Active Sensor Validation (ASV)

A More Reliable Approach CisLunar- Poseidon


Herein we describe a new approach to CCR oxygen control systems, involving automated active testing and monitoring of the oxygen sensors, that is more reliable  than the passive triple-redundant control system that is currently in common use. This  new approach capitalizes on the recent availability of very small (miniature), highly  reliable solenoid gas valves, microprocessor controlled gas monitoring and controlling  technology, and the availability of both pure oxygen and a primarily non-oxygen gas supply (e.g., air), which are both typically available on almost all CCR systems.  This new approach to oxygen control systems has its origins in the Cis­Lunar series  of closed circuit re-breathers, and as such represents the culmination of more than 20  years of experience designing, developing, and diving some of the most sophisticated  rebreathers ever built. Beginning with the Cis­Lunar MK­III (third generation) system,  two important features were incorporated in the design to address some of the problems  of oxygen sensor reliability. The first of these two features was to allow the manual  injection of diluent gas directly on the oxygen sensors at any point during a dive. This  feature served two functions: it purged any condensation that might have accumulated  on the sensors (thereby restoring function to sensors blocked by a film of water on the  sensing membrane) and, more importantly, it exposed the oxygen sensors to a known  fraction of oxygen. Given a known ambient pressure (i.e., depth), this allowed the  sensor function to be verified by observing whether the sensor readings corresponded  to the known PO2 exposed to the sensors.  The second important feature introduced on the Cis­Lunar MK­III to address oxygen  sensor reliability is that the primary LCD display presented sensor PO2 values to within  0.01 atm precision. The sensors themselves were not accurate to within this level of  precision; however, displaying the extra precision allowed the diver to determine  whether the displayed PO2 values were static or dynamic. Minor fluctuations in the gas  mixture passing over the oxygen sensors cause corresponding fluctuations in the  displayed readings – but only if the sensors are exposed to the breathing gas. On the  other hand, if one (or more) of the sensors have a film of condensate trapping a small  pocket of gas against the sensor, they will not respond to the minor fluctuations in the  breathing mixture. Instead, the sensor values will be static (changing only in response to  depth changes). Thus, a static PO2 sensor reading at the 0.01 atm precision is  indicative of an unreliable sensor value.  These features (among others) were expanded upon and improved in the Cis­Lunar  MK­IV and MK­V rebreather systems, enhancing the diver’s ability to asses not just  what the O2 sensor values are, but the extent to which they can be trusted as reliable.  With the development of the new Cis­Lunar MK­VI (“Discovery”) rebreather system  through a collaboration of the original Cis­Lunar design team (including Dr. William “Bill”  Stone, Nigel Jones, and Dr. Richard Pyle) and Poseidon Diving Systems, these features  have been improved and enhanced to the point where they represent an entirely new  approach to CCR oxygen control systems: Active Sensor Validation (ASV).  In its simplest form, the ASV control system incorporates two oxygen sensors (one  designated as the “Primary Oxygen Sensor”, and the other designated as the  “Secondary Oxygen Sensor”) and a minimum of three electronically ­controlled gas valves. One of these values is used to perform the same basic function as the solenoid  valve found in virtually all CCRs: to replenish the oxygen metabolized by the diver. In  the case of the Poseidon Cis­Lunar MK­VI rebreather, there are actually two electronically ­controlled valves to serve this purpose – allowing both greater control and  precision of injected oxygen volume, and allowing redundancy of the oxygen addition  system.  Unlike any other existing or previous CCR oxygen control system, the ASV approach  also incorporates two additional electronically ­controlled valves: one to inject oxygen  directly onto the “Primary Oxygen Sensor”, and the other to inject “diluent” gas (i.e., a  mixture containing primarily non-oxygen but nonetheless constituting a gas mixture that is directly breathable in open circuit mode within some regime of a planned dive typically it is designed to be breathable at the maximum planned dive depth). For the  purposes of this description, the “diluent” gas supply is assumed to be air (~21%  oxygen, ~79% nitrogen and other trace gases), but any breathable mixture containing at  least some (known) oxygen fraction will serve the same purpose. The basic principle of  the oxygen control system described herein is to periodically validate the readings of the  Primary Oxygen Sensor using controlled direct injections of either oxygen or diluent  (depending on the depth and the circumstances) and monitoring the response of the  sensor to validate accurate readings. These gas injections also serve the purpose of  removing any condensation that may form on the face of the sensors, thus eliminating  one of the common failure modes described above.  The purpose of the “Secondary Oxygen Sensor” is to monitor the oxygen content of  the breathing gas while the Primary Oxygen Sensor is being validated, and also to  safeguard against possible failure modes of the Primary Oxygen Sensor validation  system, as described in more detail below. 

