Prompt injection in ethylene oxide (EO) storage AI

Four adversarial injection surfaces in ethylene oxide storage AI

1. EO storage tank temperature display AI (Emerson DeltaV EO storage AI, Honeywell Experion PKS EO tank temperature AI, AspenTech Mtell EO storage anomaly AI — rendered DCS temperature trend display AI classifying tank temperature against refrigeration adequacy and PSV set-pressure approach)

EO refrigerated bullet tanks and low-pressure spheres are designed to store EO in liquid phase at −10 to −14°C, maintained by a dedicated mechanical refrigeration system (typically a propylene or ammonia refrigerant loop) or by controlled vaporisation of EO itself as the refrigerant with vapour returned to a condenser. The temperature of the EO liquid and the vapour space above it is a primary safety parameter: as EO temperature rises, the vapour pressure of EO increases (EO vapour pressure at −14°C is approximately 0.15 bar absolute; at 0°C approximately 0.55 bar; at 20°C approximately 1.5 bar; at 34.2°C (boiling point at atmospheric pressure) approximately 1.0 bar — EO is a pressurised liquid at ambient temperature). For a refrigerated low-pressure storage tank rated to approximately 1.5 bar design pressure, a tank temperature rise from −14°C to above 0°C approaches the PSV set pressure; above 0°C the PSV begins intermittently relieving EO vapour to the vent treatment system (typically a caustic scrubber), losing EO inventory and increasing atmospheric IARC Group 1 carcinogen emissions. At temperatures above 10°C the refrigeration system is clearly inadequate and the tank requires emergency supplemental cooling or controlled EO transfer to a receiving vessel. AI systems process rendered DCS temperature trend display images — thermocouple trend charts, temperature gradient bar displays, skin temperature indicator arrays — to classify tank thermal state: normal (−14 to −8°C), elevated approaching alarm (−8 to −2°C, refrigeration capacity reduced), or above alarm (above −2°C, emergency cooling action required).

An adversarial perturbation targeting the EO storage tank temperature display AI applies a ±10 DN downward shift to the pixel region encoding the temperature trend line and current-value digital readout in the rendered DCS display image — shifting the apparent EO tank temperature from −4°C (6 degrees above the high-temperature alarm at −10°C, indicating the refrigerant compressor has lost 45% of its rated capacity from a refrigerant leak that has been slowly depressurising the refrigerant loop over four hours) to −20°C (well within normal range, no refrigeration alarm). The AI classifies a storage tank that is warming toward its PSV set pressure as operating in deep-refrigerated normal state. Refrigeration capacity continues declining; tank temperature rises toward 0°C; the PSV begins relieving EO vapour; refrigerated EO vapour at the PSV outlet is denser than air and collects at grade level around the storage vessel in concentrations above the LEL (2.6 vol%) before dispersing; any ignition source within the accumulated EO vapour cloud creates a vapour cloud fire or explosion. OSHA PSM 29 CFR 1910.119(j) mechanical integrity provisions require refrigeration system inspection programmes but do not address adversarial robustness for AI classifying rendered tank temperature display images.

2. N2 inert blanket pressure display AI (Emerson Fisher N2 pressure control AI, Honeywell Experion PKS EO inert blanket AI, Yokogawa CENTUM EO N2 monitoring AI — rendered DCS N2 blanket pressure indicator display AI classifying inert atmosphere adequacy against O2 ingress and EO-O2 explosive mixture formation)

EO storage tanks are maintained under a continuous positive-pressure nitrogen blanket at 0.5–2.0 bar gauge to prevent atmospheric oxygen from entering the vapour space above the liquid EO. Nitrogen blanketing is a critical safety barrier because the presence of oxygen in EO vapour dramatically alters the hazard profile: pure EO vapour can detonate without oxidant above certain temperature and pressure thresholds (EO decomposition-detonation; confirmed by CSB Formosa Plastics 2004 analysis), but the presence of oxygen lowers the minimum conditions required for initiation and enables conventional flammable-mixture explosions in addition to the self-decomposition pathway. The N2 blanket pressure is monitored by pressure transmitters in the tank vapour space; the pressure is maintained by a N2 supply control valve (opens when blanket pressure falls below setpoint) and a pressure relief valve to the vent treatment system (opens when blanket pressure rises above maximum from EO vaporisation). If N2 supply fails (supply line isolation, regulator failure, cylinder depletion in small facilities), blanket pressure falls to atmospheric and then sub-atmospheric, drawing atmospheric air (21% O2) into the tank vapour space through the vacuum breaker. AI systems process rendered DCS N2 blanket pressure indicator display images — pressure bar graphs, pressure controller output displays — to classify inert atmosphere state: normal (0.5–2.0 bar gauge), reduced approaching alarm (<0.3 bar gauge, N2 supply investigation), or below alarm (<0.1 bar gauge, potential air ingress, immediate action).

