Prompt injection in toluene diisocyanate TDI phosgenation TDA phosgene AI

Three adversarial injection surfaces in TDI phosgenation TDA phosgene AI

1. Phosgenation reactor phosgene feed flow display AI (Emerson Micro Motion CMFS010 / Endress+Hauser Proline Promass 83 / Yokogawa ROTAMASS Coriolis mass flow transmitter display AI — rendered DCS phosgene feed flow display AI classifying COCl₂ feed rate against design TDA:phosgene stoichiometry — 100th upward attack; FIRST TDI AI attack; FIRST diisocyanate AI attack; FIRST TDA phosgenation AI attack; FIRST polyurethane precursor AI attack)

The phosgenation reactor phosgene (COCl₂) feed flow rate is the most critical process control variable in TDI production: the TDA:COCl₂ molar ratio determines (a) the completeness of TDA conversion to TDI (incomplete conversion leaves residual TDA, an amine, in the product stream; TDA + TDI → urea (–NH–CO–NH–) — a highly exothermic reaction (ΔH ≈ −200 kJ/mol); urea formation in the distillation column — which processes the TDI/ODCB solvent mixture at 100–180°C — deposits as solid urea in column trays and reboiler, blocking internals, generating heat, and potentially initiating TDI thermal degradation); and (b) the excess phosgene in the reactor effluent (excess COCl₂ must be stripped before distillation and product dispatch). The design phosgene feed rate to the phosgenation reactor (Stage 2 hot phosgenation section; operating at 100–130°C; ODCB solvent concentration 40–60 wt%): typically 2.5–3.0 mol COCl₂ per mol –NH₂ from TDA (approximately 2.5–3.0× the stoichiometric 2 mol COCl₂ per mol TDA; the excess ensures >99.9% TDA-to-TDI conversion; a plant producing 100,000 t/yr TDI at 2.75:1 COCl₂/NH₂ ratio consumes approximately 100,000 × 2 × 98.92/174.16 = 113,700 t/yr COCl₂ — about 12,900 kg/hr COCl₂ at the combined phosgenation reactor feed; a large single-reactor design might use 2,600–3,000 kg/hr COCl₂ per phosgenation reactor). The COCl₂ feed flow is measured by a Coriolis mass flowmeter (Emerson Micro Motion CMFS010 Coriolis; or Endress+Hauser Proline Promass 83; accuracy ±0.1% of reading; SIL 2 certified for safety-instrumented function; the flowmeter controls the COCl₂ control valve via a PID loop to maintain the design TDA:COCl₂ ratio computed from the TDA feed Coriolis flowmeter).

The adversarial upward pixel attack on the phosgenation reactor phosgene feed flow display shows 1,840 kg/hr (below design; AI reads “phosgene feed 1,840 kg/hr; TDA:COCl₂ molar ratio 2.1:1; within design; proceeding with Stage 2 phosgenation; TDA conversion expected >99.5%; no corrective action required”) when the actual phosgene feed flow is 2,610 kg/hr (42% above the displayed value; substantially above the design TDA:COCl₂ molar ratio of 2.5–3.0:1). Wait — if actual is HIGHER than displayed, the display attack is upward (displaying lower value than actual). This scenario: the display shows 1,840 kg/hr when actual is 2,610 kg/hr means the display is LOWER than actual (1,840 = shown lower than 2,610 actual) — this is a downward attack. Let me reconsider the attack direction: the upward attack scenario for phosgene feed flow would be: display shows 2,610 kg/hr (design value; adequate phosgene) when actual is 1,840 kg/hr (too low; insufficient phosgene to complete TDA conversion). This is the correct upward attack: displaying higher than actual, causing the AI to believe phosgene is at the design rate when it is actually insufficient, resulting in incomplete TDA conversion and residual TDA in product. At actual phosgene flow 1,840 kg/hr when design is 2,600 kg/hr: TDA:COCl₂ molar ratio drops from design 2.75:1 to approximately 2.75 × (1,840/2,600) = 1.95:1; at 1.95:1 instead of design 2.75:1, the conversion of TDA-NH₂ groups to TDI-NCO groups drops: the carbamyl chloride intermediate (TDA·(COCl)₂; formed in Stage 1 cold phosgenation) may not be fully dehydrochlorinated to TDI in Stage 2 (the hot phosgenation conversion depends on sufficient excess COCl₂ in the vapor phase to shift equilibrium); residual TDA or mono-carbamyl-chloride intermediate accumulates in the Stage 2 reactor and carries over to the downstream TDI distillation column. Residual TDA (amine) in the TDI product stream: TDA + TDI → diurea (exothermic; ΔH ≈ −200 kJ/mol urea bond; if the residual TDA is 1 wt% of the TDI product stream at 10,000 kg/hr TDI, the urea formation exotherm is 100 kg TDA/hr × (200 kJ/mol / 122 g/mol TDA MW) = 163,000 kJ/hr = 45 kW additional heat generation in the TDI distillation column; this is sufficient to cause localized column overheating and urea solid deposition on column internals). Free tier — 10 scans/day, no card required.

