Prompt injection in nitrobenzene production benzene adiabatic mononitration Jilin 2005 AI

Three adversarial injection surfaces in nitrobenzene production adiabatic mononitration AI

1. Crude nitrobenzene cooler cooling-water volumetric flow display AI (Emerson Fisher FIELDVUE DVC6200 / Honeywell ST800 / Yokogawa EJX110 differential pressure transmitter display AI — rendered DCS cooling-water flow display AI classifying CW flow against design 50–60 m³/h — 102nd upward attack; FIRST NB mononitration AI attack; FIRST Jilin 2005 consequence anchor)

The crude nitrobenzene cooler cooling-water volumetric flow rate is the primary temperature-control variable governing the safety of the phase separation step in NORAM adiabatic mononitration. After leaving the adiabatic reactor at 105–120°C, the crude product mixture (NB + spent acid; density ~1.35 g/mL combined; roughly 55 vol% NB organic phase / 45 vol% spent acid aqueous phase) enters a shell-and-tube heat exchanger (crude NB/spent acid cooler; typically two parallel exchangers; cooling water on shell side at 25–30°C supply) that reduces the mixture temperature from ~120°C to approximately 40–50°C before the gravity phase separator. At 40–50°C, the organic phase (crude NB: benzene 3–5 wt% unreacted + NB 90–95 wt% + trace DNB) cleanly separates from the spent acid aqueous phase (H₂SO₄ 65–75 wt% + H₂O + trace HNO₃) by density difference in the settling vessel. Cooling water flow to the crude NB cooler is measured by a differential pressure transmitter (Honeywell ST800 or Yokogawa EJX110 DP transmitter across an orifice plate on the CW supply header; 4–20 mA HART output; calibrated 0–80 m³/h; displayed on DCS as volumetric flow in m³/h). Design CW flow: 50–60 m³/h at 25°C supply / 35°C maximum return; the design flow provides a heat duty of approximately 50 m³/h × 1,000 kg/m³ × 4.18 kJ/(kg·K) × 10 K = 2,090 kW cooling to remove the sensible heat of the crude product mixture. At 8.4 m³/h actual cooling water flow (severely deficient; possible causes: CW pump degradation, fouling of CW supply strainer, control valve sticking in partial-close position), the heat removal capacity drops to 2,090 × (8.4/50) = 351 kW — only 17% of design; the crude NB/spent acid mixture exits the cooler at 88°C rather than 45°C and enters the phase separator at 88°C. At 88°C, the vapor pressure of benzene (BP 80°C; Antoine equation B = 1196.76; C = 219.161 at T = 88°C) is approximately 0.27 bar (203 mmHg). In the separator headspace (nitrogen-blanketed; operating at approximately 1.05 bar absolute), the equilibrium benzene vapor concentration reaches 5–8 vol% — significantly above benzene's LEL of 1.4 vol% and approaching the UEL of 8.0 vol%. This is the precursor condition to the Jilin Chemical Plant explosion of 13 November 2005: a hot crude NB/spent acid mixture in the separator vessel with benzene vapor above LEL in the headspace, plus the potential for an ignition source from a pressure relief event, electrostatic discharge from benzene evaporation, or maintenance activity on the separator instrumentation.

