Cyclohexane KA-oil liquid-phase air oxidation AI adversarial injection: how ±8 DN in the rendered reactor temperature display suppresses the cyclohexyl hydroperoxide runaway analog — and why OSHA PSM 10,000-lb flammable liquid threshold has no adversarial robustness criterion for KA-oil reactor AI

Cyclohexane KA-oil chemistry: the CyOOH radical chain, per-pass conversion control, and OSHA PSM 10,000-lb flammable liquid threshold

Cyclohexane (C₆H₁₂, molecular weight 84.16 g/mol, boiling point 80.7°C at 1 atm, flash point −18°C closed cup, LEL 1.3 vol%, UEL 8.4 vol%, autoignition temperature 245°C) is the world’s primary industrial precursor to both nylon-6 and nylon-6,6. The cyclohexane KA-oil oxidation process produces cyclohexanone (K, bp 155.7°C, flash point 44°C) and cyclohexanol (A, bp 160.8°C, flash point 68°C) in a molar ratio of approximately 40–60% K to 60–40% A depending on operating conditions and catalyst system; KA oil is then processed via one of two primary downstream routes: Beckmann rearrangement of cyclohexanone oxime (from cyclohexanone + hydroxylamine) to caprolactam (precursor to nylon-6 via ring-opening polymerisation), or nitric acid oxidation of KA oil to adipic acid (HOOC(CH₂)₄COOH, C₆H₁₀O₄, a dicarboxylic acid that reacts with hexamethylenediamine to produce nylon-6,6). Global demand for nylon-6 and nylon-6,6 fibres and resins — in automotive engineering, textile fibres, industrial films, and packaging — drives KA-oil production at major facilities operated by BASF (Antwerp, Belgium), Lanxess (Krefeld, Germany), DSM Fibre Intermediates (Geleen, Netherlands), Invista/Koch Industries (Kingston, Ontario; Orange and Victoria, Texas), DuPont (Orange, Texas), Formosa Chemicals and Fibre Corporation (Tainan, Taiwan), China Shenma Group (Pingdingshan, Henan Province, China), and Ube Industries (Ube, Yamaguchi, Japan).

The KA-oil process reaction mechanism is a radical chain oxidation initiated by thermal homolysis of cyclohexane C–H bonds (bond dissociation energy approximately 400 kJ/mol) or by initiation with added hydroperoxide or cobalt naphthenate catalyst. The uncatalysed (Hubl or SNIA Viscosa) process operates at 155–175°C, 9–12 bar without metal catalyst; the cobalt-catalysed process operates at 145–165°C, 8–10 bar with cobalt (II) naphthenate at approximately 1–5 ppm Co²⁺ in the reactor liquid phase, providing metal-catalysed decomposition of cyclohexyl hydroperoxide (CyOOH) to cyclohexyloxy radical (CyO•) and hydroxyl radical (HO•). The key kinetic intermediate is CyOOH (cyclohexyl hydroperoxide, C₆H₁₁OOH, MW 116.16 g/mol): formed by H-abstraction from cyclohexane by HO₆• or ROO•, CyOOH accumulates in the reactor liquid to steady-state concentrations of approximately 200–500 ppm by mass and decomposes via homolysis of the O–O bond (activation energy approximately 125 kJ/mol) to CyO• and HO•, which in turn abstract H from cyclohexane to propagate the chain. The KA products form from CyO• via two competing pathways: cyclohexanone (by H-abstraction from C–H adjacent to the oxy radical, β-scission) and cyclohexanol (by H-abstraction from solvent). A third pathway — β-scission of CyO• to ε-caprolactone and further oxidation — produces ring-opening over-oxidation products at elevated temperatures and conversion.

The thermal stability of CyOOH is the primary thermal runaway concern in KA-oil reactor design. CyOOH O–O bond homolysis obeys the Arrhenius relation with activation energy approximately 125 kJ/mol; the rate constant at 165°C (438 K) is approximately 1.2 × 10⁻² s⁻¹ (half-life approximately 80 minutes at steady-state concentration in the liquid phase), providing a manageable steady-state CyOOH balance between formation from chain initiation/propagation and decomposition to KA products. At 200°C (473 K), the decomposition rate constant increases approximately 8× (to approximately 9.6 × 10⁻² s⁻¹), and the steady-state CyOOH concentration rises because decomposition outpaces the rate at which radicals consume cyclohexane — a counterintuitive Arrhenius crossover effect. At 218°C (491 K), the rate constant increases to approximately 1.8 × 10⁻¹ s⁻¹: the CyOOH decomposition is now rapid enough that the heat released from O–O homolysis (approximately 148 kJ/mol CyOOH) exceeds the reactor’s specific heat removal capacity per unit volume, and reactor temperature begins to rise without external driving force — the onset of autocatalytic thermal runaway. At 218°C in a commercial KA-oil reactor with a liquid heat capacity of approximately 1,900 J/(kg·K) and CyOOH at 400 ppm concentration, the adiabatic temperature rise from CyOOH decomposition alone is approximately 0.5°C — small in isolation. But the elevated temperature simultaneously accelerates the propagation of the radical chain in the bulk cyclohexane liquid, increasing the overall oxidation rate by the Arrhenius factor of approximately 1.8× per 10°C temperature rise at these activation energies: the compounded effect is a net reactor temperature rise of approximately 8–12°C/min in the absence of emergency cooling intervention.

