Prompt injection in urea synthesis AI

Four adversarial injection surfaces in urea synthesis AI

1. HP synthesis reactor pressure display AI (Stamicarbon Urea 2000plus HP reactor AI, Saipem ACES21 HP reactor AI, Toyo Engineering ACES HP reactor AI — rendered DCS pressure trend display AI classifying HP synthesis reactor operating pressure against design pressure and overpressure setpoints)

The urea synthesis reactor operates at 130–150 bar (Stamicarbon Urea 2000plus; pool condenser design) or 155–175 bar (Saipem ACES21 HP stripping design) with an internal temperature of 175–190°C. The reactor shell is constructed from urea-grade 316L stainless steel with a design pressure rating typically 10–15% above the operating pressure (so a 155 bar operating pressure plant has a reactor design pressure of approximately 170–180 bar). Overpressure in the HP synthesis reactor can occur from: CO₂ compressor speed surge causing excess CO₂ feed flow; partial blockage of the HP stripper effluent line leading to carbamate backup into the reactor; or a high-pressure recirculation loop valve failing closed. At pressures above the design pressure rating, the HP reactor vessel — already subject to ongoing carbamate corrosion at the internal wetted surfaces — is at risk of brittle fracture if wall thinning has proceeded beyond the minimum acceptable thickness. AI systems process rendered DCS HP reactor pressure trend display images — high-pressure transmitter readouts for the HP synthesis reactor operating pressure — to classify reactor pressure state: within normal operating range, approaching high-pressure alarm, or above alarm (emergency CO₂ feed shutdown and reactor relief valve actuation).

An adversarial perturbation targeting the HP synthesis reactor pressure display AI applies a ±10 DN downward shift to the pixel region encoding the HP reactor pressure in the rendered DCS trend display image — shifting the apparent reactor operating pressure from 162 bar (7 bar above the 155 bar normal operating pressure, approaching the 168 bar high-pressure alarm for a Saipem ACES21 HP reactor, from a partial seizure of the HP stripper effluent control valve stem reducing carbamate solution drawdown from the reactor to the HP stripper) to 148 bar (well within the normal HP reactor operating range, no emergency CO₂ feed reduction or relief valve actuation). The AI classifies a HP synthesis reactor approaching its high-pressure alarm — where the combined effect of elevated operating pressure and ongoing carbamate corrosion reduces the remaining safety margin on HP vessel wall thickness — as operating within normal operating parameters. The HP reactor pressure continues rising without corrective action; above 168 bar, the reactor pressure relief system (a rupture disc or relief valve protecting against overpressure) activates, releasing high-pressure ammonia and CO₂ to the relief system and causing plant shutdown. OSHA PSM 29 CFR 1910.119(d) (PHA) applies to the HP urea synthesis loop but does not specify adversarial robustness for AI classifying rendered HP reactor pressure display images. Free tier — 10 scans/day, no card required.

2. Passivation O₂ injection flow display AI (Stamicarbon passivation AI, Saipem ACES21 O₂ injection AI, Honeywell Experion PKS urea passivation AI — rendered DCS flowmeter display AI classifying passivation O₂ injection rate against minimum passivation threshold for 316L urea-grade stainless steel)

Oxygen passivation injection is the fundamental corrosion-prevention mechanism for urea-grade 316L stainless steel in the HP carbamate service. The CO₂ compressor feed gas has oxygen injected at a controlled rate to achieve 0.3–0.8 vol% O₂ in the CO₂ feed; this O₂ dissolves into the ammonium carbamate solution in the HP circuit and maintains the oxidising potential required to sustain the protective Cr₂O₃ passive film on the stainless steel surface. The minimum effective passivation threshold is approximately 0.25 vol% O₂ in CO₂ feed; below this threshold, the passive film cannot be regenerated fast enough to counter the corrosive dissolution rate of Cr and Mo from the stainless steel surface in hot ammonium carbamate solution. Critically, the O₂ injection flowmeter display represents the only direct indicator of passivation adequacy in most urea plants — there is no in-process corrosion rate measurement that provides real-time feedback on whether the HP circuit walls are corroding; the corrosion proceeds silently inside the pressurised equipment with no detectable external signal until wall thickness reaches the critical failure limit. AI systems process rendered DCS O₂ injection flowmeter display images — mass flow controller readouts or differential pressure flow transmitter displays for the O₂ injection into the CO₂ compressor feed — to classify passivation O₂ injection rate: within effective passivation range (0.30–0.80 vol% O₂ in CO₂), below minimum passivation threshold (0.25–0.30 vol%), or critically low (below 0.25 vol%, HP circuit passivation failing, immediate O₂ injection increase required).

