Prompt injection in steel mill blast furnace AI

Four adversarial injection surfaces in steel mill blast furnace AI

1. Blast furnace tuyere thermal image AI (Paul Wurth EGS AI, Primetals BF Expert AI, tuyere camera AI)

Blast furnace tuyeres are sets of 16–42 copper cooling blocks arranged around the lower hearth of the blast furnace through which hot blast air (preheated to 900–1,300°C) is injected into the coke bed at supersonic velocity through water-cooled copper tuyere tips. Each tuyere copper block carries approximately 1,000–2,000 litres per minute of cooling water at 30–40 bar to maintain the copper at temperatures below its melting point despite the 1,700–2,000°C combustion zone adjacent to the tuyere tip. Optical inspection cameras (peephole cameras mounted on the tuyere stock) and thermal imaging cameras (FLIR T-series or Ametek Land thermal cameras mounted on the tuyere inspection ports) generate continuous images of each tuyere copper block outer surface and the hot face of the tuyere stock. Paul Wurth EGS (Expert Guidance System) blast furnace AI, Primetals Technologies BF Expert AI, and purpose-built tuyere inspection AI systems process these rendered thermal images — false-colour thermal maps of the tuyere copper block outer surface with temperature scale calibrated to normal operating range (300–500°C copper block outer surface temperature under nominal cooling) — to classify tuyere condition: normal, hot-spot (>350°C above nominal on the copper block face, indicating localised cooling water flow restriction or refractory erosion exposing the copper to higher heat flux), or burnthrough precursor (>700°C above nominal with expanding hot-spot signature, indicating imminent copper penetration). The AI classification drives blast furnace operational response: reducing hot blast temperature or pressure at the affected tuyere, increasing cooling water flow, and scheduling tuyere change-out during the next planned tuyere maintenance window before the burnthrough threshold is reached.

An adversarial perturbation on a rendered tuyere copper block thermal image that suppresses the hot-spot signature — applying a ±10 DN downward shift to the false-colour temperature encoding in the hot-spot region of the rendered thermal image, cooling the apparent copper block surface temperature from the burnthrough precursor range (rendered in orange/red at 700–900°C above nominal) toward the normal operating range (rendered in green/yellow at 50–150°C above nominal), shifting the apparent peak temperature across the AI’s hot-spot classification threshold — causes the tuyere AI to classify a copper block in burnthrough precursor condition as normal, suppressing the operational response that would have prevented the burnthrough. A tuyere burnthrough occurs when the cooling water boundary in the copper block is breached by molten iron penetration: the cooling water at 30–40 bar contacts molten iron at 1,450–1,550°C, instantly vapourising and expanding 1,700–3,000 times in volume in a steam explosion that ejects liquid iron across the cast house. The ArcelorMittal Cleveland Blast Furnace No. 5 event of 13 November 2019 produced exactly this consequence sequence — a tuyere/tymph plate event ejecting molten iron splatter and injuring five workers — with subsequent OSHA PSM investigation citing failure of the process safety monitoring system. Adversarial suppression of the tuyere thermal image AI classification replicates the monitoring system failure that the ArcelorMittal event exposed, but in a systematic and repeatable digital form rather than the hardware/maintenance failure mode.

2. Hot metal torpedo ladle level AI (ABB Level 2 AI, Primetals ladle tracking AI)

Hot metal torpedo ladles — cylindrical refractory-lined steel vessels on rail car bogies, 3.5–6 m in diameter and 15–23 m long, capacity 200–400 tonnes of liquid hot metal at 1,450–1,480°C — transport blast furnace hot metal from the cast house to the steelmaking shop (BOF or EAF). Hot metal is tapped from the blast furnace through the taphole into the torpedo ladle at the cast house level; the torpedo ladle is then moved by rail to the steel shop, where hot metal is tipped into the BOF or EAF. Torpedo ladle fill level is monitored by optical cameras (mounted at cast house taphole elevation) and laser rangefinders that measure the hot metal surface distance from the ladle opening, rendering fill level as a camera image showing the hot metal surface level relative to the ladle rim, with a maximum fill line marked on the ladle refractory lining. ABB Level 2 AI, Primetals Technologies ladle tracking and fill monitoring AI, and integrated steel mill MES AI systems process these rendered camera images to classify torpedo ladle fill state: empty (ready for tapping), filling (during blast furnace tap), approaching full (within 10–15% of maximum fill level, requiring taphole closure preparation), and full (tap complete, ready for transfer to steel shop). The AI classification drives automated taphole closure timing — the signal to the blast furnace mudgun operator to begin closing the taphole — and tapping duration management to prevent torpedo ladle overflow.

