Thoughts on voting algorythms.....

Genesis

Wanted to throw this out for consideration, as I mull over a few things....

On the Parallax chipset I have neither the space nor the precision to get real fancy with voting logic, nor am I sure I want to.

But on the ZX, which has a LOT more speed, floating point and code storage, I'm contemplating the following algorythm....

1. If any sensor is off more than 0.02 from the others, it is considered "non-conforming."

2. If there is no consensus among the sensors, the high value, so long as it is not "on the rail" (indicating a short or leakage from V+ somehow) is considered the valid one. This is a serious alarm condition as well.

3. If there is consensus among two of the three, they are considered valid UNLESS the other one reads HIGH. Then IT is the consensus and the other TWO are voted out. If the "odd man out" reads LOW, it is called bad and voted out.

4. A voted out sensor is an alarm condition. TWO voted out sensors constitute a critical alarm.

The logic I'm operating on here is that it is entirely possible to have either "slow" or current limited cells. A "slow" cell is an annoyance, but current-limited ones can kill you.

You COULD have two current-limited cells - if you trust those, you could die by voting out the one good cell and injecting when the PO2 is in fact dangerously high. If you have two slow and one good cell, you will overshoot if you compute injection intervals based on the slow ones.

If you trust the high one, the only way you get in trouble is if the high cell has leakage from somewhere. Since we're already looking for that condition and will disregard the cell if this is the case, this appears "safe".

I am also implementing a "validation" (which is in the Parallax code already) - the controller will not permit a setpoint to be selected which exceeds the maximum validated value within the previous week. If no value has been stored within 7 days, the maximum validated value is reset to 0.5. The maximum allowed PO2 to be set is 0.1 below the validation value.

Thus, when you first dive the unit, you must validate a high setpoint if you wish to set one that is greater than 0.5. If you validate on the surface (maximum PO2 of 1.0) you can dive at 0.9. If you validate at 20' (PO2 = 1.6) you can then have the controller maintain a setpoint of anything up to 1.5 (providing you're deep enough to be able to do so.) The controller knows its depth so it will not attempt to maintain a setpoint that is impossible.

You can always manually increase the PO2 over the setpoint without an alarm (provided you don't go over 1.6, wihch is the high PO2 warning limit) but the controller will not assist you in killing yourself by allowing you to ask it to rely on sensors it does not know can reach the output necessary to indicate the desired PO2.

Thoughts?

__________________
"A venturesome minority will always be eager to get off on their own, and no obstacles should be placed in their path; let them take risks for Godsake, let them get lost, sunburnt, stranded, drowned, eaten by bears, buried alive under avalanches - that is the right and privilege of any free American."
http://www.denninger.net
http://www.diversunion.org/liability.htm - Fix the Diving Cert racket

UKSteve

Another consideration in the voting logic in an eCCR is the response of the cells to the soleniod firing. If one or more cells is seen not to react upwards just after the solenoid in opened by the controller then this in itself will be a strong indication of current limited / faulty cells (or no O2 - at which point none of the cells react!).

I believe this logic is used in the AP Vision electronics.

Steve

Genesis

That's already in there (in both versions of the code) - if the solenoid fires and the system does not see the upward spike that this should produce, that is an alarm condition as well.

__________________
"A venturesome minority will always be eager to get off on their own, and no obstacles should be placed in their path; let them take risks for Godsake, let them get lost, sunburnt, stranded, drowned, eaten by bears, buried alive under avalanches - that is the right and privilege of any free American."
http://www.denninger.net
http://www.diversunion.org/liability.htm - Fix the Diving Cert racket

PCDiver

Sounds annoying. Let's say my first dive is a 30 meter dive from a rib where you have to descend quickly because of current without shot line. You don't have the time to calibrate at 20 feet because that would make you drift to far. With your controller that would mean a setpoint of 0.9. Not good.

Genesis

No, you calibrate on atmospheric air. You can validate at any time, and validation is good for longer than calibration is (you must calibrate daily or the unit will not go into dive mode.) If you FORCE it down (e.g. you ignore the screaming warning about calibration being required) it will display PO2s but refuse to inject oxygen - forcing you to fly manually.

The purpose of validating is to prove that your cells are not current-limited. There is no way to know this WITHOUT validation. This is basic engineering stuff - and it irritates me to no end that none of the existing manufacturers think its important.

Yeah, yeah, I know, everyone else does it differently. That doesn't make it right - remember, I'm coming at this not from the perspective of a Rebreather diver with 1,000 hours underwater on one, but rather from a systems engineering standpoint.

IMHO sometimes there are advantages in NOT having drilled into you "how everyone does it" before you design and implement something....

You can always fly the unit as a manual injection unit with PO2 monitor. What you can't do is ask it to kill you by accident because the electronics have not verified that the sensors can actually deliver enough current to reach the setpoint desired (any Rebreather can kill you on PURPOSE)

I'm willing to eat the inconvenience of not having the unit run a hyperbaric PO2 until the controller is satisfied that it can measure that PO2 accurately.

