Hydrogen fuel cell heavy truck AI adversarial injection: how ±10 DN in the rendered PEM stack thermal image suppresses a hot-spot precursor to H₂ crossover and thermal runaway — and why SAE J2578 has no adversarial robustness criterion for the FCEV stack monitoring AI layer

How hydrogen fuel cell heavy truck AI works — and where the adversarial injection surface lives

A Class 8 hydrogen fuel cell electric vehicle is a fundamentally different architecture from a battery-electric truck. The propulsion energy chain begins with high-pressure gaseous hydrogen stored in Type IV carbon-fibre-reinforced composite pressure vessels (CPVs) at 350 or 700 bar — the Hyundai XCIENT Fuel Cell Truck uses six 700-bar CPVs totalling approximately 31 kg of H₂; the Nikola Tre FCEV uses a CPV bank sized for 35–80 kg of H₂ depending on the variant. Hydrogen is supplied from the CPVs through a pressure regulator, a shut-off valve assembly, and a fuel recirculation loop to the anode of the proton exchange membrane (PEM) fuel cell stack. The stack — comprising 350–600 individual membrane electrode assembly (MEA) cells in series, each contributing approximately 0.6–0.7 V at rated current — oxidises hydrogen at the anode (H₂ → 2H₊ + 2e⁻) and reduces oxygen from the air compressor at the cathode (O₂ + 4H₊ + 4e⁻ → 2H₂O), generating direct current at 250–400 VDC and a thermal output of approximately 80–160 kW that is rejected through the high-temperature cooling loop (a water/ethylene glycol circuit circulating through bipolar plate cooling channels and the vehicle radiator). The stack electrical output is converted to the HV traction bus (650–900 VDC) through a DC/DC converter and combined with the buffer battery, which provides peak power during acceleration and captures regenerative braking energy.

AI monitoring systems in FCEV heavy truck platforms process rendered images from four primary safety-critical sensor systems: (1) the fuel cell stack thermal camera system, which produces false-colour thermographic images of the stack module exterior capturing temperature distributions across the active area to sub-degree resolution; (2) the CPV pressure and temperature display, rendering real-time tank pressure (bar) and CPV wall temperature (°C) for each CPV in the array on the vehicle health monitoring screen; (3) the cabin and engine compartment H₂ concentration display, rendering measured hydrogen concentration at each sensor location as a percentage of the lower explosive limit (4% H₂ by volume in air = 100% LEL); and (4) the high-voltage interlock and crash detection display, rendering accelerometer deceleration traces from crash sensors and HVIL continuity status. AI classification of these rendered displays provides the automated advisory layer for stack current reduction, emergency hydrogen shutoff valve closure, high-voltage bus contactor opening, and occupant and first responder safety alerts.

The adversarial injection surface is the boundary between each rendered display image and the AI classifier that processes it — the same structural pattern present in every FCEV heavy truck AI safety monitoring context: accurate physical sensors measure the safety-critical parameter (stack temperature, CPV pressure, H₂ concentration, crash deceleration); the measurement is rendered into a 2D visualisation image for display and AI classification; the AI classifier provides the automated safety advisory function and has been validated against clean, unperturbed renders under normal and simulated emergency conditions but has never been evaluated for adversarial robustness at its rendered-image ingestion boundary.

Sandvika Kjørbo, 10 June 2019: the H₂ storage explosion that defines the FCEV AI adversarial injection consequence envelope

The Uno-X Hydrogen refuelling station at Kjørbo in Sandvika, Norway, was one of the busiest hydrogen stations in Scandinavia, serving Toyota Mirai and Hyundai Nexo FCEV passenger cars. At 17:30 on 10 June 2019, the station experienced a catastrophic failure of a high-pressure storage module. The post-incident investigation by NEL Hydrogen (the station equipment manufacturer), the Norwegian Safety Authority, and Sintef identified the root cause as an improper reassembly of a plug that was part of the high-pressure storage assembly following recent maintenance work. The plug had been insufficiently torqued, and under hydrogen pressure loading during station operation, it displaced from its seat and was expelled. The expelled plug was found approximately 200 metres from the station. The released hydrogen — at 700-bar station storage pressure — immediately formed an explosive mixture with the surrounding air and ignited, producing a deflagration-to-detonation transition that generated an overpressure wave propagating from the station.

