What exactly failed at Texas City BP refinery on 23 March 2005 — and how does the 2005 instrument failure map to a 2026 APC AI adversarial injection?

The Texas City BP refinery explosion of 23 March 2005 killed 15 workers and injured 180 others in what the U.S. Chemical Safety and Hazard Investigation Board (CSB) called the deadliest US workplace disaster in over a decade. The CSB investigation report (2005-04-I-TX, released October 2007) identified the proximate cause as overfilling of the ISOM (isomerization) unit raffinate splitter tower during a startup sequence. The raffinate splitter is a distillation column that separates light raffinate (C5-C7 naphtha fraction) from heavy raffinate; during the startup sequence on the morning of 23 March 2005, operators were following a manual startup procedure that required adding feed to the column while gradually increasing reboiler duty to establish vapour-liquid separation. The column level monitoring relied on a sight-glass level gauge (LI-7710) on the reboiler sump and a differential pressure level transmitter (LT-7711) connected to the DCS control loop. Both instruments had known deficiencies. The sight-glass gauge was defective and would not indicate levels above approximately 9 feet — the column could be filled above that level without the gauge reading high. The DP transmitter had been marked out-of-service with a flagged engineering order that operators on the startup shift did not receive. As a result, operators believed they were adding feed to a column at a low level when the column was already filled beyond its normal operating range. When reboiler duty was increased, the overfilled raffinate was flashed at high temperature. The vapour-liquid mixture was routed through the overhead system to an atmospheric blow-down drum — a vessel with no liquid level control and no vapour-liquid separation capacity adequate for the volume involved. The drum overflowed liquid raffinate into a drain sewer. Raffinate vapours (C5-C7 hydrocarbons, LEL 1.1% for pentane) formed a vapour cloud at ground level in the area immediately downwind of the blow-down drum. A diesel pick-up truck idling nearby provided the ignition source. The explosion killed 15 workers in portable temporary office trailers located 150 feet from the blow-down drum — trailers that BP's own risk assessment had placed within the explosion overpressure zone. The 2026 adversarial injection maps to this failure mode with precise architectural correspondence. Replace the defective sight-glass gauge with a camera feed rendered as a digital image. Replace the operator reading the sight-glass with a CNN-based level classification model (AspenONE APC AI, Honeywell Profit Controller visual AI module) trained to classify the rendered image as Low, Normal, High, or High-High. Apply a ±10 DN pixel perturbation to the rendered image at the AI ingestion boundary that shifts the visible meniscus position in the gauge image from the High-High indicator range toward the Low indicator range. The APC AI outputs 'Low' — the same classification the defective sight-glass provided operators in 2005. The APC model reduces reboiler duty (attempting to fill the column from 'low' level) rather than initiating an alarm. The column fills further. The consequence envelope runs from column overhead system overpressure to raffinate overflow to vapour cloud formation to explosion — the same sequence CSB Report 2005-04-I-TX documents to the level of individual worker locations and overpressure zones at the time of detonation.

What is the adversarial injection surface in AspenONE APC AI and Honeywell Profit Controller level gauge visual modules — and why is ±10 DN sufficient to suppress a high-level detection?

Aspen Technology AspenONE Advanced Process Control AI and Honeywell Profit Controller are the two dominant model predictive control (MPC) platforms deployed in global refinery operations, with combined installations at over 600 major refinery and petrochemical complexes. Both platforms have incorporated visual AI modules in recent versions that accept camera feed inputs from instrument panels, column sight-glass gauge cameras, and operator display screens as supplementary inputs to the MPC model alongside traditional DCS tag values. The visual AI module architecture follows the same rendered-image-to-classifier pattern as the aviation and pipeline AI systems described in our pipeline ILI AI adversarial injection analysis : a camera or historian screen-capture feed is rendered as a digital image — JPEG at 95% quality, PNG at 8-bit depth, or a scaled TIFF export from the SCADA historian — and passed to a convolutional classification network that produces a discrete level state output (Low, Normal, High, High-High) consumed by the MPC model as a measured disturbance variable. A raffinate splitter reboiler sump level gauge, as imaged by the camera and rendered into a 512×512 or 1024×1024 pixel image, shows a liquid meniscus at some vertical position within the sight-glass tube window. The gauge typically spans 0-100% of the sight-glass viewing range, with the AI classifier trained to map meniscus position to one of the four level states. In the normal operating range, the meniscus appears at approximately 40-65% of the glass height, rendering as a clear horizontal liquid-vapour interface line at mid-glass. In a high-level condition during startup, the meniscus is at 85-95% of glass height, rendering as a liquid-vapour interface line near the top of the glass. The High-High classification corresponds to a meniscus at 95%+ or a flooded glass (all liquid, no visible vapour space). The adversarial perturbation operates on the pixel values corresponding to the meniscus position region — a horizontal band approximately 15-25 pixels wide at the liquid-vapour interface. A ±10 DN per-channel shift in the pixel values of this band reduces the contrast of the meniscus line against the background illumination of the sight-glass tube. At the High-High condition, the meniscus at 95% glass height is near the bright-lit upper portion of the glass; a ±10 DN compression of the interface contrast causes the CNN to interpret the meniscus line as background illumination variation at mid-glass, reclassifying the level state from High-High to Normal or Low. The ±10 DN perturbation magnitude is within the noise floor of JPEG compression at 95% quality and within the pixel-to-pixel variation introduced by industrial camera sensor noise in typical process plant lighting — making the perturbation imperceptible to a human operator reviewing the image and undetectable by standard image quality metrics used in SCADA historian integrity checks.