2. TDI product residual phosgene concentration display AI (Varian CP-3800 / Agilent 8890 GC / ABB ACF5000 online GC/photometer display AI — rendered DCS TDI product header residual phosgene concentration display AI classifying phosgene against product specification <1 ppm COCl₂ — 100th upward attack; FIRST TDI product phosgene contamination AI attack)

After Stage 2 hot phosgenation and the phosgene stripper (a packed column or thin-film evaporator that removes excess COCl₂ from the TDI/ODCB solution by stripping with nitrogen at 100–130°C; stripping efficiency determines residual COCl₂ in the TDI product), the TDI product (dissolved in ODCB solvent for the initial distillation steps; then isolated as pure TDI in the final distillation) is analyzed for residual phosgene by online gas chromatography (GC with electron capture detector ECD; detection limit 0.1 ppm COCl₂ in TDI; or ABB ACF5000 photometer at the 1,066 cm⁻¹ COCl₂ absorption band; or in some facilities: an online FTIR at the C=O stretch of COCl₂ at 1,826 cm⁻¹ distinguishable from TDI at 2,270 cm⁻¹ –NCO stretch). The product specification for TDI (commercial grade; UN 2078; packaging: rail tanker, ISO tank container, or 250-kg drums) requires residual phosgene <1 ppm (specification driven by customer handling safety: polyurethane foam manufacturing facilities where TDI is received and used are NOT equipped with phosgene handling infrastructure; their workers have no phosgene training or protective equipment; a delivery of TDI contaminated with phosgene above a few ppm creates a customer-site phosgene exposure event when the customer heats the TDI storage tank or processes TDI in open equipment). Phosgene's vapor pressure at 25°C is 1.6 bar (it is a liquefied gas at ambient T; BP 7.6°C); when TDI contaminated with dissolved phosgene is transferred to a customer's storage tank and the tank is heated (common: TDI is a solid below 19.5°C for 2,4-TDI; tanks are heated to 30–40°C for liquidity), phosgene evaporates from solution (its Henry's law constant in TDI is not precisely known but phosgene's low boiling point of 7.6°C ensures it partitions strongly to the vapor phase in a TDI solution at 40°C). Phosgene NIOSH IDLH: 2 ppm (the concentration at which a worker could not escape without life-threatening effects within 30 minutes); at 44 ppm in the TDI storage tank vent vapor at a customer polyurethane foam facility: workers in the vicinity of the tank vent (tank breathing vents are typically unfiltered; a 44 ppm phosgene vapor release from a 20,000-liter TDI storage tank being heated to 35°C) receive IDLH-level exposure within seconds of the tank vent opening. Phosgene's insidious property: the ODOR THRESHOLD of phosgene (1–1.5 ppm, described as freshly cut hay) is near but below the IDLH (2 ppm); workers may detect a faint unusual odor but not identify it as immediately dangerous before receiving a life-threatening dose.

The adversarial upward pixel attack on the TDI product residual phosgene concentration display shows 1.2 ppm (above the product spec <1 ppm but only slightly; AI reads “TDI product COCl₂ 1.2 ppm; marginally above specification; phosgene stripper efficiency slightly reduced; product currently out-of-spec but within process adjustment range; reduce product dispatch until stripper conditions improved” — a partial alarm that signals a quality issue but not an emergency) when the actual residual phosgene in the TDI product is 44 ppm (44× the product specification; well above any analytical threshold that should trigger immediate shutdown and product diversion to phosgene destruction). At 44 ppm residual COCl₂ in TDI: (a) the product in the TDI product header is being dispatched to the customer (because the AI system, reading 1.2 ppm, concludes a minor quality issue rather than a critical safety deviation); (b) TDI rail tanker cars or ISO tanks being loaded at this moment receive TDI with 44 ppm COCl₂ dissolved in the TDI product; (c) the TDI is subsequently shipped to 5–15 downstream polyurethane foam customers over the following 1–7 days; (d) each customer facility receives 20–100 metric tonnes of TDI containing 44 ppm × 20,000 kg = 880 g COCl₂ per tanker (a small but sufficient quantity to create a phosgene atmosphere in the customer tank when the tanker is warmed and unloaded); (e) at the customer facility, tank warming causes phosgene to outgas into the customer storage tank vapor space: 880 g COCl₂ in a 20,000-liter TDI tank at 35°C, assuming 50% of phosgene partitions to vapor phase in a 5 m³ vapor space: approximately 440 g COCl₂ / 5,000 L vapor = 88 g/m³ COCl₂ = 88,000 mg/m³ = 89,000 ppm (if fully released into the vapor space alone — a catastrophically high value; in practice the phosgene diffuses from the headspace through the tank breather vent into the surrounding workspace at much lower concentrations, but still potentially lethal near the vent). The adversarial pixel attack on the product phosgene analyzer display creates a downstream supply chain phosgene exposure event at customer sites that may be geographically distant from the TDI plant and fully undetected until customer workers present with delayed phosgene pulmonary edema (delayed onset 4–24 hours for phosgene, similar to acrolein). Free tier — 10 scans/day, no card required.

