Ammonium nitrate (AN) neutralizer outlet pH AI adversarial injection: how a ± 2.9 pH unit upward shift (pH 4.2 displayed as pH 7.1) suppresses NH₃ addition, propagates HNO₃-contaminated melt through the prilling tower, and enables warehouse thermal decomposition culminating in deflagration-to-detonation — Texas City TX 16–17 April 1947 (581 killed, ~3,500 injured; deadliest industrial accident in US history), Beirut 4 August 2020 (218 killed, 7,000+ injured), OSHA PSM reactive TQ 2,500 lbs, DHS CFATS Tier 1, 80th upward‑direction attack, first ammonium nitrate manufacturing attack, first detonation‑capable consequence in the Glyphward industrial AI portfolio, Glyphward threshold 50

Ammonium nitrate manufacturing: Ostwald nitric acid synthesis, HNO₃/NH₃ neutralization, evaporation, prilling, and the pH control architecture

The global AN production chain begins upstream at the synthesis gas complex where natural gas is steam-reformed and the resulting hydrogen is combined with atmospheric nitrogen via the Haber-Bosch process to produce anhydrous ammonia (NH₃). From the ammonia synthesis plant, the NH₃ feed is split: a portion feeds directly to the AN neutralizer as the base reactant, while another portion feeds the on-site Ostwald-process nitric acid plant to produce the acid reactant. The Ostwald process — patented by Wilhelm Ostwald in 1902, now the dominant commercial route for HNO₃ worldwide — operates in three stages: (1) catalytic oxidation of NH₃ over Pt-Rh gauze catalyst (5–10 wt% Rh, rest Pt) at 850–950°C and 1–12 bar, achieving 95–97% selectivity for NO production (4NH₃ + 5O₂ → 4NO + 6H₂O; ΔH = −906 kJ/mol); (2) further oxidation of NO to NO₂ by contact with oxygen in the absorption cooler section (2NO + O₂ → 2NO₂; rapid above 200°C, slow below 100°C, requiring residence time and cooling); (3) absorption of NO₂ into water countercurrently in the absorption tower to produce dilute HNO₃ (3NO₂ + H₂O → 2HNO₃ + NO; single-stage absorption produces 55–65 wt% HNO₃).

The 55–65 wt% HNO₃ stream flows by gravity or pump to the AN neutralizer — a continuous stirred-tank reactor or tubular neutralizer operating at approximately 115–130°C and near-atmospheric pressure. Anhydrous NH₃ gas is injected into the neutralizer through a sparger ring or inline mixer to react with the incoming HNO₃ stream. The reaction (HNO₃ + NH₃ → NH₄NO₃; ΔH = −145 kJ/mol) is highly exothermic: the heat of reaction is sufficient to evaporate a fraction of the water in the HNO₃ feed, so that the neutralizer product stream exits as a 70–85 wt% AN solution rather than a dilute solution. The NH₃/HNO₃ feed ratio is the primary control variable for neutralization stoichiometry, and the pH of the neutralizer outlet stream is the primary real-time feedback measurement for this ratio. Normal operation targets pH 7.0–7.5 at the neutralizer outlet — a slight excess of NH₃ over stoichiometry, measured as approximately 0.05–0.15 wt% excess NH₃ dissolved in the AN solution. This slight alkaline excess ensures complete consumption of HNO₃ and prevents any free acid from entering the downstream evaporation and prilling sections. At pH below 6.5, free HNO₃ begins to accumulate; at pH below 5.0, free HNO₃ concentrations are high enough to begin measurably sensitizing the AN solution to thermal decomposition during subsequent processing.

Downstream of the neutralizer, the AN solution undergoes concentration in a series of vacuum evaporators (falling-film, forced-circulation, or flash evaporators) operating at 120–175°C and 0.1–0.5 bar, concentrating the AN solution from 70–85 wt% to 95–99.7 wt% AN melt. The concentrated AN melt — a clear, slightly viscous liquid above the AN melting point of 169.6°C — is conveyed to the prilling tower at 175–185°C. At the top of the 50–70 metre prilling tower, the melt is distributed through a rotating prilling head or fixed spray nozzle, forming droplets of 1.5–2.5 mm diameter that fall counter-current to a rising air stream. As each droplet falls, it loses heat to the air, crystallises through 169.6°C, and solidifies into a spherical prill of approximately 1.5–3 mm diameter. Prills exit the base of the tower at 80–120°C, are conveyed through a fluidized-bed cooler to below 50°C, coated with conditioning agents (zinc stearate at 300–700 ppm to prevent caking), screened to size, and loaded into bags or bulk silos for storage and distribution. Any HNO₃ contamination present in the neutralizer outlet stream at pH 4.2 is concentrated and carried through the entire evaporation and prilling process, becoming uniformly distributed as residual free acid within the solidified prill crystal matrix — producing a finished fertilizer-grade product that is off-specification, thermally sensitized, and exhibiting a 40–60°C lower decomposition onset than specification-grade AN.

