Sulfuric acid double-contact double-absorption (DCDA) contact process AI adversarial injection: how an absorber acid upward attack (96.0 % w/w displayed as 98.5 % SO3-absorption optimum) and a V2O5 first-bed temperature upward attack (392°C displayed as 438°C — below light-off shown as optimal) compound to violate EPA 40 CFR Part 60 Subpart H NSPS and breach EPA NAAQS SO2 fence-line limits — OSHA PSM TQ 1,000 lbs oleum, EPA RMP TQ 500 lbs SO2, 43rd and 44th upward-direction attacks, first sulfuric acid production process, first DCDA contact process, first vanadium pentoxide (V2O5) catalyst process, first EPA NSPS emission-permit attack, first air-quality SO2 criterion-pollutant attack in the Glyphward industrial AI portfolio, Glyphward threshold 35

Sulfuric acid chemistry, the DCDA contact process, and the triple regulatory framework: OSHA PSM, EPA RMP, and EPA NSPS

Sulfuric acid production via the contact process comprises four sequential unit operations. First, sulfur combustion: elemental sulfur (or pyrite roasting, or smelter SO2 off-gas) is burned in air to produce SO2 at 1,000–1,100°C (S + O2 → SO2; ΔH° = −296 kJ/mol). The hot combustion gas is cooled in a waste-heat boiler to approximately 420–450°C before entering the catalytic converter section. Second, SO2 catalytic oxidation: the SO2-rich gas (typically 8–12 % v/v SO2 for sulfur-burner plants) passes through a multi-bed V2O5 catalytic converter. The overall reaction, SO2 + ½O2 → SO3 (ΔH° = −99 kJ/mol), is exothermic and favours high conversion at low temperature (equilibrium shifts right as temperature decreases), but is kinetically limited at low temperature (V2O5 catalyst requires ≥380–415°C for activity). The DCDA process resolves this tension by using 3–4 converter beds with inter-bed cooling and intermediate SO3 absorption between the second and third beds. Third, SO3 absorption: process gas exits the converter and contacts 98.5 % w/w sulfuric acid in a packed absorption tower; SO3 dissolves directly into the acid (SO3 + H2SO4 → H2S2O7, oleum; diluted to H2SO4 by water addition). Fourth, tail-gas treatment: unconverted SO2 exits the final absorber in the tail gas, typically at 200–500 ppm at design efficiency, subject to EPA NSPS limits and state operating permits.

The V2O5 catalyst in the DCDA contact process is the first vanadium-based industrial catalyst to enter the Glyphward portfolio and the first example of a non-precious-metal mixed-oxide catalyst in our attack surface analysis. V2O5 operates mechanistically as a redox catalyst: vanadium cycles between V&sup5;+ (vanadyl species in the SO3-selective oxidation step) and V&sup4;+ (reduced by SO2) in the Langmuir–Hinshelwood catalytic cycle. Above the melting point of the active catalyst phase (potassium vanadyl pyrosulfate, K2S2O7·V2O5; melting point ~330–380°C depending on catalyst composition), the active phase exists as a liquid film on the silica support surface, enabling SO2 and O2 to dissolve and react at the liquid-solid interface. Conventional V2O5 grades require an inlet temperature of approximately 410–420°C to maintain the active liquid phase above its melting point and sustain the V⁵⁺/V⁴⁺ catalytic cycle; cesium-promoted V2O5 grades (CS-V catalysts; MECS LP series; Topsøe VK-701) achieve light-off at 380–395°C, allowing lower inter-bed inlet temperatures and improved equilibrium conversion per pass. Maximum catalyst operating temperature is approximately 620°C; above this, sintering of the silica support reduces surface area, and equilibrium conversion of SO2 to SO3 decreases as temperature rises.