What is the FCC regenerator thermal AI adversarial injection surface — and what is the consequence of a suppressed afterburn detection?

Fluid Catalytic Cracking is the highest-throughput conversion unit in modern petroleum refining, processing 25-40% of a refinery's crude throughput into gasoline, diesel, and petrochemical feedstocks through catalytic cracking of heavy gas oils at 950-1,050°F in the riser reactor, followed by catalyst regeneration in the regenerator vessel at 1,200-1,350°F. The regenerator vessel burns the coke deposited on spent catalyst using controlled air injection; the combustion is designed to produce CO2 in the dense catalyst bed at the base of the regenerator. Afterburn is the most operationally significant thermal hazard in FCC regenerator operation: it occurs when CO combustion extends upward into the dilute catalyst phase above the dense bed, or into the regenerator cyclone section, where the absence of catalyst heat sink allows combustion temperatures to rise to 1,500-1,650°F — well above the design temperature of the regenerator vessel shell (typically 1,350-1,400°F), the cyclone wall refractory lining (designed for 1,400°F service), and the plenum chamber (designed for 1,350°F). Undetected afterburn sustained for 30-60 minutes can cause refractory spallation from the cyclone walls, cyclone metal distortion (nickel alloy cyclone dipleg collapse), and plenum chamber shell overtemperature — consequences that range from a forced unscheduled shutdown of the FCC unit to catastrophic shell failure and hot catalyst release. Modern FCC APC systems — including Aspen Technology DMCplus FCC AI, Honeywell UniSim FCC Optimizer AI, and KBC Petro-SIM FCC AI — incorporate thermal monitoring AI modules that process rendered false-colour thermal map images of the regenerator shell temperature distribution, produced by array pyrometers or FLIR infrared camera systems mounted at the regenerator vessel ports. The false-colour mapping assigns red to temperatures above the afterburn threshold (typically >1,450°F), yellow-orange to the normal operating range (1,200-1,350°F), and blue-green to below-normal temperatures. The APC AI classifier receives this rendered thermal map and determines whether afterburn conditions are present — triggering mitigation actions if the red afterburn zone is detected: reducing air injection rate, adjusting catalyst circulation rate, increasing lift steam flow. The adversarial injection surface is the rendered false-colour thermal map image. A ±8-12 DN hue-rotation perturbation applied to the pixel values of the red afterburn zone — specifically, incrementally shifting the hue channel of the HSV representation from the red detection band (0°-30° hue, >1,450°F) toward the yellow-orange normal operating band (30°-60° hue, 1,200-1,350°F) — causes the FCC APC AI to classify the regenerator thermal state as normal rather than afterburn. No mitigation action is initiated. The afterburn zone temperature continues rising. The consequence within the 30-60 minute window of undetected afterburn: refractory lining in the cyclone section reaches spallation temperature, cyclone metal components approach distortion limits, and the CO combustion front expands toward the plenum chamber — a failure sequence that leads to unplanned FCC shutdown at minimum, and at maximum to cyclone structural failure and hot catalyst egress from the regenerator pressure boundary at 1,300°F.

How does a Glyphward pre-scan gate integrate with oil refinery APC AI at threshold 35 — and what documentation does it generate for OSHA PSM compliance?