An adversarial perturbation on a rendered torpedo ladle camera image that elevates the displayed fill level to appear 15–20% lower than actual — applying a ±8 DN upward brightness shift to the image region above the actual hot metal surface (making the apparent air space above the hot metal surface appear larger than it is, shifting the apparent fill level down in the rendered image) — causes the torpedo ladle fill AI to classify the ladle as less full than it actually is, suppressing the approaching-full alert and delaying the taphole closure instruction. Additional hot metal tapped from the blast furnace into an already-full torpedo ladle overflows the ladle rim: 1,450°C liquid hot metal flowing over the torpedo car rail bogies and onto the cast house floor, igniting secondary fires in the cast house ductwork and pit areas below the rail level, and creating an immediate burn and explosion hazard for cast house operators on the working platform adjacent to the tap ladle. Multiple Japanese blast furnace cast house hot metal overflow incidents have been reported to MHLW (Ministry of Health, Labour and Welfare) under Japanese industrial safety reporting requirements — the consistent root cause is delayed taphole closure due to fill level monitoring error, precisely the failure mode that adversarial torpedo ladle level image AI injection would produce.

3. Continuous caster mold level AI (Danieli Automation OPTIMELT AI, ABB AbilityTM Mold Level Expert AI, SMSGROUP mold-level AI)

Continuous casting is the process by which liquid steel from the BOF or EAF is cast into solidifying billets, blooms, or slabs by flowing through a water-cooled copper mold at controlled casting speed. The copper mold (typically 700–900 mm tall, oscillating at 80–300 cycles per minute) must maintain the liquid steel meniscus — the interface between liquid steel and the solidifying shell — at a controlled level within the mold to ensure consistent shell thickness growth. Mold level is measured by eddy current sensors or nuclear density gauge systems that output a continuous voltage signal proportional to metal level, rendered as an infrared or optical level sensor trend image — a time-series plot with metal level (mm from top of mold) on the Y-axis and time on the X-axis, with a control band (±5 mm from setpoint) and breakout prediction trigger thresholds marked. Danieli Automation OPTIMELT mold level expert AI, ABB AbilityTM Mold Level Expert AI, SMSGROUP Level 2 mold-level AI, and Nippon Steel’s caster breakout prediction ML system process these rendered mold level trend images to classify two critical casting conditions: (1) mold level control performance (level within control band, oscillating normally), and (2) breakout precursor — specifically the “sticker” breakout pattern in which the solidifying shell sticks to the oscillating copper mold wall, producing a characteristic oscillating level deviation pattern as the mold drags the shell up and releases it, thinning the shell at the attachment point until the shell ruptures below the mold. Nippon Steel and POSCO have published extensively on ML-based caster breakout prediction (Nippon Steel Technical Report; POSCO J-RIM caster AI); this is the most commercially mature and widely deployed AI safety function in steelmaking.

