Prompt injection in offshore wind turbine SCADA AI

Four adversarial injection surfaces in offshore wind turbine SCADA AI

1. Blade leading-edge erosion (LEE) camera AI (Vestas CMS blade inspection AI, Siemens Gamesa LM Wind Power blade health AI, drone inspection AI — offshore blade erosion stage classification)

Offshore wind turbine blades — hollow composite structures manufactured from glass-fibre-reinforced polymer (GRP) or carbon-fibre-reinforced polymer (CFRP) spar caps with GRP shells, 80–120 metres in length and weighing 15,000–55,000 kg per blade — rotate at tip speeds of 80–100 metres per second in operating conditions that expose their leading edges to continuous high-energy impacts from rain droplets, sea spray, airborne salt crystals, and particulate matter. At 90 m/s tip speed, a 2 mm diameter rain droplet impacts the blade leading edge with a kinetic energy equivalent to a 0.2-gram projectile at 900 m/s — and in offshore environments, precipitation events can occur for 120–180 days per year, each event delivering millions of impacts per blade per hour. The leading-edge protection (LEP) system — a gel coat outer layer, an intermediate primer layer, and in modern blades a thermoplastic polyurethane (TPU) tape applied to the outer 0.5–1.0 m of blade chord — is the primary erosion barrier. AI systems from Vestas CMS blade inspection platform, Siemens Gamesa LM Wind Power blade health AI, and independent drone inspection AI providers (Sulzer Rotating Equipment Services, Rope Access Wind, Ørsted Wind Blade Services) classify drone inspection images of blade leading edges into four severity stages: Stage 1 (gel coat surface pitting, micro-crater formation, <1 mm depth, no primer exposure); Stage 2 (gel coat erosion through to primer layer, primer discolouration and edge roughening visible, <5% blade-span affected); Stage 3 (full gel coat and primer erosion, laminate GRP fibres exposed, surface roughening visible at drone resolution, >5% span affected); and Stage 4 (deep laminate erosion with spar cap fibres visible in the affected region, structural compromise indicated). Each stage triggers different repair specifications: Stage 1 calls for leading-edge protection tape application at the next scheduled maintenance visit (CTV-accessible, €5,000–€15,000 per blade); Stage 2 requires full leading-edge refurbishment at next scheduled major maintenance (SOV-based access, €20,000–€60,000 per blade); Stage 3 demands expedited blade repair with temporary production limitation pending access (potential blade swap at €400,000–€700,000); and Stage 4 requires immediate turbine shutdown and blade replacement using heavy lift vessel mobilisation (€1.2–€2.5M total cost including HLV day rate).

An adversarial perturbation applied to the pixel region of a drone-captured blade leading-edge image that suppresses the visual indicators of advanced erosion — specifically a ±8 DN suppression of the image intensity gradient in the pixel region corresponding to the erosion crater field at the leading edge (reducing the visual depth and extent of the crater texture from Stage 3 characteristics toward the smoother surface profile associated with Stage 1 gel coat pitting) — causes the blade inspection AI to classify an advancing Stage 3 erosion event as early Stage 1, triggering only a tape application at next scheduled visit instead of the expedited repair required. With the Stage 3 erosion state unaddressed and the blade continuing to rotate at 80–100 m/s tip speed in offshore precipitation, the exposed GRP laminate at the leading edge absorbs water through the erosion crater field (GRP is hygroscopic: water absorption up to 3% by weight over 12–24 months); during winter temperature cycling (seawater temperatures in the North Sea reaching −5°C to −10°C during polar outbreak events), water trapped in the delaminated fibres undergoes freeze-thaw cycling, expanding the void network within the laminate and accelerating internal delamination toward the spar cap. LM Wind Power technical bulletin LMW-TB-001 (2018) describes this mechanism: Stage 3 erosion progressing to internal delamination under freeze-thaw cycling produces a spar cap condition that can lead to fatigue crack initiation at the spar cap flange under cyclic flapwise and edgewise bending loads. Blade structural failures at Hornsea One (2019, Ørsted, UK North Sea, Vestas V164-9.5 MW) — where multiple blades sustained root-to-tip structural cracks requiring unplanned emergency HLV mobilisation — and LM Wind Power lamination defect events (2019, multiple sites, 128 LM Wind Power blades inspected and 20 replaced across multiple offshore wind farms) establish that offshore blade structural failure is not a remote-scenario risk but a documented operational event. A 15,000 kg blade released from a 90-metre hub height at 80–100 m/s tip speed travels ballistically to distances up to 500 metres from the turbine, creating a lethal fragment hazard for any vessel or personnel within that radius.

