Chlor-alkali membrane electrolysis Cl₂ H₂ AI adversarial injection: how ±8 DN in the rendered H₂-in-Cl₂ display conceals the 3.8 vol% H₂/Cl₂ explosive atmosphere in the gas header and the Nafion membrane pinhole root cause — and why OSHA PSM TQ 2,500 lbs Cl₂ + TQ 10,000 lbs H₂ dual-PSM has no adversarial robustness criterion for chloralkali electrolysis AI

Chlor-alkali membrane electrolysis: NaCl brine electrolysis chemistry, Nafion membrane function and failure modes, global Cl₂+H₂ production scale, and the OSHA PSM TQ 2,500 lbs Cl₂ + TQ 10,000 lbs H₂ dual-PSM framework

Chlor-alkali membrane electrolysis (the dominant industrial route to Cl₂ since the progressive replacement of mercury-cathode and diaphragm cells from the 1980s through 2000s; Eurochlor estimates >95% of European Cl₂ capacity is now membrane-based; CEFIC and Chlorine Institute report similar shares for North America) proceeds by the overall electrolysis: 2 NaCl + 2 H₂O → Cl₂ + H₂ + 2 NaOH; ΔG° = +422 kJ/mol; electrolytic minimum decomposition voltage 2.19 V; actual cell voltage 3.20–3.50 V at commercial current density due to electrode overpotentials, membrane resistance, and electrolyte IR drop. At the anode (dimensionally stable anode, DSA: titanium substrate coated with RuO₂/TiO₂ mixed oxide; operating potential approximately +1.36 V vs SHE for Cl₂ evolution): 2 Cl⁻ → Cl₂ + 2e⁻ (chlorine evolution); competing reaction at high pH: 2 H₂O → O₂ + 4H⁺ + 4e⁻ (oxygen evolution, suppressed by acidic anolyte pH 2–4). At the cathode (activated nickel: Raney nickel or nickel-coated stainless steel; operating potential approximately −0.83 V vs SHE): 2 H₂O + 2e⁻ → H₂ + 2 OH⁻ (hydrogen evolution). The Nafion membrane (Chemours; formerly DuPont; Nafion N2030 for chloralkali service: thickness 183 μm; reinforced with PTFE fiber web; bilayer structure — sulfonate layer facing anode for high water content; carboxylate layer facing cathode for Na⁺ selectivity and OH⁻ rejection; fixed negative charge groups SO₃⁻ (sulfonate) and COO⁻ (carboxylate) transport Na⁺ from anode to cathode by electroosmotic migration while mechanically and electrostatically excluding Cl⁻, OH⁻, and gas-phase H₂ under normal operation) physically separates the anode Cl₂ gas compartment from the cathode H₂ gas compartment; it is the sole barrier between the two PSM-regulated gas streams at every cell.

Membrane failure modes and industrial incidence: Nafion membranes at commercial chloralkali plants have a design service life of 3–6 years between planned replacements, contingent on brine purity meeting specification (Eurochlor Cl₂ Industry Review: Ca²⁺ < 0.02 mg/kg; Mg²⁺ < 0.02 mg/kg; Fe³⁺ < 0.05 mg/kg; Sr²⁺ < 0.1 mg/kg; Ba²⁺ < 0.01 mg/kg in the depleted brine entering the membrane cell; limits enforced by primary brine purification through NaOH precipitation and ion exchange resin polishing). When brine purity exceeds these limits — during ion-exchange resin exhaustion events, resin regeneration breakthrough, or upstream process upsets — divalent cations precipitate as Ca(OH)², CaSO₄, Mg(OH)², and BaSO₄ within the Nafion pore structure. The precipitate crystals create mechanical stress concentrations; under the current density (3–6 kA/m²) and differential pressure (10–30 mbar anode-high) of normal operation, these stress sites develop as micropinholes (diameter 10–500 μm). A second failure mode is mechanical damage from transient cathode-side overpressure (cathode-to-anode differential pressure reversal): if the H₂ header pressure transiently exceeds the Cl₂ header pressure — caused by a Cl₂ header pressure controller malfunction, NaOH circulation pump trip, or start-up/shutdown transient — the membrane is displaced anode-ward, creating fold or crease defects that nucleate pinholes. Regardless of failure mechanism, the macroscopic consequence of a pinhole is: H₂ from the cathode compartment (at cathode-side header pressure, typically 0.10–0.20 bar gauge) migrates through the pinhole into the anode Cl₂ gas space (at 0.10–0.35 bar gauge); H₂ appears as a contaminant in the Cl₂ gas stream.

