Electro-galvanic oxygen sensor

The oxygen content of a stored gas mixture can be analysed by passing a small flow of the gas over a recently calibrated cell for long enough that the output stabilises. The stable output represents the fraction of oxygen in the mixture. Care must be taken to ensure that the gas flow is not diluted by ambient air, as this would affect the reading.

The partial pressure of oxygen in anaesthetic gases is monitored by siting the cell in the gas flow, which is at local atmospheric pressure, and can be calibrated to directly indicate the fraction of oxygen in the mix.

The partial pressure of oxygen in diving chambers and surface supplied breathing gas mixtures can also be monitored using these cells. This can either be done by placing the cell directly in the hyperbaric environment, wired through the hull to the monitor, or indirectly, by bleeding off gas from the hyperbaric environment or diver gas supply and analysing at atmospheric pressure, then calculating the partial pressure in the hyperbaric environment. This is frequently required in saturation diving and surface oriented surface supplied mixed gas commercial diving.[5][2]

The breathing gas mixture in a diving rebreather loop is usually measured using oxygen cells, and the output of the cells is used by either the diver or an electronic control system to control addition of oxygen to increase partial pressure when it is below the chosen lower set-point, or to flush with diluent gas when it is above the upper set-point. When the partial pressure is between the upper and lower set-points, it is suitable for breathing at that depth and is left until it changes as a result of consumption by the diver, or a change in ambient pressure as a result of a depth change.

Accuracy and reliability of measurement is important in this application for two basic reasons. Firstly, if the oxygen content is too low, the diver will lose consciousness due to hypoxia and probably die,[6] or if the oxygen content is too high, the risk of central nervous system oxygen toxicity causing convulsions and loss of consciousness, with a high risk of drowning becomes unacceptable.[6] Secondly, decompression obligations cannot be accurately or reliably calculated if the breathing gas composition is not known.[6] Pre-dive calibration of the cells can only check response to partial pressures up to 100% at atmospheric pressure, or 1 bar. As the set points are commonly in the range of 1.2 to 1.6 bar,[6] special hyperbaric calibration equipment would be required to reliably test the response at the set-points. This equipment is available, but is expensive and not in common use, and requires the cells to be removed from the rebreather and installed in the test unit. To compensate for the possibility of a cell failure during a dive, three cells are generally fitted, on the principle that failure of one cell at a time is most likely, and that if two cells indicate the same P_O2, they are more likely to be correct than the single cell with a different reading. Voting logic allows the control system to control the circuit for the rest of the dive according to the two cells assumed to be correct. This is not entirely reliable, as it is possible for two cells to fail on the same dive.[6]

The sensors should be placed in the rebreather where a temperature gradient between the gas and the electronics in the back of the cells will not occur.[1]

When new, a sensor can produce a linear output for over 4 bar partial pressure of oxygen, and as the anode is consumed the linear output range drops, eventually to below the range of partial pressures which may be expected in service, at which stage it is no longer fit to control the system. The maximum output current eventually drops below the amount needed to indicate the full range of partial pressures expected in operation. This state is called current-limited. When a current limited sensor can no longer reliably activate the control system at the upper set-point in a life support system, there is a severe risk of an excessive oxygen partial pressure occurring which will not be noticed, which can be life-threatening.[1]

Other failure modes include mechanical damage, such as broken conductors, corroded contacts and loss of electrolyte due to damaged membranes.[1]

Failing high is invariably a result of a manufacturing fault or mechanical damage. In rebreathers, failing high will result in the rebreather assuming that there is more oxygen in the loop than there actually is which can result in hypoxia.

Current limited cells do not give a high enough output in high concentrations of oxygen.[1] The rebreather control circuit responds as if there is insufficient oxygen in the loop and injects more oxygen to reach a setpoint the cell can never indicate resulting in hyperoxia.

Non-linear cells do not perform in the expected manner across the required range of oxygen partial pressures. Two-point calibration against diluent and oxygen at atmospheric pressure will not pick up this fault which results in inaccurate loop contents of a rebreather. This gives the potential for decompression illness if the loop is maintained at a lower partial pressure than indicated by the cell output, or hyperoxia if the loop os maintained at a lower partial pressure than indicated by cell output.

