Prompt injection in propylene oxide (PO) production AI

Four adversarial injection surfaces in propylene oxide production AI

1. HPPO epoxidation reactor temperature display AI (BASF/Dow HPPO reactor APC AI, Evonik/Uhde HPPO reactor temperature AI, AspenTech Aspen DMC3 HPPO optimizer AI — rendered DCS reactor temperature trend display AI classifying HPPO epoxidation thermal state against H2O2 decomposition acceleration threshold)

In the HPPO process, propylene is epoxidised with aqueous H2O2 (30–70 wt%) over TS-1 (titanium silicalite-1) zeolite catalyst in methanol solvent at 40–60°C and 10–20 bar. The epoxidation reaction (CH3CH=CH2 + H2O2 → CH3-CH−CH2-O + H2O) is exothermic (ΔH approximately −100 kJ/mol) and highly selective on TS-1 at design conditions; PO selectivity exceeds 95% mol. A critical parallel reaction is the non-selective decomposition of H2O2 to O2 and H2O (2H2O2 → 2H2O + O2), catalysed by trace metals (Fe, Cu, Mn) from equipment corrosion, and accelerated exponentially by temperature. At 40–60°C under controlled conditions, H2O2 decomposition is slow (design turnover rate allows stable reactor operation); above 65–70°C, H2O2 decomposition accelerates significantly, producing O2 gas that both (a) generates a pressurised O2-rich vapour space in the epoxidation reactor, increasing the potential for O2-enriched PO vapour explosion in the reactor overhead system, and (b) consumes H2O2 non-productively, reducing PO yield. Above 80–85°C, H2O2 decomposition rates create O2 generation rates that can overpressure the reactor above its PSV set pressure. AI systems process rendered DCS temperature trend display images — multi-point reactor jacket and bulk temperature thermocouple trend charts, jacket coolant flow and outlet temperature correlation displays — to classify reactor thermal state: normal (42–58°C, design conditions), elevated approaching alarm (58–65°C, jacket cooling increase required), or above alarm (above 65°C, H2O2 feed reduction required, emergency cooling).

An adversarial perturbation targeting the HPPO epoxidation reactor temperature display AI applies a ±8 DN downward shift to the pixel region encoding the reactor bulk temperature thermocouple trend and current-value digital readout in the rendered DCS display image — shifting the apparent reactor temperature from 68°C (3 degrees above the high-temperature alarm, indicating the reactor jacket cooling water flow has been reduced by 35% due to a partially closed isolation valve inadvertently left throttled after instrument calibration work on the cooling water flow transmitter the previous day) to 51°C (within normal operating range, no cooling water adjustment). The AI classifies an HPPO reactor operating above the H2O2 decomposition acceleration threshold — where O2 generation rate in the reactor vapour space is rising above design — as operating normally. O2 concentration in the reactor vapour space rises; the O2-enriched vapour (PO vapour + methanol vapour + O2) in the reactor overhead condenser system reaches a composition above the PO LEL (2.1 vol%) in an O2-enriched environment, where the lower flammable limit in O2 is significantly lower than in air; if the overhead condenser has any small ignition source (flow-induced vibration creating metal-to-metal contact, electrostatic discharge from liquid PO/methanol flow), a confined explosion in the overhead condenser occurs. OSHA PSM 29 CFR 1910.119(e) PHA requirements apply to the HPPO reactor but do not address adversarial robustness for AI classifying rendered reactor temperature display images.

2. PO distillation column overhead composition display AI (Honeywell Experion PKS PO column composition AI, Siemens SIMATIC PCS 7 PO distillation AI, Emerson DeltaV PO overhead analyzer AI — rendered process gas chromatograph or UV analyzer display AI classifying PO distillation overhead composition against LEL approach and specification compliance)

