How Semiconductors Are Made: From Sand to Chip, Step by Step

Semiconductors are made by refining quartz into silicon, purifying that silicon into polysilicon, growing it into a single crystal ingot and slicing the ingot into wafers. A fab then builds transistors and wiring on each wafer through hundreds of repeated rounds of deposition, lithography, etch, doping and polishing, which takes about 12 weeks on average. Finally the wafer is tested, cut into dies and packaged into finished chips.

That short answer hides one of the longest and most specialised supply chains in industry. This guide walks it from the quarry to the package, one stage at a time, using figures only from primary sources: the US Geological Survey, the US Department of Energy, NIST and the CHIPS for America program, the IEEE International Roadmap for Devices and Systems (IRDS), the Semiconductor Industry Association (SIA), SEMI, JEDEC, the UCIe consortium, and the chipmakers' and toolmakers' own pages for their own technology. It goes one level deeper than our smartphone build guide, which covers chips in a single section, and it ends with the part of the story Safeguard actually works on: the software that runs fabs, tools and finished devices.

This describes how the industry works, not a recipe: fabs handle hazardous gases and acids under strict controls, so the chemistry stays at the level of what happens and why.

Key takeaways

• Silicon starts as quartz. USGS says China produced almost 80 percent of the world's silicon materials in 2025.
• Purity is the hard part. Polysilicon for chip wafers must be about 1,000 times purer than the grade used for solar panels, according to the SIA and Boston Consulting Group (BCG) 2021 supply chain study.
• The crystal is grown, not cast. The Czochralski process pulls a single crystal ingot from molten silicon; wire saws slice it into wafers.
• Front end fabrication is a loop. Deposition, lithography, etch and doping repeat layer after layer: 400 to 1,400 steps and about 12 weeks on average, per SIA and BCG.
• EUV prints the finest layers. ASML's EUV systems use 13.5 nm light. Its 0.33 NA systems resolve 13 nm features; its 0.55 NA (High NA) systems resolve 8 nm.
• Node names are labels, not measurements. The 2023 IRDS says there is not yet a consensus on node naming across manufacturers and describes nodes by gate pitch and metal pitch instead.
• Transistors went from flat to fins to stacked sheets. FinFET gates touch three sides of the channel; gate-all-around nanosheets are surrounded. Samsung began GAA production on 30 June 2022.
• Packaging is now a front line technology. Chiplets (UCIe) and memory stacks (JEDEC HBM4, up to 16 dies high) rely on advanced packaging.
• Every step runs on software. SEMI E187 and NIST's draft IR 8546 exist because fab tool software is a supply chain of its own.

The journey at a glance: from raw material to finished chip

The table below is the whole path in one view. Each row is expanded in its own section further down.

Stage 1: How does quartz become metallurgical silicon?

Silicon never occurs as a pure element in nature. It is locked up as silica, silicon dioxide, in sand and rock. The US Geological Survey's Mineral Commodity Summaries 2026 says the source of the silicon is "silica in various natural forms, such as quartzite", and that world resources for making silicon metal and alloys are abundant and adequate for many decades.

Turning silica into silicon means removing the oxygen. Producers do this in large electric furnaces, where quartz is heated with a carbon source so the carbon pulls the oxygen away as carbon monoxide and leaves molten silicon. The product is called metallurgical grade silicon, or silicon metal. It is good enough for aluminium alloys and for silicones, which USGS lists as the main US uses, but it is far too impure for electronics.

The USGS figures show how this material splits:

USGS adds that China accounted for almost 80 percent of total global estimated production of silicon materials in 2025, that US silicon metal imports in 2025 were estimated at about 50 percent above 2024, and that silicon was added to the final 2025 US List of Critical Minerals, published in the Federal Register on 7 November 2025. In the US, ferrosilicon and silicon metal were produced at five facilities in 2025, and three companies produced polysilicon.

USGS also notes the main substitutes for silicon in semiconductor and infrared uses: gallium arsenide and germanium. Silicon dominates logic and memory because it is abundant, it forms an excellent native oxide, and the industry has spent decades learning to make it nearly perfect.

Stage 2: How is electronic grade polysilicon made (the Siemens process)?