An adversarial perturbation on a rendered continuous caster mold level trend image that suppresses the breakout sticker pattern — smoothing the characteristic oscillating level deviation signature in the sticker breakout event (the level trace oscillating ±10–20 mm above and below the set point in synchrony with mold oscillation frequency during a sticker event, with the amplitude increasing as the sticker attachment progresses) by applying a ±8 DN smoothing perturbation to the rendered level trace in the sticker pattern time window, reducing the apparent oscillation amplitude below the AI’s sticker pattern classification threshold — causes the breakout prediction AI to classify the casting as proceeding normally rather than issuing a sticker breakout alarm. A sticker breakout alarm triggers immediate casting speed reduction (reducing the solidifying shell’s travel rate past the sticker attachment point to allow shell healing) or emergency casting stop — without the alarm, casting continues at full speed, the sticker attachment ruptures, and liquid steel at 1,500°C breaks through the solidifying shell below the mold exit. Liquid steel breakthrough in a continuous caster spray chamber at 0.8–2.5 m/min casting speed produces a 1,500°C steel spray event in the confined spray chamber space, destroying spray nozzles, containment equipment, and the casting strand guide, with fire consequence extending to the adjacent ladle shroud and tundish infrastructure. The Posco Gwangyang caster breakout incidents document this consequence in operational detail — each breakout event requires 24–72 hours of casting machine restoration before resumption of casting.

4. EAF charge moisture detection AI (Danieli Q-ONE charge AI, Primetals EAF scrap analysis AI, scrap yard inspection drone AI)

Electric arc furnaces melt steel scrap — pressed scrap bundles, shredded scrap, direct reduced iron (DRI), and pig iron — by striking high-current DC or AC electric arcs between graphite electrodes and the scrap charge. A critical pre-charge safety requirement is that all scrap charged into the EAF be dry (moisture content below approximately 0.3–0.5% by weight), because when liquid water or ice-containing scrap contacts the molten steel heel retained in the EAF furnace bowl from the previous heat, the water instantly vapourises at the 1,500°C molten steel surface temperature, generating steam at several hundred bar within the scrap charge pile. If the scrap pile prevents immediate steam venting, a steam explosion ejects the scrap charge, liquid steel splash, and furnace roof components from the EAF. Scrap moisture monitoring is performed by Danieli Q-ONE charge management AI, Primetals EAF scrap analysis AI, and increasingly by autonomous scrap yard inspection drones (DJI Matrice 300 with multispectral or near-infrared cameras) that scan scrap bundles in the charging bucket before bucket loading. These systems render the scrap inspection result as a spectroscopic scan image (near-infrared reflectance spectrum showing moisture absorption bands at 1,450 nm and 1,940 nm) or as a visual moisture classification map overlay on a drone RGB camera image, which is then processed by moisture classification AI to determine whether the scrap charge qualifies as dry (below 0.3% moisture, safe to charge) or wet (above 0.3% moisture, requires drying before charging).

An adversarial perturbation on a rendered scrap moisture spectrogram image that suppresses the moisture absorption band signature — applying a ±10 DN downward shift to the spectral absorbance values at the 1,450 nm and 1,940 nm moisture absorption peak wavelengths in the rendered near-infrared spectrum image, reducing the peak absorbance amplitudes below the AI’s moisture classification threshold — causes the scrap moisture AI to classify a wet scrap charge (containing 1–5% moisture by weight, corresponding to rain-soaked or frost-containing scrap) as dry, clearing the charge for loading into the EAF charging bucket. A full 40–70 tonne scrap charge containing 1% moisture by weight carries 400–700 kg of water. When this charge drops from the charging bucket into an EAF containing a 20–30 tonne liquid steel heel at 1,500°C, the 400–700 kg of water contacts the molten steel surface across the full floor area of the EAF furnace bowl simultaneously, producing a steam explosion with energy equivalent to a multi-kilogram TNT detonation within the EAF shell. The ABS Steel Carini Italy EAF explosion of 2022 killed two steelworkers and injured others in exactly this sequence: wet scrap charged into an EAF containing a molten heel produced a hydrogen-steam explosion. The Italian prosecution of steelworks management for the ABS Carini explosion centred on the failure of the pre-charge moisture verification process — adversarial injection targeting the scrap moisture AI that now performs this verification function recreates the same failure in a digitally manipulated form.