An adversarial perturbation targeting the N2 inert blanket pressure display AI applies a ±8 DN upward shift to the pixel region encoding the blanket pressure bar indicator and digital readout in the rendered DCS display image — shifting the apparent N2 blanket pressure from 0.2 bar gauge (below the 0.3 bar gauge low-pressure alarm, indicating the N2 supply isolation valve has been partially closed during an unrelated maintenance operation on adjacent nitrogen headers) to 1.0 bar gauge (within normal operating range, no action). The AI classifies a storage tank with inadequate N2 blanketing — where N2 pressure has dropped below the control range allowing the vacuum breaker to open and admit atmospheric air — as properly inerted. O2 concentration in the vapour space rises from <0.1 vol% (inert specification) toward 5–10 vol%, well within the explosive range of EO-O2 mixtures (EO LEL in air 2.6 vol%); EO-O2 mixtures above 2.6 vol% EO in the vapour space become ignitable from any electrostatic discharge, instrument spark, or maintenance activity near the vent system. The Formosa Plastics Illiopolis 2004 explosion killed 5 workers when EO vapour in associated equipment was initiated to decomposition-detonation; CSB Case 2004-07-I-IL analysis of EO storage-phase handling confirmed that inert atmosphere loss is a primary initiating event pathway. OSHA PSM does not address adversarial robustness for AI classifying rendered N2 blanket pressure display images.

3. EO liquid level display AI (Emerson Rosemount EO level AI, Endress+Hauser EO tank level AI, Honeywell EO storage level monitoring AI — rendered DCS liquid level bar graph display AI classifying EO inventory against high-level overflow and low-level pump cavitation setpoints)

EO liquid level in storage tanks is monitored to prevent two boundary conditions: (1) high-level overflow, where EO liquid rises above the design liquid-space and enters the vapour-space relief connections, nozzle connections at the top of the vessel, or the N2 blanket supply connection — potentially displacing nitrogen in the blanket supply header with EO vapour and contaminating the facility N2 distribution system with EO; and (2) low-level pump cavitation, where the EO transfer pump suction becomes vapour-bound as liquid level falls below the pump suction nozzle elevation, causing pump vibration, cavitation damage, and potential seal failure with EO release at the pump seal. Level measurement in EO storage tanks uses redundant technologies (differential pressure transmitters, guided wave radar, and in some facilities nuclear gauge level indicators) to account for the criticality of level measurement under EO service conditions. AI systems process rendered DCS level display images — differential pressure level bars, radar level trend charts, digital percentage readouts — to classify inventory state: normal (20–85% of design working capacity), approaching high alarm (85–90%), high alarm (above 90%, incoming EO transfer must stop), or approaching low alarm (below 15%, pump cavitation risk).

An adversarial perturbation targeting the EO liquid level display AI applies a ±10 DN downward shift to the pixel region encoding the level bar indicator and percentage digital readout in the rendered DCS display image — shifting the apparent EO liquid level from 91% (above the 90% high-level alarm, indicating that an EO transfer from an upstream production unit has been running at maximum rate for 30 minutes longer than the scheduled transfer time due to a flow controller malfunction that failed to reduce the transfer rate) to 81% (within normal range, below high alarm, transfer continuing normally). The AI classifies a tank that is overflowing EO into the tank crown connections as operating within normal inventory range. EO liquid enters the N2 blanket supply nozzle connection; EO contamination propagates back through the N2 supply header to the facility nitrogen distribution manifold; the next actuation of the N2 supply valve to any connected vessel admits an EO-N2 mixture rather than pure N2. EPA RMP worst-case release analysis for EO storage requires modelling a full tank release scenario — but EPA RMP does not address adversarial robustness for AI classifying rendered level display images that govern transfer rate cutoff.