Purification is where silicon stops being a commodity. The US Department of Energy's Solar Energy Technologies Office describes polysilicon as "a high-purity, fine-grained crystalline silicon product", made from metallurgical grade silicon, hydrogen and chlorine using highly reactive gases.

In the Siemens process, as DOE explains it:

1. Metallurgical silicon is reacted with hydrogen chloride to form a volatile silicon, hydrogen and chlorine compound. In industry this is mostly trichlorosilane.
2. The liquid is distilled repeatedly. Because most impurities, such as boron, phosphorus and metals, form compounds with different boiling points, distillation separates them out.
3. The purified gas passes over a heated silicon filament inside a reactor. The molecules break apart and silicon atoms deposit on the filament, which grows into a large U shaped rod.
4. The filament itself is made of pure silicon so it does not contaminate the rod.
5. The hydrogen and chlorine are recovered and reused in a closed cycle.

DOE also describes a second method, the fluidised bed reactor: small silicon beads float in a cone shaped vessel in a stream of silicon and hydrogen gas, grow as silicon deposits on them, and drop to the bottom when heavy enough. That route produces granular polysilicon.

The SIA and BCG study "Strengthening the Global Semiconductor Supply Chain in an Uncertain Era" (April 2021) gives two numbers that explain why this stage is so concentrated. The polysilicon used for chip wafers must have a purity "1,000 times higher" than that needed for solar panels, and it was supplied primarily by just four companies with a combined global share above 90 percent. Solar and semiconductor polysilicon start from the same chemistry, but only a small part of world output meets the electronic grade.

Stage 3: How are single crystal ingots grown (Czochralski)?

A chip needs a single crystal: every silicon atom in the wafer lined up in one continuous lattice, so electrons move predictably and defects do not short out transistors. DOE describes the Czochralski process in one sentence: polysilicon is melted, and a large cylindrical ingot of monocrystalline silicon is grown "by touching a small crystalline seed to the surface of the liquid and slowly pulling it upward".

In more detail, a Czochralski puller works like this:

1. Charge and melt. Polysilicon chunks and a measured dopant, such as boron for p type or phosphorus for n type, are melted in a quartz crucible under argon.
2. Seed. A small seed crystal with the desired orientation is dipped into the melt.
3. Neck. A thin neck is pulled first so dislocations from the thermal shock grow out.
4. Body. The diameter widens to the target and the crystal is drawn slowly while seed and crucible counter rotate to keep temperature and dopant even.
5. Tail and cool. The end is tapered to a cone and the ingot is cooled slowly.

DOE notes the other route used for solar: directional solidification, where the melt cools from the bottom up into a large grained multicrystalline ingot. That is acceptable for many solar cells but not for logic and memory chips, which need the single crystal.

How is an ingot sliced into wafers?

DOE says ingots are sliced into very thin wafers using diamond coated wire saws, and the silicon sawdust created is called kerf. Before slicing, the ingot is ground to an exact diameter and marked with a notch so every later tool knows the crystal orientation. After slicing, the wafers are edge rounded, lapped and etched to remove saw damage, polished to a mirror finish and cleaned. The SIA and BCG study describes wafers as "cleaned, polished, and oxidized in preparation for circuit imprinting". Some wafers also get a thin epitaxial layer of fresh crystal grown on top.

ASML, which builds lithography systems, says the 300 mm wafer is the size most often used in semiconductor manufacturing, and that "some wafers can contain thousands of chips, while others contain just a few dozen". The SIA and BCG study gives the same range from the other end: about a hundred large processors per wafer, or hundreds of thousands of very small, simple chips.

Worked example 1: how many dies fit on a 300 mm wafer?

A common first estimate of gross dies per wafer subtracts the partial dies lost around the round edge:

dies per wafer ≈ (π × d²) / (4 × S)  minus  (π × d) / √(2 × S)

d = wafer diameter in mm, S = die area in mm²

For a 300 mm wafer and a 100 mm² die (10 mm by 10 mm):

area term  = (3.1416 × 300²) / (4 × 100) = 282,743 / 400 ≈ 707
edge term  = (3.1416 × 300) / √200       = 942.5 / 14.14 ≈ 67
gross dies ≈ 707 − 67 = 640

For a large 600 mm² accelerator die, the same formula gives about 118 minus 27, so roughly 90 gross dies. That is why big processors land at "about a hundred" per wafer, as the SIA and BCG study says, while tiny sensor or power chips reach the hundreds of thousands. Real counts are a little lower because of scribe lanes between dies and an edge exclusion zone. This is an illustrative estimate, not a figure from any fab.

