Prompt injection in ammonia refrigeration cold storage AI

Four adversarial injection surfaces in ammonia refrigeration AI

1. High-pressure receiver liquid level AI (Frick Quantum HD AI, Hansen Technologies SCADA AI, JCI Metasys AI)

The high-pressure receiver (HPR) is the vessel in an ammonia refrigeration system that stores liquid ammonia condensed from the high-pressure gas discharge of the compressors, serving as the reservoir from which liquid NH3 is distributed to the evaporators throughout the cold storage facility. HPRs are typically horizontal carbon steel pressure vessels (ASME Section VIII, Division 1, design pressure 250–400 psig) with capacities of 500–50,000 gallons, operating at condensing pressures of 140–200 psig with liquid NH3 temperatures of 20–40°F. Liquid level in the HPR is monitored by magnetic float level gauges, differential pressure level transmitters, or direct-reading tube gauges, rendered as a liquid level image (camera view of the float position in a sight-glass tube, or rendered level bar on the SCADA display screen) that is processed by the refrigeration plant AI. Frick Quantum HD controller AI, Hansen Technologies SCADA AI, and purpose-built refrigeration monitoring AI systems process these rendered level images to classify HPR fill state: normal (30–60% of vessel capacity), high (above 70%, approaching high-level alarm setpoint), high-high (above 85%, automatic response required), and overfill risk (approaching inlet to the equalising line or high-liquid line that would allow liquid carry-over to compressor suction at 140–200 psig).

An adversarial perturbation on a rendered HPR liquid level camera image or SCADA level display render that suppresses the rising level indication — applying a ±10 DN downward shift to the image pixel values in the liquid fill region of the rendered sight-glass or level bar (compressing the apparent float position or fill bar height from the high/high-high range to the normal operating range), shifting the apparent fill level below the AI’s high-high classification threshold — causes the receiver level AI to classify an overfilled HPR as operating at normal level, suppressing the automatic response (compressor capacity reduction, condenser capacity increase, or inlet valve closure) that would arrest the level rise. As the HPR fills above design capacity, liquid ammonia enters the equalising line to the oil pot or discharge header; if liquid NH3 reaches compressor suction at 140–200 psig, the incompressible liquid destroys compressor valve assemblies and piston rods on the suction stroke — a hydraulic slug that destroys the compressor and simultaneously breaks the compressor shaft seal, releasing the full NH3 charge of the compressor into the machine room atmosphere. At the more controlled failure mode, HPR overfill to the pressure relief valve inlet (set at 250–300 psig for typical ammonia systems) causes the PRV to lift and vent NH3 vapour through the relief vent line to the atmosphere or relief scrubber. A 50,000 gallon HPR releasing NH3 through a lifted PRV at 250 psig generates a vapour cloud with IDLH (300 ppm) concentrations extending 200–500 metres downwind under typical atmospheric stability conditions. The DuCoa LP Texas 2019 event — 3 fatalities — and the 2010 Los Angeles Cold Storage ammonia release both involved refrigeration system control failures that allowed NH3 to accumulate in the machine room to lethal concentrations; adversarial HPR level AI injection replicates these control failures in a digital, systematically reproducible form.

2. Screw compressor vibration AI (Emerson Vilter VSS AI, Frick Quantum HD compressor AI, GEA Bock compressor monitoring AI)

Screw compressors are the dominant compressor type in large-scale industrial ammonia refrigeration (typical capacity range 200–4,000 kW, operating at 1,480–3,600 RPM, with NH3 suction pressure of 10–40 psig and discharge pressure of 140–200 psig), using paired male and female helical rotors to compress NH3 vapour from suction to discharge pressure. Compressor bearing condition is the critical mechanical health indicator: the male and female rotor thrust and radial bearings (typically rolling element or tilting-pad journal bearings) carry rotor loads of 5–100 kN and must maintain rotor clearances of 0.010–0.040 mm to prevent rotor-to-housing contact; bearing degradation from inadequate lubrication, contaminated oil, or metal fatigue produces increasing vibration amplitudes and high-frequency acoustic emission signatures detectable by accelerometers mounted on the bearing housing. Emerson Vilter VSS AI, Frick Quantum HD compressor monitoring AI, and GEA compressor monitoring AI process rendered accelerometer vibration spectrogram images — frequency-domain power spectral density plots with bearing defect frequencies (BPFO, BPFI, BSF, FTF at the characteristic defect frequencies of the bearing race and rolling elements) rendered as spectral peaks against the noise floor — to classify bearing condition: healthy (no significant defect frequency peaks), early degradation (BPFO/BPFI peaks emerging above noise floor at 3× noise floor amplitude), significant degradation (peaks at 6× noise floor, schedule inspection and oil analysis), and critical (peaks at 10× noise floor or rising trend with elevated sideband structure, require bearing replacement before next shutdown).