The documented consequences are as follows. Two Toyota Mirai FCEVs were parked at a traffic intersection approximately 150 metres from the station. The airbag systems in both Mirais deployed from the pressure wave — not from a vehicle impact, but from the external overpressure. One Mirai passenger was hospitalised with a knee injury from the airbag deployment forces. A second person nearby suffered an acute asthma attack from particulate inhalation. No fatalities occurred. Within hours, Uno-X announced the closure of all 14 of its hydrogen stations across Norway. Nel Hydrogen suspended operations of its Norwegian H₂ network. Approximately 20 hydrogen stations in Norway and Denmark suspended operations pending safety reviews of storage assembly maintenance procedures and plug specifications. Toyota Motor Norway suspended Mirai sales and deliveries. Hyundai initiated a recall of all 672 NEXO FCEVs in South Korea — approximately the entire South Korean NEXO fleet at the time — for inspection of their 700-bar CPV assemblies and valve components.

The Sandvika event is significant for the FCEV heavy truck AI adversarial injection threat model for two reasons. First, it establishes with documented evidence the magnitude of the explosion consequence from a single high-pressure hydrogen storage assembly failure at a scale comparable to, but smaller than, the CPV inventory of a Class 8 FCEV heavy truck. The Uno-X Kjørbo station storage module was designed for passenger car fuelling and held a quantity of hydrogen at station pressure. The Hyundai XCIENT Fuel Cell Truck carries 31 kg of hydrogen in six 700-bar CPVs on the vehicle itself; the Nikola Tre FCEV is designed for 35–80 kg. A catastrophic CPV failure on a Class 8 FCEV would release a hydrogen inventory significantly larger than the Sandvika station storage module, into the vehicle's immediate environment and any enclosed space (parking garage, maintenance bay, tunnel) in which the vehicle is operating. Second, the Sandvika event establishes the cascade consequence of a single hydrogen event in a national FCEV fleet: nationwide station closures, fleet recalls, and a multi-year chilling effect on H₂ vehicle adoption in Norway. The adversarial injection threat model — in which AI suppression of early thermal warning at the PEM stack boundary permits thermal runaway to progress to CPV thermal distress — represents a failure mode that could produce Sandvika-scale consequences from an operating Class 8 FCEV rather than a stationary fuelling station.

Four adversarial injection surfaces: PEM stack thermal AI, CPV display AI, cabin H₂ leak AI, and HV interlock crash detection AI

PEM fuel cell stack thermal imaging AI (FLIR A615 stack AI, Cognex thermography AI, Teledyne FLIR stack monitoring AI). The PEM fuel cell stack in a Class 8 FCEV operates at a design temperature of approximately 60–80°C under normal load. Within the stack, individual cells develop temperature non-uniformities of 5–15°C across the active area under normal conditions due to localised variations in membrane hydration, reactant gas distribution, and bipolar plate contact resistance. When a cell group begins developing a thermal hot-spot — from membrane dehydration (increased local proton resistance → elevated Joule heating → positive feedback loop), catalyst degradation (CO poisoning of Pt sites → increased electrode overpotential → localised heat generation), or water management failure (liquid water blocking gas diffusion layer pores in a starvation region) — local cell temperature can rise toward 90–110°C. Above approximately 90°C under dry conditions, the Nafion membrane approaches its glass transition temperature, membrane mechanical stability degrades, and pinhole formation begins. Hydrogen crossover through membrane pinholes brings H₂ into contact with cathode-side O₂ at the platinum catalyst, initiating MEA-level combustion (H₂ + ½O₂ → H₂O, ΔH = −241 kJ/mol at 80°C LHV) that further degrades the membrane in a thermal runaway sequence. The stack thermal camera — producing thermographic image renders of the stack module exterior in real time — is frequently the sole automated early warning layer capable of detecting a developing hot-spot at the spatial resolution and temporal frequency needed to trigger current reduction before membrane perforation. A ±10 DN adversarial downward shift in the pixel region encoding the hot-spot area — reducing the apparent temperature from the alert threshold range to within normal operating bounds — causes the stack thermal AI to classify an overheating stack as thermally normal, suppressing the current reduction or emergency shutdown actions.