The components of the simplest form of the Active Sensor Validation system (see  Figure 1) include:

Figure 1. Diagrammatic illustration of Simple Active Sensor Validation (ASV) system.

  1.  Primary Oxygen Sensor:  An oxygen sensor, exposed to the breathing gas  through a small gas chamber that can be flushed with oxygen or diluent gas  via electronically controlled valves.
  2. Secondary Oxygen Sensor: An oxygen sensor, exposed to the breathing gas through a small gas chamber that is not connected to either the oxygen or diluent gas supplies, but is in relatively close proximity to the Primary Oxygen  Sensor.
  3. Oxygen Supply: A supply of oxygen gas (normal for any closed circuit  rebreather), equipped with pressure-reducing regulator establishing a supply of  intermediate ­pressure oxygen gas.
  4. Diluent Supply: A supply of diluent gas (also normal for any closed circuit  rebreather), equipped with pressure-­reducing regulator establishing a supply of  intermediate pressure diluent gas (e.g., air).
  5. Oxygen Test Valve: An electronically controlled valve that allows a small  measured volume of oxygen gas to be injected directly onto the sensing surface of the Primary Oxygen Sensor.
  6. Diluent Test Valve: An electronically controlled valve that allows a small  measured volume of diluent gas to be injected directly onto the sensing  surface of the Primary Oxygen Sensor.
  7. Oxygen Replenish Valve: One or more electronically controlled valve(s) that allow a measured volume of oxygen to be injected into the breathing loop, in a place where the injected gas is not exposed directly to either oxygen sensor until it has been adequately mixed with the breathing mixture.
  8. Ambient Pressure Sensor: An electronic sensor that detects the ambient  pressure of the breathing gas.
  9. Electronic Control System. An electronic computer system that can read the output from both the Primary and Secondary Oxygen Sensors, monitor the  Ambient Pressure Sensor, monitor the passage of time, and control the three  electronically ­controlled valves (Oxygen Test, Diluent Test, and Oxygen  Replenish). 

Review of CCR Failure Modes 

Most CCR systems rely on oxygen sensors to provide information on the oxygen content of the breathing mixture. When multiple sensors are used, some method to derive a single estimated value for the oxygen concentration is usually incorporated. 

When the oxygen concentration (PO2) drops some defined threshold below the control  set-point, an electronically controlled valve is opened or adjusted to replenish the oxygen supply in the breathing mixture. In the discussions that follow we will use for our example a commonly  available galvanic oxygen sensor (essentially a fuel cell that  produces voltage output in response to the PO2 level) that is widely in use in CCR apparatus . However, the following discussions equally apply to all manner of sensors that produce an output signal proportional to PO2. As described above, traditional methods for using multiple oxygen sensors have several limitations, including:


All galvanic oxygen sensors must be calibrated to ensure accurate readings. The calibration process typically involves exposing the sensors to one or more known gas mixtures at a known ambient pressure, and deriving calibration constants to the electronic logic that interprets the sensor readings. Calibration is typically conducted manually or semi-automatically prior to the dive, but is sometimes only done once periodically over many dives. Calibration constants can be recorded incorrectly if the calibration gas mixture deviates from expected (e.g., if the calibration process assumes a mixture of 100% oxygen when a contaminated calibration gas is actually only 80%  oxygen), if the ambient pressure is not properly taken into account, if the sensor fails in certain ways as described below, and/or if the user performs the calibration process incorrectly. Attempts to mitigate these problems have included automated calibration routines as part of the standard pre-dive process, incorporation of ambient pressure sensors into the calibration process, and testing against threshold values intended to detect calibration errors.

