VisualPro Tech Brief
Completeness Should Not Depend on Memory
Re-verifying a semiconductor fab’s integrated safety STPA — 6 loss scenarios to 26, in half a day
Semiconductor Fab Safety Analysis | STPA and MCP in Practice | Project Report
STPAMCP IntegrationTraceability DBClass CoverageSemiconductor Fab
01Overview (TL;DR) — What Changed in Half a Day
We re-verified an existing STPA analysis of a semiconductor fab’s integrated fire, gas and facility safety control structure. It runs from the safety center operator (EHS/FMS Operator) through the central FMS/GMS supervisory server and the field safety interlock PLC out to three equipment groups: cleanroom HVAC and scrubber exhaust, OHT material handling, and specialty gas and chemical supply valves — with control actions and feedback defined as a diagram.
The method mattered. Working over VisualPro STPA’s MCP (Model Context Protocol) integration, an AI agent performed every query, registration and edit, while the human contribution was semantic judgment only. Zero GUI operations.
| Cumulative metric | Initial (original) | Final (Rev 2.1) |
|---|
| Loss scenarios | 6 (100% failure-based) | 26 (6 failure / 20 non-failure) |
| UCAs | 8 | 15 |
| Hazards / system constraints | 5 / 5 | 6 / 6 |
| Hazards with a broken trace chain | 1 (H-5) | 0 |
The central finding of the re-verification was not the new scenarios. It was where the existing analysis had been concentrated. All six original scenarios were failure-based, and the Responsibility family (Class 1, C1–C4) — the one that covers design judgment and regulatory obligation — was entirely empty. All seven findings that followed were derived backwards out of that gap.
The tool tells you what still needs analyzing — so completeness no longer depends on the analyst’s diligence.
[ [Figure 1] VisualPro Control Structure — the fab’s integrated safety control structure (control actions in red, feedback in blue). Every arrow in this diagram is where the 15 UCAs and 26 loss scenarios attach. Screen labels are in Korean, as the project data is. ]
02What Made It Possible — Three Things
1MCP Integration — A Natural-Language Instruction Is the STPA WorkAutomation
VisualPro embeds an MCP server, so an AI agent reaches the tool’s data model directly. In this exercise the human input was natural language — “check the consistency,” “register these scenarios” — while the actual queries, registrations and edits ran as API commands over 15 STPA entity types (loss, hazard, uca, loss_scenario, five relation types, and so on).
· Registered by the agent in this session: 1 hazard, 1 system constraint, 7 UCAs, 20 loss scenarios, and roughly 50 relation links
· Every command is two-step — describe (fetch the spec) then execute — so the agent learns the schema itself and registers without malformed input: zero batch registration errors
· UCA IDs (UCA-N-9, UCA-P-13) and scenario numbers are assigned automatically by type rule — no manual numbering at all
2A Traceability Database — Consistency Audit Becomes a QueryAuditability
VisualPro stores STPA data as bidirectional relations: Loss → Hazard → UCA → Loss Scenario → Countermeasure. So the audit question “where is the chain broken?” is not a manual cross-check but a few relation queries. The same mechanism verified all 20 Loss↔Hazard bidirectional links exhaustively — a check that document-based analysis usually never performs at all.
3Class Archetype Coverage — The Gaps Become a NumberCompleteness
Because every scenario carries its Class tag as data, “which of the 66 archetype cases are empty?” comes out immediately as a matrix. In spreadsheet-based work, numbering, linkage and typing degrade as scenarios multiply and coverage falls back on the analyst’s memory. On a data model, traceability, IDs and relations hold at 26 scenarios — and gaps, breaks and skew get quantified by query.
03Three Structural Defects Found by Query Alone
Found at the start of the exercise, by relation query alone. None of them is “the analysis is wrong” — all three are “the analysis is empty.”
| Defect found | How it surfaced | Action |
|---|
| Hazard H-5 (emergency power loss) had 0 UCAs and 0 scenarios — trace fully broken | One relation query per hazard | Chain restored by registering LS-11 and LS-23 |
| UCA-3 and UCA-7 had no loss scenarios | UCA↔scenario cross-check | Identified as targets for follow-up scenarios |
| Control action “emergency manual shutoff” (operator) had no UCA | Control action↔UCA mapping | Resolved by adding UCA-9 and UCA-10 |
[ [Figure 2] VisualPro Trace View — the Loss → Hazard → UCA → Loss Scenario → Countermeasure chain. LS-13 in this chain was registered by the AI agent during this exercise; it joined the trace chain immediately and became queryable and auditable like any pre-existing record. Screen labels are in Korean, as the project data is. ]
04Seven Accident Paths the Gaps Taught Us
Every one of them holds even when all components are healthy and every test passes. Each is expressed as an audit question answerable from documents in about an hour, and any question that comes back “no” is a live accident path.
