Functional Safety, Human Factors and General Safety Discussion (Moved from Mk VI)

[opheim]

Corect me if i am wrong but isn't it 5 deaths in 3 years of production on the Posiden?

- Norway, May 2010 (user error, ignored battery warnings, jumped in without running tests)
- UK, November 2011 (apparently not rebreather related, died while swimming on surface, not breathing from the loop)
- Galapagos, August 2012 (hyperoxia or hypoxia, no offboard bailout)
- South Africa, March 2013 (unknown cause, so far)
- Portugal, April 2013 (no scrubber)

In addition there was the close-call in Sweden 2009 (diver went unconscious from hypoxia on the surface, rescued and brought back to life).

No idea as to number of units out there.

 

[paulraymaekers]

.... Voyagers spring to mind. In that case there were serious design errors ....
Alex

very good info for people that currently still use these units, or parts of these units.. recently there has been a fatality again

so keep away of them

 

[matt]

At any rate, this is my last post on CCRX, and won't bother reading it either.

Bye!

Thank **** for that.

 

[RCU]

very good info for people that currently still use these units, or parts of these units.. recently there has been a fatality again

so keep away of them

What was the specific design issue or training problem with the Voyager that makes it so dangerous?


Robert

 

[Mark Chase]

- Norway, May 2010 (user error, ignored battery warnings, jumped in without running tests)
- UK, November 2011 (apparently not rebreather related, died while swimming on surface, not breathing from the loop)
- Galapagos, August 2012 (hyperoxia or hypoxia, no offboard bailout)
- South Africa, March 2013 (unknown cause, so far)
- Portugal, April 2013 (no scrubber)

In addition there was the close-call in Sweden 2009 (diver went unconscious from hypoxia on the surface, rescued and brought back to life).

No idea as to number of units out there.

Yes thats what i made it.


So what does this show us?

Were these five divers suicidal?

Or were they for reasons unknown, expecting the unit to keep them alive against a back drop of a lack of proper understanding of CCR diving?


Or is there a third possibility i haven't thought of?

If so what is it?

Name me an incident on ANY CCR where most of the information is available and I can usually show it was blatant diver error. Difference with those incidents is the diver was properly trained and fully aware of the issues.

In just about every high profile case of death on a CCR where i have been able to talk to people in the know about what happened, there has been an "OMG how the hell could they be so stupid" revelation.

2 things I know about CCR:

1: Never underestimate the ability of an idiot to work around an automated safety measure.

2: There is nothing as dangerous as a CCR that just works. Because when it does fail, someone will have become complacent and they will die.


ATB

Mark

 

[GLOC]

Mark,

Unfortunately it boils down to human behaviour and the potential for us to make silly decisions, even when you know (looking back) what you did was wrong. Part of that is because over time you have made re-adjustments to what is acceptable and got away with it.

emmbee posted a very good link which I would advise all on here to watch which concerns the 'Normalisation of Deviance' (4 links - one, two, three and four) in which the presenter talks about some very bad decisions in the Challenger disaster and the continual validation of those bad decisions because nothing went wrong. As you get further along the line and nothing bad has happened, your are making new baselines as to what is acceptable. Challenger Mission #2, O-ring damaged through heat, should have stopped the missions. They cut another o-ring, tested it to temp and pressure, it didn't fail. Great, we have just proved that we have the correct safety margins. This happened on a number of missions until the fateful one Each time the poor decision was validated because nothing bad happened.

Despite the risks being present in diving, there are fortunately not too many fatalities but I bet there are a shedload of near misses. I would guess that major changes in behaviour follow 'safe dangerous episodes' where a near-miss scared the proverbial out of the diver - you have said that your own behaviour changed when certain things happened.

However, there are still people who will go diving despite being told that their kit is unsafe and what they are doing dangerous, sometimes they survive, sometimes they don't. This isn't limited to diving, but happens elsewhere link too, a link I have provided previously.

I heard over the weekend of an incident where a diver had been told of a number of failure points on their equipment (CCR and stages) that would likely end up with them dead if they dived it. A short time later he was rescued and resuscitated after he decided to ignore the advice of the instructor who had taught him on a course in the past.

How do we stop it happening? I have some ideas but will see what I can get by asking some questions.

• If you saw someone (a stranger on a hardboat trip) doing something dangerous with their equipment (assembly, alarms still going, pre-breathe, incorrect connections etc) would you walk up to them and say 'stop'? If not, what would stop you?
  
• If you saw one of your mates doing the same, would say 'stop' and sort the issue out?
  
• Would you go to the lengths of removing something that prevented them from diving? Would you 'throw your dive' to save theirs?
  
