Potential Safety Improvements in Rebreather Design

[John C. Ratliff]

I found a couple of interesting posts on a different thread from 2006:

This is the second try, I answered this earlier and got some absurd message ... :bluthinki

I'd be interested to hear why rebreathers are still being sold that allow a user to continue breathing a mix that will not support life.

That is, as they say, the nature of a rebreather. And it's biggest danger. You can breath as long as there is enough gas volume to match your lungs. It doesn't mean the gas you're breathing supports life.
Every rebreather diver knows this!
And every rebreather diver accepts this, just as every diver accepts nitrogen narcosis or possibility of DCS.

The dangers generally involved here are hyperoxia (O2 poisening), hypoxia (O2 starvation) and hypercapnia (CO2 poisening). Hyperoxia, while possible on an SCR, is limited to diving past the MOD for the supply gas as it is for nitrox in general. Hypoxia, expected to be the cause here, can happen when fresh gas (SCR) or O2 (CCR) isn't added to the loop to replenish the O2 metabolized by the diver. Hypercapnia can occur when the scrubber is exhausted, CO2 is channeling through the scrubber bed or when the scrubber is just fine but the diver doesn't fully exhale the CO2 he generates. Holding one's breath, skipbreathing, shallow breathing will all do it. On OC too, by the way, even free diving (shallow water blackout has caused many free diving fatalities).

No SCR currently in production has a pO2 monitor in it's stock configuration.
All but one offer it as a factory option and are prepared to have it installed.
In can be done on that remaining one without any problems with monitors from several manufacturers.
Reasoning here is that cmf units continiously add gas at a higher rate than should be consumed by the diver plus have a separate addition valve to increase that flow when necessary, and that rmv-keyed units add gas per breath and hence accomodate high work rates. The latter also dump a measured amount per breath, so if gas addition ceases WOB will go up as only a few breaths are left.

CCRs operate with a fixed pO2 (setpoint) and hence have three O2 sensors that allow the diver and/or the setpoint controller to monitor and maintain the setpoint. When diving with a setpoint the fO2 in the loop changes and hence monitoring is required. Most CCRs have audible, visiual and/or vibrating alarms to notify the diver if the setpoint drifts or a cell is bad. The exception are the KISS rebreathers that are manually controlled by the diver who is trained to pay attention to the pO2 displays in the first place and fly manually.

There is currently no CO2 monitoring system available in rebreathers outside the military.
Over the years several individuals and companies have tried to make CO2 monitoring work, but there are problems have yet to be mastered, not the least of which are reliability and cost.

Ambient Pressure has implemented a scrubber monitor. While not warning of CO2 in the loop, it will warn if the absorbant fails. Not perfect, but a step in the right direction.

That being said, Rule Number 1 is: Always know your pO2!

I also singled out the quote that bradshi did above.
If the victim just wanted to fill his tank, and made an impromptu decision to jump in the pool to use up the remaining gas left in his cylinder, there is a fair chance that he didn't do a full pre-dive check that would have included checking the gas flow in his unit and the contents of the tank. I find that much more likely than anything else, as sitting on the floor of the pool doesn't lend itself to physical excertion.

Low pO2 in a cmf SCR can be brought about by mismatching gas and orifices, overbreathing the gas addition capabilities (not all that easy, I tried that on a Dräger in the pool once with a pO2 monitor installed and got worn out before the unit did) or no gas coming from the tank, either due to an out of gas situation or 1st stage/valve failure.

So more likely than not this accident was indeed human failure, and the past accounts of the victims abilities don't exactly make that any less likely.

Either way, the unit was recovered, so it should be easy enough to check the gas in the tank (both volume and composition) as well as the gas addition system (though the tank may be empty by the time he was found as gas flows continiously through the orfice).

http://www.scubaboard.com/forums/accidents-incidents/123276-rebreather-diver-dies-pool-oregon-5.html[/QUOTE]

It's a final effort by the equipment to try to prevent your death.

One system at least has been developed for military that includes CO2 sensing, auto flushes the loop with diluent when sensing CO2 or high pO2, even returns an unconcious diver to the surface. But aside from containing technology not yet cleared for civilian consumption the electronics cost more than most current CCRs. At their low production numbers the price would much more than double, so it's just not feasible yet.

It's not like any sane person would choose to dive with a mix that can be predicted to cause death.

There have been plenty of accidents and fatalities on open circuit due to divers accidentally picking the wrong gas for a given depth. Try swimming on Tx10/50 on the surface or take a few breaths of O2 at 200 feet and see how far you get. To err is human.

