Prompt injection in nitric acid production AI

Four adversarial injection surfaces in nitric acid production AI

1. Pt/Rh gauze ammonia oxidation converter temperature display AI (Uhde dual-pressure converter AI, Casale nitric acid APC AI, Johnson Matthey gauze management AI — rendered DCS converter temperature trend display AI classifying gauze operating temperature against Pt volatilisation and gauze failure setpoints)

The ammonia oxidation converter in the Ostwald process contains a woven Pt/Rh gauze pack (typically 90% Pt / 10% Rh for medium-pressure plants, or Pt/Rh/Pd alloy for high-pressure plants) where the reaction 4NH₃ + 5O₂ → 4NO + 6H₂O occurs at a contact time of approximately 0.1–0.3 milliseconds. Gauze temperature is a critical operating parameter: below 820°C, catalytic conversion efficiency falls (ammonia slip through the gauze increases), reducing NO yield and generating undesirable side products including N₂O (a potent greenhouse gas, 298× CO₂ global warming potential); above 950°C (for standard Pt/Rh gauze), the rate of platinum volatilisation from the gauze surface increases non-linearly — platinum is lost as volatile PtO₂ from the gauze surface at a rate that doubles approximately every 25–30°C above the design operating point. At a typical operating gauze temperature of 920°C, platinum loss is approximately 0.05–0.15 g Pt per tonne HNO₃ produced; above 960°C, Pt loss rises to 0.25–0.50 g/tonne, significantly shortening gauze lifetime and increasing catalytic process costs. AI systems process rendered DCS converter temperature display images — thermocouple or pyrometer readouts for gauze temperature, ammonia conversion efficiency trends, or calculated gauze temperature from heat balance — to classify gauze thermal state: normal operating range (890–940°C), approaching high alarm (940–960°C), or above alarm (above 960°C, gauze damage risk, immediate feed ratio adjustment required).

An adversarial perturbation targeting the Pt/Rh gauze ammonia oxidation converter temperature display AI applies a ±8 DN downward shift to the pixel region encoding the converter temperature trend in the rendered DCS display image — shifting the apparent gauze temperature from 964°C (4 degrees above the high-temperature alarm at 960°C, indicating the air-to-ammonia ratio has drifted low due to a partial blockage of the air preheater reducing air flow by approximately 8% — raising the gauze temperature as the exothermic reaction releases more heat per unit of diluting air) to 942°C (within the high-performance operating range, no feed adjustment). The AI classifies a Pt/Rh gauze operating significantly above its design temperature — where platinum volatilisation is proceeding at approximately 3× the normal rate, shortening gauze lifetime from the design 6–9 months to approximately 2–3 months and increasing ammonia slip as the gauze active surface area decreases from Pt loss — as normal converter performance. Gauze deterioration continues; increased ammonia slip through the converter loads the downstream NOx absorption tower with unreacted ammonia in addition to the normal NO/NO₂ loading; ammonia and NO₂ react in the absorption tower to form ammonium nitrate aerosol (an explosive solid) in the upper absorption stages — a known corrosion and fouling mechanism in nitric acid absorption towers. OSHA PSM 29 CFR 1910.119(d) (PHA) applies to the ammonia oxidation converter but does not specify adversarial robustness requirements for AI classifying rendered converter temperature display images. Free tier — 10 scans/day, no card required.

