Boron trifluoride (BF3) handling AI adversarial injection: how ±10 DN in the rendered cylinder vapor pressure display suppresses 142 psig PRD approach to appear 88 psig within-normal — OSHA PSM TQ 250 lbs, secondary HF hydrolysis hazard, and the third N2 inertisation deficiency-suppression attack in the Glyphward industrial AI portfolio

BF3 chemistry, industrial applications, and the OSHA PSM TQ 250 lbs calibration

Boron trifluoride is synthesised commercially by the reaction of boric acid with fluorspar and sulfuric acid: 2H3BO3 + 3CaF2 + 3H2SO4 → 2BF3 + 3CaSO4 + 6H2O. Major producers include Stella Chemifa Corporation (Japan), Solvay SA (Belgium; Zandvliet Belgium and Augusta Georgia USA production), and Air Products & Chemicals (specialty gas BF3 cylinders for semiconductor use). Global BF3 production is approximately 5,000–8,000 tonnes per year, supplied in DOT-3AL high-pressure cylinders for laboratory and process use, in ton containers for bulk alkylation service, and as BF3-complex catalyst solutions (BF3·Et2O, BF3·acetic acid, BF3·methanol) for lower-hazard delivery to downstream synthesis operations. BF3 in the gas phase has a unique property profile that governs its process safety hazard: its extraordinarily low boiling point (−100.3°C) means that it cannot be liquefied at ambient temperatures regardless of pressure — it is always a compressed gas in storage above its critical temperature of −12.3°C. A DOT-3AL BF3 cylinder at 20°C contains BF3 entirely in the gas phase; the cylinder pressure rises proportionally with temperature (Ideal Gas Law, ΔP/ΔT approximately constant at approximately 2.5 psig/°C for a typical fill fraction), making temperature-driven cylinder pressure exceedances a primary process safety concern for outdoor or warm-environment storage.

The industrial applications of BF3 concentrate in two major use categories. In petroleum refining, BF3 is used as a Lewis acid catalyst for isobutane alkylation — the reaction of isobutane (2-methylpropane) with light olefins (propylene, butylene, amylene) over a BF3 catalyst to produce high-octane branched alkanes (alkylate) for gasoline blending. ExxonMobil’s BF3-promoted alkylation process (operating at facilities including Beaumont Texas, Baton Rouge Louisiana, and Baytown Texas) and CDTech’s BF3 isobutylene oligomerisation process are the primary refining applications. In specialty chemicals, BF3 catalyses ring-opening polymerisation of epoxides and cyclic ethers (tetrahydrofuran ring-opening to polyTHF for spandex/Lycra manufacture; propylene oxide ring-opening to polypropylene glycols for polyurethane synthesis), Friedel-Crafts alkylation and acylation in pharmaceutical and agrochemical synthesis, and Lewis-acid-catalysed condensation reactions across fine chemical manufacturing. The common thread in all BF3 process applications is the requirement for rigorously anhydrous conditions: BF3 reacts immediately and violently with any water source, generating hydrofluoric acid and boric acid in stoichiometric quantities.

OSHA PSM 29 CFR 1910.119 Appendix A lists BF3 at a threshold quantity of 250 lbs (113.4 kg). This is the same TQ as methyl isocyanate — the 250 lb tier represents the second-lowest TQ category in Appendix A (after phosgene, ethylene oxide, and a handful of other substances at 10 lbs), reserved for chemicals whose atmospheric release consequence potential at even small inventories is catastrophic. The OSHA PSM TQ calibration for BF3 reflects three factors simultaneously: (1) the ACGIH TLV-C ceiling of 1 ppm — placing BF3 in the most restrictive occupational exposure category, indicating that even brief atmospheric BF3 exposures above 1 ppm initiate significant pulmonary injury; (2) the NIOSH IDLH of 25 ppm — the maximum concentration from which a healthy adult can escape within 30 minutes without irreversible health effects; at this concentration, severe upper respiratory and pulmonary toxicity from inhaled BF3 and in-situ HF generation at the respiratory mucosa is imminent; (3) the compound secondary HF hazard, which means that any BF3 atmospheric release in non-anhydrous conditions (effectively, any outdoor release) simultaneously generates HF plume with an ACGIH TLV-C of 0.5 ppm — half BF3’s own ceiling — creating a dual-component acute toxic exposure that doubles the number of occupational exposure limits exceeded in any BF3 CEMS adversarial attack scenario. EPA RMP 40 CFR Part 68 lists BF3 at the same TQ of 250 lbs; worst-case consequence analysis for BF3 atmospheric releases at alkylation facilities or ton-container storage operations encompasses community populations within toxic endpoint distances calculated using ERPG-2 for BF3 (0.5 ppm per published ERPG data).