A Glyphward pre-scan gate for oil refinery APC AI operates at the rendered image ingestion boundary of each visual AI module — before the AspenONE APC AI level classification CNN receives the raffinate splitter sight-glass camera image, before the Honeywell Profit Controller visual module receives the distillation column DP indicator panel screenshot, before the FCC APC AI thermal classifier receives the false-colour regenerator pyrometer map. Each rendered image is submitted to Glyphward's adversarial detection API (8-15 ms latency per image), receives a risk score (0-100), and is compared to the configured threshold. At or above threshold 35, the gate raises an AdversarialProcessImageError, suppresses the AI classification output, and routes the image to operator review — a console operator who can verify the raw DCS tag value (the differential pressure transmitter reading, the thermocouple array reading) against the rendered image before the APC model acts on the classification. Below threshold 35, the image is cleared for AI classification on the normal APC control cycle. We configure threshold 35 for refinery APC AI contexts for the same reason we apply it to aviation and pipeline safety AI: the consequence of a false negative — a high-level classification suppressed to a normal or low classification — is the Texas City instrument-misread failure mode reproduced by an adversarial attack rather than by a defective gauge. A false positive by the Glyphward gate — routing a clean sight-glass image to operator review — adds one APC control cycle (30-60 seconds) of human verification latency before the classifier output is accepted. In a refinery APC control room, this latency is operationally absorbed into the normal APC model update interval without consequence. A false negative produces an undetected overfill condition in a PSM-covered process with a vapour cloud explosion consequence envelope documented to the level of 15 fatalities and 180 injuries. The threshold 35 calibration accepts the false positive latency cost in exchange for the lowest achievable false negative rate for AI systems whose misses reproduce the most precisely documented refinery process control failure in US regulatory history. The Glyphward scan log for refinery APC AI generates a timestamped audit record for each image — scan_id, risk score, process unit identifier (raffinate splitter, FCC regenerator, fired heater, compressor), image type (level gauge camera, thermal map, vibration spectrogram), scan timestamp, and perturbation class (meniscus position shift, hue-rotation thermal band shift, spectrogram sideband suppression) — that provides the APC image classification audit trail required for OSHA PSM 29 CFR 1910.119(j)(4) mechanical integrity documentation, satisfies the EPA RMP 40 CFR Part 68.65 process safety information record-keeping requirements for instrumentation and controls, and supports the Process Hazard Analysis revalidation requirement under 1910.119(e)(6) by providing a documented record of adversarial AI failure mode identification and safeguard implementation for each covered AI classifier in the refinery APC system.

Oil refinery AI security · AspenONE APC AI · Honeywell Profit Controller · OSHA PSM 29 CFR 1910.119 · FCC regenerator thermal AI · Texas City BP 2005

Oil refinery APC AI adversarial injection: how ±10 DN in the rendered raffinate splitter level gauge image replicates the Texas City BP 2005 instrument-misread failure mode — and why OSHA PSM 29 CFR 1910.119 has no adversarial robustness criterion

Published 15 June 2026 · 2,900 words · Back to blog

On 23 March 2005, the raffinate splitter tower at the BP Texas City refinery’s ISOM unit was overfilled during a startup sequence because a sight-glass level gauge read low when the column was already dangerously full. Fifteen workers were killed. The Chemical Safety Board (CSB Report 2005-04-I-TX) identified instrument failure — specifically a defective sight-glass gauge that could not indicate levels above approximately 9 feet — as the proximate cause. In 2026, the equivalent instrument in modern Advanced Process Control deployments is a camera feed rendered as a digital image and classified by a convolutional neural network inside AspenONE APC AI or Honeywell Profit Controller. A ±10 DN pixel perturbation at the rendered image ingestion boundary — within the noise floor of JPEG compression at 95% quality — can shift the visible meniscus position from the High-High indicator range to the Normal or Low range, causing the APC model to reduce reboiler duty rather than initiate an alarm. The APC AI produces the same misread that a defective sight-glass produced in 2005. OSHA PSM 29 CFR 1910.119 requires Process Hazard Analysis for all covered processes but has no adversarial robustness criterion for AI image classifiers. EPA RMP 40 CFR Part 68 worst-case consequence analysis requires modelling of vapour cloud explosions but does not require modelling an adversarial attacker corrupting the APC AI visual inputs that determine whether the explosion initiator is detected.

How oil refinery Advanced Process Control AI works — and where the adversarial injection surface lives

Modern downstream oil refinery operations run on a layered control architecture. At the base layer, DCS (Distributed Control System) regulatory control maintains individual process variables — column pressure, feed flow rate, reboiler outlet temperature — within setpoint tolerances using PID control loops sampling at 1-second intervals. One layer above, Advanced Process Control platforms — primarily Aspen Technology AspenONE with DMC3 (Dynamic Matrix Control 3) and Honeywell Profit Controller, which together account for the majority of APC deployments in global refinery operations — run Model Predictive Control algorithms that simultaneously optimise dozens of interacting process variables against a constraint model, sampling at 30-60 second intervals and calculating setpoint adjustments that the regulatory control layer executes. A third layer of optimisation — real-time optimisation (RTO) — adjusts APC model targets at 15-60 minute intervals based on crude quality, product pricing, and utility constraints.