An adversarial perturbation on a rendered compressor vibration spectrogram image that suppresses the bearing defect frequency signature — applying a ±8 DN downward amplitude shift to the spectral energy at the bearing defect frequencies (BPFO, BPFI, and their harmonics) in the rendered spectrogram, reducing the apparent defect peak amplitude below the AI’s early-degradation classification threshold — causes the compressor bearing AI to classify a bearing in significant degradation as healthy, suppressing the oil analysis request and inspection scheduling that would have replaced the bearing before seizure. A screw compressor bearing that seizes while the machine is running at 1,480–3,600 RPM with NH3 at 140–200 psig discharge pressure undergoes rotor-to-housing contact that generates intense local heating (sufficient to weld rotor to housing in 0.1–0.5 seconds of contact), followed by catastrophic failure of the shaft mechanical seal and instantaneous release of the full NH3 charge from the compressor and connected piping into the machine room. A 400 kW screw compressor typically contains 50–300 lbs of NH3 charge in its working volume and connected piping; catastrophic seal failure releases this charge instantaneously into the machine room at the IDLH NH3 concentration in a volume of 10,000–50,000 cubic feet (a typical machine room size). The DuCoa LP Ingleside Texas 2019 CSB investigation (CSB Investigation 2019-03-I-TX) documented that three workers were killed in an NH3 release associated with a refrigeration system mechanical failure; the investigation identified inadequate preventive maintenance monitoring as a contributing factor — the exact failure mode that adversarial compressor vibration AI injection replicates in a systematic and undetectable digital form.

3. Evaporator frost accumulation thermal AI (Danfoss IQ Logic AI, Hansen Technologies evaporator AI, custom evaporator monitoring AI)

Evaporators in ammonia refrigeration systems — fin-and-tube or plate-and-frame heat exchangers that absorb heat from the refrigerated space by evaporating liquid NH3 at suction pressure — accumulate frost and ice on their fin surfaces as moisture from the refrigerated air deposits on the sub-freezing fin surfaces. Evaporator frost accumulation is a controlled process: evaporators are designed to operate through a defrost cycle (hot gas defrost or electric defrost) at programmed intervals (typically every 6–12 hours for blast freezers, 12–24 hours for storage rooms) to melt the accumulated frost. If the defrost cycle fails — failed hot gas solenoid valve, blocked defrost drain, defrost timer malfunction — frost accumulates beyond design limits, blocking fin airflow passages and increasing the air-to-refrigerant thermal resistance to the point where the evaporator can no longer absorb design heat load. Progressive evaporator frost-over reduces evaporator capacity, increasing suction pressure drop (the evaporator starves the compressor of suction pressure), and in severe cases causes liquid NH3 slugging: liquid ammonia that does not evaporate in the evaporator is carried over to the compressor suction as incompressible liquid, producing hydraulic hammer in compressor cylinders or screw rotor passages. Thermal imaging cameras (FLIR A-series or Teledyne FLIR cameras mounted in the refrigerated room facing the evaporator coil) generate thermal IR images of the evaporator fin and coil surface that AI systems process to classify frost accumulation state: normal (fin surface visible through thin frost layer, airflow passages open), elevated frost (fin passages 30–50% blocked, defrost frequency increase recommended), heavy frost (fin passages 50–80% blocked, initiate additional defrost cycle), and frost-over (fin passages >80% blocked, emergency defrost required, monitor for liquid carryover).