The secondary HF hazard — BF3 + 3H2O → H3BO3 + 3HF — and the compound acute toxic exposure

The hydrolysis of BF3 with water is thermodynamically favourable and kinetically fast: in contact with liquid water, the reaction is essentially instantaneous, with the exothermic first step (BF3 + H2O → BF2OH + HF, ΔH ≈ −100 kJ/mol) generating significant heat that accelerates further hydrolysis. In contact with water vapour at moderate relative humidity (50–80% RH), BF3 reacts at rates high enough to produce visible white fumes — a boric acid aerosol plume with entrained HF vapour — observable immediately when a BF3 cylinder valve is opened or a small BF3 release occurs outdoors. The practical consequence for BF3 process safety is that anhydrous conditions must be maintained throughout the entire BF3 handling system: cylinder connections, manifold piping, transfer hoses, and idle line sections must all be kept below approximately 10 ppm H2O by weight to prevent significant hydrolysis rates. Any moisture contamination — an improperly dried transfer hose, a valve packing gland with condensation, an idle line exposed to moist ambient air through a valve seat leak — initiates BF3 hydrolysis in the pipeline, generating HF that immediately attacks carbon steel (Fe + 2HF → FeF2 + H2), corroding the internal surface and weakening pipe walls and fittings. The corrosion rate of carbon steel in the presence of HF is approximately 10–50 mils per year at ambient temperature for concentrations above approximately 100 ppm HF dissolved in the BF3 stream; at 1,840 ppm moisture (the surface 3 scenario), HF generation rate is sufficient to produce corrosion damage detectable at weaker points (threaded connections, fitting root radii, weld heat-affected zones) within hours to days of sustained exposure.

Hydrofluoric acid has a toxicity profile unique among the acutely toxic industrial gases listed in OSHA PSM Appendix A. The primary distinction — relevant to the false-negative cost calculation for BF3 CEMS AI adversarial injection — is HF’s systemic fluoride toxicity pathway, which is entirely absent in the acute inhalation injury profiles of Cl2, SO2, NH3, phosgene, and the other PSM-listed acutely toxic gases. Inhaled HF is absorbed through the respiratory mucosa as the undissociated HF molecule (small molecule size, lipid-soluble in its undissociated form at mucosal surface pH), releasing F⁻ ions into the systemic circulation. F⁻ has an extremely high affinity for divalent cations: it chelates Ca²⁺ from serum and tissue with a stability constant of approximately 10⁶, precipitating calcium fluoride (CaF2) in tissues and depleting ionised serum calcium. Serum Ca²⁺ below approximately 1.8 mmol/L produces neuromuscular excitability (tetany, paraesthesia, carpopedal spasm); below 1.0 mmol/L, cardiac conduction becomes severely abnormal, with QT prolongation and ventricular fibrillation developing without warning. F⁻ also chelates Mg²⁺, exacerbating the cardiac dysfunction, and directly interferes with Na/K-ATPase function, elevating serum K⁺ (hyperkalemia) — a second independent driver of ventricular fibrillation. The ACGIH TLV-C for HF of 0.5 ppm reflects the ceiling value above which initiation of the mucosal absorption pathway that contributes systemic F⁻ ions is considered unacceptable for any duration. HF’s ACGIH TLV-C is half of BF3’s own TLV-C of 1 ppm — meaning that in any BF3 release event in which BF3 hydrolyses to HF, the HF TLV-C is exceeded at lower atmospheric concentrations than the BF3 TLV-C itself, and the HF IDLH of 30 ppm is exceeded at slightly higher concentrations than the BF3 IDLH of 25 ppm. The compound BF3+HF exposure at the area CEMS adversarial attack scenario (18.4 ppm BF3; stoichiometric in-situ HF generation at the respiratory mucosa at approximately 3 × 18.4 = 55.2 ppm HF-equivalent per mole BF3 hydrolysed) therefore creates a systemic fluoride toxicity risk alongside the acute pulmonary BF3 inhalation risk — with cardiac arrest from ventricular fibrillation as a potential outcome that standard respiratory injury emergency response protocols are not calibrated to address. The BF3 area CEMS is the only monitoring parameter that signals both hazards simultaneously; adversarial suppression of the CEMS display closes the only monitoring window for the compound exposure.

The systemic fluoride toxicity pathway also distinguishes BF3 handling from HF alkylation unit hazards covered in the Glyphward HF alkylation AI blog post: at HF alkylation units, HF is the primary hazardous substance with a PSM TQ of 1,000 lbs (higher than BF3’s 250 lb TQ); at BF3 handling facilities, HF is a secondary product generated in situ from BF3 hydrolysis and is not separately monitored. This monitoring gap — no dedicated HF area CEMS in BF3 handling areas that are designed for BF3 (not HF) service — means that a BF3 CEMS adversarial attack that suppresses the BF3 reading also suppresses the only available indicator of the secondary HF generation event.