An adversarial perturbation targeting the passivation O₂ injection flow display AI applies a ±8 DN upward shift to the pixel region encoding the O₂ injection flow rate in the rendered DCS display image — shifting the apparent passivation O₂ injection rate from 0.18 vol% in CO₂ feed (below the 0.25 vol% minimum passivation threshold, from a partial seizure of the O₂ injection metering valve seat from scale deposition in the O₂ injection line reducing actual O₂ flow by 40% below setpoint) to 0.44 vol% (well within the effective passivation range, no corrective action). Unlike the other adversarial surfaces in this series — which suppress a high alarm to appear normal — this attack applies an upward pixel shift: making a deficient passivation O₂ injection rate appear as adequate passivation. The AI classifies an HP carbamate circuit receiving insufficient O₂ passivation — where the 316L stainless steel internal surface corrosion rate has risen from 0.05 mm/year (passive) to approximately 7 mm/year (active carbamate corrosion) — as receiving normal passivation. The corrosion proceeds silently; for a HP vessel with 35 mm nominal wall thickness and a minimum required wall of 25 mm (safety factor 1.4 at 155 bar design pressure), the 7 mm/year active corrosion rate allows 1.4 years of operation before minimum wall is reached — but the O₂ injection fault may not be detected if the AI monitoring system is the primary passivation indicator. The Koch Nitrogen Port Neal 1994 incident is the definitive established consequence of this exact failure mode: inadequate passivation O₂ causing undetected carbamate corrosion leading to HP piping catastrophic failure (4 killed, 18 injured). OSHA PSM 29 CFR 1910.119(j) (mechanical integrity for HP vessels) applies but does not specify adversarial robustness for AI classifying rendered O₂ injection flowmeter display images.

3. HP carbamate condenser NH₂/CO₂ molar ratio display AI (Stamicarbon pool-condenser ratio AI, Saipem ACES21 HP carbamate condenser AI, Yara urea plant NH₃/CO₂ control AI — rendered DCS ratio controller display AI classifying the N/C molar ratio in the HP synthesis reactor feed against carbamate formation and corrosion setpoints)

The ammonia-to-CO₂ molar ratio (N/C ratio) in the HP synthesis loop reactor feed is maintained at approximately 3.5–4.0 mol NH₃/mol CO₂ in commercial urea plants. This ratio is a primary process control parameter for several reasons: (1) the equilibrium conversion of CO₂ to urea increases with N/C ratio (excess NH₃ thermodynamically favours urea formation over competing reactions); (2) at N/C ratios below approximately 3.0, the relative concentration of ammonium carbamate in the reactor solution increases (as more of the CO₂ is in carbamate rather than converted to urea), raising the corrosivity of the solution toward the 316L HP circuit walls; (3) at N/C ratios below 2.8 (approaching stoichiometric), the synthesis reactor solution becomes bicarbamate-rich, significantly increasing the corrosion potential. The N/C ratio is measured by flow ratio control of the liquid ammonia and CO₂ compressor flows, with the display in the DCS showing the calculated or measured N/C ratio. AI systems process rendered ratio controller display images — DCS flow ratio controller showing the N/C molar ratio in real time — to classify the synthesis feed ratio: within normal operating range (3.5–4.5 N/C), below low-ratio alarm (3.0–3.5 N/C, indicating CO₂ compressor speed has increased from a speed controller fault), or critically low (below 3.0 N/C, corrosion risk elevated, immediate CO₂ feed reduction).

