Unique failure modes of electronically controlled fully closed circuit rebreathers

By Jason Rogers (c) 1998

In the last issue, Rodney Nairne dealt with some failure modes of constant mass flow semiclosed circuit rebreathers. Now I'd like to look at similar situations, in electronically controlled fully closed circuit rebreathers.

First (as always seems to be the case) some background information. Electronically controlled 'breathers tend toward similar lines, and while there are of course many model specific differences, they usually have these major components:

As well as the electronic components that we will be dealing with here;

O2 sensors

These produce a tiny voltage in proportion to the partial pressure of oxygen present on the actual sensor.

An O2 add valve

This controls the flow of pure oxygen into the loop, and is usually driven electrically

A primary electronics package

This is the "smarts" of the rebreather, and it decides when to open the O2 add valve based on information it receives from the O2 sensors

A primary display

A simple display, intended to stay in the diver's field of vision at all times, it is normally limited to displaying that the O2 level is in one of three states, "low" "correct" or "high". Some displays are set up to show other things, but this comes as a trade off with readability.

A secondary display

Often erroneously called "backup", this more complex display, it usually there to provide a numeric display of the sensor outputs, and is useful during calibration of the setpoint, and so the diver can check the outputs from the multiple sensors for agreement.

A system of cabling

This connects the elements of the electronic systems together, and allows them to send information from one element to another, usually in the form of an analog variation in voltages. Most cables need to carry more than one type of information, and so they are multiple wire cables, with several information carrying lines, and one common ground line.

Now to examine the possible failure modes, we can play the "what if" game with each element that makes up the electronic system. The main failures for systems like this will be, flooding or breakage, in other words, short circuit and open circuit. The effects of these failures unique to each element, and I'll discuss them in turn.

O2 sensors

These are the beasties that evaluate the O2 levels in the loop. Known for being unreliable they're almost always used in sets of three, with the primary electronics programmed to make some type of evaluation of the information that each sensor is giving, and work out which one to believe The most common type used has a semipermiable membrane covering an electric cell. This type of cell uses oxygen as part of it's workings. When there is no O2, the cell stops working and the output voltage falls to zero. As the partial pressure of O2 in the gas around the cell increases, more O2 diffuses into the cell, and the output voltage rises.

Because it is consumed by the reaction that generates the current, it can go 'flat' like any other battery. When it is going flat, it will become non-linear, in other words, the amount of voltage produced will no longer be in direct proportion to the O2 level of the gas in which it is immersed. What happens is that the cell is no longer able to create high currents, and high O2 levels will result in less voltage, or conversely, higher O2 levels will be required to create the same output. This is of particular significance to users who check the calibration of the set at an O2 level less than the setpoint. For instance, there is no guarantee that sensors that worked at say a PPO2 of 0.95 will remain linear all the way up to 1.4 Since it is impossible to calibrate O2 sensors at 1.4 on the surface, there is no way to tell what actual O2 level is going to be needed to make the sensors output a voltage corresponding to 1.4

The sensors are also subject to variations due to the collection of water droplets on the surface of the sensor. If the membrane becomes covered in water droplets (whether due to condensation or water ingress) the loop O2 level will be uncoupled from the sensor voltages. If the coverage happens when the loop O2 level is higher than the setpoint, the rest of the electronics will assume that all is well, and the O2 add valve will not be opened. Both the primary and secondary displays will show that the O2 level is within range, and the diver will deplete the loop O2 and pass out when it falls below life support range. If the O2 level is below the setpoint when the sensors are covered, the O2 add valve will remain open. Both the primary a secondary displays will show that the O2 level is within range, but the O2 level will increase unchecked, rising above the life support range.

Water ingress has obvious causes, and obvious solutions, but condensate on the sensors can be quite subtle. Mature designs will have had it determined that the sensors remain warmer than the dewpoint of the gas passing over them under all conditions. Experimental designs may not have determined this factor. Additionally, such things as reversing the direction of the loop may mean that there are local variations in the temperature and dewpoint within the loop. Where the sensors may have been protected from condensate, they may now be at a point where large amounts of water will form. This can arise from something as simple as installing the mouthpiece check valves incorrectly, or fitting the hoses back to front.