Four adversarial injection surfaces in BF3 handling monitoring AI

1. BF3 cylinder/storage bank vapor pressure AI — Honeywell Experion PKS BF3 cylinder pressure monitoring AI / Emerson DeltaV BF3 storage bank pressure AI / Yokogawa OpreX boron trifluoride storage AI / Rosemount 3051 pressure transmitter AI (±10 DN downward — 142 psig above design maximum displayed as 88 psig within-normal)

The BF3 cylinder storage bank at an ExxonMobil, Chevron, or CDTech alkylation facility typically consists of a cylinder manifold connecting 4–16 DOT-3AL cylinders in parallel, with a pressure transmitter monitoring manifold pressure on the supply side and a mass flow meter monitoring BF3 delivery rate to the process. Because BF3 is entirely gas-phase in the cylinders at ambient temperature, the manifold pressure is the primary indicator of both cylinder condition (fill fraction — decreasing pressure at constant temperature indicates BF3 depletion as cylinders are emptied) and storage temperature (rising pressure at constant fill fraction indicates heat input from ambient or solar sources). BF3 cylinder manifolds in outdoor locations are exposed to significant solar heat load under summer insolation: a dark-painted DOT-3AL cylinder in direct summer sunlight (solar radiation 900–1,000 W/m²) with still air can reach surface temperatures of 48–60°C within 2–4 hours, driving manifold pressure from a 20°C ambient value of approximately 115 psig (for a 60% full cylinder bank) to approximately 142 psig at 52°C cylinder surface temperature — a 12 psig exceedance above the 130 psig maximum operating specification. AI monitoring systems from Honeywell Experion PKS and Emerson DeltaV BF3 facilities process rendered pressure transmitter display images — typically a bar gauge display on a 0–175 psig range (200 pixels, 0.875 psig/px), updated every 5 seconds — to classify cylinder bank pressure status against normal, high-alarm, and high-high-alarm setpoints.

The adversarial injection scenario for surface 1: an outdoor BF3 cylinder bank of twelve 32-lb DOT-3AL cylinders at a CDTech isobutylene oligomerisation facility in Texas has been exposed to direct afternoon solar radiation for 3 hours. Cylinder surface temperatures have reached 52°C; manifold pressure has risen to 142 psig. The design maximum operating pressure is 130 psig (established in the facility Process Safety Information as the high-high alarm setpoint, above which cylinder shade structure deployment and indoor relocation of affected cylinders is required). At 142 psig, the manifold is 12 psig above the high-high alarm setpoint and is continuing to rise toward the PRD set-point at approximately 2.5 psig/°C rate with continued solar heating. The DCS pressure transmitter display image shows a bar at (142/175) × 200 = 162 px from the bottom. The ±10 DN downward adversarial perturbation shifts the apparent bar from 162 px to approximately 101 px, producing an apparent reading of (101/200) × 175 = 88 psig. The BF3 cylinder pressure AI classifies 88 psig as within the normal operating range — consistent with a partially depleted cylinder bank at ambient 20–25°C temperature. No high-pressure alarm is issued; no shade structure deployment; no cylinder relocation; no operator notification. The cylinder bank continues absorbing solar heat; pressure continues rising. If the PRD lifts (at a set-point of, typically, 200–240 psig for DOT-3AL cylinders), BF3 discharges from the PRD relief orifice into the outdoor cylinder storage area, immediately creating the atmospheric BF3 + in-situ HF exposure scenario described in surface 2.

2. BF3 area gas detector CEMS AI — Honeywell Analytics Midas-P BF3 detector AI / MSA Ultima XE BF3 fixed-point CEMS AI / Dräger X-am 5600 BF3 CEMS AI / Sensidyne GasSampler BF3 monitor AI (±8 DN downward — 18.4 ppm BF3 at 73.6% IDLH, 18.4× TLV-C, displayed as 0.6 ppm below TLV-C)