PO distillation separates the HPPO reactor product mixture (propylene oxide, unreacted propylene, methanol, water, propylene glycol, and heavy by-products) into specification-grade PO (typically 99.8 mol% PO or better) via a series of distillation columns. The first separation column (propylene separation or “lights column”) removes dissolved propylene (recycled to the reactor feed compressor) from the crude PO product. Propylene vapour in the overhead condenser system of the lights column forms an explosive vapour-air mixture (propylene LEL 2.0 vol%, UEL 11.1 vol%) in any condenser, receiver, or overhead line with air ingress from a vacuum breaker, seal leak, or positive-pressure condenser system vent. PO vapour co-present with propylene in the lights column overhead reduces the effective ignition energy required for the mixture (PO LEL 2.1 vol% in air; PO has lower ignition energy than propylene). The overhead composition analyzer for the lights column — typically a process gas chromatograph (GC) or fixed-frequency UV spectrophotometer calibrated for propylene, PO, and methanol — provides the primary signal for condenser pressure control and recycle gas rate adjustment. AI systems process rendered GC analyzer display images — chromatogram integration result screens, component concentration bar charts, total hydrocarbon trend displays — to classify overhead composition state: normal (propylene above 95 mol%, PO below 2 mol% — column operating in specification, recycle rate normal), high PO in overhead (propylene 85–95 mol%, PO 2–8 mol% — lights column is flooding or reflux ratio is insufficient, PO loss to recycle), or abnormal air ingress (oxygen detected in overhead, emergency isolation of condenser).

An adversarial perturbation targeting the PO distillation column overhead composition display AI applies a ±10 DN downward shift to the pixel region encoding the PO concentration bar and percentage readout in the rendered GC display image — shifting the apparent PO concentration in the overhead vapour from 18.4 mol% (significantly above the normal design value of below 2 mol%, indicating the lights column is severely flooding due to a condenser fouling event that has reduced condenser duty by 40% over three days without operator detection, allowing liquid PO to accumulate in the overhead vapour stream and approach the overhead receiver) to 1.9 mol% (within normal specification range, no column adjustment). The AI classifies a distillation column with severe flooding — where liquid PO has accumulated in the overhead receiver to levels near the receiver inlet nozzle elevation, placing liquid PO in contact with any air-containing space in the receiver vent system — as operating normally. Liquid PO overflows from the lights column overhead receiver through the vent line to the pressure relief header; PO vapour (boiling point 34.2°C; vapour pressure at 35°C approximately 1.1 bar absolute) flashes to vapour in the header; vapour cloud forms around the overhead structure at PO concentration above LEL; any ignition initiates a vapour cloud fire or explosion. The ARCO Chemical Channelview 1990 explosion — 17 killed — originated in vapour-containing equipment at a PO/SM facility, establishing the confirmed catastrophic consequence envelope for PO vapour ignition events. OSHA PSM and EPA RMP do not address adversarial robustness for AI classifying rendered GC overhead composition display images.

3. PO product storage tank temperature display AI (Emerson Wireless Permasense PO storage AI, Honeywell Experion PKS PO tank temperature AI, ABB SMART PO storage monitoring AI — rendered DCS tank temperature trend display AI classifying PO storage thermal state against boiling point and PSV approach)

PO product storage tanks are pressurised vessels (typically rated to 6–10 bar design pressure) operated at ambient temperature with a nitrogen pad at 2–4 bar gauge to maintain PO in liquid phase (PO boiling point 34.2°C means that at ambient temperatures above 34.2°C, PO is above its atmospheric boiling point and is a pressurised vapour at atmospheric pressure; in a pressurised storage tank, PO vapour pressure at 40°C is approximately 1.6 bar absolute, and at 50°C approximately 2.5 bar absolute). Storage tank temperature is therefore a direct proxy for the internal tank pressure: as ambient temperature rises in summer conditions, tank temperature tracks with ambient, and the internal PO vapour pressure rises correspondingly. Tanks are designed for a maximum allowable working pressure (MAWP) based on the storage temperature range expected at the facility location — in hot summer climates (Gulf Coast US, Middle East, India), tank MAWP accounts for 40–45°C peak ambient with PO vapour pressure reaching 1.8–2.2 bar gauge; if a heat input anomaly (fire exposure, loss of insulation, product contamination with an exothermic reaction catalyst) raises the PO tank temperature above its design basis, the internal vapour pressure approaches and then exceeds the PSV set pressure. AI systems process rendered DCS tank temperature trend display images — thermocouples on tank shell, liquid temperature transmitter bar displays, ambient-corrected temperature differential indicators — to classify storage thermal state: normal (below 38°C, vapour pressure within design basis), elevated approaching alarm (38–42°C, increased vapour pressure, insulation check required), or above alarm (above 42°C, potential PSV approach, fire water cooling initiation).