• How many pieces of life support equipment are you willing to not be working 100% and still get into the water with?
  
• At what point in a dive are you willing to can the dive if it isn't 100% (in your mind)?

I need to find the reference to back this up but have read it somewhere recently, people are more likely to continue an activity despite it being 'against the rules' the longer they keep on doing the activity and they 'get away with it'. This could be part of the self-validation of crap decisions I mentioned above.

The majority of divers are time poor (although a large percentage are also cash poor!) and do not want to miss a dive. They will push the limits to make sure they get in the water even if they are mentally or physically not prepared to do the dive. If this dive is also a new mark or known as a fantastic wreck or cave, there are additional pressures to get in.

Jill H mentioned in a presentation about not jumping because her kit wasn't working properly and decided to can the dive and as a consequence she got grief from others on the boat who said 'It'll be alright...'

Peer pressure can be a very bad thing, it can also be a very good thing if it is channelled in the right direction.

Example from a recent course where the instructor and student were using the new TDI 'pre-flight' checklist. The instructor had finished his checks and had purposely slowed down his rate so the student was matching him. The instructor kept telling the student to not worry about time, but to do the checks, and yet the student missed the last item which was to make sure the bailout was turned on. Turns out after discussion it was because the student did not want to be 'late' despite the instructor saying 'take your time'...

Regards

 

[lizardland]

If you saw someone (a stranger on a hardboat trip) doing something dangerous with their equipment (assembly, alarms still going, pre-breathe, incorrect connections etc) would you walk up to them and say 'stop'? If not, what would stop you?

The list sounds remarkably like industry behavioural safety training. The company I work for (big US contractor) gives every member of staff full authority to stop work on a site if they see something dangerous/potentially dangerous happening regardless of their grade/job with no comeback.

If you saw one of your mates doing the same, would say 'stop' and sort the issue out?

That was the baseline that we teach on site. If you saw a mate or relative doing the same what would you do?

I need to find the reference to back this up but have read it somewhere recently, people are more likely to continue an activity despite it being 'against the rules' the longer they keep on doing the activity and they 'get away with it'. This could be part of the self-validation of crap decisions I mentioned above.

That's something I'd be interested in reading. I self-taught (starting as a homebuilder) so I spent a lot of time "breaking" rebreathers and diving "broken" rebreathers as part of the process I went through. You can look at seeing what they can get away with as either a negative or a positive. I've always looked on it as experimenting, having deliberately (arguably carefully) pushed failures to see what happens, see what can be done and see how long the unit can be maintained. From that point of view there are certain failures that I'm probably a bit less scared of now and maybe a bit more likely to accept to not can a dive. That could be interpreted as complacency.

On the other hand, I think I know what you mean. I've seen people get in with stuff wrong that maybe aren't as switched on about the consequences as they should be.

 

[GLOC]

Couple of pieces I found from this paper which bring the points above together when it comes to 'breaking the rules'. This study looked at airline pilots in Alaska pushing the limits to get tasks done which would have normally been cancelled in other areas.

Foot in the Door
Foot in the Door The foot-in-the-door technique is a method for obtaining compliance from another per-son: If a person has already agreed to a small request, that person is more likely to agree to a large one later, given a relatively short delay between requests (Freedman & Fraser, 1966). The mechanisms behind this technique include pressure from norms related to complying with requests, a need for self-consistency, and a ten-dency to infer one’s attitudes from one’s behav-ior (Burger, 1999; Cialdini, Trost, & Newsom, 1995; Guandagno, Asher, Demaine, & Cialdini, 2001). If these mechanisms are working in tandem, the foot-in-the-door technique is even more likely to be successful. Participants mentioned that managers asked pilots to “go and take a look” to find out the state of the weather. In some cases, this was clearly not a deliberate ploy to manipulate pilots: “You didn’t have the weather reporting in some of the passes, and with no pilot reports available, you’re going out there to take a look a lot of times,” one participant said. In other cases, however, man-agers were attempting to get their pilots to take a mission in dubious weather; after pilots had started the trip, they were sometimes reluctant to return, despite the conditions (see Table 1).

and

Normalization of Deviance
Normalization of Deviance A phenomenon similar in its insidious reli-ance on small, progressive changes is the nor-malization of deviance. The normalization of deviance is an incremental acceptance of a progressively lower level of safety by a group of people (Vaughan, 1996). Individuals are not necessarily aware that they are consistently breaking rules or eroding a safety margin. It is simply that safety is slowly compromised to a point at which the end state is dramatically different than initially intended. Participants become desensitized to the risks they are taking (Hollnagel, Woods, & Leveson, 2006)...Normalization of devi-ance occurred when the same risky behavior led to no negative consequences, so pilots kept per-forming the same behavior during the course of several days or flights. We considered situations to be illustrative of this category when informa-tion about weather was ambiguous or clearly trustworthy rather than when weather reporting was unreliable. If the weather information was known to be unreliable, pilots could reasonably discount it without becoming inured to risk.

