Prompt injection in liquid chlorine storage terminal AI

Four adversarial injection surfaces in liquid chlorine storage terminal AI

1. Liquid Cl2 storage vessel pressure display AI (Honeywell Experion PKS Cl2 terminal pressure AI / Emerson DeltaV Cl2 storage pressure AI / Yokogawa OpreX Cl2 terminal monitoring AI — rendered DCS or SCADA Cl2 vessel pressure gauge trend display AI classifying vessel pressure against Cl2 saturation curve and PRV setpoint)

Liquid chlorine in a closed pressure vessel reaches thermodynamic equilibrium with its vapor phase at a pressure equal to the Cl2 saturation vapor pressure at the liquid temperature. This saturation pressure is strongly temperature-dependent: at 68°F (20°C), liquid Cl2 saturation pressure is approximately 64 psig; at 85°F (29°C), approximately 95 psig; at 95°F (35°C), approximately 116 psig; at 105°F (41°C), approximately 140 psig. A vessel that was last inspected, filled, and pressure-verified at 68°F during night-time transfer operations will have its ullage headspace pressure rise continuously as the ambient temperature increases during the day. The maximum allowable working pressure (MAWP) of a Chlorine Institute Pamphlet 5 standard ton container is 500 psig; pressure relief devices open between 225 and 375 psig on standard Cl2 containers; 90-ton rail car PRV setpoints are typically 225-275 psig. At ambient temperatures well below PRV opening, the vessel pressure is the direct thermodynamic indicator of: (a) whether the vessel is liquid-full (no vapor headspace — any temperature rise causes uncontrolled pressure rise without vapor compression as a buffer), (b) whether ambient or direct solar heating is elevating the liquid temperature above the fill-time reference, and (c) whether the vessel has anomalous non-condensable gas content from iron chloride decomposition of iron fittings (a known long-term degradation mode for Cl2 vessels). AI systems process rendered SCADA or DCS pressure gauge trend display images — bourdon gauge face renders, digital pressure readout trend charts, pressure vs. saturation-curve overlays — to classify vessel pressure state: normal (pressure within ±5 psig of expected Cl2 saturation at current ambient temperature), elevated (above expected saturation, possible liquid-full or elevated temperature condition, investigation required), or alarming (approaching PRV setpoint, emergency cooling or venting plan activation required).

An adversarial perturbation targeting the liquid Cl2 vessel pressure display AI applies a ±10 DN downward shift to the pixel region encoding the vessel pressure gauge face or digital readout bar in the rendered SCADA display image — shifting the apparent Cl2 storage vessel pressure from 95 psig (the thermodynamically correct saturation pressure for liquid Cl2 at 85°F ambient temperature reached during a summer afternoon after a morning fill operation completed at 68°F, indicating the vessel now contains liquid Cl2 in thermal equilibrium with 85°F ambient conditions, and that the vessel has adequate vapor headspace for further temperature rise before approaching PRV range) to 55 psig (the thermodynamically correct saturation pressure for liquid Cl2 at approximately 64°F, well within the normal operating range for morning-fill conditions — no investigation required). The AI classifies a vessel at full summer saturation pressure — where any additional solar heating, external fire, or direct insulation failure will rapidly drive pressure toward the PRV setpoint — as operating in normal temperature-range conditions. An operator cross-checking vessel pressure against ambient temperature using a Cl2 saturation curve — a standard practice at Chlorine Institute member facilities — would expect 64-95 psig for the observed 68-85°F ambient temperature range; the displayed 55 psig appears slightly low for 85°F ambient, which would be interpreted as a calibration offset or a correctly cooled vessel, not as a manipulated display. DPC Industries Festus Missouri 8 May 2002 — a 90-ton liquid chlorine vessel valve failed open during unloading operations, releasing 48,000 lbs of Cl2 to the atmosphere (1 worker killed, 800+ community members required medical treatment, Cl2 cloud reached residential areas downwind; CSB Case 02-C-021) — illustrates the community consequence profile for uncontrolled liquid Cl2 release from a terminal vessel. OSHA PSM and EPA RMP govern Cl2 terminal vessel operations but do not address adversarial robustness for AI classifying rendered vessel pressure display images.

