Reliability of the Gas 

Supply in the Air Force 

Emergency Passenger 

Oxygen System 

Robert P. Garner

Joseph G. Mandella, Jr.

Civil Aerospace Medical Institute

Federal Aviation Administration

Oklahoma City, OK 73125

October 2005

Final Report

DOT/FAA/AM-05/18 

Offi ce of Aerospace Medicine

Washington, DC 20591
NOTICE

This document is disseminated under the sponsorship of

the U.S. Department of Transportation in the interest of

information exchange. The United States Government

assumes no liability for the contents thereof.
i

Technical Report Documentation Page 

1. Report No. 2. Government Accession No. 3. Recipient's Catalog No. 

DOT/FAA/AM-05/18 

4. Title and Subtitle 5. Report Date 

Reliability of the Gas Supply in the Air Force Emergency Passenger Oxygen October 2005 

System 6. Performing Organization Code 

 

7. Author(s) 8. Performing Organization Report No. 

Garner RP, Mandella JG Jr 

9. Performing Organization Name and Address 10. Work Unit No. (TRAIS) 

FAA Civil Aerospace Medical Institute 

P.O. Box 25082 11. Contract or Grant No. 

Oklahoma City, OK 73125 

12. Sponsoring Agency name and Address 13. Type of Report and Period Covered 

Office of Aerospace Medicine 

Federal Aviation Administration 

800 Independence Ave., S.W. 

Washington, DC 20591 14. Sponsoring Agency Code 

15. Supplemental Notes 

 

16. Abstract 

The protective breathing equipment (PBE) procured by the U.S. Air Force as Emergency Passenger Oxygen 

System (EPOS; Fig. 1) was alleged to have significant numbers of inadequate oxygen cylinders. In theory, this 

could prevent the PBE from providing the required time of protection for the user. The Civil Aerospace Medical 

Institute was requested to participate in the testing for the possibility of inadequate oxygen cylinders through the 

U.S. Air Force Office of Special Investigations. To test for any potential leakage and therefore an inadequate 

quantity of oxygen, EPOS units were collected from Air Force bases and submitted by the manufacturer for a 

series of tests. The primary indicator in the testing was the mass (weight) of oxygen in the cylinder. A total of 92 

oxygen cylinders that were manufactured for assembly into EPOS or similar models of PBE were evaluated. 

Estimated dates of manufacture were between January 1989 and November of 2003. Four tests were conducted. 

The first measurement was the oxygen concentration in the vacuum-packaged PBE. The oxygen cylinders were 

then removed from the PBE and any difference between the current cylinder weight and the cylinder weight at 

manufacture was recorded. The cylinders were then exposed to 40,000 feet altitude in a hypobaric chamber for 4 

hours. Weights before and after the chamber exposure were recorded. Finally, the cylinders were emptied of 

oxygen and the empty cylinder weight recorded. Two oxygen cylinders had large oxygen deficits (>11 grams). 

Based on the results of the altitude testing, the loss did not appear to be related to diffusion out of the cylinder. 

Therefore, other explanations need to be examined as to why these two cylinder shortages existed. 

 

17. Key Words 18. Distribution Statement 

 

 

Protective Breathing Equipment, Smoke Hood, 

Emergency Equipment, Oxygen Equipment

Document is available to the public through the 

Defense Technical Information Center, Ft. Belvior, VA 

22060; and the National Technical Information 

Service, Springfield, VA 22161 

19. Security Classif. (of this report) 20. Security Classif. (of this page) 21. No. of Pages 22. Price 

Unclassified Unclassified 12 

Form DOT F 1700.7 (8-72) Reproduction of completed page authorized 

1

RELIABILITY OF THE GAS SUPPLY IN THE AIR FORCE

EMERGENCY PASSENGER OXYGEN SYSTEM

INTRODUCTION

An emergency aboard an aircraft can require individual 

protection from hypoxia, smoke, and fumes. Generally, 

this type of protection can be offered through the availability of protective breathing equipment (PBE), commonly referred to as a “smoke hood.” PBE devices have 

been designed for both aircraft passengers and crew. It 

is recognized that crewmembers require the protection 

offered by PBE to successfully complete their assigned 

tasks in emergency situations. Performance standards for 

crewmember PBE call for specifi c, functional capabilities 

and have been relatively well defi ned (Society of Automotive Engineers Aerospace Standards 8031 and 8047, 

Federal Aviation Administration Technical Standard 

Orders C99 and C116 [7]). Safety benefi ts in providing 

PBE to passengers aboard commercial transport category 

aircraft are a subject of debate (6). Although some guidelines have been created (The European Organization for 

Civil Aviation Equipment, ED-65), no governing body 

currently mandates or regulates “smoke hood” type devices for transport category aircraft passengers. However, 

due to the potential benefi ts of the devices in certain 

circumstances, many private and military organizations 

have made the decision to equip their aircraft with PBE 

for passengers.