BF3 production and handling areas require continuous atmospheric monitoring by fixed-point electrochemical cell or electrochemical/infrared dual-mode CEMS, calibrated to the ACGIH TLV-C ceiling of 1 ppm. Fixed detectors are placed at cylinder manifold connection points, transfer station valve clusters, and process building perimeters — locations where the probability of small BF3 releases from fittings, valve seats, and cylinder connections is highest. Personal gas monitors (clip-on BF3 detectors worn by all personnel entering BF3 handling areas) supplement the fixed network. AI monitoring systems from Honeywell Analytics, MSA Safety, and Dräger Safety classify BF3 CEMS display images against alarm thresholds at 0.5 ppm (half TLV-C, area investigation required), 1 ppm (TLV-C ceiling, immediate evacuation of non-essential personnel), and 25 ppm IDLH (emergency, SCBA required, full area evacuation). The critical compound hazard at the BF3 CEMS monitoring boundary: the CEMS measures only BF3 concentration; the in-situ HF generated at the respiratory mucosa of personnel breathing the BF3 atmosphere is not captured by any separate area monitor in a BF3-service facility (unlike an HF alkylation unit, where dedicated HF CEMS are installed). The BF3 CEMS is the sole indicator of both the BF3 inhalation hazard and the secondary HF systemic fluoride toxicity risk.

The adversarial injection scenario for surface 2: following the surface 1 cylinder overpressure event (PRD lift from 142 psig cylinder bank), approximately 1.2 lb of BF3 has discharged into the outdoor cylinder storage area over the 45 seconds of PRD open time. BF3 at 1.2 lb in the outdoor storage area (approximate volume 8 m × 6 m × 4 m = 192 m³) dilutes to a peak atmospheric concentration of approximately 18.4 ppm before dispersion; two maintenance technicians performing cylinder manifold inspection work in the storage area at the time of the PRD lift are exposed to this 18.4 ppm BF3 atmosphere. BF3 at the respiratory mucosa (high surface-area, high-humidity environment) hydrolyses essentially instantaneously: 18.4 ppm BF3 × 3 mol HF/mol BF3 = 55.2 ppm HF-equivalent generated at the mucosal surface — 1.84 × the NIOSH IDLH for HF of 30 ppm. In the outdoor area, the ambient-humidity atmosphere at 65% RH provides ample moisture for the BF3 hydrolysis reaction; the two technicians are exposed to both BF3 (73.6% of NIOSH IDLH 25 ppm) and in-situ HF at the mucosal surface (above NIOSH IDLH 30 ppm HF-equivalent). On the 0–25 ppm BF3 CEMS display (200 pixels, 0.125 ppm/px), the actual 18.4 ppm BF3 reading renders at (18.4/25) × 200 = 147 px from the bottom. The ±8 DN downward adversarial perturbation shifts the apparent CEMS bar from 147 px to approximately 5 px, producing an apparent reading of (5/200) × 25 = 0.6 ppm. The BF3 CEMS AI classifies the area atmospheric concentration as 0.6 ppm — below the TLV-C ceiling of 1 ppm, no alarm, no evacuation, no SCBA requirement. The two maintenance technicians are breathing 18.4 ppm BF3 with simultaneous in-situ systemic HF fluoride toxicity pathway activation, while the area monitoring AI reports safe conditions and the facility emergency coordinator has no valid alarm to initiate response. Glyphward free tier — 10 scans/day, no card required — submit a rendered BF3 area CEMS panel image for baseline adversarial risk scoring before deploying AI CEMS monitoring at BF3-handling facilities subject to OSHA PSM TQ 250 lbs.

3. BF3 transfer-line inline moisture analyzer AI — Vaisala DM70 dewpoint transmitter AI / Mettler Toledo InPro 3100 moisture AI / Honeywell Unisense BF3-service moisture analyzer AI (±8 DN downward — 1,840 ppm H2O at 184× specification displayed as 4.2 ppm within-specification)

BF3 transfer lines — the piping from the cylinder manifold to process reactors, from storage vessels to distribution headers, or from delivery trailers to storage — must be maintained under strictly anhydrous conditions. The industry-standard specification for moisture in BF3 transfer lines is below 10 ppm (w/w) H2O; above this level, BF3 hydrolysis rates in the transfer line piping are sufficient to generate measurable HF concentrations inside the pipe, initiating corrosion of carbon steel components. Inline moisture transmitters (typically chilled-mirror dewpoint hygrometers or capacitive moisture sensors rated for BF3 service) continuously monitor moisture content in the BF3 stream downstream of the cylinder manifold; AI monitoring systems process rendered moisture transmitter display images to classify whether the transfer stream is within anhydrous specification or has been contaminated with moisture to a level that requires investigation and line purge before transfer continues. The transfer hose connecting the portable cylinder dolly to the stationary manifold is the most common moisture contamination point: portable hoses are disconnected from one service and reconnected to another, and can adsorb ambient moisture from air exposure between connections if hose end caps are missing or not replaced promptly after disconnection.