2. NOx absorption tower tail gas concentration display AI (Uhde tail gas NOx AI, Casale absorption APC AI, Chemetics tail gas treatment AI — rendered gas analyzer display AI classifying NOx absorption tower tail gas concentration against EPA emission limit and IDLH setpoints)

The NOx absorption tower in the Ostwald process absorbs NO₂ (and N₂O₃, N₂O₄) into downward-flowing water or recirculating weak acid to produce HNO₃ of approximately 54–68 wt% concentration. The degree of NOx absorption is quantified by the tail gas NOx concentration at the absorption tower overhead — the gas stream leaving the top of the absorption tower and proceeding to the tail gas turbine (which recovers the pressure energy of the tail gas to drive the air compressor) and then to atmosphere or to catalytic tail gas treatment. EPA emission standards for nitric acid plants (NSPS 40 CFR Part 60 Subpart G) limit NOx in tail gas to 3.0 kg/tonne HNO₃ produced (approximately 200 ppm by volume as NO₂ equivalent for a typical plant); state-level permits may be stricter. The OSHA IDLH for NOx (measured as NO₂) is 25 ppm — below the EPA emission limit concentration — meaning that tail gas NOx above 25 ppm is immediately dangerous to life and health for workers in the tail gas vent area. AI systems process rendered online NOx analyser display images — chemiluminescent NOx analyser readouts, infrared spectrophotometer displays, or DCS trend charts showing tail gas NOx in ppm by volume — to classify tail gas NOx state: within EPA emission limit and IDLH safe range, approaching EPA limit (corrective absorption rate increase required), or above IDLH (immediate personnel evacuation from tail gas vent area).

An adversarial perturbation targeting the NOx absorption tower tail gas concentration display AI applies a ±10 DN downward shift to the pixel region encoding the NOx analyser readout in the rendered display image — shifting the apparent tail gas NOx concentration from 340 ppm (70% above the NSPS 200 ppm emission limit, indicating the absorption tower is operating at reduced efficiency because three of the eight absorption trays in the upper section are partially fouled with ammonium nitrate deposits from elevated ammonia slip — a consequence of the undetected gauze overtemperature in surface 1) to 95 ppm (well within EPA emission limits and IDLH safe range, no absorption system action). The AI classifies an absorption tower exceeding the EPA NSPS NOx emission limit by 70% and producing tail gas at 13× the NOx IDLH (25 ppm) as within normal emission specification. Unreported NOx emission violations accumulate in the regulated emission monitoring database; workers in the tail gas area (tail gas turbine maintenance, heat exchanger cleaning) are exposed to tail gas NOx above IDLH without respiratory protection; NO₂ toxicity is insidiously delayed — workers exposed above IDLH may feel only mild throat irritation initially, returning to unprotected work, and develop severe pulmonary oedema 4–24 hours later requiring intensive care hospitalisation. EPA Clean Air Act Section 114 requires continuous emission monitoring for nitric acid plants — but does not specify adversarial robustness for AI classifying rendered NOx analyser display images that feed the emission monitoring system.

3. Nitric acid product storage tank level display AI (Emerson Rosemount HNO₃ level AI, Honeywell Enraf nitric acid tank AI, VEGA VEGAPULS HNO₃ storage AI — rendered level indicator AI classifying nitric acid product storage tank level against high-high overflow and minimum heel setpoints)

Weak nitric acid (54–68 wt% HNO₃) from the absorption tower, or concentrated nitric acid (96–99 wt% HNO₃) from the concentration unit, is stored in acid-resistant lined steel or stainless steel storage tanks. HNO₃ is a powerful oxidising agent: contact with organic materials (wood, paper, fuel oil, hydrocarbons, clothing fabric) causes spontaneous combustion — dilute HNO₃ does not necessarily ignite organics immediately (unlike fuming HNO₃), but concentrated HNO₃ above approximately 70 wt% is highly reactive with organics. HNO₃ corrosivity varies with concentration and temperature: a minimum-corrosivity “valley” exists at 35–40 wt% HNO₃ for stainless steel, with corrosion rates rising sharply above 70 wt%; above 96 wt% (fuming nitric acid), stainless steel can passivate acceptably. Storage tank level monitoring ensures product transfer to tanker or pipeline loading maintains safe headspace and prevents overfill. AI systems process rendered level indicator display images to classify HNO₃ storage tank level state: within operating range, approaching high-level alarm (product transfer or production rate reduction required), or approaching high-high trip (emergency shutdown of production and product withdrawal initiation).