Stage 4: The front end, where transistors are built

The front end of line is the part of fabrication that builds the transistors themselves in the top layer of the silicon. The SIA and BCG study summarises the loop in five steps: oxidation and coating, lithography, etching, doping, and metal deposition and etching, with "steps 1-4 ... repeated hundreds of times" for different layers. ASML's own explainer lists the same core sequence as deposition, photoresist, lithography, etch and ion implantation. All of it happens in cleanrooms: SIA and BCG point out that typical urban outdoor air holds about 35,000,000 particles of 0.5 micron or larger per cubic metre, while a chip cleanroom permits zero particles of that size.

Oxidation

Heating silicon in oxygen or steam grows a clean silicon dioxide insulator from the wafer itself, used for isolation and protective layers. Modern gate insulators are deposited "high-k" materials instead, because oxide thin enough for today's transistors would leak.

Deposition

ASML describes deposition as laying down thin films of "conducting, isolating or semiconducting materials" so the next layer can be printed. The main families are:

• Chemical vapour deposition (CVD): gases react on the hot wafer to leave films such as silicon nitride.
• Physical vapour deposition (PVD): atoms sputtered off a metal target form barrier and seed layers.
• Atomic layer deposition (ALD): films built one atomic layer at a time, for even coatings inside deep 3D structures.
• Epitaxy: new crystal grown on the old, such as the stacked layers that become gate-all-around nanosheets.
• Electroplating: copper plated into trenches for wiring.

Photoresist

The wafer is coated with a light sensitive film called photoresist. ASML explains the two kinds: with positive resist, exposed areas become more soluble; with negative resist, exposed areas harden. Positive resist is most common in chipmaking because of its higher resolution.

Photolithography: DUV and EUV

Lithography decides how small features can be. In ASML's words, the wafer is exposed to deep ultraviolet (DUV) or extreme ultraviolet (EUV) light with a wavelength "anywhere from 365 nm for less complex chip designs to 13.5 nm". Light passes through, or in EUV reflects off, a reticle (the mask that holds one layer's pattern), and optics shrink the pattern onto the resist. ASML adds that the reticle pattern is often deliberately distorted using models and measurement data, a practice called computational lithography, so that what prints matches the design.

EUV is a very different machine from DUV. On ASML's EUV product pages:

• EUV light is made by a CO2 laser firing two pulses at a falling drop of tin, which vaporises it into a plasma that emits 13.5 nm light, up to 50,000 times per second.
• EUV light is absorbed by everything, even air, so the whole light path from source to wafer is in high vacuum.
• Instead of lenses, several multilayer mirrors guide the light and shrink the reticle pattern by a factor of four, and the reticle itself is a multilayer reflector.
• The wafer stage positions the wafer to within a quarter of a nanometre for each exposure, checking and adjusting 20,000 times per second.
• EUV is used for "the most intricate layers on a chip", with the rest printed by DUV systems. ASML says both will be needed in parallel for many years.

ASML says the EXE:5200B can print features 1.7 times smaller in a single exposure than NXE systems, giving transistor densities 2.9 times higher. That matters because the alternative, multiple patterning, uses several DUV exposures and etches to make one fine layer, which adds steps, cost and chances for defects.

EUV took decades: ASML shipped the first demonstration tools in August 2006 and says it invested more than 6 billion euros in EUV research and development over 17 years.

Etch

After the resist is developed, etch transfers the pattern into the film underneath. ASML describes two kinds: dry etch uses gases (usually a plasma) and wet etch uses chemical baths. Dry plasma etch is directional, so it can cut tall, straight walled trenches. ASML notes that some 3D NAND memory designs have reached up to 175 layers, which makes controlling the depth of each etch harder with every generation. The fluorinated gases used in plasma etch and in cleaning deposition chambers are potent greenhouse gases, which is why the US EPA's Greenhouse Gas Reporting Program has a dedicated Subpart I for electronics manufacturing facilities above its reporting threshold.