2. Gearbox bearing vibration spectrogram AI (Vestas CMS gearbox AI, SKF Enlight Wind bearing AI, Siemens Gamesa Condition Monitoring AI, GE Vernova APM Wind — offshore gearbox bearing fault frequency classification)

Multi-megawatt offshore wind turbines using conventional drivetrains — including the Vestas V164-9.5 MW and V236-15 MW, Siemens Gamesa SG 8.0-167 DD (direct drive, no gearbox), and GE Vernova Haliade-X 13 MW (medium-speed drivetrain with single-stage planetary gearbox) — generate significant gearbox bearing condition monitoring data that is processed by spectrogram-based AI systems. For turbines with three-stage planetary gearboxes (Vestas V90/V112/V126 series, GE Wind 4.1–113), the gearbox bearing condition monitoring system uses accelerometer arrays mounted on the gearbox housing at the low-speed, intermediate-speed, and high-speed shaft bearing locations to capture vibration time-series data sampled at 20–50 kHz. The raw time-domain vibration signal is transformed to frequency domain using Fast Fourier Transform (FFT) or Short-Time Fourier Transform (STFT) and rendered as a colour-coded two-dimensional spectrogram — frequency (Hz) on the X-axis, time (minutes or hours) on the Y-axis, and vibration amplitude encoded as a colour scale (typically deep blue for low amplitude, scaling through green, yellow, orange, and red for progressively higher amplitudes) with a range typically spanning 0–80 dB above noise floor. Bearing fault frequencies — Ball Pass Frequency Outer race (BPFO), Ball Pass Frequency Inner race (BPFI), Ball Spin Frequency (BSF), and Fundamental Train Frequency (FTF) — are calculated from bearing geometry and shaft rotational speed, and appear in the spectrogram as horizontal bands at those specific frequencies. SKF Enlight Wind bearing AI and Vestas CMS gearbox AI classify these rendered spectrogram images: the AI is trained to identify the characteristic sideband patterns that appear around fault frequencies as bearing damage develops — early outer race spalling produces amplitude peaks at BPFO and its harmonics (2×BPFO, 3×BPFO) with sidebands at shaft rotation frequency; intermediate bearing damage produces additional modulation sidebands and elevated floor noise; severe damage prior to seizure produces broadband noise elevation and loss of the original sideband structure as the spall extends across the full bearing race. Offshore gearbox replacement — requiring HLV mobilisation (€150,000–€350,000/day, 3–7 days at-turbine), gearbox unit cost (€300,000–€600,000), and associated downtime losses (8–15 MW turbine losing €1,500–€3,000/day at €60–100/MWh) — totals €800,000–€1,500,000 per event when caught early before secondary damage; significantly more if bearing seizure causes gear set destruction.

