U.S. Navy Diving and Aviation Safety

Blood pressure is not the only silent medical killer. Hypoxia is also, and unlike chronically elevated blood pressure, it cripples within minutes, or seconds.

Hypoxia, a condition defined by lower than normal inspired oxygen levels, has killed divers during rebreather malfunctions, and it has killed pilots and passengers, as in the 1999 case of loss of cabin pressure in a Lear Jet that killed professional golfer Payne Stewart and his entourage and aircrew. Based on Air Traffic Control transcripts, that fatal decompression occurred somewhere between an altitude of 23,000 feet and 36,500 ft.

In most aircraft hypoxia incidents, onset is rapid, and no publically releasable record is left behind. The following recording is an exception, an audio recording of an hypoxia emergency during a Kalitta Air cargo flight.

Due to the seriousness of hypoxia in flight, military aircrew have to take recurrent hypoxia recognition training, often in a hypobaric (low pressure) chamber.

As the following video shows, hypoxia has the potential for quickly disabling you in the case of an airliner cabin depressurization.

Aircrew who must repeatedly take hypoxia recognition training are aware that such training comes with some element of risk. Rapid exposure to high altitude can produce painful and potentially dangerous decompression sickness (DCS) due to the formation of bubbles within the body’s blood vessels.

In a seminal Navy Experimental Diving Unit (NEDU) report published in 1991, LCDR Bruce Slobodnik, LCDR Marie Wallick and LCDR Jim Chimiak, M.D. noted that the incidence of decompression sickness in altitude chamber runs from 1986 through 1989 was 0.16%, including both aviation physiology trainees and medical attendants at the Naval Aerospace Medical Institute. Navy-wide the DCS incidence “for all students participating in aviation physiology training for 1988 was 0.15%”. If you were one of the 1 and a half students out of a thousand being treated for painful decompression sickness, you would treasure a way to receive the same hypoxia recognition training without risk of DCS.

With that in mind, and being aware of some preliminary studies (1-3), NEDU researchers performed a double blind study on twelve naïve subjects. A double-blind experimental design, where neither subject nor investigator knows which gas mixture is being provided for the test, is important in medical research to minimize investigator and subject bias. Slobodnik was a designated Naval Aerospace Physiologist, Wallick was a Navy Research Psychologist, and Chimiak was a Research Medical Officer. (Chimiak is currently the Medical Director at Divers Alert Network.)

Three hypoxic gas mixtures were tested (6.2% O2, 7.0% and 7.85% O2) for a planned total of 36 exposures. (Only 35 were completed due to non-test related problems in one subject.) Not surprisingly, average subject performance in a muscle-eye coordination test (two-dimensional compensatory tracking test) declined at the lower oxygen concentrations. [At the time of the testing (1990), the tracking test was a candidate for the Unified Triservice Cognitive Performance Assessment Battery (UTC-PAB)].

As a result of this 1990-1991 testing (4), NEDU proved a way of repeatedly inducing hypoxia without a vacuum chamber, and without the risk of DCS.

The Navy Aerospace Medical Research Laboratory built on that foundational research to build a device that safely produces hypoxia recognition training for aircrew. That device, a Reduced Oxygen Breathing Device is shown in this Navy photo.

070216-N-6247M-009 Whidbey Island, Wash. (Feb 16, 2007) Ð Lt. Cmdr. James McAllister, from San Diego, Calif. sits in the simulator during a test flight using the new Reduced Oxygen Breathing Device (ROBD). The ROBD is a portable device that delivers a mixture of air, nitrogen and oxygen to aircrew, simulating any desired altitude. Combined with a flight simulator the ultimate effect replicates an altitude induced hypoxia event. McAllister is the Director of the Aviation Survival Training Center at Whidbey Island. U.S. Navy photo by Mass Communication Specialist 1st Class Bruce McVicar (RELEASED)
Whidbey Island, Wash. (Feb 16, 2007) Lt. Cmdr. James McAllister, from San Diego, Calif. sits in the simulator during a test flight using the Reduced Oxygen Breathing Device (ROBD). The ROBD is a portable device that delivers a mixture of air, nitrogen and oxygen to aircrew, simulating any desired altitude. Combined with a flight simulator the ultimate effect replicates an altitude induced hypoxia event. McAllister is the Director of the Aviation Survival Training Center at Whidbey Island. U.S. Navy photo by Mass Communication Specialist 1st Class Bruce McVicar.

Although NEDU is best known for its pioneering work in deep sea and combat diving, it continues to provide support for the Air Force, Army and Marines in both altitude studies of life-saving equipment, and aircrew life support systems. Remarkably, the deepest diving complex in the world, certified for human occupancy, also has one of the highest altitude capabilities. It was certified to an altitude of 150,000 feet, and gets tested on occasion to altitudes near 100,000 feet. At 100,000 feet, there is only 1% of the oxygen available at sea level. Exposure to that altitude without a pressure suit and helmet would lead to almost instantaneous unconsciousness.

OSF FL 900
A test run to over 90,000 feet simulated altitude.

Separator small

  1. Herron DM. Hypobaric training of flight personnel without compromising quality of life. AGARD Conference Proceedings No. 396, p. 47-1-47-7.
  2. Collins WE, Mertens HW. Age, alcohol, and simulated altitude: effects on performance and Breathalyzer scores. Aviat. Space Environ Med, 1988; 59:1026-33.
  3. Baumgardner FW, Ernsting J, Holden R, Storm WF. Responses to hypoxia imposed by two methods. Preprints of the 1980 Annual Scientific Meeting of the Aerospace Medical Association, Anaheim, CA, p: 123.
  4. Slobodnik B, Wallick MT, Chimiak, JM. Effectiveness of oxygen-nitrogen gas mixtures in inducing hypoxia at 1 ATA. Navy Experimental Diving Unit Technical Report 04-91, June 1981.