The United States Air Force Air Mobility Command 

(AMC) recognized the need for a readily accessible, portable passenger protective system to supply passengers 

with oxygen and protect them from the effects of altitude, 

smoke, and toxic fumes. After an extensive evaluation and 

testing of available devices suited for passenger protection, 

a “smoke hood” type of device was selected. The Essex 

PB&R Corporation manufactures the device. The U. S. 

Air Force calls the device the Emergency Passenger Oxygen System (EPOS). These units contain a single oxygen 

cylinder that is required to provide a supply of oxygen 

to the user. Recently, questions regarding the stability of 

the oxygen cylinder were presented to the Air Force. It 

was hypothesized that the oxygen cylinders leaked and 

that the severity of the leak might be suffi cient to result in 

the EPOS being unable to meet its intended purpose. To 

examine this possibility, the oxygen cylinders from EPOS 

units were collected and tested. The Civil Aerospace Medical Institute (CAMI) was requested to perform the testing 

by the U.S. Air Force Offi ce of Special Investigations.

The devices tested were the Essex VRU provided to 

the Air Force as a Passenger Smoke and Fume Protective 

Device (PSFPD), designated as the EPOS. The purpose 

of the testing was to evaluate the oxygen content in the 

cylinders from units that had been manufactured over 

a representative range of dates. The goal was to address 

a very specifi c EPOS component, the oxygen cylinder. 

Emphasis was placed on possible leakage from these 

cylinders as indicated by the mass (weight) of oxygen 

they contained.

METHODS

A total of 92 cylinders were checked. All of the cylinders 

were of the same design. A representative range of dates of 

manufacturer was desired. To achieve this, the Air Force 

Offi ce of Special Investigations collected two different 

groups of EPOS. The fi rst group totaled 46 cylinders with 

estimated dates of manufacture between January 1999 and 

November 2003. The second group (n=23) of cylinders 

came from units manufactured between August 1996 

and November 1997. The manufacturer provided a third 

group of cylinders. The estimated date of manufacture 

of these PBE (n=8) fell between March 1992 and April 

1993. Older samples of individual cylinders were also 

provided. They totaled seven cylinders from the January 

1989 to the August 1990 timeframe. For each cylinder, 

the following information was recorded: the unit serial 

number, the cylinder bottle number, the production batch 

designation, and the weight at manufacture. Four tests 

related to the potential loss of oxygen from the cylinders 

were conducted.

Test 1. The EPOS units were received in their standard 

vacuum-packaged condition. This process is designed to 

minimize exposure to humidity that might compromise 

the carbon dioxide scrubbers. The fi rst test took a gas 

sample from the units in which the vacuum packaging 

appeared to be intact. A hypodermic needle was attached 

to the sampling line of a mass spectrometer (Perkin-Elmer, Model MGA-1100). The needle was inserted into 

the vacuum packaging, and a 20-30 second sample was 

taken at one sample per second. Cylinders in which the 

vacuum packaging had obviously been compromised 

were excluded.
2

Test 2. The EPOS units were carefully disassembled 

so as not to activate the oxygen release. Each unit and 

cylinder had the aforementioned information recorded. 

Then the cylinder was weighed (in grams) on an electronic 

balance (Ohaus, Model TP4KD). The difference between 

the present cylinder weight and the weight stamped on 

the cylinder at manufacture was calculated.

Test 3. A primary interest serving as the basis of the 

testing was whether or not the cylinders were leaking 

oxygen over time. It was theorized that if this were the 

case and the leakage was based on diffusion, the process 

would be accelerated by altitude exposure. Therefore, the 

cylinders were placed in the CAMI hypobaric research 

chamber and exposed to a simulated altitude of 40,000 

feet for 4 hours. They were weighed after the exposure and 

the pre- and post-fl ight weight difference calculated.

Test 4. The oxygen was released from the cylinder, 

and the cylinder was weighed. The difference in weight 

between the empty cylinder and all previous weight determinations was calculated.

RESULTS

The concept underlying the fi rst test was that leakage 

from the cylinders would increase the oxygen concentration in the vacuum packaging protecting the EPOS. If the 

volume of leakage was large enough, it could potentially 

rupture the packaging. Of the 69 EPOS units collected by 

the Air Force Offi ce of Special Investigations, the vacuum 

seal of four had been compromised. Two of the four had 

obvious signs of intentional alteration. A square hole had 

been cut in one package, and the other had been partially 

opened in a manner consistent with the instructions. The 

other two compromised packages were a bit more suspicious. Both were ruptured along the seam of the packaging. 

This is an area that is probably most susceptible to the 

issues of an increase in pressure. A graph of data representative of the results obtained from testing the other 65 

EPOS is presented in Figure 2. The atmospheric oxygen 

concentration was 20.9±0.1% prior to sampling from the 

package; the oxygen concentration in the package was 

20.9±0.1%, and atmospheric oxygen was 20.9±0.1% after 

sampling from the package. These numbers supported a 

conclusion that no signifi cant amount of oxygen leaked 

out of the cylinders and increased the package internal 

oxygen concentration. This assumes that the packaging 

is impermeable to atmospheric gases.

The differences in the current cylinder weights and 

the cylinder weights at manufacture (expressed in oxygen 

weight) are presented in Figure 3. Weights for all 92 

cylinders are presented in order of increasing production batch designation. At manufacture, the cylinders 

are designed to contain 24.7±0.6 grams of oxygen. Seven 

cylinders, 7.6%, fell outside of the range of two standard 

deviations, assuming the difference represents a loss of 

oxygen. The average and standard deviation of oxygen 

shortage for this subset is 6.8±5.1 grams. Two cylinders 

that were light by 14.4 and 12.8 grams were the major 

contributors to the large variance. These were the same 

two cylinders that had the vacuum packaging ruptured 

along the seams. Four of the seven cylinders that were 

not within manufacturer weight specifi cations were from 

the same production batch-designation.

The altitude test was performed to determine if an 

increased pressure differential led to a loss of oxygen 

from the cylinder. The weight changes are presented in 

Figure 4. Although one bottle lost 0.4 grams of oxygen 

after altitude exposure, the oxygen level of this particular bottle remained within manufacture specifi cations. 

Weight consistency after altitude exposure suggested that 

any oxygen loss from an increased pressure differential was 

functionally non-existent. This conclusion was further 

supported by the fact that the Air Force Offi ce of Special 

Investigations had collected a number of the EPOS that 

had been installed aboard aircraft. The weights of these 

units were no different than the ones yet to be used on 

fl ights.

The difference between the current weight and the 

empty cylinder was considered as the mass of oxygen 

contained in the cylinder. These levels are plotted in 

Figure 5. As anticipated, the differences between the 

weight designation at manufacture and the current weight 

is representative of a low oxygen level. In the cylinders 

that were low, the sum of this difference and the oxygen 

mass measured (23.2±0.2 grams) was below the level that 

the cylinders were supposed to contain at manufacture. 

The two cylinders with the lowest oxygen levels (10.3 

and 11.9 grams) were from production batch designations indicating manufacturing dates between March 

and May of 1997.

DISCUSSION

The reason for these tests was to determine if the EPOS 

had oxygen supply defi cits that would prevent them from 

performing as intended in an emergency situation. In 

general, the results indicated that the large majority of 

cylinders contained a level of oxygen consistent with 

cylinder design specifi cations. Seven of the 92 cylinders 

tested had oxygen levels below what is specifi ed. These 

fi ndings should be considered in functional, statistical, 

and historical terms.

Theoretically, the cylinders are designed to contain 

approximately 17.3 liters of oxygen (~24.7 grams). This 
3

supply is required to provide a viable gas mixture for 

breathing to the user. If 15 minutes is considered as a 

representative time frame, an average of 1.15 liters of 

oxygen per minute would be provided. This volume 

represents a little over three times what a 198-pound 

(90kg) individual would be anticipated to utilize at rest. 

It would be expected to support a work level in the range 

of 80-85 watts. The actual demand placed on the device 

probably would fall between these two extremes. Picking 

the average between these two values results in an oxygen 

consumption level of ~0.73l/min which supports a work 

rate in the range of 50-55 watts. Using this scenario, 

only the most defi cient cylinders (i.e., those containing 

10.3 and 11.9 grams of oxygen) would fail to provide 

15 minutes of breathable gas. The other fi ve would be 

provide 18 minutes or more under this scenario. 

Another approach might be to consider the oxygen 

levels in the context of FAA Technical Standard Order 

(TSO)-C116. For a 90kg individual, the exercise profi le 

outlined could be expected to demand about 19.7 liters 

of oxygen. Thus, the PBE design meeting the TSO has 

two oxygen cylinders. If the fi ndings from these samples 

were projected onto testing of that design, the only combination that would fail due to insuffi cient oxygen would 

be the one that had the two most defi cient bottles built 

into the same hood. Together, those two cylinders would 

supply roughly 78% of the required oxygen. Any other 

combination of cylinders would be anticipated to pass the 

performance criteria for oxygen supply. A single-cylinder 

EPOS is designed to provide 88% of the demand required 

by the TSO. Between 69-81% would be provided by the 

fi ve cylinders that had a reduced oxygen level. The preceding hypothetical analysis demonstrates the disparity 

between a manufacturing specifi cation of a component 

and the overall performance of a device. This relationship makes statistical characterization of the results very 

diffi cult in terms of EPOS performance.

Means of analyzing “one-shot” devices have been established (3, 5). Again, the problem that presents itself 

in this particular case is whether or not the cylinder oxygen levels below specifi cations result in EPOS units that 

functionally fail to meet intended use requirements. If all 

those cylinders are considered hood “failures,” there is no 

way a confi dence level for reliability consistent with the 

mandates of the TSO-116 could functionally be achieved. 

In practice, this holds true even if only the two most 

defi cient oxygen cylinders are considered to represent 

PBE failures. It must be recognized that the mandates 

of TSO-C116 are not the performance criteria required 

by the Air Force.

The Air Force did not specifi cally defi ne the required 

duration of use in the Technical Order that originally 

described the PBE systems that were being considered 

for procurement. They characterized the duration of use 

into heavy, light-to-moderate, and sitting workloads for a 

154-pound (70 kg) individual. The device was designed to 

function for 5, 20, and “up to” 60 minutes, respectively, 

for each of these conditions. Meaningful interpretation 

of these guidelines in light of human variation is diffi cult. 

Working through these durations of use from rest may 

provide some insight. Expected oxygen requirements 

at rest would be 0.245 L/min for a 70kg person. This 

results in duration of use of approximately 70 minutes. 

The defi cient cylinders would provide 29.4, 34.0, 55.5, 

56.9, 61.5, 64.0, and 65.2 minutes of oxygen. Obviously, only the two most defi cient cylinders fall out of 

the designated range. Assuming a heavy workload uses 

all of the oxygen in 5 minutes, the individual would be 

using 3.5 L/min. This would require oxygen utilization at 

approximately 50 ml/kg/min. That is about 14 times the 

resting metabolic rate and a power output of 250 watts. 

A 20-minute duration allots 0.865 L/min. This projects 

to an oxygen utilization of 12 ml/kg/min or about 3.5 

times the resting demand representing a power output 

of 60-65 watts. These are reasonable workloads, but each 

level calculated represents a number of assumptions, 

though valid, may or may not be applicable. Without 

more defi nitive performance specifi cations, defi nitive 

characterization of the manufacture specifi cation for the 

cylinders is not possible.

From a historical perspective, protective breathing 

equipment of this general design has been in use for at 

least 15 years. The devices have been tested with human 

subjects in terms of performance at low altitudes (4), evacuation from aircraft (8), and in comparison with other PBE 

designs (9). Oxygen levels have been specifi cally monitored 

in more recent tests related to the performance of the EPOS 

(1) and EPOS improvements (2). There is no indication 

in the reports involving human subjects that the PBE had 

to be doffed as a result of lack of oxygen. Similarly, no 

oxygen defi ciency was observed in performance testing. 

Database searches of aviation-related literature did not 

identify any reports of crewmember PBE failures related 

to oxygen want. This accumulated information related to 

the general design of the EPOS suggests that it is a reliable 

piece of equipment. That does not mean that the large 

oxygen shortage observed in two of the cylinders should 

not be addressed and remedied.

Maybe the most important question to be considered 

is “Why did the cylinders have low amounts of oxygen?” 

The data collected do not indicate a systematic leakage 

either with time or increased pressure differential. The 

defi cient cylinders were simply low. Although circumstantial evidence of the packaging being torn could indicate 
4

leakage from the cylinder, the conditions that stopped 

the process during altitude testing are hard to imagine. 

The simplest explanation would appear to be that the 

cylinders were not adequately fi lled during manufacture. 

This could be a function of manufacturing processes, 

component cleaning, or other quality control issues. 

These and any other possible explanations need to be 

investigated if they have not already been accomplished. 

The cylinders with the largest oxygen defi ciencies were 

manufactured in 1997. The possibility exists that the 

reasons underlying the defi ciency have been identifi ed 

and addressed in terms of specifi c remedial action. The 

potential reduction in oxygen represented by the worstcase cylinders would represent a signifi cant reduction in 

the duration of protection for the user.

SUMMARY AND CONCLUSIONS

Data collected from cylinders representative of the oxygen supply built into Air Force EPOS protective breathing equipment did not indicate any type of systematic 

leakage. However, some cylinders (7, 7.6% of the total) 

had oxygen levels below the design specifi cation. For fi ve 

of this group that were only slightly below the required 

oxygen level, it is not defi nitive whether the defi ciency 

would represent a meaningful change in the performance 

characteristics specifi ed by the Air Force for the device. 

The other two have to be considered a limitation to the 

functional capabilities of the EPOS. Steps should be taken 

to identify why the cylinders were defi cient and defi nitive 

steps taken to correct the problem. 

REFERENCES

1. Garner RP, Murphy RE, Donnelly SS, Thompson 

KE, Geiwitz KL. Testing the structural integrity of 

the Air Force’s emergency passenger oxygen system 

at altitude. Offi ce of Aviation Medicine Report, 

DOT/FAA/AM-00/6. February 2000. 1

2. Garner RP, Utechtt JS. Performance criteria for 

development of extended use protective breathing 

equipment. 2003 SAFE Symposium Proceedings.

3. John PWM. Statistical Methods in Engineering and 

Quality Assurance. Indianapolis, Indiana: Wiley, 

1990.

4. Schlegel TT, Higgins EA, McLean GA, Lyne PJ, 

England, HM, Attocknie PA. Comparison of 

protective breathing equipment performance at 

ground level and 8,000 feet altitude using parameters prescribed by portions of FAA action notice 

A-8150.2. FAA Offi ce of Aviation Medicine Report 

DOT/FAA/AM-89/10. June 1989. 1

5. Sherwin ER. Analysis of “one-shot” devices. 

Selected topics in assurance related technologies, DoD Reliablility Analysis-Center. Accessed 

from the Internet on 05/02/2005 at URL: 

http://rac.alionscience.com/rac/jsp/webdocs/

racdocRpt.jsp?44286-003

6. Speitel L, Hill RG. Study of benefi ts of passenger 

protective breathing equipment from analysis 

of past accidents. FAA Technical Center Report 

DOT/FAA/CT-88/03. March 1988.

7. Technical Standard Order (TSO)-C116. Crewmember protective breathing equipment. Federal 

Aviation Administration. Aircraft Certifi cation 

Service, Washington, DC. March 1990.

8. McLean GA, Higgins EA, Lyne PJ. The effects of 

wearing passenger protective breathing equipment 

on evacuation times through type III and type IV 

emergency aircraft exits in clear air and smoke. FAA 

Offi ce of Aviation Medicine Report DOT/FAA/

AM-89/10. November 1989. 1

9. Wilcox B, McLean GA, England HM. Comparison of 

portable crewmember protective breathing equipment 

(CPBE) designs. FAA Offi ce of Aviation Medicine 

Report DOT/FAA/AM-93/6. April 1993. 1

1

This publication and all Offi ce of Aerospace Medicine technical 

reports are available in full-text from the Civil Aerospace Medical 

Institute’s publications Web site: www.faa.gov/library/reports/medical/

oamtechreports/index.cfm
5

FIGURES

Figure 1. The Emergency Passenger Oxygen System 

evaluated in this study. The unit contains a single oxygen 

cylinder (not visible) that is normally opened to the interior of 

the unit when taken from the packaging for donning.
6

Figure 2. Sampling of gases within the EPOS packaging. This is a representative trial from Test 1. The dark 

line is a voltage signal use to delineate the sampling period (left y-axis). The light gray boxes are the sample 

collection periods used for comparison. The circles are the oxygen concentration (right y-axis). 
7

Figure 3. Differences in weight observed between weight at manufacture and the current weight. The production 

batch number (x-axis) is roughly equivalent to the date of cylinder manufacture. Values listed on the cylinders 

for weight at manufacture appear to be representative batch weights, not the actual measured weight of each 

individual cylinder.
8

Figure 4. Weight changes resulting from a 40,000-foot altitude exposure. No meaningful weight change 

was observed as a result of altitude exposure. Again, cylinders are listed by increasing production batch 

designation.
9

Figure 5. Mass of oxygen contained within the cylinders. The majority of defi ciencies are clustered around 

production batch numbers and a time frame of assembly in 1997.