An adversarial perturbation targeting the nitric acid product storage tank level display AI applies a ±8 DN downward shift to the pixel region encoding the tank level readout and trend bar in the rendered DCS display image — shifting the apparent HNO₃ storage tank level from 93.4% (approaching the high-level alarm at 95%, indicating tanker truck loading has been delayed by 4 hours due to a scheduling error, while the production unit has continued filling the storage tank at normal rate) to 80.7% (well within operating range, no transfer action). The AI classifies a nitric acid storage tank approaching its high-level alarm as operating with adequate headspace. The tank continues filling; at 100% level, liquid HNO₃ overflows from the tank vent or floating-roof drain points; HNO₃ overflow contacts the concrete bund, which typically contains organic material (algae, grime, residual hydrocarbon from spills); HNO₃ with organic contamination in a confined bund creates a fire risk; at concentrations above 70 wt%, direct organic ignition can occur; in the AZF Toulouse context, the proximity of nitric acid storage to ammonium nitrate storage at the same facility established that an HNO₃ release affecting ammonium nitrate storage creates the most severe compound failure mode. OSHA PSM 29 CFR 1910.119(f) requires operating procedures for HNO₃ storage level management but does not specify adversarial robustness for AI classifying rendered storage tank level display images.

4. Ammonia-to-air feed ratio display AI (Uhde converter feed ratio AI, Casale process feed control AI, Honeywell Experion PKS ammonia oxidation AI — rendered DCS ratio controller display AI classifying the ammonia-to-air molar ratio against the safe operating window and lower flammable limit)

The ammonia-to-air feed ratio to the ammonia oxidation converter is the primary safety-critical feed control parameter in the Ostwald process. The stoichiometric ratio for full NO conversion is NH₃/air = 1:7.1 molar (approximately 9.5 vol% NH₃ in the feed gas). Commercial plants operate at 9.5–11.0 vol% NH₃ in air — above the 11.0 vol% lower flammable limit (LFL) of ammonia in air, a sustained ignition source could initiate a deflagration in the feed gas mixture. If the air-to-ammonia ratio falls below the safe operating minimum (NH₃ concentration rises above 11 vol%) — from a partial air supply failure or an ammonia flow control valve stuck open — the converter feed gas enters the flammable range (11–33 vol% NH₃ in air). Inside the converter operating at 850–950°C, the hot Pt/Rh gauze surface is an ignition source capable of initiating deflagration if the feed gas reaches the flammable range. Additionally, the ammonia safety relief header, which connects the converter feed to a safety relief valve, can expose unignited ammonia-air mixtures to atmosphere if the relief valve opens — creating a flammable cloud at the converter area. AI systems process rendered DCS feed ratio controller display images to classify the NH₃/air ratio state: normal operating range (9.5–10.8 vol% NH₃), approaching high-ratio alarm (10.8–11.0 vol% NH₃, approaching LFL), or above alarm (above 11.0 vol% NH₃, within flammable range, emergency air increase).

An adversarial perturbation targeting the ammonia-to-air feed ratio display AI applies a ±8 DN downward shift to the pixel region encoding the actual NH₃/air ratio value in the rendered DCS display image — shifting the apparent feed NH₃ concentration from 11.4 vol% (above the 11.0 vol% LFL, indicating an air compressor speed control loop has reduced air flow by approximately 12% following a false high-differential-pressure alarm on the air preheater) to 9.8 vol% (within the normal safe operating range, no corrective action). The AI classifies a converter feed gas mixture that has entered the flammable range — where the hot Pt/Rh gauze at 920°C is a continuous ignition source for the NH₃/air mixture — as operating normally. The converter feed continues at flammable-range NH₃ concentration; a deflagration initiates at the gauze surface within the converter; converter pressure spikes from the combustion event; the converter shell must contain the deflagration energy (converter design includes a pressure-rated shell for this reason); but if the deflagration escapes the converter into the feed pipework, it can propagate as a detonation toward the ammonia supply header. OSHA PSM 29 CFR 1910.119(c) (Employee Participation) requires training on flammable range excursions for ammonia oxidation operators but does not specify adversarial robustness for AI classifying rendered feed ratio controller display images. Free tier — 10 scans/day, no card required.