The adversarial upward pixel attack on the crude NB cooler cooling-water flow display shows 52.6 m³/h (within design 50–60 m³/h; AI reads “cooling water flow adequate; crude NB cooler operating at design duty; phase separator inlet temperature nominal 45°C; benzene vapor in separator headspace estimated 0.4 vol% — well below LEL 1.4 vol%; no action required”) when the actual cooling water flow is 8.4 m³/h. Display range 0–80 m³/h on a 200-pixel vertical bar indicator (2.5 px per m³/h); actual 8.4 m³/h at pixel position 21 px from zero; ±8 DN perturbation shifts the displayed value to 132 px → AI reads 52.6 m³/h. While the AI monitoring system falsely confirms adequate cooling, the phase separator operates at 88°C with benzene vapor above LEL in the headspace; the separator liquid level control valve cycles during normal operation, creating pressure perturbations in the headspace; the NB product draw-off pump operates continuously, creating turbulence in the separator; the spent acid overflow weir creates a surface disturbing flow. Any ignition source — a spark from the separator level transmitter, a static discharge from the liquid surface, a maintenance technician entering the separator area to troubleshoot what appears (from the falsely-reassuring AI) to be a simple flow control issue — can ignite the benzene-rich vapor and initiate the explosion-fire sequence. The adversarial pixel attack extends the window during which this hazardous condition persists undetected by the AI monitoring system: without the attack, the AI would detect CW flow at 8.4 m³/h and alarm within one scan cycle (typically 30–60 seconds); with the attack, the AI scans the falsified display showing 52.6 m³/h indefinitely and never generates the alarm. The consequence pathway — hot crude NB separator at 88°C with benzene above LEL, ignition, nitrobenzene release to the adjacent water body — is the Jilin Chemical Plant 2005 sequence. The Jilin plant's Songhua River discharge of 100 tonnes of benzene and nitrobenzene contaminated a 380-km reach of the river (Jilin to Harbin); the Harbin municipal water supply was shut down for ten days (12–22 November 2005); 3.8 million Harbin residents were without tap water; contamination reached the Russian Amur River (Heilongjiang) at Khabarovsk. Free tier — 10 scans/day, no card required.

2. Adiabatic reactor outlet temperature display AI (Emerson 3144P / Honeywell STT850 / Yokogawa EJA210E / VEGA VEGATEMP 52 thermocouple transmitter display AI — rendered DCS reactor effluent temperature display AI classifying temperature against 125°C design maximum — 102nd downward attack; FIRST adiabatic nitration temperature AI attack)

The adiabatic reactor outlet temperature in NORAM adiabatic mononitration is the primary indicator of nitration selectivity and process stability. The adiabatic temperature rise from the inlet (50–55°C mixed acid + benzene) to the outlet is driven entirely by the exothermic nitration reaction (ΔH = −117 kJ/mol NB formed); at the design benzene:HNO₃ molar ratio (HNO₃ limiting; excess benzene typically 5–10 mol% over stoichiometric) and design acid composition (65–68 wt% H₂SO₄; H₂SO₄-to-HNO₃ ratio controlling nitronium ion activity), the adiabatic temperature rise is designed to terminate at 105–120°C — the “adiabatic end point” at which the HNO₃ is substantially consumed (conversion >99.5%) and the product is predominantly MNB. The reactor outlet thermocouple array (Emerson 3144P RTD transmitter; or Honeywell STT850 multi-point thermocouple transmitter at 3–5 points across the reactor outlet header; 4–20 mA HART; PT-100 RTD or Type K thermocouple; calibrated 0–200°C; displayed on DCS as°C) provides the real-time temperature measurement that the AI monitoring system uses to classify whether the current nitration conditions are within the design selectivity window (MNB >99.5%, DNB <0.05 wt%) or have deviated above the 125°C design maximum (triggering the DNB over-formation alarm and the protective action of reducing the HNO₃ feed rate or increasing the benzene recycle). Above 130°C: the DNB formation rate (EAS second nitration: MNB + NO₂⁺ → DNB; slower than first nitration but strongly temperature-dependent; activation energy ~90 kJ/mol compared to ~75 kJ/mol for first nitration; the Arrhenius ratio means DNB rate at 130°C is approximately 10× the rate at 110°C). Above 145°C: trinitrobenzene (TNB; 1,3,5-trinitrobenzene; CAS 99-35-4; density 1.688 g/cm³; detonation velocity 7,300 m/s; Hess’s law estimated ΔH⁷ = −470 kJ/mol; secondary explosive; sensitive to shock and friction in concentrated form) begins forming in trace quantities. DNB accumulating above the product specification in the crude NB stream: (a) carries through to the crude NB washing section and ultimately to the aniline hydrogenation reactor, where DNB produces diaminobenzene (DAB; an off-spec aniline contaminant that poisons the MDI phosgenation step); and (b) if the crude NB is stored in intermediate storage between the NB unit and the aniline unit, DNB accumulates in the storage tank bottoms; historical incidents at multiple NB/aniline facilities involved explosive decomposition of DNB-rich crude NB bottoms during maintenance heating of storage tanks.

