CNS Calculation and Verification Model

AD_ward9

Attached is a verification model for the CNS calculation.

The margin needed to meet the 1 billion hour requirement for avoiding O2 convulsions may be controversial (Section 7).

The model provides a formal specification and model for integer implementations as well as floating point. The actual code, both the Verilog version and the C version, is then run against the model, in Monte Carlo simulations, to validate the correctness of the implementation.

As usual, all constructive comments welcome.

Cheers,

Alex

Attached Images

CNS verification model_060418.pdf (165.6 KB, 134 views)

Genesis

I don't think there's anything controversial about it at all.

1.0 appears to be a perfectly reasonable place to put the bar, considering the extreme nature of the consequence if you take an O2 hit.

While there ARE people who take one and survive, the odds are not good. Even with a FFM the prospect of the victim being totally "out of it" for 30 minutes or more is not conducive to them remaining alive.

Now where there MAY be controversy is if you disallow override (e.g. during decompression.) I'm not sure that is nearly as open-and-shut as it is for the "working" portion of the dive.

__________________
"A venturesome minority will always be eager to get off on their own, and no obstacles should be placed in their path; let them take risks for Godsake, let them get lost, sunburnt, stranded, drowned, eaten by bears, buried alive under avalanches - that is the right and privilege of any free American."
http://www.denninger.net
http://www.diversunion.org/liability.htm - Fix the Diving Cert racket

AD_ward9

Well that is where the interesting bit comes in. You see, from the two US Navy based trials referenced (Butler, Central Nervous System Oxygen Toxicity in Closed Loop SCUBA Divers II and Harabin, A Model for Predicting Central Nervous System Oxygen Toxicity from Hyperbaric Oxygen Exposures in Humans), the predicted death rate if you decompress on a PPO2 of 1.3 and run your CNS to 75% is quite high - far higher than the 1 in a billion requirement set in European Law.

As a quick check on whether the calculated figure of 1 in 10,000 to 1 in 100,000 risk is correct, we looked at this forum and accident lists. There were roughly 500 members of this forum when we looked, not all of whom have rebreathers. Their experience seems to be on average about 3 years. There are six incidents reported of O2 convulsions. This suggests the convulsion rate is below the 1 in 100,000 hour level.

Possible reasons for this are also cited. CO2 and Helium both increase the risk of O2 toxicity. See again the references cited.

Finally, there is the issue of error in calibration or failure of multiple sensors causing the PPO2 to be out by enough to have an impact on O2 toxicity.

Given these factors, it is necessary to either put a safety margin around the measured PPO2 or some other conservatism factor.

The margin around PPO2 seems the best. Given the Naval studies, simply doing the sums says that to get the risk below 1 in a billion hours, one needs a padding factor of 0.25. So we can put in 0.2 and 0.3 for aggressive and conservative use.

This would mean you can decompress on 1.4 even, but your CNS clock would tick fast causing you to need low PPO2 breaks.

Comments more than welcome. I do emphase this is a mathematical thing rather than anything subjective. We need to back decisions by hard facts and prove probabilities: this again is a requirement for EC approval - a Safety Assessment is required and various standards stipulate the requirements these must meet.

There is an update already to the paper, from internal feedback since January. The change is a minor one, reported on the front page, relating to simplifying the integer calculation. There is no change in results for the data set presented.

Cheers

Alex

Attached Images

CNS verification_model_060418.pdf (167.0 KB, 31 views)

Genesis

Here's an interesting idea... on deco have the unit time "air breaks" for you, and alternate between a low and high setpoint (e.g. 1.3 and 0.4)

I wonder if that would keep the O2 toxicity risk under control, while still giving the advantages of relatively-high PO2 deco?

__________________
"A venturesome minority will always be eager to get off on their own, and no obstacles should be placed in their path; let them take risks for Godsake, let them get lost, sunburnt, stranded, drowned, eaten by bears, buried alive under avalanches - that is the right and privilege of any free American."
http://www.denninger.net
http://www.diversunion.org/liability.htm - Fix the Diving Cert racket

AD_ward9

That is a good idea. We will put that in. Green blob again for that!

So, when you get to 90% CNS using the accelerated method, the system will tell you it is putting in an "Air break" and do just that, allowing the PPO2 to be breathed down to 0.4, until CNS drops to 85%, whereupon it will increase the PPO2 to your set point again.

You will need to breathe the loop down. This will take 10 to 12 minutes if you are on deco.

Any other suggestion on the limits? Should low point be 0.7?

Cheers,

Alex

divetheworld

Statistics work as impressive as ever. Two questions Alex;

What specific legal requirement are you referring to in the first statement, curious.

The reference to He & CO2 increasing the possibility of a tox, have you found much tangible evidence to get some conclusions from on this? Any suppositions you might want to share?

Interesting stuff.

Brent

__________________

AD_ward9

On your first question, EN14143:2003 makes it a requirement to meet EN 61508. That contains the 1 billion hour requirement in part 0.

On the second item, it is in the papers we cited in the pdf I posted. The reference section has links to the papers online, so it easy to download them.

We also kept our list of citations down to the minimum so we do not lose the important information in noise. The papers we cited have a good list of other references on this same topic.

Cheers,

Alex

Genesis

Gotta go under 0.5 to get ANY credit for CNS according to NOAA.

Note that the usual practice on OC is to use the LOWEST FO2 gas you have (which is usually backgas); on 16/50, for example, an airbreak at 20' produces a roughly .25 PO2.

This would tend to argue for running even lower during an airbreak - perhaps to 0.3 - but I can see risk there too, because as the PO2 gets lower the reaction time for a LOW PO2 alarm goes down as well......

I am thinking 0.4 because that leaves you a reasonable margin before a failure to inject (e.g. low PO2) becomes critical, leaves you with the ability to ascend on the loop without injection in an emergency from 20' without risking the loop going hypoxic, and yet meets the < 0.5 critical point.

__________________
"A venturesome minority will always be eager to get off on their own, and no obstacles should be placed in their path; let them take risks for Godsake, let them get lost, sunburnt, stranded, drowned, eaten by bears, buried alive under avalanches - that is the right and privilege of any free American."
http://www.denninger.net
http://www.diversunion.org/liability.htm - Fix the Diving Cert racket

AD_ward9

I agree with your whole argument on this one.

So, we allow the user to select CNS acceleration as conservative or aggressive. In conservative mode we add 0.3 and in aggressive mode 0.2, to the actual PPO2. We then use the CNS algorithm, verified using the formal model posted, to determine the CNS%. When the resulting CNS gets to 90%, we tell the user the system is "Adding an air break" and allow the PPO2 to be breathed down to 0.4. When CNS gets down to 85%, we return to the PPO2 set point.

Users can set PPO2s of:

• up to 0.7 on the surface
• up to 1.1 below 20m
• up to 1.4 above 20m

Min PPO2 is 0.4 at all times.

I should mention that users can set surface PPO2 either manually, or on "auto", where the system tries to maintain 70% of the maximum possible PPO2 up to the set point. This is shown on the formal deco model, and also in the O2 control model.

Thanks for some useful feedback. I think we have a safer system because of it, already. Any more comments welcome.

We will include the above behaviour in the simulator, formal model and then the actual code.

Cheers,

Alex

UWSojourner

Richard Vann's article refers to the PO2 limits in terms of bar. Other published tables refer to ATA. What is the standard? Bar or ATA when refering to 45min at 1.6 (for example)?