Preventing accidents in rebreathers from cell failures is possible in most cases by accurately testing the cells before use. Some divers carry out in-water checks by pushing the oxygen content in the loop to a pressure that is above that of pure oxygen at sea level to indicate if the cell is capable of high outputs. This test is only a spot check and does not accurately assess the quality of that cell or predict its failure. The only way to accurately test a cell is with a test chamber which can hold a calibrated static pressure above the upper set-point without deviation and the ability to record the output voltage over the full range of working partial pressures and graph them.

If more than one statistically independent cell is used, it is unlikely that more than one will fail at a time. If one assumes that only one cell will fail, then comparing three or more outputs which have been calibrated at two points is likely to pick up the cell which has failed by assuming that any two cells that produce the same output are correct and the one which produces a different output is defective. This assumption is usually correct in practice, particularly if there is some difference in the history of the cells involved.[9] The concept of comparing the output from three cells at the same place in the loop and controlling the gas mixture based on the average output of the two with the most similar output at any given time is known as voting logic, and is more reliable than control based on a single cell. If the third cell output deviates sufficiently from the other two, an alarm indicates probable cell failure. If this occurs before the dive, the rebreather is deemed unsafe and should not be used. If it occurs during a dive, it indicates an unreliable control system, and the dive should be aborted. Continuing a dive using a rebreather with a failed cell alarm significantly increases the risk of a fatal loop control failure. This system is not totally reliable. There has been at least one case reported where two cells failed similarly and the control system voted out the remaining good cell.[6]

If the probability of failure of each cell was statistically independent of the others, and each cell alone was sufficient to allow safe function of the rebreather, the use of three fully redundant cells in parallel would reduce risk of failure by five or six orders of magnitude.[6]

The voting logic changes this considerably. A majority of cells must not fail for safe function of the unit. In order to decide whether a cell is functioning correctly, it must be compared with an expected output. This is done by comparing it against the outputs of other cells. In the case of two cells, if the outputs differ, then one at least must be wrong, but it is not known which one. In such a case the diver should assume the unit is unsafe and bail out to open circuit. With three cells, if they all differ within an accepted tolerance, they may all be deemed functional. If two differ within tolerance, and the third does not, the two within tolerance may be deemed functional, and the third faulty. If none are within tolerance of each other, they may all be faulty, and if one is not, there is no way of identifying it.[6]

Using this logic, the improvement in reliability gained by use of voting logic where at least two sensors must function for the system to function is greatly reduced compared to the fully redundant version. Improvements are only in the order of one to two orders of magnitude. This would be great improvement over the single sensor, but the analysis above has assumed statistical independence of the failure of the sensors, which is generally not realistic.[6]

Factors which make the cell outputs in a rebreather statistically dependent include:[6]

• Common calibration gas - They are all calibrated together in the pre-dive check using the same diluent and oxygen supply.
• Sensors are often from the same manufacturing batch - Components, materials and processes are likely to be very similar.
• Sensors are often installed together and have since been exposed to the same P_O2, temperature profile over the subsequent time.
• Common working environment, particularly with regards to temperature and relative humidity, as they are usually mounted in very close proximity in the loop, to ensure that they measure similar gas.
• Common measurement systems
• Common firmware for processing the signals

This statistical dependency can be minimised and mitigated by:[6]

• Using sensors from different manufacturers or batches, so that no two are from the same batch
• Changing sensors at different times, so they each have a different history
• Ensuring that the calibration gases are correct
• Adding an statistically independent P_O2 measuring system to the loop at a different place, using a different model sensor, and using different electronics and software to process the signal.
• Calibrating this sensor using a different gas source to the others

An alternative method of providing redundancy in the control system is to recalibrate the sensors periodically during the dive by exposing them to a flow of either diluent or oxygen or both at different times, and using the output to check whether the cell is reacting appropriately to the known gas as the known depth. This method has the added advantage of allowing calibration at higher oxygen partial pressure than 1 bar.[6] This procedure may be done automatically, where the system has been designed to do it, or the diver can manually perform a diluent flush at any depth at which the diluent is breathable to compare the cell P_O2 readings against a known F_O2 and absolute pressure to verify the displayed values. This test does not only validate the cell. If the sensor does not display the expected value, it is possible that the oxygen sensor, the pressure sensor (depth), or the gas mixture F_O2, or any combination of these may be faulty. As all three of these possible faults could be life-threatening, the test is quite powerful.[6]