The general principle of
substantive diving safety, that the diver must be able to deal with any single immediately life-threatening equipment failure with significant risk without outside assistance, holds for rebreather diving. If recovery from a failure leaves the diver in a compromised position where there is a high risk of a single point failure mode which can no longer be managed by the diver, the dive should be terminated. The concept of comparing the output from three cells at the same place in the loop and controlling the gas mixture based on the average output of the two with the most similar output at any given time is known as voting logic, and is more reliable than control based on a single cell. If the third cell output deviates sufficiently from the other two, an alarm indicates probable cell failure. If this occurs before the dive, the rebreather is deemed unsafe and should not be used. If it occurs during a dive, it indicates an unreliable control system, and the dive should be aborted. Continuing a dive using a rebreather with a failed cell alarm significantly increases the risk of a fatal loop control failure. This system is not totally reliable. There has been at least one case reported where two cells failed similarly and the control system voted out the remaining good cell. If the probability of failure of each cell was statistically independent of the others, and each cell alone was sufficient to allow safe function of the rebreather, the use of three fully redundant cells in parallel would reduce risk of failure by five or six orders of magnitude. The voting logic changes this considerably. A majority of cells must not fail for safe function of the unit. In order to decide whether a cell is functioning correctly, it must be compared with an expected output. This is done by comparing it against the outputs of other cells. In the case of two cells, if the outputs differ, then one at least must be wrong, but it is not known which one. In such a case the diver should assume the unit is unsafe and bail out to open circuit. With three cells, if they all differ within an accepted tolerance, they may all be deemed functional. If two differ within tolerance, and the third does not, the two within tolerance may be deemed functional, and the third faulty. If none are within tolerance of each other, they may all be faulty, and if one is not, there is no way of identifying it. Using this logic, the improvement in reliability gained by use of voting logic where at least two sensors must function for the system to function is greatly reduced compared to the fully redundant version. Improvements are only in the order of one to two orders of magnitude. This would be great improvement over the single sensor, but the analysis above has assumed statistical independence of the failure of the sensors, which is generally not realistic. Factors which make the cell outputs in a rebreather statistically dependent include: • Common calibration gas – They are all calibrated together in the pre-dive check using the same diluent and oxygen supply. • Sensors are often from the same manufacturing batch – Components, materials and processes are likely to be very similar. • Sensors are often installed together and have since been exposed to the same P_{O_2} and temperature profile over the subsequent time. • Common working environment, particularly with regards to temperature and relative humidity, as they are usually mounted in very close proximity in the loop, to ensure that they measure similar gas. • Common measurement systems • Common firmware for processing the signals This statistical dependency can be minimised and mitigated by: • Using sensors from different manufacturers or batches, so that no two are from the same batch • Changing sensors at different times, so they each have a different history • Ensuring that the calibration gases are correct • Adding a statistically independent P_{O_2} measuring system to the loop at a different place, using a different model sensor, and using different electronics and software to process the signal. • Calibrating this sensor using a different gas source to the others An alternative method of providing redundancy in the control system is to recalibrate the sensors periodically during the dive by exposing them to a flow of either diluent or oxygen or both at different times, and using the output to check whether the cell is reacting appropriately to the known gas at the known depth. This method has the added advantage of allowing calibration at a higher oxygen partial pressure than 1 bar. This procedure may be done automatically, where the system has been designed to do it, or the diver can manually perform a
diluent flush at any depth at which the diluent is breathable to compare the cell P_{O_2} readings against a known F_{O_2} and absolute pressure to verify the displayed values. This test does not only validate the cell. If the sensor does not display the expected value, it is possible that the oxygen sensor, the pressure sensor (depth), or the gas mixture F_{O_2}, or any combination of these may be faulty. As all three of these possible faults could be life-threatening, the test is quite powerful.
Gas injection control circuit failure If the control circuit for oxygen injection fails, the usual mode of failure results in the oxygen injection valves being closed. Unless action is taken, the breathing gas will become hypoxic with potentially fatal consequences. An alternative mode of failure is one in which the injection valves are kept open, resulting in an increasingly hyperoxic gas mix in the loop, which may pose the danger of
oxygen toxicity. Prevention: Two basic approaches are possible. Either a redundant independent control system may be used, or the risk of the single system failing may be accepted, and the diver takes the responsibility for manual gas mixture control in the event of failure. Mitigation: Most (possibly all) electronically controlled CCRs have manual injection override. If the electronic injection fails, the user can take manual control of the gas mixture provided that the oxygen monitoring is still reliably functioning. Alarms are usually provided to warn the diver of failure.
