Functional Safety, Human Factors and General Safety Discussion (Moved from Mk VI)

[GLOC]

Rather than spiral into a pit, rise to this:

Agreed. I believe that both sides are out and I do not want (or need) any more 'he said, she said' comments.

Tell us please, what you are doing to improve the Functional Safety of your products.

What improvement are you considering in response to this accident? What mitigations have you taken already?

Alex

Alex, I would also ask what you are doing to get YOUR products to market and being used by the public? The safest rebreather is one that isn't used/or the easiest way to prevent diving fatalities is not to go diving. You would have far more credibility if your units were available to be used the public and that you provide firm evidence that your military and commercial units are in actual use.

Regards

 

[AD_Ward9]

Agreed. I believe that both sides are out and I do not want (or need) any more 'he said, she said' comments.

Alex, I would also ask what you are doing to get YOUR products to market and being used by the public? The safest rebreather is one that isn't used/or the easiest way to prevent diving fatalities is not to go diving. You would have far more credibility if your units were available to be used the public and that you provide firm evidence that your military and commercial units are in actual use.

Apocs are in production and we have a fair number of active users. Yes, iCCR model has been held back, but basic units were shipped and the OSEL factory is very busy.

Military, one of our customers has them at IMDEX next week. Other than that, I am not permitted to comment.

Commercial, customers on that have published a fair bit. I am technical, not involved in the commercial side so won't comment, other than it was reported to me recently they have been in intensive use and performance is excellent - as we knew.

What matters to this discussion is what safety improvements we can do as an industry, from learning from accidents on others units. Here the diver was to blame for an accident on a third party rebreather.

You are studying Human Factors in rebreather safety, so I am very surprised that you are not interested in the Functional Safety response of "Could this accident occur on our product, if so, is there anything further we can do to mitigate it?". One thing is for sure, human divers will continue acting like humans.

Accidents should be about learning how to improve. The worst thing is to see an accident on a product one is responsible for, because one ignored the lessons seen by a third party. There are three ways to learn: "Either 1) Read it, or 2) Observe mistakes of others, or 3) suffer the mistake yourself". Surely we all want to be in 1) or 2), as lesson 3) is tough.

I have stated what we are doing as part of our product development in the light of this MkVI accident, even though we do have mitigations in place already that "should" reduce the chance of such an accident occurring. I have described several mechanical solutions, ranging in cost from a cost of pennies (viewing window) to ten Euro (spring loaded plate). I would be keen to hear of solutions from others and see wider action to avoid such accidents occurring again.

Alex

 

[GLOC]

Actually my studies aren't on rebreather safety, they are looking at the errors and violations which take place across the spectrum of Human Factors from organisational through to the individual in sport diving in general.

We have a good idea of 'what happens' but not why. Functional safety is part of that and whilst I am going to cover it, I am not going to go into a massive amount of detail because I do not believe it is the 'sizing case' when it comes to improving safety and I am more interested in why people do the things they do and as a consequence focussing on non-fatal incidents rather than fatals for a number of reasons.

If you can ask your commercial team to provide links to published work that would be great. I am involved in military procurement so forgive me if I am a little sceptical when it comes to having something on a stand at a military expo as being evidence of being fielded. I know of a number of pieces of equipment that were being advertised for sale at Farnborough which have not even finished the Technology Demonstration Programme (TDP) stage yet; programmes which I am involved in directly.

Regards

 

[paulraymaekers]

Tell us please, what you are doing to improve the Functional Safety of your products.

What improvement are you considering in response to this accident? What mitigations have you taken already?

Alex

I'll only reply to factual questions, not to slander/ false statements: I urge you to do the same for the good of this discussion

1 our product is on the market and is extensively used: so we have data on reliability

2 functional safety: redundancy both mechanical and electronic: if the procedures are followed, the likelyhood is < 1/1.000.000 dives that the unit will give you unbreathable gas UNNOTICED

3 regarding this accident: rEvo has full scrubber monitoring: if the scrubber is not in the unit, it shows on the handset, and even if fitted, but empty, the handset shows you the sorb does not work

so it's not what we 'will do', but what is actually on the market!