OSHA PSM 29 CFR 1910.119 coverage of cyclohexane KA-oil plants operates through section (a)(1)(ii) of the standard: PSM applies to any process involving a flammable liquid or gas (as defined in 29 CFR 1910.1200(c)) at or above 10,000 lbs (4,536 kg) in a single location, excluding hydrocarbon fuels used solely as workplace fuel and not part of a highly hazardous chemical process. Cyclohexane’s flash point of −18°C (closed cup) classifies it as a GHS Category 1 flammable liquid under 29 CFR 1910.1200 — the most flammable category, requiring flash point below 23°C. Commercial KA-oil reactor cascades maintain approximately 50–150 tonnes of cyclohexane inventory in the reactor vessels alone, plus additional inventory in the cyclohexane feed storage and the product separation distillation train — collectively ranging from approximately 100–300 tonnes of cyclohexane on-site. The Nypro UK Flixborough plant carried approximately 120 tonnes (264,000 lbs) of cyclohexane in process, 26 times the OSHA PSM 10,000-lb (22,000 lbs is 10,000 lb threshold) — deeply covered by the 10,000-lb flammable inventory PSM trigger. PSM element (d) requires all KA-oil facilities to document the maximum intended cyclohexane inventory, the design operating temperature and pressure range, the design per-pass conversion range, the maximum CyOOH concentration at steady state, and the emergency cooling system design capacity. PSM element (e) PHA must cover reactor temperature excursion, loss of cooling, elevated per-pass conversion, and catastrophic cyclohexane release — the Flixborough failure modes — as HAZOP nodes. These regulatory requirements do not address the adversarial robustness of AI systems now classifying rendered DCS display images of reactor temperature, per-pass conversion, and emergency cooling water flow in real time at the process monitoring boundary that PSM element (e) identifies as the primary safeguard against Flixborough-type consequence trajectories.

Flixborough, 1 June 1974: the Nypro UK bypass pipe failure and the KA-oil consequence anchor

The Nypro UK Ltd cyclohexane KA-oil plant at Flixborough, North Lincolnshire, England, was a joint venture between Dutch State Mines (DSM, 55% ownership) and Fisons plc and SCBA (45% combined ownership), producing approximately 70,000 tonnes per year of caprolactam — the nylon-6 precursor — from cyclohexane via the KA-oil intermediate route. The cyclohexane oxidation section comprised six reactors in series — each a large vessel approximately 4.5 metres diameter and 3.5 metres height — operating in cascade at approximately 155°C, 8.8 bar, with a total cyclohexane inventory of approximately 120 tonnes distributed across the reactors, the connecting pipework, and the adjacent cyclohexane surge vessel. Air was sparged into the reactor liquid by a distributed sparger system; reactor temperature was maintained by internal cooling coils circulating cooling water at approximately 35–45°C.

In March 1974, during a routine inspection, a crack was discovered in the 28-inch (711 mm) diameter bellows joint on reactor 5 — a flexible pressure-rated connector that accommodated thermal expansion between the fixed reactor structure and the connecting piping. The crack extended through the wall of the bellows. The decision was made to isolate reactor 5 and install a temporary bypass pipe directly connecting the outlet nozzle of reactor 4 to the inlet nozzle of reactor 6, allowing the plant to continue operating at reduced throughput with four active reactors while reactor 5 underwent bellows repair. The temporary bypass was designed and constructed over approximately one week by plant maintenance fitters, without involvement of a qualified mechanical engineer in the structural design review. The bypass pipe was 20-inch (508 mm) nominal diameter — 8 inches smaller than the 28-inch reactor nozzles it connected — and was supported by a temporary scaffolding structure with two bellows joints at the reactor connection points. The engineering deficiencies subsequently identified in the Parker Inquiry report (January 1975) were fundamental: the bypass pipe’s two bellows joints were connected at different heights than the original 28-inch nozzles (the reactor nozzles were at different elevations), creating a “dog-leg” arrangement that imposed torsional and bending moments on the bellows joints during operation; the bellows joints used were rated for axial compression and extension movement, not torsional rotation; no formal stress calculation was performed to verify the bypass pipe assembly could withstand operating temperature, pressure, and imposed moments. No engineer on site held a Certificate of Competence under the Factories Act 1961 for pressure vessels at the time the bypass was installed.

