Beat 01
Process IP is the crown jewel
A recipe leak is worse than an outage. Every architectural decision starts from keeping recipes, panel designs and defect imagery inside the tenant.
Security
Your process IP is the asset we are trusted with
Recipes, panel designs and defect images are the most valuable data in the fab. Isolation, encryption, governance and an air-gapped option are the baseline, not a tier.
- Tenant isolation
- SSO / RBAC
- Immutable audit
- Air-gapped option
Reviewed by IT/OT and IP teams before a single tool is connected
Gen-8.6 OLED fabFlexible OLED module lineAutomotive display makermicroLED pilot lineAR/VR microdisplay groupLTPS array fab
Threat model
What we assume
Beat 02
The plant network is not the internet
OT segmentation is real and non-negotiable. The fab edge runtime is designed to work with no outbound path at all.
Beat 03
Control paths are safety-relevant
Write-back to tools and robotic handling is treated as a safety-adjacent surface with fail-safe stops and explicit authorisation.
Beat 04
Audits will come
Customer audits, field returns and reliability investigations all require reconstructing decisions years later. The audit log is designed for that, not for debugging.
# closed loop, one panel
perceive substrate → tft → emitter stack → sub-pixel
plan deposition · anneal · transfer · test/bin
act recipe write-back (SECS-GEM)
sense mura ΔL* · sub-pixel opens · particles
optimise yield · ramp · scrap
log immutable audit entry ✓ signed
retrain engineer correction → model
Controls
Defence in layers
Each layer assumes the one above it may fail.
Step 1 of 6 · identity
Identity
SSO from your directory, RBAC mapped to fab roles, least privilege by default.
Step 2 of 6 · isolation
Isolation
Per-tenant data separation for recipes, designs, imagery and models.
Step 3 of 6 · encryption
Encryption
In transit and at rest, with key management aligned to your policy.
Step 4 of 6 · network
Network
OT segmentation respected; on-prem and air-gapped deployment supported.
Step 5 of 6 · control
Control safety
Authorised, idempotent write-back with fail-safe stop on every path.
Step 6 of 6 · audit
Audit
Immutable, signed decision records with model version and approver.
Controls
What is in place
Per-tenant isolation
Your recipes, panel designs, defect images and models never mix with another tenant's.
Encryption in transit and at rest
Standard, enforced, and documented for your review.
SSO and RBAC
Identity federated from your directory with fab-role-aware permissions.
Immutable audit log
Yield- and quality-grade records that cannot be silently rewritten.
On-prem / air-gapped
Full operation with no outbound connectivity.
Fleet learning without IP transfer
Model improvements travel across the fleet; your data does not.
Air-gapped
The loop runs with nothing leaving the plant
In air-gapped mode the control plane is local, models are delivered through your own media process, and telemetry stays inside the fab.
# deployment profile
mode air-gapped
outbound none
control-plane local
model-updates operator-delivered, signed bundles
telemetry retained on-site
audit-export on-demand, signed
Safety
Fail-safe is a design requirement, not a feature
Any path that can move a tool or a panel can be stopped. Degradation is always toward less autonomy, never toward acting on a weak signal.
- Fail-safe stop on every control path
- Auto-degrade from autonomy to advisory on confidence loss
- Idempotent, replay-safe agent steps
- Known-good-state return for robotic handling
# closed loop, one panel
perceive substrate → tft → emitter stack → sub-pixel
plan deposition · anneal · transfer · test/bin
act recipe write-back (SECS-GEM)
sense mura ΔL* · sub-pixel opens · particles
optimise yield · ramp · scrap
log immutable audit entry ✓ signed
retrain engineer correction → model
Data handling
What is stored, where and why
If a data class is not needed for a decision or an audit, it is not collected.
| Data class | Location | Purpose |
|---|---|---|
| Recipes and setpoints | Your tenant / on-prem | Control and reconstruction |
| Panel designs | Your tenant / on-prem | Perception context |
| Defect and inspection imagery | Your tenant / on-prem | Classification and training |
| Metrology and telemetry | Your tenant / on-prem | Drift attribution |
| Decision audit records | Your tenant / on-prem | Quality and customer audits |
| Model weights and versions | Tenant-scoped | Rollout, rollback, reconstruction |
Security FAQ
What IT/OT asks first
Through three gates. Shadow mode observes and predicts with no write-back; advisory mode recommends recipe, transfer and binning moves that a process-integration or yield engineer approves; graduated autonomy releases low-risk deposition, anneal and transfer control once measured accuracy and twin validation clear the bar. High-impact decisions stay human-in-the-loop.
Per-tenant isolation with recipes, panel designs and defect images scoped to your tenant, encryption in transit and at rest, SSO/RBAC, an immutable yield/quality-grade audit log and an on-prem or air-gapped option. Fleet learning shares model improvements, never your recipes.
The fab edge runtime keeps running without the cloud, agent steps are idempotent, and every control path has a fail-safe stop that returns tools and robotic handling to a known-good state. Degradation drops autonomy back to advisory rather than acting on a weak signal.
Voices from the line
What the fab floor tells us
“We do not lose panels because nobody is watching. We lose them because the signal that mattered was buried under a thousand nuisance calls.”
“Ramp is the whole game. If a new product takes two quarters of manual tuning, that is two quarters of margin we never get back.”
“Transfer yield is our ceiling on microLED. Every dead emitter is a repair cycle or a scrapped backplane.”
Quotes are illustrative composites drawn from discovery interviews with process-integration, yield and quality engineers. Named references are [PLACEHOLDER] pending design-partner consent.
The economics
What the loop is measured on
Emiteon is priced and evaluated on the numbers a fab already reports. These are design-partner targets for the first twelve months of deployment.
$26BDisplay-fab automation, process control, inspection, test and fab software market
~14%Annual growth in the segments Emiteon plays in
135%Net revenue retention target from land-and-expand
99.9%Uptime target for the fab edge runtime
Figures marked as targets are design-partner objectives, not audited results. Company operating status, customers and outcomes are [ASPIRATIONAL] until independently verified.
FAQ
Questions fabs ask first
Through three gates. Shadow mode observes and predicts with no write-back; advisory mode recommends recipe, transfer and binning moves that a process-integration or yield engineer approves; graduated autonomy releases low-risk deposition, anneal and transfer control once measured accuracy and twin validation clear the bar. High-impact decisions stay human-in-the-loop.
Reducing false calls is the wedge, not a side effect. The mura-and-defect agent is trained on true-versus-false-call labels from your own inspection history, so it separates genuine large-area non-uniformity, sub-pixel opens and shorts, particles and stains from nuisance signals, and every call is traceable to the evidence behind it.
Per-tenant isolation with recipes, panel designs and defect images scoped to your tenant, encryption in transit and at rest, SSO/RBAC, an immutable yield/quality-grade audit log and an on-prem or air-gapped option. Fleet learning shares model improvements, never your recipes.
Deposition, photolithography, encapsulation and anneal tools, Mura/AOI inspection and metrology, array and cell test, mass-transfer and repair stations, robotic handling and MES — vendor-neutral via SECS-GEM/HSMS where the tool supports it, with REST and OPC-UA bridges elsewhere.
Every pixel, perfectly uniform.
Send us your security questionnaire
We would rather answer it before the pilot than during it.