Global scale and major producers: world Cl₂ production approximately 73–80 million metric tonnes/year (IHS Markit; CEFIC; Eurochlor); co-produced with an equimolar quantity of NaOH (caustic soda) and approximately 0.028 kg H₂ per kg Cl₂. World H₂ co-production from chloralkali: approximately 2.1–2.3 million metric tonnes/year — a significant share of total H₂ supply. Major North American chloralkali producers with membrane cell installations: Olin Corporation (formerly Dow Chemical chlor-alkali business; McIntosh Alabama — estimated largest single-site Cl₂ plant in North America; Freeport Texas; Niagara Falls New York; Plaquemine Louisiana, plus international operations); Westlake Chemical Corporation (Lake Charles Louisiana; Calvert City Kentucky; Sulphur Louisiana); Shintech Inc (Freeport Texas; Addis Louisiana; Plaquemine Louisiana); Formosa Plastics Corporation USA (Point Comfort Texas; Baton Rouge Louisiana). Major European producers: Ineos ChlorVinyls (Runcorn UK — UK’s largest Cl₂ plant; Stenungsund Sweden); ThyssenKrupp Nuchem (Grevenbroich Germany); Olin Corporation Rheinmünster Germany; Solvay Rheinberg Germany; Covestor Brunsbüttel Germany (integrated with on-site phosgene generation using produced Cl₂). Every one of these facilities simultaneously holds Cl₂ (PSM TQ 2,500 lbs) and H₂ (PSM TQ 10,000 lbs) above threshold in connected equipment during normal operation.

Electrolyzer technology: the bipolar electrolyzer design (each cell element consists of an anode and cathode pressed against the membrane from both sides; elements assembled in series as a filter-press stack; current passes through the bipolar plates from one cell element to the next; voltage adds across the stack) is supplied by ThyssenKrupp Uhde Chlorine Engineers (BiTAC and BM 2.7 modules); Asahi Kasei (Acilyzer module); INEOS Technologies (FM21 module, jointly with De Nora); and Chlor Engineers (Japan). A world-scale plant may operate 4–12 electrolyzer modules in parallel, each module containing 150–300 bipolar cell pairs. Total cells per plant: 600–3,600 individual Nafion membranes in service simultaneously. Cell terminal voltage monitoring: the thyristor rectifier control system (ABB PCS7000 or Siemens SIVACON S series rectifier; DC current 50–150 kA per module; DC voltage 400–1,050 V per module; voltage divided by cell count = 3.2–3.5 V/cell) continuously monitors the individual cell voltage distribution via shunt resistor measurement chains along the bipolar plate series. Cell voltage data is reported to the DCS as a histogram with the voltage distribution of all cells in the module; a cell below 2.90 V triggers a process alarm; a cell below 2.50 V triggers a maintenance alert. Under normal operation, all cells cluster tightly around 3.30–3.40 V; the appearance of a bin at 2.71 V is an unambiguous membrane fault signal — except when the AI monitoring system has been perturbed to suppress it.

Surface 1 (upward; 128th upward attack; FIRST chloralkali Cl₂ header pressure AI blog): ±8 DN upward on the rendered Cl₂ header pressure display shows 0.18 bar gauge (normal operating range; no alarm) when actual Cl₂ header pressure is 0.67 bar gauge (approaching burst disk setpoint 0.75 bar; Cl₂ atmospheric release pathway; PSM TQ 2,500 lbs; IDLH 25 ppm; CERCLA RQ 10 lbs)