The bypass pipe operated from March to June 1974 — approximately three months. On Saturday 1 June 1974 at approximately 4:53 pm (GMT), the bypass pipe failed catastrophically. The failure mechanism, reconstructed in the Parker Inquiry from post-explosion wreckage analysis and from metallurgical examination of bellows fragments, was bellows collapse under the combined effect of operating pressure (approximately 8.8 bar gauge) and the torsional/bending moments imposed by the misaligned “dog-leg” geometry: the bellows at the reactor 4 end collapsed inward, opening a large-area breach in the cyclohexane pressure boundary at the operating temperature of 155°C. Cyclohexane at 155°C and 8.8 bar above atmospheric flash-evaporates dramatically on pressure reduction to atmospheric: the flash fraction — the proportion of liquid cyclohexane that vaporises in the pressure drop from 8.8 bar to 1 bar absolute — is approximately 38–43% by mass, producing a dense, low-momentum cyclohexane vapour-aerosol cloud at near-ground level. The remainder of the liquid cyclohexane rained out as a pool on the ground and vaporised at the pool surface. Approximately 30 tonnes of cyclohexane were released in the immediate aftermath of the bellows failure from reactors 4 and 6 and the interconnecting pipework; additional cyclohexane continued to discharge from the broken pressure boundary for some minutes. The cyclohexane cloud drifted in the prevailing light south-westerly wind over the site at approximately ground level, encountering multiple potential ignition sources.

Approximately 45 seconds to one minute after the initial release — based on witness accounts of the time between hearing a “rushing” sound (the initial release) and the explosion — the cyclohexane cloud ignited. The ignition source was not definitively identified in the Parker Inquiry; candidate sources included the instrument workshop, the hydrogen reformer (producing hydrogen for the caprolactam reduction step), plant furnaces, and electrical sparking. The deflagration of the cyclohexane-air cloud produced a blast wave with explosion energy estimated at approximately 15–16 tonnes of TNT equivalent, based on site structural damage analysis and ACMH (Advisory Committee on Major Hazards) post-accident investigation. The control room, located approximately 50 metres from the bypass pipe, suffered near-total structural collapse: the majority of the 28 fatalities occurred in the control room and in the adjacent offices where Saturday maintenance and supervision staff were working. The 1 June 1974 site crew — a Saturday skeleton staff — had approximately 30 people on site at the time of the explosion; 28 were killed. Thirty-six workers were injured on site. Fifty-three additional injuries were recorded in the surrounding community, predominantly from glass and debris. Structural damage to 1,821 houses within the communities of Flixborough, Amcotts, Althorpe, and Keadby extended up to approximately 1–1.5 kilometres from the site; 167 shops and commercial buildings were damaged; several farms and agricultural buildings within 3 kilometres suffered significant damage. Total estimated damage was approximately £36 million in 1974 prices (equivalent to approximately £400–500 million at 2026 values). The Flixborough explosion remains the UK’s largest peacetime industrial explosion in terms of explosion energy and on-site fatalities, and it is among the largest vapour cloud explosions (VCE) in chemical process history globally — exceeded in TNT equivalent only by Port Neal Iowa (1994, Koch Nitrogen, approximately 32 tonnes TNT) and Texas City (2005, BP, approximately 7 tonnes TNT from the raffinate splitter) in the post-1960 US/European petrochemical record.

The regulatory consequence of Flixborough was the formation of the UK Health and Safety Executive (HSE) and the Advisory Committee on Major Hazards (ACMH), whose three reports (1976, 1979, 1983) formed the basis for the Control of Industrial Major Accident Hazards (CIMAH) Regulations 1984 — the UK’s first mandatory safety report regime for major hazard sites. CIMAH was superseded by the Control of Major Accident Hazards (COMAH) Regulations 1999 and revised as COMAH 2015, implementing the EU Seveso III Directive 2012/18/EU. The direct causal sequence at Nypro UK — inadequate engineering oversight of a pressure boundary modification — led to the PSM Management of Change element (PSM element (l) in OSHA 1910.119; and COMAH Safety Report change management requirements) that is now a universal requirement at major hazard facilities. In 2026, the KA-oil reactor monitoring adversarial injection scenario is a different failure mode from the Nypro UK bypass pipe mechanical failure — but the consequence trajectory is analogous: an undetected deviation from safe operating parameters in the KA-oil reactor cascade progresses to cyclohexane release and ignition. At Nypro UK, the deviation was a structurally inadequate pipe modification. In the adversarial injection scenario, the deviation is a thermal runaway at 218°C and 13.7% conversion that is invisible to the AI monitoring layer because all three relevant DCS displays — temperature, conversion, emergency cooling — have been adversarially perturbed to appear within normal operating range.