An adversarial perturbation applied to the rendered gearbox bearing vibration spectrogram image that suppresses the amplitude peaks at the bearing outer race fault frequency — a ±10 DN downward shift applied to the pixel rows encoding the BPFO and 2×BPFO frequency bands in the spectrogram colour scale (shifting the apparent amplitude at those frequency bands from the orange–red range indicating 15–25 dB above background toward the green–blue range indicating normal background vibration levels) — causes the gearbox bearing AI to classify an early-to-intermediate outer race spall (BPFO peak amplitude elevated 15–25 dB above background, consistent with a spall covering 5–20% of the outer race circumference) as normal background vibration, suppressing the escalated inspection and planned gearbox exchange that the elevated BPFO would trigger. With the outer race spall undetected, the bearing continues to operate under offshore turbine loading (alternating radial and axial load cycles from rotor weight, aerodynamic thrust, and wave-induced tower motion at 0.1–0.5 Hz), and the spall extends at a rate determined by bearing load, lubrication film condition, and operating temperature. At the intermediate stage, the spall covers 30–60% of the outer race and produces secondary metallic debris that contaminates the gearbox lubricating oil — the debris particles (steel fragments 0.1–2 mm) transit through the gearbox oil circuit and generate abrasive wear on the planetary gear teeth and planet carrier bearing rolling elements. At the catastrophic stage, the outer race fragments into multiple pieces under the alternating load, the bearing cage disintegrates, and the planet carrier drops onto the ring gear — producing immediate gear tooth impact loading that destroys the planetary stage gear set in the subsequent 0.1–10 seconds of continued rotation before the vibration trip activates. Hornsea One Vestas V164 gearbox failures (2019–2022, documented by Ørsted in their O&M fleet performance reports as leading causes of unplanned offshore HLV mobilisation) establish that planetary stage gearbox failures at offshore multi-MW turbines are operational events with documented consequence chains. GE Vernova APM Wind asset performance management AI and DNV-ST-0262 condition monitoring certification both require condition monitoring systems to correctly detect bearing degradation — adversarial suppression of the spectrogram AI creates a classification gap above those hardware systems.

3. Offshore foundation scour monitoring camera AI (Fugro SeaSee AI, Bureau Veritas offshore scour AI, COWI subsea inspection AI, multibeam echosounder bathymetric rendering AI — monopile scour depth exceedance classification)

Offshore wind turbine monopile foundations — hollow steel cylinders 6–10 metres in diameter, driven 20–40 metres into the seabed, forming the primary structural interface between the turbine tower and the seabed — are subject to seabed scour: the hydraulic erosion of seabed sediment around the pile caused by tidal current and wave-induced near-bed flow acceleration around the pile obstruction. Scour depth at offshore wind monopiles can reach 1.5–2.0 times the pile diameter (9–20 metres of scour depth for a 6–10 m pile) under combined wave-current loading at exposed North Sea or Atlantic sites; without scour protection (rock dumping or scour mat installation), scour removes the lateral soil support from the lower section of the pile, increasing the free-embedded length (the unsupported pile length from seabed to the first point of lateral soil support). The consequence of excessive scour for turbine structural integrity is twofold: first, the turbine first natural frequency — the frequency at which the integrated turbine-tower-foundation system resonates under cyclic loading — shifts as the effective foundation stiffness decreases, potentially moving outside the design-basis “soft-soft” or “soft-stiff” frequency range (typically 0.20–0.35 Hz for 8–15 MW turbines) into the 1P rotor excitation frequency or 3P blade-passing frequency bands, creating resonance-amplified fatigue loading across the tower, transition piece, and pile; second, the ultimate lateral load capacity of the foundation — its capacity to resist the overturning moment from storm aerodynamic and wave loads — decreases as free-embedded length increases, with design-basis pile capacity requiring a minimum free-embedded length. AI systems from Fugro SeaSee (underwater photogrammetry AI), Bureau Veritas offshore structural monitoring AI, and COWI subsea inspection AI process rendered bathymetric plan-view images — colour-coded depth contour plots rendered from multibeam echosounder or remotely operated vehicle (ROV) sonar scan data — to classify scour condition: within-design (scour depth below design scour level, no action required); approaching-design (scour depth 80–100% of design scour level, accelerated monitoring required); at-design (scour depth at design level, rock-dump installation required within 6 months); and exceeded-design (scour depth beyond design level, immediate rock-dump required, turbine loading review required, potential operational load limitation).