The adversarial injection surface introduced by AI visual modules lives between the regulatory control layer and the APC layer. Both AspenONE and Honeywell Profit Controller now support visual AI input modules that accept camera feeds from physical instruments — level gauge cameras mounted on column sight-glass assemblies, operator display screen-captures from historian workstations, thermal camera feeds from fired heater tubes and FCC regenerator shell pyrometry systems, and vibration spectrogram displays from compressor health monitoring dashboards — as measured disturbance variables fed into the MPC model. These camera feeds are captured at intervals ranging from every APC control cycle (30-60 seconds) to every 5 minutes for slower-varying parameters. The camera image is rendered — scaled, colour-normalised, JPEG-compressed at 95% quality or exported as a 512×512 PNG — before being submitted to the AI classification CNN. The CNN output — a discrete level state, a temperature zone classification, a vibration health state — enters the APC model as a measured disturbance input on the same footing as DCS analogue tag readings.

The boundary between the camera capture and the CNN classifier is the adversarial injection surface. It is the same architectural boundary we have identified in every physical inspection AI system that processes rendered sensor imagery: the point at which raw sensor data becomes a raster image representation, submitted to an AI classifier that was trained on unperturbed images and has no adversarial robustness criterion in its qualification standard.

Texas City BP 2005: the raffinate splitter overfill sequence

The CSB Report 2005-04-I-TX is the most rigorously documented refinery process control instrument failure in US regulatory history. Its consequence quantification is precise: 15 fatalities, 180 injuries, $1.5 billion in direct costs, and a $21 million OSHA civil penalty (then the largest ever issued). Understanding the exact failure mechanism is essential for understanding why ±10 DN pixel perturbation in a 2026 APC AI level gauge image is the same failure, expressed as a software attack rather than a hardware defect.

The ISOM unit at Texas City processed raffinate — C5-C7 light naphtha — in a raffinate splitter column that separated isomerate light ends from the heavy raffinate product. During a startup sequence on 23 March 2005, the column was being filled with feed under manual control while operators gradually increased reboiler duty to establish the vapour-liquid equilibrium needed for stable operation. The startup procedure required monitoring the reboiler sump liquid level using the primary level instrument, LI-7710 — a sight-glass gauge mounted on the column base section.

LI-7710 was defective in a specific and fatal way: the gauge tube was clogged or restricted above approximately 9 feet of level indication. The column’s actual level could rise above 9 feet — and continue rising to 158 feet, the top of the column — without the gauge reading above its maximum indication. The backup DP transmitter (LT-7711) was flagged out-of-service by an engineering order that the startup crew had not received. A high-level alarm configured on LT-7711 was consequently inactive.

At 1:20 PM on 23 March 2005, with the column actually filled to approximately 158 feet — completely flooded, liquid raffinate filling the overhead vapour space and the overhead line to the condenser — operators believed from the LI-7710 reading that the column was near its normal operating level of 6-7 feet. Reboiler duty was increased to 40 MMBTU/hr as the procedure specified. The raffinate inventory, at 270°F and 55 psig, was flashed by the heat input. Liquid and vapour raffinate was driven upward through the overhead system, past the condenser, and into the atmospheric blow-down drum — a vessel designed for occasional small column pressure reliefs, not the high-volume liquid overflow of a completely flooded 158-foot column startup.

The blow-down drum overflowed within minutes. Liquid C5-C7 raffinate at approximately 270°F cascaded from the drum’s overflow drain into the surrounding grade area, vaporising on contact with ambient air (LEL for pentane: 1.4% by volume; vapour density 2.5 — heavier than air, pooling at grade level). The vapour cloud drifted southwest toward the contractor parking area and the cluster of portable temporary office trailers. A diesel pick-up truck idling with its engine running near Trailer F provided the ignition source. The explosion overpressure — 1-3 psi at 150 feet from the ignition point — destroyed all 13 trailers in the vicinity. Fifteen workers were killed, twelve of them in trailers that had been risk-assessed by BP and placed within the identified explosion hazard zone based on an analysis that concluded the risk was acceptable because trailers were only ‘temporarily’ sited in that location. At the time of the explosion, the trailers had been in the zone for four years.

The 2026 adversarial injection produces an identical process state with one substitution: the defective sight-glass gauge becomes an APC AI classification CNN whose rendered input image has been adversarially perturbed to shift the meniscus position from High-High to Normal. The physical process proceeds identically from that point. The APC model has no basis to initiate corrective action because its level state input says Normal. The regulatory control layer continues executing APC setpoints that add heat and feed to an already overfilled column. The consequence sequence runs to vapour cloud formation on the same timeline as 23 March 2005.