Three adversarial injection surfaces in cyclohexane KA-oil reactor monitoring AI

1. Reactor #4 bed temperature display AI (Honeywell Experion PKS KA-oil reactor monitoring AI, Yokogawa OpreX cyclohexane oxidation AI — rendered DCS temperature trend AI classifying reactor temperature against runaway alarm structure)

The cyclohexane KA-oil oxidation reactor temperature display AI processes a rendered DCS temperature trend display image for the reactor bed temperature — typically an array of Type K or Type J thermocouples at multiple elevations in the reactor liquid phase, with the mid-reactor liquid temperature used as the primary process control variable. The temperature display is calibrated on a 100–250°C range (200 pixels, 1.33 px/°C), capturing the full range from reactor cold-start temperatures to the safe operating upper limit at approximately 180°C and the emergency shutdown setpoint at approximately 185–190°C. High-temperature alarm setpoints are typically 175°C (high-temperature alarm — investigate cooling system, reduce air flow), 185°C (high-high alarm — initiate emergency cooling injection), and 195°C (emergency shutdown setpoint — automatic trip of air feed and emergency quench). The design setpoint is typically 160–168°C for the uncatalysed process and 150–160°C for the cobalt-catalysed process.

The adversarial injection scenario for surface 1: Reactor #4 in the 5-reactor KA-oil cascade. The reactor has been operating for 14 days since the last planned maintenance cycle; the cooling water coil inspection indicated minor fouling (approximately 15–20% reduction in heat transfer coefficient from carbonate scale deposition). The reactor air feed flow increased 18–22% above design setpoint approximately 6 hours ago during a temporary increase in production throughput (partially driven by a downstream caprolactam conversion backlog). The combination of reduced cooling efficiency and elevated air feed has been raising reactor temperature over the previous 4 hours. Actual reactor #4 bed temperature: 218°C — 50°C above the 168°C design setpoint, 23°C above the emergency shutdown setpoint of 195°C, in the autocatalytic CyOOH decomposition regime where temperature is rising at approximately 10°C/min without emergency cooling intervention. On the 100–250°C DCS display (200 pixels, 1.33 px/°C), 218°C renders at (218–100) / 150 × 200 = 157 px from the bottom of the display range. The ±8 DN downward adversarial perturbation applied to the pixel region encoding the reactor temperature thermocouple trend trace shifts the apparent trace position from 157 px to approximately 84 px from the bottom of the display — a displacement of 73 px — producing an apparent temperature reading of (84/200) × 150 + 100 = 163°C. The KA-oil reactor AI classifies the reactor temperature as 163°C: 5°C below the 168°C design setpoint, 12°C below the 175°C high-temperature alarm, well within the normal operating window. The AI does not trigger the high-temperature alarm; no emergency cooling injection is initiated; no air feed reduction is ordered; no emergency shutdown signal is generated. The actual 218°C reactor temperature — 23°C above the automatic emergency shutdown setpoint — continues to generate CyOOH autocatalytic runaway at 10°C/min, with reactor pressure rising from liquid thermal expansion and dissolved CO₂ generation from over-oxidation, approaching the reactor MAWP of approximately 14 bar and the safety valve setpoint.

The surface 1 reactor temperature suppression attack is structurally analogous to the reactor temperature attacks in the MIC storage AI scenario (surface 1: 28°C refrigeration failure shown as 2°C) and the phosgene reactor AI scenario (162°C Cl₂ slip onset shown as 68°C): in each case, the reactor temperature display AI is the primary early-warning signal for the most dangerous kinetic condition in the process (CyOOH autocatalytic runaway for KA-oil, MIC water reaction exotherm for MIC storage, activated carbon deactivation for phosgene synthesis), and the adversarial downward shift on the temperature display eliminates the operator’s primary kinetic state indicator at the point when emergency action is most urgently required. The phosgene reactor temperature adversarial injection scenario — 162°C activated carbon deactivation displayed as 68°C — documents the same downward temperature suppression mechanism at a different PSM TQ tier (COCl₂ TQ 10 lbs vs cyclohexane 10,000-lb flammable threshold).

2. Per-pass conversion GC analyser display AI (±8 DN downward shift — 13.7% over-oxidation conversion suppressed to appear 5.4% on-target)

The per-pass conversion analyser in the cyclohexane KA-oil reactor cascade is a critical process control instrument: the GC (gas chromatograph) or NIR (near-infrared) analyser samples the combined reactor effluent stream at the cascade outlet, measures cyclohexane, cyclohexanone, cyclohexanol, and over-oxidation products (adipic acid, glutaric acid, succinic acid, formic acid) by concentration, and computes the per-pass conversion as (cyclohexane consumed / cyclohexane fed) × 100%. The GC cycle time is typically 3–8 minutes (NIR is faster, approximately 30 seconds), with the current conversion value displayed as a trend on the DCS operations console. Normal operating range: 4–8% per-pass conversion. High-conversion alarm setpoints: 9% (investigate air flow ratio, check reactor temperatures, reduce throughput if necessary) and 11% (KA selectivity significantly degraded, deep-oxidation exotherm rising; reduce air feed flow immediately, initiate conversion reduction protocol). Emergency setpoint: 13% (deep-oxidation exotherm at approximately 3× design cooling load; emergency air trip initiated by DCS if automated, or immediate operator manual trip).