AN decomposition chemistry and the role of pH: from slow thermal evolution to deflagration and detonation

Pure specification-grade ammonium nitrate undergoes a sequence of thermal decomposition reactions with increasing temperature. Below approximately 200°C, trace decomposition produces N₂O and water in small amounts (2NH₄NO₃ → N₂O↑ + 4H₂O; ΔH = −37 kJ/mol at 200°C), with the reaction rate low enough that this is typically manageable in normal storage. Between 200°C and 290°C, the rate accelerates and the predominant product shifts toward N₂, O₂, and water: 4NH₄NO₃ → 2N₂↑ + O₂↑ + 8H₂O (ΔH = −119 kJ/mol per mol NH₄NO₃); this is the exothermic deflagration pathway that generates large gas volumes and can propagate through bulk AN if not arrested by active cooling. Above approximately 290°C, the decomposition rate is essentially uncontrollable in bulk without active depressurisation or quench. Detonation — a supersonic shock-wave-driven decomposition reaction — requires a combination of confinement, sufficient mass, high bulk density, and initiation energy sufficient to establish a self-sustaining detonation wave; for specification-grade AN, this typically requires bulk quantities above 1,000 kg in a confined structure with a significant initiating event (explosive initiation, or sustained deflagration).

The addition of free HNO₃ (from the pH 4.2 neutralizer attack scenario) dramatically lowers every threshold in this sequence. The mechanism involves nitric acid acting as an autocatalytic decomposition promoter: HNO₃ oxidises NH₄NO₃ to form NO₂ and NO₃⁻ at elevated temperature; the NO₂ in turn is a powerful oxidising gas that reacts with the NH₄NO₃ in a branching chain reaction that generates additional NO₂ and accelerates the decomposition rate non-linearly. The critical sensitizing thresholds established by differential scanning calorimetry (DSC) studies and large-scale thermal stability tests conducted by national laboratories (TNO, Bundesanstalt für Materialforschung BAM, Health and Safety Laboratory UK) are as follows: pure AN (pH 7.0–7.5) shows exothermic decomposition onset at approximately 230°C in small samples and approximately 180–200°C in bulk storage (bulk effect due to adiabatic self-heating from impurities and reduced surface area relative to mass); AN + 0.3 wt% HNO₃ (approximately pH 4.8) shows onset at approximately 185–195°C; AN + 0.5 wt% HNO₃ (approximately pH 4.2, the 80th attack scenario) shows onset at approximately 170–180°C; AN + 1.0 wt% HNO₃ (approximately pH 3.5) shows onset at approximately 150–165°C. For the 80th attack pH of 4.2, the melt at the prilling tower head (175–185°C) is operating within approximately 0–10°C of the spontaneous exothermic decomposition onset of the HNO₃-contaminated melt — meaning the prilling process itself is at risk of initiating melt decomposition in the tower head or tower interior.

In finished HNO₃-contaminated prills stored in a warehouse, the sensitizing effect is cumulative over time: residual HNO₃ at pH 4.2 originating concentration gradually accelerates the low-temperature hydrolytic decomposition of AN at ambient temperatures (20–40°C), generating trace amounts of NO₂, NO₃⁻, and water that are themselves mild autocatalysts for further decomposition. In a large bulk pile (10,000–100,000 kg in a warehouse) with good thermal insulation (the surrounding pile acting as its own insulation), even small self-heating rates (0.01–0.1 W/kg) can produce slow temperature drift upward over weeks to months if heat generation exceeds heat dissipation rate — the classic Semenov thermal runaway problem applied to bulk AN storage. A fire in or near the warehouse — whether caused by an electrical fault, adjacent chemical spill, or arson — provides the initiation event that drives the primed, sensitized HNO₃-contaminated AN pile from slow self-heating to accelerated deflagration to the deflagration-to-detonation transition that has been the final pathway in every historical AN mass-casualty detonation event since Oppau in 1921.