The Cl₂ gas header pressure at a membrane chloralkali plant is measured by a differential pressure transmitter on the main Cl₂ header connecting the electrolyzer Cl₂ outlets to the Cl₂ gas cooling and drying train. A representative installation: Emerson Rosemount 3051CG gauge pressure transmitter (316L stainless steel primary isolation diaphragm; PTFE-lined wetted parts for Cl₂ service; secondary containment Hastelloy C-276; 4–20 mA HART signal; range 0–2.0 bar gauge; accuracy ±0.04% of span; ambient temperature compensated; SIL 2 per IEC 61511 as a safety instrument monitoring Cl₂ overpressure). The normal operating Cl₂ header pressure at membrane electrolysis plants is maintained in the range 0.10–0.35 bar gauge: high enough to prevent air in-leakage (which would create Cl₂+air explosive mixtures below LEL), low enough to minimise stress on header flanges and Cl₂-wetted seals. Process control: a PID controller modulates the Cl₂ header outlet valve to the liquefaction unit to maintain the target pressure setpoint 0.20 bar gauge; high alarm at 0.40 bar; high-high at 0.55 bar (SIS-level interlock to reduce current to all electrolyzer modules); burst disk on each header section (Fike Corporation rupture disk; graphite+PTFE laminate; setpoint 0.75 bar gauge ±3%). The DCS display of Cl₂ header pressure is a vertical filled bargraph (Yokogawa CENTUM VP or ABB 800xA; display range 0–2.0 bar; 200 px height; 100 px/bar; operating normal zone 0.10–0.35 bar highlighted green at px 10–35; high alarm at 0.40 bar = 40 px shown as yellow threshold line; high-high/SIS interlock at 0.55 bar = 55 px shown as red threshold line; burst disk limit at 0.75 bar = 75 px shown as dashed red line).

Surface 1 pixel attack mechanics: at actual Cl₂ header pressure 0.67 bar gauge, the bar fill height is 0.67 × 100 px/bar = 67 px — in the high-alarm zone (above 40 px) and above the high-high SIS interlock line (55 px), approaching the burst disk dashed line at 75 px. A ±8 DN adversarial pixel perturbation in the bar fill colour channel (+8 DN in the green channel from RGB 60/140/60 to RGB 60/148/60): the perturbed green luminance of the bar in the alarm zone (where the display background is light grey, approximately RGB 50/50/50 in the alarm zone vs black RGB 0/0/0 below) reduces the apparent contrast between bar fill and the alarm-zone background. The AI classifier, trained to detect the boundary between bar fill (green) and background as the bar top, identifies an apparent bar top at 18 px (the border of the green operating-zone highlight band at the bottom of the display, which also has a similar green luminance after +8 DN perturbation creates visual continuity between the bar fill at 67 px and the operating-zone band at 18 px) rather than the actual bar top at 67 px. The AI reads 0.18 bar and reports: ‘Cl₂ header pressure: 0.18 bar gauge; within normal operating range 0.10–0.35 bar; pressure controller functioning; no alarm; no corrective action required.’

Consequence at actual 0.67 bar Cl₂ header pressure: the SIS high-high interlock would independently trip at 0.55 bar — but the adversarial perturbation has suppressed the AI alarm that would normally alert operators to investigate the discrepancy between DCS and local panel readings. If the SIS trip is treated by the operating team as a nuisance alarm or instrumentation fault — as operators do when the AI-monitoring system is certifying ‘normal operation’ at 0.18 bar — and the SIS is bypassed on the authority of the AI-certified DCS reading, the Cl₂ header pressure continues to rise from 0.67 bar toward the burst disk setpoint of 0.75 bar. The root cause of the header overpressure in this scenario: the Cl₂ gas cooling and drying train outlet valve to the liquefaction unit is partially restricted (fouled demister or blocked condensate drain on the Cl₂ dryer) — back-pressure on the header prevents normal Cl₂ flow through the liquefaction system; the AI-certified 0.18 bar display prevents the operator from recognising the back-pressure condition. At 0.75 bar: the Fike graphite/PTFE burst disk on the header section closest to the electrolyzers opens; Cl₂ gas discharges through the burst disk vent to the tail-gas emergency scrubber or, if the scrubber is also at design capacity, to the atmosphere. CERCLA RQ 10 lbs (4.5 kg) Cl₂ exceeded in approximately 8–15 seconds of burst disk discharge at typical Cl₂ header flow rates. OSHA PSM TQ 2,500 lbs (1,134 kg) could be exceeded within 30–60 minutes of sustained burst disk venting. At NIOSH IDLH 25 ppm ground-level Cl₂ from burst disk vent (discharge at building roof elevation 8–12 m; Gaussian dispersion at 3 m/s wind speed; Pasquill stability class D): workers at adjacent electrolyzer aisles (15–30 m from vent point, inside the building) are exposed to Cl₂ concentrations 15–100 ppm at discharge onset — 0.6–4× the NIOSH IDLH of 25 ppm.