For a couple of sensors, a small PC board and a valve? Maybe another $500 - $1000?

In my previous post I mentioned the manually controoled KISS CCR.
A couple of guys thought the same way you did and designed an aftermarket control system. Adds a HUD display in the line of sight and solenoid and setpoint controller to the KISS (as well as a different display and the option to plug a dive coomputer with yet another pO2 display in). The setpoint controller/solenoid act as a safety parachute, injecting gas only when the setpoint falls below 0.4 ata.

The system costs $1,800.
http://www.scubaboard.com/forums/accidents-incidents/123276-rebreather-diver-dies-pool-oregon-5.html

So apparently there are some solutions out there.

Dr. Lecter, forgive me, but I was unfamiliar with the Hannibal Lecter series of novels. You might note that it is easy for someone unfamiliar with that series to mistake your moniker for something entirely different.

SeaRat

 

[Dr. Lecter]

So apparently there are some solutions out there.

Um, no. There are some options out there. It's not like the idea of an eCCR is universally embraced, for example. Some people still dive pure mCCR without any electronic parachute of any kind, and of that subset some are running a needle valve or other technically purely manual control of O2 addition vice a CMF addition from a 1ATA reg. And I'm not aware of many civilian divers who'd stake their lives on the fact that the benefits of the automagical military CCR described above would outweigh the extreme downside risks inherent in it, say, sending them up to the surface at the wrong time due to a failure. The CO2 sensor tech remains in its infancy, largely because making it work reliably inside a CCR loop at the depths these things get taken to these days...hasn't happened yet.

At the end of the day, a lot of people prefer flexibility over paternalistic safety. Yes, I could kill myself with my revo by manually injecting O2 at 100m or 10/50 while surface swimming; no, I would not dive a unit that tried to out-think me on gas injection. First, because there are corner cases where I might have to pick the lesser of two evils. Second, because giving the unit the control necessary to prevent me from doing something that would be bad at time A means that the unit could fail and prevent me from doing the same thing at time B when it's not only not bad, but is actually necessary to survive​.

Dr. Lecter, forgive me, but I was unfamiliar with the Hannibal Lecter series of novels. You might note that it is easy for someone unfamiliar with that series to mistake your moniker for something entirely different.

SeaRat

Good lord, man! Go read Silence of the Lambs, Red Dragon, and Hannibal this instant. And catch at least Hopkins's performance in Silence of the Lambs - he won an Oscar for something like 16 minutes of screen time.

 

[John C. Ratliff]

Dr. Lecter,

First, thanks...I am retired, so I may spend some time reading those novels.

Now, I have done a bit of googling "fatality rates for rebreather divers," and gotten some interesting results. You talk about injecting oxygen at depth instead of dilutent. Well, what if the rebreather did that on its own? I found a set of 27 slides by Deeplife Co. in the U.K., and this is what they say in their last slide:

Preventing the Deaths

1. Rebreathers currently are nowhere near the standard expected of other life critical
systems.
2. Most manufacturers use staff with no Functional Safety training, to design life
critical systems, including the electronics and software in rebreather control.
3. Open review and fitting better safety systems could have prevented all of the
incidents reported here.
4. Technologies are available that would have prevented every one of the incidents
cited here.
5. That means people are dying because equipment is designed badly, with
inadequate safeguards.
6. Manufacturers are split: a few respond quickly to safety issues, others oppose
safety initiatives. The worst units described here, that reset and hang, have never
been recalled.
7. The four sports rebreather manufacturers with the worst safety records try to gag
Safety Professionals by sponsoring trolling and slander web sites against them.
Those same manufacturers campaign for standard organisations to drop
Functional Safety requirements for rebreathers.
8. It is left to the diver to be aware.
http://www.deeplife.co.uk/files/How_Rebreathers_Kill_People.pdf

From a cursory look at this, they have some very good points about Failure Modes and Effects Criticality Analysis (FMECA) being done on the rebreathers. Apparently, this is required for the CE Mark, but is deemed to be confidential information and so is not publicly released. I am a bit worried about these slides, as there is no author cited. There may also be a conflict of interest, as apparently they do make some of the items they recommend. However, they do have some very good points that go beyond the particular rebreather incident that started this discussion.

Another paper I found talks about the difference between open circuit diving with a twin-tank system and rebreather diving found a death rate about ten times higher with rebreathers than with open circuit scuba:
http://www.dhmjournal.com/files/Fock-Rebreather_deaths.pdf
I have yet to read in detail this paper, but it shows that there is room for better rebreather systems.