 

[AD_Ward9]

Functional safety is part of that and whilst I am going to cover it, I am not going to go into a massive amount of detail because I do not believe it is the 'sizing case' when it comes to improving safety and I am more interested in why people do the things they do and as a consequence focussing on non-fatal incidents rather than fatals for a number of reasons.

If you can ask your commercial team to provide links to published work that would be great. I am involved in military procurement so forgive me if I am a little sceptical when it comes to having something on a stand at a military expo as being evidence of being fielded. I know of a number of pieces of equipment that were being advertised for sale at Farnborough which have not even finished the Technology Demonstration Programme (TDP) stage yet; programmes which I am involved in directly.

Regards

On your first point, that is a shame as it addresses a lot of what human factors are all about at a practical level. If you don't go into it, then your PhD will suffer from the effect described by Justin Kruger and David Dunning in their landmark paper "Unskilled and unaware of it".

On the second point, military avionics. I remember recruiting design engineers from Ferranti and Marconi in 1993, who worked on the "latest" jet avionics, how they described the systems they just finished designing, but it would take 30 years before entering service on Program XYZ - likely when they would be about to retire. Fortunately dive products go into full service faster, but not like lighting: after CE there are a lot of reliability tests etc to ensure products don't have any field issues. The primary client for the Incursion is a demanding top-brand company, who are happy at it being at IMDEX with the products they ship in large quantities to navies around the world.

Alex

 

[GLOC]

On your first point, that is a shame as it addresses a lot of what human factors are all about at a practical level. If you don't go into it, then your PhD will suffer from the effect described by Justin Kruger and David Dunning in their landmark paper "Unskilled and unaware of it".

I know about the Kruger and Dunning effect and it certainly has an impact. However, I would argue, but don't have the evidence, that a large percentage of people know the risks that they are taking but choose to ignore them. Diver having heart surgery 3 weeks before going diving, diver with stents in place and taking GTN, divers diving deep air on high task-load diving running out of gas, diver being told that their kit was unsafe because of a number of issues and had to be rescued and resuscitated, diver entering water after massive blunt trauma and dying...the list goes on. These won't be resolved by Functional Safety and unless you have evidence to show 'undetected' failures are the major cause of fatalities (which are only one or two steps beyond an incident), then I am going to continue to focus on this. I have already been told to bring my scope of study down to a more manageable level - this is one PhD not 10! I know there will be a statement in the conclusion that says 'More work required...' and this should include non-biased, non-commercially focussed work, but who will pay for it? Sport diving is not considered an important aspect of general society and therefore does not attract interest (and funding) until certain individuals make it easier to do 'something' than 'nothing' although what is done doesn't necessarily make a difference. This video RoSPA CCR Aware - YouTube has only been viewed 126 times...

On the second point, military avionics. I remember recruiting design engineers from Ferranti and Marconi in 1993, who worked on the "latest" jet avionics, how they described the systems they just finished designing, but it would take 30 years before entering service on Program XYZ - likely when they would be about to retire. Fortunately dive products go into full service faster, but not like lighting. The primary client for the Incursion is a demanding top-brand company, who are happy at it being at IMDEX with the products they ship in large quantities to navies around the world.

Alex

Looking forward to see the formal notifications of it going into service but I still stand by my statement, having it on show means diddly-squat when it comes to proving that it is in service and is acceptable to the user. If the commercial units are in service, you should be able to get that evidence relatively easily especially if it a game-changing capability.

Regards

 

[Mark Chase]

Actions on how to avoid repeat accidents is what this thread should be about. I would not have thought it very difficult to produce devices that shut off the gas path when the scrubber is not fitted. We had another device for when the O2 was not flowing ... purely mechanical, again replaced by the ALVBOV and relies on electronics, and worse, an electro-mechanical actuator.

Alex

Well said

ATB

Mark

 

[Randy Thornton]

Alex,

I find it somewhat amazing that you find it acceptable to criticize and even testify in court against other manufacturers's product and design when your own product is not actually to market. It is one thing to have great theoretical ideas. The world is full of big idea people. The secret to success is to being able to recognize the difference between a "great idea" and an idea that is capable of being brought to fruition in a reasonable time frame, at a reasonable cost, in a reasonable manner.