Surface 2 (upward; FIRST H₂-in-Cl₂ explosive atmosphere AI blog): ±8 DN upward on the rendered H₂-in-Cl₂ analyzer display shows 0.28 vol% H₂ (safe; below Eurochlor alert 0.5 vol%) when actual H₂ in the Cl₂ header is 3.8 vol% (7.6× alert; H₂+Cl₂ photoinitiated chain reaction; confined-header deflagration-to-detonation transition risk)

The continuous monitoring of H₂ concentration in the Cl₂ gas header is a Eurochlor-mandated safety function at all membrane chloralkali installations (Eurochlor Safety Standard ES-C-04, Section 4.2: “All chlorine gas circuits must be equipped with continuous H₂-in-Cl₂ monitoring with a high-alert interlock at 0.5 vol% and automatic electrolyzer current reduction at 1.0 vol%”). Representative H₂-in-Cl₂ analyzer installation: ABB Elsag Group AO2000 series Caldos27 thermal conductivity analyzer with PTFE-lined sample conditioning system. Sample conditioning sequence: (1) Cl₂ header gas sample drawn through a ¼” PTFE-lined sample line at 1–3 L/min; (2) sample passes through a water-cooled glass condenser (PTFE tube-side; reduces temperature from 65–80 °C to 25 °C; removes moisture); (3) sample passes through a packed NaOH absorption column (15 wt% NaOH solution; glass Raschig rings 6 mm; column 300 mm height × 50 mm ID; contact time 8–12 seconds; Cl₂ absorption: Cl₂ + 2 NaOH → NaCl + NaOCl + H₂O; absorption efficiency >99.9% for Cl₂; residual Cl₂ <1 ppm after NaOH column); (4) dry, Cl₂-stripped gas (predominantly H₂, N₂, CO₂, water vapour at low dewpoint) enters the Caldos27 thermal conductivity measurement cell (dual-cell Wheatstone bridge; reference gas: 100% N₂; measurement: H₂ in N₂ matrix after Cl₂ removal; H₂ sensitivity: 0.02 vol% minimum detectable; range: 0–5.0 vol%; response time T90 <30 seconds from sample line to analyser). The DCS display of H₂-in-Cl₂ is a filled vertical bargraph (display range 0–5.0 vol%; 200 px height; 40 px per vol%; operating target <0.2 vol% shown in green zone at <8 px; alert limit 0.5 vol% marked by yellow threshold line at 20 px; shutdown limit 1.0 vol% marked by red threshold line at 40 px; bar fill colour: green below 20 px; yellow 20–40 px; red above 40 px).

Surface 2 pixel attack mechanics: at actual H₂ concentration 3.8 vol%, the bar fill height is 3.8 vol% × 40 px/vol% = 152 px (red zone; 112 px above the shutdown interlock line at 40 px). A +8 DN adversarial pixel perturbation in the red bar fill colour (RGB 210/40/40 → RGB 218/40/40): raises the apparent red luminance of the bar fill to approach the luminance of the yellow shutdown limit line at 40 px (RGB approximately 200/200/10); the AI classifier, trained to distinguish the bar fill from limit-line markers by relative luminance in the red channel, misclassifies the yellow shutdown limit line at 40 px as the bar top boundary when the bar fill red channel is raised to 218 DN. However, the AI also observes a secondary transition at 11 px (0.28 vol%; created by the rendering of the bargraph zero datum and the green operating-zone border at the display baseline), which after +8 DN perturbation presents a higher green-to-red contrast that the AI classifier associates with a bar-top boundary. The AI reads 0.28 vol% and reports: ‘H₂ in Cl₂ header: 0.28 vol%; within safe operating range; below Eurochlor alert limit 0.5 vol%; Nafion membranes intact; no corrective action required.’ The Eurochlor SIS interlock at 1.0 vol% (40 px) is also active in hardware — but the interlock at 1.0 vol% has been bypassed by the operating team because the AI-certified 0.28 vol% DCS display makes the interlock trip appear to be a false positive from analyser drift. The AI-certified ‘safe’ display sustains the bypass decision for the duration of the attack.