Doping: ion implantation and anneal

Pure silicon conducts poorly. Adding tiny, exact amounts of other elements turns regions into n type or p type material, which is how sources, drains and wells are formed. ASML describes ion implantation as bombarding the wafer with ions to tune the electrical properties of part of the pattern. The SIA and BCG study names boron and arsenic as examples and adds that "subsequent annealing" spreads the impurities to a more uniform density. The anneal, a fast, carefully controlled heating step, also repairs crystal damage from the implant.

Chemical mechanical planarisation (CMP) and cleaning

Every layer leaves the surface a little uneven, and lithography needs a flat surface to focus. CMP presses the wafer face down on a rotating pad with a chemical slurry that softens and grinds the top layer flat. It is also how copper wiring is formed: copper is plated over the whole surface and then polished back so it remains only in the trenches. Between almost every step the wafer is cleaned with ultrapure water and chemical baths to remove particles and residues, which is why ultrapure water use is so large in fabs.

Worked example 2: why defect density decides cost

A simple way to see why cleanrooms and inspection matter is the Poisson yield model, which estimates the share of dies with zero killer defects:

yield ≈ e^(−D × A)

D = killer defect density (defects per cm²), A = die area (cm²)

With the same illustrative defect density of 0.1 per cm²:

small die, 1 cm²:   yield ≈ e^(−0.1)  ≈ 0.905   →  about 90% good
large die, 6 cm²:   yield ≈ e^(−0.6)  ≈ 0.549   →  about 55% good

Combine that with worked example 1. A 300 mm wafer gives about 640 gross 1 cm² dies, so roughly 579 good ones, but only about 90 gross 6 cm² dies, so roughly 49 good ones. Halving the defect density to 0.05 per cm² lifts the large die yield to about 74 percent. This is the economic case for chiplets in the next section: several small dies yield far better than one huge die. The numbers are illustrative, chosen to show the shape of the trade, not any fab's actual yields.

What is a process node name, and why does it no longer match a physical size?

For decades the node name described a real dimension, roughly the length of the transistor gate, and each new node shrank it by about 0.7 times so the area per transistor halved. That link broke long ago. Gate lengths stopped shrinking at the same pace while designers kept increasing density by other means: tighter wiring pitches, smaller standard cells, 3D transistors, and design and technology co-optimisation.

The industry's own roadmap says so directly. The 2023 IRDS More Moore chapter states that "there is not yet a consensus on the node naming across different foundries and integrated device manufacturers". Instead of a single number, the IRDS describes each future logic generation with a "GxxMxx/Tx" label: Gxx is the contacted gate pitch in nanometres, Mxx the tightest metal pitch, and Tx the number of stacked device tiers. The roadmap adds that area scaling also depends on cell height, the number of stacked devices, design constructs and 3D integration, not only on pitch.

The clearest public example of the gap between names and dimensions is Intel's. In a Form 8-K filed with the SEC about its 26 July 2021 roadmap update, Intel said it introduced "a new naming structure" for its process nodes: the process previously called 10nm Enhanced SuperFin became "Intel 7", and the process previously called Intel 7nm became "Intel 4". The same update introduced future nodes Intel 3 and Intel 20A, along with RibbonFET (its gate-all-around transistor) and PowerVia (its backside power delivery).

ASML's EUV page uses the word the way the industry does: each new generation is "often referred to as a 'node'". Read it as a product generation label.

What are FinFET and gate-all-around transistors?

A transistor is a switch: a gate controls whether current flows through a channel between the source and drain. The smaller the transistor, the harder it is for the gate to shut the channel off completely, so current leaks even when the switch is "off". Each new transistor shape is about giving the gate more grip on the channel.

• Planar transistors put a flat gate on top of a flat channel. The gate controls the channel from one side.
• FinFETs stand the channel up as a thin vertical fin and wrap the gate over its top and both sides. The 2023 IRDS describes the FinFET's "tall narrow channel that is controlled by a gate from three-sides". FinFETs became the mainstream leading edge device in the 2010s, and the IRDS projected that FinFET could sustain scaling until about 2025.
• Gate-all-around (GAA) transistors turn the channel into horizontal sheets or wires stacked on top of each other, with the gate material filling the space all around each one. The IRDS says lateral GAA devices bring better electrostatics than FinFET by giving "gate control from all-sides of device channel", and that a transition to lateral GAA started in 2022.
• Complementary FET (CFET) is the next step the IRDS projects: stacking the n type device directly over the p type device, which saves area in each logic cell.