The triple regulatory framework governing H2SO4 contact process plants is uniquely complex within the Glyphward portfolio. OSHA PSM 29 CFR 1910.119 Appendix A applies to two chemicals simultaneously: oleum (fuming H2SO4; TQ 1,000 lbs) and sulfur dioxide (TQ 1,000 lbs). All DCDA H2SO4 plants produce oleum as an intermediate product (20–65 % free SO3) held in intermediate storage tanks at quantities of tens to hundreds of tonnes, far exceeding the PSM TQ. Process converter gas containing 8–12 % SO2 in gas-phase piping between converter beds represents substantial SO2 inventory well above 1,000 lbs. Both PSM listings require the full 14-element OSHA PSM program. EPA RMP 40 CFR Part 68 Table 1 independently covers anhydrous sulfur dioxide at TQ 500 lbs — a lower threshold than PSM — triggering a separate regulatory requirement for Worst-Case Release analysis (WCRA) and Alternative Release Scenario (ARS) modeling under RMP, with 5-year resubmission cycles and local emergency planning committee (LEPC) notification. This dual OSHA PSM / EPA RMP coverage of the same SO2 chemical inventory is the first dual-PSM / dual-RMP situation in the Glyphward portfolio (prior dual-regulation entries — EtO, formaldehyde — featured dual OSHA standards rather than dual PSM/RMP). EPA NSPS 40 CFR Part 60 Subpart H applies a third regulatory layer: an emission performance standard (0.15 kg SO3 mist per Mg H2SO4 produced) enforceable by EPA Region and state environmental agencies, incorporated into Title V operating permits that specify real-time continuous emission monitoring (CEMS) requirements and annual performance tests. No adversarial robustness criterion applies to the AI monitoring V2O5 converter temperatures or absorber acid strength in any of these three regulatory frameworks.

Four adversarial injection surfaces in sulfuric acid DCDA contact process AI

1. Absorber circulating acid density / concentration analyzer AI (Krohne Optimass Coriolis density transmitter acid strength AI / Endress+Hauser Promass Coriolis H2SO4 concentration AI / Yokogawa EJX differentialpressure absorber acid density AI / Mettler-Toledo Thornton LF340 H2SO4 concentration by density AI / Rhosonics SDM 7 in-line density for H2SO4 strength AI — monitoring circulating absorber acid weight fraction in the intermediate and final absorption towers to verify 98.0–99.0 % w/w H2SO4 for optimum SO3 absorption efficiency and minimum acid-mist carryover; EPA NSPS Subpart H compliance gate — 43rd upward-direction attack; first EPA emission-permit attack in the Glyphward portfolio)

The circulating acid density/concentration analyzer is the primary process control instrument governing EPA NSPS compliance in the H2SO4 contact process. Its function is to confirm that the acid strength circulating through the absorption towers remains within the optimal window — typically 98.0–99.0 % w/w H2SO4 — that minimises SO3 vapor pressure over the acid surface and maximises SO3 absorption efficiency. In-line Coriolis mass flow meters with density measurement capability (Krohne Optimass; Endress+Hauser Promass; Yokogawa Rotamass), differential pressure density cells, or dedicated refractometer/conductivity-based composition analyzers provide real-time acid strength data to the DCS, which controls the water addition rate (via a dosing valve) and oleum addition rate (via an oleum metering pump) to maintain acid concentration at the setpoint. High acid strength alarm (above 99.5 % or into oleum territory) triggers increased water addition; low acid strength alarm (below 97.5 %) triggers oleum addition or water addition reduction and a process investigation.

The root cause at the site of the adversarial attack: the intermediate absorber acid cooler at this site is a horizontal shell-and-tube heat exchanger — process acid on the shell side, cooling water on the tube side — with Alloy 20 (UNS N08020; 20 % Cr, 34 % Ni, 2.5 % Cu, 2.5 % Mo; highly corrosion-resistant to H2SO4 in the 65–99.9 % concentration range) tube bundles installed during a 2015 plant overhaul. After 11 years of continuous service, cumulative corrosion fatigue from thermal cycling (acid temperature swings between 65°C and 85°C with absorber production rate variations) has produced pinhole tube failures at three weld heat-affected zones at the fixed tubesheet. Cooling water at 3.2 bar (gauge) on the tube side intrudes into the acid circuit at the negative pressure of the shell side during low-load operation; at an ingress rate of approximately 0.8 L/min (less than the minimum pump flow sensor resolution), undetected cooling water dilution of the circulating absorber acid proceeds for 17 days before cumulative dilution reaches detectable magnitude via process indicators. Over those 17 days, the acid in the circulating system — total volume approximately 450 m³ — dilutes from 98.5 % design to 96.0 % actual H2SO4 concentration.