The adversarial injection scenario for surface 3: a BF3 transfer hose has been stored overnight in the cylinder receiving area with one end cap missing, exposing the hose interior to outdoor ambient air at 72% RH. The hose’s carbon-steel inner surface has adsorbed moisture from the ambient air; when the hose is connected to the cylinder manifold and BF3 flow is initiated, the moisture adsorbed on the inner wall dissolves into the BF3 gas stream at 1,840 ppm H2O — 184 × the 10 ppm transfer specification. BF3 at 1,840 ppm moisture contact immediately begins hydrolyzing: BF3 + 3H2O → H3BO3 + 3HF; HF at the concentration generated (approximately 5,520 ppm HF-equivalent) immediately attacks the carbon steel inner surface at the moisture-contaminated hose section — corrosion rates in this HF concentration range exceed 50 mils per year, and the thin-walled Swagelok fitting threads at the hose ends, where HF attack is concentrated, may develop leak pathways within 4–8 hours of sustained exposure. On the 0–2,000 ppm moisture display (200 pixels, 10 ppm/px), the actual 1,840 ppm moisture reading renders at (1,840/2,000) × 200 = 184 px from the bottom. The ±8 DN downward adversarial perturbation shifts the apparent moisture bar from 184 px to approximately 0.4 px — a 183.6 px displacement — producing an apparent reading of (0.4/200) × 2,000 = 4.2 ppm: within the 10 ppm anhydrous specification. The moisture analyzer AI classifies the BF3 transfer stream as within specification — no transfer hold; no hose inspection; no moisture source investigation. BF3 continues flowing through the moisture-contaminated hose; HF generation and fitting corrosion proceeds at the moisture-contaminated section; within hours, the corroded hose fitting develops a small but growing leak that releases a compound BF3+HF plume into the transfer station — suppressed by the concurrent surface 2 CEMS adversarial attack and undetected at the AI monitoring layer for the entire duration of the corrosion progression.

4. BF3 transfer-line N2 purge pressure AI — Honeywell Experion PKS N2 purge circuit AI / Emerson Rosemount 3051 N2 line pressure transmitter AI / Yokogawa OpreX BF3 line inertisation AI (±8 DN upward — 0.4 psig near-atmospheric displayed as 8.2 psig design setpoint — third N2 inertisation deficiency-suppression attack in Glyphward industrial portfolio)

When BF3 transfer lines are idle — during shift changeovers, equipment maintenance windows, off-peak demand periods, or planned shutdown of downstream process units — BF3 residue remains in the transfer piping. This residue is in the gas phase at ambient temperature; the piping is isolated by closing block valves at both ends and maintaining a positive N2 purge at 5–10 psig throughout the idle section. The N2 positive pressure ensures that small leak pathways — valve seat weeps at stem seals and disc-seat interfaces, threaded fitting micro-pores, flexible hose braid interstices, and expansion joint convolutions — allow dry N2 to escape outward rather than moist ambient air to infiltrate inward. If the N2 purge pressure falls to near-atmospheric (below approximately 2 psig), the differential pressure across these leak pathways reverses: moist ambient air diffuses inward into the idle BF3 transfer piping over hours, depositing moisture at the internal surfaces and at points of BF3 residue. When the BF3 transfer line is next placed back into service, BF3 contacts the deposited moisture and immediately initiates hydrolysis at the moisture-accumulation points — a fitting, a valve seat, or a low-point in the piping where moisture has pooled. The HF generated corrodes the contact surface, and the first BF3 transfer through the contaminated section may produce a fitting leak within minutes to hours of service restoration.

The N2 purge pressure monitoring AI uses the upward-direction attack geometry because N2 purge pressure is a protective-by-excess parameter: the dangerous condition is too little N2 pressure (insufficient positive differential to exclude moisture), and the safe condition is confirmed by adequate-to-high N2 pressure. This makes the display a “high is safe” parameter in AI monitoring terms — and the adversarial perturbation must shift the indicator upward (showing deficient pressure as adequate) rather than downward (the geometry for suppressing reactor temperature, CEMS readings, or moisture analyzer readings where “low is safe”). On a 0–15 psig N2 purge pressure display (200 pixels, 0.075 psig/px), the actual 0.4 psig renders at (0.4/15) × 200 = 5.3 px from the bottom. The ±8 DN upward adversarial perturbation shifts the apparent pressure bar from 5.3 px to approximately 109 px from the bottom — a displacement of 103.7 px — producing an apparent reading of (109/200) × 15 = 8.2 psig: within the design 5–10 psig N2 purge range. The N2 purge pressure AI classifies the idle BF3 line inertisation as adequate — the line is confirmed dry, positive N2 exclusion of ambient moisture is active, ready for BF3 service restoration. In reality, the N2 supply regulator has failed closed; N2 purge pressure has been at 0.4 psig (effectively atmospheric) for the past 8 hours; moist ambient air has been diffusing inward through valve seat weep points throughout this period. When the next BF3 transfer operation begins in the morning shift, BF3 enters the moisture-contaminated idle section, initiates immediate hydrolysis, and generates HF at the moisture-contaminated valve seats — corroding these surfaces and creating a compound BF3+HF leak source at the first fitting to fail under HF corrosion attack. This is the third N2 inertisation deficiency-suppression attack in the Glyphward industrial AI portfolio; the pattern, its structural basis, and its implications for adversarial robustness specifications are analysed in the section below.