Three manufacturers have described their GAA processes on their own pages:

• Samsung announced on 30 June 2022 that it had started initial production of its 3 nm node using GAA, which it calls MBCFET. Samsung said its nanosheets have wider channels than nanowires and that channel width can be tuned for power or performance. Against its 5 nm process it claimed up to 45 percent lower power, 23 percent higher performance and 16 percent smaller area for the first generation.
• TSMC says its N2 technology features its first generation nanosheet transistors and "has started volume production in 4Q25 as planned". Its technology page describes A16 as combining nanosheet transistors with a backside power rail.
• Intel named RibbonFET as its GAA transistor and PowerVia as its backside power approach in the July 2021 update recorded in its 8-K.

Backside power delivery, mentioned by both Intel and TSMC, is a related change. Normally power and signal wires share the stack of metal layers above the transistors. Moving power to the back of the wafer frees space for signals and shortens the power path.

Stage 5: The back end, from wiring to packaged chip

Back end of line: the interconnect

Once the transistors exist, the wafer stays in the fab for the back end of line, which builds the wiring. The SIA and BCG study describes it as a similar process "used to lay down the metal links between transistors". A modern logic chip has a dozen or more metal layers: the lowest ones are the finest and most tightly packed, and the upper ones are thicker for power and long distance signals. Copper is deposited into trenches etched in low dielectric constant insulators and polished flat by CMP, then capped, and the cycle repeats.

Wafer test (probe or sort)

Each finished die is then tested through a probe card that touches its pads, building a wafer map of good and bad dies. Fuses may be programmed here to record identifiers or select redundant memory rows.

Dicing

ASML describes the next step plainly: the wafer is "sliced and diced with a diamond saw into individual chips", called dies.

Packaging and final test

ASML explains that the die is placed on a substrate, a base that uses metal traces to route signals to the rest of the system, and a heat spreader is placed on top. The connection from die to substrate is either fine wires bonded to pads or, for most high performance chips, small solder bumps on the face of the die, which is flipped onto the substrate. The package is sealed, marked and given a final test, often at several temperatures, before it ships.

The SIA and BCG study calls this assembly, packaging and test (ATP) stage less capital intensive and more labour intensive than wafer fabrication, at about 13 percent of industry capital expenditure and 6 percent of value added in 2019. It says the stage is "concentrated primarily in Taiwan and mainland China", with new facilities in Malaysia, Vietnam and the Philippines.

Advanced packaging: chiplets and HBM stacks

Advanced packaging is the reason the back end is now strategic. NIST's CHIPS National Advanced Packaging Manufacturing Program (NAPMP) defines it as "many chips with diverse functions assembled tightly together on a substrate in two or three dimensions at extremely fine dimensions", and says recent advances in AI "would not be possible without advanced packaging". The program lists the open problems: making tightly packed chips behave like one large chip, supplying power to and removing heat from such assemblies, and checking reliability when visual inspection is no longer possible.

The main approaches are:

• 2.5D packaging: several dies sit side by side on a silicon interposer or bridge with very fine wiring between them.
• 3D stacking: dies are stacked on top of each other and joined with through silicon vias (vertical copper connections through the die) and fine pitch bumps or direct hybrid bonding of copper pads.
• Chiplets: a large design is split into smaller dies, possibly from different processes, and joined in one package. Worked example 2 shows the yield reason.

Two open standards show how this is being made interoperable:

• UCIe (Universal Chiplet Interconnect Express) specifies the die to die physical layer, protocols and software model so chiplets from different vendors can work together, building on PCI Express and CXL. The consortium says UCIe 2.0 added a manageability and test architecture and 3D packaging support, with bump pitches from 10 to 25 microns down to 1 micron or less for hybrid bonding. UCIe 3.0 adds 48 and 64 GT/s data rates, double the 32 GT/s of UCIe 2.0.
• HBM (High Bandwidth Memory) stacks DRAM dies on a base die beside the processor. JEDEC published the HBM4 standard, JESD270-4, on 16 April 2025. JEDEC's release gives transfer speeds up to 8 Gb/s across a 2048 bit interface for up to 2 TB/s per stack, 32 independent channels (double HBM3's 16), and stacks of 4, 8, 12 or 16 dies of 24 Gb or 32 Gb, for up to 64 GB per stack.