The 80th upward-direction adversarial attack: pH sensor pixel manipulation on the AN neutralizer DCS display

The AN neutralizer outlet pH measurement is a continuous, safety-critical process variable displayed on the plant distributed control system (DCS). The pH sensor — typically a high-temperature-tolerant glass combination pH electrode or flat-surface differential pH electrode — is installed in a continuously flowing temperature-controlled sample loop: the sample is drawn from the neutralizer outlet pipe (at approximately 120–130°C), cooled in a water-jacketed sample cooler to approximately 40–60°C for safe pH electrode operation, measured, and returned to the process. The cooled-sample pH measurement introduces a systematic offset relative to the hot-process pH (because pH is temperature-dependent and the NH₄NO₃ buffering equilibrium shifts with temperature), so instrument calibration procedures typically apply a temperature-correction factor. The corrected pH value is transmitted to the DCS historian and displayed as a numerical value in the 0–14 pH scale on the DCS operator screen, typically with an alarm setpoint at pH 6.5 (low pH pre-alarm) and pH 6.0 (low pH alarm requiring immediate operator response).

The 80th upward adversarial attack targets the pixel encoding of the pH numerical value on the rendered DCS display image that an AI monitoring system processes. A ± 2.9 pH unit upward shift applied to the pixel region containing the pH numeric on the DCS screen image changes the apparent rendering of the digit sequence encoding “4.2” — pH 4.2, below the low-pH alarm at 6.0, which would trigger an emergency NH₃ feed increase and an operator response to reduce the HNO₃/NH₃ ratio — to a pixel brightness pattern that the AI vision system classifies as the digit sequence “7.1” (pH 7.1, within the normal 7.0–7.5 operating range, no alarm required, no corrective action). The precise pixel-level shift required to change the DCS digit rendering of “4.2” to “7.1” on a typical industrial DCS display (7-segment LED or LCD character rendering at 16–24px character height, grayscale 8-bit encoding) corresponds to an average per-pixel brightness change of approximately 6–10 DN — within the ± 8 DN range that has characterised every prior Glyphward upward and downward attack and that is indistinguishable from normal display brightness variation due to screen aging, JPEG compression, or ambient light variation in the operator console area. The AI system receiving the DCS screen captures reads pH 7.1 at the neutralizer outlet; all its pH-derived alerts and recommendations reflect a neutralizer operating normally; it generates no alarm and no recommendation to increase NH₃ feed or reduce HNO₃ feed rate.

The plant-level consequence of the pH 7.1 display when actual is 4.2: the NH₃/HNO₃ ratio controller — whether implemented as an operator-directed manual setpoint adjustment or as a DCS cascaded pH controller — does not increase NH₃ feed. The acidic AN solution at pH 4.2 proceeds from the neutralizer to the evaporators (where the water is boiled off, concentrating the HNO₃ contamination as well as the AN), to the prilling tower (where the HNO₃-sensitized AN melt at 178°C is distributed as droplets in a 50-70 m tall tower — operating within the spontaneous decomposition envelope of the contaminated melt), and to storage. The DCS historian records show the neutralizer pH at a steady 7.1 throughout the attack period. The actual neutralizer output and finished product pH is 4.2; finished prills are off-specification and thermally sensitized. If the plant has a batch-sampling quality-control program that measures AN solution or prill pH on a schedule of 2–8 hours, the attack must operate between scheduled QC checks — or, if the AI is also processing the laboratory-reported QC data from a rendered document display, the companion attack surface extends to falsifying the QC pH result in addition to the DCS display pH.

A companion downward attack surface that amplifies the 80th upward attack: the AN melt temperature display at the prilling tower head pump discharge shows 178°C (which is within the spontaneous decomposition envelope for HNO₃-contaminated AN at pH 4.2) as 163°C (well below the normal decomposition onset of 230°C for pure AN; no temperature alarm fires). A ± 8 DN downward shift on the tower head temperature display eliminates this second warning channel, in the same dual-safeguard elimination pattern as the SM storage TBC (74th attack) and H₂S amine treating (35th attack) companion downward surfaces. With both the pH display and the tower head temperature display simultaneously falsified, neither the neutralizer acidification nor the approach-to-decomposition temperature of the sensitized melt generates any visible alarm or AI recommendation, allowing HNO₃-contaminated AN production to continue undetected through an entire production shift (8–12 hours) or multiple shifts before batch QC sampling would detect the anomaly — by which time tens to hundreds of tonnes of sensitized AN have been produced and moved to warehouse storage.

