Security

How a piece of software is allowed to touch a tool.

Waferira writes recipes to production tools, so the security story is mostly a control story: recipe bounds, a policy and tool-state check before every write, named approvers, an append-only audit log the fab owns, rollback to the qualified recipe, and strict IP isolation between tenants with inference kept at the fab edge.

Ask a security question Read the docs

Policy before every writeAppend-only auditPer-tenant IP isolation

Every agent action records
  • Source signals it acted on
  • Recipes, specs and procedures it retrieved, with citations
  • Predicted impact
  • Allowed range and the limit applied
  • Rollback condition
  • Responsible approver and OCAP link
  • Wafer and lot scope

Nothing is written without this record.

Guardrails

An agent that can move a recipe needs a leash

Waferira writes to production tools over SECS/GEM. Every capability is scoped to a qualified recipe window, every write is policy-checked against tool state, and every action is written to an append-only, IP-isolated audit log the fab owns.

  • Recipe bounds. Each agent writes only inside the qualified recipe window for that tool, with explicit per-parameter limits.
  • Policy and tool-state checks before every write. Autonomy level, tool state, qualification, interlocks and shift are evaluated before a recipe moves.
  • Human-in-the-loop gates. Holds, out-of-window moves and lot release wait for a named approver, with OCAP linkage on every excursion.
  • Immutable, IP-isolated audit log. Append-only and exportable. Every action records source signals, retrieved procedures with citations, predicted impact, allowed range, rollback condition, approver and lot scope.
  • Rollback. Declared rollback conditions return a recipe to its previous qualified version; loss of the edge node leaves the tool on its own controller and recipe.
  • Tenant and IP isolation. Recipes, device designs, defect libraries and process memory never cross a customer boundary. Inference and feature storage stay at the fab edge; an on-prem control plane is available for IP-sensitive fabs.

Compliance posture

ItemScopeStatus
SOC 2 Type I and fab-security reviewControl plane QUEUED Planned, first 6 months
SOC 2 Type IIControl plane QUEUED Planned, 6 to 12 months
SSO and RBACConsole and approvals QUEUED Planned, 6 to 12 months
IP-isolation and security assurance packageFab security and IT and OT review QUEUED Planned, 6 to 12 months
SEMI-standards-cited reasoningRecipes, integration specs, OCAPs RUNNING In the design, every answer cites its source
Per-tenant IP isolationData, models, memory RUNNING In the design from day one
On-prem and fab-edge deploymentIP-sensitive fabs RUNNING Design option

Read the security overview

Data

What data exists and who can see it

The data strategy from the architecture: lot-based, labelled in the fab, synthetic only for rare events, governed per tenant.

Sources

  • Inline optical inspection, e-beam and SEM review, reticle inspection
  • Overlay, CD and film metrology; FDC and tool-sensor streams
  • Recipes, APC moves, MES and WIP state, AMHS events
  • OCAPs, engineer labels and approvals, wafer and lot outcomes

Governance

  • Per-tenant isolation for recipes, device designs, defect libraries, models and memory
  • Explicit model lineage, model cards and dataset versioning
  • Federated or privacy-preserving transfer only where customer contracts allow, and planned rather than in place
  • Synthetic data used only to augment rare defects and excursions, validated against real distributions
  • Inference and feature storage at the fab edge; on-prem control plane available
Tool safety

The write path

What has to be true before a recipe moves.

  1. A declared tool. The agent can only call tools declared with their parameters, units and limits.
  2. A policy decision. Autonomy level, tool state, qualification, interlocks and shift are evaluated.
  3. A simulated check. Where the agent is configured with verify=twin, the move is simulated on the fab twin before it is written.
  4. An approval, if required. Holds, out-of-window moves and lot release wait for the named approver, with the OCAP linked.
  5. A bounded write. The SECS/GEM connector enforces the qualified recipe window and per-parameter limits again at the tool boundary.
  6. A record. The action, its evidence and its outcome are appended to the IP-isolated audit log and the lot genealogy.
  7. A rollback path. Declared rollback conditions return the recipe to its previous qualified version; the tool never depends on the edge node to run.
Autonomy

Four levels, set per agent and per tool

A fab does not go from manual APC to unattended control in one step. Waferira makes the level explicit, auditable and reversible at any time. The first release runs shadow mode, then assist mode, then graduated autonomy for low-risk APC, defect and metrology loops.