The Siren’s Call of Rebreather Oxygen Sensors

Sirens Cove (contributed by Spanish Conqueror to Mythical Mania Wiki)

In Greek mythology irresistibly seductive female creatures were believed to use enchanted singing to beckon sailors to a watery grave.

Why this myth endured through the centuries is difficult to say. However, my theory is that it helped explain to grieving widows and mothers why ships sometimes inexplicably disappeared, taking their crew with them, never to be seen again. By the reasoning of the time, there must have been some sort of feminine magic involved.

The oxygen sensors in closed-circuit, electronically or computer-controlled rebreathers are a magic device of sorts. They enable a diver to stay underwater for hours, consuming the bare minimum of oxygen required. The only thing better than a rebreather using oxygen sensors would be gills. And in case you wondered, gills for humans are quite impractical, at least for the foreseeable future. r22van

I have written, or helped write three diving accident reports where the final causal event in a rebreather accident chain proved to be faulty oxygen sensors. So for me, the Siren call of this almost magical sensor can, and has, lured divers to their seemingly blissful and quite unexpected death.

Those who use oxygen sensors know that if the sensor fails leading to a hypoxic (low oxygen) state, loss of consciousness comes without warning. If sensor failure results in a hyperoxic state (too high oxygen), seizures can occur, again leading to loss of consciousness, usually without warning. Unless a diver is using a full facemask, loss of consciousness for either reason quickly leads to drowning.

EX 19 rebreather (U.S. Navy photo)

Due to the life-critical nature of oxygen control with sensors, three sensors are typically used, and various “voting” algorithms are used to determine if all the sensors are reliable, or not. Unfortunately, this voting approach is not fail-proof, and the presence of three sensors does not guarantee “triple” redundancy.

In one rebreather accident occurring during the dawn of computer-controlled rebreathers, a Navy developed rebreather cut off the oxygen supply to a diver at the Navy Experimental Diving Unit, and all rebreather alarms failed. The diver went into full cardiopulmonary arrest caused by hypoxia. Fortunately, the NEDU medical staff saved the diver’s life, aided in part by the fact that he was in only 15 feet of water, in a pool.

In two more recent accidents the rebreathers kept feeding oxygen to the diver without his knowledge.  One case was fatal, and the other should have been but was not. Why it did not prove fatal can only be explained by the Grace of God.

The two cases were quite different. In one the diver broke a number of safety rules and began a dive with known defective equipment. He chose to assume that his oxygen sensors were in better shape than the rest of his rebreather. If he had been honest with himself, he would have realized they weren’t. If he had been honest with himself, he would still be alive.

The other dive was being run by an organization with a reputation for being extremely safety conscious. Nevertheless, errors of omission were made regarding oxygen sensors which almost cost the experienced diver his life.

In the well-documented Navy case, water from condensation formed over the oxygen sensors, causing them to malfunction. The water barrier shielded the sensors from oxygen in the breathing loop, and as the trapped oxygen on the sensor face was consumed electrochemically the sensor would indicate a declining oxygen level in the rig, regardless of what was actually happening. Depending on how the sensor voting logic operated, and the number of sensors failing, various bad things could happen.

During its accident investigation, when NEDU used a computer simulation to analyze the alarm and sensor logic, it found that if two of the three sensors were to be blocked (locked) by condensed water, the rig could lose oxygen control in either a hypoxic or hyperoxic condition. Based on a random (Monte Carlo) sensor failure simulation, low diver work loads were more often associated with hypoxia than higher work rates, even with one sensor working normally.

We deduce from this result that “triple redundancy” really isn’t.

The white circles at the top left of this scrubber canister housing are the three oxygen sensors used in an experimental U.S. Navy rebreather.

When the accident rig was tested in the prone (swimming) position at shallow depth, after 2 to 3 hours sensors started locking out, and the rig began adding oxygen continuously. The computer simulation showed that the odds of an alarm being signaled to the diver was only 50%. The diver therefore could not count on being alerted to a sensor problem.

Unfortunately in this near fatal case the rig stopped adding oxygen, the diver became hypoxic and the diver received no alarms at all.

After NEDU’s investigation, the alarm logic was rewritten with a vast improvement in reliability. The orientation of the sensors was also changed to minimize problems with condensation.

Today what is being seen are divers who extend the use of their sensors beyond the recommended replacement date. Like batteries, oxygen sensors have a shelf-life, but they also have a life dependent on use. Heavily used sensors may well be expended long before their shelf-life has expired.

The Siren, by John Williams Waterhouse.

Presumably, the birthing pains of the relatively new underwater technology based on oxygen sensors have now passed. Nevertheless, those who use rebreathers should be intimately familiar with the many ways sensors, and their electronic circuitry, can lead divers ever so gently to their grave.

Like sailors of old, there are ways for divers to resist being lulled to their death by oxygen sensors. First among them is suspicion.  When you expect to have a great day of diving, you should be suspicious that your rebreather may have different plans for you. Your responsibility to yourself, your dive buddies and your family is to make sure that the rebreather, like a Siren, does not succeed in ruining your day.


The best way to ward off sensor trouble is through education. To that end, Internet sites like the following are useful. Check with your rebreather manufacturer or instructor for additional reading material.