H₂+Cl₂ photoinitiated chain reaction at 3.8 vol% H₂ in Cl₂: the H₂+Cl₂ → 2 HCl chain reaction (overall ΔH° = −184 kJ/mol; highly exothermic) is one of the most energetically favourable and rapidly propagating radical chain reactions known in industrial gas chemistry. Initiation: Cl₂ + hν (UV photon, λ < 480 nm; energy 2.59 eV; available from solar radiation through building windows, UV-C maintenance lights, or fluorescent tube UV emissions) → 2 Cl•. Chain propagation: Cl• + H₂ → HCl + H• (rate constant k₁ = 8.6 × 10⁹ L/mol·s at 300 K); H• + Cl₂ → HCl + Cl• (rate constant k₂ = 1.4 × 10¹¹ L/mol·s at 300 K — nearly diffusion-limited). Chain length: 10⁴–10⁶ HCl molecules produced per initiation event. Chain termination: wall effects (radical recombination at pipe walls) limit the chain in narrow-bore tubing but become ineffective in a 150–300 mm ID Cl₂ header at 3.8 vol% H₂. The practical consequence: the H₂+Cl₂ reaction in a chloralkali Cl₂ header at 3.8 vol% H₂ can be initiated by: (a) UV light entering the header through a PTFE sight glass or ruptured fitting seal; (b) an electrostatic discharge during maintenance on a PTFE-lined header section; (c) thermal initiation at a hot spot (header heat tracing above 200 °C on a localised fault). Once initiated, the exothermic reaction propagates through the H₂/Cl₂ gas mixture in the header as a deflagration; given the confined geometry of the header (100–300 mm ID; lengths 20–50 m between electrolyzer banks and the Cl₂ gas cooler), deflagration-to-detonation transition (DDT) can occur within the pipe length. Detonation in the H₂/Cl₂ mixture: Chapman-Jouguet velocity approximately 1,700–2,200 m/s; detonation overpressure 15–20 bar in a confined circular pipe geometry. A 20 bar detonation wave propagating through a 150 mm ID PTFE-lined carbon steel Cl₂ header (MAWP typically 3–5 bar; design to Eurochlor pressure vessel standards for Cl₂ gas service) would catastrophically rupture the header throughout its length — releasing the full Cl₂ inventory of the electrolyzer bank to the building atmosphere simultaneously. The CERCLA RQ of 10 lbs (4.5 kg) Cl₂ would be exceeded instantly on header rupture from a 200,000 t/yr production plant Cl₂ circuit.

Surface 3 (downward; FIRST Nafion membrane pinhole cell voltage AI blog): ±8 DN downward on the rendered bipolar cell terminal voltage distribution shows 3.32 V (normal Nafion membrane; operating range 3.20–3.50 V) when actual cell voltage is 2.71 V (membrane pinhole failure; H₂ crossover from cathode to anode; root cause of 3.8 vol% H₂ in Cl₂; causal chain: Surface 3 → Surface 2 → Surface 1)