Autonomy levels and the human role at each
LevelWhat the agent doesWhat the human doesWhere it sits in a pilot
L1 · AdvisoryRecommends recipe moves, dispositions and dispatch, with citationsEnters every change manuallyShadow mode, first on the design-partner cell
L2 · SupervisedProposes a recipe write or hold; it executes on approvalApproves each move in the review consoleAssist mode, where accuracy and ROI are proven
L3 · BoundedWrites inside the qualified recipe window, tool-state checks and OCAP linkageApproves holds, out-of-window moves and lot releaseGraduated autonomy for low-risk APC, defect and metrology loops
L4 · Qualified loopsRuns a qualified loop without prompting, inside its envelopeSets the envelope; reviews the shift recordPlanned; reserved for loops the fab has qualified
Run timeline · scenario

One scenario run, step by step

Every Waferira run is an ordered, inspectable sequence. This is run_7b2e9c on Module M2 · 300 mm · metal-1 · lot L-48213. Scenario completes in 10 steps with one approval gate. Overlay and CD predicted inside spec, one reticle-repeater signature caught and held for review, dispatch re-optimised, lot released with full genealogy.

run_7b2e9c Module M2 · 300 mm · metal-1 · lot L-48213 illustrative scenario SUCCEEDED
  1. 01 ingest.lot SUCCEEDED 0.7 s

    Fab Orchestrator · Pulled lot L-48213 from fab MES: 25 wafers, 300 mm, metal-1 layer, route, reticle, overlay and CD spec and the standing cycle-time target. Locked the target envelope for the run.

  2. 02 twin.simulate SUCCEEDED 38 s

    Fab Twin · Simulated 64 candidate correctable, recipe and dispatch sets on the as-run fab twin and ranked them on predicted overlay residual, CD uniformity, excursion risk and cycle time.

  3. 03 litho.correctables SUCCEEDED 1 m 20 s

    Litho-and-Overlay · Per-field overlay correctables and a focus-dose trim written to scanner SCN-07 over SECS/GEM after the previous lot's residual trended toward the control limit. Predicted overlay residual back inside spec.

  4. 04 etch.uniformity SUCCEEDED 58 s

    Etch-and-Depo · Chamber B on etcher ETCH-12 showed an edge-fast uniformity drift in FDC. Pressure and RF trims written within the qualified recipe window; predicted CD uniformity recovered.

  5. 05 cmp.removal SUCCEEDED 46 s

    CMP-and-Implant · Downforce and platen-speed trim on CMP-03 against the virtual removal-rate estimate to hold post-CMP thickness and dishing inside the window.

  6. 06 inspect.classify SUCCEEDED continuous

    Defect-and-Inspect · Inline optical, e-beam review and SEM imagery fused at the tool edge. 1,412 events classified, most dispositioned nuisance; one reticle-repeater signature on three dies flagged for review.

  7. 07 vm.score SUCCEEDED 2.1 s

    Metrology-and-Virtual · Virtual metrology scored every wafer at post-etch and post-CMP from tool-sensor and FDC signatures. Two wafers routed to physical metrology on predicted variance; the rest sampled at plan.

  8. 08 approve.human APPROVAL 1 m 04 s

    Fab Orchestrator · The reticle-repeater signature called for a reticle inspection hold and a recipe move outside the qualified window. Held for the module process engineer and approved at 03:14:27.

  9. 09 dispatch.route SUCCEEDED 4.3 s

    Yield-and-Dispatch · Dispatch re-optimised across 1,840 lots in WIP under reticle, chamber and qualification constraints. The lot routed to the qualified chamber with the shortest predicted queue; AMHS move issued to the stocker.

  10. 10 lot.release SUCCEEDED 1 m 05 s

    Quality-and-Conformance · Lot L-48213 moved on: genealogy written (recipe moves, correctables, FDC signatures, VM scores, defect map, approvals) and checked against the layer spec.

Tool calls · scenario

What the audit log looks like

Every tool invocation, argument and result is written to an append-only, IP-isolated, human-readable log, and every reasoning step is expandable. Nothing about a run is hidden from the fab.