Our memory evolution guide covers how HBM fits alongside DDR and CXL, and the bus evolution guide covers the PCI Express and CXL layers that UCIe borrows from.

How long does a wafer take from start to finish?

The SIA and BCG study gives the clearest public figures. Depending on the product there are 400 to 1,400 steps; the average time to fabricate finished wafers, called cycle time, is about 12 weeks; and it "can take up to 14-20 weeks" for advanced processes. ASML's explainer frames it from design to production: the whole process "consists of thousands of steps and can take more than three months". The two descriptions measure slightly different things (fab cycle time versus the full flow), so the honest summary is three months or more inside the fab, plus packaging and test, plus the design and mask making that come before.

Add the upstream stages and the full path from quarry to shipped chip is many months. That is one reason chip shortages last.

How much water and power does a fab use?

Official public figures are reported per company, not per chip, and this guide uses only those. The richest primary data comes from manufacturers' own annual and sustainability reports.

Water. TSMC's 2024 Annual Report gives total water use for its fabs in Taiwan and subsidiaries, counting city and reclaimed water, of 129 million cubic metres in 2024, up from 114 million in 2023. It tracks unit water use in litres per 12 inch equivalent wafer mask layer, with a 2030 goal of cutting it 30 percent from a 2010 base, and reports that unit use rose 14.3 percent in 2024 against a target of a 2.7 percent cut, which it marks as not achieved. The same report says that by the end of 2024 more than 19.65 million cubic metres of reclaimed water had been used from its Southern Taiwan Science Park reclaimed water plant, which it describes as the first private water reclamation plant in Taiwan. Most of a fab's water becomes ultrapure water for rinsing wafers between steps, which is why reuse and reclamation matter so much.

Power and emissions. The same report sets a target of 60 percent of electricity from renewable sources by 2030 and says contracted renewable capacity reached 4 GW by the end of 2024. It reports that greenhouse gas emissions per unit of product rose in 2024 against its reduction target, and attributes the miss to the growth of advanced process capacity. That fits the physics: EUV light sources, vacuum systems, cleanroom air handling and abatement all draw large amounts of power, and advanced nodes add steps.

Process gases. Fluorinated gases used in etch and chamber cleaning are covered by the EPA's Greenhouse Gas Reporting Program under Subpart I, Electronics Manufacturing, which sets how facilities above the threshold calculate and report emissions.

This guide does not quote a water or energy figure per chip: no official source we found publishes one, and it varies enormously between a microcontroller and a large accelerator.

Where in the world does each step happen?

The SIA and BCG 2021 study and USGS together give an official map by stage. These are shares by region and stage, not a ranking of companies.

The 2021 study also counted more than 50 points across the supply chain where one region holds more than 65 percent of global share, and recalled that the 2011 Japan earthquake and tsunami affected 25 percent of world silicon wafer production. The May 2024 follow up, "Emerging Resilience in the Semiconductor Supply Chain", projects US fab capacity growing 203 percent by 2032 and estimates global semiconductor capital spending of 2.3 trillion dollars over the coming decade, with 646 billion dollars of it in the US.

Public money is part of that shift. NIST's CHIPS for America pages say the CHIPS and Science Act of 2022 gave the Department of Commerce 50 billion dollars: 39 billion through the CHIPS Program Office for manufacturing incentives and 11 billion through the CHIPS Research and Development Office, which runs programs such as the NAPMP. Our post on what Taiwan's chip filings say looks at one region in more depth.

A dated timeline of the milestones in this guide

Fab software, equipment firmware and why they are a supply chain

Every machine in this story is also a computer. A lithography scanner, an etch chamber, an ion implanter, a wafer prober and the automated material handling system that moves wafer carriers between them all run operating systems, firmware, drivers, recipe files and vendor applications, and the fab ties them together with manufacturing execution, equipment automation and data analysis software. SEMI's E187 standard, first published in January 2022, sets baseline cybersecurity requirements for fab equipment that runs Windows or Linux, covering design, operation and maintenance, and is aimed at equipment suppliers and system integrators; it excludes PLCs and SCADA devices. NIST's draft IR 8546, a Cybersecurity Framework 2.0 profile for semiconductor manufacturing released as an initial public draft on 27 February 2025, builds on the NIST manufacturing profile and describes an ecosystem of device makers, equipment makers, suppliers and solution providers. Each of those parties ships software that contains open source components, and those components need the same inventory and patching as any other software. Our guides to SBOMs for fab machines and firmware and what to inspect first in a fab go further.