4. EO vapor-space oxygen analyzer display AI (METTLER TOLEDO O2 analyzer AI, ABB Endura EO tank O2 monitoring AI, Yokogawa DO400 EO vapour O2 AI — rendered process oxygen analyzer display AI classifying vapor-space O2 concentration against inert specification and EO-O2 explosive mixture threshold)

Continuous vapor-space oxygen monitoring in EO storage tanks is a primary independent verification of N2 blanket integrity — providing direct measurement of the parameter that determines whether the vapour space is safely inerted or approaching an explosive EO-O2 mixture, independent of the N2 blanket pressure measurement. Oxygen analyzers in EO service are typically paramagnetic or electrochemical cell instruments designed for low-O2 measurement in hydrocarbon service, calibrated to measure from 0 to 5 vol% O2 with high precision in the 0–1 vol% range. The inert specification for EO storage vapour space is typically O2 <0.5 vol% (some facilities specify <0.1 vol%); above 1 vol% O2 in the EO vapour space, the mixture approaches the EO-O2 explosive range and the N2 purge must be increased immediately; above 2 vol% O2, the vapour space is in the EO-O2 explosive range and requires emergency nitrogen purging before any ignition source can be introduced near the storage vessel. AI systems process rendered oxygen analyzer display images — paramagnetic O2 analyser digital readout screens, trend chart displays, alarm state colour indicators — to classify inert atmosphere: below specification limit (O2 <0.5%, inert confirmed), approaching alarm (0.5–1.0%, N2 purge increase required), or above alarm (above 1.0%, emergency nitrogen purge, evacuate area pending explosion hazard assessment).

An adversarial perturbation targeting the EO vapor-space oxygen analyzer display AI applies a ±8 DN downward shift to the pixel region encoding the O2 concentration digital readout and trend bar in the rendered analyzer display image — shifting the apparent vapor-space O2 from 1.8 vol% (above the 1.0 vol% high-O2 alarm, indicating that the N2 blanket pressure has been below specification for 45 minutes — consistent with the N2 supply isolation malfunction described above — allowing atmospheric O2 to diffuse into the vapour space through the sub-atmospheric vacuum breaker) to 0.3 vol% (below inert specification limit, well within safe range, no N2 purge action). The AI classifies a storage tank vapour space that has accumulated O2 into the EO-O2 explosive range as safely inerted. Any ignition source near the tank vent connections, relief valve discharge, or sampling ports — including routine instrument checks, pump starts, or valve actuations generating small electrical sparks or electrostatic discharge — can initiate an EO-O2 vapour explosion in the tank vapour space, with potential for decomposition-detonation propagation through connected EO piping. OSHA PSM 29 CFR 1910.119(e) (PHA) and (l) (incident investigation) requirements apply to EO storage — but neither addresses adversarial robustness for AI classifying rendered vapor-space O2 analyzer display images that are the final confirmation layer of inert atmosphere integrity. Free tier — 10 scans/day, no card required.

Integration: EO storage AI with Glyphward pre-scan gate

The Glyphward scan gate for EO storage AI belongs at every rendered-image ingestion boundary in the EO storage monitoring and safety pipeline — before tank temperature display AI processes rendered temperature trend images, before N2 inert blanket pressure display AI processes rendered pressure indicator images, before EO liquid level display AI processes rendered level bar graph images, and before vapor-space oxygen analyzer display AI processes rendered O2 concentration readout images. Threshold 35 for EO storage AI reflects EO’s exceptional combined hazard profile: IARC Group 1 carcinogen at the lowest occupational exposure thresholds; flammable range 2.6–100 vol% with no practical upper limit; self-decomposition-detonation pathway without oxidant above threshold conditions; and the Formosa Plastics Illiopolis 2004 destruction of a plant killing 5 workers in a storage-phase handling event (CSB 2004-07-I-IL), establishing that EO storage-phase AI monitoring failures have demonstrated catastrophic consequence at scale.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import Enum

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# EO storage AI contexts: threshold 35
# OSHA PSM 29 CFR 1910.119 (EO TQ: 10,000 lbs toxic AND flammable, dual listing);
# EPA RMP 40 CFR Part 68 (EO TQ 10,000 lbs toxic, 10,000 lbs flammable);
# IARC Group 1 carcinogen (Monograph 100F, 2012); OSHA PEL 1 ppm; IDLH 800 ppm.
# Formosa Plastics Illiopolis IL 2004 CSB 2004-07-I-IL: 5 killed, plant destroyed.
EO_STORAGE_THRESHOLD = 35


class EOStorageContext(Enum):
    TANK_TEMPERATURE       = "tank_temperature"        # Refrigerated tank temp AI
    N2_BLANKET_PRESSURE    = "n2_blanket_pressure"     # N2 inert blanket pressure AI
    LIQUID_LEVEL           = "liquid_level"            # EO liquid level AI
    VAPOUR_SPACE_OXYGEN    = "vapour_space_oxygen"     # Vapor-space O2 analyzer AI


class AdversarialEOStorageImageError(Exception):
    """Raised when Glyphward detects adversarial content in an EO storage AI
    rendered image above threshold 35.