Loop flood The breathing resistance of a loop may more than triple if the scrubber material is flooded. The absorption of carbon dioxide by the scrubber requires a certain amount of humidity for the reaction, but an excess will degrade absorption and may lead to accelerated breakthrough. Prevention: Predive leak checks and careful assembly are the key to avoiding leaks through connections and detecting damage. The negative pressure test is most important for this purpose. This test requires that the breathing loop maintains a pressure slightly below ambient for a few minutes to indicate that the seals will prevent leakage into the loop. Care in using the dive/surface valve will prevent flooding through the mouthpiece. This valve should always be closed when the mouthpiece is out of the mouth underwater. Mitigation: The diver will usually be made aware of flooding by increased breathing resistance, water noise, or carbon dioxide buildup, and sometimes by buoyancy loss. A
caustic cocktail is usually a sign of a fairly extensive flood and is only likely if there are a lot of small particles in the scrubber material, or a relatively soluble absorbent material is used. Some rebreathers have water traps to prevent water entering through the mouthpiece from getting as far as the scrubber, and in some cases there are mechanisms to remove water from the loop while diving. Some scrubbers are virtually unaffected by water, either due to the type of absorbent medium, or due to a protective membrane. If all else fails, and the loop is flooded beyond safe functionality, the diver can bail out to open circuit.
Gas leakage A well assembled rebreather in good condition should not leak gas from the breathing circuit into the environment except that which is required by functional considerations, such as venting during ascent, or to compensate for, or control, the addition of gas in a semi-closed rebreather. Prevention: Pre-use preparation of the rebreather includes checking of seals and post-assembly leak checks. The positive pressure test checks that the assembled unit can maintain a slight internal positive pressure for a short period, which is an indication that gas does not leak out of the loop. Inspection and replacement of soft components should detect damage before component failure. Mitigation: Minor gas leakage is not in itself a serious problem, but it is often a sign of damage or incorrect assembly that may later develop into a more serious problem. Manufacturer's operating manuals generally require the user to identify the cause of any leak and rectify it before using the equipment. Leaks which develop during a dive will be assessed by the dive team for cause and risk, but there is not often much that can be done about them in the water. Minor leaks may be tolerated, or the dive may be turned, depending on severity and the circumstances of the dive. A major leak may require bailout.
CMF orifice blockage A blockage to the constant mass flow orifice is one of the more hazardous failures of this type of semi-closed rebreather, as it will restrict the feed gas supply and may lead to a hypoxic loop gas with a high risk of the diver losing consciousness and either drowning or dry asphyxiation.. Prevention: Inspection and flow testing of the CMF orifice before each dive or on each diving day will ensure that the orifice does not clog from corrosion, and an upstream microfilter to trap particles large enough to block the orifice will greatly reduce the risk of blockage during a dive by foreign matter in the gas supply. Some rebreathers use two orifices as this will usually ensure that at least one remains functional, and the gas is less likely to become fatally hypoxic. Mitigation: If the oxygen content is monitored and the diver identifies a problem with feed gas delivery, it may be possible to manually add gas, or induce triggering of the automatic diluent valve by exhaling to the environment through the nose and thereby artificially reducing the volume of gas in the loop. The forced addition of gas will bring up the oxygen content, but the dive should be terminated as this problem can not be rectified during the dive. This hazard is the strongest argument for oxygen partial pressure monitoring in a CMF SCR.
Risk The percentage of deaths that involve the use of a rebreather among US and Canadian residents increased from approximately 1 to 5% of the total diving fatalities collected by the
Divers Alert Network from 1998 through 2004. Investigations into rebreather deaths focus on three main areas: medical, equipment, and procedural.
Divers Alert Network (DAN) report 80 to 100 fatal accidents per 500,000 to 1 million active scuba divers in the US, per year.