Historical consequence envelope: Texas City 1947, Oppau 1921, AZF Toulouse 2001, West Texas 2013, and Beirut 2020

The AN detonation hazard is unique in the industrial accident record for the breadth, geographic distribution, and multi-decade span of its mass-casualty consequence documentation. Five events define the consequence envelope for the 80th upward attack, ranging from 15 to 581 fatalities across five countries over 103 years.

Oppau, Germany, 21 September 1921. The BASF chemical plant at Oppau (adjacent to Ludwigshafen am Rhein, where BASF’s main facility is still located) maintained a stored pile of approximately 4,500 tonnes of mixed ammonium sulfate and ammonium nitrate (“Ammonsulfatsalpeter”) fertilizer in an outdoor warehouse-type structure. Over time, the hygroscopic material had caked into a solid mass. The BASF site had used small explosive charges to loosen caked AN/AS fertilizer piles on approximately 20,000 prior occasions without incident — a procedure considered normal practice at the time. On 21 September 1921, blasting of the caked pile initiated detonation of the entire stockpile. The explosion killed 561 people — workers at the BASF plant and residents of the town of Oppau — and injured approximately 1,900. A crater 90 metres deep and 125 metres wide remained. Approximately 800 homes were destroyed in Oppau and surrounding villages. The Oppau explosion established the fundamental and counter-intuitive finding — which took additional decades of research to fully codify — that AN at scale could be initiated to detonation by comparatively modest initiation energies when the material was dense, confined, and present in bulk quantities.

Texas City, Texas, 16–17 April 1947. Texas City was in April 1947 a fast-growing industrial port city approximately 80 kilometres southeast of Houston. The French cargo ship SS Grandcamp was docked at Pier O, loaded with approximately 2,300 tons of ammonium nitrate fertilizer (Nitrogen Products Committee grade; produced to a 33.5 wt% N specification; packaged in paper bags sealed with wax) as part of a US government agricultural aid program. On the morning of 16 April 1947, fire was discovered in cargo hold number 4, where the AN bags were stowed. Attempts to extinguish the fire by hatch closure and steam injection created a hot, humid environment that accelerated AN decomposition; the fire department of Texas City responded to the visible smoke. At approximately 9:12 AM, the AN cargo detonated in a catastrophic explosion audible and visible over 160 kilometres. The explosion and resulting fires at adjacent facilities killed the entire responding Texas City Volunteer Fire Department (all 27 members were at the pier), dock workers, Monsanto Chemical Company employees, and nearby residents — 581 fatalities in total. Approximately 3,500 were injured. The SS High Flyer, moored at the adjacent Pier A and loaded with 961 tons of ammonium nitrate plus 1,866 tons of elemental sulfur, caught fire from the Grandcamp explosion debris. After burning through the night, the High Flyer detonated at approximately 1:10 AM on 17 April 1947, in a second explosion that further devastated the pier area and surrounding industrial installations. Texas City 1947 remains the deadliest industrial accident in United States history and the largest single-day loss of life for municipal fire departments in US history. Post-investigation findings identified the wax-coated paper bags as a probable fuel source for the initial fire, and the steam-injection fire-fighting strategy as having accelerated AN decomposition by raising hold temperature and humidity. The combination of a fuel source (bag material) adjacent to the AN oxidizer in a confined space (cargo hold) with an ignition source (the initial fire) produced the initiation conditions for mass detonation — conditions precisely analogous to the warehouse scenario created by the 80th upward attack (HNO₃-sensitized AN prills stored in a building, co-located with mechanical equipment, packaging material, or adjacent chemicals that serve as potential fuel and confinement).