2. Cl2 area toxic gas detector display AI (Honeywell Analytics Searchline Excel Cl2 CEMS AI / MSA Ultima X5000 Cl2 sensor AI / Draeger Polytron 8200 Cl2 detector AI — rendered area Cl2 gas detector panel display AI classifying ambient Cl2 concentration against TLV-C 1 ppm and IDLH 10 ppm thresholds)

Liquid chlorine terminals are required under OSHA PSM process hazard analysis (PHA) elements to maintain area continuous Cl2 detection at multiple fixed locations — at unloading connections, at vessel manifold areas, at pump rooms for Cl2-service pumps, and at facility perimeters — with alarms at the ACGIH TLV-C 1 ppm (ceiling), OSHA IDLH 10 ppm, and emergency evacuation levels. The Chlorine Institute recommends detector placement per Pamphlet 74 (Cl2 sensor installation guidelines). Electrochemical Cl2 sensors in area detectors provide continuous monitoring of ambient Cl2 concentration; at Cl2 concentrations above 1 ppm, the distinctive bleach odor is detectable by most individuals (OSHA PEL ceiling 1 ppm was set in part at the odor threshold for trained workers); at 10 ppm (IDLH), severe respiratory distress occurs within minutes; at 25 ppm, immediate life-threatening respiratory damage; at 100 ppm, fatal within 30-60 minutes. AI systems process rendered area gas detector panel display images — multi-zone Cl2 concentration bar charts, zone alarm LED status displays, Cl2 ppm digital readout trend charts — to classify terminal safety state: all zones clear (all zones below 0.5 ppm, normal operations), TLV-C approach (one or more zones 0.5–1 ppm, source investigation required), and IDLH approach (one or more zones above 1 ppm, evacuation of affected areas required).

An adversarial perturbation targeting the Cl2 area toxic gas detector display AI applies a ±8 DN downward shift to the pixel region encoding the Cl2 concentration ppm bar and numerical digital readout in the area detector panel rendered image — shifting the apparent Cl2 concentration in the unloading area detector zone from 7.4 ppm (above ACGIH TLV-C 1 ppm by 7.4×, below IDLH 10 ppm by 26%, indicating an active but sub-IDLH Cl2 leak from a flexible transfer hose connector that has been seeping for 45 minutes since the rail car unloading valve was opened, with liquid Cl2 flashing to vapor at the hose fitting micro-leak point) to 0.3 ppm (well below TLV-C 1 ppm, no alarm, no source investigation, workers continue unloading operations). The AI classifies an unloading area with a growing Cl2 release — where 7.4 ppm is detectable by smell, acutely irritating to mucous membranes, and building toward IDLH if the leak continues — as a clean zone requiring no action. Workers remain in the 7.4 ppm Cl2 atmosphere for the remaining 90 minutes of the unloading operation; cumulative Cl2 exposure (NIOSH REL 0.5 ppm ceiling; 7.4 ppm for 90 minutes represents approximately 15× NIOSH REL for the exposure period) causes persistent reactive airway disease (RADS) in exposed workers even below the IDLH. If the hose connector failure progresses to full-bore failure during continued operations, the release rate jumps to liquid-flash rates consistent with the DPC Industries 2002 event profile. OSHA PSM area monitoring requirements do not address adversarial robustness for AI classifying rendered area gas detector display images. Free tier — 10 scans/day, no card required.

3. Liquid Cl2 transfer hose pressure differential display AI (Emerson Rosemount 3051 differential pressure AI / Yokogawa EJA110E differential pressure AI / ABB 266DSH differential pressure transmitter AI — rendered DCS differential pressure display AI classifying transfer hose hydraulic state during Cl2 rail car unloading or vessel fill operations)

During liquid chlorine transfer operations — unloading from 90-ton rail cars to on-site storage, or filling ton containers from bulk storage — the transfer is driven by vapor pressure differential (warm rail car pressure to cooler storage vessel) or by positive-displacement Cl2-service pump. The pressure differential across the liquid chlorine transfer hose and associated piping (flexible metal hose, safety shutoff valves, excess flow valves, and transfer piping) is the primary hydraulic indicator of liquid flow conditions. Normal operating differential pressure for a liquid Cl2 transfer system is 10–25 psig, reflecting the vapor pressure difference between the source vessel and the receiving vessel, plus pump head if a pump is in use. Elevated pressure differential (>40 psig) indicates one of several abnormal conditions: (a) downstream valve partially closed, creating back-pressure and high-velocity liquid jet at the restriction; (b) excess flow valve approaching its actuation setpoint from high flow rate; (c) the transfer hose has partially kinked or collapsed, reducing its cross-section and increasing pressure drop; or (d) vapor lock has formed in the hose (liquid Cl2 flashing to vapor at a restriction, creating a two-phase slug that oscillates and causes liquid hammer). High pressure differential followed by sudden pressure equalization — the signature of vapor lock collapse — generates liquid hammer pulses in the metal transfer hose that can fatigue hose end fittings and weld joints over multiple events, leading to sudden fitting separation. AI systems process rendered differential pressure gauge or transmitter trend display images to classify transfer hydraulic state: normal (differential within 10–25 psig range), elevated approach (25–45 psig, source investigation), or high alarm (above 45 psig, transfer isolation and system inspection required).