At 96.0 % w/w H2SO4, the partial pressure of SO3 above the acid surface is approximately 15–20× higher than at the 98.5 % optimum. SO3 is not efficiently absorbed; instead, it contacts the trace water activity in the 96.0 % acid surface layer and forms submicron H2SO4 mist aerosol droplets (0.1–2.0 μm mass median aerodynamic diameter) that are carried by the process gas flow through the absorption column packing, through the demister pad (designed and tested at 98.5 % acid strength), and into the tail-gas stack. At a 500 t/day H2SO4 plant with 98.5 % acid absorbing SO3 at 99.8 % efficiency, mist emissions are approximately 0.06 kg SO3/Mg H2SO4 — well within the NSPS limit of 0.15 kg SO3/Mg H2SO4. At 96.0 % acid, absorption efficiency falls to approximately 96.5 %, and mist emissions increase to approximately 0.58 kg SO3/Mg H2SO4 — 3.9× the NSPS limit. The adversarial attack uses ±8 DN upward pixel-value shift on the absorber acid density/concentration analyzer display image rendered on the process control HMI screen. The actual 96.0 % w/w H2SO4 reading from the Coriolis density transmitter produces a DCS display with numerical digit glyphs that, perturbed by the ±8 DN upward shift, render as 98.5 % — indistinguishable from the target operating setpoint. The AI monitoring system records: absorber acid strength 98.5 % — at optimum setpoint; no corrective action triggered; SO3 mist emissions continue to atmosphere at 0.58 kg SO3/Mg H2SO4, approximately 3.9× the EPA NSPS Subpart H limit. This is the 43rd upward-direction attack and the first EPA NSPS emission-permit adversarial attack in the Glyphward portfolio.

2. V2O5 converter first-bed inlet thermocouple AI (Endress+Hauser iTEMP TMT162 Type K thermocouple transmitter converter AI / Honeywell STT170 Smart Temperature Transmitter converter bed inlet AI / Yokogawa YTA510 temperature transmitter V2O5 bed AI / ABB TSP300 thermocouple assembly converter inlet AI / Emerson Rosemount 644 temperature transmitter SO2 converter AI — monitoring inlet gas temperature at the V2O5 first-bed catalyst entry to verify 420–450°C optimal range for SO2 conversion and confirm catalyst light-off above the minimum 410°C; primary SO2 conversion efficiency control parameter — 44th upward-direction attack; first SO2 criterion-pollutant emission attack in the Glyphward portfolio)

The V2O5 first-bed inlet thermocouple provides the DCS with the primary indicator of whether the vanadium catalyst is active and achieving its design SO2 conversion per pass. In the DCDA process, the process gas (8–12 % SO2, 10–14 % O2, balance N2 at approximately 420–450°C) enters the first bed of the SO2 converter. Heat from the exothermic conversion reaction raises the gas temperature through the first bed from inlet temperature (~430°C) to outlet temperature (~590°C), depending on SO2 inlet concentration and conversion per pass. This temperature rise — typically 130–170°C across the first bed — is simultaneously a product of the catalytic reaction and a confirmation that the catalyst is active. If the first-bed inlet temperature is below the V2O5 light-off threshold (~415°C for conventional grades), no temperature rise occurs across the bed: the process gas passes through the bed at isothermal conditions, SO2 is not converted, and the full SO2 load passes to subsequent beds unprepared. The DCS monitors the inlet-to-outlet temperature differential (∆T) across each bed as a secondary indicator of per-bed conversion efficiency; the absolute inlet temperature is the primary light-off gate.