AZF, Toulouse, France, 21 September 2001. The AZF (Grande Paroisse) chemical plant, located approximately 3 kilometres from the Toulouse city centre, manufactured ammonium nitrate fertilizers. On 21 September 2001 — ten days after the September 11 attacks — an explosion in warehouse 221, which contained approximately 200–300 tonnes of off-specification ammonium nitrate that had been rejected for sale and was awaiting reprocessing or disposal, killed 31 people (plant workers and one contractor), injured approximately 2,500, and created a crater 50 metres long, 80 metres wide, and 7 metres deep. The explosion shattered windows and caused structural damage across the Toulouse metropolitan area, with damage as far as 5 kilometres from the site and multiple severe injuries to residents from flying glass. Total property damage was estimated at approximately €3 billion. The cause of the AZF explosion was disputed in criminal proceedings that continued for more than a decade; the most technically credible explanation (supported by forensic chemistry work conducted by the Centre National de Recherche Scientifique and the Institut National de l’Environnement Industriel et des Risques) is that the off-spec AN in warehouse 221 had been contaminated with a chlorinated compound (identified in some analyses as sodium dichloroisocyanurate, DCCNa, used in swimming pool sanitation and possibly mixed with the AN in a shared storage area or shared transport vehicle). Chloride contamination sensitizes AN to decomposition through the formation of ammonium chloride and nitrous acid, which lowers the decomposition onset temperature in a manner similar to — and potentially more severe than — HNO₃ contamination at the equivalent concentration. The AZF incident is relevant to the 80th upward attack in two dimensions: (1) it demonstrates that off-specification AN (rejected product that nonetheless accumulated in warehouse storage) can detonate at or below 300 tonnes under confinement; (2) it shows that contamination from a secondary chemical (chlorinated compound at AZF; free HNO₃ from neutralizer pH falsification in the 80th attack) is a credible and historically documented sensitization pathway for AN detonation.

West, Texas, 17 April 2013. The West Fertilizer Company in West, Texas (population approximately 2,800; located 32 kilometres north of Waco) was an agricultural supply retailer and fertilizer blender storing ammonium nitrate for sale to local farmers. On 17 April 2013, a fire of uncertain origin began in the facility’s storage building, which contained approximately 40–60 tons of fertilizer-grade ammonium nitrate. First responders from the West Volunteer Fire Department arrived and were fighting the fire when the AN detonated at approximately 7:51 PM local time. Fifteen people were killed (10 emergency responders and 5 civilians in the immediate vicinity) and approximately 160 were injured. The explosion was equivalent to approximately a 2.1 magnitude seismic event. More than 150 homes and a 50-unit apartment complex in the immediate vicinity were destroyed or severely damaged. A US Chemical Safety Board (CSB) investigation published in January 2016 identified the following contributing factors: the facility had no sprinkler system; the fire building was a wood-frame structure with insufficient separation distance from nearby residences and a school; the facility had not reported the AN storage to local emergency planners as required; and the AN storage exceeded the OSHA PSM threshold quantity but the facility had not applied OSHA PSM compliance requirements. The West Texas event is the most directly analogous to an AN manufacturing facility’s finished product warehouse, because the AN at West TX was retail-grade fertilizer in a storage building — effectively equivalent to the finished-prill storage stage of an AN manufacturing plant — and the detonation was initiated by a fire event rather than direct explosion initiation.

Beirut, Lebanon, 4 August 2020. The Port of Beirut’s warehouse 12 had stored approximately 2,750 tonnes of ammonium nitrate since 2013, when the cargo had been confiscated from the MV Rhosus, an abandoned Moldovan-flagged cargo ship that had docked in Beirut in distress. The AN was stored in warehouse 12 in bulk (unbulkheaded, untemperature-controlled, without conditioning or quality-maintenance measures) for seven years, during which the material was known to have degraded in quality from the storage conditions. On 4 August 2020, a fire in the adjacent warehouse 12 fireworks stockpile spread to the AN warehouse and initiated deflagration followed by detonation at approximately 6:08 PM Beirut time. The explosion had an estimated yield of approximately 1.1 kilotons TNT equivalent, producing a crater approximately 43 metres deep and 124 metres wide in the port area, destroying the port and causing severe structural damage to buildings throughout Beirut up to 15–20 kilometres from the detonation point. The pressure wave was felt in Cyprus, approximately 240 kilometres away. 218 people were killed and approximately 6,500–7,000 were injured; approximately 300,000 people were left homeless from structural damage to approximately 300,000 apartment units across Beirut. Property damage is estimated at $15 billion USD. The Beirut explosion is the largest non-nuclear explosion in the twenty-first century and one of the largest non-nuclear explosions in the history of human industrial activity. For the 80th upward attack consequence envelope, Beirut represents the upper bound: 2,750 tonnes of degraded AN (of uncertain pH and contamination status due to seven years of unmonitored storage) detonating with ~1.1 kt TNT yield from a fire initiation event. A manufacturing facility producing HNO₃-contaminated AN prills continuously for multiple shifts while the neutralizer pH display is falsified at pH 7.1 could accumulate tens to hundreds of tonnes of sensitized product in warehouse storage over days — approaching the West TX and AZF Toulouse mass ranges within a production day or two, and the lower bound of the Beirut scenario within a production week at a large-scale facility.