The adversarial injection scenario for surface 2: the elevated air feed flow that has been driving reactor #4 to 218°C (surface 1 scenario) has also increased total reactor cascade conversion from the design center of 6% to 13.7%. At 13.7% conversion, the deep-oxidation product distribution has shifted significantly: approximately 25% of converted cyclohexane is forming over-oxidation products (adipic acid, glutaric acid, succinic acid) instead of KA oil, contributing an additional exotherm of approximately 3,000–3,500 kJ/kg over-oxidation products — a total exothermic load on the reactor cascade of approximately 4× the design cooling load at 5–7% conversion with full KA selectivity. The actual 13.7% conversion renders on the 0–20% DCS conversion display (200 pixels, 10 px/%) at (13.7/20) × 200 = 137 px from the bottom. The ±8 DN downward adversarial shift moves the apparent analyser reading from 137 px to approximately 54 px from the bottom, corresponding to (54/200) × 20 = 5.4% conversion. The KA-oil reactor AI classifies the per-pass conversion as 5.4% — within the 4–8% optimal range, indicating full KA selectivity and design exotherm load. No conversion alarm is triggered; no air feed reduction is initiated; no emergency conversion reduction protocol is activated. The actual 13.7% conversion continues to contribute the additional over-oxidation exotherm that compounds the surface 1 thermal runaway: the elevated conversion means that even if the surface 1 reactor temperature attack were detected and emergency cooling initiated, the cooling demand — at 4× design load — would exceed the emergency cooling capacity without simultaneous reduction of the air feed flow. The surface 2 downward attack thus prevents the operator from knowing that emergency cooling alone — at the displayed 22.8 m³/h flow (surface 3) — would be insufficient for the compound thermal load.

The over-oxidation exotherm compound is particularly relevant to the Flixborough analog: the reactor temperature runaway at Nypro UK was not specifically documented as involving elevated per-pass conversion, since the bypass pipe failure preceded any documented process upset in reactor kinetics. However, a thermal runaway in the KA-oil reactor cascade driven by elevated conversion is well-documented in process safety literature as one of the two primary runaway mechanisms (the other being loss of cooling without conversion change). The compound of surface 1 (temperature runaway) and surface 2 (elevated conversion exotherm) in the adversarial scenario is more severe than either individually: the combined effect prevents both temperature-based intervention (cooling injection) and conversion-based intervention (air feed reduction) from being initiated, because both display readings appear within-normal to the AI monitoring layer.

3. Emergency cooling water injection flow display AI (±8 DN upward shift — 4.1 m³/h cooling-starved flow displayed as 22.8 m³/h adequate — 101st upward-direction attack in the Glyphward portfolio)

The cyclohexane KA-oil oxidation reactor emergency cooling water injection system is a dedicated high-pressure cooling water supply, separate from the normal reactor cooling coil circuit, designed specifically for thermal runaway arrest: emergency cooling water is injected directly into the reactor liquid phase (and in some designs into the air sparger line) at high flow rates to rapidly reduce reactor temperature below the CyOOH autocatalytic decomposition threshold. Normal reactor cooling operates through the internal cooling coils at continuous flow rates of 40–80 m³/h; the emergency cooling injection system provides an additional burst of cooling capacity of 20–35 m³/h at full opening. The emergency cooling water injection flow display AI processes a rendered DCS flow indicator display for the emergency cooling water injection flow rate — typically a turbine flowmeter or magnetic flowmeter on the emergency cooling supply header, with a display range of 0–40 m³/h (200 pixels, 5 px/(m³/h)). Normal standby condition: 0 m³/h (valve closed); emergency activation target: 20–35 m³/h (full opening); low-flow alarm during emergency operation: 10 m³/h (insufficient cooling for runaway arrest at most kinetic states).