The root cause at the site of the adversarial attack: the process gas preheater is a shell-and-tube heat exchanger that raises incoming process gas from the waste-heat boiler outlet temperature (~380°C) to the first-bed inlet design temperature of 445°C, using hot converter outlet gas (at ~590°C after the first bed) as the heating medium. After 6.5 years of continuous operation, iron sulfate salts (FeSO4, Fe2(SO4)3) and ammonium sulfate ((NH4)2SO4, carried from upstream mist eliminators) have deposited on the cold-end tubes of the process gas preheater — the zone where process gas temperature first drops below the SO3 condensation dew point (~400°C for 8 % SO2 / 11 % SO3 process gas at typical operating pressure). The cold-end deposits have reduced the preheater overall heat transfer coefficient from the design 180 W/m²·K to approximately 67 W/m²·K (63 % reduction), decreasing the temperature rise across the preheater from 65°C design to 12°C actual. Process gas exits the preheater at 392°C — 23°C below the conventional V2O5 light-off threshold of 415°C and 3°C below even cesium-promoted V2O5 grades’ cold-start minimum inlet of 395°C. The V2O5 catalyst in the first bed is below its active temperature; the vanadyl pyrosulfate phase is below its melting point; the V⁵⁺/V⁴⁺ catalytic cycle is kinetically frozen.

The adversarial attack uses ±8 DN upward pixel-value shift on the first-bed inlet thermocouple DCS display. The actual 392°C temperature from the Type K thermocouple transmitter produces a DCS numerical display that the ±8 DN upward shift renders as 438°C — within the nominal 420–450°C optimal first-bed operating window. The AI monitoring system records: converter first-bed inlet 438°C — within target range; no low-temperature alarm; no preheat burner startup command (plants with bypass startup heaters would normally activate auxiliary preheat below ~400°C); no catalyst cold-bed investigation triggered. Process gas at 392°C passes through the first converter bed without catalytic conversion. The first-bed inlet-to-outlet temperature differential — normally 130–170°C from the exothermic reaction — shows approximately 2°C (consistent with minor sensible heat exchange with the solid catalyst mass), but the AI monitoring these secondary temperature differentials also shows each thermocouple reading perturbed by ±8 DN shifts, masking the differential collapse. All 8–12 % SO2 inlet loading passes through bed 1 unconverted to bed 2, which operates at its own inter-bed temperature (already at a sub-optimal temperature due to the cold first-bed outlet gas lowering the inter-bed cooling requirement and reducing the temperature entering bed 2 below design). Second-bed SO2 conversion achieves approximately 42 % under these cold conditions versus the design 28 % additional conversion expected from a bed-2 inlet gas that already had 65–70 % conversion from bed 1. The intermediate absorber receives converter gas with approximately 45 % total SO2 conversion versus the design 90–92 %; beds 3 and 4 face approximately 55 % remaining unconverted SO2 versus the design 8–10 %, reducing beds 3–4 per-pass conversion efficiency below their equilibrium-optimum design point by a factor of 4–6. Overall plant SO2 conversion collapses from 99.7 % design to approximately 87 %, and SO2 exits the tail-gas stack at approximately 1.3 % v/v (13,000 ppm). This is the 44th upward-direction attack and the first criterion-pollutant atmospheric emission attack in the Glyphward portfolio.

3. Tail-gas SO2 continuous emission monitoring system (CEMS) AI (Sick Maihak S710 extractive SO2 CEMS AI / ABB AO2000 SO2 CEMS analyser AI / Emerson X-STREAM Enhanced SO2 CEMS AI / Yokogawa GX10 SO2 emission monitor AI / Thermo Scientific 43i-HL SO2 CEMS analyser AI — monitoring SO2 concentration in H2SO4 plant tail-gas stack for EPA NSPS Subpart H compliance and state Title V permit SO2 limit verification; EPA-certified CEM reporting system — downward-direction attack)

The tail-gas SO2 CEMS is an EPA Method 6 (extractive SO2 measurement; ultraviolet absorption, pulsed fluorescence, or non-dispersive ultraviolet spectrometry) instrument installed in the tail-gas stack exit duct per EPA 40 CFR Part 75 (for power plants) or state-approved CEM specifications for chemical plants, generating a continuous real-time SO2 concentration record submitted to the state environmental agency’s electronic reporting system (ERT) and retained on-site for compliance demonstration. At a well-controlled DCDA plant operating at 99.7 % SO2 conversion, the tail-gas SO2 concentration is typically 200–500 ppm — a compliant margin below state permit limits, which typically incorporate NSPS Subpart H via Title V permit conditions.

