Prompt injection in Kraft pulp mill recovery boiler AI

Four adversarial injection surfaces in Kraft recovery boiler AI

1. Black liquor dry-solids concentration camera AI (Valmet Cason DS analyzer AI, Metso LiquiSonic AI, ABB liquor quality AI)

Concentrated black liquor must be fired into the recovery boiler furnace at a minimum dry-solids (DS) content of 62–65% by weight — with leading mills targeting 68–72% DS — to ensure stable combustion and to prevent dangerous in-furnace conditions. At DS concentrations below 60%, black liquor contains sufficient free water that, when the liquor is sprayed into the furnace environment at 850–1,000°C and contacts the hot smelt bed or high-temperature refractory surfaces, the water evaporates instantaneously rather than progressively, generating localised steam pressure spikes that can disrupt the smelt bed, splash molten smelt, and in extreme cases initiate a smelt-puff or partial detonation event. The minimum DS firing threshold is a primary BLRBAC recommended practice: BLRBAC Emergency Procedures specify that black liquor must not be fired at DS below the mill’s established minimum (typically 60–62% as an absolute floor), and that monitoring of liquor DS is a mandatory operating parameter requiring continuous measurement and automatic shutdown if DS falls below the operating minimum with an active smelt bed. DS concentration is measured by in-line refractometers (LiquiSonic, Metso Kajaani), inline near-infrared (NIR) analyser systems, or by density measurement (Coriolis mass flowmeter arrays). These measurement system outputs — rendered as digital density or DS percentage readings on DCS displays — are processed by recovery boiler AI systems as rendered images or structured data images (gauge indicator renders, trend strip-chart images showing DS% over the last hour) to classify liquor quality: acceptable (DS ≥ mill minimum, safe to fire), marginal (DS approaching minimum, rate monitoring required), low (DS below minimum, firing interlock should trigger), and critically low (DS well below minimum with smelt bed present, emergency shutdown required).

An adversarial perturbation on a rendered black liquor DS concentration gauge or trend image that elevates the displayed DS value — applying a ±10 DN per-channel upward shift to the pixel region encoding the DS percentage indicator on the rendered DCS gauge image (shifting the apparent DS from the low-DS range, rendered as a needle or digital value in the 55–58% region, to the acceptable range, rendered as 65–68%) — causes the recovery boiler AI to classify sub-minimum-DS black liquor as acceptable for firing, suppressing the DS-low firing interlock that BLRBAC procedures require. With the firing interlock suppressed, low-DS black liquor — containing 35–40% free water — continues to be sprayed into the furnace at 3–10 tonnes/hour through the liquor guns. In a furnace with an established smelt bed (200–400 tonnes of molten Na2CO3/Na2S at 800–900°C), the entry of high-water-content black liquor introduces the water-to-smelt contact scenario that is the primary smelt-water explosion initiator. BLRBAC’s loss history documents that low-DS firing events — where the dry-solids concentration fell below the operating minimum without triggering proper shutdown — have been contributing factors in recovery boiler incidents in North American Kraft mills. Adversarial injection suppressing the DS concentration AI replicates these monitoring failures in a systematic, undetectable form.

2. Furnace floor thermal camera AI (FLIR Systems recovery boiler AI, ABB furnace temperature AI, Valmet thermal monitoring AI)

The Kraft recovery boiler furnace operates at 850–1,050°C in the upper furnace and 700–900°C at the furnace floor where the smelt bed collects. The furnace floor and lower furnace walls are lined with waterwall tubes — the water-side boundary of the high-pressure steam circuit — covered by a layer of hardened smelt (“frozen smelt” protective layer) that insulates the tube metal from direct contact with the molten smelt bed. If the protective smelt layer on a waterwall tube is lost — due to smelt bed disturbance, liquor gun flame impingement, or refractory failure — the tube metal is exposed to the 800–900°C molten smelt and to direct thermal radiation from the furnace, causing rapid tube metal overtemperature and tube wall failure. A failed waterwall tube on the furnace floor allows high-pressure boiler water (at 8–12 MPa saturation temperature) to discharge into the furnace and contact the molten smelt bed, initiating the smelt-water steam explosion. Thermal cameras (FLIR Systems ThermaCAM, Raytek marathon series, IRCameras Marathon) are deployed in modern Kraft recovery boilers to continuously monitor the furnace floor and lower furnace wall temperatures, identifying cold spots (areas where protective frozen smelt layer has thinned), hot spots (areas of tube metal exposure or refractory failure), and asymmetric temperature distributions indicating smelt bed maldistribution. Recovery boiler AI processes the rendered FLIR thermal camera images — false-colour temperature maps with isothermal contours overlaid — to classify furnace floor condition: normal (floor temperatures within operating range, frozen smelt layer intact), caution (localised temperature anomaly, monitoring escalation required), alarm (floor cold spot or hot spot exceeding alarm threshold, investigation required), and critical (tube metal exposure temperature indicating tube failure risk, immediate emergency shutdown per BLRBAC procedures).