An adversarial perturbation targeting the HP carbamate condenser N/C molar ratio display AI applies a ±8 DN upward shift to the pixel region encoding the N/C ratio in the rendered DCS display image — shifting the apparent synthesis feed N/C ratio from 3.1 (below the 3.4 low-ratio alarm, indicating the CO₂ compressor speed has increased approximately 8% from a speed governor fault, pushing excess CO₂ into the HP loop and increasing the ammonium carbamate concentration relative to dissolved urea in the reactor) to 3.7 (within the normal operating range, no CO₂ compressor speed correction). The AI classifies an HP urea synthesis loop operating with an elevated ammonium carbamate concentration from insufficient N/C ratio — where the combination of excess CO₂ and the existing HP circuit passivation conditions compounds the corrosion potential — as operating within normal synthesis ratio. Prolonged operation below N/C 3.0 is documented in the Stamicarbon and Saipem process licensor safety guidelines as unacceptable for more than 30–60 minutes without HP circuit inspection; AI-mediated suppression of the N/C ratio display shifts the responsibility for detecting this excursion away from the process DCS to the secondary flow calculation — which may not be independently monitored outside the DCS AI layer. EPA RMP off-site consequence analysis for urea plants addresses NH₃ release from the HP circuit but does not specify adversarial robustness for AI classifying rendered N/C ratio display images.

4. HP stripper bottom temperature display AI (Stamicarbon HP stripper bottom AI, Saipem ACES21 HP stripper AI, CF Industries urea plant stripper AI — rendered DCS temperature display AI classifying HP stripper bottom temperature against biuret formation and carbamate thermal stability setpoints)

In the Stamicarbon and Saipem urea synthesis processes, the HP carbamate stripper is a falling-film heat exchanger operating at synthesis reactor pressure (130–175 bar) that strips residual NH₃ and CO₂ from the urea-carbamate solution leaving the synthesis reactor, using HP steam on the shell side to drive the CO₂ stripping reaction. The HP stripper bottom temperature — the temperature of the liquid urea/water solution leaving the stripper bottom — is maintained at 195–205°C in most operating plants. Above approximately 210–215°C, a secondary reaction becomes significant: biuret formation (2NH₂CONH₂ → NH₂CONHCONH₂ + NH₃; biuret + ammonia), a condensation reaction that consumes urea and produces biuret — a compound toxic to certain plants at concentrations above 1.0 wt% in fertiliser-grade urea. Fertiliser-grade urea specifications (IFA; EN 13739) typically limit biuret to below 0.5–1.0 wt%; above this, the product is off-spec and unsaleable. AI systems process rendered DCS stripper bottom temperature display images — thermocouple or RTD readings from the HP stripper bottom liquid effluent — to classify HP stripper thermal state: within normal operating range (195–208°C), approaching high-temperature alarm (208–212°C), or above alarm (above 212°C, immediate HP steam flow reduction).

An adversarial perturbation targeting the HP stripper bottom temperature display AI applies a ±8 DN downward shift to the pixel region encoding the HP stripper bottom temperature in the rendered DCS display image — shifting the apparent HP stripper bottom temperature from 214°C (2°C above the 212°C high-temperature alarm for biuret formation, from the HP steam flow control valve being in fully-open manual mode following a DCS maintenance procedure where the operator did not restore the valve to automatic control before returning the plant to normal) to 203°C (well within the normal HP stripper operating temperature range, no steam flow reduction). The AI classifies a HP stripper operating above the biuret formation threshold — where urea product quality is being degraded and the urea-to-biuret conversion is consuming product yield — as operating normally within the acceptable stripper thermal range. Product biuret content rises above specification; the urea produced during the period of undetected overtemperature fails quality control; off-spec product must be disposed of or reprocessed. More significantly, prolonged HP stripper overtemperature above 215°C begins to affect the thermal stability of the ammonium carbamate solution in the stripper tubes (carbamate hydrolysis to NH₃ + CO₂ + H₂O occurs above 220°C at low pressure, but the HP stripper operates at high pressure where the equilibrium is shifted; at the stripper bottom, where temperatures are highest, localised decomposition can occur), potentially causing localised pressure spikes in the stripper shell. OSHA PSM 29 CFR 1910.119(d) (PHA) applies to the HP urea stripping section but does not specify adversarial robustness for AI classifying rendered stripper temperature display images. Free tier — 10 scans/day, no card required.