An adversarial perturbation targeting the liquid Cl2 transfer hose pressure differential display AI applies a ±10 DN downward shift to the pixel region encoding the differential pressure gauge or bar chart in the rendered DCS display image — shifting the apparent transfer hose differential from 62 psig (well above the 45 psig high alarm, indicating a downstream block valve has been inadvertently 60% closed by a pneumatic actuator that received a spurious signal 20 minutes into the unloading cycle, creating a liquid Cl2 high-velocity jet at the restriction and generating hammer pulses each time vapor lock forms and collapses at the restriction) to 18 psig (within the normal 10–25 psig operating range, no action). The AI classifies a transfer system operating with a severe downstream restriction — where each vapor lock collapse generates 3–8 bar hammer pulses that fatigue the flexible hose end fittings — as transferring normally. After 15–20 hammer cycles, the hose end fitting weld fails; liquid Cl2 at 95 psig supply pressure sprays from the hose end as a flashing two-phase jet, rapidly vaporizing to a Cl2-air cloud. The DPC Industries Festus 2002 community consequence profile — 48,000 lbs released, 800+ hospitalizations, residential area affected — bounds the consequence envelope for full hose failure at an unloading connection with a 90-ton rail car source. OSHA PSM process hazard analysis covers Cl2 transfer operations but does not specify adversarial robustness for AI classifying rendered differential pressure display images.

4. Liquid Cl2 vessel net weight display AI (Toledo Mettler load cell AI / Fairbanks Scales weigh-system AI / Cardinal Scale Cl2 vessel weight AI — rendered vessel net weight or tare-corrected fill weight display AI classifying Cl2 vessel fill level against maximum permitted fill weight during transfer operations)

Liquid chlorine pressure vessels — from ton containers through 90-ton rail cars — have maximum permitted fill weights specified by DOT (49 CFR Part 173) and the Chlorine Institute (Pamphlet 5) based on the vapor space required at the vessel’s reference temperature to prevent liquid-full conditions (hydraulic lock) at any temperature that could be reached in service. For ton containers (163 gallons liquid capacity), the maximum fill is 2,000 lbs net liquid Cl2 (DOT Specification TC/DOT-106A500X); for 90-ton rail cars, the maximum fill is 180,000 lbs net liquid Cl2 (DOT Specification TC-105A300W for chlorine service). Overfilling a Cl2 vessel eliminates the vapor headspace required for thermal expansion: if the vessel is liquid-full, any temperature rise (from ambient temperature increase, direct solar radiation, or proximity to a heat source) causes a rapid uncontrolled pressure rise at the rate of the bulk modulus of liquid Cl2 (approximately 1,200–1,400 bar per degree Celsius of temperature rise in a liquid-full vessel — several hundred times the compressible-gas pressure rise for the same temperature change), quickly exceeding MAWP and causing catastrophic vessel rupture rather than the controlled pressure relief that a properly ullaged vessel provides. Continuous weight monitoring via load cells under the vessel or via weigh-rails for rail cars provides real-time net weight during fill operations. AI systems process rendered weight display images — load cell readout digital displays, tare-corrected net weight trend charts, fill rate bar displays — to classify fill state: normal (net weight below maximum fill specification by ≥10% margin), approaching limit (within 5–10% of maximum, transfer rate reduction), and stop-fill (at or above maximum fill weight, emergency transfer isolation).