Having been in business for almost 35 years, I have seen people over the years who think that the way to be successful is to try to belittle, undercut and generally destroy their competition. In my experience, these people are rarely if ever successful in the long run. Sure, every businessman needs to have identified their unique selling proposition, but constantly attacking and trying to undermine their competition is not a USP. In fact, it is pretty much a recipe for disaster. Maybe if you focussed on actually getting your theoretical product to market instead of worrying about what every other manufacturer is or is not doing with their "real" products, you might actually have something for people to comparison shop with. Theory is all fine and dandy, but at the end of the day, theory is just theory.

We are all interested in your theories, but please for your own dignity, don't try to compare theory against real product. Once you have an actual product in the marketplace, you should feel free to suggest that prospective customers comparison shop. Until then, it is a bit like the person who walks into a car dealership with no cars and the salesman suggest that he shouldn't buy or drive any existing cars on the market because they are all unsafe and if the prospective buyer will just put down a deposit, they will be first in line when the new theoretical car comes out on the market. A bit disingenuous in my opinion.

You have some interesting ideas. Why not focus on getting them implemented in an actual production unit and stop worrying about your competition. If you spent as much energy on your own products as you seem to spend on trying to injure your competition, you just might have something in the marketplace by now.

Just my $.02

Regards,
Randy

 

[AD_Ward9]

I find it somewhat amazing that you find it acceptable to criticize and even testify in court against other manufacturers's product and design when your own product is not actually to market.

Randy, I was not criticising others here. I was being criticised, just as you are doing to me here, but I did not take Paul R to task over his claims other than ask that the thread focus on solutions rather than attacks. Instead of address the safety issues, you use the opportunity apparently to ask that they remain hidden.

However to keep the record straight, the rebreathers we developed are in the market, and they are being delivered other than the iCCR variant of the Apoc just now. What you miss entirely is the history and issue, of WHY we even make rebreathers.

In 2000, a rebreather had several goes at killing me (hanging, going into non-life support states etc). I examined the controller, and was astonished at what I found. I advised the manufacturer privately. They did a couple of extremely urgent fixes, but ignored the rest of the issues.

In 2001, nothing had improved so we developed some rebreathers for our own use, and used it as a research vehicle. We were not happy to dive the rebreathers we bought after we had seen underneath the covers, hence we were pushed into that development to get something we were happy diving.

In 2003, EN 14143:2003 was adopted including the IEC 61508 requirement. We hoped this would encourage improvements in safety.

In 2005 nothing had happened with fixing those other issues, nor did I see any progress at implementing IEC 61508 as was required by law, so I went public with the issues. I could not sit quiet and see accidents piling up, with a high probability that these issues were involved in a significant fraction of them.

In 2006, people asked for more detail of fixes and solutions, so I published those, free of charge, and they are still there and read heavily judging by the monthly download rate.

In 2009, I was told to either shut up or put my money where my mouth was, so we develop a sports unit meeting IEC 61508 spawned out of the rebreather development we were doing that was not in the sports sector. So we launched the Apoc.

In early 2010, the CE audit increased by orders of magnitude in intensity. We did the extra work, paid a lot more, and in 2011 got the certificates. We also achieved IEC 61508 - a first for any piece of dive equipment.

In March 2011 OSEL started shipping the Apocs and cleared all the original basic unit orders. They continue shipping new orders for those and also for iCCR splits - the backlog grows and shrinks, but they are shipped.

We are passionate about safety, and promote that in conferences, by publications, and yes, we will act as an expert witness where appropriate, and we also will pay for anyone damaged in an accident to get proper expert witnesses when our own units are used in a situation that becomes an accident - diving is risky so that will happen at some point.

I see from the thanks you got, what the real issue is here. I am in the wrong place. A discussion that has no real interest in safety or creation of any improvement.

 

[opheim]

I see from the thanks you got, what the real issue is here. I am in the wrong place. A discussion that has no real interest in safety or creation of any improvement.