The AspenONE APC AI level gauge classifier: adversarial injection mechanics

AspenONE APC with DMC3 is deployed at approximately 350 major refinery and petrochemical complexes worldwide. In implementations with visual AI modules enabled — available from Aspen Technology since the AspenONE 14 release, with expanded multimodal input support in subsequent versions — a camera mounted on the sight-glass assembly of a distillation column sends a continuous MJPEG stream to the AspenONE process historian. At each APC model update cycle (nominally every 60 seconds for a raffinate splitter APC model), the historian server exports the most recent camera frame as a 512×512 JPEG image at 95% compression quality and passes it to the visual AI module’s classification pipeline.

The sight-glass gauge image — in a typical column installation — shows a cylindrical glass tube back-lit by a fluorescent or LED backlight, with the liquid-vapour meniscus appearing as a horizontal dark-on-bright interface line. The tube is flanked by scale markings (0-100% or 0-10 feet) etched on a metal backing plate. The image rendering maps the full tube view to the 512×512 pixel frame, with the liquid-vapour interface occupying a horizontal band of approximately 20-40 pixels at whatever height corresponds to the current level. In the High-High condition — level at 95-100% of the sight-glass viewing range — the meniscus band is near the top of the image: pixels 30-70 from the top edge, in a 512-pixel height image.

The CNN classifier — trained on a library of sight-glass images annotated across the four level states at multiple column installations — extracts features from the meniscus position, the contrast of the meniscus band against the backlit background, and the ratio of liquid-phase area (darker, below the meniscus) to vapour-phase area (brighter, above the meniscus). The decision boundary between High-High and High corresponds to a meniscus position above approximately 90% of the tube height; High versus Normal corresponds to 70-90%; Normal versus Low corresponds to 30-70%.

The adversarial perturbation targets the meniscus band pixel values. A ±10 DN per-channel (R, G, B) shift applied to the 20-40 pixel horizontal band at the meniscus position reduces the contrast of the liquid-vapour interface against the backlit background. The backlit tube interior, normally rendered as a high-brightness region (pixel values 210-240 DN in the 0-255 range) above the meniscus, merges with the perturbed meniscus band values (shifted from the normal 160-180 DN dark interface region toward 170-190 DN). The CNN interprets the reduced contrast as a meniscus at mid-glass — a Normal level condition — rather than a meniscus at the top of the tube. The APC model receives a Normal level disturbance input for the current control cycle and does not modify its setpoints to initiate a high-level response.

The ±10 DN perturbation magnitude is critical to the attack’s persistence. JPEG compression at 95% quality introduces quantisation errors of ±4-8 DN in the DCT coefficients of a typical sight-glass image. Camera sensor read noise in an industrial IP camera (typical 1/2.8" Sony Starvis CMOS sensor at 30 lux process lighting) contributes ±3-6 DN frame-to-frame pixel variation. A ±10 DN adversarial perturbation is within the combined noise floor — the perturbed image is indistinguishable from a normally compressed camera frame to an operator reviewing the image on a historian workstation, to a standard image integrity check (MD5 hash comparison against expected value ranges), and to the SCADA historian’s built-in image quality validation routine.

FCC regenerator thermal AI: the afterburn suppression surface

The FCC regenerator is the highest-temperature continuous operation in most oil refineries, and afterburn detection is its most operationally critical monitoring function. The adversarial injection surface for FCC regenerator thermal AI illustrates the same rendered-image vulnerability as the level gauge classifier, but with a different physical medium — a false-colour infrared thermal map rather than a visible-light sight-glass image — and a different consequence timeline: afterburn consequence unfolds over tens of minutes rather than the seconds of a vapour cloud ignition event, but the structural damage to cyclone internals can require multi-month repair outages and can create a hot catalyst release hazard that OSHA cites under PSM 1910.119 general duty clause provisions.

FLIR A-series or equivalent array pyrometer systems deployed on FCC regenerator vessel ports render 2D temperature distribution maps of the regenerator shell or cyclone section. The rendering maps measured temperature to a false-colour scale: typically blue-green for 900-1,100°F (below normal regenerator dense bed operating temperature), yellow-orange for 1,100-1,400°F (normal dense bed combustion range), and red for >1,400°F (afterburn zone, above design temperature for cyclone internals). The APC AI classifier processes this rendered false-colour map at 5-minute intervals and outputs an afterburn state classification (No Afterburn / Afterburn Detected / Afterburn Critical) consumed by the FCC APC optimizer as a constraint that limits air injection rate if afterburn is detected.

