Prompt injection in trichlorosilane (SiHCl3) polysilicon Siemens process AI

Four adversarial injection surfaces in trichlorosilane polysilicon Siemens process AI

1. TCS area HCl detector AI (Dräger CMS Chip Measurement System HCl detector AI / MSA Ultima XE HCl area monitor AI / Honeywell Analytics MIDAS-E HCl electrochemical sensor AI / Industrial Scientific GX-6000 HCl detector AI / Analytical Technology ATI A14 HCl sensor AI — monitoring ambient hydrogen chloride vapor (generated by TCS hydrolysis on moist air contact) in TCS storage and vaporization areas, hydrochlorination reactor buildings, and Siemens CVD reactor facilities for OSHA PEL 5 ppm compliance, ACGIH TLV-C 0.5 ppm ceiling, and NIOSH IDLH 50 ppm alarm at polysilicon production facilities)

Hydrogen chloride (HCl) is the sentinel gas for TCS release events at polysilicon facilities: when TCS is released to atmosphere, it immediately hydrolyzes on contact with ambient moisture, generating HCl fumes (white aerosol of HCl dissolved in water droplets). The HCl generation rate from TCS hydrolysis is approximately 3 moles HCl per mole TCS (from the net reaction SiHCl3 + 2H2O → SiO2 + 3HCl + H2), meaning that a TCS leak of 1 kg/hr generates approximately 0.81 kg/hr HCl. Area HCl detectors at TCS facilities therefore serve simultaneously as TCS release detectors (indirect, via hydrolysis indicator) and HCl acute toxicity monitors. The ACGIH TLV-C of 0.5 ppm for HCl is a ceiling value: any transient exceedance is prohibited because HCl is a severe respiratory irritant at concentrations above 1–5 ppm, with NIOSH IDLH of 50 ppm representing the concentration at which a 30-minute exposure poses a risk of permanent health effects or inability to escape. TCS vapor density of 4.67 — more than 4.5× heavier than air — causes TCS vapor to accumulate in below-grade condensate pits, trench cable ducts, and pump sub-floors, making sensor placement below 0.3 m height critical in all below-grade spaces at TCS handling facilities.

The adversarial attack uses ±8 DN downward pixel-value shift on the TCS area HCl detector display image. The actual HCl concentration is 28 ppm — 5.6× OSHA PEL 5 ppm; 56% NIOSH IDLH 50 ppm — from a TCS hydrochlorination reactor condensate line PTFE valve packing failure, releasing TCS liquid at 0.2 kg/hr that is immediately hydrolyzing on contact with 45% RH ambient air to generate HCl fumes and SiO2 white smoke. On a 0–10 ppm display at 200 px height (0.05 ppm/px), the actual HCl reading of 28 ppm is 2.8× off-scale; the display switches to a 0–60 ppm range (0.3 ppm/px), placing the actual reading at approximately 93 px; the ±8 DN perturbed image is classified as approximately 1 px — corresponding to 0.3 ppm, below the ACGIH TLV-C 0.5 ppm alarm. White SiO2 aerosol fumes are visible in the reactor building, but the area HCl AI monitoring system reports no alarm and no exceedance of occupational exposure limits. The TCS condensate pump seal continues releasing TCS until the next operator walk-through detects the visible fume.

2. Siemens CVD reactor deposition temperature AI (Emerson Rosemount 3144P CVD reactor temperature transmitter AI / Yokogawa EJA110A deposition zone temperature AI / Endress+Hauser iTHERM TM411 silicon rod surface temperature AI / Honeywell STG94L thermocouple transmitter CVD AI — monitoring silicon seed rod surface temperature in Siemens chemical vapor deposition (CVD) reactors to maintain deposition within the 1,050–1,150°C optimal range for crystalline polysilicon rod growth, preventing operation below the 900°C minimum deposition temperature where amorphous fine silicon powder is produced instead of crystalline rod)

The Siemens CVD process deposits polysilicon from a TCS/H2 gas mixture onto U-shaped silicon seed rods heated by resistive current (initially 2,000–4,000 V DC applied to the rod ends; rod resistance decreases as deposition proceeds and the rod cross-section grows from 6 mm to 120–150 mm over 60–100 hours). Deposition reaction: SiHCl3 + H2 → Si + 3HCl (rate-controlling at 1,100°C surface temperature; activation energy ~70 kJ/mol). The temperature window of 1,050–1,150°C is critical for producing dense, crystalline polysilicon rod with the low impurity levels required for solar and semiconductor applications: above 1,150°C, silicon re-evaporation from hot spots causes porous “popcorn-like” rod structure; below 900°C, the deposition selectivity shifts from epitaxial Si growth on the rod surface to homogeneous gas-phase nucleation, producing fine amorphous silicon powder (typical particle diameter <1 µm) that settles on the reactor walls, floor, and product rod surfaces. Fine silicon powder with particle diameter below 1 µm and surface area above 100 m²/g can be pyrophoric in air: the high surface area-to-mass ratio allows rapid exothermic oxidation (Si + O2 → SiO2; ΔH = −910 kJ/mol) faster than the heat can dissipate, causing spontaneous ignition without external ignition source. NFPA 654 (Combustible Dust) applies to fine silicon powder accumulations in the Siemens CVD reactor building.