High-pressure CPV pressure/temperature display AI (Hexagon Agility CPV monitoring AI, Luxfer Gas Cylinders H₂ sensor AI, Worthington Industries CPV AI). The thermally activated pressure relief device (TPRD) in each 700-bar CPV is designed to actuate when the CPV exterior composite wall temperature reaches approximately 110°C (SAE J2579 requirement), venting the full hydrogen inventory as a controlled vertical-up discharge rather than allowing pressure buildup to the CPV burst pressure (approximately 175% of the 700-bar rated working pressure). The TPRD temperature sensor reading is rendered as part of the CPV safety display — showing CPV pressure (bar), temperature (°C), and pressure decay rate (bar/h, indicating leak rate). AI monitoring of this rendered display classifies CPV status: normal, overheat (temperature above 85°C, indicating possible fire impingement or cooling failure — trigger: initiate immediate TPRD pre-arm and driver alert), and catastrophic overheat (temperature approaching 110°C TPRD actuation threshold). A ±8 DN adversarial shift suppressing the apparent CPV temperature trend — preventing the AI from classifying rising CPV wall temperature as an overheat condition — delays the emergency hydrogen shutoff and driver evacuation advisory. If fire from a parallel event (stack module fire, battery thermal runaway in a parallel vehicle, debris fire in a maintenance bay) impinges on a CPV whose temperature AI has been adversarially suppressed, the TPRD may not be pre-armed and the driver may not be alerted before the TPRD activates or the CPV composite overwrap loses structural integrity. The Sandvika 2019 explosion consequence envelope applies.

Cabin and engine compartment H₂ leak concentration display AI (Figaro TGS 821 AI, NevadaNano MPS H₂ sensor AI, H2Scan HY-OPTIMA AI). Hydrogen is colourless, odourless, and ignites across a 4–75% by volume concentration range in air — the widest explosive range of any common fuel gas. Its minimum ignition energy at stoichiometric composition (29.5% H₂) is approximately 0.017 mJ — 15 times below methane (0.28 mJ) and more than 200 times below gasoline vapour (0.24 mJ). FCEV safety management systems render H₂ concentration at each sensor location (cab, engine compartment, undercarriage zone) as a percentage of LEL. AI classification of these displays operates on the advisory thresholds defined in SAE J2578: 25% LEL (advisory — investigate leak source), 50% LEL (warning — driver evacuation and emergency shutoff), above 50% LEL (automatic emergency shutoff). A ±8 DN adversarial downward shift in the H₂ concentration bar pixel region — suppressing an actual 30% LEL reading to an apparent below-advisory level — prevents the advisory from being generated while H₂ continues to accumulate toward the 4% LFL ignition threshold. At the 0.017 mJ minimum ignition energy, any electrical spark in the cab — a light switch contact, a charging circuit transient, a relay closing — is sufficient to ignite a 4% H₂ mixture. The consequence pathway after ignition in an enclosed cab volume is an internal deflagration with an overpressure proportional to the degree of confinement.

High-voltage interlock and crash detection display AI (Aptiv HVIL AI, TE Connectivity HV interlock AI, Sensata Technologies crash detection AI). The HV DC bus in a Class 8 FCEV operates at 650–900 VDC. SAE J2578 Section 5.2 and FMVSS 305 S5.3 require that following a crash event exceeding the defined severity threshold, the HV bus must be automatically disconnected within 5 seconds, and HVIL continuity must confirm HV bus isolation before first responders touch HV components. AI processing of the rendered crash sensor acceleration display — a 2D graphical render of the deceleration trace at each accelerometer versus time — classifies whether the crash threshold has been exceeded. A ±8 DN adversarial shift suppressing the peak deceleration in the rendered trace from above the crash detection threshold to below it prevents the AI from classifying the event as a crash, suppressing automatic HV contactor opening. A first responder approaching the crashed vehicle receives no “HV SAFE” confirmation from the vehicle monitoring system. Contact with a conductive surface connected to the 650–900 VDC HV bus at approximately 1,000 ohm body resistance delivers 0.65–0.9 A through the body — above the IEC 60479-1 DC fibrillation threshold of approximately 500 mA for exposures exceeding 200 ms. This is a direct lethal consequence of an adversarially suppressed crash detection AI classification.