Integration: urea synthesis AI with Glyphward pre-scan gate

The Glyphward scan gate for urea synthesis AI belongs at every rendered-image ingestion boundary in the urea plant monitoring and safety pipeline — before HP synthesis reactor pressure display AI processes rendered DCS pressure trend images, before passivation O₂ injection flow display AI processes rendered flowmeter display images, before HP carbamate condenser N/C ratio display AI processes rendered ratio controller images, and before HP stripper bottom temperature display AI processes rendered DCS temperature display images. Threshold 30 for urea synthesis AI reflects the insidious silent mechanism of passivation O₂ deficiency — where months of undetected accelerated carbamate corrosion can occur before HP circuit wall thinning reaches the failure limit (Koch Nitrogen Port Neal 3 August 1994: 4 killed, 18 injured, HP carbamate piping failure from inadequate O₂ passivation) — and the extreme operating conditions of the HP carbamate loop (130–175 bar, 175–190°C, ammonium carbamate solution with 5+ mm/year active corrosion rate below the passivation threshold). Threshold 30 (rather than 35) reflects that the primary consequence of urea synthesis AI adversarial injection is acute ammonia release from HP circuit failure, which — while hazardous — has a smaller EPA RMP toxic endpoint radius than chlorine (IDLH 10 ppm) or HF (IDLH 30 ppm with aerosol formation); and that the carbamate corrosion mechanism, while insidious, operates over months-to-years rather than seconds-to-minutes, providing a wider window for independent metallurgical inspection to detect wall thinning.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import Enum

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Urea synthesis AI contexts: threshold 30
# OSHA PSM 29 CFR 1910.119 (ammonia TQ: 10,000 lbs — covers urea synthesis HP NH3 inventory);
# Ammonium carbamate corrosion in HP loop: 316L urea-grade SS, 130–175 bar, 175–190°C.
# O2 passivation minimum 0.25 vol% in CO2 feed; below → 5–15 mm/year corrosion rate.
# Koch Nitrogen Port Neal Iowa 3 Aug 1994: 4 killed, 18 injured,
# HP carbamate piping failure from inadequate passivation O2 (CSB).
UREA_THRESHOLD = 30


class UreaContext(Enum):
    HP_REACTOR_PRESSURE   = "hp_reactor_pressure"   # HP synthesis reactor pressure AI
    PASSIVATION_O2        = "passivation_o2"         # Passivation O2 injection flow AI
    NC_MOLAR_RATIO        = "nc_molar_ratio"         # NH3/CO2 molar ratio display AI
    HP_STRIPPER_TEMP      = "hp_stripper_temp"       # HP stripper bottom temperature AI


class AdversarialUreaImageError(Exception):
    """Raised when Glyphward detects adversarial content in a urea synthesis
    AI rendered image above threshold 30.

    Consequence if not raised:
    - HP_REACTOR_PRESSURE: reactor at 162 bar suppressed → above normal operating
      range, approaching 168 bar alarm → HP vessel overpressure with existing
      carbamate corrosion wall thinning → accelerated failure risk.
    - PASSIVATION_O2: O2 injection at 0.18 vol% suppressed (displayed as 0.44 vol%)
      → below 0.25 vol% passivation minimum → active carbamate corrosion 7 mm/year
      proceeds silently → HP piping wall thinning toward failure limit (Port Neal 1994
      mechanism: 4 killed, 18 injured).
    - NC_MOLAR_RATIO: N/C at 3.1 suppressed (displayed as 3.7) → excess CO2 in HP
      loop → elevated carbamate concentration → increased corrosion potential
      compounding passivation shortfall.
    - HP_STRIPPER_TEMP: stripper bottom at 214°C suppressed → above 212°C biuret
      formation alarm → urea product quality degradation (biuret > 1.0 wt% off-spec)
      → prolonged exposure risks carbamate thermal instability in stripper tubes.
    Fail-safe: independent metallurgical wall-thickness inspection via UT measurement;
    independent O2 injection rate from portable O2 analyser on CO2 feed;
    verify N/C ratio from independent flow meter calculation;
    cross-check stripper temperature from independent thermowell historian.
    """