An adversarial perturbation applied to the rendered bathymetric plan-view image that suppresses the colour representation of advanced scour depth in the contour map — a ±8 DN colour shift applied to the pixel region encoding the deep-scour contour immediately surrounding the pile penetration point (shifting the colour from the red-to-purple band on the depth scale representing scour at or beyond design level toward the green-to-yellow band representing within-normal seabed elevation) — causes the foundation scour AI to classify an advanced scour condition (exceeding design scour level and requiring immediate rock-dump installation) as a within-threshold seabed profile, deferring the rock-dump protection and turbine loading review that the exceeded-design scour condition requires. As scour continues to deepen without protection — at rates of 0.1–0.5 metres per winter storm season at exposed North Sea sites — the free-embedded pile length increases and the first natural frequency migrates progressively toward the 1P or 3P excitation band. The turbine control system’s resonance detection logic — which monitors tower acceleration data and initiates an automated shutdown if tower fore-aft or side-side acceleration spectral density at the first natural frequency exceeds the design envelope — provides a downstream engineering control that would eventually force an unplanned shutdown as frequency shift becomes detectable; however, in the interval between the scour AI misclassification and the resonance control shutdown detection, the turbine continues to accumulate fatigue loading on the tower base weld — the highest-stress structural node in the system, subject to wave-induced bending moments of 100–400 MN·m at 8–15 MW scale. In the extreme scenario where scour exceeds 2 times the pile diameter at a high-loading site (Dogger Bank Bank conditions: 100-year wave height >20 m, 50-year current velocity >1.5 m/s), foundation yielding under combined wave and aerodynamic loading becomes credible — a total loss event for a €10–15M turbine asset and an uncontrolled collapse generating secondary wave and structural hazard for any maintenance or survey vessels in the vicinity.

4. Lightning protection receptor condition AI (IEC 61400-24:2019, GE Vernova LPS integrity camera AI, Siemens Gamesa blade lightning management (BLM) AI, drone inspection AI — wind turbine blade lightning receptor condition classification)

IEC 61400-24:2019 (Lightning protection for wind turbines) requires wind turbine blades to be equipped with a Lightning Protection System (LPS) that intercepts lightning strike channels before the arc can attach to and propagate through the blade composite laminate. The LPS consists of metallic receptors — typically solid copper, aluminium bronze, or stainless steel discs or tapered cylinders — installed flush with the blade outer surface at specified intervals along the blade span (typically 3–8 receptors per blade, concentrated at the blade tip where strike probability is highest, with spacing determined by rolling sphere method per IEC 61400-24:2019 Section 6.2). Each receptor is connected by a down-conductor cable routed internally through the blade to the hub and tower earthing system, providing a low-impedance path for lightning current (peak current 20–200 kA, rise time 1–10 μs) from the receptor to earth without the current flowing through the blade laminate. The protective function depends on the receptor presenting a sufficiently low leader attachment radius — the radius of the sphere of influence within which the upward leader from the receptor preferentially connects to the downward lightning leader rather than an attachment to the adjacent GRP or CFRP laminate. AI systems including GE Vernova LPS integrity camera AI, Siemens Gamesa blade lightning management (BLM) AI, and third-party drone inspection AI providers (Sulzer, Aetos Drones, OneSky Systems) classify drone-captured optical images of each receptor in three condition states: intact (receptor surface silver-metallic, uniform machined finish, no surface erosion, edge geometry preserved — previous strike current has left no visible damage, receptor ready to capture subsequent strikes); degraded (receptor surface shows erosion pitting, edge rounding, and surface oxidation from one or more previous strike attachments — receptor still functional but with reduced leader attachment radius, elevated maintenance priority); and functionally failed (receptor surface shows through-burning — material ablated from the receptor face, subsurface voids visible, or the receptor has been partially displaced from its seating by arc recoil forces — receptor cannot reliably intercept next strike channel, next strike will attach to the blade laminate adjacent to the mounting assembly). The distinction between degraded and functionally failed is subtle at optical inspection resolution: a degraded receptor has surface erosion but intact substrate; a functionally failed receptor has breached through its copper body, typically leaving a darkened, oxidised, porous surface with visible subsurface channelling.