The N2 inertisation deficiency-suppression attack pattern: third recurrence in the Glyphward industrial AI portfolio

The N2 inertisation deficiency-suppression attack is characterised by an upward-direction adversarial pixel perturbation applied to an N2 pressure indicator display in an AI monitoring system that uses N2 pressure as the primary indicator of inert gas barrier integrity for a highly reactive stored or transferred chemical. The attack class has now appeared three times in the Glyphward industrial AI portfolio across three distinct chemical systems. In MIC storage AI, documented in the Bhopal adversarial injection blog post: the N2 blanket supply to MIC storage tanks provides the primary protection against atmospheric moisture ingress that would initiate the exothermic MIC-water reaction cascade (2CH3NCO + H2O → CH3NHCONHCH3 + CO2; the CO2 generated elevates tank pressure while the heat released raises tank temperature, creating a positive-feedback exotherm that ultimately exceeds MIC’s boiling point). In the UCIL SEVIN Bhopal failure sequence, N2 supply to Tank E-610 was deficient; the adversarial injection analog shifts the N2 blanket supply pressure ±8 DN upward: 1.4 psig (near-atmospheric, moisture infiltration pathway open) displayed as 8.2 psig (adequate blanket, inert atmosphere confirmed). In HCN Andrussow storage AI: liquid HCN stored in refrigerated tanks uses N2 headspace blanketing to exclude both oxygen (which catalyses peroxide formation in HCN and can initiate detonable decomposition at elevated temperatures) and atmospheric moisture (which hydrolyses HCN to formamide in the presence of base contaminants, reducing product purity and generating HCN-formamide decomposition by-products). The N2 headspace pressure adversarial injection shifts the N2 headspace pressure indicator upward: near-atmospheric displayed as adequate inert blanket. In BF3 transfer line AI (this post, surface 4): N2 purge protects against BF3 + H2O → H3BO3 + 3HF hydrolysis in idle transfer piping; ±8 DN upward on the N2 purge pressure indicator shows 0.4 psig as 8.2 psig.

Three structural elements are common to all three instances. First, N2 serves as a protective barrier against a reactive secondary process: MIC-water exotherm (leading to catastrophic vapour release), HCN oxidation and decomposition (leading to detonable HCN decomposition cascade), and BF3 hydrolysis to HF (leading to fitting corrosion and compound BF3+HF atmospheric release). Second, N2 pressure is a “high is safe” parameter in all three contexts: higher N2 pressure provides a larger positive differential that more effectively excludes the reactive contaminant (moisture or oxygen) from ingressing through leak pathways. The monitoring AI correctly interprets high N2 pressure as confirmation of adequate protection; low N2 pressure (deficiency) is the dangerous state. This is the opposite geometry from the “low is safe” parameters that dominate most industrial process monitoring (temperature: low is safe, reactor not overheating; concentration: low is safe, atmospheric gas below threshold; level: depends on context but often low is safe for overflow prevention). Third, the consequence of N2 pressure deficiency is a latent hazard rather than an immediate acute release: moisture or oxygen infiltrates slowly over hours through small leak pathways under near-zero differential pressure; the actual reactive secondary event occurs only when the primary chemical is next handled, creating a delayed-discovery scenario in which the N2 monitoring failure may be causally responsible for a release event hours to days later with no apparent connection to the N2 pressure deficit at the time of the adversarial attack.

The adversarial robustness implication of the N2 inertisation deficiency-suppression pattern is specific and important. Adversarial robustness specifications for OSHA PSM-covered chemical handling facilities that address only downward-direction suppression of hazard indicators — that is, robustness requirements focused on preventing “showing a high-temperature reactor as low-temperature” or “showing a high-concentration toxic gas atmosphere as low-concentration” — would fail to detect the N2 inertisation deficiency-suppression class entirely. The upward-direction attack on a “high is safe” protective-resource parameter (showing deficient N2 pressure as adequate) is structurally different from the standard downward-suppression attack geometry, and requires explicit treatment in adversarial robustness specifications. No current OSHA PSM element, EPA RMP requirement, ACGIH TLV-C documentation, or NIOSH IDLH standard addresses this distinction. The three-recurrence pattern across MIC, HCN, and BF3 in the Glyphward portfolio suggests that the N2 inertisation deficiency-suppression class is likely to appear in additional chemical systems where N2 provides the primary protective barrier — chlorine cylinder storage (N2 used in some modern cylinder handling stations to exclude atmospheric moisture from the regulator train), liquid SO2 storage (N2 padding), and HF storage tank blanketing — each of which is a candidate for this attack class in AI monitoring systems deployed on those specific chemical handling operations.

