From TSMC to Tungsten: Semiconductor Supply Chain Risks

Part one of a two-part series on supply chains

May 03, 2021

Welcome to SemiLiterate, a guide to the chip industry through the lens of public policy. Feel free to share with others you think may be interested.

BLUF: This post summarizes risks identified in public comments submitted to the Bureau of Industry and Security’s March 2020 Request for Information (RFI) on “Risks in the Semiconductor Manufacturing and Advanced Packaging Supply Chain” and introduces a methodology for understanding and identifying tiers of semiconductor supply chain risk using trade data. Risks in materials and packaging deserve greater attention. Part 2 will summarize potential solutions and tradeoffs.

Introduction

In March 2020 the Bureau of Industry and Security posted a Request for Information (RFI) on “Risks in the Semiconductor Manufacturing and Advanced Packaging Supply Chain.” 96 comments were submitted. This post talks about the interesting ones.

The semiconductor supply chain is expansive, expensive, and full of chokepoints.

Depending on the specific product, there are 400 to 1,400 steps in the overall manufacturing process of semiconductor wafers. The average time to fabricate semiconductor wafers is about 12 weeks, but it can take up to 14-20 weeks.
A state-of-the-art semiconductor fab of standard capacity requires roughly $5 billion - $20 billion of CapEx, including land, building, and equipment. This is significantly higher than, for example, the estimated cost of a next-generation aircraft carrier ($13 billion) or a new nuclear power plant ($4 billion to $8 billion.
The ambient outdoor air in a typical urban area contains 35,000,000 particles of 0.5 micron or bigger in size for each cubic meter, while a semiconductor manufacturing cleanroom permits absolutely zero particles of that size…
There are more than 50 points across the overall supply chain where a single region accounts for 65% or more of the total global supply…

This regional concentration causes heartburn for policymakers in the US and Europe who are keenly interested in diversifying advanced semiconductor fabrication beyond East Asia.

Background: Who is in this Supply Chain

The semiconductor supply chain is poorly defined and poorly understood. So, before getting in to this post, I want to use a metaphor I’ve previously introduced to explain at a basic level the structure of the semiconductor supply chain: baking a cake.

Think of making a chip like baking a cake. You get out a recipe book, find the right page, pre-heat the oven, mix baking powder, flour, eggs, & sugar in a bowl, pour the batter in a pan, put that pan in the oven, and then pull it out when its done.

I like using the graphic below from the Peterson Institute for International Economics to illustrate all the different parts of the semiconductor supply chain. There are:

Companies that make ovens (“semiconductor manufacturing equipment”)
Companies that make eggs, flour & sugar (“specialized chemicals & materials”)
Companies that edit, organize, and publish recipe books, but they don’t write the recipes themselves (“EDA software”)
Companies that come up with recipes (“semiconductor designers”)
Companies that bake cakes using other company’s recipes (“foundries”)
Companies that come up with recipes AND bake their own cakes (“integrated device manufacturers”)
Companies that make sure all cakes taste and look the same (“outsourced assembly and test”)

Most talk about semiconductor supply chain risks focuses on the small number of companies that make the ovens, come up with recipes, and do the baking. What is unique about the comments BIS received is how they reveal everyone should be just as concerned about the providers of eggs, flour, and sugar.

The rest of this post will focus on understanding and identifying risks to U.S. semiconductor production in tandem with the risks stemming from the entity that is producing or providing the product.

Tiers of Supply Chain Risk: TSMC to Tungsten

The most concerning risks in any supply chain are sole and single source suppliers. “Sole source” refers to products/services for which there is literally only one supplier of the item/service whereas “single source” means a particular supplier is purposefully chosen by the buying organization, though there may be other suppliers who are available that for one reason or another (qualification time, cost) are not used.

The current conversation around semiconductor supply chain security is obsessively focused on one company (TSMC) in one country (Taiwan) because it has 92% of the world’s sub-10nm chip manufacturing. TSMC is a sole source supplier of 5nm semi manufacturing services and a single source supplier for some >5nm chips. There are other contract manufacturers of slightly less advanced chips in the world (ex. Samsung) but many fabless companies use TSMC as their single source of these contract manufacturing services. TSMC is incredibly important. But, there are supply chain risks to TSMC that are just as concerning as the global reliance on TSMC itself.