Sensor failure:  

Galvanic oxygen sensors eventually fail either through exhaustion of their chemical reaction or from a host of other environmental and user caused effects (e.g. abuse). In many cases, a sensor will simply fail to generate sufficient output voltage at the time of calibration, and will be identified. In other cases, however, a sensor can perform normally up to a certain point, but deviate significantly from linearity in output voltage once the oxygen concentration exceeds a certain value. For example, a sensor could perform normally up to an oxygen concentration of 1.1 ATM partial pressure, but then fail to produce a correspondingly higher output voltage at higher oxygen concentrations. Because the calibration process of most CCR systems uses 100% oxygen at ambient pressure (i.e., 1 atm partial pressure), the calibration process may appear to complete correctly, but the system may not be able to properly interpret readings when the sensor is exposed to oxygen partial pressures above 1 atm. In other words, while the sensor calibration may be linear in the range of 0.2 through 1.0 atm PO2, it will fail to produce accurate readings at higher PO2 values. This form of sensor failure is particularly insidious if it happens below the selected set-point, because the control system will continue to add oxygen to the breathing gas until the actual PO2 is dangerously high.


The breathing gas in a CCR is humidified to the point of super-saturation when the gas exhaled from the diver’s lungs is passed through the breathing loop of the rebreather. In most cases, ambient water temperature is cooler than body core temperature, and as the breathing gas is cooled in the CCR breathing loop, liquid condensation inevitably forms. The total volume of condensate can exceed several tens of milliliters per hour of dive time. This condensation can affect the oxygen sensor readings, and can even lead to erroneous readings if a film of condensate traps a pocket of gas against the sensing membrane. It can also lead to premature failure of the sensor. Attempts to mitigate this problem include “water traps” and absorbent pads in the breathing loop designed to divert collected condensate away from the oxygen sensors; strategic placement of sensors in areas least likely to form condensation; placement of sensors on different planes to reduce the probability of multiple sensors collecting condensate simultaneously; and active condensate removal via a blast of injected gas directed at the sensing membrane. Although using multiple oxygen sensors and using sensors designed specifically for humid environments can mitigate some of these problems, all known CCR oxygen control systems are subject to failures due to one or more of the above problems.

Solving the Problems of Oxygen Sensor Reliability: Active Sensor Validation (ASV)

Initial Sensor Calibration

Because the Primary Oxygen Sensor has direct access to both oxygen and known diluent mixtures (e.g., air) via electronically ­controlled micro-valves (see Figure 1), the ASV system is capable of exactly calibrating itself without any input from the user, and it is capable of performing such calibration with an exceedingly small volume of consumable gas, which is an important performance measure in a CCR.1

This system  does not require any reliance of proper user initiated calibration routines or, indeed, any  interaction of the user at all. At initial power-­up, the ASV system will automatically inject a burst of pure diluent gas (e.g., air) directly on the Primary Oxygen Sensor, reliably exposing it to a known low-oxygen mixture. A sufficient volume of injected gas will also  expose the nearby Secondary Oxygen Sensor. The same procedure applies to the oxygen supply mixture as well. These two known points provide a precise two-­point  calibration for the primary oxygen sensor. Others have purported to have developed  “automated” calibration systems for re-breathers but the ASV system represents the first true achievement of exact, and efficient, auto-calibration for a CCR. 2 Because of the availability of oxygen and diluent (e.g., air) directly applied to the Primary Oxygen  Sensor via the electronically-­controlled Oxygen Test Valve and Diluent Test Valve, and  the proximity of the Secondary Oxygen Sensor to the Primary Oxygen Sensor, the ASV  system is much more effective and efficient for establishing accurate calibration of the oxygen sensors prior a dive. The ASV system can be made even more reliable by:

  1. Incorporating threshold limits to detect when a sensor falls out of acceptable output voltage values at calibration time;
  2. use of algorithmic analysis of a stored log of calibration values to detect calibration trends, alerting the user to a need to replace a sensor;
  3. detection of mouthpiece valve position to ensure that the calibration does not  proceed unless the mouthpiece valve is in a position that prevents breathing through the loop during the calibration process 3 
  4. clear and unambiguous “Do not Dive” indicators that prevent the user from operating the rebreather in the event that the pre-dive calibration process does not complete successfully 4

An additional benefit of the automatic pre-­dive check system is that it can also serve as a pre-­dive verification that the correct gas mixture (oxygen or diluent) is connected to the correct supply regulator (within calibration threshold tolerances of the sensors).

In ­ Dive Sensor Verification and Monitoring With Diluent Gas 

Another new feature of the ASV system described herein is the ability to monitor and test the function of oxygen sensors during the course of the dive either at periodic time intervals, or in response to specific circumstances detected by the Electronic Control System. When desired, the system can automatically inject a small amount of diluent gas onto the Primary Oxygen Sensor, and then observe the resultant reading from the sensor as it is interpreted by the electronic control system. With an ambient pressure sensor and a known oxygen fraction in the diluent supply, the Primary Oxygen Sensor can be exposed to a known partial pressure of oxygen at any moment during the dive, and monitored to ensure that the sensor responds with the correct reading. Failure of this test can initiate an alert to the diver that the dive should be aborted immediately.

In Dive Sensor Testing and Monitoring With   Oxygen

Because the system also has access to 100% oxygen and can inject it directly onto the Primary Oxygen Sensor, the ASV system is also capable of testing the linearity of the sensor voltage output at partial pressures in excess of 1 ATM (i.e., the maximum calibration value during pre-­dive). For example, when the Electronic Control System detects via an ambient pressure sensor that the diver has reached a depth of 20 feet (6 m.), where the ambient pressure is approximately 1.6 ATM, a small burst of oxygen directly on the Primary Oxygen Sensor can ensure that the calibration constants apply reliably for readings at partial pressures well above 1.0 ATM. Thus, if the system is set to maintain an oxygen partial pressure of 1.3 ATM, there can be confidence in the reliability of the readings at that value, even though it is higher than the maximum pre­-dive calibration value of 1.0 atm. As with the diluent injections, the volume of oxygen needed to be injected to perform this test is so small that it would not have a significant impact on the overall gas composition in the CCR breathing loop 5 . The ASV system described here is thus the first to offer full range sensor calibration verification. Furthermore, this calibration is performed in a fully automated fashion that is “transparent” to, and requires no interaction from, the user.