| # | Finding | Why it gets missed | Class |
|---|
| 14 | Fire mode vs gas mode — the regulations fight each other | Fire protection and gas safety have different codes, different design contractors, different drawings; the cross-review never happens | 1-C4 |
| 15 | An unreleased Force tag — the ghost of commissioning | Force state shows only deep in a diagnostic screen, and logic review reads source, not output overrides | 1-C23 |
| 16 | A default that reads “no signal” as normal | Design review examines “what if the value is wrong,” rarely “what is our policy when no value arrives” | 1-C20 |
| 17 | Stale mapping after a fab retrofit — the MOC blind spot | The value is correct, so no self-diagnostic can catch it. What is wrong is not the data but the coordinate system | 2-C7 |
| 18 | The restoration trap — re-energizing is riskier than the outage | Outage drills and UPS tests cover the moment power dies. The order in which things come back is not tested | 3-C7 |
| 19 | Instrument air as a common cause | Every component is healthy and every single-device test passes. “All zones actuating at once” is in no test procedure | 3-C11 |
| 20 | The schedule’s betrayal — a calendar does not know about emergencies | The scheduler is not treated as a control element, so it never appears in the interlock matrix | 4-C11 |
Case 1 — Fire mode vs gas mode (A-Ha #14)
A fire signal from the fire alarm panel mandates HVAC shutdown and fire damper closure under fire code, to stop smoke spread. But in a gas fire, stopping exhaust means gas accumulation and secondary explosion risk. Fire code and gas safety demand the opposite action from the same damper — a conflict at the level of regulation.
1SiH4 (silane) leaks slightly at a gas piping flange; because silane self-ignites on air contact, a localized fire starts with it.
2The fire panel detects fire, and the code-driven interlock automatically executes HVAC shutdown and fire damper closure.
3At the same moment the gas detection system registers the leak — the safety PLC should be commanding emergency exhaust to maximum.
4But the fire damper on the exhaust path has already been closed by the fire logic. The PLC’s exhaust command is physically void.
5Unburned gas accumulates and concentrates indoors, raising secondary explosion risk (H-1) — the result of two safety logics each acting “correctly.”
Audit question When fire and gas signals arrive together, is the damper and exhaust priority written into the design documentation?
Case 2 — Instrument air as a common cause (A-Ha #19)
When every zone’s pneumatic valves and dampers actuate simultaneously in an emergency, instrument air (IA) header pressure drops and some shutoff valves fail to close within their required time. Routine testing actuates one valve at a time, so this is never detected.
1Routine valve function tests run one valve at a time. IA demand always has margin and the test always passes.
2A real emergency arrives — a large leak trips every zone’s interlock at once.
3Dozens of pneumatic valves and dampers begin actuating together, and IA header pressure falls sharply.
4Starved of air, some valves lack actuation torque and fail to close fully within the required time (left partly open).
5The system tallies “shutoff complete,” while gas keeps flowing through the partly open line (H-1).
Audit question Has the IA demand for an all-zone simultaneous actuation scenario ever been calculated or demonstrated by test?
05The Three-Step Workflow and the Audit Checklist
The seven findings did not come out of a brainstorming session. They came out of a procedure run on data. What the tool handled at each step is what makes the method reproducible.
| Step | The expert’s role | VisualPro’s role |
|---|
| 1. Tagging audit | Compare case text against the causal structure of each scenario, for meaning | Query all 26 scenarios with tags and links instantly; a mistagging fix (LS-8) applied in one save |
| 2. Coverage matrix | Select, among the gaps, the families that can genuinely occur in a fab | Compute the 66-case × 26-scenario mapping automatically from Class tag data |
| 3. Backward derivation and registration | Substitute domain entities into the %slots%, design the audit questions | Batch-register new UCAs, scenarios and relations; auto-assign IDs; link traceability at once |
The point The expert’s time went entirely into judgment of meaning. As querying, cross-check preparation, registration and numbering moved to the tool, the same half-day carried the analysis from a 6-scenario system to a 26-scenario one.
The Deliverable Is the Action List — Design Audit Checklist
| # | Audit question | Document to check | Related |
|---|
| 1 | Is damper priority documented for simultaneous fire and gas signals? | Fire interlock design doc, interlock matrix | LS-20 |
| 2 | Is there continuous monitoring of PLC Force tags and a shift-handover check? | PLC operating procedure, shift log | LS-26 |
| 3 | On communication timeout, is the tag quality policy “alarm”? | PLC logic standard, tag database | LS-21 |
| 4 | Does equipment relocation MOC include updating the safety mapping? | MOC procedure, mapping table history | LS-22 |
| 5 | Has the power restoration sequence been documented and tested? | Restoration procedure, restart test records | LS-23 |
| 6 | Has all-zone simultaneous IA demand been calculated and demonstrated? | Instrument air capacity calculation | LS-24 |
| 7 | Do scheduled actions have an emergency-state hold condition? | Automatic test schedule settings, interlock list | LS-25 |
06Capability and Effect
The effects observed in this project, mapped to the capability that produced them. Every figure is measured from this session.
| VisualPro capability | Effect in this exercise |
|---|
| MCP server (AI agent integration) | Natural language to STPA query, registration and edit. Whole exercise in half a day with zero GUI operations |
| Loss-to-Countermeasure traceability model | Three structural defects — H-5 trace break, missing control action UCA — found by query alone |
| Bidirectional relation data | Exhaustive cross-verification of all 20 Loss↔Hazard relations — a check usually skipped in document analysis |
| UCA type system (N/P/T/S) with auto IDs | ID and type consistency held while UCAs grew to 15; zero manual numbering |
| Support for scenarios not tied to a UCA | Autonomous process behavior (Class 4) and delivery failure (Class 3) families accepted as first-class data |
| Two-step describe/execute API | The agent confirms the schema before registering — zero errors across 20 batch registrations |
07Frequently Asked Questions (FAQ)
Q1What is VisualPro’s MCP integration?