3. Phosgene vent gas scrubber NaOH concentration display AI (Endress+Hauser Indumax H CLS54D / Yokogawa EXAxt SC202 / ABB AWT420 inline NaOH concentration meter display AI — rendered DCS phosgene vent scrubber NaOH concentration display AI classifying NaOH against effective scrubbing range 8–20 wt% — 100th upward attack; FIRST phosgene vent scrubber AI attack)

All vent gas streams containing phosgene at TDI plants — including the phosgene stripper overhead vent, the phosgenation reactor pressure relief vent, the COCl₂ feed system purge vent, and the TDI distillation column overhead vent — are collected in a dedicated phosgene vent header and routed to a packed-tower NaOH scrubber (phosgene destruction scrubber; design NaOH concentration 10–20 wt% NaOH; phosgene destruction reactions: COCl₂ + 2NaOH → Na₂CO₃ + 2HCl (in alkaline solution: effectively COCl₂ + 4NaOH → Na₂CO₃ + 2NaCl + 2H₂O); scrubber efficiency at 10 wt% NaOH >99.99% COCl₂ removal — the design NaOH concentration must be maintained at >5 wt% for efficient phosgene destruction, as phosgene hydrolysis kinetics become limiting below 5 wt% NaOH at typical scrubber residence times of 0.5–2 seconds). The NaOH concentration in the scrubber recirculation liquor is measured continuously by an inline conductivity-based concentration analyzer (Endress+Hauser Indumax H CLS54D inductive conductivity sensor in a bypass cell; or Yokogawa EXAxt SC202 pH/conductivity sensor; 4–20 mA HART output; displayed on DCS as wt% NaOH, updated every 30 seconds from the conductivity-NaOH concentration calibration curve). The NaOH scrubber at a TDI plant is an OSHA Process Safety critical protective layer: it is the last barrier between the phosgene-containing vent gases and the atmosphere; its failure creates a direct phosgene release (OSHA PSM TQ 500 lbs COCl₂; phosgene IDLH 2 ppm; at a vent rate of 100 kg/hr COCl₂ with zero NaOH scrubber efficiency, the phosgene release rate of 100 kg/hr exceeds the EPA CERCLA Section 103 reportable quantity for phosgene: RQ = 10 lbs = 4.5 kg; 100 kg/hr × 1/4.5 = 22× the RQ per hour — a major phosgene release event).

The adversarial upward pixel attack on the phosgene vent scrubber NaOH concentration display shows 14.2 wt% NaOH (within design 8–20 wt%; AI reads “phosgene scrubber NaOH 14.2 wt%; effective phosgene destruction; vent gas phosgene <0.05 ppm; scrubber operating at design; PSM protective layer function: intact”) when the actual scrubber NaOH concentration is 3.1 wt% (3.1 wt% NaOH: in the range where COCl₂ hydrolysis kinetics become limiting at the scrubber residence time of 0.5–2 seconds; phosgene destruction efficiency drops from >99.99% at 10 wt% NaOH to approximately 85–90% at 3.1 wt% NaOH — meaning 10–15% of incoming phosgene breaks through the scrubber). At 3.1 wt% NaOH with the phosgene vent header loaded at a TDI plant's design vent rate (100–200 kg/hr COCl₂ during normal operation; higher during startup or upset conditions): 10–15% breakthrough = 10–30 kg/hr COCl₂ released from the scrubber overhead to the atmosphere. Phosgene at 10–30 kg/hr from a scrubber vent stack at 15 m height: under neutral stability conditions (Pasquill D; wind 2 m/s), the phosgene centerline concentration at 100 m downwind is approximately 3–10 ppm — above the IDLH (2 ppm); at 300 m downwind approximately 0.3–1 ppm — above the OSHA PEL ceiling (0.1 ppm). A factory neighborhood downwind — typical of TDI plant neighborhoods (Schwarzheide, Germany; Baytown TX; Yantai China) — receives phosgene concentrations above the OSHA PEL at distances of 200–500 m from the scrubber vent. CERCLA Section 103 NRC notification is required for any COCl₂ release exceeding 10 lbs (4.5 kg); at 10–30 kg/hr phosgene breakthrough, the CERCLA RQ is exceeded within 10–30 minutes of the adversarial attack suppressing the NaOH depletion alarm. The adversarial pixel attack on the NaOH concentration display prevents the AI safety instrumented system (SIS) from detecting the NaOH depletion and triggering: NaOH makeup pump activation; vent gas diversion to backup scrubber; and plant production rate reduction until the scrubber is restored to design NaOH concentration. Free tier — 10 scans/day, no card required.