SeaRat

 

[Dr. Lecter]

Dr. Lecter,

First, thanks...I am retired, so I may spend some time reading those novels.

Now, I have done a bit of googling "fatality rates for rebreather divers," and gotten some interesting results. You talk about injecting oxygen at depth instead of dilutent. Well, what if the rebreather did that on its own? I found a set of 27 slides by Deeplife Co. in the U.K., and this is what they say in their last slide:

From a cursory look at this, they have some very good points about Failure Modes and Effects Criticality Analysis (FMECA) being done on the rebreathers. Apparently, this is required for the CE Mark, but is deemed to be confidential information and so is not publicly released. I am a bit worried about these slides, as there is no author cited. There may also be a conflict of interest, as apparently they do make some of the items they recommend. However, they do have some very good points that go beyond the particular rebreather incident that started this discussion.

Another paper I found talks about the difference between open circuit diving with a twin-tank system and rebreather diving found a death rate about ten times higher with rebreathers than with open circuit scuba:
http://www.dhmjournal.com/files/Fock-Rebreather_deaths.pdf
I have yet to read in detail this paper, but it shows that there is room for better rebreather systems.


SeaRat

First, the idea of the CCR failing in a manner that leads to unintended gas injection into the loop (an "internal boom" in some cases, or a solenoid/related failure) is covered in training and manageable. If venturing really deep, some people isolate their O2 from the loop entirely and plug a rich bailout mix into it instead, thereby reducing the possibly unmanageable risk of having the loop flood with 100% O2 at great depth (pO2 going to 4 is bad, but probably won't kill you before you can fix it; pO2 going to 11 or 20...maybe a different story).

Second, DeepLife has long been hocking their own CCR unit with the mantra that it's the only one that's sufficiently safe for anyone to dive. Oddly, very few people seem to dive one. Draw your own conclusions. On a related note, DeepLife's CCR fatality list has numerous documented issues with what goes into it as fact, as well as the conclusions and assumptions it contains--take a read around Rebreatherworld, there have been a number of battles about it.

Third, I have no qualms admitting that CCRs have more failure points than most OC systems (one can conceive of an elaborate OC system for something like a world record dive, where the sheer number of separate OC regs/tanks involved might make it more failure-prone than a CCR). Or that certain of their most dangerous failure modes are also their most insidious ones, unlike OC where if the system totally fails you generally either get a ****ton of bubbles or no air at all (contaminated gas or failure to properly analyze or gas switch aside, but CCR involves those risks too). What I dispute is that there is a way that, using currently available technology, you can retain all the benefits of a CCR system while making it significantly safer. There's no doubt the damn things are more dangerous than most OC systems standing alone, but there are dives where the benefits of the CCR strongly outweigh those risks--or simply would not be practical to do on OC. At that point, you either limit your dives or accept the added risk.

From the DeepLife slide deck you found to have some "very good points":

Cause: User kept pressing O2 button instead of dil button on descent.

Recommendation:
Would have been avoided if Auto Shut-Off valve fitted.
Question on why O2 manual button is needed.
Requires clearer alarms, such as voice annunciation.

This kind of thinking is so contrary to my own (and many other CCR divers') that there's simply no point in discussing the issue. People like that are free to go build and sell things like the DeepLife vaporware add-ons or the Poseidon 7; people like me can keep ordering their revos, or KISSs, or Megs, or whatever poison we prefer in configurations we like. Although if I have to listen to voice annunciation from someone else's unit, it may not be as safety-enhancing as they'd like to think

 

[descent]

... there are corner cases where I might have to pick the lesser of two evils. ... giving the unit the control necessary to prevent me from doing something that would be bad at time A means that the unit could fail and prevent me from doing the same thing at time B when it's not only not bad, but is actually necessary to survive​.

That sounds like something a test pilot would say.

Both Air France 447 and Asiana 214 were crammed full of modern automation. Both flights came to tragic ends after some dysfunctional interactions between crew members and their automated systems. Both flights would have benefited from a more aggressive instinct to reach into/under/away from the automation for a manual sanity check.

My attitude toward the machines I use is convoluted, inconsistent and probably hypocritical. As a programmer, I always look for gadgets that allow me to have complete, unfiltered access to their internals. And yet, I sometimes use Apple laptops.

For several years, I even carried an iPhone as my primary phone. Ugh. Never again.