Integration: steel mill blast furnace AI scanning with Glyphward pre-scan gate

The Glyphward scan gate for steel mill blast furnace AI belongs at every rendered-image ingestion boundary in the steelmaking AI pipeline — before tuyere thermal inspection AI processes rendered FLIR/Land thermal maps, before torpedo ladle fill AI processes rendered camera images, before continuous caster mold level AI processes rendered level trend images, and before EAF charge moisture AI processes rendered near-infrared spectrogram images. Threshold 35 for steel mill blast furnace AI contexts reflects the instantaneous consequence envelope of all four adversarial injection scenarios: tuyere burnthrough (instantaneous steam explosion at copper block failure), torpedo ladle overflow (immediate hot metal spill onto cast house), caster breakout (instantaneous 1,500°C steel breakthrough when sticker shell ruptures), and EAF explosion (instantaneous steam explosion when wet scrap contacts molten heel) — in each case, there is no complementary engineered safety layer that provides protection after the AI misclassification has occurred and the process has advanced past the intervention point.

import asyncio, base64, hashlib, json
from datetime import datetime, timezone
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Steel mill blast furnace and continuous casting AI contexts: threshold 35
# OSHA PSM 29 CFR 1910.119; EPA MACT Subpart L 40 CFR Part 63;
# ASTM E1820 (fracture toughness); ISO 17776 (hazard identification).
STEEL_MILL_AI_THRESHOLD = 35


class SteelMillAIContext(Enum):
    TUYERE_THERMAL         = "tuyere_thermal"         # BF tuyere copper block thermal image AI
    TORPEDO_LADLE_LEVEL    = "torpedo_ladle_level"    # Hot metal torpedo ladle fill level AI
    CASTER_MOLD_LEVEL      = "caster_mold_level"      # Continuous caster mold level trend AI
    EAF_SCRAP_MOISTURE     = "eaf_scrap_moisture"     # EAF scrap charge moisture spectrogram AI


class AdversarialSteelMillImageError(Exception):
    """Raised when Glyphward detects adversarial pixel content in a steel mill
    blast furnace AI rendered image above threshold 35.

    Consequence if not raised:
    - TUYERE_THERMAL: tuyere burnthrough → steam explosion + molten iron
      spray at 1,450°C across cast house → multiple fatalities.
    - TORPEDO_LADLE_LEVEL: ladle overflow → 1,450°C hot metal spill.
    - CASTER_MOLD_LEVEL: breakout sticker not detected → 1,500°C steel
      breakthrough below mold → casting machine destruction, fatality.
    - EAF_SCRAP_MOISTURE: wet scrap classified dry → steam explosion in
      EAF shell → worker fatality. ABS Carini 2022 consequence envelope.
    Fail-safe: halt AI process control recommendation; require manual
    operator inspection of affected furnace/caster/ladle before resuming.
    """

    def __init__(self, scan_id: str, score: int,
                 context: SteelMillAIContext,
                 site_id: str, unit_id: str,
                 heat_id: str | None,
                 flagged_region: dict | None = None) -> None:
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.site_id = site_id
        self.unit_id = unit_id
        self.heat_id = heat_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial steel mill image: "
            f"context={context.value} score={score} "
            f"site={site_id} unit={unit_id} heat={heat_id} scan_id={scan_id}"
        )


async def scan_steel_mill_image(
    image_bytes: bytes,
    context: SteelMillAIContext,
    site_id: str,
    unit_id: str,
    heat_id: str | None,
    operator_id: str,
    osha_psm_covered: bool,
    client: httpx.AsyncClient,
) -> dict:
    """Scan a steel mill blast furnace AI rendered image for adversarial
    content.

    Fail-safe contract: AdversarialSteelMillImageError or httpx error →
    halt AI process control recommendation for affected unit; require manual
    operator inspection of tuyere/ladle/caster/scrap charge before resuming
    per OSHA PSM 29 CFR 1910.119 safe work practices requirements.

    Args:
        image_bytes: Tuyere thermal map, torpedo ladle camera image,
            caster mold level trend render, or EAF scrap NIR spectrogram.
        context: SteelMillAIContext identifying the steelmaking data modality.
        site_id: Steel plant or site name.
        unit_id: Blast furnace, caster strand, EAF, or torpedo ladle ID.
        heat_id: Heat or cast sequence identifier (if applicable).
        operator_id: Steel company operator name.
        osha_psm_covered: Whether this facility is covered by OSHA PSM
            29 CFR 1910.119 (HF pickling above 1,000 lbs threshold).
        client: Shared httpx.AsyncClient for connection reuse.