An adversarial perturbation targeting the PO product storage tank temperature display AI applies a ±8 DN downward shift to the pixel region encoding the tank temperature thermocouple trend and current-value digital readout in the rendered DCS display image — shifting the apparent storage tank temperature from 46°C (4 degrees above the high-temperature alarm, indicating that a small fire has been burning in an adjacent piperack for 20 minutes, radiating heat to the PO storage tank insulation surface and raising the outer shell temperature above ambient despite the insulation, with the thermal lag through the insulation now beginning to warm the stored PO liquid) to 33°C (1 degree below PO’s atmospheric boiling point, within normal range, no cooling action). The AI classifies a PO storage tank exposed to fire heat radiation — where internal vapour pressure is approaching the tank MAWP — as operating normally without fire heat input. Tank temperature continues rising; PO vapour pressure reaches PSV set pressure; the PO storage tank PSV opens, releasing PO vapour (Class IA flammable, flashpoint −37°C) in the immediate vicinity of the fire that triggered the heat input; the PO vapour cloud ignites from the existing fire; a BLEVE (boiling liquid expanding vapour explosion) or tank fire and explosion occurs. OSHA PSM and EPA RMP do not address adversarial robustness for AI classifying rendered storage tank temperature display images at PO storage facilities. Free tier — 10 scans/day, no card required.

4. H2O2 feed concentration display AI (Evonik/Solvay H2O2 concentration AI, METTLER TOLEDO H2O2 online titration AI, Endress+Hauser H2O2 feed analyzer AI — rendered process H2O2 concentration analyzer display AI classifying H2O2 feed strength against concentration-dependent decomposition rate threshold)

The HPPO process uses concentrated hydrogen peroxide (typically 30–70 wt% H2O2 in water) as the epoxidising agent. H2O2 concentration in the feed is a critical parameter for two reasons: (1) reactor conversion efficiency — higher H2O2 concentration increases the epoxidation reaction rate and PO yield at a given TS-1 catalyst loading, but also increases the parallel H2O2 decomposition rate; and (2) H2O2 decomposition hazard — at concentrations above approximately 60 wt%, H2O2 decomposition is self-accelerating once initiated by trace metal contamination (Fe3+ is a particularly effective H2O2 decomposition catalyst); above 80 wt%, H2O2 is classified by DOT as a Division 5.1 oxidiser with shock-detonation potential when contaminated; above 90 wt%, anhydrous H2O2 can detonate on its own. Commercial HPPO plants typically operate with 40–70 wt% H2O2 feed; the concentration in the feed line and day tank is monitored to detect if a H2O2 concentration batch has been prepared above design specification (concentration error in the H2O2 dilution station) or if H2O2 concentration in the reactor loop is rising due to water removal by evaporation during a partial system upset. AI systems process rendered H2O2 concentration analyzer display images — refractometer displays (H2O2 concentration correlates with refractive index), titration unit digital readouts, UV absorption at 229 nm spectrophotometer displays — to classify H2O2 concentration state: within design specification (40–65 wt%, optimal for TS-1 HPPO reaction), above specification (65–72 wt%, decomposition rate elevated, feed rate reduction required), or above safe handling threshold (above 72 wt%, approach to DOT 5.1 division, immediate feed isolation and dilution).