Sticking with the TSMC example, one might think of the supply chain risks in tiers:

Tier 1 risk: TSMC is the sole source of advanced logic chip production.
Tier 2 risk: TSMC relies on a sole source Extreme Ultraviolet Lithography (EUV) tool from ASML (Netherlands) for its advanced logic production.
Tier 3 risk: ASML relies on its 5000 suppliers, some of whom are single source, to provide components for its EUV machine.
Tier 4 risk: All lithography tools rely on rare gases and specialty materials from single or sole source suppliers (ex. Linde, Carl Zeiss, Wonik).
Tier 5 risk: Rare gas suppliers rely on steel factories in Ukraine and China to supply 80% or more of rare gases used in the semiconductor industry. Production of these gases is dependent on Air Separation Units (ASUs) at these factories.

To tie tiers 1 to 5: TSMC’s advanced logic chip production relies on single and sole source gases from steel plants in Ukraine and China. That is a company-level risk. But it is also an industry-level risk because (presumably) all the other major semiconductor companies rely on a handful of companies for rare gas supplies (who presumably don’t only sell to chip factories), which are in turn largely derived from steel factory operations in two countries. This is not abstract. Conflict in Ukraine in 2015 interrupted supply of Neon gas used in fabs for weeks, raising prices 500%.

Tier 1-5 risks like this exist in many of the 400-1400 steps required to process a wafer. This example of supply chain risk tiers also highlights several things:

There are product-specific, company-specific, country-specific risks.
Risks are more easily defined (and mitigated) at the Tier 1 and Tier 2 levels. These are the risks you read about in the news.
Tier 3-5 risks are difficult to identify, costly to mitigate, and require greater strategic thinking. (Should a chip factory build a steel factory just to vertically integrate its supply of rare gases? (No.))

What the Comments Say:

Comments were submitted by a huge cast of characters, reflecting this industry’s breadth. Semiconductor companies and the industry associations that represent them, universities, think tanks, Manufacturing USA consortia, the National Mining Association, the Motor Equipment Manufacturing institute, Taiwanese chemical suppliers, the American Chemical Council, and Amazon.

The easiest way to think about risks to the semiconductor supply chain is by breaking them down in to the chip production process steps each risk implicates (from SIA):

The U.S. semiconductor supply chain is leading when it comes to (non-DRAM) design, EDA, and equipment. The rest of the supply chain is heavily concentrated in Asia, with a few outliers in Europe. Other comments provide greater detail (and nice charts):

Materials:

Materials risks are extreme for specialty chemicals and gases like high purity isopropyl alcohol, Lanthanum, Cerium, Scandium, Palladium, Platinum, Ruthenium, Yttrium-oxide, Krypton, Helium, Xenon etc. There are also supply risks to specialty products like chemical mechanical planarization (CMP) pads/slurries, metal coils, wafers, quartz crucibles, graphite parts, and slicing wire. Not many American flags here (from SEMI):

EDA and Design:

US firms lead decisively in EDA & logic chip design. Risks are minimal (from SIA):

Manufacturing Equipment and Fabrication:

The US leads in most semiconductor manufacturing equipment and maintains 12% market share of worldwide chip factory capacity. Its primary weaknesses are in wafer production, chemical vapor deposition, lithography, and assembly/packaging tools, advanced logic chips, and some types of memory chips (from CSET):

Outsourced Assembly and Test (OSAT):

Of the top 10 OSAT companies, only Amkor is headquartered in the US. There are almost no contract OSAT facilities in the US, though Intel and IBM operate company-internal facilities (chart from Purdue). The US lacks production of packaging materials, printed circuit boards, and the tooling required for assembly/test.

Using Trade Data to Identify Semiconductor Supply Chain Chokepoints

Comments submitted in response to this RFI provide a wealth of information to identify chokepoints in the semiconductor supply chain while trade data offers a way to diagnose single and sole source problems. Lets use a chemical commonly used in semiconductor manufacturing as an example: ammonium paratungstate (APT). Quoting from one of the comments to BIS:

"80% of the world's tungsten mineral (APT, ammonium paratungstate) comes from China. APT is used to make tungsten hexafluoride (WF6) and tungsten (W) sputter targets. WF6 is used for the majority of all semiconductor devices. China represents about 80% of the mining production, with 95% of supply controlled by one company. There are reportedly new mining sources in Vietnam and possibly in South Korea.
There is only one WF6 manufacturing site in the U.S. owned by Japanese company. This site has no expansion capability and would need high investment to build additional plant capacity.