The adversarial injection scenario for surface 3: the emergency cooling water injection system at reactor #4 was partially activated approximately 90 minutes ago by an automated DCS low-priority alarm (a lower-temperature high-temperature alert at 169°C — which the surface 1 adversarial attack on the temperature display subsequently suppressed from the AI view). The emergency cooling supply valve at reactor #4 opened to approximately 18–20% of full stroke — partially opened because the DCS temperature reading (at that moment showing 172°C, before the adversarial perturbation was applied at the current 218°C condition) generated only a low-priority alarm. At 18–20% valve opening, the emergency cooling flow is approximately 4.1 m³/h — well below the full design flow of 25 m³/h and below the 10 m³/h minimum effective flow for runaway arrest. On the 0–40 m³/h display (200 pixels, 5 px/(m³/h)), the actual 4.1 m³/h renders at (4.1/40) × 200 = 20.5 px from the bottom of the display. The ±8 DN upward adversarial shift moves the apparent flow indicator from 20.5 px to approximately 114 px from the bottom, corresponding to (114/200) × 40 = 22.8 m³/h. The KA-oil reactor AI classifies the emergency cooling injection flow as 22.8 m³/h — above the 20 m³/h minimum for effective runaway arrest, appearing as adequate emergency cooling in operation. No additional cooling action is initiated; no request to fully open the emergency cooling valve is generated; no supplemental cooling pathway (cooling tower emergency bypass, fire water system connection to cooling header) is considered. The actual 4.1 m³/h provides approximately 4.1 × 1,000 × 4.18 × (45–20) = 1.5 MW of heat removal at a 25°C cooling water temperature rise across the injection (inlet 20°C, exit 45°C) — against a thermal runaway heat generation rate at 218°C and 13.7% conversion of approximately 12 MW, a factor of 8× shortfall between actual cooling provision and runaway arrest demand. Displayed as 22.8 m³/h, the same cooling water supply appears to provide approximately 8.4 MW — still below the 12 MW demand at the actual kinetic state, but above the 20 m³/h minimum alarm setpoint: the AI sees no emergency cooling insufficiency alert.

The upward-direction emergency cooling water flow attack is the 101st upward-direction adversarial attack in the Glyphward industrial AI portfolio — the first targeting emergency cooling water injection flow specifically in a liquid-phase oxidation reactor context. Structurally, it is analogous to previous upward attacks on protective-resource parameters: HF alkylation acid strength (81.4 wt% degraded shown as 87.8 wt% adequate), VCM autoclave jacket cooling water flow (8 m³/h shown as 14 m³/h adequate), urea passivation O₂ injection (0.18 vol% deficient shown as 0.44 vol% adequate), and MIC N₂ blanket supply (1.4 psig failing shown as 8.2 psig adequate). In each case, the adversarial upward shift targets a parameter where HIGHER FLOW/CONCENTRATION = MORE PROTECTIVE, making a deficiency in the protective resource appear as adequate provision. For KA-oil emergency cooling injection: a displayed flow of 22.8 m³/h suggests the reactor has emergency cooling coverage at approximately 90% of the 25 m³/h design emergency flow — an operator would not initiate additional cooling actions with 22.8 m³/h displayed. The actual 4.1 m³/h — 16.4% of design emergency flow — would immediately prompt full valve opening and investigation of supply header pressure if correctly displayed. The VCM suspension PVC autoclave jacket cooling water flow upward attack is structurally the closest precedent: 8 m³/h deficient cooling flow displayed as 14 m³/h adequate in the autoclave temperature runaway scenario, analogous to 4.1 m³/h emergency cooling shown as 22.8 m³/h at the KA-oil runaway boundary.

The compound of surfaces 1, 2, and 3 creates a particularly effective thermal runaway concealment: surface 1 (temperature displayed as 163°C) and surface 3 (emergency cooling displayed as 22.8 m³/h) together create a self-consistent false picture — at a displayed temperature of 163°C (within-normal), 22.8 m³/h of emergency cooling is not only unnecessary but appears as over-provision of cooling capacity. Surface 2 (conversion displayed as 5.4%) is consistent with the false temperature picture: at 163°C, a 5.4% per-pass conversion implies a KA selectivity of approximately 88% and a reactor heat load of approximately 3 MW — well within the normal cooling coil capacity of 5–7 MW at design flow. The three-surface compound creates an entirely self-consistent false operating picture: a reactor running at 163°C (5°C below setpoint), 5.4% conversion (within design target), with 22.8 m³/h emergency cooling flow (above effective minimum) — an AI-assessed nominal operation state while the actual condition is 218°C (23°C above auto-shutdown setpoint), 13.7% conversion (4× design exotherm), and 4.1 m³/h emergency cooling (8× below arrest demand).

OSHA PSM 29 CFR 1910.119, UK COMAH Regulations 2015, API RP 505, and the adversarial robustness gap for cyclohexane KA-oil reactor AI