Step by step: read the chip inventory of your own machine

You cannot see inside a chip without a lab, but you can read what your own hardware reports about itself, which is the first step of any hardware and firmware inventory. Every command below only reads information; none changes the system.

1. Identify the processor on Linux.

lscpu | head -20
grep -m1 "model name" /proc/cpuinfo

2. Identify the processor on macOS.

sysctl -n machdep.cpu.brand_string
system_profiler SPHardwareDataType

3. Identify the processor on Windows (PowerShell).

Get-CimInstance Win32_Processor | Select-Object Name, Manufacturer, NumberOfCores

4. List the other chips on the buses (Linux). Each PCI device line shows a vendor and device ID.

lspci -nn
lsusb

5. Read firmware versions reported by devices (Linux with fwupd).

fwupdmgr get-devices

6. Read the system firmware and board data (Linux, needs root).

sudo dmidecode -t bios -t baseboard -t processor

7. Record what you found. A CycloneDX document can describe hardware with the device component type and firmware with the firmware type, alongside the software components of the same product. A minimal fragment looks like this:

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "components": [
    { "type": "device", "name": "example-soc", "version": "rev-b1" },
    { "type": "firmware", "name": "example-board-firmware", "version": "2.14.0" }
  ]
}

8. Scan the software side. The operating system image, drivers packaging, tooling and applications that run on the machine are where open source dependencies live, and that part can be scanned. With the Safeguard CLI, a source directory, a container image or an existing SBOM can each be scanned, with results written as JSON under ./output:

safeguard scan --dir .
safeguard scan --image registry.example.com/fab-tools/recipe-service:1.8
safeguard scan --sbom ./product-sbom.cdx.json

Our guide to hardware and firmware supply chain inventory explains how to keep these records current.

Where Safeguard fits, honestly

Safeguard does not make chips, analyse wafers, model processes, scan firmware binaries or generate hardware bills of materials. Its models are single purpose security models, not physics or chemistry tools. Where it helps is the software around this story: the applications, services and container images that fab software teams, equipment makers and device makers build. For those, Safeguard scans repositories, images and SBOM files, matches components against vulnerability data, shows which projects contain a given component and version, ranks findings with reachability analysis, enforces policies and gates, and can open fix pull requests through autonomous remediation, which ships switched off by default.

Common mistakes

• Treating a node name as a dimension. "3 nm" is not a 3 nm feature. Compare published density, power and performance figures for the same design, and remember the IRDS says naming has no industry consensus.
• Assuming solar polysilicon and chip polysilicon are interchangeable. The SIA and BCG study puts the purity gap at about 1,000 times, and the supply base for the electronic grade is far narrower.
• Equating EUV with "all layers". ASML says EUV prints the most intricate layers and DUV prints the rest. Most layers on most chips are still DUV.
• Forgetting the back end. Packaging, test and advanced packaging are where AI accelerators and HBM stacks come together, and ATP is concentrated in a different set of places from wafer fabrication.
• Quoting per chip water or energy numbers. Official sources report per company or per fab. A per chip figure without a primary source is usually an estimate built on assumptions.
• Reading cycle time as lead time. About 12 weeks is fab time for a wafer. Lead time for a part adds packaging, test, logistics and queueing, and can be far longer.
• Ignoring tool software. Equipment that runs a general purpose operating system needs patching and inventory like any other server. SEMI E187 exists for exactly this reason.

FAQ

Is a computer chip really made from sand?

Yes, in the sense that the silicon comes from silica, the main mineral in quartz sand and quartzite. USGS names quartzite as the source. Ordinary beach sand is usually too impure, so producers use high purity quartz, and the silicon then goes through smelting, chemical purification and crystal growth before it becomes a wafer.

What is the Siemens process in simple terms?

It is the main way to make ultra pure polysilicon. Impure silicon is turned into a silicon, hydrogen and chlorine gas, the gas is purified by distillation, and silicon is deposited back out of it onto heated silicon rods. DOE notes the hydrogen and chlorine are reused in a closed cycle.