Both from Paletz, S.B., Bearman, C., Orasanu, J. & Holbrook, J., 2009, Socializing the human factors analysis and classification system: incorporating social psychological phenomena into a human factors error classification system, Human factors, 51(4), pp. 435-45

Still trying to find the one about the reticence to stopping progressing down the
'violation' route...problem when you have so many papers and trying to work out what the keywords should be!

Regards

 

[lizardland]

(Burger, 1999; Cialdini, Trost, & Newsom, 1995; Guandagno, Asher, Demaine, & Cialdini, 2001)

Cialdini's book, Influence, is a great (and probably quite relevant to this thread) read on some of the points you mention. Very accessible, written more for a lay audience rather than people "in the game". Highly recommended.

 

[Simon Mitchell]

Simon, We are the only company I am aware of that has designed and seen to production, an oxygen addition button that does not put the users life in immediate danger when the oxygen injection button sticks on.

You designed and released an oxygen addition button that stuck on so often you had to recall it (full marks for that part). An oxygen addition button that sticks on always puts the user's life in danger unless they notice it, and there are countless task loading scenarios where a diver might fail to do so. If another company did this and tried to defend a resulting accident in the manner you do above, you would be accusing them of murder.

...you could improve rebreather safety by openly identifying these (real design issues), in the small area where you have some expertise

As long as its not a design issue in your unit? I should remind you Alex, that when I did exactly this in my very first interaction with you, you started all the insults and mudslinging that have led us to this point today. The issue I raised, as you will recall, could not be more relevant to my "small area of expertise", and you publicly tried to pretend it didn't exist while quietly fixing the problem behind the scenes. You will have to excuse my subsequent cynicism over virtually everything you say.

As there are commercial sensitivities to the rest of your post, I will say no more on your other points other than being designers in the supply chain, Deep Life have little to do with the commercial diving product once it was certified, tested and delivered other than observe its successful use in the field at a distance. What I can say is that the company handling the commercialisation reports they continue to use and operate the umbilical rebreathers and praise its excellent performance.

Whether customers wish to use the umbilical unit or put them on their product list is up to them. Why this is the case is not for public debate however all the reasons are due to factors that have nothing to do with the rebreather or its design. What our customers elect to do with their products is to a great extent up to the customer themselves: once the product is delivered it has nothing to do with me and my team unless support requirements are requested.

On the specific military Incursion rebreather that we have designed, just to correct a matter of fact, while we had production spec Apocs at DEMA in 2009, the eCCR Incursion there was a prototype. It was delivered only after getting CE in 2011 and went into trials. There are other versions of the Incursion too ... such as that with the customer at IMDEX. All professional products have a phased rollout, to ensure it is right rather than fill a market overnight.

At last, the truth (in a convoluted "spinny" kind of way). Thank you Alex. After your representative Horn insisted for years that these products were available "off the shelf" as a production item to end users, it is clear that the umbilical rebreather is not yet for sale, and no one has purchased the military rebreather. I am glad we have cleared that one up.

Simon M

 

[AD_Ward9]

You designed and released an oxygen addition button that stuck on so often you had to recall it (full marks for that part).

No, Simon a stuck on oxygen addition button doesn't have to put the diver's life in danger, e.g. the design of ours regardless of which button is fitted does not put the diver's life in immediate danger. In fact, as far as I am aware, it is the only O2 injector on a rebreather to have this feature. All others I have looked at inject either no gas, or huge amounts of O2 if they get stuck on: ours does not.

Again as you fail to to understand simple concepts, as there was no safety issue with our functionally safe product, there was no need for a recall, simply a free of cost user serviceable upgrade, like all the improvements we find they are free.

As I said previously, ALL gas addition buttons can stick on. Are you disputing this fact? All injectors have an inherent "stuck at" failure mode that is just as obvious but I note you fail to acknowledge in any other unit despite multiple public reports of this stuck at faults with no improvements by those manufacturers. A status quo you seem happy to support.

I am VERY interested in a design issue with our rebreathers design (there still exists my outstanding offer of a bottle of single malt on exactly this) however you need to substantiate the issue for me to be interested in it and I have yet to see anything valid from you on the subject.

You tell me to essentially to put up or shut-up, but do not practice it yourself.