British Sub-Aqua Club (BSAC) and DAN open-circuit accident rates are very similar, although BSAC dives have a higher proportion of deep and decompression dives. An analysis of 164 fatal rebreather accidents documented from 1994 to February 2010 by Deep Life, reports a fatal accident rate of one in 243 per year, using a conservative assumption of linear growth of rebreather use and an average of around 2500 active participants over that time. This is a fatal accident rate of over 100 times that of open circuit scuba. The statistics indicate that equipment choice has a dramatic effect on dive safety. A further analysis of these rebreather deaths found significant inaccuracies in the original data. Review shows that the risk of death while diving on a rebreather is in the region of 5.33 deaths per 100,000 dives, roughly 10 times the risk of open circuit scuba or horseriding, five times the risk of skydiving or hang gliding, but one eighth the risk of base jumping. No significant difference was found when comparing MCCRs with ECCRs or between brands of rebreather since 2005, but accurate information on numbers of active rebreather divers and number of units sold by each manufacturer are not available. The survey also concluded that much of the increased mortality associated with CCR use may be related to use at greater than average depth for recreational diving, and to
high-risk behaviour by the users, and that the greater complexity of CCRs makes them more prone to equipment failure than OC equipment. EN 14143 (2009) (Respiratory equipment – Self-contained re-breathing diving apparatus [Authority: The European Union Per Directive 89/686/EEC]) requires that manufacturers perform a
Failure mode, effects, and criticality analysis (FMECA), but there is no requirement to publish the results, consequently most manufacturers keep their FMECA report confidential. EN 14143 also requires compliance with
EN 61508. According to the Deep Life report this is not implemented by most rebreather manufacturers, with the following implications: • no existing rebreather has been shown to be able to tolerate any one worst case failure. • users have no information on the safety of the equipment they use. • the public can not examine the conclusions of FMECA and challenge dubious conclusions. • there is no public FMECA data which can be used to develop better systems. Analysis of probability failure trees for open circuit scuba shows that use of a parallel or
redundant system reduces risk considerably more than improving the reliability of components in a single critical system. These risk modelling techniques were applied to CCRs, and indicated a risk of equipment failure some 23 times that for a manifolded twin cylinder open circuit set. When sufficient redundant breathing gas supply in the form of open circuit scuba is available, the mechanical failure risk of the combination becomes comparable to that for open circuit. This does not compensate for poor maintenance and inadequate pre-dive checks, high risk behavior, or for incorrect response to failures. Human error appears to be a major contributor to accidents. There are no formal statistics on underwater electronics failure rates, but it is likely that human error is more frequent than the error rate of electronic dive computers, which are the basic component of rebreather control electronics, which process information from multiple sources and have an algorithm for controlling the oxygen injection solenoid. The sealed dive computer package has been around for long enough for the better quality models to have become reliable and robust in design and construction. An electronically controlled rebreather is a complex system. The control unit receives input from several sensors, evaluates the data, calculates the appropriate next action or actions, updates the system status and displays, and performs the actions, in some cases using real-time feedback to adapt the control signal. The inputs include one or more of pressure, oxygen and temperature sensors, a clock, and possibly helium and carbon dioxide sensors. There is also a battery power source, and a user interface in the form of a visual display, and possibly audio and vibratory alarms. In a minimal eCCR the system is very vulnerable. A single critical fault can necessitate manual procedures for fault recovery or the need to bail out to an alternative breathing gas supply. Some faults may have fatal consequences if not noticed and managed very quickly. Critical failures include power supply, non-redundant oxygen sensor, solenoid or control unit. The mechanical components are relatively robust and reliable and tend to degrade non-catastrophically, and are bulky and heavy, so the electronic sensors and control systems have been the components where improved
fault tolerance has generally been sought. Oxygen cell failures have been a particular problem, with predictably serious consequences, so the use of multiple redundancy in oxygen partial pressure monitoring has been an important area of development for improving reliability. A problem in this regard is the cost and relatively short lifespan of oxygen sensors, along with their relatively unpredictable failure, and sensitivity to the environment. To combine cell redundancy with monitoring circuit, control circuit and display redundancy, the cell signals should all be available to all monitoring and control circuits in normal conditions. This can be done by sharing signals at the analog or digital stage – the cell output voltage can be supplied to the input of all monitoring units, or the voltages of some cells can be supplied to each monitor, and the processed digital signals shared. The sharing of digital signals may allow easier isolation of defective components if short circuits occur. The minimum number of cells in this architecture is two per monitoring unit, with two monitoring units for redundancy, which is more than the minimum three for basic voting logic capability. The three aspects of a fault tolerant rebreather are hardware redundancy, robust software and a fault detection system. The software is complex and comprises several modules with their own tasks, such as oxygen partial pressure measurement, ambient pressure measurement, Oxygen injection control, decompression status calculation and the user interface of status and information display and user inputs. It is possible to separate the user interface hardware from the control and monitoring unit, in a way that allows the control system to continue to operate if the relatively vulnerable user interface is compromised. Diver's Alert Network found that the actual cause of death determined by a medical examiner war drowning in 94% of recreational/technical rebreather fatalities. A military rebreather accident study found that drowning following loss of consciousness only occurred in 5.5% of cases. This much lower incidence of drowning has largely been attributed to safety protocols which include the use of a mouthpiece retaining strap (MRS) to secure the airway. There may have been other significant contributory differences in the circumstances of the incidents, such as the proximity of a buddy, the decompression status of the divers and the distance to the surface.