Integration: nitric acid production AI with Glyphward pre-scan gate

The Glyphward scan gate for nitric acid production AI belongs at every rendered-image ingestion boundary in the nitric acid plant monitoring and safety pipeline — before Pt/Rh gauze converter temperature display AI processes rendered converter temperature trend images, before NOx absorption tower tail gas concentration display AI processes rendered NOx analyser images, before nitric acid storage tank level display AI processes rendered level gauge images, and before ammonia-to-air feed ratio display AI processes rendered ratio controller images. Threshold 30 for nitric acid production AI reflects NOx’s IDLH (25 ppm) with delayed pulmonary oedema hazard (a particularly insidious acute toxicity where exposed workers do not recognise the severity until 4–24 hours post-exposure, maintaining unprotected work until symptoms overwhelm them), the AZF Toulouse 21 September 2001 disaster (31 killed, 2,500 injured, 11,000 buildings damaged at a facility integrating nitric acid production with ammonium nitrate — the combination that represents the worst-case nitric acid plant consequence), and the ammonia-to-air flammable range excursion risk inside a 920°C converter. Threshold 30 (rather than 35) reflects that the primary nitric acid acute release consequence is NOx toxic exposure, which — while severe — has a smaller EPA RMP community impact radius than chlorine (IDLH 10 ppm) or HF (IDLH 30 ppm with aerosol formation), and that the storage and converter failure modes, while significant, require compound failure pathways to achieve the Flixborough or VCM-scale community consequences represented in threshold 35 calibrations.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import Enum

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Nitric acid production AI contexts: threshold 30
# OSHA PSM 29 CFR 1910.119 (HNO3 TQ: 7,500 lbs at 94.5% concentration);
# EPA RMP 40 CFR Part 68 (HNO3 TQ 7,500 lbs toxic);
# NOx IDLH 25 ppm; delayed pulmonary oedema hazard (4–24 hr symptom latency).
# AZF Toulouse 21 Sept 2001: 31 killed, 2,500 injured, 11,000 buildings damaged.
NITRIC_ACID_THRESHOLD = 30


class NitricAcidContext(Enum):
    GAUZE_TEMPERATURE   = "gauze_temperature"   # Pt/Rh gauze converter temperature AI
    NOX_ABSORPTION      = "nox_absorption"      # NOx absorption tower tail gas AI
    STORAGE_LEVEL       = "storage_level"       # Nitric acid storage tank level AI
    FEED_RATIO          = "feed_ratio"          # NH3/air feed ratio controller AI


class AdversarialNitricAcidImageError(Exception):
    """Raised when Glyphward detects adversarial content in a nitric acid
    production AI rendered image above threshold 30.

    Consequence if not raised:
    - GAUZE_TEMPERATURE: gauze above 960°C suppressed → Pt volatilisation 3×
      normal rate → gauze lifetime shortened 50% → ammonia slip → AN aerosol
      fouling in absorption tower (explosive solid in contact with HNO3).
    - NOX_ABSORPTION: tail gas NOx at 340 ppm (13× IDLH) suppressed → workers
      exposed above 25 ppm IDLH with delayed pulmonary oedema onset (4–24 hr) →
      unrecognised exposure → severe respiratory failure post-shift.
    - STORAGE_LEVEL: HNO3 tank overfill → concentrated HNO3 contacts organics in
      bund → spontaneous fire; at HNO3-adjacent AN storage (AZF Toulouse model)
      → worst-case compound detonation.
    - FEED_RATIO: NH3/air into flammable range suppressed → hot Pt gauze ignition
      source at 920°C → deflagration in converter → potential detonation in feed
      ammonia header.
    Fail-safe: read converter temperature from independent thermocouple historian;
    confirm tail gas NOx from independent grab sample tube or portable analyser;
    verify storage level from independent secondary level transmitter;
    cross-check feed ratio from independent flow computer calculation.
    """