An adversarial perturbation applied to the drone-captured receptor inspection image that suppresses the visual indicators of a functionally failed receptor — a ±8 DN suppression of the image intensity in the pixel region corresponding to the darkened, oxidised, porous surface of a burned-through receptor (restoring the apparent brightness and surface texture uniformity toward that of an intact silver-metallic receptor) — causes the LPS inspection AI to classify a functionally failed receptor (burned through, unable to capture the next strike) as intact, deferring the receptor replacement that IEC 61400-24:2019 requires before the next lightning exposure season. With the failed receptor in position, the next lightning strike to the blade tip region — at the blade tip, where offshore turbines at North Sea or Irish Sea latitudes can receive 3–15 direct strikes per year per turbine — attaches to the receptor mounting recess or to the adjacent GRP laminate rather than to the receptor face. A direct arc attachment to the blade GRP laminate transfers the full lightning current (20–200 kA, 10–30 kJ energy in the first stroke) into the composite material, where it vaporises moisture trapped in the GRP resin matrix (water vapour overpressure 100–1,000 bar instantaneously) and ablates the resin, creating an explosive delamination event that can split the laminate along the blade chord for 0.5–3 metres from the attachment point. If the arc reaches the blade tip or trailing edge, the explosive vaporisation generates a pressure wave that blows the blade tip section off entirely — releasing a GRP fragment of 50–500 kg at a velocity determined by the explosive energy. The Middelgrunden offshore wind farm (Denmark, Ørsted, 20 × Bonus 2 MW turbines) documented a blade detonation event from LPS failure in which direct arc attachment to the blade laminate destroyed approximately 4 metres of blade tip, scattering GRP fragments across a 200-metre radius — establishing that offshore LPS failures produce debris release events with a hazard radius exceeding the turbine maintenance exclusion zone.

Integration: offshore wind SCADA AI scanning with Glyphward pre-scan gate

The Glyphward scan gate for offshore wind turbine SCADA AI belongs at every rendered-image and drone-image ingestion boundary in the turbine condition monitoring and inspection AI pipeline: before blade LEE drone image AI processes leading-edge erosion photographs, before gearbox bearing vibration AI processes rendered spectrogram images, before foundation scour monitoring AI processes rendered bathymetric contour maps, and before lightning receptor condition AI processes receptor drone inspection photographs. Threshold 35 reflects the multiple engineering control layers present in offshore wind SCADA systems (automatic vibration trip systems, SCADA-level shutdown logic, scheduled maintenance windows) that sit between a classification failure and the ultimate structural consequence — but those downstream controls do not eliminate the consequence risk; they merely extend the time window in which the adversarial suppression must persist unchallenged before structural damage accumulates to the catastrophic threshold.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Offshore wind turbine SCADA AI contexts: threshold 35
# IEC 61400-25:2017 (SCADA communications for wind power plants);
# IEC 62443-3-3:2013 (IACS security level requirements);
# DNV-ST-0262:2021 (Certification of condition monitoring systems for
#   wind turbines, Section 4 CMS integrity requirements);
# IEC 61400-24:2019 (Lightning protection for wind turbines, LPS
#   inspection and maintenance requirements Section 9).
WIND_TURBINE_THRESHOLD = 35


class WindTurbineAIContext(Enum):
    BLADE_EROSION       = "blade_erosion"       # Blade LEE drone inspection AI
    GEARBOX_BEARING     = "gearbox_bearing"     # Gearbox vibration spectrogram AI
    FOUNDATION_SCOUR    = "foundation_scour"    # Foundation scour bathymetric AI
    LIGHTNING_RECEPTOR  = "lightning_receptor"  # LPS receptor condition drone AI


class AdversarialWindTurbineImageError(Exception):
    """Raised when Glyphward detects adversarial content in an offshore wind
    turbine SCADA AI image above threshold 35.

    Consequence if not raised:
    - BLADE_EROSION: Stage 3 erosion classified as Stage 1 → repair deferred
      → water ingress → freeze-thaw delamination → spar cap compromise →
      blade structural failure at fatigue load → 15,000 kg fragment at
      up to 300 km/h; Hornsea One 2019 structural parallel.
    - GEARBOX_BEARING: BPFO/BPFI amplitude peaks suppressed → outer race
      spall undetected → spall extends to bearing seizure → planetary stage
      gear set destruction → total gearbox loss (€800k–€1.5M including HLV).
    - FOUNDATION_SCOUR: scour depth exceeding design level classified as
      within-normal → rock-dump deferred → free-embedded pile length
      increases → first natural frequency shifts outside design range →
      resonance-amplified fatigue accumulation → potential foundation
      yielding under storm loading at extreme scour depth.
    - LIGHTNING_RECEPTOR: burned-through receptor classified as intact →
      maintenance deferred → next lightning strike attaches to blade laminate
      → explosive GRP delamination → blade tip detonation + fragment release;
      Middelgrunden Denmark LPS failure structural parallel.
    Fail-safe: halt AI classification; escalate to O&M engineering team for
    manual physical inspection before resuming AI-driven wind turbine condition
    monitoring advisory functions. Notify wind farm operations controller.
    """