The adversarial perturbation targets the hue values of the red afterburn zone pixels. An HSV hue-rotation of approximately ±8-12 DN — shifting the H channel of the afterburn zone pixels from the 0°-25° hue range (red, >1,400°F classification) toward the 25°-55° hue range (orange-yellow, 1,200-1,400°F normal range) — causes the CNN to classify the afterburn zone as a normal-temperature dense bed region. The APC optimizer receives a No Afterburn state and does not reduce air injection or adjust catalyst circulation. Afterburn temperature continues rising. Within the 30-60 minute window before thermocouples in the cyclone section begin reading above their normal range through the slower-responding direct measurement channel, the adversarially suppressed thermal AI classification has allowed afterburn to progress beyond the point at which air injection reduction alone can reverse it.

The OSHA PSM 29 CFR 1910.119 qualification gap

OSHA Process Safety Management (29 CFR 1910.119) is the most comprehensive process safety regulatory framework in the United States, covering approximately 13,000 facilities with covered processes and requiring a documented Process Hazard Analysis for each covered process that identifies hazards, evaluates safeguards, and documents recommendations for risk reduction. The PHA revalidation requirement under 1910.119(e)(6) mandates that every covered process PHA be updated and revalidated at intervals not exceeding five years.

The 1910.119(e)(2) PHA methodology requirements specify six approved methods: What-If, Checklist, What-If/Checklist, HAZOP, FMEA, and Fault Tree Analysis. For a raffinate splitter column, a HAZOP study would identify the Level node with High Level as a deviation, document the causes (control valve failure, feed flow increase, level controller failure, instrument failure), document the consequences (column flooding, overhead system overpressure, blow-down drum overflow, vapour cloud explosion), document the existing safeguards (SIS high-high level trip, level transmitter redundancy, blow-down drum vent to flare), and verify that the combination of safeguards provides adequate risk reduction by reference to IEC 61511 Safety Integrity Level requirements.

The gap is in the cause enumeration. A HAZOP deviation node for ‘Level — High’ in a raffinate splitter will list ‘LI-7710 sight-glass gauge failure’ as a credible cause — because that is the failure mode documented by CSB Report 2005-04-I-TX, and every OSHA PSM audit of a raffinate splitter column since 2007 will look for it. But ‘adversarial pixel perturbation in the rendered level gauge camera image submitted to the AspenONE APC AI visual module’ will not appear in the cause list of any HAZOP performed using any current PHA methodology guidance — API RP 750 (1990), CCPS “Guidelines for Hazard Evaluation Procedures” (3rd ed., 2008), or OSHA’s own 3132 PSM Compliance Guidelines. None of these guidance documents address AI image classifier adversarial failure modes. None have been updated since adversarial machine learning became a documented practical threat to deployed AI systems.

The mechanical integrity requirement under 1910.119(j) compounds the gap. A refinery’s MI programme for APC visual AI modules will specify camera calibration intervals (typically annual), image quality validation procedures (histogram range checks, focus sharpness metrics), and historian data retention requirements. None of these MI programme elements address adversarial robustness of the CNN classifier that processes the validated camera images. A camera that passes its annual calibration check, produces images within the specified histogram range, and outputs JPEG files with the correct metadata can be supplying adversarially perturbed level gauge images to the APC AI — and the MI programme will record it as in-service and conformant.

The parallel with aviation regulatory gaps is structural. As we noted in our analysis of jet engine borescope AI and EASA AMC 20-16, aviation inspection AI qualification standards were developed before adversarial machine learning was a practical deployment consideration — and share the same structural gap with OSHA PSM: rigorous qualification against expected operational variability, with no adversarial attacker in the threat model. The difference is that borescope AI misses accumulate over months before an engine failure event; raffinate splitter level gauge AI misses can produce a vapour cloud explosion within 15 minutes of the misclassification, on the timeline established by 23 March 2005.

Fired heater tube thermal AI and compressor vibration spectrogram AI: the secondary surfaces

Two additional adversarial injection surfaces in refinery APC AI are worth noting alongside the level gauge and FCC regenerator thermal AI surfaces, as they represent the highest-consequence secondary failure modes in a refinery’s process equipment portfolio.

Fired heater tube thermal AI monitors the tube skin temperatures of process heaters — the furnaces that heat crude oil before atmospheric distillation, heat vacuum residue before vacuum distillation, and heat hydrotreater feed before reactor entry. API Standard 530 “Calculation of Heater-Tube Thickness in Petroleum Refineries” specifies design metal temperature limits for each tube alloy grade: P11 chrome-moly tubes typically rated to 1,100°F skin temperature; P22 tubes to 1,200°F; 347H stainless steel tubes to 1,400°F. Infrared camera systems monitor tube skin temperatures through sight ports during operation; the rendered infrared images — false-colour maps of the tube bank — are processed by APC AI classifiers to identify tubes approaching or exceeding their API 530 temperature limits. An adversarial perturbation that suppresses a hot-spot rendering — shifting a 1,250°F tube-surface temperature zone from the orange-red near-limit colour to the yellow normal-service colour — can allow a P11 tube to operate above its API 530 design temperature without triggering an APC setback or operator alert, risking pressure-rupture of the tube under operating pressure (typically 100-600 psig feed pressure) and the consequent release of hot hydrocarbon into the heater firebox.