SAE J2578, FMVSS 303/304/305, and NFPA 2:2023: the qualification framework and its AI boundary

SAE J2578 (Recommended Practice for General Fuel Cell Vehicle Safety, SAE International) is the foundational FCEV safety document that establishes performance requirements for the hydrogen storage system, high-voltage safety system, hydrogen leak detection, and fuel cell stack safety. It is referenced in FMVSS 303 (Fuel System Integrity of Compressed Natural Gas Vehicles, applied to hydrogen FCEVs by regulatory interpretation and proposed rulemaking), FMVSS 304 (Compressed Natural Gas Fuel Container Integrity, applied to Type IV CPV qualification), and FMVSS 305 (Electric Powered Vehicles: Electrolyte Spillage and Electrical Shock Protection). NFPA 2:2023 (Hydrogen Technologies Code) Chapter 11 addresses gaseous hydrogen vehicles and requires H₂ concentration monitoring in occupied spaces, emergency shutdown actuation at defined concentration thresholds, and TPRD installation on all on-vehicle CPVs. UN GTR 13 (Hydrogen and Fuel Cell Vehicles, a United Nations Global Technical Regulation) defines the international standard for FCEV hydrogen system qualification adopted by Japan (JARI), South Korea (KMVSS), the European Union, and other jurisdictions.

These standards share a common structure. They specify sensor performance requirements (the H₂ sensor must detect concentrations above the defined threshold; the crash accelerometer must register the defined deceleration signature), hardware qualification requirements (the CPV must pass burst pressure, pressure cycling, fire exposure, and environmental tests under SAE J2579; the HV contactor must open within 5 seconds of crash detection under FMVSS 305), and system-level safety function requirements (H₂ above 50% LEL must trigger emergency shutoff; HV must be isolated after a crash). None of these standards specify requirements for AI systems that classify the rendered output of the qualified sensors. The physical sensors — thermal camera, pressure transducer, H₂ electrochemical sensor, crash accelerometer — are within the SAE/FMVSS/NFPA qualification scope. The AI classification layer, which processes the 2D rendered visualisation of the sensor output and provides the automated advisory and actuation trigger, is not.

The gap follows the same pattern documented for hydrogen electrolysis UV flame detection AI under NFPA 2 and nuclear power plant digital I&C AI under NRC GDC 13 and IEEE Std 603-2018: the physical instrument is specified and qualified; the AI that classifies the rendered output of that instrument is not within the standard’s scope and has never been evaluated against an adversary in the validation threat model. SAE J2578 Section 4.2 requires that the H₂ concentration monitoring system prevent occupant exposure above 25% LEL — it does not require that the AI classifying the rendered H₂ concentration display be evaluated for adversarial robustness. No revision of SAE J2578 through its most recent edition has addressed adversarial machine learning, and no NHTSA rulemaking under FMVSS 303/304/305 has proposed adversarial robustness requirements for AI safety monitoring systems in FCEVs as of 2026.

PEM membrane dehydration to thermal runaway: the progressive failure pathway that stack thermal AI must intercept

The proton exchange membrane in a PEM fuel cell is typically a Nafion perfluorosulfonic acid ionomer membrane 25–175 micrometres thick. Its proton conductivity — the physical basis for ion transport from anode to cathode — is strongly dependent on hydration state. Well-hydrated Nafion at 80°C achieves a proton conductivity of approximately 0.1 S/cm. At 30% relative humidity, conductivity falls to approximately 0.01–0.02 S/cm — a 5–10 times increase in membrane resistance at the same temperature. Under constant electrical load, higher membrane resistance produces more Joule heating (heat ∝ I²R): a local region of the stack with elevated resistance generates more heat than the surrounding cells, which drives the local temperature above the stack average. Elevated local temperature increases the local evaporation rate, reducing local relative humidity further, which reduces membrane hydration, which increases resistance further. This positive feedback loop — dehydration → elevated resistance → elevated temperature → further dehydration — is the fundamental instability that membrane thermal management systems must prevent.

The first early warning indicator of this failure sequence is the development of a localised thermal hot-spot on the stack exterior, detectable by the stack thermal camera as a region of elevated temperature 5–20°C above the surrounding stack surface. At this stage — with hot-spot temperature in the 85–95°C range — the intervention is simple and effective: reducing the stack current density by 20–30% lowers the Joule heating rate in the affected region, allows the cooling system to recover the temperature, and permits membrane rehydration through continued water generation at the cathode. The fuel cell continues operating at reduced power. No hydrogen release occurs. No CPV involvement.