That seems like a very serious semiconductor supply chain risk:

Tier 1 Risk: Company B makes chips for Company A

Tier 2 Risk: Company B buys equipment from Company C

Tier 3 Risk: Company C’s equipment relies on WF6

Tier 4 Risk: WF6 is sole sourced by Company B from Company D’s US factory

Tier 5 Risk: Company D buys most of its APT from China

The conversation around semi supply chain security is currently focused on making sure Company B continues to make chips for Company A. But there are myriad deeper risks here, and its not clear whose job it is to mitigate these risks. We’re going to focus on just diagnosing the problem: this product’s supply chain dependence on China.

The first step is identifying the Harmonized Schedule code for the product you’re worried about. There are a couple different ways you could do this using official resources (like the USITC’s Commodity Description Look Up) but honestly just Google “ammonium paratungstate HS code” and it will get you there. Look for the 6-digit version and you’ll find: HS 2841.80 Metallic “Tungstates (Wolframates).” This isn’t exactly ammonium paratungstate, but it gets us started in the right direction.

Now take your HS code and plug it in to the Organization of Economic Complexity’s website. Scroll down to the data visualization section and you’ll get a lot of pretty charts. This one is particularly helpful:

Based on this data it looks like China’s share of worldwide exports of Metallic Tungstates contracted in the past 10 years as supply from Vietnam increased and it had ~55% market share in 2019. Not exactly the 80% that the BIS commenter stated.

Lets dig deeper. International trade data is all harmonized at the 6-digit level (thus the “Harmonized” Schedule) but if you look at U.S. imports or exports specifically you can get even more granular data from the Harmonized Tariff Schedule of the United States (HTSUS). In this case, you can go to Chapter 28 of the HTSUS and check to see if there are any codes related to APT at the 8 or 10-digit level. Lucky for us, when you do so, you find HTS 2841.80.00.10 “Tungstates (Wolframates) of ammonium.” Bingo.

Going now to the USITC’s DataWeb tool and looking at Imports for Consumption, pull charts for US Imports from China and US Imports from the World for 2010-20. Then, cross walk the numbers to get US Imports from China as a Percent of US Imports from the World for HTS 2841.80.00.10 from 2010-20. This is what you get:

From a supply chain risk identification perspective, this is much more helpful: we can now see that China is responsible for over 50% of US imports of APT every year since 2010 and currently accounts for almost 75% of US imports. That seems like a useful data point if you are interested in semiconductor supply chain security. So what to do?

Going back to DataWeb, we can also see who else the US is importing APT from:

That is not a very diverse supply chain. But, it looks like there may be some suppliers in Germany, Japan, and Vietnam active in the last 5 years (note: Vietnam has a notorious delay in its trade data reporting - it likely has exports for 2019 and 2020). A quick search reveals a Japanese supplier affiliated with Mitsubishi Materials Group and a Vietnamese supplier affiliated with Masan Resources. And it looks like the two entities signed a strategic cooperation agreement in late 2020. If I’m a semiconductor company looking to diversify my supply chain, that is all I need to start qualifying a new supplier. It might also be worth determining the cost of expanding the one existing WF6 production facility in the US or if stockpiling WF6 is viable.

Conclusion, Caveats, and Questions:

This analysis could be repeated many times over for a variety of products in the semiconductor supply chain: polysilicon, wafers, photomasks, printed circuit boards, test equipment and rare earths all seem like good candidates to start with.

This analysis deliberately avoids a lot of other (messier) risks: regulatory, workforce, testing capacity constraints, black swans, and natural disasters.

It raises several questions any serious supply chain analysis must contend with:

What tiers of what supply chains should a country focus on securing? Is it product-specific (memory chips?) or process-step (materials, EDA) specific?
What supply chain risks should be mitigated, what supply chain risks must be accepted because they are too expensive/expansive to mitigate?
When is the supply chain considered “secure”? Define the goal.
How broadly does one define supply chain security? Is human capital part of the supply chain? If so, what does it mean to “secure” it?
What role does regulation play as a risk in the semiconductor industry (ex. Kigali Amendment to the Montreal Protocol, Trusted Foundry program, EPA)?

Part 2 of this series will address some of these questions.

Semi-Literate