Mitigation A variety of options have been developed to reduce the risk of, and mitigate rebreather emergencies, which can be classified as equipment and procedural options.
Equipment options Mouthpiece retaining straps: These are intended to prevent the mouthpiece falling out of the diver's mouth if they lose consciousness, thereby reducing the risk of drowning. The
Rebreather Training Council issued a safety guidance note recommending the use of mouthpiece retaining straps. A mouthpiece retaining strap is also a mandatory design feature for rebreathers sold in the EU and UK, following European rebreather standard EN14143:2013. The arrangement is required to be adjustable or self adjusting, and to hold the mouthpiece firmly and comfortably in the user's mouth, and to minimise ingress of water if a diver has a convulsion or loses consciousness underwater.
Full-face masks: These provide a more secure airway than mouthpiece retaining straps, but may require special arrangements for bailout.
Bailout valves: A bailout valve that allows the diver to bai out to open circuit without removing the mouthpiece reduces the risks in a hypercapnic event, as the mouthpiece does not have to be removed to switch to open circuit, which is quick and eliminates the chance of inhaling while the airway is unprotected. This can be supplied from onboard diluent of offboard bailout cylinder, but the gas supply must be suitable for the depth. Like the mouthpiece, the BOV should be held securely by a mouthpiece retaining strap, unless mounted to a full-face mask. If provided with a quick connector, a rescuer cn connect a suitable gas for an unconscious diver while the mouthpiece remains in place, however, quick connections are a flow restriction that will decrease the performance of the open circuit demand valve, and should be tested to make sure they perform adequately at the maximum depth intended by the user. A bailout valve is also of great value in a hypercapnic incident where the diver may be unable or unwilling to shut off the DSV and insert a separate bailout demand valve, while the carbon dioxide levels are high. This is a real problem, and once in the hypercapnic feedback loop the desperate need to breathe continuously and rapidly may make it impossible to recover. A diluent flush might be enough in some cases to get carbon dioxide low enough to be able to switch.
Carbon dioxide monitoring: Two basic methods of detecting or monitoring carbon dioxide in the breathing loop are available as of 2024. Neither is entirely satisfactory. The temperature stich monitors the advance of the reaction front in the scrubber, but only on the line of the sensors, which is not necessarily the line at which breakthrough will occur. The other method is to use electronic sensors to measure carbon dioxide partial pressure at a point in the loop. One problem with this technology is that the sensors are also sensitive to water, and can give false positives. another problem is that the carbon dioxide in the loop is not always an accurate indication of hypercapnia, as the scrubbed gas can be within specification, but the diver may be building up high levels of carbon dioxide due to high work of breathing. Measuring end of exhalation peak carbon dioxide, which would catch this problem, is not yet (2023) available.
Alarms: Audible, visual, and tactile alarms may be available. Usually the default is visual alrm with the options of audible buzzers and sometimes tactile vibrators. Sometimes a head-up display is available, and sometimes a head up display positioned for visibility for the buddy is available.
Procedural options Checklists: To some extent electronic checklists are becoming an integral part of eCCR startup procedure, but they are still external to a significant part of pre-dive preparation. When using a checklist, it is important that each of the checks is verified. For example, to check that a gas supply valve has been opened, it is not sufficient to merely check gauge pressure, as this will register even if the valve was subsequently closed. Operating a valve that releases pressure will indicate whether the pressure drops of remains constant with some gas loss.
Statistics Statistics collected and analysed by DAN suggest that rebreather diving fatalities have averaged around 20-25 per year over the period from 2013 to 2023, which is slightly higher than the previous period, but there are also more rebreather divers doing more rebreather dives. 1400 to 2300 certifications per year are estimated, and the rebreather manufacturing industry has grown considerably, though accurate production and sales figures are not available. Cardiac events, hypoxia, and hyperoxia are the main causes of death where it is known with any confidence, and fatality rates have been estimated at 1.8 to 3.8 deaths per 100,000 dives or 1.2 to 2.5 deaths per 100,000 diving hours on rebreathers. The data are limited, and assumed to be underreported, particularly from Asia.
Demographics ==Standard operating procedures==