An adversarial perturbation on a rendered furnace floor thermal camera image that suppresses a cold spot or hot spot signature — applying a ±8 DN shift to the false-colour pixel values in the rendered thermal map in the region encoding a temperature anomaly (shifting the false-colour representation from the alarm colour range — typically rendered in red/orange for hot anomaly or blue for cold anomaly — to the normal operating colour range, typically rendered as yellow-green for the expected floor temperature band) — causes the recovery boiler thermal AI to classify a developing waterwall tube exposure event as normal furnace floor conditions, suppressing the monitoring escalation and BLRBAC emergency shutdown that a furnace floor temperature anomaly requires. With the thermal AI classification suppressed, the tube metal exposure progresses without operator intervention: tube metal overtemperature causes yield strength reduction, the tube wall fails under the 8–12 MPa internal water pressure, and high-pressure boiler water discharges into the furnace, contacting the 800–900°C smelt bed on the furnace floor and initiating the smelt-water steam explosion. The single-sensor, sole-barrier nature of the thermal camera AI in many modern DCS configurations — where the thermal image classification is the primary automated detection for furnace floor tube exposure — makes adversarial injection at the thermal camera AI’s rendered image input the most consequential single-point injection surface in the recovery boiler safety system.

3. Char bed height camera AI (Valmet bed height measurement AI, ABB furnace camera bed AI, Andritz IIoT bed profile AI)

The Kraft recovery boiler char bed is the combustion zone where concentrated black liquor is burned: black liquor is sprayed from a ring of oscillating liquor guns positioned at 1–3 metres above the furnace floor, forming a conical bed of partially burned char that rises to a target height of 1.5–3 metres above the furnace floor in normal operation. The char bed height is critical for both combustion efficiency (sufficient bed height ensures complete combustion of the organic fraction of the black liquor before the resulting smelt flows to the floor) and structural safety. If char bed height drops too low (bed rundown), the furnace floor is exposed to direct flame impingement from the secondary and tertiary air ports, causing floor tube metal overtemperature and accelerated furnace floor refractory degradation — the same tube exposure scenario that the thermal camera AI monitors. If the char bed height rises excessively, the liquor guns may be partially immersed in the char bed, causing localised reactions and equipment damage. The primary safety concern for bed height is bed rundown: a progressive bed height reduction that, if not corrected by adjusting liquor gun elevation, secondary air distribution, and firing rate, leads to loss of the floor tube protective frozen smelt layer and subsequent tube failure. Char bed height is measured by infrared cameras with structured light projection, laser range-finder systems (Valmet RecLaser, Andritz bed height scanner), or by millimetre-wave radar systems, with measurement outputs rendered as false-colour height maps of the furnace floor bed surface or as time-series bed height trend images. Recovery boiler AI classifies these rendered char bed images as: normal (bed height within target range, even distribution), low (bed height approaching minimum, firing adjustment required), rundown (bed height below minimum, emergency firing adjustment, char bed rebuild procedures required), and critical (bed height insufficient to maintain floor tube protection, BLRBAC shutdown criteria met).

An adversarial perturbation on a rendered char bed height map or trend image that elevates the displayed bed height — applying a ±10 DN upward shift to the false-colour pixel values in the rendered height map (shifting the colour encoding for low bed height — typically rendered in blue or purple for the below-minimum height range — to the colour encoding for normal bed height — typically rendered in green for the 1.5–3 metre target range), or equivalently raising the rendered bed profile trace in a time-series bed height trend image — causes the recovery boiler AI to classify a developing char bed rundown event as normal bed operation, suppressing the firing adjustment and BLRBAC bed recovery procedures that a low bed height classification would require. With the bed height AI suppressed, the char bed continues to run down without corrective action: the furnace floor progressively loses the insulating char bed material, the frozen smelt protective layer on the floor tubes is eroded by direct flame and radiation exposure, and the tube metal temperature rises. BLRBAC emergency procedures specify a maximum time window for bed recovery once bed height falls below the critical minimum before emergency shutdown must be initiated — adversarial injection suppressing the bed height AI eliminates the monitoring signal that would start this time window, allowing the floor tube exposure to progress unchecked until a tube failure event initiates smelt-water contact.