    def __init__(self, scan_id: str, score: int,
                 context: WindTurbineAIContext,
                 turbine_id: str, wind_farm_id: str,
                 flagged_region: dict | None = None) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.turbine_id = turbine_id
        self.wind_farm_id = wind_farm_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial wind turbine image: "
            f"context={context.value} score={score} "
            f"turbine={turbine_id} wind_farm={wind_farm_id} "
            f"scan_id={scan_id}"
        )


async def scan_wind_turbine_image(
    image_bytes: bytes,
    context: WindTurbineAIContext,
    turbine_id: str,
    wind_farm_id: str,
    client: httpx.AsyncClient,
) -> dict:
    """Scan an offshore wind turbine SCADA AI image before classification.

    Covers four adversarial injection surfaces:
      BLADE_EROSION       — drone LEE inspection image (RGB/multispectral)
      GEARBOX_BEARING     — rendered vibration spectrogram image
      FOUNDATION_SCOUR    — rendered bathymetric scour contour map image
      LIGHTNING_RECEPTOR  — drone LPS receptor condition image

    Fail-safe contract: AdversarialWindTurbineImageError or httpx error →
    halt wind turbine AI classification for the affected monitoring context
    on turbine_id; require physical inspection (IEC 62443 maintenance
    isolation, DNV-ST-0262 CMS integrity procedure) before resuming
    AI-driven condition monitoring or inspection advisory functions.
    Notify wind farm operations controller.
    """
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": (
            f"wind_turbine:{context.value}:"
            f"{wind_farm_id}:{turbine_id}"
        ),
        "metadata": {
            "wind_farm_id": wind_farm_id,
            "turbine_id": turbine_id,
            "context": context.value,
            "image_sha256": image_hash,
            "scanned_at": datetime.now(timezone.utc).isoformat(),
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()

    if result["score"] > WIND_TURBINE_THRESHOLD:
        raise AdversarialWindTurbineImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            turbine_id=turbine_id,
            wind_farm_id=wind_farm_id,
            flagged_region=result.get("flagged_region"),
        )
    return result

Deploy scan_wind_turbine_image at each wind turbine SCADA AI image ingestion boundary with the matching WindTurbineAIContext enum value. On AdversarialWindTurbineImageError for BLADE_EROSION context: suspend AI-driven blade condition reporting for the flagged turbine and escalate to the blade engineering team for manual CTV or rope-access inspection before the next scheduled maintenance cycle. On GEARBOX_BEARING context: suspend AI-driven gearbox health advisory and initiate manual oil sample analysis and vibration data review by rotating equipment engineers before next HLV planning cycle. On FOUNDATION_SCOUR context: suspend scour AI classification and commission an independent multibeam echosounder survey before the next storm season. On LIGHTNING_RECEPTOR context: suspend receptor condition advisory and initiate an immediate drone re-inspection with independent image capture before the next convective season. Threshold 35 applies uniformly across all four contexts — the multiple engineering control layers in offshore wind SCADA (automatic shutdown systems, periodic scheduled inspection windows, manual O&M engineering review) provide a time buffer between AI classification failure and structural consequence that justifies a marginally higher threshold than nuclear I&C (threshold 25) or FPSO ESD (threshold 30), but the €10–18M asset loss and blade fragment release consequence at the structural failure end of the risk chain means threshold 35 is the appropriate floor, not 40 or 45. See free tier — 10 scans/day, no card required and oil and gas SCADA AI prompt injection (similar IACS industrial control system adversarial injection context). Get early access

Related questions