OSHA PSM 29 CFR 1910.119, EPA RMP 40 CFR Part 68, ACGIH TLV-C 1 ppm, NIOSH IDLH 25 ppm, and the adversarial robustness gap for BF3 handling AI

OSHA PSM 29 CFR 1910.119 governs BF3 handling at the 250 lb threshold quantity — the same TQ as MIC, placing BF3 in the second-most stringent PSM tier (after phosgene at 10 lb and equivalents). PSM element (d) (Process Safety Information) requires facilities to document BF3 chemical properties — PSM TQ 250 lbs, TLV-C 1 ppm, IDLH 25 ppm, OSHA PEL 1 ppm ceiling, hydrolysis reaction with water (BF3 + 3H2O → H3BO3 + 3HF) and secondary HF properties (TLV-C 0.5 ppm, IDLH 30 ppm, systemic fluoride toxicity) — alongside cylinder storage specifications (maximum operating pressure, PRD set-point, storage temperature limits), transfer line anhydrous specification (below 10 ppm H2O), N2 purge design requirements (5–10 psig, all idle lines), and the consequences of cylinder overpressure (surface 1 scenario), atmospheric BF3+HF compound release (surface 2 scenario), moisture contamination and HF generation in transfer line (surface 3 scenario), and N2 purge pressure deficiency and moisture infiltration (surface 4 scenario). PSM element (e) (Process Hazard Analysis) requires PHA studies covering all four surface scenarios as hazard initiating events; the primary process safety safeguards identified in PHAs for each scenario are the BF3 cylinder pressure monitoring AI (surface 1), the BF3 area gas CEMS AI (surface 2), the transfer-line moisture analyzer AI (surface 3), and the N2 purge pressure monitoring AI (surface 4). PSM element (e) does not specify adversarial robustness requirements for AI classifying the rendered display images of these four monitoring parameters at the BF3 handling monitoring boundary.

PSM element (j) (Mechanical Integrity) requires inspection and testing of BF3 cylinder valves, PRD devices, manifold piping, and transfer hoses — the physical equipment whose integrity the monitoring AI is tasked to verify — but does not address adversarial robustness of the AI systems interpreting their display outputs. PSM element (l) (Management of Change) requires MOC review before changes to BF3 handling process parameters but does not extend to adversarial robustness testing when AI monitoring systems are deployed or updated at BF3-handling facilities. PSM element (o) (Emergency Planning) requires emergency action plans for BF3 atmospheric release scenarios — but these plans depend on the CEMS AI providing accurate atmospheric BF3 detection, which the surface 2 adversarial attack defeats. EPA RMP 40 CFR Part 68 requires BF3 facilities to maintain worst-case and alternative release scenario consequence analyses using EPA toxic endpoint methodology with BF3 ERPG-2 toxic endpoint distances — but does not address adversarial robustness of AI systems at the monitoring boundary that precedes the release events the RMP models. ACGIH TLV-C documentation for BF3 at 1 ppm describes the basis for the ceiling standard — acute pulmonary toxicity from BF3 inhalation and in-situ HF generation at the respiratory mucosa — but does not address adversarial robustness of AI systems classifying rendered BF3 CEMS display images at the 1 ppm monitoring boundary. NIOSH IDLH documentation for BF3 at 25 ppm does not address adversarial robustness of AI area monitoring display classification. The regulatory gap for BF3 handling AI is structurally identical to the gaps documented for phosgene production AI and MIC storage AI: the most stringent PSM regulatory tier (TQ 250 lbs) applied to BF3 handling contains no adversarial robustness specification for the AI display classification layer now operating at all four primary monitoring boundaries in BF3 cylinder pressure, CEMS, moisture, and N2 purge monitoring systems.