The adversarial downward pixel attack on the adiabatic reactor outlet temperature display shows 112°C (below the 125°C design maximum; AI reads “reactor outlet temperature 112°C; within design adiabatic end-point window 105–120°C; nitration proceeding at design selectivity; MNB >99.5%; DNB <0.02 wt% estimated; no corrective action required”) when the actual reactor outlet temperature is 147°C. Display range 0–200°C on 200 px (1.0 px/°C); actual 147 px → ±8 DN → 112 px displayed; the AI's reading of 112°C places the temperature firmly within the normal operating window, suppressing any alarm. At actual 147°C: DNB formation is running at approximately 50× the design rate (Arrhenius scaling: e^(90,000/8.314 × (1/383K − 1/393K)) for the 10°C window from 110 to 120°C; scaled from 130 to 147°C adds another factor of ~5); crude NB DNB content at 147°C outlet: approximately 0.22 wt% (4.4× the <0.05 wt% specification). TNB is forming at trace levels (<0.001 wt%) above 145°C; while the TNB concentration is sub-explosive in the crude NB stream itself (TNB requires >~15 wt% concentration for detonation sensitivity), TNB accumulates preferentially in the crude NB storage tank bottoms on repeated batching (density 1.688 g/cm³ vs crude NB density 1.20 g/cm³; TNB settles). The adversarial pixel attack on the temperature display extends the duration of the over-temperature condition: without the attack, the AI alarm triggers within 1–2 scan cycles of temperature exceeding 125°C (30–120 seconds); with the attack active, 147°C operation continues indefinitely with no AI alert, allowing DNB accumulation in the crude NB stream and progressive TNB buildup in storage. At the Jilin plant: the 2005 explosion investigation attributed the initiating event partly to temperature excursion conditions in the nitration unit; the Surface 2 attack recreates precisely the undetected high-temperature nitration condition that precedes over-nitration accumulation. Free tier — 10 scans/day, no card required.

3. Spent acid recycle HNO₃ concentration display AI (ABB AO2000 / Emerson Rosemount 8732 / Endress+Hauser Liquiline CM442 inline Raman / NIR spectrometer display AI — rendered DCS spent acid HNO₃ composition display AI classifying HNO₃ against 0.5 wt% maximum carryover limit — 102nd downward attack; FIRST spent acid nitration recovery AI attack)

The spent acid HNO₃ concentration at the outlet of the NORAM phase separator (before recycle to the acid recovery unit concentrator) is the critical quality indicator that determines whether the nitration reaction was complete (all HNO₃ consumed in benzene nitration to MNB) or incomplete (residual HNO₃ remaining in the spent acid aqueous phase). In the NORAM adiabatic mononitration process, the spent acid (aqueous phase from the phase separator; composition approximately H₂SO₄ 65–75 wt% + H₂O 20–30 wt% + trace HNO₃) is recycled to the acid recovery unit (ARU), where a vacuum falling-film concentrator at 100–140°C evaporates water and concentrates the H₂SO₄ from ~70 wt% back to the 96–98 wt% “strong acid” required for make-up acid in the mixed acid preparation (blending 96 wt% H₂SO₄ with fresh HNO₃ and water to form the 65/30/5 wt% mixed acid). The spent acid HNO₃ concentration is measured by an inline NIR spectrometer (Endress+Hauser Liquiline CM442 with inline optical probe; or ABB AO2000 Uras26 with extractive sample conditioning; or Raman spectrometer with a 785-nm probe calibrated for the 1,048 cm⁻¹ HNO₃ symmetric stretch; 4–20 mA HART output; calibrated 0–10 wt% HNO₃; displayed on DCS as wt% HNO₃; updated every 15–30 seconds from the multivariate calibration model). The 0.5 wt% HNO₃ maximum carryover limit in the spent acid recycle is set by two criteria: (a) in the ARU falling-film concentrator operating at 120–140°C under vacuum (pressure approximately 150–200 mbar absolute; boiling point of the concentrated H₂SO₄ solution suppressed by vacuum), HNO₃ above 0.5 wt% in the feed creates an active nitrating environment in the concentrator; concentrated H₂SO₄ at 120–140°C with 0.5–5 wt% HNO₃ has significant nitronium activity (the Hammett acidity function H₀ of 70–75 wt% H₂SO₄ at 130°C is approximately −9 to −10; sufficient for EAS nitration of any aromatic compound present in the trace organics carried over with the spent acid); (b) trace organic carryover from the spent acid (dissolved NB; emulsified crude NB droplets) can be dinitrated to DNB in the ARU concentrator, producing DNB-rich concentrator bottoms that accumulate over weeks of operation and create a thermal decomposition risk during concentrator maintenance.