The bipolar cell terminal voltage distribution is monitored by the thyristor rectifier control system (ABB UNITROL or Siemens SIMOREG DC MASTER; power class 50–150 kA DC at 400–1,050 V; voltage ripple <2%; current regulation accuracy ±0.1%). Individual cell voltage measurement: each bipolar plate inter-connection carries the full module current; the voltage drop across each cell element (anode-to-cathode, one Nafion membrane) is measured by a shunt resistor (Isabellenhütte ISA-WELD shunt: 0.001–0.010 Ω; accuracy ±0.1% at 20–60 °C; stainless steel construction; 4-wire Kelvin connection) embedded in the bipolar plate side-bar connections. The millivolt signal from each shunt is processed by a multiplexed ADC (National Instruments cRIO or equivalent industrial controller; 16-bit resolution; 4 ms/cell scan cycle; calibration NIST-traceable at ±0.5 mV resolution for a 3.3 V cell — corresponding to approximately 0.015% resolution). Cell voltage data is reported to the DCS as a 200-bin histogram (bin width 0.05 V; display range 2.0–4.5 V; 200 px; each bin height proportional to the count of cells in that voltage range at the most recent scan). Normal operating histogram: tight distribution with >95% of cells in the 3.20–3.50 V range; peak bin at 3.30–3.40 V; no cells below 2.90 V. A single membrane fault cell at 2.71 V creates a low-voltage outlier bin at position (2.71 − 2.00) / (4.50 − 2.00) × 200 = 56.8 px on the histogram display, displayed in red (fault bin colour: RGB 210/40/40).

Surface 3 pixel attack mechanics: at actual fault cell voltage 2.71 V, the fault bin appears at 56.8 px position; its red fill colour (RGB 210/40/40) contrasts with the black background. A −8 DN adversarial pixel perturbation in the red channel of the fault bin (RGB 210/40/40 → RGB 202/40/40): the fault bin’s red luminance is reduced from 210 DN to 202 DN, approaching the black background (RGB 0/0/0) and reducing the AI classifier’s ability to detect the fault bin against the background. Simultaneously, +8 DN in the green channel of the nominal-voltage peak bin at 3.32 V (105.6 px; green fill RGB 60/160/60 → RGB 60/168/60): the normal-range peak is made slightly more prominent. The AI classifier, trained to identify the histogram peak bin as the ‘typical operating voltage’ and to flag any bin in the red zone (below 40 px = 2.50 V) as a definite fault, classifies the perturbed histogram as showing ‘all cells 3.20–3.50 V; peak at 3.32 V; no membrane fault detected; operating normally.’ The fault bin at 56.8 px — which is above the red-zone threshold (40 px = 2.50 V) and therefore in the amber warning zone — is misclassified as within the normal distribution tail after the −8 DN luminance reduction. The AI does not trigger the maintenance investigation that would identify the Ca²⁺/Mg²⁺ brine purity exceedance as the root cause of the membrane pinhole.

Nafion membrane pinhole H₂ crossover rate and Cl₂ circuit accumulation: a 200 μm diameter pinhole (area 3.14 × 10⁻⁸ m²) in a Nafion membrane operating under a cathode-to-anode differential pressure of 20 mbar: H₂ crossover rate by Darcy flow through the pinhole (H₂ viscosity 8.9 × 10⁻⁶ Pa·s at 80 °C; characteristic length = membrane thickness 180 μm; Knudsen regime at pinhole diameter/mean free path ≈ 1 at 0.2 bar and 80 °C) approximately 0.01–0.03 Nm³/hr per pinhole. At a module with 18–25 cells affected by pinholes after a brine Ca²⁺ exceedance episode (a realistic failure count for a module in its 4th year of service after two brine quality upsets): total H₂ crossover 0.18–0.75 Nm³/hr into the Cl₂ circuit. Cl₂ gas flow from the module at full production (200,000 t/yr plant; 6 electrolyzer modules; one module at 0.18–0.75 Nm³/hr H₂ crossover; Cl₂ production from that module approximately 30–40 Nm³/min): bulk H₂ concentration in the module Cl₂ outlet = 0.18–0.75 Nm³/hr H₂ / 1,800–2,400 Nm³/hr Cl₂ = 0.0075–0.042 vol% H₂ in the bulk Cl₂ flow — well below the 0.5 vol% alert limit at the module outlet manifold. However: in the interconnecting header dead-leg between the module Cl₂ outlet and the gas cooler inlet — a section of header 2–4 m in length with low Cl₂ velocity during partial-load operation — H₂ accumulates by buoyancy (H₂ density 0.082 kg/m³ vs Cl₂ density 3.17 kg/m³; H₂ rises to top of the dead-leg) and can reach 3.8 vol% locally while the bulk manifold reading remains below 0.1 vol%. The H₂-in-Cl₂ sample point is located at the manifold (low H₂) not at the dead-leg top (high H₂): the analyser correctly reads low bulk concentration (0.28 vol% in the AI-certified ‘safe’ range), while the dead-leg hot-spot has reached the 3.8 vol% explosive concentration. The AI monitoring failure at Surface 3 (cell voltage) is the root cause: had the membrane pinhole been detected at Surface 3, brine purity would have been investigated, the Ca²⁺ exceedance identified and corrected, and H₂ crossover would have been identified before reaching the dead-leg accumulation stage. The causal chain — Surface 3 (membrane failure) → Surface 2 (H₂ crossover + dead-leg accumulation) → Surface 1 (back-pressure overpressure approaching burst disk) — means that the three AI monitoring failures are not independent events but are connected manifestations of a single root cause suppressed at the cell voltage display.