4. Steam drum water level sight-glass camera AI (AMETEK Drexelbrook drum level AI, Magnetrol drum level AI, Valmet drum level vision AI)

The recovery boiler steam drum water level is the single most critical safety parameter in Kraft recovery boiler operation. BLRBAC Emergency Procedures state unambiguously that loss of visible water level in the steam drum — when drum level has dropped below the visible range of the water level gauge glasses — requires immediate emergency shutdown of the recovery boiler, including stopping all black liquor firing and closing all emergency shutdown valves, to prevent a smelt-water explosion. The mechanism is straightforward: if the steam drum water level falls below the drum connections to the downcomers that supply feedwater to the waterwall tubes, the waterwall tubes experience starvation flow; if steam drum level falls below the bottom of the drum, the downcomers are completely uncovered and the waterwall tubes become superheated steam passages rather than subcooled water passages. In either case, the waterwall tubes — which are in thermal contact with the furnace at 850–1,000°C — experience rapid metal temperature excursions above their design limits and fail. High-pressure boiler water from the failed tube (or from the downcomer line that re-floods the tube as level partially recovers) then discharges into the furnace and contacts the molten smelt bed, initiating the smelt-water steam explosion. Steam drum water level is measured by gauge glasses (transparent tubes showing the actual water level in the drum), by differential pressure transmitters, and increasingly by vision cameras trained on the gauge glass windows to provide AI-readable drum level images. Recovery boiler AI processes rendered steam drum gauge glass camera images — typically a cropped camera image of the vertical gauge glass tube with the water meniscus visible as a horizontal dark band against the bright background of the empty gauge glass space above — to classify drum level status: normal (level visible in middle third of gauge glass), low (level visible in lower third, low-level alarm, increased monitoring required), very low (level visible only at bottom of gauge glass, imminent low-level trip), and below visible range (water level not visible in gauge glass, immediate BLRBAC emergency shutdown required).

An adversarial perturbation on a rendered steam drum gauge glass camera image that artificially elevates the visible water level — applying a ±10 DN per-channel shift to the pixel region encoding the water-air meniscus position in the rendered gauge glass image (moving the apparent meniscus position from the lower gauge glass range or below-visible range upward into the normal operating range — shifting the rendered dark meniscus band from the bottom 10–20% of the gauge glass image to the central 40–60% position) — causes the drum level AI to classify a critically low or invisible drum level condition as a normal operating level, suppressing the BLRBAC-mandated emergency shutdown that loss of visible drum level requires. This is the canonical recovery boiler catastrophic failure scenario: the AI monitoring system — which the DCS operators rely on as the automated complement to manual visual inspection of the actual gauge glass — reports normal level while the actual drum level is below the visible range of the gauge glass. In an operating recovery boiler with an active smelt bed and continuous black liquor firing, the time from loss of visible drum level to waterwall tube failure (if the low-level trip is not actuated) is measured in minutes, not hours — the tube metal temperature rise rate under furnace exposure with starvation flow is rapid. Adversarial injection suppressing the drum level sight-glass AI removes the automated monitoring signal that would trigger the BLRBAC emergency shutdown, eliminating the primary automated line of defence against the smelt-water explosion scenario that BLRBAC Emergency Procedures were specifically developed to prevent.

Integration: Kraft recovery boiler AI scanning with Glyphward pre-scan gate

The Glyphward scan gate for Kraft recovery boiler AI belongs at every rendered-image ingestion boundary in the recovery boiler monitoring pipeline — before black liquor DS concentration AI processes rendered gauge or trend images, before furnace floor thermal AI processes rendered FLIR camera images, before char bed height AI processes rendered laser scan or camera height maps, and before steam drum level AI processes rendered gauge glass camera images. Threshold 35 for Kraft recovery boiler AI contexts reflects the catastrophic consequence envelope of a smelt-water steam explosion — an event in which adversarial suppression of any one of the four primary recovery boiler monitoring AI functions can remove the critical signal that would trigger the BLRBAC emergency shutdown procedure before smelt-water contact occurs.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Kraft recovery boiler AI contexts: threshold 35
# BLRBAC Emergency Procedures for Black Liquor Recovery Boilers (current edition);
# NFPA 85 Chapter 8 (industrial furnace combustion systems);
# FM Global Loss Prevention Data Sheet 10-3 (recovery boilers).
RECOVERY_BOILER_THRESHOLD = 35