VisualPro embeds an MCP (Model Context Protocol) server so that an AI agent such as Claude reaches the STPA, FMEA, FTA, HARA and TARA data models directly. The user instructs in natural language; the agent performs queries, registrations and edits through the tool’s API commands. The whole of this exercise ran that way.
Q2Can data registered by an AI be trusted?
Two mechanisms. First, every command returns its required fields and rules at the describe step, so the agent cannot submit data that does not fit the schema — batch registration errors in this session were zero. Second, re-querying after registration to verify the result is standard procedure. Semantic validity remains the expert’s job, through the tagging audit.
Q3What is the decisive difference from spreadsheet-based STPA?
Traceability exists as data. Completeness questions — “which hazard has no scenario?”, “which control action is unanalyzed?” — are answered by query. Finding the H-5 trace break and the empty Responsibility family in this exercise is the demonstration. On documents, the same question demands an exhaustive manual cross-check.
Q4What improves if we adopt this workflow?
Expert time shifts from mechanical work — querying, registering, numbering, maintaining links — to judgment of meaning: whether a scenario is valid, whether the design holds. On this case, expanding the scenario system from 6 to 26 and completing the consistency audit took half a day.
Q5Does the same approach work for analyses other than STPA?
Yes. The VisualPro MCP server exposes commands for FMEA, FTA (including cut sets and PMHF calculation), HARA (including the Hyundai Motor standard) and TARA in addition to STPA, so the same natural language, query and register, verify workflow applies across safety analysis.
08Start Now (Next Step)
The hard part of STPA is not learning the technique. It is knowing how far the analysis has come and what is still empty. Manage it in documents and the answer to that question lives in the analyst’s memory; manage it as data and the answer comes back as a query result. Start with VisualPro — proven in semiconductors, automotive, defense, aviation and robotics — and make completeness a property of the structure rather than of anyone’s diligence.
Completeness as a property of the structure, not of anyone’s diligence — VisualPro STPA.
This brief summarizes a re-verification performed by VWAY’s Solution Division in collaboration with an AI agent over VisualPro STPA’s MCP integration. The cumulative data set (6 hazards, 15 UCAs, 26 loss scenarios) can be inspected with its traceability in the Semicon.vsa project.
VisualPro Inquiries & Demo
We re-verified an existing STPA analysis of a semiconductor fab’s integrated fire, gas and facility safety control structure. It runs from the safety center operator (EHS/FMS Operator) through the central FMS/GMS supervisory server and the field safety interlock PLC out to three equipment groups: cleanroom HVAC and scrubber exhaust, OHT material handling, and specialty gas and chemical supply valves — with control actions and feedback defined as a diagram.
The method mattered. Working over VisualPro STPA’s MCP (Model Context Protocol) integration, an AI agent performed every query, registration and edit, while the human contribution was semantic judgment only. Zero GUI operations.
The central finding of the re-verification was not the new scenarios. It was where the existing analysis had been concentrated. All six original scenarios were failure-based, and the Responsibility family (Class 1, C1–C4) — the one that covers design judgment and regulatory obligation — was entirely empty. All seven findings that followed were derived backwards out of that gap.
· Registered by the agent in this session: 1 hazard, 1 system constraint, 7 UCAs, 20 loss scenarios, and roughly 50 relation links
· Every command is two-step — describe (fetch the spec) then execute — so the agent learns the schema itself and registers without malformed input: zero batch registration errors
· UCA IDs (UCA-N-9, UCA-P-13) and scenario numbers are assigned automatically by type rule — no manual numbering at all
Found at the start of the exercise, by relation query alone. None of them is “the analysis is wrong” — all three are “the analysis is empty.”
Every one of them holds even when all components are healthy and every test passes. Each is expressed as an audit question answerable from documents in about an hour, and any question that comes back “no” is a live accident path.
The seven findings did not come out of a brainstorming session. They came out of a procedure run on data. What the tool handled at each step is what makes the method reproducible.
The effects observed in this project, mapped to the capability that produced them. Every figure is measured from this session.
The hard part of STPA is not learning the technique. It is knowing how far the analysis has come and what is still empty. Manage it in documents and the answer to that question lives in the analyst’s memory; manage it as data and the answer comes back as a query result. Start with VisualPro — proven in semiconductors, automotive, defense, aviation and robotics — and make completeness a property of the structure rather than of anyone’s diligence.