You have yet to see our CO2 monitor, you have yet to observe it in use and you certainly haven't dived it. Nor do you have any expertise in the observation of any other end-tidal CO2 monitor in a dived rebreather. Nor have I seen anything published by you of the standard required that lets me know you would be capable of preforming trials on my product that are likely to identify any issues with its design.

You also continually ignore the real reason why there is not the perceived problem with our CO2 monitoring that you continue to allege. That BOVs and DSVs exhibit CO2 bypass is quite a concern which we used our CO2 monitor to first find, then validate with our mass spectrometers readings. Again we have openly published this report. We note with interest that as our testing and design capability exceeds most all the other players in the recreational market, this has not even been criticised as no one else tests their product to the required rigour. Ignorance is bliss but is not exactly safe.

On your last point, you only appear to have confused yourself on some misguided attempt to waste my time or again muddy waters as an continued agenda. Both our Umbilical and Military rebreather units have been sold to customers "off the shelf" as a production item as previously disclosed. What our customers do with them from a commercial viewpoint, is then their choice. Again, a simple concept you seem to struggle to grasp, and people are telling me again that you seem to press for information for your sponsors.

 

[GLOC]

Enough, please.

Regards

 

[Tony_Q]

You have yet to see our CO2 monitor, you have yet to observe it in use and you certainly haven't dived it.

Hello Alex,

Thank you for continuing to put your side of the story. Without having delivered the iCCR, it takes some balls to keep coming back.:square:

While Simon hasn't seen or used your CO2 monitor, one diver who has (Dave Sutton) did post that there was some issue (or words to that effect).

If he was diving a production unit, did he misunderstand something, i.e. there isn't/wasn't a problem (or not with the CO2 monitoring/bailout side of things); or have his concerns been addressed with some modifications to the unit?

This matter doesn't seem to have been cleared up in any company communications.

Thanks,
Tony Quinn

 

[dmainou]

Alex,

Here in Oz we call companies like yours a Gonna as in going to do this and going to do that...

Military... umbilical... oxygen only.... honestly we couldn't care less.

The promise is for an iCcr. Let's talk when we can order one and get a fully functioning unit delivered within a few weeks time.

In the meantime it's nothing but a mental exercise of sexual relief.

Sorry to be blunt.

D

Sent from my GT-I9300 using Tapatalk 2

 

[GLOC]

Stuart,

I found this paper which you might find interesting which covers why General Aviation pilots (I think relatively comparable to CCR divers) continue to fly into Instrument Conditions when not qualified or experienced to do so.

They have developed a theory of decision making under uncertainty called Prospect Theory. An important implication of the theory is that “variations of the reference point can therefore determine whether a given outcome is evaluated as a gain or as a loss” (Tversky & Kahneman, 1981, p. 211). The implications of this for aeronautical decision making were explored by O’Hare and Smitheram (1995) who showed that decisions to continue a flight into uncertain conditions were less likely when the prospects were framed in terms of possible gains rather than as possible losses

and later

A related perspective which has been widely investigated in the context of business investment decisions is the sunk-cost approach (Arkes & Blumer, 1985). The sunk-cost effect describes the behavior of individuals who continue to invest in a losing course of action when it would be more advantageous to discontinue investment. It has been suggested that the psychological motive of not wishing to appear wasteful is one of the driving forces behind this tendency. The phenomenon also appears to be consistent with Prospect theory. The same paradigm can be used to explain the apparent tendency of pilots to continue with a potentially risky course of action later in a flight. To abandon the flight at a late stage involves ‘wasting’ the time and resources already invested in the flight. Factors which increase this investment (e.g. costly aircraft charges) or the psychological connection with the investment (e.g. personal responsibility for organizing the flight, presence of passengers etc) should strengthen the sunk-cost effect and increase the tendency for poor decision making later in flight.

I can see a number of parallels within sport diving when we are time poor and don't want to waste the time and effort getting to the dive site and 'canning it' before you even get in the water. It takes a strong will to not 'give it a go' although attitudes are changing as the 'education' changes.

The paper is available here http://www.hf.faa.gov/docs/508/docs/weatherReport.pdf

I also found this in a thesis from Cranfield looking at Perception of Risk and Hazards amongst General Aviation pilots (Vallee, 2006).

..risk perception is part of the decision-making process of pilots when flying and therefore has an impact on pilots’ performance. If risk perception varies with internality*, it would be interesting to know what can influence internality so that pilots could perceive risk higher and take adequate decisions when they encounter a hazard...Pilots protect and maintain their self-esteem probably because they need to be optimistic to do such a high risk activity; otherwise they would not feel confident enough to cope with all the hazards that can happen in aviation. However, overconfidence is no good either, and general aviation pilots definitely need to be encouraged towards safe flying attitudes.