Compressor vibration spectrogram AI monitors the rotating machinery health of process compressors — hydrogen recycle compressors in hydroprocessing units, wet gas compressors on FCC units, and refrigerant compressors in alkylation units — using vibration spectrograms rendered from accelerometer signals. Mechanical seal deterioration, bearing defects, and shaft misalignment each produce characteristic frequency components in the vibration spectrum — sidebands at multiples of the rotor fundamental frequency, sub-synchronous components at 0.4-0.48× running speed for seal rub, high-frequency components at bearing defect frequencies (BPFI, BPFO, BSF). AI classifiers trained on vibration spectrograms identify these deterioration signatures and trigger maintenance recommendations or automatic setbacks. An adversarial perturbation that dampens the sideband amplitude in the rendered spectrogram image — reducing the displayed sideband peak heights toward the spectrogram noise floor — suppresses the seal deterioration signature, delaying the maintenance recommendation and allowing continued operation toward catastrophic seal failure and the hydrocarbon release that follows.

Glyphward threshold 35 for oil refinery APC AI

Glyphward’s adversarial detection API operates as a pre-scan gate at the rendered image ingestion boundary of each APC visual AI module in the refinery: the sight-glass level gauge camera image before the distillation column level classifier, the false-colour pyrometer map before the FCC regenerator afterburn classifier, the infrared tube image before the fired heater API 530 limit classifier, and the vibration spectrogram before the compressor health classifier. Each rendered image is submitted to Glyphward’s API (8-15 ms latency per image), receives a risk score (0-100), and is compared to the configured threshold.

We configure this threshold at 35 for all refinery APC AI visual input contexts. The threshold selection reflects the consequence asymmetry established by Texas City BP 2005. A false negative — passing an adversarially perturbed raffinate splitter level gauge image to the APC level classifier — produces a High-High condition classified as Normal, the APC model continues filling the column, and the consequence sequence runs on the timeline of 23 March 2005: vapour cloud formation in approximately 15 minutes. There is no complementary automated detection channel with a comparable response time: the SIS high-high level trip depends on the DP transmitter LT-7711, a different instrument, but in many installations the SIS and APC systems share the same instrument bus, and an adversary with access to the APC visual AI ingestion boundary may also have access to the SIS trip logic display. At threshold 35, the gate is calibrated to minimise false negatives at the cost of a false positive rate that routes approximately 5-8% of clean level gauge images to operator review — one additional 30-60 second verification loop per APC control cycle, operationally absorbed in the normal APC update cadence without process disruption.

The Glyphward scan log for refinery APC AI generates a timestamped record for each image: scan_id, risk score, process unit (raffinate splitter, FCC regenerator, fired heater H-101, compressor KC-101), image type (level gauge camera, pyrometer thermal map, tube infrared, vibration spectrogram), scan timestamp, and perturbation class (meniscus position shift, hue-rotation thermal band shift, spectrogram sideband suppression, hot-spot contrast reduction). This record satisfies the OSHA PSM 29 CFR 1910.119(j)(4) mechanical integrity audit trail for AI-based instrumentation inputs, documents the adversarial failure mode identification that supports PHA revalidation under 1910.119(e)(6), and provides the EPA RMP 40 CFR Part 68.65 process safety information record for covered process instrumentation and controls.

Free tier — 10 scans/day, no card required. Submit a rendered raffinate splitter level gauge camera image or FCC regenerator pyrometer map to the Glyphward scanner to generate a baseline adversarial risk score for your refinery APC AI pipeline.

FAQ

What does OSHA PSM 29 CFR 1910.119 require for process control instrumentation and AI in oil refineries — and what is the adversarial robustness gap?

OSHA PSM 29 CFR 1910.119 covers any process with more than 10,000 lbs of a flammable liquid above its boiling point. It requires Process Hazard Analysis under 1910.119(e) using approved methods (HAZOP, What-If, FMEA) and mechanical integrity programmes under 1910.119(j) for all instruments critical to safe operation. A HAZOP on a raffinate splitter column will identify ‘Level Indicator Failure’ as a credible cause of High Level deviation — the exact failure mode documented by Texas City BP 2005. It will not identify ‘adversarial pixel perturbation in the rendered level gauge camera image submitted to the AspenONE APC visual AI module’ — because no current PHA methodology guidance (API RP 750, CCPS Guidelines for Hazard Evaluation Procedures 3rd ed., OSHA 3132) addresses adversarial AI image classifier failure modes. A refinery holding a full OSHA PSM compliance record can be running APC AI that is vulnerable to ±10 DN pixel perturbation at the rendered image ingestion boundary of its level classification CNN.