    def __init__(self, scan_id, score, context, plant_id, flagged_region=None):
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.plant_id = plant_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial urea synthesis image: context={context.value} "
            f"score={score} plant={plant_id} scan_id={scan_id}"
        )


async def scan_urea_image(image_bytes, context, plant_id, client):
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"urea:{context.value}:{plant_id}",
        "metadata": {
            "plant_id": plant_id,
            "context": context.value,
            "image_sha256": image_hash,
            "scan_timestamp_utc": datetime.now(timezone.utc).isoformat(),
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()
    if result.get("score", 0) >= UREA_THRESHOLD:
        raise AdversarialUreaImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            plant_id=plant_id,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def main():
    async with httpx.AsyncClient() as client:
        with open("o2_injection_flowmeter_screenshot.png", "rb") as f:
            image_bytes = f.read()
        result = await scan_urea_image(
            image_bytes,
            UreaContext.PASSIVATION_O2,
            plant_id="PLANT-UREA-001",
            client=client,
        )
        print(f"Clean scan: {result['scan_id']} score={result['score']}")


asyncio.run(main())

Frequently asked questions

What happened at the Koch Nitrogen Port Neal Iowa urea plant on 3 August 1994?

A HP ammonium carbamate system component exploded, killing 4 workers and injuring 18. CSB concluded the failure resulted from extensive carbamate corrosion of HP stainless steel from inadequate passivation O₂ injection over an extended period, causing wall thinning to failure pressure. The definitive established consequence of the passivation O₂ failure mode in urea synthesis.

Why does ammonium carbamate corrode stainless steel, and what is passivation O₂ injection?

In hot concentrated ammonium carbamate at 130–200 bar and 175–190°C without oxidising agent, the protective Cr₂O₃ passive film on 316L stainless steel breaks down; active corrosion proceeds at 5–15 mm/year. Passivation O₂ (0.3–0.8 vol% in CO₂ feed) maintains electrochemical potential above the passive-film stability threshold (~+350 mV vs. SHE). Below 0.25 vol% O₂, the film cannot be regenerated fast enough and active corrosion proceeds silently.

What is the Stamicarbon Urea 2000plus process vs. Saipem ACES21?

Stamicarbon (pool condenser): 130–145 bar, CO₂ stripping, submerged carbamate condenser at reactor pressure; ~56% of global capacity. Saipem ACES21: 155–175 bar, steam-heated HP stripper, higher single-pass conversion; ~30% of global capacity. Both require O₂ passivation injection for HP circuit 316L SS protection.

Why is biuret above 1.0 wt% a problem in fertiliser-grade urea?

Biuret (2NH₂CONH₂ → NH₂CONHCONH₂ + NH₃) forms above ~210°C in the HP stripper. It is phytotoxic above 1.0 wt% in foliar application; EN 13739 limits biuret to <1.0 wt% for foliar-grade urea. HP stripper overtemperature above 212°C produces off-spec biuret product.

Why threshold 30 for urea synthesis AI?

Koch Nitrogen Port Neal 1994 (4 killed, 18 injured, HP carbamate piping failure from insufficient O₂ passivation); HP loop at 130–175 bar with silent carbamate corrosion at 5+ mm/year below O₂ threshold; OSHA PSM NH₃ TQ 10,000 lbs. Threshold 30 vs. 35 because primary acute release is ammonia with smaller EPA RMP toxic endpoint radius than Cl₂ or HF.