*refers to locus of control "Individuals with an internal locus of control believe they can control the situation by their own behaviour, whereas individuals with an external locus of control perceive that the outcomes of a situation are due to external factors."

Regards

 

[Mr Walker]

So poker players who are unwilling to fold, although they "know" they should, and instead call "just to see", should not become divers, right? Or pilots?

/nils

 

[Randy Thornton]

OK Folks,

I think we have had about enough discussion/arguing back and forth about the APOC or the lack thereof. Let's please direct our discussion back to something more constructive.

Many thanks,
Randy

 

[AD_Ward9]

<snip for brevity in answering>
If he was diving a production unit, did he misunderstand something, i.e. there isn't/wasn't a problem (or not with the CO2 monitoring/bailout side of things); or have his concerns been addressed with some modifications to the unit?

This matter doesn't seem to have been cleared up in any company communications.

Tony, I am not aware of any CO2 monitoring related issue reported by DS or any matter that requires clearing up. As an example we have long had video openly published of him try diving the Apoc with everything functioning as designed. https://www.facebook.com/photo.php?v=123147937737984&set=vb.151298954899613&type=3&theater and https://www.facebook.com/photo.php?v=123144424405002&set=vb.151298954899613&type=3&theater

Also , as per my post above, we used the iCCR CO2 monitoring to formally for audit purposes validate the readings from our mass spectrometer and publicly reported this.

If there is an issue with operation or accuracy of our CO2 monitor we are quite confident we would have identified it during these trials which identified many other interesting datapoints and learning outcomes. For example, http://www.deeplife.co.uk/or_files/Fault_Study_CO2_Bypass_110314.pdf

For your information, the iCCR CO2 monitor will ship functionally unchanged from that displayed at DEMA in 2009 other than a tougher matt black overlay on the pod, the code is now entirely SPARK Ada rather than MISRA C in 2009, and a better readability of the screen in bright sunlight.

Admitted, we have yet to deliver the iCCR to the public, however there is an awful lot of other ancillary items that we have delivered for the recreational market to improve user safety and that we continue to release. For example this week there is a ruggedised purge button for the ALVBOV, and one version of the DC350 dive computer models was released to the commercial client - these are on the OSEL FB pages and will go into the newsletter.

I note Randy's suggestion above, agree with it, and should leave other items to OSEL support. If you have any questions, just email them on their support line, and they should respond quickly with a personal answer. If you don't get a quick answer, please PM me.

 

[Mr fish]

You designed and released an oxygen addition button that stuck on so often you had to recall it (full marks for that part). An oxygen addition button that sticks on always puts the user's life in danger unless they notice it, and there are countless task loading scenarios where a diver might fail to do so. If another company did this and tried to defend a resulting accident in the manner you do above, you would be accusing them of murder.


Simon M

from what iv read about the sticky o2 button , it takes about 12 seconds to get half a breather full of o2 , maybe some what less if your all ready at just under 1.3 when you press the death switch , just the right amount of time to say ooooooooooo shit so much for 1 mill of man hr ,:haddock:


The DC350 computer OUT NOW , well done , let,s hope they sell as fast as that boarding ladder ,
Tell you what AD
I m all out of that cheep malt you like . so have a meal on me https://encrypted-tbn0.gstatic.com/...lVOWngk9wXtja0teH7hOd3YtkauK6HLYr7lxf7xLcSwFw

 

[Simon Mitchell]

I am VERY interested in a design issue with our rebreathers design (there still exists my outstanding offer of a bottle of single malt on exactly this) however you need to substantiate the issue for me to be interested in it and I have yet to see anything valid from you on the subject.

You tell me to essentially to put up or shut-up, but do not practice it yourself.

In deference to Randy's wishes I will merely direct readers to a previous post which proves there was a problem with the Apoc CO2 monitoring which Alex denied but quietly rectified.

Post 4 on this thread: http://www.ccrexplorers.com/showthread.php?t=14980&highlight=ad_ward9

Nor have I seen anything published by you of the standard required that lets me know you would be capable of preforming trials on my product that are likely to identify any issues with its design

INESON A, HENDERSON K, TEUBNER D, MITCHELL SJ. Analyzer position for end tidal carbon dioxide monitoring in a rebreather circuit. Diving Hyperbaric Med 40, 206-209, 2010.

Has met the standard of a peer reviewed scientific journal. But if you are unfamiliar with publishing in such journals you probably have little appreciation of those standards.

Simon M