OSHA PSM 29 CFR 1910.119 coverage of cyclohexane KA-oil facilities operates through the 10,000-lb (4,536 kg) flammable liquid inventory provision (section (a)(1)(ii)) rather than through a specific named HHC TQ in Appendix A. This regulatory entry point — the 10,000-lb flammable inventory trigger — is the most common PSM coverage mechanism for large-volume flammable process hydrocarbons (cyclohexane, styrene, ethylbenzene, cyclohexanone/cyclohexanol): it covers the Flixborough-scale inventory (120 tonnes, 26× the 10,000-lb threshold) and any facility with a few dozen tonnes of flammable liquid in the process. PSM element (d) (Process Safety Information) requires documentation of cyclohexane properties (flash point, LEL, UEL, autoignition temperature, vapour pressure/temperature relationship above the design operating temperature), reactor design temperature, pressure, and maximum allowable working pressure, emergency cooling system design basis and capacity, per-pass conversion safe operating limits, and CyOOH accumulation rate models. PSM element (e) (Process Hazard Analysis) requires PHA–HAZOP studies of: reactor temperature excursion above high-high setpoint with cooling loss (the surface 1 + surface 3 compound adversarial scenario); elevated per-pass conversion above 10% driving over-oxidation exotherm above cooling capacity (the surface 2 compound adversarial scenario); catastrophic release of cyclohexane from a reactor pressure boundary failure (the Flixborough bypass pipe failure mode and the thermal runaway approach to MAWP). These PHA requirements identify AI-monitored DCS displays for reactor temperature, per-pass conversion, and emergency cooling water flow as the primary safeguards against the Flixborough consequence trajectory. PSM element (e) does not specify adversarial robustness requirements for the AI systems classifying these displays.

PSM element (j) (Mechanical Integrity) requires inspection and testing of reactor pressure vessels, cooling coils, emergency cooling supply valves, flow meters, and temperature sensors — the Flixborough lesson directly applied to pressure boundary integrity. Had MOC (PSM element (l)) applied at Nypro UK in 1974, the temporary bypass pipe installation would have required a qualified mechanical engineer’s structural review and a formal pressure boundary calculation — the deficiency that was the root cause of the bypass pipe failure. PSM element (l) MOC requires review of process changes, but does not extend to adversarial robustness testing when AI monitoring systems are deployed or updated. PSM element (o) Emergency Planning and Response requires emergency response plans for cyclohexane releases — but those plans depend on the monitoring systems providing accurate detection of the thermal runaway that precedes the release, which the three-surface adversarial attack compromises simultaneously at all three primary monitoring points.

UK COMAH Regulations 2015 (SI 2015/483), transposing EU Seveso III Directive 2012/18/EU, applies to major hazard establishments in Great Britain handling flammable substances at or above the Seveso III Annex I thresholds. For cyclohexane and other Category Flammable liquids/gases (Category 2 in Seveso III Annex I), the lower-tier threshold is 5,000 tonnes and the upper-tier threshold is 50,000 tonnes at the site. Most commercial KA-oil facilities in the UK and Europe hold cyclohexane inventories well below 5,000 tonnes at any single site (a typical facility may have 200–500 tonnes in process and storage combined), which places them below the COMAH lower-tier threshold for cyclohexane alone. However, KA-oil facilities also hold inventories of cyclohexanone (flash point 44°C, Category 3 flammable) and caprolactam precursors, and may aggregate to COMAH coverage via the ‘sum of fractions’ approach for multiple dangerous substances at quantities below individual thresholds. The Nypro UK Flixborough site, operating with 120 tonnes of cyclohexane in process plus additional storage, would be below the 5,000-tonne lower-tier COMAH threshold for cyclohexane in modern Seveso III terms but would typically be covered by COMAH via the aggregation clause if other hazardous substances are present. COMAH Safety Reports at KA-oil facilities that are COMAH-covered must document cyclohexane vapour cloud explosion (VCE) as a major accident scenario, identify the process monitoring systems (reactor temperature, per-pass conversion, emergency cooling) as primary risk reduction measures, and verify their functionality through regular inspection and testing. COMAH Safety Reports do not specify adversarial robustness requirements for the AI display classification systems monitoring those parameters.

API Recommended Practice 505 (“Recommended Practice for Prevention of Fires and Explosions in Refineries and Petrochemical Plants from Flammable or Combustible Liquid or Gaseous Spills”, 2002) provides guidance on vapour cloud explosion prevention, flammable material release minimisation, and process monitoring requirements for refinery and petrochemical processes handling large inventories of flammable hydrocarbons. API RP 505 Chapter 6 (Process Unit Monitoring and Control) addresses monitoring instrumentation for temperature, pressure, and flow in flammable liquid-phase processes — directly applicable to KA-oil reactor monitoring — and identifies DCS-based monitoring displays as the primary operator interface for detecting deviations that could lead to flammable liquid or vapour release. API RP 505 does not specify adversarial robustness requirements for AI systems classifying rendered DCS monitoring display images at the KA-oil reactor monitoring boundary. The regulatory gap for cyclohexane KA-oil reactor AI across OSHA PSM (US), COMAH 2015 (UK/EU), and API RP 505 (international) is structurally consistent with the pattern documented across the Glyphward industrial AI portfolio: regulatory frameworks identify AI-monitored DCS displays as primary safeguards against the documented major accident scenarios (Flixborough VCE, MIC storage Bhopal-type release, phosgene production delayed-pulmonary-oedema fatality), but no regulatory framework — existing or pending — specifies adversarial robustness requirements for the AI display classification systems that are the real-time interpretation layer at those monitored boundaries.