Back when I was an unruly gearhead, I always carried extra platinum-tipped spark plugs in my pocket. Gift giving was simpler then; my friends got custom-ground racing camshafts that I had made in my spare time, whether they needed them or not. Today, I can barely find the dipstick on the cars in my driveway. Lately, when something dies between key and headlights, no amount of staring under the hood enlightens me. I used to resent the high labor rate at the various auto repair shops. Now, I look forward to talking to my mechanics, and I secretly hope that they don't figure out that I value their expertise at a significant multiple of what they have been charging me for it.

I am curious about your system philosophy, Dr Lecter. As you can see, I have no settled agenda. I hope you don't mind if I ask:

Do you dive a completely manual rig?

As you speed through the vasty deep at a consistent depth (who among us does not envy you!), how often do you find yourself manually adding O2?

Does your rig automatically add diluent when a mechanical sensor is compressed by a reduced volume, maybe in a counterlung? Have you disabled this automated function, or considered it?

Again, just curious, and I hope you find discussion of the interface between the system and its ever-changing user as interesting as I do.

Best regards.

 

[victorzamora]

That sounds like something a test pilot would say.

Both Air France 447 and Asiana 214 were crammed full of modern automation. Both flights came to tragic ends after some dysfunctional interactions between crew members and their automated systems. Both flights would have benefited from a more aggressive instinct to reach into/under/away from the automation for a manual sanity check.

I'm an Aerospace Engineer and these are all I can think about, plus a few more. It's the Boeing vs Airbus argument. Boeing's flight controls are such that the airplane gives inputs, suggestions, and yells if it's unhappy....but the pilot can do whatever he/she darned well pleases. Airbus's flight controls are such that the pilot gives inputs and suggestions....but the plane can do whatever it darned well pleases. Both have had many pilot-induced crashes. Only Airbus has had plane-induced crashes. Air France Flight 296, if you read what happened, was the pilots wanting to do a low fly-by for the airshow. The plane decided it had had enough of this and the pilots were dumb. Killed everyone on board and 3 on the ground.

I'm mature enough to make my own decisions. I don't want a nanny in the form of scuba gear, flight controls, or other organization/entity. If you want a nanny, that's fine....stick to the sandbox.

 

[John C. Ratliff]

I am curious as to whether rebreather users would embrace a CO2 monitor system. You have triple-redundant O2 sensors in many rebreathers. It seems to me that the one missing indicator is that of a rise in CO2.

To the airline analogy, to me it would be like flying without an altimeter. You can fly easily, but you must rely on your own senses to tell you how high you are in relation to the ground. For helicopters (I used to crew them), this is not a problem. But for airplanes which must continue to fly forward, it may be a problem. I had to pull two Korean Air Force pilots' bodies out of the Yellow Sea in 1969 because they had lost their altimeter, and were flying back to the base using VFR. They broke through the ceiling at 1,000 feet (approximately), and had been told to descend to 1,000 feet via radio earlier. When they broke through the ceiling, they could visually see the Yellow Sea, and thought they were at about 10,000 feet because the sea was flat calm, no waves at all. They basically flew that F-86 into the water, thinking they were much higher than they actually were flying. It was quite a tragedy, and I had to cut them out of their parachute harnesses after they were ejected through their canopy by the impact (from head and helmet damage), and their parachutes in the water around them before putting them on the HH-43's hoist for recovery.

I see some parallels to how rebreather divers use only their own senses to "sense" CO2 buildup, by pre-breathing (for symptomology) and monitoring their physiology through their dive. But there can be traps set that would overcome their own sensing ability. Would not a CO2 indicator provide you valuable knowledge, or an indicator about the life of the scrubber?

SeaRat

 

[descent]

... If you want a nanny, that's fine....stick to the sandbox.

Heavens, no. I hope I don't sound like I am advocating nanny levels of protection.

The worst nanny experience is usually a micromanaging government. You can read what I think about rebreathers that contain no user serviceable parts and the CE standards pushing us toward a smothering nanny-future full of simple toys.

That post is upthread: #102.

 

[Akimbo]

It might be interesting to note that saturation divers have been using totally closed circuit mixed gas electronic rebreathers for over 30 years. There has never had a fatality, and are in use 24/7 in very deep water. Unbelievable? Not when you consider that almost none of it is on the diver.

The only part a diver wears is a helmet-mounted demand valve that controls exhalations into a hose with a relative vacuum. The exhaust then goes to the bell where a negative-biased back pressure regulator and water separator routes the gas all the way back to the surface. CO2 is scrubbed, O2 is added, moisture is removed, and HP compressors pump it back into tube-trailer size cylinders for re-use.