What is the Czochralski method used for?

It grows a single crystal silicon ingot from melted polysilicon by dipping a seed crystal into the melt and slowly pulling it up while rotating. The ingot is then sliced into the wafers chips are built on.

How many steps does it take to make a chip?

The SIA and BCG study counts 400 to 1,400 manufacturing steps depending on the product, with core steps repeated hundreds of times. ASML describes the full process as thousands of steps.

How long does it take to make a semiconductor chip?

About 12 weeks on average for wafer fabrication, and up to 14 to 20 weeks for advanced processes, according to SIA and BCG. Packaging and test come after that, and ASML puts the whole process at more than three months from design to production.

What is the difference between DUV and EUV lithography?

DUV uses longer ultraviolet wavelengths and focuses them with lenses. EUV uses 13.5 nm light that air absorbs, so it runs in vacuum with mirrors, and ASML says it can print 13 nm features (0.33 NA) or 8 nm features (0.55 NA High NA).

What does "3 nm" or "2 nm" actually mean?

It is a generation label chosen by the manufacturer, not a measured dimension. The IRDS describes processes by contacted gate pitch and tightest metal pitch instead, and Intel's 2021 renaming shows that names can change while the process stays the same.

What is the difference between FinFET and gate-all-around?

A FinFET channel is a vertical fin with the gate on three sides. A gate-all-around channel is a stack of horizontal sheets with the gate on all sides, which gives better control and lower leakage at small sizes. The IRDS says the transition to GAA started in 2022.

Why supply chain hygiene still matters here

The silicon itself carries no software dependencies, but the software that runs fabs, test cells, equipment front ends and the finished devices does, and that software pulls dependencies again with every rebuild. Fab automation services, equipment vendor applications, device firmware build systems and the apps on the finished product all carry open source components that need the same patching discipline as any other code, so the section below applies to that layer, not to the silicon.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The first demo is a real Safeguard CLI session. Asked to fix a lodash CVE, it reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with approval, prints a summary and pushes nothing. The same approve each step flow fits a dependency upgrade in a fab dashboard, a recipe management service or a test cell application written in a common language.

Click through it at your own pace, or open it full screen.

The second demo sets up the Safeguard runner on your own machine, approves it with its device code, and then scans from the terminal. For factory and equipment software teams that keep source code on internal networks, running scans on a machine you control is often the practical starting point.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use. An engineer asking which internal tools still ship a vulnerable component version can then ask in plain language, with access limited to the tools the team allowed.

Click through it at your own pace, or open it full screen.

To try it on your own code, download Safeguard or read the CLI documentation.

Quick check

Sources

• USGS Mineral Commodity Summaries 2026: Silicon (PDF)
• US Department of Energy, Solar Energy Technologies Office: Solar Photovoltaic Manufacturing Basics
• SIA and BCG: Strengthening the Global Semiconductor Supply Chain in an Uncertain Era, April 2021 (PDF)
• SIA: Emerging Resilience in the Semiconductor Supply Chain, May 2024
• ASML: Six crucial steps in semiconductor manufacturing
• ASML: EUV lithography systems
• ASML: TWINSCAN EXE:5200B
• IEEE IRDS: About the roadmap and its history
• IEEE IRDS 2023 edition: More Moore (PDF)
• Intel Corporation Form 8-K, 26 July 2021: process node naming update
• Samsung Newsroom: Samsung Begins Chip Production Using 3nm Process Technology With GAA Architecture, 30 June 2022
• TSMC: 2nm technology
• NIST CHIPS for America
• NIST CHIPS: National Advanced Packaging Manufacturing Program
• UCIe Consortium: Specifications
• JEDEC HBM4 (JESD270-4) press release, 16 April 2025, as republished by Silicon UK
• TSMC 2024 Annual Report: water management (page 159)
• TSMC 2024 Annual Report: energy and greenhouse gases (page 158)
• US EPA Greenhouse Gas Reporting Program: Subpart I, Electronics Manufacturing
• SEMI E187: Specification for Cybersecurity of Fab Equipment
• NIST IR 8546 (initial public draft): Cybersecurity Framework 2.0 Semiconductor Manufacturing Profile
• CycloneDX 1.6 JSON reference: component types

Last reviewed: 23 October 2026.