Glyphward threshold 42 for cyclohexane KA-oil reactor AI

Glyphward’s adversarial detection API operates as a pre-classification gate at each rendered-image ingestion boundary in the cyclohexane KA-oil reactor AI pipeline: before the reactor temperature display AI processes each rendered DCS temperature trend image, before the per-pass conversion GC analyser AI processes each rendered conversion trend image, and before the emergency cooling water injection flow display AI processes each rendered flow indicator image. Each rendered display image receives a Glyphward risk score (0–100) in 8–15 ms. At or above threshold 42, Glyphward gates the AI classification and generates an alert triggering manual verification against the underlying DCS process historian data — the raw thermocouple transmitter output, GC raw chromatogram data, and magnetic flowmeter raw signal stored as engineering-unit time series that are not accessible to the pixel-level adversarial perturbation applied to the rendered display images.

Threshold 42 for cyclohexane KA-oil reactor AI reflects three factors. First, consequence magnitude: the Flixborough 1974 anchor — 28 killed, 16 tonnes TNT equivalent, 1,821 houses damaged — is the largest peacetime industrial explosion consequence in the Glyphward portfolio from a single-facility on-site fatality count. The Flixborough consequence envelope exceeds the Glyphward portfolio’s next-largest flammable VCE anchor — the LG Polymers Visakhapatnam 2020 styrene monomer release (12 killed, threshold 35) — by a factor of 2.3× in on-site fatalities, and it compares in community impact radius with the Port Neal Iowa 1994 urea synthesis explosion (4 killed, 18 injured at the site; threshold 30 for the urea AI silent-corrosion attack, not the explosion scenario directly). Threshold 42 places cyclohexane KA-oil reactor AI above the OSHA PSM flammable-TQ-tier portfolio average (styrene AI at 35, HDPE Unipol AI at 30) while remaining below the super-toxic release AI tier (MIC storage at 35 — calibrated to Bhopal mortality, not Flixborough).

Second, the three-surface compound attack creates a compounding thermal runaway trajectory: surface 1 (temperature runaway) and surface 2 (over-conversion exotherm) interact causally to produce a cooling demand at 218°C and 13.7% conversion that exceeds the designed emergency cooling system capacity, while surface 3 (emergency cooling flow upward attack) eliminates the operator’s awareness that cooling is inadequate. The cross-surface thermal interaction means that detecting only one surface — for example, detecting the surface 1 temperature suppression but not the surface 2 conversion suppression — would still leave the operator with an incomplete picture: even knowing the actual temperature is 218°C, without knowing the actual conversion is 13.7% (and thus the cooling demand is 4× design), the operator cannot make an accurate emergency response decision about cooling water flow adequacy. Glyphward threshold 42 detects all three surfaces from pixel-level adversarial signatures, generating three independent alerts at surfaces 1, 2, and 3 that collectively expose the three-surface compound attack on the first alert cycle.

Third, the milestone context: surface 3 — the emergency cooling water injection flow upward attack — is the 101st upward-direction adversarial surface attack in the Glyphward industrial AI portfolio, reaching the 101st upward attack milestone across the KA-oil, MIC storage, phosgene, HF alkylation, VCM, formaldehyde, H₂SO₄, CH₃SH, urea, TDI phosgenation, acrolein, 1,3-butadiene, dimethyl sulfate, and all predecessor industrial process AI contexts in the portfolio. The upward-direction attack pattern — protective-resource parameters adversarially shifted upward to make deficiency appear as adequate provision — is now documented across 101 distinct industrial process AI attack surfaces in the Glyphward adversarial database, spanning OSHA PSM Appendix A toxic chemicals at TQs from 10 lbs (phosgene) to 15,000 lbs (cyclohexane via flammable TQ), across petrochemical, mining, water treatment, nuclear, aviation, maritime, and healthcare AI contexts. The false positive cost at threshold 42 for KA-oil reactor AI: 2–4 minutes to verify the reactor temperature from the DCS historian raw thermocouple record, 3–6 minutes to obtain a fresh per-pass conversion GC cycle result or NIR on-line verification against the raw chromatogram, and 1–2 minutes to verify the emergency cooling water injection flow from the flow transmitter raw signal. False negative cost: cyclohexane KA-oil thermal runaway at 218°C and 13.7% conversion with 4.1 m³/h emergency cooling — progressing undetected at 10°C/min toward MAWP, reactor pressure boundary approach, and the Flixborough consequence trajectory.

Free tier — 10 scans/day, no card required. Submit a rendered cyclohexane KA-oil reactor temperature DCS display, per-pass conversion GC analyser display, or emergency cooling water injection flow indicator from your KA-oil facility to the Glyphward scanner to generate a baseline adversarial risk score for your KA-oil reactor AI inputs.