[Genesis]

Quote: (Originally Posted by dave t)

Karl

is it not possible to buffer the cells so they dont react to stray voltage and the like hitting them?

In a way that makes it impossible for the cells to be polluted? No.

This is one of the "realities of life" that faces you when you design electronics. The amplifier (or ADC if you go direct into a high-bit-count one, e.g. a 20-bit unit) has a V+ rail applied to it in order to function. If a leak develops across that and the input pins, you will drive the sensor.

You can argue that one can use an instrument amp (differential amplification) to avoid this (e.g. neither pole of the sensor is grounded) but that only reduces the failure probability - it does not eliminate it. Instrument amps are used in medical equipment because there the risk is of electrocution, but you can still get nailed - it just requires two faults instead of one.

In a rebreather the "fault" that presents the risk is water intrusion and if it happens it is unlikely to remain localized to one pin on a device, unlike an actual electronics failure (which usually IS limited to one gate, unless the fault is caused by a power disturbance, etc)

At best there's a few millimeters of separation between the pins that carry power and ground. Relying on differential amplification to "prevent" a breach from happening isn't good enough.

My depth sensor requires differential amplification and yet it got buggered good when I flooded (intentionally) the head board. Even with what is supposed to be an "isolated" input, it was still screwed. It wasn't destroyed (once things were dried out it returned to normal) but the readings were WAY off (how's telling 'ya you're at 300' when you're on the surface sound?)

If you had a full-on flood and didn't bugger the secondary display then the attempts of the designer of that device to isolate this from happening held - that time. The point is that you cannot trust that they will hold. In the K1, for example, the head board is completely encapsulated in epoxy and no millivolt signals leave that board to the display - so a full-on flood of the computer will not cause the sensors to get buggered. In theory.

HOWEVER, a failure in the head board - which is possible - CAN cause the sensors to get hosed. Unfortunately it is possible for a fault in the handset to bugger the head board - applying unregulated V+ to a signal pin will frequently damage or destroy the device that gets the errant voltage. There are defensive mechanisms avalable to attempt to prevent that but they're not foolproof, particularly when salt water (which is highly conductive) is involved.

IMHO one of the design criteria for electronics like this is that you must not, to the best of your ability, present information to the user unless you have high confidence that it is correct. It is IMHO far better to "black out" the display than to display trash, because in the former case the user KNOWS he can't rely in the data (since there is none!) while in the latter he may think what he's got is valid when its not.

[Genesis]

Quote: (Originally Posted by AD_ward9)

That was because you are using the wrong cells.
.....
Our views on the poor performance of the Teledyne cells are well known, based on thorough testing. It never fails to astonish me how many companies just design these in without testing at all. For the cell to be suitable for a rebreather, dumping a cell into water should not change its characteristics, nor should shorting it out (the cells have a low resistance load on them anyway, internally).

Analysis of what I saw showed that the disruption came about because voltage was applied to the sensor's pins (that is, it was being "reverse driven", or if you prefer, "charged" instead of discharged)

The direction of the current (e.g. which pins was positive with respect to the other) in the malfunction scenario cannot be accurately predicted. In the synthetic tests of course it can be since immersion of an unpotted board has known trace lengths, distances from one pin to another, etc. But in a real failure the flood may not be total (that is, water intrusion may not reach all pins equally or at all) and as such you can at best guess what you're going to have happen.

I suspect that ANY O2 sensor is going to fail in similar ways if it is reverse-driven.

(BTW, I'd love to test the AI sensors, but they've become unobtanium in the US since the guy who was distributing them has passed and nobody has picked them up. So for right now anyway we appear to be stuck with Teledyne.)

I wasn't able to blow up the sensor amplification board (in the head) by flooding the controller board on purpose (although I did destroy the controller doing that!) but that doesn't mean that I trust that it will not happen if the handset floods for real. That I couldn't cause it in a synthetic test doesn't mean that if the same thing happens 10,000 times it will never occur, as all of the necessary elements to cause potential damage are present. By definition any time unregulated voltage can find its way onto a regulated voltage rail or signal pin which has its maximum allowable applied potential under the unregulated rail's voltage you have the potential to destroy circuitry. I tend to be very defensive when it comes to designs like this, coming from a process-control background - if the device cannot be reasonably confident of what its displaying then its going to alarm if it can, but refuse to proceed automously.

[AD_ward9]

Quote: (Originally Posted by Genesis)

In a way that makes it impossible for the cells to be polluted? No.

Sorry, but I disagree. We have tested Teledyne R17D and R22Ds in sea water, and they fail. We have tested Analytical Industries PSR 11-39-MDs in sea water and they pass. Same is true for exposure to CO2. That is the effect of pollution. A second issue is the effect of putting a current into the cell.