    Returns:
        Glyphward scan result dict.

    Raises:
        AdversarialSteelMillImageError: if score exceeds threshold 35.
        httpx.HTTPStatusError: on Glyphward API error (fail-closed).
    """
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"steel_mill:{context.value}:{site_id}:{unit_id}:{heat_id}",
        "metadata": {
            "site_id": site_id,
            "unit_id": unit_id,
            "heat_id": heat_id,
            "operator_id": operator_id,
            "osha_psm_covered": osha_psm_covered,
            "image_sha256": image_hash,
            "context": context.value,
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()

    await _write_steel_mill_scan_audit(
        image_hash=image_hash,
        scan_id=result["scan_id"],
        score=result["score"],
        context=context,
        site_id=site_id,
        unit_id=unit_id,
        heat_id=heat_id,
        osha_psm_covered=osha_psm_covered,
        flagged=result["score"] > STEEL_MILL_AI_THRESHOLD,
    )

    if result["score"] > STEEL_MILL_AI_THRESHOLD:
        raise AdversarialSteelMillImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            site_id=site_id,
            unit_id=unit_id,
            heat_id=heat_id,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def _write_steel_mill_scan_audit(
    *, image_hash: str, scan_id: str, score: int,
    context: SteelMillAIContext, site_id: str,
    unit_id: str, heat_id: str | None,
    osha_psm_covered: bool, flagged: bool,
) -> None:
    record = {
        "ts": datetime.now(timezone.utc).isoformat(),
        "scan_id": scan_id,
        "image_sha256": image_hash,
        "context": context.value,
        "score": score,
        "threshold": STEEL_MILL_AI_THRESHOLD,
        "flagged": flagged,
        "site_id": site_id,
        "unit_id": unit_id,
        "heat_id": heat_id,
        "osha_psm_covered": osha_psm_covered,
        "regulatory_refs": [
            "OSHA PSM 29 CFR 1910.119 (Process Safety Management of Highly Hazardous Chemicals)",
            "EPA MACT Subpart L 40 CFR Part 63 (NESHAPs for Iron and Steel Manufacturing)",
            "OSHA 29 CFR 1910.67 (vehicle-mounted elevating platforms; BF maintenance AI)",
            "ISO 17776 (hazard identification in steel mill process safety management)",
            "ASTM E1820 (fracture toughness standard; steel quality AI)",
            "Japanese JIS G 3101 / JIS G 4051 (steel quality standards; caster product AI)",
            "AIST Steel Technology (tuyere burnthrough incident documentation)",
        ],
    }
    audit_path = Path("/var/log/glyphward/steel_mill_ai_scan_audit.jsonl")
    audit_path.parent.mkdir(parents=True, exist_ok=True)
    with audit_path.open("a") as fh:
        fh.write(json.dumps(record) + "\n")

Deploy scan_steel_mill_image at each steel mill AI rendered-image ingestion boundary: before tuyere thermal inspection AI (threshold 35), before torpedo ladle fill level AI (threshold 35), before continuous caster mold level AI (threshold 35), and before EAF scrap moisture AI (threshold 35). On AdversarialSteelMillImageError: halt the AI process control recommendation for the affected unit immediately and require manual operator inspection before resuming. For tuyere thermal AI: do not accept a “normal” classification from a flagged image — require physical tuyere inspection at the peephole camera and increased cooling water flow monitoring before resuming standard blast furnace operation. For EAF scrap moisture AI: do not charge the flagged scrap bucket — require a physical moisture inspection (pinch test, visual inspection for ice/water) of the scrap bundle before charge authorisation. See also: chemical plant process safety AI prompt injection (related OSHA PSM regulatory context) and smart manufacturing ICS AI prompt injection (related manufacturing AI context). Get early access

Related questions