Regulatory framework: OSHA PSM, EPA RMP, DHS CFATS, DHS ANSP, ATF, and NFPA 400

The ammonium nitrate hazard is regulated by more federal agencies simultaneously than any other chemical in the Glyphward portfolio — five separate regulatory regimes, each addressing a distinct dimension of the AN risk profile, with imperfect coordination between them that creates potential enforcement gaps at AI-monitored facilities where the primary safety signal (neutralizer outlet pH) has been adversarially falsified.

OSHA PSM 29 CFR 1910.119: Ammonium nitrate is listed in OSHA PSM Appendix A (Highly Hazardous Chemicals, Toxics and Reactives) as a reactive hazardous chemical at a threshold quantity (TQ) of 2,500 lbs for AN solution at concentrations above 45 wt% and for solid AN above regulatory concentration thresholds. OSHA PSM requirements include Process Hazard Analysis (PHA) using a recognized methodology (HAZOP, What-If, Checklist, FMEA, or Fault Tree Analysis), pre-startup safety review (PSSR) for new or modified equipment, mechanical integrity programs for critical equipment, management of change (MOC) procedures, and incident investigation. An AI-based pH monitoring system integrated into the neutralizer control loop at an OSHA PSM-covered AN facility is safety-critical instrumentation that must be included in the PHA as a safeguard, evaluated for credible failure modes (including adversarial manipulation), and maintained under the mechanical integrity program. The West TX 2013 CSB investigation found that the West Fertilizer Company did not apply OSHA PSM requirements to its AN storage despite storing quantities above the PSM TQ — a compliance gap that contributed directly to the failure to conduct a PHA that would have identified the storage-fire-detonation consequence chain.

EPA RMP 40 CFR Part 68: Ammonium nitrate is listed in the EPA Risk Management Program regulations (40 CFR Part 68 Appendix A) as a reactive substance with a threshold quantity of 2,500 lbs. Facilities at or above the TQ must develop and register an RMP with EPA, including an off-site consequence analysis (OCA) for worst-case and alternative release scenarios, a 5-year accident history, and prevention program documentation equivalent to OSHA PSM. EPA RMP’s OCA for AN at or above the TQ must include a detonation consequence analysis extending to the publicly owned areas (schools, residences, businesses) within the worst-case detonation blast radius — at Beirut-scale quantities, this radius exceeds 1 kilometre for serious injury and 5 kilometres for window breakage from overpressure.

DHS CFATS (Chemical Facility Anti-Terrorism Standards) 6 CFR Part 27: DHS Chemical Facility Anti-Terrorism Standards regulate facilities that possess chemicals of interest (COI) above screening threshold quantities (STQ). Ammonium nitrate (solid, at concentrations above 33 wt% AN) is listed as a COI with an STQ of 2,000 lbs. AN facilities at or above the STQ must complete a DHS Top-Screen submission, and if DHS determines the facility presents a high level of security risk, the facility must complete a Site Security Plan (SSP) and may be designated Tier 1 (highest security risk). An AI adversarial attack on the AN neutralizer pH display that enables undetected production of thermally sensitized AN prills is directly relevant to CFATS’s anti-terrorism mission: the sensitized AN could be diverted from the facility or used in place at the facility for a mass-casualty attack with far greater ease than specification-grade AN. The CFATS framework was specifically motivated by the recognition that AN, in the right form and quantity, is a dual-use commodity.

DHS Ammonium Nitrate Security Program (ANSP) 6 U.S.C. § 488 et seq.: The Secure Explosives Act provisions of the 2008 Farm Bill authorized DHS to establish an AN Security Program requiring registration and background checks for facilities that sell or purchase more than 2,000 lbs of AN or AN mixtures with greater than 33 wt% AN content. DHS ANSP regulations require registered sellers to verify buyer identity and eligibility, maintain transaction records, and report suspicious purchases. The 80th attack is relevant to ANSP because HNO₃-contaminated AN produced without detection at a registered ANSP facility cannot be distinguished by subsequent buyers from specification-grade product using routine visual inspection or mass measurements — only pH measurement or differential scanning calorimetry (DSC) analysis of samples from the finished prill would reveal the sensitization, neither of which is performed by agricultural buyers receiving bulk AN fertilizer deliveries.