tool-call stream · run_7b2e9c
  1. 03:02:10mes.read_lot({ lot: "L-48213", layer: "M1", module: "M2" })
  2. 03:02:11ok 25 wafers · reticle R-M1-114 · overlay and CD spec locked
  3. 03:02:11twin.simulate({ candidates: 64, horizon: "lot" })
  4. 03:02:49ok best set #41 · overlay residual 2.6 nm · excursion risk 0.05
  5. 03:02:50policy.evaluate({ set: 41, autonomy: "L3" })
  6. 03:02:50ok 7 recipe writes inside qualified window · 1 move requires human approval
  7. 03:02:51secs.write_recipe({ tool: "SCN-07", correctables: "per_field", dose: "-0.3%" })
  8. 03:04:11ok predicted overlay residual 3.1 → 2.6 nm · CD on target
  9. 03:04:12secs.write_recipe({ tool: "ETCH-12", chamber: "B", pressure: "+1.5%", rf: "-0.8%" })
  10. 03:05:10ok edge-fast drift cleared · predicted uniformity inside window
  11. 03:05:11secs.write_recipe({ tool: "CMP-03", downforce: "-2%", platen: "+1%" })
  12. 03:05:57ok virtual removal rate on target · dishing inside window
  13. 03:05:58vision.stream({ tools: ["INS-02", "EB-01", "SEM-04"] })
  14. 03:09:40repeater: 3 dies · same field position · reticle R-M1-114 · killer class
  15. 03:09:41vm.predict({ lot: "L-48213", steps: ["post_etch", "post_cmp"] })
  16. 03:09:43ok 25 wafers scored · 2 routed to physical metrology
  17. 03:09:44approval.request({ action: "reticle_hold", recipe_move: "outside_window" })
  18. 03:14:27ok approved by module process engineer · OCAP linked · logged
  19. 03:14:28cuopt.dispatch({ wip: 1840, constraints: ["reticle", "chamber", "qual"] })
  20. 03:14:32ok lot routed to ETCH-12/B · AMHS move to stocker ST-14
  21. 03:14:33amhs.move({ foup: "F-20911", to: "ST-14" })
  22. 03:15:21ok carrier delivered · handling exceptions 0
  23. 03:15:22mes.log_lot({ lot: "L-48213", genealogy: "full" })
  24. 03:16:27ok scenario complete · 10 steps · 1 hold reviewed · released

Reasoning trace

Plan, thought, action, observation, exactly as the orchestrator would record it.

GoalRun lot L-48213 through metal-1 on module M2, hold overlay and…

Run lot L-48213 through metal-1 on module M2, hold overlay and CD inside the layer spec, catch any excursion before physical metrology, and dispatch on cycle-time target.

PlanSimulate the lot on the twin first. Lead with litho so the cor…

Simulate the lot on the twin first. Lead with litho so the correctables are right before etch, then trim etch and CMP against virtual metrology, keep inspection continuous, and hold anything outside the qualified window for a human.

ThoughtThe previous lot's overlay residual on SCN-07 trended toward t…

The previous lot's overlay residual on SCN-07 trended toward the control limit. On the twin, a per-field correctable update with a small dose trim brings the predicted residual back to 2.6 nm without touching focus.

Actiontwin.simulate(candidates=64) returns set #41: per-field correc…

twin.simulate(candidates=64) returns set #41: per-field correctables and dose minus 0.3% on SCN-07, chamber B pressure and RF trims on ETCH-12, downforce minus 2% on CMP-03.

ObservationSet #41 predicts overlay residual 2.6 nm, CD uniformity inside…

Set #41 predicts overlay residual 2.6 nm, CD uniformity inside window and excursion risk 0.05. Nine candidates cut cycle time further but routed the lot to an unqualified chamber and were discarded.

ActionExecute set #41 under autonomy level L3: seven recipe writes i…

Execute set #41 under autonomy level L3: seven recipe writes inside the qualified window, the reticle hold and the out-of-window move routed to the module process engineer.

ObservationReticle-repeater signature on three dies at 03:09:40 from the …

Reticle-repeater signature on three dies at 03:09:40 from the fused inspection stream. Virtual metrology routed two wafers to physical measurement on predicted variance.

OutcomeScenario complete. Overlay and CD predicted inside spec, the r…

Scenario complete. Overlay and CD predicted inside spec, the repeater held and reviewed with the OCAP linked, the lot dispatched to a qualified chamber and released with full genealogy.

Enterprise

Standardise autonomy across the group

One policy model, one audit trail, one benchmark across every module in every fab, with the process, device and yield models kept private to each site.

Talk to us Enterprise details

  • SSO and role-based access down to the recipe parameter, planned for the 6 to 12 month release
  • Group-wide autonomy policy with per-fab override and approval chains
  • Cross-fab benchmarking on yield, excursions, cycle time and virtual-metrology accuracy without moving recipes across tenants
  • On-prem control plane and fab-edge deployment for IP-sensitive fabs
  • Edge autonomy that survives control-plane loss by leaving each tool on its own controller and qualified recipe
  • Dedicated deployment engineer and quarterly model review per fab
FAQ

Straight answers

The questions fab directors and process engineers ask in the first meeting.

Yes, over SECS/GEM, but only inside the qualified recipe window for that tool, with per-parameter limits and tool-state checks, and only at the autonomy level your fab has set. Level 1 is advisory: Waferira recommends and an engineer enters everything. Design partners start there, in shadow mode.

Get started

Send us your security questionnaire

We answer plainly, including where an item is planned rather than done.

Contact Enterprise