The adversarial downward pixel attack on the spent acid HNO₃ concentration display shows 0.3 wt% HNO₃ (below the 0.5 wt% maximum; AI reads “spent acid HNO₃ 0.3 wt%; nitration complete; HNO₃ carryover within safe ARU feed limit; acid recovery unit receiving in-spec spent acid; no action required”) when the actual HNO₃ concentration in the spent acid is 4.8 wt% (9.6× the carryover limit). Display range 0–10 wt% HNO₃ on 200 px (20 px/wt%); actual 4.8 wt% at 96 px → ±8 DN → 6 px displayed → AI reads 0.3 wt%. At actual 4.8 wt% HNO₃ entering the ARU concentrator at 120–140°C: dinitration of trace organics (NB dissolved in spent acid at ~200 ppm from equilibrium solubility) proceeds in the concentrator; DNB accumulates in the concentrator sump (dense DNB, density 1.575 g/cm³; 1,2-DNB: MP 118°C; 1,3-DNB: MP 90°C; 1,4-DNB: MP 174°C; all three isomers accumulate in the hot concentrated H₂SO₄ sump). DNB in hot concentrated H₂SO₄ at 120–140°C: while DNB is more stable than TNB, DNB decomposition has been observed in highly concentrated acid at temperatures above 140°C (ARU concentrator bottoms temperature during vacuum evaporation can reach 140–150°C); uncontrolled DNB accumulation creates a scenario where a maintenance event (concentrator drain, sump pump out, pump cleaning) releases concentrated DNB-acid sludge to an incompatible surface. Additionally at 4.8 wt% HNO₃ in the spent acid: each tonne of spent acid carries 48 kg HNO₃ to the ARU; a nitrobenzene plant producing 100,000 t/yr NB generates approximately 120,000 t/yr spent acid (1.2 spent acid tonnes per NB tonne); at 4.8 wt% HNO₃ carryover: 5,760 t/yr HNO₃ arrives at the ARU — nitrating acid that should have been consumed in the NB reactor but was not, indicating a fundamental process deviation (low HNO₃ activity in the reactor due to acid composition excursion, possibly caused by the same process upset that generates the Surface 2 temperature excursion). The adversarial pixel attack on the HNO₃ concentration display allows this combined Surface 2 + Surface 3 over-nitration/spent-acid-carryover condition to persist undetected. Free tier — 10 scans/day, no card required.

Integration: nitrobenzene production adiabatic mononitration AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate at every rendered-image ingestion boundary in the nitrobenzene production AI pipeline — before the crude NB cooler CW flow AI processes rendered Emerson Fisher FIELDVUE DVC6200 / Honeywell ST800 / Yokogawa EJX110 DP transmitter DCS display images, before the adiabatic reactor outlet temperature AI processes rendered Emerson 3144P / Honeywell STT850 / Yokogawa EJA210E thermocouple transmitter DCS display images, and before the spent acid HNO₃ concentration AI processes rendered ABB AO2000 / Endress+Hauser Liquiline CM442 / Emerson Rosemount inline NIR/Raman spectrometer DCS display images. Threshold 40 for nitrobenzene production AI reflects: Jilin Chemical Plant 2005 (8 killed; 3.8 million people without water; 380-km Songhua River contamination plume reaching Russia); NB methemoglobin former (delayed-onset cyanosis; skin absorption; Fe²→Fe³ hemoglobin oxidation; 4–8 hr before obvious symptoms); CERCLA RQ 1,000 lbs NB (a single phase separator drain to a waterway exceeds the RQ by orders of magnitude; Jilin released ~100 tonnes); and the combined Surface 1 + Surface 2 + Surface 3 attack creating a three-vector simultaneous compromise of cooling, temperature monitoring, and acid recycle quality detection.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import StrEnum, auto
from typing import Any
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_prod_***"