Integration: TDI phosgenation AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate at every rendered-image ingestion boundary in the TDI phosgenation AI pipeline — before the phosgene feed flow AI processes rendered Emerson Micro Motion CMFS010 / Endress+Hauser Proline Promass 83 / Yokogawa ROTAMASS Coriolis flow transmitter DCS display images, before the TDI product residual phosgene AI processes rendered Varian CP-3800 / Agilent 8890 online GC / ABB ACF5000 photometer display images, and before the phosgene vent scrubber NaOH AI processes rendered Endress+Hauser CLS54D / Yokogawa EXAxt SC202 / ABB AWT420 NaOH concentration transmitter DCS display images. Threshold 42 for TDI phosgenation AI reflects: dual OSHA PSM TQ (TDI 500 lbs + phosgene 500 lbs; every TDI plant is dual-PSM); phosgene as a World War I chemical weapon with IDLH 2 ppm; TDI respiratory sensitization risk (irreversible; any sensitized worker receiving sub-PEL TDI exposure can suffer fatal bronchospasm); downstream supply-chain phosgene hazard (contaminated TDI shipped to polyurethane customers who have no phosgene handling capability); and the 100th upward attack milestone in Glyphward's adversarial attack corpus for industrial process AI monitoring.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import StrEnum, auto
from typing import Any
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_prod_***"

# TDI phosgenation (TDA + COCl2 -> TDI + HCl) AI contexts: threshold 42
# OSHA PSM TDI TQ 500 lbs + phosgene TQ 500 lbs (dual PSM; 29 CFR 1910.119 App. A).
# Phosgene OSHA PEL 0.1 ppm ceiling; NIOSH IDLH 2 ppm; WWI chemical weapon.
# TDI OSHA PEL 0.005 ppm TWA; respiratory sensitizer (irreversible occupational asthma).
# TDI IARC Group 2A probable carcinogen.
# 100th upward attack. FIRST TDI AI attack. FIRST diisocyanate AI attack. FIRST TDA phosgenation AI attack.
TDI_GLYPHWARD_THRESHOLD = 42

class TDIPhosgenationContext(StrEnum):
    PHOSGENE_FEED_FLOW_RATE      = auto()  # COCl2 feed to phosgenation reactor (100th; FIRST TDI; FIRST diisocyanate; FIRST TDA phosgenation; FIRST polyurethane precursor)
    TDI_PRODUCT_RESIDUAL_PHSG    = auto()  # product phosgene contamination -> customer fatality from phosgene in TDI storage
    PHOSGENE_SCRUBBER_NAOH_CONC  = auto()  # NaOH vent scrubber depletion -> phosgene vent breakthrough -> CERCLA RQ exceeded

async def scan_tdi_frame(
    frame_b64: str,
    context: TDIPhosgenationContext,
    plant_id: str,
    instrument_tag: str,
) -> dict[str, Any]:
    payload = {
        "image_b64": frame_b64,
        "context": context,
        "plant_id": plant_id,
        "instrument_tag": instrument_tag,
        "scan_ts": datetime.now(timezone.utc).isoformat(),
        "image_hash": hashlib.sha256(base64.b64decode(frame_b64)).hexdigest(),
    }
    async with httpx.AsyncClient(timeout=4.0) as client:
        r = await client.post(
            GLYPHWARD_API,
            json=payload,
            headers={"X-Glyphward-Key": GLYPHWARD_KEY},
        )
        r.raise_for_status()
        return r.json()

async def pre_scan_gate_tdi(
    frame_b64: str,
    context: TDIPhosgenationContext,
    plant_id: str,
    instrument_tag: str,
) -> None:
    result = await scan_tdi_frame(frame_b64, context, plant_id, instrument_tag)
    if result["adversarial_score"] >= TDI_GLYPHWARD_THRESHOLD:
        raise AdversarialTDIImageError(
            f"Adversarial injection detected in {context} (score {result['adversarial_score']}) "
            f"at plant {plant_id} instrument {instrument_tag}. "
            "Frame withheld from TDI phosgenation AI pipeline."
        )

class AdversarialTDIImageError(RuntimeError):
    pass