The design should protect the cells from reverse currents/voltages by a 100k or larger resistor between the cell and every load, and guard ring the signal tracks.

Quote: (Originally Posted by Genesis)

This is one of the "realities of life" that faces you when you design electronics. The amplifier (or ADC if you go direct into a high-bit-count one, e.g. a 20-bit unit) has a V+ rail applied to it in order to function. If a leak develops across that and the input pins, you will drive the sensor.

This would be a very dangerous design. We have seen that design in the field: a rebreather we tested after a fatality from another company, had an ESD fault due to doing exactly what you describe.

The sensors should have a large series resistor between them and any electronics. E.g. a 100K. The output of the cell has a resistor across it, internally giving it an output impedance of between 82 Ohms and 270 Ohms. This means the electronics can fail in any way it likes, it is not going to affect the reading from that cell from any of the redundant ADCs that should be present. The signal tracks should be internal to the pcb, guarded by ground, so even a flood does not put a voltage on the cells.

We have tested with 10k and 100k series resistors. With the latter, there is noticeably more noise, so oversample and use a 64 sample moving average to give a 1 second response on your input. 100k is safer from the ESD and cross-fault standpoint.

Quote: (Originally Posted by Genesis)

You can argue that one can use an instrument amp (differential amplification) to avoid this (e.g. neither pole of the sensor is grounded) but that only reduces the failure probability - it does not eliminate it. Instrument amps are used in medical equipment because there the risk is of electrocution, but you can still get nailed - it just requires two faults instead of one.

This is the wrong way to do it, and will fail from a single failure.

Quote: (Originally Posted by Genesis)

In a rebreather the "fault" that presents the risk is water intrusion and if it happens it is unlikely to remain localized to one pin on a device, unlike an actual electronics failure (which usually IS limited to one gate, unless the fault is caused by a power disturbance, etc)

This is not true. When moisture gets into a chip there is a generalised failure because everything is within a few microns of the silicon surface (it is a planar lithographic process: the gate oxide is just tens of atoms thick in a modern process).

Quote: (Originally Posted by Genesis)

At best there's a few millimeters of separation between the pins that carry power and ground. Relying on differential amplification to "prevent" a breach from happening isn't good enough.

You are thinking of the pins. What happens is usually not a pin problem, but the water moves by capilliary action along the leadframe. The pads on the silicon are very close together indeed: typically 200 microns.

Quote: (Originally Posted by Genesis)

My depth sensor requires differential amplification and yet it got buggered good when I flooded (intentionally) the head board. Even with what is supposed to be an "isolated" input, it was still screwed. It wasn't destroyed (once things were dried out it returned to normal) but the readings were WAY off (how's telling 'ya you're at 300' when you're on the surface sound?)

Again, a design issue.
Alex

[rdmmdr]

alex

we keep hearing about the sensor report so either post it or quit harping about it. and lets see your electronics. schematics and code, if they are so much better then everyone elses, i am sure you can sell them. but prove it. i will volunteer to crash test it, with mine as backup
rick

[Genesis]

Quote: (Originally Posted by AD_ward9)

Sorry, but I disagree. We have tested Teledyne R17D and R22Ds in sea water, and they fail. We have tested Analytical Industries PSR 11-39-MDs in sea water and they pass. Same is true for exposure to CO2.
This would be a very dangerous design. We have seen that design in the field: a rebreather we tested after a fatality from another company, had an ESD fault due to doing exactly what you describe.

The sensors should have a large series resistor between them and any electronics. E.g. a 100K. The output of the cell has a resistor across it, internally giving it an output impedance of between 82 Ohms and 270 Ohms. This means the electronics can fail in any way it likes, it is not going to affect the reading from that cell from any of the redundant ADCs that should be present.

We have tested with 10k and 100k series resistors. With the latter, there is noticeably more noise, so oversample and use a 64 sample moving average to give a 1 second response on your input. 100k is safer from the ESD and cross-fault standpoint.

Series resistors do you no good if they are shorted across by seawater. The effective series resistance of most amplifiers (I realize you're not using them as you're going direct into a high-bitcount ADC) is in the megaohms or better, so the problem doesn't arise there.

The potential problem comes from seawater contamination where it does not belong.

You are assuming that the watertight integrity of your electronics is never compromised. I am assuming that it can be compromised. Indeed, field results say that it sometimes is - a handset CAN flood, for example.