Don't think so, the issue is just that "everyone" considers the Apoc-saga to be about the iCCR - pure and simple. That's where the really interesting bling is supposed to be (the "real" ALVBOV, the CO2-stuff etc). The Apoc available at the market is a 6m device with no real bling, and needs modifications (rendering it non-CE etc) to be usable for anything deeper than 6m, hence - not very interesting. The (alledged?) military and commercial units are at least not available to the public, so they are not really interesting either.

Personally I still think the ideas behind the "real" apoc are extremely interesting, the CO2-stuff and the apparent breathing characteristics are indeed impressive. But as others mentioned - the discussion should be around safety, and it needs to be clear that much of what you add to the debate can't possibly be regarded as anything but theoretical as long as the iCCR is still only available to the publich purely through PDFs.

So I would encourage you to stick around, but try to keep the discussion about "actual products" limited to the only unit available to the public, and the more tempting subjects concerning the iCCR (or military/commercial units) on a more theoretical level. As many have said before - as soon as the iCCR hits the market (and I for one really hope it does - with great success, as that would be a true revolution in the CCR market judging by the last 5 years worth of debates and PDFs) you'll have all the "rights" in the world to "stick it" to the other manufacturers. Until then - stick with the theory, and be constructive about it.


That being said - wouldn't Pauls solution be sufficient, as in the rms monitoring of the scrubber, telling the diver that the scrubber is not installed and/or not working? Although I'm not sure it would have helped in the case which brought on this discussion, as the diver (most likely) never did a prebreathe. Not sure Pauls gadget would reveal the information about scrubber state before a prebreathe?

 

[paulraymaekers]

....Not sure Pauls gadget would reveal the information about scrubber state before a prebreathe?

if the scrubber is not installed, or not starting up during pre-breath, you get no 'green light' to jump
of course you can jump, but you were clearly warned the unit was not funtional

 

[Simon Mitchell]

How hard is it to switch the rebreather on and inject gas if the PPO2 is below 0.16atm? How hard is it to employ real engineers to design circuits so they don't hang instead of allowing amateur salesmen to do it? How hard is it to fit rechargeable batteries that do not suffer battery bounce? How hard is it to include a brown out circuit and a watchdog timer and test them to ensure they actually work? How hard is it to ensure there are no non-life support modes in a rebreather controller's software (i.e. nowhere for the program to get stuck in, where it stops injecting O2 or stops updating the PPO2 display). How hard is it to remove or disable the Power Off button? These things are not rocket science but elementary.

Probably harder than producing an oxygen addition button that doesn't put the user's life in danger by sticking open!!

On the subject of your commercial and military units: Everyone can see through it Alex. You have delivered some prototypes to manufacturers who, you claim, are happy with them. Great. But the umbilical rebreather currently does not appear on the product list of the company who intend producing it, and the military rebreather is going to be at a show. So what? It was at a show 3 or 4years ago, and still no military unit has purchased it.

Finally, people can judge that bizarre document on your website for themselves, but in my opinion you just make a colossal fool of yourself.

Simon M

 

[Oldefors]

In early 2010, the CE audit increased by orders of magnitude in intensity. We did the extra work, paid a lot more, and in 2011 got the certificates. We also achieved IEC 61508 - a first for any piece of dive equipment.

I'm confused - how can a rebreather whose functional safety in great extent relies on an ALVBOV actuator be CE certified and reach SIL 3 when said actuator doesn't work properly?

 

[AD_Ward9]

[

Probably harder than producing an oxygen addition button that doesn't put the user's life in danger by sticking open!!
[

Simon, We are the only company I am aware of that has designed and seen to production, an oxygen addition button that does not put the users life in immediate danger when the oxygen injection button sticks on.

It is a fact that the oxygen addition button can stick on in all O2 injectors. The key Functional Safety response is to ensure when it happens, the injector fails in safe state. We can debate what is a safe state is until the cows come home, but in this case it is one that a group concluded was safe after looking at the alternatives, and turned out to be safe in practice when this failure occurred.