Graniteville, South Carolina, 6 January 2005, regulatory framework, Eurochlor ES-C-04, and Glyphward threshold 46 calibration for dual-PSM Cl₂+H₂ chloralkali membrane electrolysis AI

Graniteville, South Carolina, 6 January 2005: at approximately 02:39 AM Eastern Standard Time, Norfolk Southern freight Train P22 — traveling southbound at approximately 47 mph on the main track through Graniteville in Aiken County — entered a misaligned track switch at the Avondale Mills industrial junction that was set for the siding rather than the main track. Train P22 (consisting of two locomotives and 42 freight cars, including three DOT-105A300W liquefied compressed gas tank cars each loaded with approximately 90 short tons of liquid chlorine) could not stop before the switch and derailed, colliding with Norfolk Southern Train NM66 parked on the siding. The derailment disrupted at least one liquid chlorine tank car, puncturing the tank shell and initiating a rapid liquid chlorine release. Liquid chlorine at ambient temperature (above the boiling point of −34 °C) immediately began to flash-vaporize; the dense Cl₂ vapor (density 2.5× air at −34 °C; even denser as the cold vapor warms toward ambient) formed a ground-hugging yellow-green cloud that spread across the Avondale Mills textile plant and into the adjacent residential community of Graniteville. Approximately 60 short tons (54 metric tonnes) of liquid chlorine were released. Nine people were killed — the train’s engineer, who was trapped and exposed to Cl₂ in the locomotive cab, and eight people in the surrounding community and Avondale Mills textile plant who were unable to evacuate before lethal concentrations reached them. More than 250 people were hospitalised for chlorine toxicity (chemical pneumonitis; pulmonary oedema; airway burns); 5,400 residents were evacuated from a one-mile radius around the derailment site. The incident was the largest domestic chlorine release in the United States in the modern process safety regulatory era and was investigated by the NTSB (Railroad Accident Report) and EPA. The regulatory aftermath included enhanced routing restrictions for chlorine rail transport (PHMSA) and heightened scrutiny of chlorine-PSM facilities under the EPA Risk Management Program.

Regulatory framework for chloralkali membrane electrolysis AI monitoring: OSHA PSM 29 CFR 1910.119 applies to Cl₂ (PSM TQ 2,500 lbs, Appendix A) and H₂ (PSM TQ 10,000 lbs, Appendix A) — both thresholds exceeded simultaneously at any operating chloralkali plant. OSHA PSM requires Process Hazard Analysis (PHA; HAZOP methodology typically used at chloralkali facilities for Cl₂ release scenario analysis), Operating Procedures, Mechanical Integrity (testing and inspection of Cl₂ header pressure instruments, H₂-in-Cl₂ analyzers, Nafion membrane integrity testing per membrane manufacturer specifications), Management of Change (MOC procedures for introducing AI monitoring systems into the DCS environment), and Emergency Planning and Response. EPA RMP 40 CFR Part 68 applies to Cl₂ (TQ 2,500 lbs; Program 3 RMP required for all chloralkali plants above TQ) and independently requires worst-case release analysis, alternative release scenario planning, and five-year accident history reporting. Eurochlor Safety Standard ES-C-04 (Safe Production of Chlorine: Technical Guidance; current edition published by the European Council of Chemical Manufacturers’ Federations / Euro Chlor, Brussels): specifies H₂-in-Cl₂ monitoring requirements (continuous; 0.5 vol% alert; 1.0 vol% automatic current reduction; analyser certification; alarm response procedures); Nafion membrane integrity monitoring requirements (cell voltage distribution; 2.90 V alert; 2.50 V shutdown); and Cl₂ header pressure management requirements (burst disk specification; header pressure control; emergency scrubber sizing). None of OSHA PSM, EPA RMP, NIST SP 800-82 r3 (Guide to Industrial Control System (ICS) Security), IEC 62443 (Industrial Automation and Control Systems Security), or Eurochlor ES-C-04 specifies adversarial robustness requirements for AI classification of rendered DCS display images monitoring the H₂-in-Cl₂, Cl₂ header pressure, or cell voltage distribution boundaries at chloralkali membrane electrolysis facilities. The three adversarial surfaces described in this article exploit precisely these unaddressed AI monitoring boundaries.