What exactly failed at Texas City BP refinery on 23 March 2005 — and how does it map to a 2026 APC AI adversarial injection?

The CSB Report 2005-04-I-TX identified the proximate cause of the Texas City explosion (15 fatalities, 180 injured) as a defective sight-glass level gauge (LI-7710) that could not read above approximately 9 feet, causing operators to believe the raffinate splitter was at normal fill during startup when it was completely flooded at 158 feet. Reboiler heat input flashed the overfilled raffinate through the overhead system into an atmospheric blow-down drum that overflowed liquid C5-C7 hydrocarbons; the vapour cloud ignited from a pick-up truck engine, destroying 13 trailers and killing 15 workers. The 2026 adversarial injection substitutes the defective sight-glass with an adversarially perturbed rendered camera image that the APC AI classifies as Normal rather than High-High. Every subsequent step in the consequence sequence is identical: the APC model continues adding heat and feed, the column overfills, the overhead system sees liquid, the blow-down drum overflows, a vapour cloud forms.

Why is ±10 DN sufficient to suppress a high-level detection in AspenONE APC AI — and how does the perturbation remain undetectable?

A raffinate splitter sight-glass in a High-High condition shows a liquid-vapour meniscus near the top of the tube: a horizontal dark-on-bright interface band in approximately pixels 30-70 from the top of a 512-pixel height image. The CNN identifies this meniscus position as High-High by the contrast of the 20-40 pixel interface band against the backlit tube background and the ratio of dark liquid-phase area to bright vapour-phase area. A ±10 DN per-channel pixel shift on the interface band reduces its contrast against the backlit background, causing the CNN to interpret the interface as mid-glass — a Normal level condition. The ±10 DN magnitude is within the combined noise floor of JPEG 95% compression (±4-8 DN DCT quantisation error) and industrial IP camera sensor read noise (±3-6 DN frame-to-frame variation at 30 lux process lighting). The perturbed image passes standard histogram range checks, focus sharpness metrics, and SCADA historian image quality validation. A human operator reviewing the image on a workstation cannot distinguish it from a normally compressed camera frame.

What is the FCC regenerator afterburn adversarial injection surface — and what happens to the regenerator cyclone if afterburn goes undetected for 30-60 minutes?

FCC regenerator afterburn — CO combustion extending from the dense catalyst bed into the dilute phase and cyclone section — raises dilute-phase temperatures from the normal 1,200-1,350°F range to 1,500-1,650°F, above the design temperature of cyclone refractory lining (rated 1,400°F) and cyclone metal components (nickel alloy, rated 1,450°F). Thermal monitoring AI processes FLIR or array pyrometer false-colour maps of the regenerator shell to detect afterburn zones classified by their red coloration (>1,450°F). A ±8-12 DN hue-rotation perturbation in the red zone pixels shifts them from the red afterburn band (0°-25° HSV hue) into the orange-yellow normal operating band (25°-55° hue), suppressing the afterburn classification. Without an APC air injection setback, afterburn temperature continues rising. In 30-60 minutes: refractory spallation from cyclone walls, cyclone metal distortion, and potential plenum chamber overtemperature — a forced outage minimum; at worst, cyclone dipleg collapse and hot catalyst egress from the regenerator pressure boundary.

How does a Glyphward pre-scan gate integrate with refinery APC AI at threshold 35 — and what documentation does it generate for OSHA PSM compliance?

Glyphward operates at the rendered image ingestion boundary of each APC visual AI module — before the level gauge image reaches the distillation column CNN, before the pyrometer map reaches the FCC afterburn classifier, before the infrared tube image reaches the fired heater API 530 limit classifier. Each image receives a risk score (0-100) in 8-15 ms. At or above threshold 35, Glyphward suppresses the AI classification and routes the image to operator review for DCS tag verification. Below 35, normal APC classification proceeds. Threshold 35 reflects the Texas City consequence asymmetry: a false positive (routing a clean gauge image to operator review) adds one 30-60 second APC cycle of verification latency; a false negative (passing a perturbed image to the classifier) initiates a raffinate overfill sequence on the 15-minute timeline of 23 March 2005. The scan log — scan_id, risk score, process unit, image type, scan timestamp, perturbation class — satisfies OSHA PSM 1910.119(j)(4) MI audit trail requirements, supports PHA revalidation documentation under 1910.119(e)(6), and meets EPA RMP 40 CFR Part 68.65 process safety information record-keeping for instrumentation and controls.