Glyphward threshold 35 for BF3 handling AI

Glyphward’s adversarial detection API operates as a pre-classification gate at each rendered-image ingestion boundary in the BF3 handling AI pipeline: before the cylinder pressure AI processes each manifold pressure transmitter display image, before the CEMS AI processes each area gas detector panel image, before the moisture analyzer AI processes each inline moisture transmitter display image, and before the N2 purge pressure AI processes each purge circuit pressure transmitter display image. Each rendered display image receives a risk score (0–100) in 8–15 ms. At or above threshold 35, Glyphward gates the AI classification and generates an alert triggering manual verification of the displayed parameter against the underlying DCS process historian raw transmitter records — the engineering-unit time series that are inaccessible to pixel-level adversarial perturbation — or, for field instruments (cylinder manifold pressure, N2 purge line pressure), direct field verification against the local gauge or transmitter display.

Threshold 35 for BF3 handling AI reflects three calibration factors. First, OSHA PSM TQ 250 lbs places BF3 in the same regulatory tier as MIC — the chemical released at Bhopal in 1984 in the worst industrial chemical disaster in history. The 250 lb TQ is the direct regulatory expression that BF3 monitoring failure has catastrophic consequence potential, encoded into the OSHA regulatory system at the same level applied to MIC after the 1984 disaster demonstrated at the largest scale in history what a monitoring failure at an MIC storage facility produces. The OSHA PSM system was specifically designed to prevent a repeat of Bhopal; assigning BF3 the same TQ as MIC indicates that OSHA assessed BF3 facilities as carrying MIC-class risk that requires full PSM management. Threshold 35 aligns BF3 handling AI detection sensitivity with MIC storage AI, phosgene production AI, and HF alkylation unit AI — the substances at the same or adjacent regulatory tier in OSHA PSM Appendix A.

Second, the compound BF3+HF secondary hazard generated by in-situ hydrolysis changes the false-negative cost calculation at the CEMS monitoring boundary in a way not present for any other single-compound acute toxic gas CEMS adversarial attack in the Glyphward portfolio. For all other CEMS adversarial attacks in the portfolio — HF alkylation acid release, chlorine area CEMS, MIC area detector — a false negative suppresses one compound’s atmospheric concentration. For BF3 CEMS AI, a false negative simultaneously suppresses the only monitoring indicator of both the primary BF3 acute inhalation hazard and the secondary systemic HF fluoride toxicity hazard (Ca²⁺ chelation → hypocalcaemia → ventricular fibrillation) that BF3 generates in situ at the respiratory mucosa. The cardiac arrest risk from systemic fluoride toxicity — which can occur at HF exposure concentrations above the mucosal IDLH-equivalent without any dramatic acute respiratory warning that would trigger self-rescue — adds a consequence pathway to the BF3 CEMS false negative that is not addressed by standard compressed gas exposure emergency response protocols (which focus on respiratory support, decontamination, and oxygen therapy rather than calcium gluconate IV administration and cardiac monitoring that HF systemic toxicity requires). False positive cost at threshold 35: 1–3 minutes to verify cylinder bank pressure, area CEMS reading, moisture analyzer reading, and N2 purge pressure against underlying DCS historian transmitter records or field gauge verification. False negative cost: compound BF3+HF atmospheric exposure at 18.4× TLV-C BF3 (with simultaneous in-situ systemic HF fluoride toxicity pathway activated at mucosal surface, above NIOSH IDLH HF) + transfer-line fitting corrosion from moisture-initiated HF generation progressing toward compound BF3+HF plume release + moisture accumulation in idle transfer line piping generating latent BF3–to–HF hydrolysis at next service restoration. The asymmetry calibrates to threshold 35.

Third, the N2 inertisation deficiency-suppression pattern — now confirmed as a class with three recurrences in the Glyphward portfolio — establishes that the upward-direction attack on “high is safe” protective parameters is a systematic vulnerability of AI monitoring systems at PSM-covered chemical facilities, not an isolated artefact of any one chemical system. BF3 transfer line N2 purge monitoring is the third instance; the pattern will recur in AI monitoring systems deployed on any chemical handling operation where N2 provides an inert gas barrier against a reactive secondary hazard. Threshold 35 applies to all four BF3 handling monitoring surfaces simultaneously, ensuring that the compound four-surface attack — in which each individually plausible AI classification is reinforced by the apparent coherence of the other three — is detected at the AI input gate rather than discovered only when the compound consequence (cylinder overpressure, compound atmospheric BF3+HF exposure, transfer-line corrosion, and idle-line moisture infiltration) has progressed to a physical release event. Free tier — 10 scans/day, no card required. Submit a rendered BF3 cylinder vapor pressure display, area CEMS panel image, inline moisture transmitter display, or N2 purge pressure indicator from your BF3 handling facility to the Glyphward scanner to generate a baseline adversarial risk score for your BF3 handling AI inputs before they reach the AI classification layer operating at the OSHA PSM TQ 250 lbs monitoring boundary.