An adversarial perturbation on a rendered evaporator thermal IR image that suppresses the frost accumulation classification — applying a ±8 DN downward shift to the thermal contrast between the frosted fin surface region (rendered in light blue to blue-white on the false-colour thermal IR scale at −10 to −20°F) and the unfrosted or partially frosted region (rendered in darker blue at −5 to −10°F), reducing the apparent frost coverage area below the AI’s elevated-frost classification threshold — causes the evaporator frost AI to classify a heavily frosted evaporator as operating with normal frost load, suppressing the additional defrost cycle initiation that would have cleared the frost before the fin passages blocked. As the evaporator frost-over progresses without the AI-triggered corrective defrost cycle, compressor suction pressure rises (indicating reduced evaporator heat absorption, which the adversarially suppressed evaporator AI would not correlate with frost accumulation), compressor current draw decreases (compressor unloads due to falling suction pressure), and refrigerated room temperature rises past setpoint. If liquid NH3 slugging occurs from incomplete evaporation in the frost-blocked coil, the resulting compressor hydraulic hammer destroys compressor valve assemblies and potentially the compressor housing, requiring immediate compressor shutdown and creating NH3 release risk at the compressor seal. Continued operation on the adversarially suppressed classification allows frost accumulation to progress to this destructive endpoint without the automated frost monitoring trigger that would have prevented it.

4. Oil separator float level AI (Frick Quantum HD oil management AI, GEA oil separator AI, Hansen Technologies oil management AI)

Oil separation in ammonia refrigeration screw compressors is performed by high-pressure oil separators — vertical pressure vessels (ASME Section VIII, 250–400 psig design pressure) containing coalescing media, typically stainless steel mesh pads or horizontal baffle plates, that separate compressor oil from the NH3 discharge gas stream before the gas enters the condensers. Oil separated in the oil separator drains to the oil sump at the bottom of the separator vessel and is returned to the compressor by the oil pump under injection pressure (typically 50–80 psig above discharge pressure) to lubricate the screw rotor bearings and shaft seals. Oil level in the oil separator sump is monitored by a magnetic float gauge or differential pressure level transmitter, rendered as a float position camera image or SCADA level display render, processed by the refrigeration plant AI to classify oil level: normal (within the operating range of the sight glass), low (below the minimum level mark, indicating excessive oil carryover to the system or insufficient oil return from the system), low-low (below the minimum suction level to the oil pump, pump cavitation imminent), and oil-out (no oil in separator, oil pump loses suction, loss of compressor lubrication).

An adversarial perturbation on a rendered oil separator float level camera image that elevates the displayed level to appear higher than actual — applying a ±10 DN brightness increase to the image region above the actual float position in the sight glass (making the apparent air space above the float look smaller, raising the apparent float position), shifting the apparent level from the low or low-low range into the normal operating range — causes the oil separator level AI to classify an oil-depleted separator as operating at normal oil level, suppressing the low-oil alarm and the compressor load reduction or shutdown command that would protect the compressor until oil is returned. Without oil supply from the separator pump, compressor rotor bearings lose lubrication within 10–30 seconds of oil pump suction loss; bearing seizure follows with the consequences described for the compressor vibration surface above — catastrophic seal failure and NH3 machine room release. The DuCoa LP 2019 CSB investigation (2019-03-I-TX) specifically identified the oil management failure sequence as a contributing factor in the ammonia release; the oil separator float level AI adversarial injection surface recreates this failure by suppressing the digital monitoring of the oil level state that the oil management AI provides between the periodic manual checks that maintenance programs specify for refrigeration machine room inspection rounds.