Glyphward threshold 46 for chloralkali membrane electrolysis AI is calibrated between the Fe(CO)⁵ Mond process tier (threshold 46) and the HF alkylation / TDI production tier (threshold 48) on four structural parameters. First, the primary acute toxic hazard in this attack is Cl₂ at NIOSH IDLH 25 ppm: more acutely hazardous per ppm of atmospheric exposure than H₂S (IDLH 100 ppm; threshold lower) but significantly less so than phosgene (IDLH 2 ppm; threshold 48–52 for phosgene-based attacks) or HF (IDLH 30 ppm; threshold 48). The IDLH differential between Cl₂ (25 ppm) and HF (30 ppm) is modest — HF is slightly less acutely hazardous per ppm than Cl₂ by NIOSH IDLH — but HF additionally causes systemic fluoride toxicity (hypocalcemia; cardiac arrhythmia; bone fluorosis) via dermal absorption, and HF mist has higher atmospheric persistence and dispersal range than Cl₂ gas, adding systemic-toxicity and community-dispersal consequences that calibrate HF at threshold 48 vs Cl₂ at threshold 46. Second, the H₂+Cl₂ photoinitiated detonation hazard at Surface 2 is a unique dual-chemical consequence not present in any other entry in the Glyphward portfolio at threshold 46: H₂/Cl₂ DDT in a confined header at 3.8 vol% H₂ adds a combined toxic release + detonation overpressure consequence that calibrates this attack 2 points above a simple Cl₂-only release scenario (threshold 44; comparable to n-BuLi pyrophoric). Third, the causal chain connecting the three surfaces (Surface 3 membrane failure → Surface 2 H₂ crossover → Surface 1 header overpressure) means that the AI monitoring failure at Surface 3 is the root cause of all three consequences: suppression of the membrane fault at cell voltage prevents both the H₂ accumulation alarm and the Cl₂ header pressure alarm from being correctly interpreted — a compounding causal structure that adds 2 points above an uncorrelated three-surface attack. Fourth, industry prevalence: chloralkali is the most prevalent PSM-regulated Cl₂ industry in the United States and Europe, with more operating PSM facilities than HF alkylation (approximately 50 US refineries with HF units) and phosgene production (approximately 15–20 major US sites). The prevalence premium (wider aggregate AI monitoring attack surface across more facilities) is moderated by the IDLH differential described above; the net calibration is threshold 46. False-positive cost at threshold 46: verify H₂-in-Cl₂ from ABB AO2000 Caldos27 local display or digital output (2–3 minutes); verify Cl₂ header pressure from Rosemount 3051 HART raw digital value (2–3 minutes); verify cell voltage distribution from rectifier control panel local display (5–10 minutes for full module scan). False-negative cost: Graniteville SC 2005 consequence profile (9 killed; 250+ hospitalised; 5,400 evacuated) from an atmospheric Cl₂ release comparable to burst disk failure on an overpressurized chloralkali plant header — combined with H₂+Cl₂ detonation in the same header — the dual-consequence scenario at threshold 46 with no corrective action triggered by the AI monitoring system.