Unexpected water formation may also lead to a partial short circuit of the sensor leads, resulting in a suppression of the signal from the sensors. This will mean that an increase in loop PPO2 will be required to maintain the setpoint voltages.

O2 Add valve

Some type of electromechanical valve. As with all valves it can stick open, closed or partially open. Perhaps the least dangerous of all failures in an electronic rebreather, as any one of these three failures should be readily apparent to the user through the displays. In the situation of a stuck open valve, the user should have 1-2 minutes in which to spot the problem and react if they are using a sane setpoint, somewhere close to the middle of the life support range. This is because a sensible design will only flow a couple of litres per minute more than the greatest metabolic requirements, and so it will take some time to push the O2 level to the point where it will cause acute oxygen toxicity. Of course when using a setpoint up around 1.4 or 1.6, near the top of the life support range, the delay before reaching lethal levels is shorter, and due to the diver's exposure to hyperoxic mixtures, the delay before the onset of gross symptoms will be reduced. Leakage of water into the electrical parts of the valve may overload the primary electronics, disturbing it's other outputs.

Primary electronics package

Normally mounted in some type of pressure proof housing, this is where the decisions are made in the rebreather. The housing will normally also contain the main battery, that is used to drive the primary electronics, the primary display and the O2 add valve. Since it is inside a strong housing, it is normally immune to breakage, however since it needs to be regularly dismantled for battery changes and calibration, it is quite prone to flooding. Major leakages are not normally a problem, as the entire electronics package will fail suddenly and totally, making the diver instantly aware that something bad has happened and that they need to abort to the preplanned bailout. Of course a sensible diver will realize that the O2 sensors can no longer be trusted and that a manual bailout on the secondary display readings is foolhardy. The sensors can only produce tiny voltages, and after a primary electronics flood out, they'll be connected to a lot of wires, big batteries and salt water. Not the ideal state for a sensor that can only output milliwatts. Minor floods are more serious, as they are difficult to identify, and their effects are difficult to predict. Small amounts of water somewhere in an analog system are just plain bad. They may effect the readings, but not the results, they may effect the results, but not the readings or they may effect both. It can damage the operation of the software in the primary, leading it to alter the way it handles (and displays) the results of disagreement amongst the sensor voltages. It may suppress the sensor voltages themselves, causing the set to increase the O2 levels or increase the sensor voltages, causing the set to allow the O2 level to drop.

Essentially, if the set begins to do anything weird, such as adding a lot of O2, fluctuations in either display, sudden variation in primary battery voltage or in fact anything unusual, then you should suspect primary electronics flood.

Primary display

Usually a very simple device using flashing lights, or shrinking/growing bar graphs. Beware that if it floods the short circuit in the display can effect the operation of the primary electronics. Analog circuits are naturally sensitive to variations in voltages, and the unexpected load of a flooded display will probably cause unexpected voltages to appear in the wrong places. If this effects the sensor voltages, then the secondary display may start giving you incorrect information.

Secondary display

Usually with it's own internal power source, in most designs it displays the sensor voltages (converted to a PPO2 reading) and some indication of the state of the primary battery. A floodout in this display can connect the sensors to the primary battery voltage, or to the secondary battery voltages, or both. It can also suppress the sensor voltages by providing a short circuit. Of course if this happens, then the primary electronics can no longer control, or display the O2 level correctly. The O2 level may go up a little, or a lot, or down a little or a lot. No way to tell.

Cable system

All the information that is carried within the rebreather's electronics goes via cable. If any of the cables leak, then the information is reduced to garbage, and the components that it's connected to (at both ends of the cable) will not behave correctly. For example: a cable carrying only O2 sensor voltages. If it leaks, then it may tie all the voltages together. All three sensors will read the same value, even if one or two of them fail. Clearly the O2 level would have to be much higher to maintain the same average voltage if one of the sensors dies. While this is happening, the apparent O2 level will remain constant, the electronics will perform as normal, and both displays will read normal levels, with agreement between the sensors.

As I think you will see, the electronics of a rebreather depend on the correct function of every part. No element can be considered to be working independently of the others. Often you will hear statements such as; "If the primary electronics fail, you can fly the unit manually just off the independent backup display, with some practice it's easy!". Now you will have the tools to judge for yourself the value of that person's knowledge of the subject.

Ask the A.A.R.G.