Rather than be part of the problem attempting to conceal the real design issues in rebreathers, you could improve rebreather safety by openly identifying these, in the small area where you have some expertise.

As there are commercial sensitivities to the rest of your post, I will say no more on your other points other than being designers in the supply chain, Deep Life have little to do with the commercial diving product once it was certified, tested and delivered other than observe its successful use in the field at a distance. What I can say is that the company handling the commercialisation reports they continue to use and operate the umbilical rebreathers and praise its excellent performance.

Whether customers wish to use the umbilical unit or put them on their product list is up to them. Why this is the case is not for public debate however all the reasons are due to factors that have nothing to do with the rebreather or its design. What our customers elect to do with their products is to a great extent up to the customer themselves: once the product is delivered it has nothing to do with me and my team unless support requirements are requested.

On the specific military Incursion rebreather that we have designed, just to correct a matter of fact, while we had production spec Apocs at DEMA in 2009, the eCCR Incursion there was a prototype. It was delivered only after getting CE in 2011 and went into trials. There are other versions of the Incursion too ... such as that with the customer at IMDEX. All professional products have a phased rollout, to ensure it is right rather than fill a market overnight.

On the investment document, as your rebreather features heavily in it for the wrong reasons (http://www.xray-mag.com/files/slideshow/Simon_Mitchell.jpg), I see it struck a nerve but there is still opportunity to use your knowledge to identify issues and find solutions rather than keep bashing people that are working hard as they continue to do just that.

On a positive note, on O2, to stimulate improvements in the area of PPO2 monitoring, we will release the actual code for the O2 Sensor Fusion algorithm we use. A key client gave permission for this last week. We expect the release to be this month.

 

[Stan]

Alex,

I would've thought that somebody with your backing would be better off trying to get more reliable cells to market? From the current crop of units, the cells seem to be the only weak link (well, after the organic lump strapped to the front of it).

Until we see videos with the likes of Dr Harry pushing the limits with an Apoc strapped to them, then the unit is still just a myth unfortunately. Your project was really interesting at the beginning, but it got too personal. Engineers don't attack people, they just quietly carry on and produce something that makes people sit back and realise they mean business. The Aurora Blue being an example of this.

I try and learn from forums as I'm really interested in CCR design, but everytime I read one of your replies, I'm reminded of this bloke - https://www.youtube.com/watch?v=rLDgQg6bq7o&feature=youtube_gdata_player

Also, trying to pigeon hole globally respected manufacturers and physicians as people who don't are not trying to advance unit safety will not make your crusade any easier.

We'll never be 100% safe under the water, in fact, the day when someone puts a unit on and has convinced themselves that it is 100% safe, that'll probably be the most dangerous dive they'll ever do.

 

[Mark Chase]

Alex

You miss the point totaly.

If Posiden and spent time posting about all the amazing safety feetures of their new recreational CCR, I am sure we would all be impressed with the inovation and aparent fool proof design.

In the real world Posiden has had an apaling death/unit sold ratio which would put it right up there with your beloved Inspo Classic.

So when you offer up a load of meeningles (to us) numbers sugesting how great your unit is, forgive us for saying so what? Lets see the real thing.

Even with your tiny tiny market share you have already discovered a simple failure mode on one of your super EN CE numbered units.

THATS the real world

ATB

Mark

 

[AD_Ward9]

I'm confused - how can a rebreather whose functional safety in great extent relies on an ALVBOV actuator be CE certified and reach SIL 3 when said actuator doesn't work properly?

Fredrik, It is not a case of the actuator not working in the normal divers envelope that the EN 14143 standard covers, as that is fine.

We found there can be instances where it may not work every time at the extremities of temperature beyond that stipulated EN 14143. The extremes occur in the field often as equipment is left in the hot sun in tropical locations (it is black), or in frozen car boots. Hence our focus on extending the electro-mechanical actuator's performance to cover that extra range.

SIL 3 means when we discover anything like that, we have to follow it up vigorously, which we are doing. The actuator, as you know, is not even used in normal diving - only when the loop is unbreathable to trigger the ALVBOV in the electronic version. It therefore needs to work in an emergency as reliably as is possible within ALARP, even under these extremes of temperature.