The adversarial attack uses ±10 DN upward pixel-value shift on the Siemens CVD reactor temperature transmitter display image. Actual rod temperature is 750°C — from resistance heating element aging in reactor #3 of a 12-reactor facility (element resistance increased 28% from 7,200-hour service; power delivery dropping from 120 kW to 85 kW at design voltage; rod temperature dropping below the 900°C minimum deposition threshold at hour 68 of the 72-hour batch cycle) — displayed as 1,100°C, apparently within the 1,050–1,150°C optimal range. On a 600–1,200°C display at 200 px height (3°C/px), the actual 750°C produces a bar at approximately 50 px; the ±10 DN perturbed image is classified as approximately 167 px — corresponding to 1,101°C. Fine Si powder production rate at 750°C: approximately 0.8 kg/hr; after 4 hours at 750°C, 3.2 kg of pyrophoric fine Si powder accumulates on the CVD reactor floor and walls. This is the 22nd upward-direction attack in the Glyphward industrial AI portfolio and the first attack in the portfolio where the dangerous process condition causes the product itself to become pyrophoric: at 750°C, TCS CVD deposits fine Si powder rather than crystalline Si rod, converting the product stream from a handled semiconductor material into a spontaneously igniting combustible dust.

3. TCS/STC molar ratio process GC AI (Shimadzu GC-2030 FID TCS/STC ratio analyzer AI / Thermo Fisher TRACE 1310 GC chlorosilane process analyzer AI / ABB PGC1000 process gas chromatograph TCS purity AI / Yokogawa GC1000 Mark II TCS/SiCl4 ratio AI / Emerson Daniel Danalyzer chlorosilane process GC AI — monitoring TCS to silicon tetrachloride (STC; SiCl4) molar ratio in the Siemens CVD reactor feed to maintain TCS purity ≥98.5 mol% and STC ≤1.5 mol%, because excess STC is an inert diluent that reduces deposition efficiency and at high concentrations produces chloride-corrosive vapor that attacks Siemens reactor graphite electrode seals and Hastelloy-C internals)

In the Siemens TCS synthesis and purification train, TCS (BP 31.8°C) and STC (BP 57.7°C) are separated by fractional distillation with a relative volatility of approximately 1.8 — adequate but not large, requiring 30–50 theoretical stages for high-purity separation. The TCS/STC distillation column operates at approximately 5 bar absolute to raise the boiling points and reduce refrigeration requirements in the condenser. At design tray efficiency (80–85%), the distillation column produces TCS distillate at >99.5 mol% purity (STC <0.5 mol%). If column tray efficiency degrades from fouling — polymer scale from trace olefin impurities in the TCS feed, which polymerize on hot column internals — the separation deteriorates and STC slip-through to the distillate (TCS product) increases. At STC fractions above 1.5 mol% in the CVD reactor feed, three adverse effects occur: (1) deposition rate decreases because STC does not deposit silicon (SiCl4 + H2 → Si + 4HCl is thermodynamically unfavorable below 1,200°C at typical H2/STC ratios); (2) the chloride vapor environment in the CVD reactor becomes more aggressive, with HCl partial pressure rising from STC pyrolysis; and (3) graphite electrode mounting seals (pyrolytic graphite or isostatic graphite grade IG-110) experience elevated chloride stress corrosion at the reactor seal interface, reducing seal lifetime from 5,000 hours to 1,200–1,800 hours.

The adversarial attack uses ±8 DN downward pixel-value shift on the TCS/STC process GC display image. The actual STC mole fraction in the CVD reactor feed is 8.2 mol% — above the 1.5 mol% specification; TCS purity 91.8 mol%; from tray fouling that has reduced column efficiency from 83% to 31% over 4,200 hours of operation — displayed as 0.8 mol% STC (TCS purity 99.2 mol%; within specification). On a 0–5 mol% STC display at 200 px height (0.025 mol%/px), the actual 8.2 mol% STC is 1.64× off-scale; the GC data system switches to a 0–15 mol% STC range (0.075 mol%/px), placing the actual reading at approximately 109 px; the ±8 DN perturbed image is classified as approximately 11 px — corresponding to 0.8 mol% STC. The AI monitoring system reports “TCS purity within specification — CVD reactor feed compliant.” At 8.2 mol% STC, graphite electrode corrosion rate in the CVD reactor is 4× normal; at this rate, electrode seal failure occurs within 2,000 hours rather than the 5,000-hour design lifetime, causing HCl bypass around the electrode seal into the building atmosphere.