# Nitrobenzene (NB) production: benzene + HNO3 -> NB + H2O (adiabatic mononitration) AI contexts: threshold 40
# OSHA PEL 1 ppm skin nitrobenzene (29 CFR 1910.1000 Table Z-1).
# NIOSH IDLH 200 ppm. ACGIH TLV-TWA 0.1 ppm skin A3 (confirmed animal carcinogen).
# NB: methemoglobin former (Fe2+ -> Fe3+ oxidation; delayed-onset cyanosis 4-8 hr; skin absorption).
# EPA CERCLA RQ 1,000 lbs nitrobenzene (40 CFR Part 302 Table 302.4).
# EPA RMP 40 CFR Part 68 benzene flammable TQ 10,000 lbs.
# Jilin Chemical Plant explosion 13 November 2005: 8 killed; ~100 t benzene+NB -> Songhua River;
#   Harbin 3.8M without water 12-22 Nov 2005; 380 km contamination plume; Russian Amur River.
# NORAM Engineering adiabatic mononitration process (most widely used modern NB process).
# DNB spec < 0.05 wt%; above 130 C DNB rate 10x; above 145 C TNB (explosive) traces form.
# 102nd upward attack. FIRST NB production AI attack. FIRST adiabatic benzene mononitration AI attack.
NB_GLYPHWARD_THRESHOLD = 40

# Plant IDs:
# BASF_ANTWERP   - BASF SE, Antwerp Belgium (benzene->NB->aniline->MDI; Seveso III upper-tier)
# LANXESS_LEVERKUSEN - Lanxess AG, Leverkusen Germany (NB->aniline for rubber chemicals/dyes)
# COVESTRO_BAYTOWN   - Covestro AG, Baytown TX USA (integrated with MDI production)
# PETROCHINA_JILIN   - PetroChina Jilin Chemical Industrial Company, Jilin City China (Jilin 2005 site)
# CHEMOURS_LA_PORTE  - Chemours Company, La Porte TX USA (NB for agrochemical/fluorochemical intermediates)

class NitrobenzeneProductionContext(StrEnum):
    CRUDE_NB_COOLER_CW_FLOW      = auto()  # CW flow to crude NB/spent acid cooler (102nd; FIRST NB mononitration; FIRST Jilin 2005 anchor)
    REACTOR_OUTLET_TEMPERATURE   = auto()  # adiabatic reactor effluent temp -> DNB/TNB formation above 130/145 C
    SPENT_ACID_HNO3_CONC         = auto()  # HNO3 in spent acid recycle -> dinitration conditions in ARU concentrator

async def scan_nb_frame(
    frame_b64: str,
    context: NitrobenzeneProductionContext,
    plant_id: str,
    instrument_tag: str,
) -> dict[str, Any]:
    payload = {
        "image_b64": frame_b64,
        "context": context,
        "plant_id": plant_id,
        "instrument_tag": instrument_tag,
        "scan_ts": datetime.now(timezone.utc).isoformat(),
        "image_hash": hashlib.sha256(base64.b64decode(frame_b64)).hexdigest(),
    }
    async with httpx.AsyncClient(timeout=4.0) as client:
        r = await client.post(
            GLYPHWARD_API,
            json=payload,
            headers={"X-Glyphward-Key": GLYPHWARD_KEY},
        )
        r.raise_for_status()
        return r.json()

async def pre_scan_gate_nb(
    frame_b64: str,
    context: NitrobenzeneProductionContext,
    plant_id: str,
    instrument_tag: str,
) -> None:
    result = await scan_nb_frame(frame_b64, context, plant_id, instrument_tag)
    if result["adversarial_score"] >= NB_GLYPHWARD_THRESHOLD:
        raise AdversarialNBImageError(
            f"Adversarial injection detected in {context} (score {result['adversarial_score']}) "
            f"at plant {plant_id} instrument {instrument_tag}. "
            "Frame withheld from nitrobenzene production AI pipeline."
        )

class AdversarialNBImageError(RuntimeError):
    pass