At the time of the compound adversarial attack (converter bed 1 cold-bypassed; absorber acid diluted to 96.0 %), the actual tail-gas SO2 concentration is approximately 1.3 % v/v (13,000 ppm) — a value 26–65× the typical state permit limit of 250–500 ppm SO2. The actual reading on the CEMS analyzer display is 13,000 ppm. The ±8 DN downward pixel shift on the CEMS display reduces the rendered reading to 420 ppm — within the compliance window. The EPA-certified CEMS electronic data record uploaded to the state’s ERT reports: SO2 = 420 ppm — permit compliant; no excess emission event reported; no Deviation Report (40 CFR Part 75 / state program analog) triggered. Simultaneously, area SO3/H2SO4 mist monitors at the stack base would show actual mist concentrations corresponding to 0.58 kg SO3/Mg H2SO4 — 3.9× the NSPS limit — but these readings are also subject to the compound downward attack described in surface 4 below.

4. Plant-perimeter and area SO2/SO3 monitor AI (Dräger X-am 8000 SO2 area gas detector AI / Honeywell BW MicroClip XL SO2 personal area monitor AI / Sierra Monitor FS10 SO2 area detector AI / Crowcon Gasman SO2 portable detector AI / Multi-Rae Pro SO2 perimeter monitor AI — monitoring ambient SO2 and SO3 acid mist concentration at plant fence line, absorber building, and converter building access for OSHA occupational limits and EPA fence-line ambient compliance with NAAQS SO2 primary standard 75 ppb; industrial hygiene and community health sentinel — downward-direction attack)

Plant perimeter SO2 monitors serve a dual function in H2SO4 plants: occupational safety (OSHA PEL SO2 5 ppm ceiling; ACGIH TLV-C 0.25 ppm — the most stringent occupational SO2 limit — triggers evacuation of sensitive workers including those with asthma or COPD at concentrations above 0.5 ppm), and EPA NAAQS compliance sentinel (EPA primary SO2 standard 75 ppb 1-hr average; secondary SO2 standard 500 ppb 3-hr average — community health and vegetation protection). ACGIH’s TLV-C of 0.25 ppm — 20× more protective than the OSHA PEL — reflects controlled human exposure studies from the 1980s–2000s showing measurable bronchoconstriction in exercising asthmatics at 0.25 ppm SO2 and clinically significant airway obstruction at 0.5 ppm, compared with the OSHA PEL’s 1971 basis in symptom-threshold studies of healthy adult males at rest.

At the time of the adversarial attack, ambient SO2 concentration at the plant fence line is approximately 18.6 ppm — 74× the ACGIH TLV-C and 3.7× the OSHA PEL, from a 1.3 % SO2 tail-gas plume at a 45 m stack under D-class atmospheric stability, 3 m/s crosswind, and a downwind receptor at the plant boundary. The ±8 DN downward pixel shift on the area SO2 monitor display reduces the rendered reading from 18.6 ppm to 0.4 ppm — below the ACGIH TLV-C action threshold of 0.25 ppm (the value at which sensitive workers would begin evacuation under site industrial hygiene protocols). Workers conducting routine plant perimeter inspection, sampling at the tail-gas stack base (CEMS maintenance), and performing absorber packing inspection at the plant boundary face actual SO2 exposure at 18.6 ppm — near the NIOSH IDLH 100 ppm from chronic peak excursion accumulation — with no area alarm, no evacuation signal, and no personal protective equipment upgrade triggered. Meanwhile, communities within 2–8 km downwind of the facility face ambient SO2 concentrations exceeding the EPA NAAQS primary standard of 75 ppb from the uncontrolled 1.3 % SO2 tail-gas plume, with no regulatory notification, no state environmental agency alert, and no LEPC emergency response activated — because the EPA-certified CEMS electronic record (reporting 420 ppm, below permit limit) shows apparent compliance.

The 43rd and 44th upward-direction attacks: the first emission-permit attack and the first criterion-pollutant NAAQS breach in the Glyphward portfolio

The Glyphward portfolio’s upward attack taxonomy, through the 42nd attack (N2O4 liquid bipropellant HNO3 inhibitor), has been dominated by on-site harm: worker toxic exposure beyond IDLH thresholds, explosion risk from flammable atmosphere formation or inertisation failure, undetected equipment damage, product quality failure at the customer, and sterilisation efficacy failure with patient harm. In every case, the primary adversarial consequence — the harm whose materialization the upward attack enables — occurs within the plant boundary or, in the case of supply-chain attacks, at the immediate customer site. The 43rd and 44th upward attacks on the H2SO4 contact process represent the first in which the primary adversarial consequence is atmospheric emission of a regulated air pollutant that crosses the plant boundary to affect surrounding communities and ecosystem: the first harm that materializes at the EPA fence-line and beyond.