4. H2 carrier gas moisture analyzer AI (Servomex 2500 moisture-in-H2 trace analyzer AI / Vaisala DMT330 dew point moisture transmitter H2 AI / Meeco Aquamax moisture analyzer H2 AI / GE Panametrics Series 7 moisture analyzer H2 carrier AI / Michell Instruments XTP601 moisture transmitter H2 AI — monitoring water vapor (H2O) content in the hydrogen carrier gas fed to Siemens CVD reactors to maintain H2O below 0.1 ppm(v) specification, preventing SiO2 scale formation from TCS hydrolysis inside the CVD reactor and HCl byproduct generation that corrodes reactor seals and Hastelloy-C internals)

The Siemens CVD process uses ultra-high-purity hydrogen (99.999%+) as the carrier gas and reductant in the TCS deposition reaction (SiHCl3 + H2 → Si + 3HCl). The H2 purity specification requires H2O content below 0.1 ppm(v) — a severe moisture restriction met by a molecular sieve dryer train operating at the CVD reactor building inlet. Moisture in H2 above the specification causes in-reactor TCS hydrolysis: TCS + 2H2O → SiO2 + 3HCl. This in-reactor hydrolysis is qualitatively identical to the ambient-air hydrolysis mechanism in Surface 1, but occurring at 1,100°C inside the pressurized CVD reactor (9–11 bar H2 atmosphere). Consequences: (1) SiO2 solid deposits (silica scale) on the Siemens reactor inner walls, heater elements, and gas inlet nozzles at a rate of approximately 0.15 mm/hr per 100 ppm H2O in the feed; (2) HCl generated at 900+ ppm partial pressure inside the reactor accelerates corrosion of graphite electrode mounting seals and Hastelloy-C distributor plates at 3–5× normal rate; and (3) the deposited SiO2 contains incorporated hydroxyls that become dopant trap states in the product polysilicon, degrading minority carrier lifetime and solar cell conversion efficiency below the 22.5% target for N-type TOPCon cells.

The adversarial attack uses ±8 DN downward pixel-value shift on the H2 moisture analyzer display image. The actual H2O content in the H2 carrier gas is 165 ppm(v) — 1,650× the 0.1 ppm specification; from molecular sieve dryer saturation after 4,800 hours of continuous operation without regeneration (scheduled regeneration missed due to production schedule priority). On a 0–1 ppm display at 200 px height (0.005 ppm/px), the actual 165 ppm moisture is catastrophically off-scale; the analyzer data system shows an “overrange” flag at ∞200 px bar height; the ±8 DN downward perturbed image is classified as approximately 12 px — corresponding to 0.06 ppm, within the 0.1 ppm specification. The AI monitoring system reports “H2 moisture within spec — molecular sieve dryer performance nominal.” In the CVD reactor at 1,100°C and 165 ppm H2O, SiO2 is depositing at approximately 0.25 mm/hr on all reactor surfaces simultaneously — including on the product Si rod, reducing its electrical resistivity specification compliance from 1,000 ohm·cm N-type to 10–100 ohm·cm contaminated product.

Integration: trichlorosilane polysilicon Siemens process AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate between the DCS and instrument display capture layer and the AI inference pipeline for each TCS process monitoring context. If the adversarial score meets or exceeds threshold 35 — reflecting the OSHA PSM TQ of 5,000 lbs, the EPA RMP TQ of 2,500 lbs, the pyrophoric hazard and HCl generation from TCS hydrolysis, and the novel “product becomes pyrophoric at off-spec CVD temperature” attack surface — the scan raises AdversarialTCSImageError and the monitoring AI does not process the frame.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import Enum