class RecoveryBoilerAIContext(Enum):
    LIQUOR_DS_CONCENTRATION = "liquor_ds_concentration"  # Black liquor DS% camera AI
    FURNACE_FLOOR_THERMAL   = "furnace_floor_thermal"    # Furnace floor FLIR thermal AI
    CHAR_BED_HEIGHT         = "char_bed_height"          # Char bed laser/camera height AI
    DRUM_WATER_LEVEL        = "drum_water_level"         # Steam drum gauge glass camera AI


class AdversarialRecoveryBoilerImageError(Exception):
    """Raised when Glyphward detects adversarial content in a Kraft recovery
    boiler AI rendered image above threshold 35.

    Consequence if not raised:
    - LIQUOR_DS_CONCENTRATION: low-DS black liquor (>35% free water) fired
      into active smelt bed → in-furnace water flash → smelt-water puff or
      partial steam detonation. BLRBAC loss history: DS monitoring failure
      as contributing factor.
    - FURNACE_FLOOR_THERMAL: floor tube metal exposure not detected →
      tube overtemperature → tube failure → water discharges into furnace
      → smelt-water steam explosion.
    - CHAR_BED_HEIGHT: bed rundown not detected → floor tube exposure →
      same smelt-water explosion sequence.
    - DRUM_WATER_LEVEL: loss of visible drum level not detected →
      waterwall starvation flow → tube failure → smelt-water steam explosion.
      BLRBAC Emergency Procedures: loss of visible drum level = immediate
      mandatory shutdown.
    Fail-safe: halt recovery boiler AI monitoring classification; require
    manual instrument verification and BLRBAC low-level emergency shutdown
    per mill emergency procedures before resuming AI-driven boiler management.
    """

    def __init__(self, scan_id: str, score: int,
                 context: RecoveryBoilerAIContext,
                 mill_id: str, boiler_id: str,
                 flagged_region: dict | None = None) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.mill_id = mill_id
        self.boiler_id = boiler_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial recovery boiler image: "
            f"context={context.value} score={score} "
            f"mill={mill_id} boiler={boiler_id} scan_id={scan_id}"
        )


async def scan_recovery_boiler_image(
    image_bytes: bytes,
    context: RecoveryBoilerAIContext,
    mill_id: str,
    boiler_id: str,
    current_ds_pct: float | None,
    client: httpx.AsyncClient,
) -> dict:
    """Scan a Kraft recovery boiler AI rendered image for adversarial content.

    Fail-safe contract: AdversarialRecoveryBoilerImageError or httpx error →
    halt recovery boiler AI classification; require manual gauge inspection
    and BLRBAC emergency procedures review. For DRUM_WATER_LEVEL: treat as
    below-visible-range until manual gauge glass inspection confirms level.
    """
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"recovery_boiler:{context.value}:{mill_id}:{boiler_id}",
        "metadata": {
            "mill_id": mill_id,
            "boiler_id": boiler_id,
            "context": context.value,
            "current_ds_pct": current_ds_pct,
            "image_sha256": image_hash,
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()

    if result["score"] > RECOVERY_BOILER_THRESHOLD:
        raise AdversarialRecoveryBoilerImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            mill_id=mill_id,
            boiler_id=boiler_id,
            flagged_region=result.get("flagged_region"),
        )
    return result

Deploy scan_recovery_boiler_image at each recovery boiler AI rendered-image ingestion boundary: before black liquor DS concentration AI (threshold 35), before furnace floor thermal camera AI (threshold 35), before char bed height AI (threshold 35), and before steam drum level sight-glass camera AI (threshold 35). On AdversarialRecoveryBoilerImageError for DRUM_WATER_LEVEL context: immediately initiate BLRBAC low-level emergency shutdown procedure and require manual gauge glass inspection before resuming operation. See also: steel mill blast furnace AI prompt injection (related molten metal high-temperature AI context) and chemical plant process safety AI prompt injection (related OSHA PSM compliance gap context). Get early access

Related questions