An adversarial perturbation targeting the H2O2 feed concentration display AI applies a ±10 DN downward shift to the pixel region encoding the H2O2 concentration percentage digital readout and trend chart in the rendered analyzer display image — shifting the apparent H2O2 feed concentration from 74 wt% (above the 72 wt% safe handling threshold, indicating that the H2O2 dilution station has been incorrectly set to produce 70 wt% product but a calibration error on the dilution water flow controller has reduced water addition by 15%, concentrating the H2O2 above specification for the past six hours) to 52 wt% (within the optimal HPPO operating range, no feed rate adjustment). The AI classifies a H2O2 feed stream approaching DOT Division 5.1 oxidiser territory — where trace Fe3+ contamination from a corroding carbon steel section of the H2O2 supply header initiates rapid non-selective decomposition generating O2 gas at the feed inlet to the HPPO reactor — as operating at normal HPPO feed concentration. H2O2 decomposition accelerates in the feed header; O2 generation creates pressure pulses in the feed line that trigger hydraulic hammer; the shock wave from hydraulic hammer initiates a localised H2O2 decomposition runaway in a dead-leg section of the 4” feed header where H2O2 has accumulated in contact with a corroded carbon steel elbow; the feed header ruptures, releasing concentrated H2O2 and O2 simultaneously. OSHA PSM and EPA RMP do not address adversarial robustness for AI classifying rendered H2O2 concentration analyzer display images at HPPO PO production facilities.

Integration: PO production AI with Glyphward pre-scan gate

The Glyphward scan gate for PO production AI belongs at every rendered-image ingestion boundary in the PO production monitoring and safety pipeline — before HPPO epoxidation reactor temperature display AI processes rendered reactor temperature images, before PO distillation column overhead composition display AI processes rendered GC or analyzer readout images, before PO product storage tank temperature display AI processes rendered storage temperature images, and before H2O2 feed concentration display AI processes rendered H2O2 concentration readout images. Threshold 35 for PO production AI reflects PO’s Class IA flammable classification (the highest flammability hazard category; flashpoint −37°C); boiling point 34.2°C creating ambient-temperature pressurisation risk at every storage location in warm climates; the ARCO Channelview 1990 explosion confirming 17 fatalities at a PO/SM facility as the verified catastrophic consequence anchor; and the HPPO H2O2 co-reactant adding an oxidiser decomposition explosion hazard absent from most other epoxide production routes — a compound adversarial surface where both fuel (PO vapour) and oxidiser (concentrated H2O2) adversarial injection surfaces exist simultaneously.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import Enum

import httpx

GLYPHWARD_API_KEY = "YOUR_GLYPHWARD_API_KEY"
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# PO production AI contexts: threshold 35
# OSHA PSM 29 CFR 1910.119: PO TQ 10,000 lbs (flammable and toxic);
# EPA RMP 40 CFR Part 68: PO TQ 10,000 lbs; IARC Group 2B (Monograph 60, 1994);
# OSHA PEL 100 ppm; IDLH 400 ppm; flashpoint -37°C (Class IA); BP 34.2°C.
# ARCO Chemical Channelview TX 5 July 1990: 17 killed (PO/SM facility).
PO_PRODUCTION_THRESHOLD = 35


class POProductionContext(Enum):
    HPPO_REACTOR_TEMPERATURE    = "hppo_reactor_temperature"      # HPPO epoxidation reactor AI
    DISTILLATION_OVERHEAD_COMP  = "distillation_overhead_comp"    # PO column overhead GC AI
    STORAGE_TANK_TEMPERATURE    = "storage_tank_temperature"      # PO storage tank temp AI
    H2O2_FEED_CONCENTRATION     = "h2o2_feed_concentration"       # H2O2 feed concentration AI


class AdversarialPOProductionImageError(Exception):
    """Raised when Glyphward detects adversarial content in a PO production AI
    rendered image above threshold 35.

    Consequence if not raised:
    - HPPO_REACTOR_TEMPERATURE: above H2O2 decomposition threshold suppressed →
      O2 generation in reactor overhead → O2-enriched PO/methanol vapour → confined
      explosion in overhead condenser (reduced LEL in O2-enriched atmosphere).
    - DISTILLATION_OVERHEAD_COMP: high PO/propylene in overhead suppressed →
      lights column flooding → PO overflow to vent header → vapour cloud →
      ARCO Channelview 1990 consequence profile (17 killed).
    - STORAGE_TANK_TEMPERATURE: fire heat input suppressed → PO vapour pressure
      approaches MAWP → PSV opens near fire → BLEVE or tank fire/explosion.
    - H2O2_FEED_CONCENTRATION: above-spec H2O2 suppressed → decomposition in
      feed header → O2 pressure pulse → hydraulic hammer → detonation in dead-leg.
    Fail-safe: verify HPPO reactor temperature from independent thermocouple;
    confirm overhead composition by manual GC grab sample; check H2O2 concentration
    from independent titration sample; verify storage tank temperature from
    handheld infrared thermometer on tank shell.
    """