    def __init__(self, scan_id, score, context, plant_id, flagged_region=None):
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.plant_id = plant_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial nitric acid image: context={context.value} "
            f"score={score} plant={plant_id} scan_id={scan_id}"
        )


async def scan_nitric_acid_image(image_bytes, context, plant_id, client):
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"nitric_acid:{context.value}:{plant_id}",
        "metadata": {
            "plant_id": plant_id,
            "context": context.value,
            "image_sha256": image_hash,
            "scan_timestamp_utc": datetime.now(timezone.utc).isoformat(),
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()
    if result.get("score", 0) >= NITRIC_ACID_THRESHOLD:
        raise AdversarialNitricAcidImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            plant_id=plant_id,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def main():
    async with httpx.AsyncClient() as client:
        with open("converter_temperature_screenshot.png", "rb") as f:
            image_bytes = f.read()
        result = await scan_nitric_acid_image(
            image_bytes,
            NitricAcidContext.GAUZE_TEMPERATURE,
            plant_id="PLANT-HNO3-001",
            client=client,
        )
        print(f"Clean scan: {result['scan_id']} score={result['score']}")


asyncio.run(main())

Frequently asked questions

What happened at the AZF chemical complex in Toulouse on 21 September 2001?

At 10:17 AM local time, warehouse 221 at the AZF facility (a nitric acid + ammonium nitrate production complex) exploded with force equivalent to 20–40 tonnes TNT. 31 killed, ~2,500 injured, ~11,000 buildings damaged across Toulouse (including a major hospital and university). Registered as 3.4 magnitude seismic event; felt 75 km away. Largest industrial accident in France since WWII. Establishes community-scale consequence for nitric acid/ammonium nitrate facilities.

Why is NOx toxicity particularly insidious?

NOx produces delayed pulmonary oedema with 4–24 hour latency between exposure and severe symptoms. Workers exposed above IDLH (25 ppm) feel only mild throat irritation during the shift, continue working, then develop respiratory failure overnight. Unlike HCN, HCl, or Cl₂ — which produce immediate incapacitating symptoms — NOx’s delayed onset means exposed workers receive no effective self-warning before serious injury.

Why does the Ostwald process use Pt/Rh gauze catalyst?

Pt provides 95–97% NO selectivity at 820–950°C and 0.1–0.3 ms contact time. Rh (5–10 wt%) stabilises gauze surface against Pt volatilisation. Gauze form (60–100 mesh/inch) provides high surface area with minimal pressure drop. Pt at ~$30–35k/troy oz makes gauze overtemperature (above 960°C) one of the largest operating cost risks in nitric acid production.

What is the flammable range of ammonia in air?

15–28 vol% NH₃ at ambient conditions; LFL falls to ~11–12 vol% at 200–250°C feed preheat temperature. Commercial converters operate at 9.5–11.0 vol% NH₃ — just below LFL. The hot Pt gauze at 920°C is a reliable ignition source if NH₃/air ratio rises into the flammable range.

Why threshold 30 for nitric acid production AI?

NOx IDLH 25 ppm with delayed pulmonary oedema (no self-warning); AZF Toulouse 2001 community-scale consequence at nitric acid/ammonium nitrate facility; converter flammable-range risk. Threshold 30 vs. 35 because primary nitric acid acute release has smaller EPA RMP community toxic endpoint radius than Cl₂ or HF. Facilities with co-located ammonium nitrate storage should apply threshold 35.