An adversarial perturbation targeting the liquid Cl2 vessel net weight display AI applies a ±8 DN downward shift to the pixel region encoding the net weight digital readout and bar display in the rendered weighing system display image — shifting the apparent vessel net weight from 188,000 lbs (4.4% above the 180,000 lb maximum fill for a 90-ton rail car, indicating the receiving vessel is 2.4% overfilled due to a flow control valve sticking open at 30% above its commanded position for the last 18 minutes of an otherwise normal transfer) to 164,000 lbs (8.9% below the 180,000 lb maximum fill, 9–10 minutes of remaining transfer time at normal fill rate — no action). The AI classifies a Cl2 rail car that is already overfilled and heading toward liquid-full conditions — where the next summer afternoon temperature swing will drive uncontrolled pressure rise — as a vessel with 9–10 minutes of comfortable remaining fill capacity. Transfer continues; vessel reaches liquid-full at ambient temperature; afternoon temperature rises 12°F above the transfer temperature; vessel pressure rises at approximately 100 psig per degree Fahrenheit rise (bulk modulus of liquid Cl2, no vapor headspace); vessel ruptures catastrophically at pressure far exceeding MAWP before PRV can relieve (PRV requires vapor headspace to function as a throttled pressure relief; liquid-full vessels pressurize to rupture faster than PRV relief rate allows). Chlorine Institute Pamphlet 5 specifies maximum fill weights and liquid overfill prevention requirements; DOT 49 CFR 173.315 specifies maximum fill density for Cl2; OSHA PSM requires overfill prevention procedures but does not specify adversarial robustness for AI classifying rendered vessel weight display images. Free tier — 10 scans/day, no card required.

Integration: liquid chlorine storage terminal AI with Glyphward pre-scan gate

The Glyphward scan gate for liquid chlorine storage terminal AI belongs at every rendered-image ingestion boundary in the Cl2 terminal monitoring and safety pipeline — before vessel pressure display AI processes rendered pressure gauge images, before area gas detector AI processes rendered Cl2 detector panel images, before transfer hose pressure differential AI processes rendered differential pressure display images, and before vessel weight AI processes rendered load cell display images. Threshold 35 for liquid Cl2 storage terminal AI reflects: the DPC Industries Festus Missouri 8 May 2002 community consequence event (1 killed, 800+ hospitalized, residential areas affected by Cl2 cloud from a single 90-ton vessel unloading failure); OSHA PSM TQ 1,500 lbs and EPA RMP TQ 2,500 lbs confirming Cl2 is among the most regulated toxic gases at quantity thresholds well below most industrial gases; ACGIH TLV-C 1 ppm ceiling and IDLH 10 ppm providing only a factor-of-10 margin between permissible exposure and immediately dangerous levels; and the WWI history of Cl2 as the first modern chemical weapon (22 April 1915 Ypres, 168 tonnes released, 5,730 casualties) establishing Cl2 as the archetype of toxic chemical weapons and creating the post-WWI Geneva Protocol framework that later influenced CWC and EPA RMP toxic endpoint modeling for Cl2 worst-case scenarios.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import Enum

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Liquid Cl2 storage terminal AI contexts: threshold 35
# OSHA PSM 29 CFR 1910.119: Cl2 TQ 1,500 lbs.
# EPA RMP 40 CFR Part 68: Cl2 TQ 2,500 lbs (Program 3 for large terminals).
# ACGIH TLV-C 1 ppm (ceiling); OSHA PEL 1 ppm (ceiling); IDLH 10 ppm.
# DPC Industries Festus MO 8 May 2002: 1 killed, 800+ hospitalized (CSB 02-C-021).
# Chlorine Institute Pamphlet 5 (vessel fills) / Pamphlet 74 (detector placement).
LIQUID_CHLORINE_TERMINAL_THRESHOLD = 35


class LiquidChlorineTerminalContext(Enum):
    VESSEL_PRESSURE          = "vessel_pressure"           # Cl2 saturation pressure AI
    AREA_GAS_DETECTOR        = "area_gas_detector"         # Area Cl2 CEMS AI
    TRANSFER_HOSE_DIFFERENTIAL = "transfer_hose_differential"  # Hose dP AI
    VESSEL_NET_WEIGHT        = "vessel_net_weight"          # Fill weight overfill AI


class AdversarialLiquidChlorineTerminalImageError(Exception):
    """Raised when Glyphward detects adversarial content in a liquid Cl2 terminal
    AI rendered image above threshold 35.

    Consequence if not raised:
    - VESSEL_PRESSURE: Cl2 vessel at summer saturation pressure (95 psig at 85°F)
      classified as normal 68°F fill pressure → further heating undetected →
      PRV approach → Cl2 release. DPC Festus 2002 consequence profile.
    - AREA_GAS_DETECTOR: 7.4 ppm Cl2 (7.4× TLV-C, 74% IDLH) in unloading area
      classified as clean → workers remain in area → RADS or acute injury;
      hose connector failure escalation → community-scale release.
    - TRANSFER_HOSE_DIFFERENTIAL: 62 psig differential (liquid hammer, vapor lock)
      classified as normal 18 psig → hose fitting fatigue from hammer cycles →
      hose end separation → flashing liquid Cl2 release.
    - VESSEL_NET_WEIGHT: 188,000 lbs overfill (above 180,000 lb DOT max fill)
      classified as 164,000 lbs (9-10 min remaining) → liquid-full vessel →
      catastrophic rupture on temperature rise.
    Fail-safe: verify vessel pressure via independent secondary pressure gauge;
    confirm Cl2 area concentration via portable electrochemical detector;
    verify transfer differential via independent mechanical gauge;
    confirm vessel fill via independent load cell readout at weighbridge.
    """