The  Importance of  the Secondary Oxygen   Sensor  

The incorporation of a Secondary Oxygen Sensor into the ASV system adds to the reliability of the overall sensor monitoring architecture in several ways. During periods when the Primary Oxygen Sensor is not being actively tested, the Secondary Oxygen Sensor can be compared to the Primary Oxygen Sensor to ensure concurrency of readings. If the readings are not concurrent, the system can be triggered to perform a test on the Primary Oxygen Sensor. If the discrepancy of readings was caused by condensation on the Primary Oxygen Sensor, the test itself may correct the problem. If the Primary Oxygen Sensor fails the test, the system can issue an abort alert, and initiate a test of the Secondary Oxygen Sensor by increasing the volume of gas injected at the Primary Oxygen Sensor. If the Primary Oxygen Sensor passes the test, but the Secondary Oxygen Sensor is still providing inconsistent readings (e.g., if condensation has formed on the Secondary Oxygen Sensor, or if the Secondary Oxygen Sensor has failed for some other reason), then an abort alert can be issued to the diver. Another reason for incorporating a Secondary Oxygen Sensor that is not connected directly to the output from the Diluent Test Valve and Oxygen Test Valve, is to serve as a “sentry” to safeguard against small leaks from either of the test valves. In the event of a large leak of either of these valves, it is likely that the control logic of the Electronic Control System would recognize it immediately, and initiate an abort alert to the diver. However, if there was a very small leak in either of the test valves, a trickle of gas onto the Primary Oxygen Sensor might be such that it would bias the reading, but not so much that it could be detected by the Electronic Control System. The sensor would be functioning normally, and would pass all tests, but because the gas in immediate proximity to the sensor membrane is exposed to a contaminated gas mixture (not the actual breathing gas mixture) it would provide erroneous readings and lead to a malfunction of the oxygen control system 6 . Having a Secondary Oxygen Sensor that is not directly exposed to the gas coming from the test valves would result in detection of this failure mode due to discrepancy of readings between the two sensors (as described above). If the leak is so large that it causes contamination of the Secondary Oxygen Sensor, it would be large enough to detect by itself, and even still would not affect the Secondary Oxygen Sensor as much as the Primary Oxygen Sensor, hence causing a (detectable) discrepancy in readings. Yet another reason for having a Secondary Oxygen Sensor is that it can be used to monitor the actual breathing gas while the Primary Oxygen Sensor is being tested. Whereas the Primary Oxygen Sensor is not exposed to the actual breathing mixture during tests, the Secondary Oxygen Sensor continues to monitor the breathing loop gas (see footnote 5 for further information on how this system deals with this situation). A proprietary, patent ­pending real ­time calibration method has been developed by Poseidon Systems that insures that the Secondary Oxygen Sensor remains properly calibrated during a dive.

Why Not Three Oxygen Sensors?

In fact, a strong argument can be made that a single sensor with active validation capabilities is more reliable and more informative than three passive sensors that cannot be validated.

Given the industry standard design incorporating three oxygen sensors into oxygen control systems for rebreathers, some discussion is necessary to explain why three sensors are not used in the Cis­Lunar/ Poseidon MK­VI CCR. Although the incorporation of three sensors is standard, how the information from those three sensors is interpreted is not standard. The main reason for having three sensors is to ostensibly allow for “voting logic”. With only one sensor, there is no way to know if it is reading incorrectly. With two sensors, it’s possible to know they are out of sync (and that at least one is reading incorrectly), but it is not possible to determine which sensor is correct, and which is incorrect. Thus, the reasoning goes, three sensors are needed to allow a “majority vote” regarding which readings to believe. In March of 2006, one of the authors posed a question to a room full of highly experienced rebreather divers:

Suppose you have three sensors that give you readings of 0.5 ATM , 0.5 ATM , and 1.1 ATM . What should the control system assume to be the correct PO2, and how should it use this information to maintain a safe breathing mixture?

Each experienced rebreather diver gave an answer. No two answers were the same. One said the PO2 should be interpreted as 0.5 ATM (voting out the high reading as erroneous). Another said the PO2 should be interpreted as 0.7 ATM (the average of all three sensors). Another said that the PO2 should be interpreted as 0.8 ATM (a midpoint between the two values). Another said that the sensor with a dynamic reading should override the static readings, if any. Another said that the control system should use the low value for preventing hypoxia and for calculating decompression, and the high value for preventing hyperoxia.

Each of these answers is either correct or incorrect, depending on which of the many possible failure modes has caused the readings to be out of agreement. In some failure modes, the correct value is 0.5 ATM. In other failure modes, 1.1 ATM is the correct value. Indeed, some failure modes involve all three sensors being wrong. Because there is no way to easily determine which failure mode has caused the discrepancy, there is no one “correct” response of the control system.

The Active Sensor Validation (ASV) system described here allows a real-time validation of the Primary Oxygen Sensor with as much reliability as laws of physics (i.e., Boyle’s Law), and certainty of diluent composition (verified to some extent during initial sensor calibration). With sensor validation and condensate purging combined into a single fully automated system, most failure modes are resolved. In fact, a strong argument can be made that a single sensor with active validation capabilities is more reliable and more informative than three passive sensors that cannot be validated.