There was a fatality on a bell-mounted reprocessing system, but that was about 40 years ago. The demand exhaust regulator failed and the diver suffered massive barotrauma.

Obviously this is not a SCUBA rebreather, but it does demonstrate that the main problems are water, power, and scale. Do these surface-based automatic reprocessing systems ever fail? Of course they do. Are they as electronically sophisticated or redundant as eCCRs? No way. Independent alarms go off when they fail, technicians walk over and tend to the problem, and bad gas from the system never makes it to the diver. The diver never even knows there is a problem and just keeps on working.

Technological improvements will eventually solve the miniaturization, power reliability, sensor, and seawater intrusion problems. It will never eliminate failures. Scale is the real bugger here. There isn’t much time for corrective actions when the gas that goes down the exhaust hose is back in your mouth within a few seconds.

 

[Dr. Lecter]

I am curious about your system philosophy, Dr Lecter. As you can see, I have no settled agenda. I hope you don't mind if I ask:

Do you dive a completely manual rig?

As you speed through the vasty deep at a consistent depth (who among us does not envy you!), how often do you find yourself manually adding O2?

Does your rig automatically add diluent when a mechanical sensor is compressed by a reduced volume, maybe in a counterlung? Have you disabled this automated function, or considered it?

I dive a hybrid rig with the solenoid and CMF (depth allowing it) functioning as the primary addition system at depth while I monitor pO2 closely with the HUD (2 cells) and my controller (3 cells). A manual dil flush allows me to verify the sensor output makes sense given my depth and O2 fraction in the dil. Below 80m or so the CMF falls off gradually and I take over control from the solenoid, adding O2 manually as needed (which isn't much at 100m). If I want to go much past 100m I will have to start plumbing in a depth compensating source of O2 (or more likely, O2 rich bailout), but for the depths to which I dive the 1ATA reg that allows for a CMF O2 addition at most depths still provides enough IP to allow for manual O2 addition. The other nice thing about the hybrid is that if (say because I did a poor job of soldering a pinched negative lead back together in my solenoid box the night before) my solenoid cuts out when I backroll off the boat, I shrug and fly the unit manually the rest of the dive. For ascents, it's all manual.

My CMF is pretty well matched to my resting metabolic rate, so assuming I'm not working or really, really cold, the solenoid will fire very rarely and I won't do much of anything. Below 80m, when the pressure difference between my 1ATA O2 reg's IP and the ambient pressure is insufficient to maintain CMF (there's still a leak of O2 into the unit through the orifice, but it is ever-decreasing with depth past 80m), I will have to add O2 more frequently because the metabolic consumption stays fixed while the fixed flow rate into the unit drops. Still, we're talking about a manual or solenoid squirt of O2 every few minutes or so. A little 100% goes a very long way at such depths.

The revo does contain an ADV inside the exhale counterlung, next to the solenoid and CMF orifice. While I have not disabled it, I do have it detuned to the point where I have to really want to pull dil from it. I'm happy with where it's set now: for a while it was too easy to activate and screwed up my pO2; then it was too hard to use at all and made rapid drops harder...now it's just about right. Because I am using onboard hypoxic dil, I would not be adverse to an inline shutoff for the ADV, but the revo's design doesn't really allow for that. I compensate by turning off the dil valve and running the unit ('air' breaks aside) as an O2 CCR from 20' to the surface during deco.

Apple laptops have excellent hardware design, IMO...certain models have taken amazing beatings from me over the years and kept on doing what I wanted them to do. Add to that my general ignorance of how software and computers really work, plus being raised on an old 512k beige box, and you have a devoted Apple user. Though much of the OS since the jump from 9 to X has annoyed even me. I won't get into my feeling about old cars versus new ones, but we're probably not too far apart. I spent the last two years of law school rebuilding/upgrading an '82 XJS with the Lucas ignition V12 and loved every minute of it; now I drive a basic Tacoma and enjoy not having to think about anything related to my car.

As for a CO2 sensor - yes, I would love one (assuming it wasn't consistently giving me false positives from water vapor and/or gas density at depth). Until they have a good one, the RMS system has shown itself to be very useful (when it works right; temperamental little probes and BT connection early on). What I would not adopt is a coupling between a CO2 sensor and the rest of the unit's functions. I love information, but do not like my CCR doing things for me (despite my acceptance of the solenoid on my hybrid revo...it's just better at adding tiny squirts of O2 than I am).