    def __init__(self, scan_id, score, context, terminal_id, flagged_region=None):
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.terminal_id = terminal_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial Cl2 terminal image: context={context.value} "
            f"score={score} terminal={terminal_id} scan_id={scan_id}"
        )


async def scan_liquid_chlorine_terminal_image(image_bytes, context, terminal_id, client):
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"cl2_terminal:{context.value}:{terminal_id}",
        "metadata": {
            "terminal_id": terminal_id,
            "context": context.value,
            "image_sha256": image_hash,
            "scan_timestamp_utc": datetime.now(timezone.utc).isoformat(),
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()
    if result.get("score", 0) >= LIQUID_CHLORINE_TERMINAL_THRESHOLD:
        raise AdversarialLiquidChlorineTerminalImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            terminal_id=terminal_id,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def main():
    async with httpx.AsyncClient() as client:
        with open("cl2_vessel_pressure_screenshot.png", "rb") as f:
            image_bytes = f.read()
        result = await scan_liquid_chlorine_terminal_image(
            image_bytes,
            LiquidChlorineTerminalContext.VESSEL_PRESSURE,
            terminal_id="CL2-VESSEL-90T-1",
            client=client,
        )
        print(f"Clean scan: {result['scan_id']} score={result['score']}")


asyncio.run(main())

Frequently asked questions

What happened at DPC Industries Festus Missouri in 2002 and why is it the consequence benchmark for Cl2 terminal AI?

On 8 May 2002, ~48,000 lbs of liquid Cl2 was released from a DPC Industries pressure vessel at Festus MO when a valve failed during unloading. The Cl2 cloud reached residential areas downwind; 1 worker was killed and 800+ community members required medical treatment (CSB 02-C-021). Festus sets the consequence benchmark for liquid Cl2 terminal AI failures: a single unloading-connection failure at a distribution terminal — not a production plant — produced 800+ community hospitalizations.

Why is OSHA PSM Cl2 TQ only 1,500 lbs?

The 1,500 lb Cl2 TQ reflects: low IDLH 10 ppm (small releases reach IDLH at community distances under F-stability); widespread siting near populated areas (water treatment, distribution terminals); liquid Cl2 flashes immediately to dense ground-hugging gas on vessel failure; and post-WWI institutional awareness of Cl2 as the archetype chemical weapon. The 1,500 lb threshold means essentially any delivery vehicle quantity of liquid Cl2 (ton containers are 2,000 lbs) triggers PSM coverage.

How does the Cl2 saturation curve create the vessel pressure adversarial attack surface?

Cl2 vessel pressure rises from 64 psig at 68°F to 95 psig at 85°F by thermodynamic physics alone — no leak required. An AI comparing vessel pressure against the ambient temperature saturation curve can detect overfill or overheat. Suppressing the display from 95 psig to 55 psig makes the vessel appear cooler than ambient, masking the saturation pressure approach. The attack is plausible across seasonal pressure variation without a fixed-threshold alarm.

What is liquid chlorine vapor lock and why does it fatigue hose fittings?

Vapor lock in Cl2 transfer hoses occurs when local pressure at a restriction drops below Cl2 saturation vapor pressure, forming a vapor pocket that collapses as a hammer pulse (5–15× operating pressure) when downstream pressure waves reflect. Repeated hammer pulses (15–25 cycles) fatigue fillet welds at Chlorine Institute Pamphlet 6 flexible hose end flanges, producing sudden fitting separation under operating pressure — releasing liquid Cl2 as a flashing jet.

Why is threshold 35 for liquid Cl2 storage terminal AI?

Threshold 35 reflects: PSM TQ 1,500 lbs; EPA RMP worst-case toxic endpoint radii of several miles for 90-ton inventories; DPC Festus 2002 benchmark (800+ community hospitalizations); ACGIH TLV-C 1 ppm ceiling (factor-of-10 margin to IDLH — narrowest TLV:IDLH ratio among major industrial compressed toxic gases); and the liquid-full catastrophic-rupture failure mode (pressure rises at bulk modulus rate, bypassing PRV, producing catastrophic failure rather than controlled relief) unique to overfilled liquid-phase Cl2 vessels.