One change I considered on the K1 was to perform rail power regulation in the battery housing. That change has some good and some bad outcomes. The bad outcome is that one of the most likely failures (flood wise) is in the battery case! If that happens you are now likely to destroy the ENTIRE electronics system because now it is POSSIBLE for an unregulated V+ rail to appear on the regulated V+ output. NOT good.

The GOOD outcome is that with the digital signal handling between the head and controller you could then REMOVE the cap of the controller (if you could get it off!) underwater and it would destroy the controller, but there would be no damage to the head board nor the sensors, as there's nothing other than TTL level signals in there - no unregulated power is then in the handset.

So far the bad outweighs the good, so the regulator stays in the handset. If the handset floods you must assume that the head board has been compromised. What follows from that is that you must ALSO assume the SENSORS connected to that head board have been compromised.

I argue that you must make this assumption even if 99.99% of the time you're wrong and the sensors are just fine, because the ONE time they are screwed you are going to die if you trust them.

Thus, you must have ALTERNATIVES available to you in this event instead - which will NOT be compromised by that happening. That means you either have a 4th completely independant cell in the head, or you bail off if the primary electronics fail until you can reach a depth where it is safe to run the unit as a pure O2 rebreather (which requires no electronics.)

Quote:

This is the wrong way to do it, and will fail from a single failure.
......
This is not true. When moisture gets into a chip there is a generalised failure because everything is within a few microns of the silicon surface (it is a planar lithographic process: the gate oxide is just tens of atoms thick in a modern process).

Yes, I know - but the fault STARTS with the water bridging the pins. As it progresses into the chip itself the short becomes more-or-less total, as the resistance of seawater across distances of that size is very close to zero.

Fact is Alex that if you have a water intrusion problem into the electronics all bets are off for anything connected to that device by conductors. Without electrical isolation (e.g. optical signalling and completely separate power sources) you CANNOT trust anything connected to the device which has been compromised. This is doubly true if you have an unregulated voltage rail anywhere in the same flooded space.

You can buy some protection by putting your voltage regulation and all V+ wiring in a COMPLETELY separate space (e.g. separately potted) but even this is not proof against failure, as that separate space can ALSO fail in isolation and dump unregulated power where it doesn't belong.

[AD_ward9]

Quote: (Originally Posted by Genesis)

Series resistors do you no good if they are shorted across by seawater. The effective series resistance of most amplifiers (I realize you're not using them as you're going direct into a high-bitcount ADC) is in the megaohms or better, so the problem doesn't arise there.

The potential problem comes from seawater contamination where it does not belong.

Which is why the signal lines should be run inside the pcb with gnd guards.

On the input to inverting amplifiers, it is not high impedance: it is zero due to the feedback to control the amplifier gain, so the series resistor from the pin which sets the gain ratio determines the overall input impedance. For positive amplifiers, both inputs should see the same impedance for maximum stability.

If you use an amplifier directly, then it will fail sooner or later from ESD.

On the flood issue, the answer is detect the flooding. This is very easy to do: we use a differential sensor across the scrubber to detect it early on, but on the sensor board, have multiple wet contacts. If your sensors are in water then your loop is so compromised it can't be used.

On the regulator issue, regulators should not be in the breathing loop. Incidentally, if you use a single tant capacitor, your design will fail EN61508.

This thread was about the sensors being damaged by a flood. The remedies are as I described: series resistor to prevent the chips driving them, and using a gnd guard around the signal wires so no current can get into them. Shorting them out completely for a period is OK on most sensors. Driving a voltage into them is not OK.

Alex

[Genesis]

Quote: (Originally Posted by AD_ward9)

Which is why the signal lines should be run inside the pcb with gnd guards.

On the input to inverting amplifiers, it is not high impedance: it is zero due to the feedback to control the amplifier gain, so the series resistor from the pin which sets the gain ratio determines the overall input impedance. For positive amplifiers, both inputs should see the same impedance for maximum stability.

If you use an amplifier directly, then it will fail sooner or later from ESD.

Oh now c'mon. That's not true. There are ways to prevent ESD damage and they're not exactly esoteric.

Quote:

On the flood issue, the answer is detect the flooding. This is very easy to do: we use a differential sensor across the scrubber to detect it early on, but on the sensor board, have multiple wet contacts. If your sensors are in water then your loop is so compromised it can't be used.

You're assuming the flood is in the head. I'm not. Cables can flood, electronics can flood, battery compartments can flood. Of those, most are not in the breathing loop.

Quote:

On the regulator issue, regulators should not be in the breathing loop. Incidentally, if you use a single tant capacitor, your design will fail EN61508.