There has been no issues at all with the mechanical version of the ALVBOV actuator, hence the basic Apocs were shipped. The issue affects only the electronic version of the ALVBOV on the iCCR.

Alex

 

[AD_Ward9]

I would've thought that somebody with your backing would be better off trying to get more reliable cells to market? From the current crop of units, the cells seem to be the only weak link (well, after the organic lump strapped to the front of it).

Stan, we have done exactly that https://www.opensafety.eu/product_info.php?products_id=42 and see the O2 cell report and O2 cell fusion report, we published so all can benefit from this. We developed ruggedised cells, with Aii. They are VERY much more reliable than the cells fitted generally to rebreathers, and moreover, we can test them automatically to sort out when they fail in almost all cases. They are not interchangeable with say an R22, but we have published everything for others to use these cells. I promised earlier today to even release the actual O2 sensor fusion code.

In the real world Posiden has had an apaling death/unit sold ratio which would put it right up there with your beloved Inspo Classic.

The numbers sold for the Poseidon are high, so the record looks OK so far. I don't have numbers of how many of those sales are in use, but then that is true for everyone. By extending the market for rebreathers, Poseidon have gone into an area where human factors are even more important, and in doing so there are lessons we can all learn from their experiences - they have been very good in publishing safety information and are generally safety oriented. Their experiences of divers ignoring all checks and alarms saying no dive, or diving without a scrubber, and suchlike - brings human error onto another plateau.

On your Apoc question, we were happy with the Apocs that were sold, we monitored any field issue closely and openly report it (a first in the industry), and develop improvements. All products can be improved. We have three very tiny improvements so far over the past 2 years, two of which are buttons! This compares to over 70 improvements another company did to their product in the first 6 years - some tiny but a fair few not so tiny.

The two button improvements we did, were the ALVBOV purge button (making it more rugged - on the OSEL FB site), and the O2 inject button to reduce the probability of it sticking on. The fact the issues are just buttons, tells us again what we know, namely the human factor issues are very hard to quantify in design and even after field testing, needs close monitoring and follow up from the production that is sold and used by a wide customer base. There are only two buttons on the Apoc, and the fact that both were improved, and nothing in the breathing loop could be improved in that period, reinforces this.


Alex

 

[Mark Chase]

Posiden Numbers are high?

Realy?

Because I dive a lot and i have never even seen one.

I have always been told the low fatality rate on the KISS is irelevent due to the low volume of sales and yet I see KISS divers all over the place at home and overseas.

What is the apx number of Posiden units sold?


Corect me if i am wrong but isn't it 5 deaths in 3 years of production on the Posiden?

KISS 2 deaths in 13 years?

ATB

Mark

 

[AD_Ward9]

Posiden Numbers are high?

Realy?

Because I dive a lot and i have never even seen one.

I have always been told the low fatality rate on the KISS is irelevent due to the low volume of sales and yet I see KISS divers all over the place at home and overseas.

What is the apx number of Posiden units sold?


Corect me if i am wrong but isn't it 5 deaths in 3 years of production on the Posiden?

KISS 2 deaths in 13 years?

ATB

Mark

Always a balance in releasing numbers, when one has knowledge in confidence. I suspect, but have no scientific evidence, that there are a lot of MkVIs in a corner never used.

However, you are absolutely right. The accident rate on straight mCCRs is very good indeed and puts sports eCCRs in the shadows.

KISS and mCCR numbers sales are very respectable, even though the KISS has abysmal WOB and other peculiarities, there are still few accidents. Many mCCRs are used heavily. It was those mCCR stats that turned us off the same road that Poseidon went down for sports units after we had gone down most of it: the Apoc is essentially a high performance version of the KISS with some extra safety features thrown in.

The only area one needs to be careful though, is there are some mCCRs with poor accident records. Voyagers spring to mind. In that case there were serious design errors and equally bad training practices (the court sentenced the two behind it to a year in prison suspended and an 800K Euro fine each). One has to look at the whole, training, design, performance, and what people are actually doing with them.

Alex