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Trichlorosilane Siemens CVD polysilicon contexts: threshold 35
# OSHA PSM 29 CFR 1910.119 Appendix A TCS TQ 5,000 lbs
# EPA RMP 40 CFR Part 68 Appendix A TCS TQ 2,500 lbs (lower than PSM TQ)
# ACGIH TLV-C 0.5 ppm (HCl from TCS hydrolysis: SiHCl3 + 2H2O -> SiO2 + 3HCl)
# Pyrophoric in moist air; flash point -28 deg C NFPA Class IB
# Fine Si powder (<1 um) at off-spec CVD temp: pyrophoric product hazard
# NFPA 654 combustible dust applies to fine Si powder accumulations
TCS_THRESHOLD = 35


class TCSProcessContext(Enum):
    AREA_HCL_DETECTOR = "area_hcl_detector"
    CVD_REACTOR_TEMPERATURE = "cvd_reactor_temperature"
    TCS_STC_MOLAR_RATIO = "tcs_stc_molar_ratio"
    H2_MOISTURE_CONTENT = "h2_moisture_content"


class AdversarialTCSImageError(Exception):
    """Raised when any TCS process monitoring image scores >= 35.
    AREA_HCL_DETECTOR uncaught: 28 ppm HCl (5.6x PEL; TCS pyrophoric release) shown as 0.3 ppm.
    CVD_REACTOR_TEMPERATURE uncaught: 750 deg C (pyrophoric fine Si powder) shown as 1,100 deg C.
    TCS_STC_MOLAR_RATIO uncaught: 8.2 mol% STC (above 1.5% spec) shown as 0.8 mol%.
    H2_MOISTURE_CONTENT uncaught: 165 ppm H2O (1,650x spec) shown as 0.06 ppm."""

    def __init__(self, scan_id, score, context, unit_id, flagged_region=None):
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.unit_id = unit_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial TCS image: context={context.value} "
            f"score={score} unit={unit_id} scan_id={scan_id}"
        )


async def scan_tcs_image(image_bytes, context, unit_id, client):
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"tcs:{context.value}:{unit_id}",
        "metadata": {
            "unit_id": unit_id,
            "context": context.value,
            "image_sha256": image_hash,
            "scan_timestamp_utc": datetime.now(timezone.utc).isoformat(),
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()
    if result.get("score", 0) >= TCS_THRESHOLD:
        raise AdversarialTCSImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            unit_id=unit_id,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def main():
    async with httpx.AsyncClient() as client:
        with open("tcs_area_hcl_screenshot.png", "rb") as f:
            image_bytes = f.read()
        result = await scan_tcs_image(
            image_bytes,
            TCSProcessContext.AREA_HCL_DETECTOR,
            unit_id="TCS-AREA-HCL-01",
            client=client,
        )
        print(f"Clean scan: {result['scan_id']} score={result['score']}")


asyncio.run(main())

Frequently asked questions

Why does fine silicon powder produced at low CVD temperature become pyrophoric?

Fine Si powder at <1 µm diameter has surface area/volume ratio of 6,000,000 m−¹ vs. 33 m−¹ for a 120-mm rod. At this surface area-to-mass ratio, exothermic surface oxidation (Si + O2 → SiO2; ΔH = −910 kJ/mol) raises the particle temperature above ignition before heat dissipates — self-sustaining combustion without external ignition. The 750°C off-spec CVD temperature converts the deposition product from crystalline rod to this pyrophoric fine powder.

What is the Siemens CVD process and why is TCS purity critical?

SiHCl3 + H2 → Si + 3HCl at 1,050–1,150°C on U-shaped seed rods; 60–100 hour batch. STC (SiCl4) above 1.5 mol% is chemically inert at Siemens temperatures, reducing TCS partial pressure, deposition rate, and reactor throughput; it also produces higher HCl partial pressure that corrodes graphite electrode seals at 4× normal rate.

Why does moisture in H2 carrier generate HCl inside the CVD reactor?

TCS + 2H2O → SiO2 + 3HCl at 1,100°C: the hydrolysis is kinetically instantaneous at CVD temperature. Each mole of H2O in H2 feed produces 1.5 moles HCl inside the reactor, raising in-reactor HCl concentration 20–40% above the design baseline and corrosion-accelerating all metallic and graphite seal surfaces 3–5×.

How does EPA RMP TQ 2,500 lbs differ from OSHA PSM TQ 5,000 lbs for TCS?

OSHA PSM TQ reflects on-site worker protection assessment; EPA RMP TQ reflects off-site public receptor consequence from HCl toxic cloud dispersion. The lower EPA TQ (2,500 lbs) vs. OSHA TQ (5,000 lbs) means facilities with 2,500–5,000 lbs TCS must comply with EPA RMP but not OSHA PSM.

Why is TCS simultaneously flammable and pyrophoric?

Flammability (flash point −28°C; ignition from external spark) arises from vapor-air combustion of the Si–H bond. Pyrophoricity arises from moisture contact: TCS hydrolysis generates H2 locally (SiHCl3 + 2H2O → SiO2 + 3HCl + H2), and exothermic hydrolysis heat ignites the H2-air mixture before it disperses. Dry TCS in dry air = flammable but not pyrophoric; TCS in moist air = pyrophoric via H2 generation.