I'm aware of this. No tant's anywhere on my unit, and there is nothing other than ceramics and mylars for caps in the potted part that's in the head. The voltage regulators along with the high-output pass ICs are in the handset, where they cannot cause offgassing into the loop if something really dramatic and bad happens - that's a 1 ATA enclosure on your wrist with an interrupted cable connection - no path back to the loop for it.

Quote:

This thread was about the sensors being damaged by a flood. The remedies are as I described: series resistor to prevent the chips driving them, and using a gnd guard around the signal wires so no current can get into them. Shorting them out completely for a period is OK on most sensors. Driving a voltage into them is not OK.

Alex

Actually, it was about trusting sensors after a flood, and I didn't take the original discussion as being strictly about sensors getting wet.....

[rdmmdr]

alex

what are you talking about 10,000 volt protection for the circuits, i work with 13.8 kv and know what it will do. there is now way you can include 10kv protection in a rebreather. much less protect the inputs from 100v , and why do in the first place.

when you want to stop building the next 100 thousand dollar rebreather and get real post the spec for your s--t and we get to tear it apart.


you act like you are the only individual in the world that can build the electronics for a rebreather.

you are using 20 bit adcs why the sensor has less then 8 bit resoluition talk about overkill

rick

[AD_ward9]

Quote: (Originally Posted by rdmmdr)

alex

what are you talking about 10,000 volt protection for the circuits, i work with 13.8 kv and know what it will do. there is now way you can include 10kv protection in a rebreather. much less protect the inputs from 100v , and why do in the first place.

when you want to stop building the next 100 thousand dollar rebreather and get real post the spec for your s--t and we get to tear it apart.

you act like you are the only individual in the world that can build the electronics for a rebreather.

you are using 20 bit adcs why the sensor has less then 8 bit resoluition talk about overkillrick

You are mixing Electrostatic discharge voltages and power voltages. The two are like chalk and cheese to each other (i.e. totally different).

1. The chips themselves have 2KV ESD resistance. If any chip has less than 1.5KV ESD protection, they tend to fail spontaneously. If you do a google on "ESD HBM" you will find a lot of information on this.

2. Put an O2 cell into the unit in your living room, and you will inject around 10KV in an ESD event. Protecting from this is normal design practice. It just takes the right resistor and capacitor, and two diodes (which are normally in one pack). For a rebreather you need Class 3B+ ESD protection overall, because there are no ESD protection provisions in the environment where the unit is used. Just the same as the RF input on your TV or the USB ports on decent computers. It is very simple to do. It costs less than $0.04. The capacitor is the decoupling across your power supplies.

3. The need is to protect from ESD not 10KV continuously. 100V continuous protection is required, and this is achieved using the same components as above. The 100V comes from a cell with the load open circuit for a long period.

On your comments on electronics design, there are quite a few on this forum who have good electronics design skills, hence the sensible debates.
If you believe you can do much better, then do it and post the circuit diagrams just like we have.

On the ADC issue, using a high resolution ADC gives 15uV resolution, which with a 4.5mV in air O2 sensor gives the resolution required for the end result to be accurate to 1%. If you use an 8 bit ADC you will have to use a high gain amplifier in front of it, which will drift considerably, or use a lot of power. It will cost more than the 24 bit solution. To have a 1% accuracy output, with a 0.9% accuracy sensor, the resolution and accuracy needs to be much higher than 1%, otherwise the accuracy will drop as the root sum of the squares of each error in the path. Your offset voltage on your amplifier in front of an 8 bit ADC can give you a huge error. Look at the offset voltage and its temperature dependency for the amplifier you use. In any case, 24 bit ADCs are actually cheaper than 8 bit because they are sigma delta converters instead of Flash converters or dual slope.

Alex

[AD_ward9]

Quote: (Originally Posted by Genesis)

Oh now c'mon. That's not true. There are ways to prevent ESD damage and they're not exactly esoteric.

We had an offline discussion on the ESD issue. The short of it is that you use capacitor and resistor as shunts for ESD, whereas we use series methods because ESD is a discharge spike of 1ns, followed by 100ns decay from the body, and the inductance in shunts means they work poorly. For example, most capacitors are actually inductors at these frequencies (just check the self resonant frequency of the capacitor).

There are lots of ways of skinning a cat, and lots of simple cheap solutions to the ESD issue. We both agree this is not esoteric stuff, but basic things any decent designer does to external inputs. The easiest one of all is to fit SMB connectors instead of Molex so the gnd makes contact before the signal pin.

The tracking inside the board is not for ESD: it is to prevent the power supply being coupled to the sensor tracks anywhere. Tracks are covered by solder resist, but if the power supply does get to them through heavy condensation or worse, a flood, then the sensors are stuffed.

Alex