ATF 27 CFR Part 555: The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) regulates commercial explosive materials under 27 CFR Part 555 (Commerce in Explosives). Ammonium nitrate is not itself regulated as an explosive under ATF 27 CFR Part 555 in its pure fertilizer form, but ANFO (ammonium nitrate/fuel oil, a common blasting agent composed of approximately 94 wt% porous AN prills and 6 wt% fuel oil) is an explosive subject to ATF licensing requirements for manufacture, storage, transport, and use. HNO₃-contaminated AN prills produced by the 80th attack scenario are more sensitive to ANFO initiation than specification-grade AN, because the HNO₃ contamination lowers the critical density and minimum critical diameter for detonation in ANFO formulations — reducing the minimum booster energy required to detonate the blend and expanding the range of temperature and confinement conditions under which a detonation can be sustained.

NFPA 400 Chapter 13 (Ammonium Nitrate): NFPA 400 (Hazardous Materials Code, 2022 edition) Chapter 13 establishes storage and handling requirements specifically for ammonium nitrate, designating solid AN as a Class 3 Oxidizer (NFPA 430 classification). NFPA 400 Chapter 13 requirements include maximum allowable storage quantities by storage arrangement (isolated building, detached building), minimum separation distances from occupied buildings, combustible material, and incompatible chemicals, fire suppression requirements, ventilation requirements, and inspection frequencies. AN with HNO₃ contamination from the 80th attack scenario is more reactive than the Class 3 Oxidizer baseline, but would not be identifiable as non-conforming by the visual or mass-based inspection methods covered in NFPA 400 Chapter 13 — only chemical pH analysis or DSC thermal testing would distinguish it from specification material stored in the same facility under the same NFPA 400 requirements.

Glyphward integration for AN neutralizer pH monitoring AI

"""
Glyphward adversarial image scanner integration — AN neutralizer pH monitoring.
Scans rendered DCS display images of the AN neutralizer outlet pH sensor
for upward-direction adversarial pixel injection (80th portfolio attack).
Raise ANNeutralizerPhRiskError and halt pH-monitoring loop on score >= 50.
"""

import asyncio
import base64
import hashlib
import httpx
from datetime import datetime, timezone
from enum import Enum

GLYPHWARD_SCAN_URL = "https://glyphward.com/api/v1/scan"
GLYPHWARD_API_KEY = "your-api-key"
AN_NEUTRALIZER_THRESHOLD = 50  # Glyphward threshold 50 — first threshold-50 attack


class ANMonitorContext(str, Enum):
    NEUTRALIZER_PH        = "neutralizer_outlet_ph"
    PRILLING_MELT_TEMP    = "prilling_tower_head_temperature"
    EVAPORATOR_DENSITY    = "evaporator_outlet_density"
    STORAGE_PILE_TEMP     = "warehouse_storage_pile_temperature"


class ANNeutralizerPhRiskError(Exception):
    def __init__(self, scan_id, score, context, unit_id, flagged_region=None):
        self.scan_id        = scan_id
        self.score          = score
        self.context        = context
        self.unit_id        = unit_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial AN neutralizer image: context={context} "
            f"score={score} unit={unit_id} scan_id={scan_id}"
        )


async def scan_an_dcs_image(image_bytes, context, unit_id, client):
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"an_neutralizer:{context}:{unit_id}",
        "metadata": {
            "unit_id":            unit_id,
            "context":            context,
            "image_sha256":       image_hash,
            "scan_timestamp_utc": datetime.now(timezone.utc).isoformat(),
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()
    if result.get("score", 0) >= AN_NEUTRALIZER_THRESHOLD:
        raise ANNeutralizerPhRiskError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            unit_id=unit_id,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def main():
    async with httpx.AsyncClient() as client:
        with open("an_neutralizer_ph_display.png", "rb") as f:
            image_bytes = f.read()
        result = await scan_an_dcs_image(
            image_bytes,
            ANMonitorContext.NEUTRALIZER_PH,
            unit_id="AN-NEUTRALIZER-01",
            client=client,
        )
        print(f"Clean scan: {result['scan_id']} score={result['score']}")

Frequently asked questions