If the early hot-spot is adversarially suppressed in the thermal camera render — and the AI classification fails to detect and flag the developing overtemperature — the membrane in the affected region continues drying and heating toward the Nafion glass transition range (~120°C). Above approximately 100°C with localised dryout, mechanical creep and chemical degradation begin to produce membrane perforation — pinholes of 1–50 µm diameter at structurally compromised locations. Hydrogen crossover through each pinhole brings H₂ from the anode chamber into direct contact with cathode-side oxygen at the platinum catalyst. The H₂ + ½O₂ → H₂O oxidation reaction at the Pt surface is exothermic (ΔH = −241 kJ/mol), producing additional localised heating precisely at the site of maximum membrane degradation. The crossover combustion rate scales with pinhole area, which increases as MEA degradation proceeds, producing the runaway condition. At this stage — with internal H₂/O₂ combustion in multiple cells — the only intervention is emergency stack shutdown: isolating the H₂ supply manifold, disconnecting the stack from the electrical load, and activating emergency cooling. If the stack shutdown is delayed by adversarially suppressed thermal warning, the thermal runaway can progress to MEA destruction across a significant portion of the stack, generating heat sufficient to challenge the bipolar plate and stack housing thermal limits and potentially igniting the hydrogen supply manifold at the stack inlet.

Glyphward threshold 30 for hydrogen fuel cell heavy truck AI

Glyphward’s adversarial detection API operates as a pre-classification gate at each rendered-image ingestion boundary in the FCEV safety monitoring pipeline: before the stack thermal imaging AI processes the thermographic camera render, before the CPV display AI processes the pressure/temperature trend, before the cabin H₂ concentration AI processes the sensor array display, and before the crash detection AI processes the accelerometer trace render. Each rendered image receives a risk score (0–100) in 8–15 ms. At or above threshold 30, Glyphward gates the AI classification and generates an immediate safety alert to the vehicle safety management system — without waiting for the monitoring AI to produce a potentially adversarially corrupted advisory output.

Threshold 30 for hydrogen fuel cell heavy truck AI contexts reflects three consequence factors and one proportionality comparison. First, the CPV thermal failure consequence. A Type IV 700-bar CPV carrying 6–15 kg of hydrogen represents a stored pressure energy of approximately 50–100 MJ per CPV and a total chemical energy of approximately 700–1,800 MJ per CPV. A catastrophic CPV failure — from fire impingement on a CPV whose AI-monitored temperature display was adversarially suppressed — produces a hydrogen release at a scale that the Sandvika 2019 Kjørbo explosion demonstrated can injure bystanders at 150 metres from the release point and shut down national H₂ infrastructure. Second, the cabin H₂ accumulation consequence. Hydrogen’s 0.017 mJ minimum ignition energy means that cabin H₂ accumulation to 4% LFL (adversarially undetected because the concentration display AI was suppressed) will ignite from any cab electrical event. Third, the HV bus electrocution consequence. 650–900 VDC at a body resistance of 1,000 ohms delivers 0.65–0.9 A through the torso — above the IEC 60479-1 DC cardiac fibrillation threshold — to a first responder touching an unisolated HV component whose crash detection AI suppressed the automated disconnect.

Threshold 30 is 5 points above the threshold 25 applied to nuclear power plant digital I&C AI. The distinction reflects two factors. First, the nuclear domain has the NRC GDC 20–24 single-failure criterion — an explicit regulatory requirement that no individual failure shall prevent the safety function — with no equivalent in SAE J2578. The gap between regulatory intent and AI regulatory coverage is therefore sharpest in the nuclear domain. Second, the nuclear consequence anchors — TMI-2 1979 (50% core damage) and Fukushima Daiichi 2011 (three reactor buildings, multi-decade facility loss) — represent a larger population consequence than a Class 8 FCEV CPV failure, even at the Sandvika consequence scale. Threshold 30 versus threshold 25 is not a determination that FCEV AI adversarial injection is a minor risk — the Sandvika consequence envelope is serious and the first responder electrocution risk is directly lethal — but a calibrated proportionality in the same portfolio scale.

The false positive cost for all four FCEV AI gate triggers is a manual safety check: a manual inspection of the thermal camera raw output, the physical CPV pressure display, the physical H₂ sensor indicator, or the physical crash sensor alarm — all of which continue to display the correct physical measurement regardless of the adversarial state of the rendered AI input image. A false positive threshold-30 gate triggers a manual verification step. A false negative — adversarially suppressed stack thermal AI that misclassifies a developing hot-spot as normal operating temperature — permits the membrane dehydration and crossover pathway to progress toward thermal runaway without automated intervention.

Free tier — 10 scans/day, no card required. Submit a rendered PEM stack thermal camera image from your FCEV monitoring system to the Glyphward scanner to generate a baseline adversarial risk score for your hydrogen fuel cell vehicle AI classification inputs.