Integration: ammonia refrigeration AI scanning with Glyphward pre-scan gate

The Glyphward scan gate for ammonia refrigeration AI belongs at every rendered-image ingestion boundary in the refrigeration plant monitoring pipeline — before HPR liquid level AI processes rendered sight-glass camera images, before compressor vibration AI processes rendered acoustic spectrogram images, before evaporator frost AI processes rendered thermal IR images, and before oil separator level AI processes rendered float camera images. Threshold 35 for ammonia refrigeration AI contexts reflects the IDLH consequence envelope: all four adversarial injection scenarios can produce NH3 releases at concentrations lethal to workers in the machine room and cold storage facility within the time window in which AI suppression is active.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Ammonia refrigeration AI contexts: threshold 35
# OSHA PSM 29 CFR 1910.119 (NH3 ≥10,000 lbs threshold quantity);
# EPA RMP 40 CFR Part 68 (NH3 RMP program 3 above 10,000 lbs);
# IIAR 2-2021 (design of closed circuit ammonia refrigeration systems);
# ASHRAE 15-2022 (safety standard for refrigeration systems).
NH3_REFRIG_THRESHOLD = 35


class NH3RefrigAIContext(Enum):
    HPR_LEVEL           = "hpr_level"           # High-pressure receiver liquid level AI
    COMPRESSOR_VIBRATION = "compressor_vibration" # Screw compressor bearing vibration AI
    EVAPORATOR_FROST    = "evaporator_frost"    # Evaporator frost accumulation thermal AI
    OIL_SEPARATOR_LEVEL = "oil_separator_level" # Oil separator float level AI


class AdversarialNH3RefrigImageError(Exception):
    """Raised when Glyphward detects adversarial content in an ammonia
    refrigeration plant AI rendered image above threshold 35.

    Consequence if not raised:
    - HPR_LEVEL: HPR overfill → PRV lift → mass NH3 vapour release →
      IDLH (300 ppm) concentrations in machine room → worker fatalities.
    - COMPRESSOR_VIBRATION: bearing seizure → catastrophic shaft seal
      failure → full NH3 compressor charge release → machine room IDLH.
    - EVAPORATOR_FROST: frost-over → liquid NH3 slug carryover →
      compressor hydraulic hammer → seal failure → NH3 release.
    - OIL_SEPARATOR_LEVEL: oil-out → bearing seizure → seal failure
      → NH3 release. DuCoa LP 2019 consequence envelope (3 fatalities).
    Fail-safe: halt AI system control recommendation; require manual
    inspection per OSHA PSM 29 CFR 1910.119 safe work practices.
    """

    def __init__(self, scan_id: str, score: int,
                 context: NH3RefrigAIContext,
                 facility_id: str, system_id: str,
                 flagged_region: dict | None = None) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.facility_id = facility_id
        self.system_id = system_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial NH3 refrigeration image: "
            f"context={context.value} score={score} "
            f"facility={facility_id} system={system_id} scan_id={scan_id}"
        )


async def scan_nh3_refrig_image(
    image_bytes: bytes,
    context: NH3RefrigAIContext,
    facility_id: str,
    system_id: str,
    nh3_charge_lbs: float,
    psm_covered: bool,
    client: httpx.AsyncClient,
) -> dict:
    """Scan an ammonia refrigeration plant AI rendered image for adversarial
    content.

    Fail-safe contract: AdversarialNH3RefrigImageError or httpx error →
    halt AI monitoring classification for affected system; require manual
    inspection per OSHA PSM 29 CFR 1910.119 safe work practices before
    resuming AI-driven plant control decisions.
    """
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"nh3_refrig:{context.value}:{facility_id}:{system_id}",
        "metadata": {
            "facility_id": facility_id,
            "system_id": system_id,
            "nh3_charge_lbs": nh3_charge_lbs,
            "psm_covered": psm_covered,
            "image_sha256": image_hash,
            "context": context.value,
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()

    if result["score"] > NH3_REFRIG_THRESHOLD:
        raise AdversarialNH3RefrigImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            facility_id=facility_id,
            system_id=system_id,
            flagged_region=result.get("flagged_region"),
        )
    return result

Deploy scan_nh3_refrig_image at each ammonia refrigeration AI rendered-image ingestion boundary: HPR level AI (threshold 35), compressor vibration spectrogram AI (threshold 35), evaporator frost thermal AI (threshold 35), and oil separator level AI (threshold 35). On AdversarialNH3RefrigImageError: halt AI-driven control and monitoring decisions for the affected system and require manual operator inspection of the affected vessel or compressor before resuming. See also: chemical plant process safety AI prompt injection (related OSHA PSM regulatory context) and LNG terminal regasification AI prompt injection (related cryogenic storage AI context). Get early access

Related questions