However, there is at least one failure mode in this new system that mandates the need for the Secondary Oxygen Sensor, which is the possibility (described above) that a small trickle leak through one of the calibration solenoid valves could skew the value of the Primary Oxygen Sensor. By having an independent Secondary Oxygen Sensor that is not connected to the calibration solenoid valves, it is possible to detect this new failure mode and respond accordingly with appropriate alerts to the diver. In the context of the Active Sensor Validation system as used on no-decompression dives, the introduction of a third sensor provides no additional information of value for interpreting the actual PO2 of the breathing gas. Other ASV systems involving additional sensors and/or solenoid valves have been designed by Poseidon Systems AB (all are in patent­pending stage) and are being developed for use in exploratory rebreather systems for use in overhead environments (including decompression diving). Discussion of these more advanced systems is outside the scope of this document.

Diluent Injection Capability

Having an electronically ­controlled diluent valve also provides an opportunity for a feature not available in any other known CCR control system: that is, the ability to automatically reduce the oxygen concentration in the breathing loop. Whereas most CCR oxygen control systems operate by injecting oxygen via an electronically­ controlled valve whenever the oxygen concentration in the breathing gas drops below a certain “setpoint” value, they are incapable of responding in any way to a situation when the oxygen level increases above the set-point value. They are, in fact, “open loop” control systems. The system described here is capable true closed loop control – that is, by injecting a substantial volume of diluent gas into the breathing mixture if the detected oxygen concentration is too high. Although this would temporarily obfuscate the readings of both oxygen sensors, the sensors would restore functionality as soon as the breathing gas moved through the loop as the diver breathed [again, see footnote 5 on this subject], and the important factor is that a safer (reduced oxygen concentration) gas mixture would be delivered to the diver.

Oxygen Replenish Valve

Because oxygen replenishment is a normal function of the oxygen control system, it would be unwise to use the Oxygen Test Valve for this purpose, due to persistent spoofing of the Primary Oxygen Sensor, and exposure of this sensor to potentially very high PO2 values. Thus, a separate Oxygen Replenish Valve (or, in the case of the MK­VI, two Oxygen Replenish Valves) is incorporated into this system that injects oxygen intended to replenish that which is consumed by the diver into a location on the breathing loop where it will not impact the oxygen sensor readings directly. The oxygen injected to replenish the metabolized oxygen would be adequately mixed with the breathing loop gas before it reaches either oxygen sensor. However, in an emergency situation in which the normal oxygen replenish valve(s) fail to add oxygen to the system, or in a situation wherein an auxiliary safety valve (either manually operated or automatically operated) has closed the oxygen supply feeding the oxygen replenishment valves, then it would be possible to use the oxygen test valve to automatically add oxygen to the system. In such an event, which would be rare, the firmware residing on the system micro-controller would halt the normal oxygen sensing and firing algorithm and would wait for a period of time necessary for the oxygen that was injected through the oxygen test valve to have cleared the respective oxygen sensor cavities and been flushed with the mixed breathing gas resulting from the emergency oxygen addition pulse. At this point the firmware emergency algorithm would reassess the situation, measure the system PO2, and determine if further emergency oxygen addition is required through the oxygen test valve.

Automated Turbulent Condensate Purge 

The injections of (dry) diluent gas directly onto the sensor also have the simultaneous effect of blowing off any accumulated condensation near the sensor membrane. Through proper mechanical design, this injection process can be turbulent in such a fashion (through computational fluid dynamics modeling and empirical testing) as to lift off condensation from the oxygen sensor sensing surface and cause it to be ejected into the breathing loop (through radial drain holes in the sensor chamber) where it can be captured and stored (e.g. in a sponge trap). This can be achieved with the least amount of expended consumable gas. The injected gas can be pre-­warmed by exposure to a heat exchange mechanism with the ambient breathing loop gas to offset the chilling effect on the gas when it is decompressed from an intermediate pressure stage (i.e., upstream of the test valves). The volume of gas injected is small enough that it will have negligible impact on the overall breathing gas composition but it will have the beneficial effect of purging condensate automatically from the Primary Oxygen Sensor without diver intervention.


%d bloggers like this: