Electro-galvanic oxygen sensor

An electro-galvanic fuel cell is an electrochemical device which consumes a fuel to produce an electrical output by a chemical reaction. One form of electro-galvanic fuel cell based on the oxidation of lead is commonly used to measure the concentration of oxygen gas in underwater diving and medical breathing gases.

Electronically monitored or controlled diving rebreather systems,^[1] saturation diving systems,^[2] and many medical life-support systems use galvanic oxygen sensors in their control circuits to directly monitor oxygen partial pressure during operation.^[3] They are also used in oxygen analysers in recreational, technical diving and surface supplied mixed gas diving to analyse the proportion of oxygen in a nitrox, heliox or trimix breathing gas before a dive.^[4]

These cells are lead/oxygen galvanic cells where oxygen molecules are dissociated and reduced to hydroxyl ions at the cathode. The ions diffuse through the electrolyte and oxidize the lead anode. A current proportional to the rate of oxygen consumption is generated when the cathode and anode are electrically connected through a resistor^[1]

The cell reaction for a lead/oxygen cell is: 2Pb + O₂ → 2PbO, made up of the cathode reaction: O₂ + 2H₂O + 4e⁻ → 4OH⁻, and anode reaction: 2Pb + 4OH⁻ → 2PbO + 2H₂O + 4e⁻.^[1]

The cell current is proportional to the rate of oxygen reduction at the cathode, but this is not linearly dependent on the partial pressure of oxygen in the gas to which the cell is exposed: Linearity is achieved by placing a diffusion barrier between the gas and the cathode, which limits the amount of gas reaching the cathode to an amount that can be fully reduced without significant delay, making the partial pressure in the immediate vicinity of the electrode close to zero. As a result of this the amount of oxygen reaching the electrode follows Fick's laws of diffusion and is proportional to the partial pressure in the gas beyond the membrane. This makes the current proportional to P_O2. The load resistor over the cell allows the electronics to measure a voltage rather than a current. This voltage depends on the construction and age of the sensor, and typically varies between 7 and 28 mV for a P_O2 of 0.21 bar^[1]

Diffusion is linearly dependent on the partial pressure gradient, but is also temperature dependent, and the current rises about two to three percent per kelvin rise in temperature. A negative temperature coefficient resistor is used to compensate, and for this to be effective it must be at the same temperature as the cell. Oxygen cells which may be exposed to relatively large or rapid temperature changes, like rebreathers, generally use thermally conductive paste between the temperature compensating circuit and the cell to speed up the balancing of temperature.^[1]

Temperature also affects the signal response time, which is generally between 6 and 15 seconds at room temperature for a 90% response to a step change in partial pressure. Cold cells react much slower and hot cells much faster. As the anode material is oxidised the output current drops and eventually will cease altogether. The oxidation rate depends on the oxygen reaching the anode from the sensor membrane. Lifetime is measured in oxygen-hours, and also depends on temperature and humidity^[1]

The oxygen content of a stored gas mixture can be analysed by passing a small flow of the gas over a recently calibrated cell for long enough that the output stabilises. The stable output represents the fraction of oxygen in the mixture. Care must be taken to ensure that the gas flow is not diluted by ambient air, as this would affect the reading.^{[citation needed]}

The partial pressure of oxygen in anaesthetic gases is monitored by siting the cell in the gas flow, which is at local atmospheric pressure, and can be calibrated to directly indicate the fraction of oxygen in the mix.^{[citation needed]}

The partial pressure of oxygen in diving chambers and surface supplied breathing gas mixtures can also be monitored using these cells. This can either be done by placing the cell directly in the hyperbaric environment, wired through the hull to the monitor, or indirectly, by bleeding off gas from the hyperbaric environment or diver gas supply and analysing at atmospheric pressure, then calculating the partial pressure in the hyperbaric environment. This is frequently required in saturation diving and surface oriented surface supplied mixed gas commercial diving.^[5][2]

The breathing gas mixture in a diving rebreather loop is usually measured using oxygen cells, and the output of the cells is used by either the diver or an electronic control system to control addition of oxygen to increase partial pressure when it is below the chosen lower set-point, or to flush with diluent gas when it is above the upper set-point. When the partial pressure is between the upper and lower set-points, it is suitable for breathing at that depth and is left until it changes as a result of consumption by the diver, or a change in ambient pressure as a result of a depth change.^{[citation needed]}

Accuracy and reliability of measurement is important in this application for two basic reasons. Firstly, if the oxygen content is too low, the diver will lose consciousness due to hypoxia and probably die,^[6] or if the oxygen content is too high, the risk of central nervous system oxygen toxicity causing convulsions and loss of consciousness, with a high risk of drowning becomes unacceptable.^[6] Secondly, decompression obligations cannot be accurately or reliably calculated if the breathing gas composition is not known.^[6] Pre-dive calibration of the cells can only check response to partial pressures up to 100% at atmospheric pressure, or 1 bar. As the set points are commonly in the range of 1.2 to 1.6 bar,^[6] special hyperbaric calibration equipment would be required to reliably test the response at the set-points. This equipment is available, but is expensive and not in common use, and requires the cells to be removed from the rebreather and installed in the test unit. To compensate for the possibility of a cell failure during a dive, three cells are generally fitted, on the principle that failure of one cell at a time is most likely, and that if two cells indicate the same P_O2, they are more likely to be correct than the single cell with a different reading. Voting logic allows the control system to control the circuit for the rest of the dive according to the two cells assumed to be correct. This is not entirely reliable, as it is possible for two cells to fail on the same dive.^[6]

The sensors should be placed in the rebreather where a temperature gradient between the gas and the electronics in the back of the cells will not occur.^[1]

Oxygen cells behave in a similar way to electrical batteries in that they have a finite lifespan which is dependent upon use. The chemical reaction described above causes the cell to create an electrical output that has a predicted voltage which is dependent on the materials used. In theory they should give that voltage from the day they are made until they are exhausted, except that one component of the planned chemical reaction has been left out of the assembly: oxygen.^[7]

Oxygen is one of the fuels of the cell so the more oxygen there is at the reaction surface, the more electrical current is generated. The chemistry sets the voltage and the oxygen concentration controls the electric current output. If an electrical load is connected across the cell it can draw up to this current but if the cell is overloaded the voltage will drop. When the lead electrode has been substantially oxidised, the maximum current that the cell can produce will drop, and eventually linearity of output current to partial pressure of oxygen at the reactive surface will fail within the required range of measurement, and the cell will no longer be accurate.^[7]

There are two commonly used ways to specify expected sensor life span: The time in months at room temperature in air, or volume percentage oxygen hours (Vol%O₂h). Storage at low oxygen partial pressure when not in use would seem an effective way to extend cell life, but when stored in anoxic conditions the sensor current will cease and the surface of the electrode may be passivated, which can lead to sensor failure. High ambient temperatures will increase sensor current, and reduce cell life. In diving service a cell typically lasts for 12 to 18 months, with perhaps 150 hours service in the diving loop at an oxygen partial pressure of about 1.2 bar and the rest of the time in storage in air at room temperature.^[1]

Failures in cells can be life-threatening for technical divers and in particular, rebreather divers.^[8] The failure modes common to these cells are: failing with a higher than expected output due to electrolyte leaks, which is usually attributable to physical damage, contamination, or other defects in manufacture,^[7] or current limitation due to exhausted cell life and non linear output across its range.^[1][7]

Shelf life can be maximised by keeping the cell in the sealed bag as supplied by the manufacturer until being put into service, storing the cell before and between use at or below room temperature, - a range of from 10 to 22 °C is recommended by a manufacturer - and avoid storing the cell in warm or dry environments for prolonged periods, particularly areas exposed to direct sunlight.^[9]

When new, a sensor can produce a linear output for over 4 bar partial pressure of oxygen, and as the anode is consumed the linear output range drops, eventually to below the range of partial pressures which may be expected in service, at which stage it is no longer fit to control the system. The maximum output current eventually drops below the amount needed to indicate the full range of partial pressures expected in operation. This state is called current-limited. Current limited cells do not give a high enough output in high concentrations of oxygen.^[1][7] The rebreather control circuit responds as if there is insufficient oxygen in the loop and injects more oxygen in an attempt to reach a setpoint the cell can never indicate, resulting in hyperoxia. When a current limited sensor can no longer reliably activate the control system at the upper set-point in a life support system, there is a severe risk of an excessive oxygen partial pressure occurring which will not be noticed, which can be life-threatening.^[1][10]

Other failure modes include mechanical damage, such as broken conductors, corroded contacts and loss of electrolyte due to damaged membranes.^[1][7]

Failing high – producing an output indicating partial pressure higher than reality – is invariably a result of a manufacturing fault or mechanical damage. In rebreathers, failing high will result in the rebreather assuming that there is more oxygen in the loop than there actually is which can result in hypoxia.^[7]

Non-linear cells do not perform in the expected manner across the required range of oxygen partial pressures. Two-point calibration against diluent and oxygen at atmospheric pressure will not pick up this fault which results in inaccurate loop contents of a rebreather. This gives the potential for decompression illness if the loop is maintained at a lower partial pressure than indicated by the cell output, or hyperoxia if the loop is maintained at a higher partial pressure than indicated by cell output.^[7]

Preventing accidents in rebreathers from cell failures is possible in most cases by accurately testing the cells before use.^[7] Some divers carry out in-water checks by pushing the oxygen content in the loop to a pressure that is above that of pure oxygen at sea level to indicate if the cell is capable of high outputs.^[11] This test is only a spot check and does not accurately assess the quality of that cell or predict its failure.^[11] The only way to accurately test a cell is with a test chamber which can hold a calibrated static pressure above the upper set-point without deviation and the ability to record the output voltage over the full range of working partial pressures and graph them.^{[citation needed]}

If more than one statistically independent cell is used, it is unlikely that more than one will fail at a time. If one assumes that only one cell will fail, then comparing three or more outputs which have been calibrated at two points is likely to pick up the cell which has failed by assuming that any two cells that produce the same output are correct and the one which produces a different output is defective. This assumption is usually correct in practice, particularly if there is some difference in the history of the cells involved.^[12][7] The concept of comparing the output from three cells at the same place in the loop and controlling the gas mixture based on the average output of the two with the most similar output at any given time is known as voting logic, and is more reliable than control based on a single cell. If the third cell output deviates sufficiently from the other two, an alarm indicates probable cell failure. If this occurs before the dive, the rebreather is deemed unsafe and should not be used. If it occurs during a dive, it indicates an unreliable control system, and the dive should be aborted. Continuing a dive using a rebreather with a failed cell alarm significantly increases the risk of a fatal loop control failure. This system is not totally reliable. There has been at least one case reported where two cells failed similarly and the control system voted out the remaining good cell.^[6][10]

If the probability of failure of each cell was statistically independent of the others, and each cell alone was sufficient to allow safe function of the rebreather, the use of three fully redundant cells in parallel would reduce risk of failure by five or six orders of magnitude.^[6]

The voting logic changes this considerably. A majority of cells must not fail for safe function of the unit. In order to decide whether a cell is functioning correctly, it must be compared with an expected output. This is done by comparing it against the outputs of other cells. In the case of two cells, if the outputs differ, then one at least must be wrong, but it is not known which one. In such a case the diver should assume the unit is unsafe and bail out to open circuit. With three cells, if they all differ within an accepted tolerance, they may all be deemed functional. If two differ within tolerance, and the third does not, the two within tolerance may be deemed functional, and the third faulty. If none are within tolerance of each other, they may all be faulty, and if one is not, there is no way of identifying it.^[6]

Using this logic, the improvement in reliability gained by use of voting logic where at least two sensors must function for the system to function is greatly reduced compared to the fully redundant version. Improvements are only in the order of one to two orders of magnitude. This would be great improvement over the single sensor, but the analysis above has assumed statistical independence of the failure of the sensors, which is generally not realistic.^[6]

Factors which make the cell outputs in a rebreather statistically dependent include:^[6][7]

• Common calibration gas - They are all calibrated together in the pre-dive check using the same diluent and oxygen supply.
• Sensors are often from the same manufacturing batch - Components, materials and processes are likely to be very similar.
• Sensors are often installed together and have since been exposed to the same P_O2, temperature profile over the subsequent time.
• Common working environment, particularly with regards to temperature and relative humidity, as they are usually mounted in very close proximity in the loop, to ensure that they measure similar gas.
• Common measurement systems
• Common firmware for processing the signals

This statistical dependency can be minimised and mitigated by:^[6][7]

• Using sensors from different manufacturers or batches, so that no two are from the same batch
• Changing sensors at different times, so they each have a different history
• Ensuring that the calibration gases are correct
• Adding an statistically independent P_O2 measuring system to the loop at a different place, using a different model sensor, and using different electronics and software to process the signal.
• Calibrating this sensor using a different gas source to the others

An alternative method of providing redundancy in the control system is to recalibrate the sensors periodically during the dive by exposing them to a flow of either diluent or oxygen or both at different times, and using the output to check whether the cell is reacting appropriately to the known gas as the known depth. This method has the added advantage of allowing calibration at higher oxygen partial pressure than 1 bar.^[6] This procedure may be done automatically, where the system has been designed to do it, or the diver can manually perform a diluent flush at any depth at which the diluent is breathable to compare the cell P_O2 readings against a known F_O2 and absolute pressure to verify the displayed values. This test does not only validate the cell. If the sensor does not display the expected value, it is possible that the oxygen sensor, the pressure sensor (depth), or the gas mixture F_O2, or any combination of these may be faulty. As all three of these possible faults could be life-threatening, the test is quite powerful.^[6]

The first commercially available certified oxygen cell checking device was launched in 2005 by Narked at 90,^[11] but did not achieve commercial success. A much revised model was released in 2007 and won the "Gordon Smith Award" for Innovation at the Diving Equipment Manufacturers Exhibition in Florida.^[13] Narked at 90 Ltd also won the Innovation Award for "an technical diving product that has made diving safer" at EUROTEK.2010 for their Oxygen Cell Checker.[1] Archived 2021-01-23 at the Wayback Machine. The Cell Checker has been used by organisations such as Teledyne, Vandagraph,^{[citation needed]} National Oceanic and Atmospheric Administration,^[11] NURC (NATO Undersea Research Centre),^[11] and Diving Diseases Research Centre.^[11]

A small pressure vessel for hyperbaric testing of cells is also available in which a pressurised oxygen atmosphere of up to 2 bar can be used to check linearity at higher pressures using the electronics of the rebreather.^[14]

• Glossary of fuel cell terms