This distinction matters because the regulatory gap it exploits is different in character from the PSM/HAZOP gap exploited by all prior attacks. OSHA PSM process hazard analysis generates worst-case and representative scenarios — high/low process variables, sensor failure modes, loss of containment — and evaluates them against on-site consequences (fire, explosion, toxic exposure to workers). EPA RMP worst-case release scenarios assess the off-site consequence of a loss-of-containment event — a tank rupture, a pipe failure, a catastrophic release of SO2 to atmosphere — and evaluate the plume dispersion distance to the toxic endpoint (ERPG-2 concentration). Neither OSHA PSM HAZOP nor EPA RMP worst-case analysis addresses the scenario in which the process plant is fully intact — no containment failure, no catastrophic release — but is continuously operating outside its design emission performance envelope because an AI adversarial attack on the absorber acid-strength analyzer has falsely confirmed optimum acid concentration. The emission exceedance in the 43rd attack is not a loss-of-containment event; it is a performance exceedance: SO3 absorption efficiency below design, emitting SO3 mist continuously at 3.9× the NSPS limit through the intended emission pathway (tail-gas stack), with the CEMS falsely confirming compliance and the process continuing to produce H2SO4 normally.

The 44th attack on the V2O5 first-bed temperature introduces the second structural novelty: the SO2 emission in this case is not an emission from a process operating at reduced efficiency but from a process where a fundamental catalytic step — first-bed SO2 conversion — is entirely absent due to cold-bypass of the catalyst, while the monitoring AI reports normal converter operation. This is distinct from a gradual deactivation or performance degradation: the first-bed V2O5 catalyst is physically intact and undamaged, and would resume full activity if the inlet temperature were raised above 415°C. The adversarial attack exploits the gap between physical catalyst state (present but cold; kinetically frozen) and monitored process state (inlet temperature within optimal range; converter operating normally as displayed). A HAZOP “temperature low at converter bed 1 inlet” deviation would identify the downstream consequences of low converter inlet temperature and specify appropriate safeguards — a low-temperature alarm, a minimum temperature interlock, or a startup preheat burner. HAZOP does not address the scenario in which the thermocouple reads accurately but the AI monitoring the DCS display of the thermocouple reading is adversarially manipulated to show a higher temperature than the thermocouple actually reports.

The compounding of attacks 43 and 44 in a single facility — diluted absorber acid (96.0 %, poor SO3 absorption) simultaneously with cold-bypassed first-bed converter (87 % overall SO2 conversion) — creates a compounded EPA NSPS violation: SO3 mist emission exceeds Subpart H limits from poor absorption efficiency; SO2 emission exceeds state permit limits and approaches EPA NAAQS 75 ppb at downwind community receptors from the 87 % conversion shortfall; and the H2SO4 mist and SO2 co-emission forms sulfate aerosol (SO4²− particulate matter) in the plume, contributing to secondary PM2.5 formation in downwind communities at distances of 10–50 km — a precursor to PM2.5 exceedance of the EPA NAAQS annual primary standard (12 μg/m³). The sulfate precursor formation from H2SO4 plant SO2 emission is precisely the mechanism that originally motivated the 1971 EPA NSPS Subpart H standard for H2SO4 plants and the Clean Air Act’s designation of SO2 as a criteria pollutant in the original 1970 NAAQS framework. Adversarial manipulation of H2SO4 plant AI monitoring is therefore not only a process safety gap but a public health and clean air regulatory gap that the adversarial testing community has not yet characterised.

ACGIH TLV‑C 0.25 ppm SO2 and the EPA NAAQS 75 ppb: the regulatory spectrum from plant worker to downwind community

Sulfur dioxide occupational and ambient exposure limits span a wider range than almost any other criterion pollutant in the Glyphward portfolio, reflecting the compound regulatory history of SO2 from its role as the defining industrial air pollutant of the 20th century. At one end: OSHA PEL 5 ppm (ceiling, 1971), derived from 1968 ACGIH TLV and unchanged in 55 years despite extensive subsequent evidence. At the other: EPA NAAQS primary SO2 standard 75 ppb (0.000075 % v/v, 1-hr average), revised downward from the 1971 original 365 ppb (24-hr) standard in 2010 based on the weight of evidence from multistep risk assessment. Between them: ACGIH TLV-C 0.25 ppm (a ceiling, not TWA); NIOSH REL 0.5 ppm (10-hr TWA); NIOSH IDLH 100 ppm. The 67-fold gap between the OSHA PEL (5 ppm) and the NAAQS primary standard (0.075 ppm) — and the 3.3-fold gap between the ACGIH TLV-C (0.25 ppm) and the NAAQS standard (0.075 ppm) — reflects the different exposure paradigms: occupational ceiling for healthy adults at a 40-hr/wk industrial worksite versus 24/7 ambient community exposure for populations including asthmatics, infants, the elderly, and individuals with cardiovascular comorbidities.

The H2SO4 plant adversarial attack scenario sits at the convergence of these regulatory limits. Within the plant boundary, workers in the absorber building, CEMS maintenance at the stack base, and catalyst bed access for converter internals inspection are exposed to SO2 at the ambient concentrations generated by the 1.3 % tail-gas SO2 plume under specific wind conditions — not the typical 200–500 ppm CEMS reading (which is measured in a contained duct at high flow velocity), but the ground-level diluted ambient concentration at the plant fence line: 18.6 ppm in the scenarios modeled above. At 18.6 ppm, ambient SO2 exceeds the OSHA PEL ceiling (5 ppm) by 3.7×, the ACGIH TLV-C (0.25 ppm) by 74×, and approaches 18.6 % of the NIOSH IDLH (100 ppm). Workers with pre-existing asthma exposed at 18.6 ppm would experience severe acute bronchospasm within minutes; workers without respiratory comorbidities would experience pronounced upper airway and lower respiratory tract irritation at 18.6 ppm, consistent with NIOSH’s threshold for “physiological effects” at 6–12 ppm SO2 for healthy adults at moderate exercise levels. The area SO2 monitor downward attack (surface 4) suppresses 18.6 ppm to 0.4 ppm, eliminating the only engineered alarm capable of alerting workers to leave the area.

The parallel gap in the OSHA PSM / EPA RMP / EPA NSPS triple-regulatory framework is structurally identical to the gap identified in every prior Glyphward blog entry: process hazard analysis, emission performance standards, and worst-case release analysis together constitute a comprehensive regulatory framework for physically plausible process failures, containment breaches, and emission exceedances. None of these frameworks includes a requirement for adversarial robustness testing of the AI systems that monitor the rendered display outputs of process sensors. The DCS reads the correct thermocouple values; the thermocouple reads the correct temperature; the absorber acid density meter reads the correct concentration. The adversarial manipulation occurs at the AI perception layer — between the sensor output as rendered on a process HMI display and the AI inference that converts that rendered image to a process state classification. This layer is invisible to HAZOP, invisible to EPA performance test methods, and invisible to CEM certification procedures. Glyphward threshold 35 applies at all H2SO4 contact process facilities holding oleum above the OSHA PSM TQ 1,000 lbs or SO2 in process above the EPA RMP TQ 500 lbs.

Integration: sulfuric acid DCDA contact process AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate between the DCS display capture layer and the AI inference pipeline for each H2SO4 contact process monitoring context. If the adversarial score meets or exceeds threshold 35 — calibrated on OSHA PSM TQ 1,000 lbs oleum, EPA RMP TQ 500 lbs SO2, EPA NSPS 40 CFR Part 60 Subpart H H2SO4 mist limit, the 43rd upward-direction absorber acid strength attack, the 44th upward-direction V2O5 first-bed temperature attack, and the first EPA emission-permit and SO2 criterion-pollutant attacks in the Glyphward industrial AI portfolio — the scan raises AdversarialH2SO4ImageError and the monitoring AI does not process the frame.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import StrEnum

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# H2SO4 DCDA contact process monitoring contexts: threshold 35
# OSHA PSM 29 CFR 1910.119 Appendix A: oleum TQ 1,000 lbs; SO2 TQ 1,000 lbs
# EPA RMP 40 CFR Part 68 Table 1: SO2 TQ 500 lbs
# EPA NSPS 40 CFR Part 60 Subpart H: H2SO4 mist ≤0.15 kg SO3/Mg H2SO4
# ACGIH TLV-C SO2 0.25 ppm / OSHA PEL 5 ppm / NIOSH IDLH 100 ppm
# EPA NAAQS primary SO2 75 ppb (1-hr) / secondary 500 ppb (3-hr)
# Absorber acid UPWARD (43rd): 96.0% w/w H2SO4 shown as 98.5% (SO3 absorption optimum)
# -> SO3 mist emission 0.58 kg/Mg H2SO4: 3.9x EPA NSPS limit 0.15 kg/Mg
# -> FIRST EPA emission-permit attack; FIRST H2SO4 production; FIRST DCDA; FIRST V2O5
# V2O5 bed-1 temperature UPWARD (44th): 392°C shown as 438°C (optimal 420–450°C)
# -> converter cold-bypassed; overall SO2 conversion 99.7%→87%; 1.3% v/v SO2 tail gas
# -> FIRST criterion-pollutant SO2 atmospheric emission attack; FIRST acid rain precursor
H2SO4_THRESHOLD = 35


class H2SO4ProcessContext(StrEnum):
    ABSORBER_ACID_STRENGTH = "absorber_acid_strength"
    V2O5_BED1_INLET_TEMPERATURE = "v2o5_bed1_inlet_temperature"
    TAIL_GAS_SO2_CEMS = "tail_gas_so2_cems"
    AREA_SO2_SO3_MONITOR = "area_so2_so3_monitor"


class AdversarialH2SO4ImageError(Exception):
    """Raised when any H2SO4 DCDA contact process monitoring image scores >= 35.
    ABSORBER_ACID_STRENGTH uncaught (43rd upward, EPA NSPS emission):
      96.0% w/w H2SO4 (SO3 absorption ~96.5%) shown as 98.5% (optimum ~99.8%).
      SO3 mist emission 0.58 kg/Mg H2SO4: 3.9x EPA NSPS Subpart H limit.
    V2O5_BED1_INLET_TEMPERATURE uncaught (44th upward, SO2 criterion pollutant):
      392°C (below V2O5 light-off ~415°C) shown as 438°C (optimal).
      Overall SO2 conversion 99.7%→87%; 1.3% v/v tail-gas SO2; NAAQS exceedance.
    TAIL_GAS_SO2_CEMS uncaught: 13,000 ppm SO2 shown as 420 ppm (permit compliant).
    AREA_SO2_SO3_MONITOR uncaught: 18.6 ppm SO2 (74x ACGIH TLV-C) shown as 0.4 ppm."""

    def __init__(self, scan_id, score, context, unit_id, flagged_region=None):
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.unit_id = unit_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial H2SO4 image: context={context} "
            f"score={score} unit={unit_id} scan_id={scan_id}"
        )


async def scan_h2so4_image(image_bytes, context, unit_id, client):
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"h2so4:{context}:{unit_id}",
        "metadata": {
            "unit_id": unit_id,
            "context": context,
            "image_sha256": image_hash,
            "scan_timestamp_utc": datetime.now(timezone.utc).isoformat(),
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()
    if result.get("score", 0) >= H2SO4_THRESHOLD:
        raise AdversarialH2SO4ImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            unit_id=unit_id,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def main():
    async with httpx.AsyncClient() as client:
        with open("absorber_acid_density_analyzer.png", "rb") as f:
            image_bytes = f.read()
        result = await scan_h2so4_image(
            image_bytes,
            H2SO4ProcessContext.ABSORBER_ACID_STRENGTH,
            unit_id="H2SO4-DCDA-FINAL-ABSORBER-ACID-STRENGTH",
            client=client,
        )
        print(f"Clean scan: {result['scan_id']} score={result['score']}")


asyncio.run(main())

Frequently asked questions