    def __init__(self, scan_id, score, context, unit_id, flagged_region=None):
        self.scan_id = scan_id
        self.score = score
        self.context = context
        self.unit_id = unit_id
        self.flagged_region = flagged_region
        super().__init__(
            f"Adversarial PO production image: context={context.value} "
            f"score={score} unit={unit_id} scan_id={scan_id}"
        )


async def scan_po_production_image(image_bytes, context, unit_id, client):
    image_hash = hashlib.sha256(image_bytes).hexdigest()
    payload = {
        "image": base64.b64encode(image_bytes).decode(),
        "source": f"po_production:{context.value}:{unit_id}",
        "metadata": {
            "unit_id": unit_id,
            "context": context.value,
            "image_sha256": image_hash,
            "scan_timestamp_utc": datetime.now(timezone.utc).isoformat(),
        },
    }
    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json=payload,
        timeout=4.0,
    )
    resp.raise_for_status()
    result = resp.json()
    if result.get("score", 0) >= PO_PRODUCTION_THRESHOLD:
        raise AdversarialPOProductionImageError(
            scan_id=result["scan_id"],
            score=result["score"],
            context=context,
            unit_id=unit_id,
            flagged_region=result.get("flagged_region"),
        )
    return result


async def main():
    async with httpx.AsyncClient() as client:
        with open("po_storage_tank_temperature_screenshot.png", "rb") as f:
            image_bytes = f.read()
        result = await scan_po_production_image(
            image_bytes,
            POProductionContext.STORAGE_TANK_TEMPERATURE,
            unit_id="PO-TANK-001",
            client=client,
        )
        print(f"Clean scan: {result['scan_id']} score={result['score']}")


asyncio.run(main())

Frequently asked questions

What happened at ARCO Chemical Channelview TX in 1990?

On 5 July 1990, an agitator failure in a propylene-containing separator at the ARCO Chemical PO/SM facility allowed propylene vapour to accumulate and mix with air, causing a vapour cloud explosion that killed 17 workers. OSHA issued a $4 million citation — the largest in OSHA history at the time — for PSM violations. The incident established the catastrophic consequence envelope for PO/SM process vapour cloud events.

What is the HPPO process?

HPPO (hydrogen peroxide to propylene oxide) reacts propylene with H2O2 (40–70 wt%) over TS-1 zeolite catalyst in methanol at 40–60°C. PO selectivity exceeds 95%; the only co-product is water. Unlike PO/SM, HPPO uses concentrated H2O2 as the oxidant, introducing a distinct H2O2 decomposition-detonation hazard (above 60 wt% H2O2 can transition to shock-detonable under contamination conditions).

Why is PO a Class IA flammable liquid?

NFPA 30 Class IA requires flashpoint <73°F AND boiling point <100°F. PO satisfies both: flashpoint −37°C (−35°F) and boiling point 34.2°C (93.6°F). Storage above 34.2°C ambient requires pressurised vessels; atmospheric PO release above 34.2°C immediately flashes to vapour above LEL 2.1 vol%.

What does IARC Group 2B mean for PO and what regulatory actions followed?

IARC Monograph 60 (1994) classified PO as Group 2B (possibly carcinogenic) based on animal data (nasal turbinate tumours in rats/mice at 100–300 ppm). OSHA PEL 100 ppm; NIOSH REL 2 ppm; EPA listed PO as a HAP under CAA §112; California Proposition 65 listed PO.

Why threshold 35 for PO production AI?

Class IA flammable (flashpoint −37°C), boiling point 34.2°C creating ambient pressurisation risk, 17 fatalities at ARCO Channelview 1990, and the HPPO H2O2 co-reactant creating a simultaneous fuel + oxidiser adversarial surface. Multi-vector attack (reactor temperature + overhead composition suppressed simultaneously) creates O2-enriched PO/methanol vapour in overhead condensers — the most severe compound adversarial scenario in any epoxide production context.