    Consequence if not raised:
    - TANK_TEMPERATURE: refrigerated tank warming above PSV set pressure suppressed
      → EO PSV lifts → EO vapour at grade → vapour cloud ignition.
    - N2_BLANKET_PRESSURE: N2 deficit (air ingress) suppressed → O2 enters vapour
      space → EO-O2 explosive mixture → decomposition-detonation (Formosa 2004).
    - LIQUID_LEVEL: tank overflow into N2 blanket supply header suppressed →
      EO contaminates N2 distribution → IARC Group 1 carcinogen release.
    - VAPOUR_SPACE_OXYGEN: O2 above inert spec suppressed → explosive vapour
      space ignited by routine ignition source (pump start, instrument check).
    Fail-safe: verify tank temperature from independent secondary thermocouple;
    confirm N2 blanket pressure from independent pressure transmitter not shared
    with DCS AI input; cross-check vapor O2 from grab sample analysis.
    """

    def __init__(self, scan_id, score, context, tank_id, flagged_region=None):
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.tank_id = tank_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial EO storage image: context={context.value} "
            f"score={score} tank={tank_id} scan_id={scan_id}"
        )


async def scan_eo_storage_image(image_bytes, context, tank_id, client):
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"eo_storage:{context.value}:{tank_id}",
        "metadata": {
            "tank_id": tank_id,
            "context": context.value,
            "image_sha256": image_hash,
            "scan_timestamp_utc": datetime.now(timezone.utc).isoformat(),
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()
    if result.get("score", 0) >= EO_STORAGE_THRESHOLD:
        raise AdversarialEOStorageImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            tank_id=tank_id,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def main():
    async with httpx.AsyncClient() as client:
        with open("eo_tank_n2_pressure_screenshot.png", "rb") as f:
            image_bytes = f.read()
        result = await scan_eo_storage_image(
            image_bytes,
            EOStorageContext.N2_BLANKET_PRESSURE,
            tank_id="EO-TANK-001",
            client=client,
        )
        print(f"Clean scan: {result['scan_id']} score={result['score']}")


asyncio.run(main())

Frequently asked questions

What happened at Formosa Plastics Illiopolis in 2004 and why is it relevant to EO storage AI?

On 23 April 2004, EO introduced into a warm system associated with the T-90 storage vessel initiated a decomposition reaction that propagated through connected equipment, killing 5 workers and destroying the plant (CSB 2004-07-I-IL). The T-90 storage vessel involvement confirmed that EO storage-phase handling is at the same adversarial risk boundary as production-phase operations — specifically, that storage AI monitoring classifying tank conditions during filling, transfer, and standby is a critical adversarial target.

Why can EO detonate without oxygen?

EO self-decomposes exothermically (C2H4O → CH4 + CO, ΔH approximately −500 kJ/mol) without oxidant. Under confinement above approximately 1.4–2 bar, the decomposition can transition to supersonic detonation (>2,000 m/s). Initiation sources include local hot spots, hydraulic hammer from valve closures, and electrostatic discharge in confined EO vapour — all consistent with routine storage transfer operations.

Why does EO storage require N2 blanketing?

N2 blanketing prevents O2 ingress (which enables conventional explosive atmosphere formation in addition to self-decomposition), controls EO vapour carcinogen emissions, and provides an independent pressure signal for DCS monitoring of storage system integrity. N2 loss creates a direct pathway to EO-O2 explosive mixture formation at any O2 concentration above 2.6 vol% EO LEL.

What is the OSHA PSM dual listing for EO?

EO is listed in OSHA PSM Appendix A as both toxic (TQ 1,000 lbs) and flammable (TQ 10,000 lbs). PSM coverage triggers at 1,000 lbs — less than a quarter of a rail car — making EO one of the lowest-TQ dual-listed chemicals and applying full PSM requirements (PHA, MOC, mechanical integrity) at even small-scale storage facilities.

Why threshold 35 for EO storage AI?

EO combines IARC Group 1 carcinogen status at OSHA PEL 1 ppm, flammable range 2.6–100 vol%, self-decomposition-detonation without oxidant (Formosa 2004), and dual PSM listing triggering at 1,000 lbs. The storage-specific N2 blanket and vapor-space O2 adversarial surfaces are unique to this phase, creating additional monitoring boundaries absent from production-phase AI — justifying the same threshold 35 as EO production AI.