__________________
"A venturesome minority will always be eager to get off on their own, and no obstacles should be placed in their path; let them take risks for Godsake, let them get lost, sunburnt, stranded, drowned, eaten by bears, buried alive under avalanches - that is the right and privilege of any free American."
http://www.denninger.net
http://www.diversunion.org/liability.htm - Fix the Diving Cert racket

decoweenie

I iterate Peter's comment.

You live/dive in Florida where the practive of "dive-bomb" a wreck (descend as fast as possible up current to drift into a wreck) is popular, this would mean that you would have to dive in manual most of the time.

__________________
"...after a while you get bored offering advice to a bull that like to keep butting the fence with its head rather than walking through the open gate..."

- Rebreather World PM

Genesis

No it doesn't; I think you're misinterpreting how it works.

I live and dive here too (Florida) and do hot drops from time to time.

Validation means you have to validate once a week. Every time you are on deco, select validate. As long as it does not expire you are not in any way limited. If you dive at least once a week, validation will never expire (except when the sensors don't work right any longer!)

If it does expire, your first dive after that is PO2 limited. However, if you have a working PO2 on the bottom (e.g. 1.4) manually attained you can validate there if you're comfortable that what you're seeing is "real" (e.g. if you're at the mod then a DIL flush works.) If you "believe it", then that's your call (e.g. you're way off the MOD and have injected O2 to bring up the PO2 manually - but you decide to tell the unit that its ok to go ahead and "trust" the sensor readings.)

What validation does is verify that the sensors can exceed the selected PO2 and that at the time you validated they were all within reasonable linearity at higher than the PO2 you wish to select for automatic maintenance.

Your use (or abuse) of it is entirely at your discretion - but it requires an affirmative action on your part of SEEING a valid PO2 reading from all three sensors and acknowledging that you're happy with it before the controller will allow a hyperbaric PO2 to be selected.

Its not an attempt to keep you from killing yourself by doing something stupid, but does eliminate one of the ways you can kill yourself through lack of attention to detail.

__________________
"A venturesome minority will always be eager to get off on their own, and no obstacles should be placed in their path; let them take risks for Godsake, let them get lost, sunburnt, stranded, drowned, eaten by bears, buried alive under avalanches - that is the right and privilege of any free American."
http://www.denninger.net
http://www.diversunion.org/liability.htm - Fix the Diving Cert racket

decoweenie

So once a week you will have to validate by either:

1. O2 flush at 20ft/6m, or
2. do a diluent flush at max depth using a diluent mix that would give you ~0.1 PO2 above your normal set-point

Is that correct ?

If so then option 1 is more practical since most people would standardize on a diluent mix for most depths (i.e. 10/50 for me).

__________________
"...after a while you get bored offering advice to a bull that like to keep butting the fence with its head rather than walking through the open gate..."

- Rebreather World PM

Genesis

Close - your options are:

1. Do an O2 flush at 20ft (if you want a max setpoint of 1.5) - the obvious convenient time to do that is during deco.
2. Do a dil flush at the MOD (if you want a max setpoint of 1.3, assuming MOD is defined in your world at 1.4)
3. Manually attain 0.1 over the setpoint you want to be able to set as maximum at any time during the dive, and tell the controller to validate. If the cells are all within linearity (none are voted out) it will accept that.

Note that (3) is not as safe as (1) or (2), as (3) doesn't prove that you really had 1.4 in the loop - just that you could read it, and all three sensors agreed - but you're the pilot.

You are warned on power-up if validation has expired and the setpoints have been cut back to 0.5. On the surface you can also validate to 1.0 (in practice, I can only reach 0.95ish) which will give you an 0.8 setpoint maximum - unless you "cheat" and do it during a positive pressure test (in which case you can read somewhat over 1.0, and get an 0.9)

This is sufficient to get you to the bottom with a decent PO2 (e.g. 0.8 ro 0.9) on automatic at which point you can validate if you wish to raise the setpoint further and believe what you're seeing.

__________________
"A venturesome minority will always be eager to get off on their own, and no obstacles should be placed in their path; let them take risks for Godsake, let them get lost, sunburnt, stranded, drowned, eaten by bears, buried alive under avalanches - that is the right and privilege of any free American."
http://www.denninger.net
http://www.diversunion.org/liability.htm - Fix the Diving Cert racket

decoweenie

Nice idea, but IMHO, not practical based on my experience:

• O2 flush at the begining of the dive isn't always possible.
• Mixing different diluent per dive to get 1.4 MOD isn't the usual practice.

I am sure you will disagree...

Anyway, I think an alarm to remind the diver to revalidate would be a better option than to disable the solenoid. Anyway, just MHO and it is your unit.

__________________
"...after a while you get bored offering advice to a bull that like to keep butting the fence with its head rather than walking through the open gate..."

- Rebreather World PM