ote technical note technic

a A Description and Analysis of the FAA 

Onboard Oxygen Analysis System 

Michael Burns 

William M. Cavage 

July 2003 

DOT/FAA/AR-TN03/52 

This document is available to the public through the National Technical 

Information Service (NTIS), Springfield, Virginia 22161. 

U.S. Department of Transportation 

Federal Aviation Administration
NOTICE 

This document is disseminated under the sponsorship of the U.S. 

Department of Transportation in the interest of information exchange. The 

United States Government assumes no liability for the contents or use 

thereof. The United States Government does not endorse products or 

manufacturers. Trade or manufacturer's names appear herein solely 

because they are considered essential to the objective of this report. This 

document does not constitute FAA certification policy. Consult your local 

FAA aircraft certification office as to its use. 

This report is available at the Federal Aviation Administration William J. 

Hughes Technical Center’s Full-Text Technical Reports page: 

actlibrary.tc.faa.gov in Adobe Acrobat portable document format (PDF). 
Technical Report Documentation Page 

1. Report No.

DOT/FAA/AR-TN03/52 

2. Government Accession No. 3. Recipient's Catalog No.

4. Title and Subtitle

A DESCRIPTION AND ANALYSIS OF THE FAA ONBOARD OXYGEN 

5. Report Date

July 2003 

ANALYSIS SYSTEM 6. Performing Organization Code

AAR-440 

7. Author(s)

Michael Burns and William M. Cavage 

8. Performing Organization Report No.

9. Performing Organization Name and Address

Federal Aviation Administration 

William J. Hughes Technical Center 

Airport and Aircraft Safety 

10. Work Unit No. (TRAIS)

Research and Development Division 

Fire Safety Branch 

Atlantic City International Airport, NJ 08405 

11. Contract or Grant No.

12. Sponsoring Agency Name and Address

U.S. Department of Transportation 

Federal Aviation Administration 

13. Type of Report and Period Covered

Technical Note 

Office of Aviation Research 

Washington, DC 20591 

14. Sponsoring Agency Code

ANM-110 

15. Supplementary Notes

16. Abstract

The Federal Aviation Administration (FAA) is planning a series of ground and flight tests with Airbus to prove the concept of a

simplified fuel tank inerting system, which has been developed by the FAA. The FAA has also developed an onboard oxygen 

analysis system to measure the oxygen concentration in the aircraft fuel tank during the testing. To help ensure smooth integration 

and the safety of the testing, the FAA has documented the system description, interfaces, operation, and has performed a failure 

mode effects criticality analysis. This analysis attempts to identify the failure modes of each system component and assess the 

effects of these failures on the component, system, and aircraft. The analysis also applies a hazard category to each hazard as well 

as some hazard probability when it was deemed necessary by the author. Hazard controls are also listed. 

All relevant system information has been summarized to allow for the system to be properly integrated into the proposed flight test 

aircraft. The results of the analysis indicated that most failure modes had no effect on the aircraft or other secondary systems. The 

few hazards with potential aircraft effects have significant controls in place to reduce the likelihood of the hazard and mitigate any 

potential hazard exposure. 

17. Key Words

Interface, Oxygen analysis, Failure modes, Controls, System, 

FMECA 

18. Distribution Statement

This document is available to the public through the National 

Technical Information Service (NTIS), Springfield, Virginia 

22161.

19. Security Classif. (of this report)

Unclassified 

20. Security Classif. (of this page)

Unclassified 

21. No. of Pages

28 

22. Price

Form DOT F1700.7 (8-72) Reproduction of completed page authorized 
TABLE OF CONTENTS 

Page 

BACKGROUND 1

SYSTEM DESCRIPTION 1 

System Overview 1 

Sample Train Flow 2 

System Safety Features 3 

SYSTEM INTERFACE 3 

Power Requirements 3 

Physical Interface 4 

Rack Mounting 4 

Plumbing Connections 5 

Power Connections 6 

Signal Connections 6 

Signal Characteristics 6 

Instrument Settings 6 

SYSTEM OPERATION 7 

FAILURE MODE EFFECTS CRITICALITY ANALYSIS 8 

Hazard Severity 9 

Hazard Probability 9 

Hazard Status 9 

CONCLUSIONS AND RECOMMENDATIONS 10 

REFERENCES 10

APPENDICES 

 A—Parts List 

B—Onboard Oxygen Analysis System Wiring Diagram

C—Power Requirements for Onboard Oxygen Analysis System

D—Signal Connector Pin Designations 

iii
E—Onboard Oxygen Analysis System Operatrional Procedures 

F—Failure Mode Effects Criticality Analysis Hazard Listing for Onboard Oxygen 

Analysis System

G—Description and Analysis of Lab-Based Oxygen Analysis System for Use With Flight 

Test Inert Gas Generator 

LIST OF FIGURES 

Figure Page 

1 System Block Diagram 2 

2 Photo of OBOAS 1 and 2 Mounted in Two 19′′ Flight Test Racks 4 

3 Rear Interface Panel on OBUSS 5 

4 Inlet and Outlet Pressure Controller Power Supplies 7 

LIST OF TABLES 

Table Page 

1 Frequency Converter Power Connector Pin Designation Table 6 

2 Table of Hazard Severity Definitions 9 

iv
BACKGROUND

The Federal Aviation Administration (FAA) is planning a series of ground and flight tests with 

Airbus to prove the concept of a simplified fuel tank inerting system developed by the FAA. To 

determine the effectiveness of the inerting system, the oxygen concentration will be measured at 

eight locations in the fuel tank, utilizing two 4-channel sample trains with in-line oxygen 

analyzers. The onboard oxygen analysis system (OBOAS) design is based on sound principals 

and engineering practices. This system is essentially the same system employed on previous 

flight tests with the Boeing Company to examine the concept of ground-based inerting. To allow 

for the smooth installation and operation of the system on the Airbus flight test aircraft, it is 

critical to document how the system works, how to interface with the system, and how to operate 

the system. It is also critical to document known failure modes of the OBOAS to better allow 

the owner/operator of the flight test aircraft to assess the risk of installing and operating the 

system on the aircraft. This report documents how the OBOAS operates, details the system

interfaces, explains system operation, and gives a system-level failure mode effects criticality 

analysis (FMECA). 

FMECA is a tool used to gage the reliability of a system. It can be structured to a safety 

outcome and used by a stakeholder, alone or with other analysis, to assess risk [1]. This type of 

analysis entails listing all components of a system with all known failure modes of that 

component (i.e., valve fails to open, or meter indicates incorrectly) with any known failure 

causes. With each failure mode, the effects of the hazard are listed for the component, the 

analyzed system, and the aircraft. In addition to failure effects, the hazard criticality is also 

assessed for each failure in terms of the hazard severity and probability. Hazard severity is 

generally assessed by categories (i.e., Cat 1-Catastrophic or Cat 2-Critcial), which are defined 

for each analysis. Hazard probability is based upon the best reliability data available from the 

component manufacturers. The analysis will also list hazard controls. Controls are mechanisms, 

physical or otherwise, that are in place in the system to prevent or mitigate the hazard. Any 

hazard comments are also listed in the analysis. 

SYSTEM DESCRIPTION

SYSTEM OVERVIEW. 

The OBOAS consists of a regulated sample train with flow through in-line oxygen sensors and 

ancillary equipment, comprised of two identical four-channel systems. Each four-channel 

system was self-contained in a standard 19-inch half rack designed to meet the airworthiness 

requirements of Title 14 Code of Federal Regulations (CFR) Part 25. Each system has four 

independent sample trains that can draw an ullage sample from four different locations in the 

fuel tank, regulate the sample pressure, expose the sample to the oxygen sensor, and redeposit 

the sample back into the fuel tank. Each oxygen sensor has a companion analyzer mounted on 

the same 19-inch rack. Also mounted on each rack was a four-channel inlet pressure controller 

and a single-outlet pressure controller electronic unit. These electronic units support the five 

pressure regulator/controllers in each four-channel system. 

1
The system has the option of sampling from a calibration port, which could be supplied with air 

or a calibration gas of choice, and bypassing the tank return, thereby not contaminating the 

ullage space with the calibration gas. Each sample train channel has two selectable inputs to 

allow each channel to sample from two different locations. Each analyzer has a 4 to 20-mA

output and a 0 to 10-volt output. The pressure regulator/controller electronic units also have a 

scaled voltage output to read unit-regulated pressure. These signals will be passed to the aircraft

data acquisition system (DAS) for collection with other test data to assist in OBOAS data/health 

management. Figure 1 shows a block diagram illustrating the primary components of the 

measurement system, with the sample flow path, signal, and power flow highlighted. The 

numbered components are listed in appendix A with the name and model of the part, the 

manufacturer, and the part number. For completeness, a wiring diagram is given in appendix B. 

Containment Box 

Return to Fuel 

Tank 

To Aircraft 

Exterior 

Fuel Tank Vapor 

Fuel Tank Liquid 

Pressurized Air 

Electrical Power 

Electronic Signals 

FIGURE 1. SYSTEM BLOCK DIAGRAM 

SAMPLE TRAIN FLOW. 

Each individual sample train consists of a complex, regulated flow path, with ancillary 

equipment designed to expose each oxygen sensor to the required constant sample conditions. 

2
The sample is drafted from the fuel tank via a previously installed sample line. The sample 

enters the OBOAS through a selector valve, which allows selection of the input connector, 

system exposure to the calibration gas, or channel shutoff. The sample passes through a flash 

arrestor and a fluid trap that contains a float shutoff valve. The sample passes through an active 

pressure regulator/controller, which actively controls the inlet sample pressure to a vacuum

pressure below the lowest expected atmospheric pressure in the fuel tank (around 2.9 psia). The 

sample is pumped to a pressure just above ambient sea level pressure (14.7 psia) in two stages 

with a diaphragm pump. The sample passes through a coalescing filter and a needle valve, 

where the initial flow conditions are set before each test, and through a flow meter that gives the 

sample flow rate. The sample passes through the oxygen sensor and through a check valve. The 

four sample trains in each system are ganged to a single outlet where they pass through the outlet 

pressure controller, another flash arrestor, and through a bypass valve back to the fuel tank. This 

bypass valve allows the sample to be sent to an outflow valve instead of back into the fuel tank 

or be redirected into any single-channel input. This feature was developed to allow the systems 

own pump pressure to free a stuck float valve during a test while having virtually no impact on 

the other three channels’ data. The outlet pressure controller actively controls the outlet flow 

pressure back to the tank to give a sample pressure just above sea level, keeping a constant 

pressure between the diaphragm pump and the outlet controller. 

SYSTEM SAFETY FEATURES. 

Each four-channel sample train is contained in an onboard ullage sampling system (OBUSS) box 

that minimizes exposure of the operator and crew to hazardous vapors in the event of a leak in 

the sample train. The sampling lines are constructed of PFA tubing with Swagelok®

connections. The OBUSS contains an air-supplied ejector that requires a minimum of 3 SCFM 

of compressed air at 40 psi or greater. This ejector maintains constant negative pressure on the 

inlet, drafting a volume of air from the inside of the OBUSS, to purge the box to prevent buildup 

of any hazardous vapors. This also prevents the escape of hazardous vapors from the OBUSS 

into the aircraft cabin. The ejector inlet is plumbed through a flow indictor that allows the 

operator to determine if purge flow is functional at any point in time. Each sample train has a 

fluid trap/float shutoff valve and a coalescing filter. These prevent fuel, fuel vapor, 

condensation, and water vapor from contaminating the sample train or damaging the in-line 

oxygen sensor. Each four-channel system has one 8-head diaphragm pump (two heads per 

channel), which supplies the displacement required to move the sample through the sample train 

at all fuel tank altitudes and temperatures. All electrical components indigenous to the OBUSS 

are mounted exterior to the containment box. This allows for the separation of potentially 

hazardous vapors in the containment box with a potential arc or spark from a faulty electrical 

circuit. 

SYSTEM INTERFACE

POWER REQUIREMENTS. 

The OBOAS consists of several laboratory instruments used to perform the function described in 

the previous section. This equipment is powered by standard North American household power, 

consisting of 115 Vac at 60 Hz. To allow for operation on an aircraft, each four-channel 

OBOAS uses a 3.5-kVA power frequency converter. Each converter accepts 115 Vac at 400 Hz 

(standard aircraft ac power) and creates the appropriate power. Each converter will require a 

3
115 Vac three-phase power connection with a total capability of 30 amps. Each phase leg is 

capable of 13 amps. It is possible to provide only 25 amps of total power to the converter, 

provided the circuit breaker has overshoot capability to allow for a brief surge in power to start 

the system motor. The minimum overshoot capability needed to start the system is 

approximately 40 amps for 0.5 second. This number is based on preliminary laboratory testing 

and will be validated during ground testing. Appendix C gives the power required for all 

equipment for a single, four-channel OBOAS. 

PHYSICAL INTERFACE. 

Four primary interfaces exist between the OBOAS and the aircraft: the rack mounting to the 

aircraft, the gas sample and additional supply plumbing connections to the OBOAS interface 

panel, the aircraft power connections to the converters, and the signal connections to the aircraft 

DAS. 

RACK MOUNTING. Each OBOAS is mounted in an industry standard flight test (14 CFR Part 

25 certifiable data) 19′′ instrumentation rack that is approximately 48′′ tall (see figure 2). Two 

OBOASs mount together in a dual-rack configuration to a single 0.040′′ thick aluminum plate 

with four large pieces of 1′′ aluminum angle attached with fasteners to both the plate and racks. 

This aluminum plate mounts on a track-mating fixture designed to integrate with standard large 

commercial transport seat tracks for the purpose of attaching instrumentation racks into flight 

test aircraft. No engineering data is available for specification of the track-mating fixture. The 

aluminum plate attaches with pinch plates at the front and back of the plate that is held down 

with 3/8′′ aircraft-quality bolts. 

FIGURE 2. PHOTO OF OBOAS 1 AND 2 MOUNTED IN TWO 19′′ FLIGHT TEST RACKS 

4
PLUMBING CONNECTIONS. The gas sample lines integrate with the OBOAS via the rear 

interface panel on the sample system (OBUSS), shown in figure 3. Each channel has two inputs 

(A and B), which correspond to the input selector on the front panel of the OBOAS. Each 

sample tube mates to the interface panel via a 1/4′′ female Swagelok fitting. The sample return 

line also interfaces on the same panel with a 1/4′′ female Swagelok fitting. 

A 

B 

FIGURE 3. REAR INTERFACE PANEL ON OBUSS 

A calibration gas can be plumbed to the system via the rear interface panel. This allows for 

calibration/validation of the system after system warmup and before the start of testing. The 

calibration gas tube mates to the interface panel via a 1/4′′ female Swagelok fitting. The 

pressure of the calibration gas source should be set to below 10 psig to ensure proper operation 

of the inlet pressure regulators during calibration. A nominal 5 psig supply pressure regulator 

setting is recommended for the calibration gas supply. 

The purge air line is also connected to the OBUSS via the rear interface panel. The line mates to 

the interface panel via a 1/4′′ female Swagelok fitting. The purging ejector requires air supplied 

at 40 psig, giving an ejector inlet flow of 3 CFM. This inspires 3 CFM of purge air out of the 

sample system containment box, giving a total purge air dump flow of 6 CFM per OBOAS. The 

OBUSS should be purged while the sample pump is running. The ejector supply air may be 

shutoff above altitudes of approximately 25,000 feet, where the purge air dump will supply 

sufficient vacuum pressure to purge the box adequately. The purge air dump line mates to the 

system rear interface of each OBUSS with a 1/2′′ female Swagelok fitting. This fitting can be 

mated to an appropriate mating fixture in a dummy window to allow the OBUSS to vent the 

exterior of the aircraft. 

Note all references to the 1/4′′ or 1/2′′ female Swagelok fittings refer to the Swagelok Company 

compression fittings that accept 1/4′′ or 1/2′′ outer diameter tubing. 

5
POWER CONNECTIONS. Aircraft power is supplied to each OBOAS by supplying threephase 115 Vac power to the accompanying power frequency converter. An MS3106F18-11S 

cannon plug with five large solder-on pins, each capable of carrying 13 amps of 115 Vac power, 

was used to apply power to the converter. Table 1 gives the connector pin designations. 

TABLE 1. FREQUENCY CONVERTER POWER CONNECTOR PIN 

DESIGNATION TABLE 

Pin Label Description 

1 115 Vac 400 Hz, phase A 

2 115 Vac 400 Hz, phase B 

3 115 Vac 400 Hz, phase C 

4 Neutral

SIGNAL CONNECTIONS. The signals from the OBOAS oxygen analyzers are supplied to 

aircraft DAS through a cannon plug with mating connector type MS3126F14-19S. In addition, 

the output from the pressure regulator electronic units can also be collected by the DAS to 

monitor system health and data quality. This also mates with the aircraft DAS through the same

type of mating connector. The pin designations for those connectors are given in appendix D.

SIGNAL CHARACTERISTICS. 

All OBOAS signals are linear voltage outputs corresponding to the instrument range. 

The oxygen analyzers have a 0 to 10-volt output that corresponds to 0 to 25 percent oxygen. 

This gives a slope of 2.5% oxygen/volt with an intercept of 0. For the 100% oxygen analyzer 

being used to measure the system permeate gas, the 0 to 10-volt output corresponds to 0 to 100 

percent oxygen giving a slope of 10% oxygen/volt with an intercept of 0. 

The inlet pressure controllers have a 0 to 1-volt output that corresponds to 0 to 500 torr. This 

gives a slope of 0.5 torr/mvolt with an intercept of 0. For the outlet pressure controllers being 

used, the 0 to 1-volt output corresponds to 0 to 1000 torr, giving a slope of 1 torr/mvolt with an 

intercept of 0. 

INSTRUMENT SETTINGS. 

Each oxygen analyzer has been set to have a fixed-scale output, as described in the signal 

characteristics section. To obtain these signal characteristics, the analyzer output range must be 

set to “HI” and the analysis range must be set to 0% to 25% oxygen. This is achieved by 

selecting both the “Set High Range” and the “Set Low Range” buttons simultaneously and using 

the arrows to select HI. To correctly set the high and low range, select the Set High Range or Set 

Low Range button and use the up and down arrows to set the low range to 0 and the high range 

to 25. 

6
The pressure regulator settings have been set to achieve maximum system efficiency for the 

proposed flight testing pressure range. These settings call for all channel inlet pressures to be set 

to 150 torr and the outlet pressure regulator for each OBOAS to be set to 840 torr. The inlet 

pressure for each channel is changed by selecting the correct channel from the channel display 

selector switch on the inlet pressure controller power supply, and then using the adjustment 

screw corresponding to that channel to change the pressure, which will be indicated on the 

readout panel. Note: You must hold the Set Pt. switch in the up position while turning the 

adjustment screw to observe the change in inlet pressure setting. To adjust the outlet pressure 

regulator setting, simply turn the Set Pt. knob on the front panel of the outlet pressure regulator 

power supply to indicate the desired pressure in torr. Figure 4 shows the inlet and outlet 

pressure controller power supplies. 

FIGURE 4. INLET AND OUTLET PRESSURE CONTROLLER POWER SUPPLIES 

SYSTEM OPERATION

The OBOAS is designed to run with no human interaction. The system will arrive at the test 

facility with all instruments set to the correct values for the proposed flight test scenario. These 

values will be validated during ground testing, and initial flight testing if necessary, to ensure 

valid, accurate data throughout the flight test program. The primary function of the system is to 

measure the oxygen concentration of the gas it is sampling. This is accomplished by turning the 

system on, allowing the system to warmup, and then calibrating the system. The system can then 

be used to measure the oxygen concentration in the fuel tank. 

To turn the system on, all electronics must be on and all pressure regulators must be on and set to 

the flow position. Be sure the input selector is set to the auxiliary input port and sample return 

selector is set for sample dump. To start a single OBOAS, simply turn on the switch 

corresponding to the correct OBOAS motor. Check to ensure that all sample train pressures are 

being regulated to the desired value. 

To calibrate the system, wait 2 hours for the system to adequately warmup and stabilize. Allow 

the system to sample from the open port (cabin air) and wait for the reading to stabilize. Select 

range from the oxygen analyzer and adjust the display to read 20.9. To validate the calibration, 

attach a calibration gas to the calibration port on the rear interface of the OBUSS. Select 

calibration from the input selector valve and be sure the sample return selector valve is set 

sample dump. Allow the system to stabilize and check to be sure that the measured value is 

consistent with the ticket on the calibration gas bottle. All readings are considered valid if

7
within ±0.1 percent oxygen. It has been observed in the lab that readings of oxygen 

concentration in air can differ by 0.2-0.3 percent oxygen from the expected value of 20.9 with no 

adverse effect on the system accuracy. 

To measure the oxygen concentration in the fuel tank, simply select the primary sample port on 

the input selector valve and turn the return selector valve to return to tank. If the power to the 

OBOAS converters should be removed for any reason during warmup, calibration, or testing (kill 

switch), the system pumps must be taken off-line before power is applied again. After system

electrical power is restored, the pumps can be turned on and the system can continue to operate 

after an adequate stabilization period. 

The system has the capability to dislodge a stuck fuel tank sample line float valve by back 

purging the input of the clogged sample line in question with the system outflow. This is 

accomplished by turning both the input selector and pressure controller off corresponding to the 

stuck float valve and selecting that channel number on the back purge selector valve. Next, 

select sample line purge on the sample return selector for a short period of time to ensure 

pressurization of the sample line. Return the sample return selector to the original position. 

Turn the selector valve to the primary sample port and turn on the channel regulator. The 

channel sample flow should return to normal. 

Appendix E gives a detailed list for the above-mentioned system operational procedures. 

FAILURE MODE EFFECTS CRITICALITY ANALYSIS

The FMECA was performed for the system as defined in the system diagram (see figure 1). The 

FMECA identifies all critical components of the system and attempts to identify all failure 

modes associated with the operation or incorrect operation of each component during normal 

system operation. All listed component, system, and aircraft effects are based on worst credible 

case scenario, as seen by the analyst. It is important to note that aircraft effects are based on the 

author’s aviation knowledge and engineering experience but only the aircraft operator/end user 

can truly assess and quantify the ultimate aircraft effect. Failure modes are listed, with hazard 

data compiled, in appendix F. 

For time’s sake, the FMECA only considers the in-flight phase of operation with a near-full 

center wing tank because it was deemed most safety critical. If an identified failure mode has a 

worse-case hazard category or probability during other phases of operation (i.e., parked/ground 

taxi), it will be noted in the analysis comments, and due to the limited time and scope of the 

analysis, failure mode causes will be given in general terms. 

A tertiary analysis was performed to determine the equivalent level of safety an oxygen analysis 

system would need to measure the oxygen concentration of an inert gas generator during a flight 

test. Appendix G addresses this question. 

8
HAZARD SEVERITY. 

Table 2 lists the hazard category definitions used for the analysis. These are based on standard 

categories developed for system safety analysis in Mil-Std 882C. When a hazard has multiple 

possible scenarios with a different possible resulting severity, the worst credible case severity 

(with I being the worst) is used as the hazard severity regardless of the assessed probability. 

All hazard data given is for the single failure listed, in terms of the analyzed system. 

TABLE 2. TABLE OF HAZARD SEVERITY DEFINITIONS 

Code Hazard Category Description

I Catastrophic Results in failure of the system or death or critical injury 

to operator or nearby personnel 

II Critical Results in major system damage or degraded system

operation/severe injury to operator or nearby personnel 

III Marginal Results in minor system damage or undesirable system

operation/minor injury to operator or nearby personnel 

IV Negligible Results in negligible system damage or injury to 

operator or nearby personnel 

HAZARD PROBABILITY. 

Probabilities will be assigned to specific hazards identified by the end user. These will be 

hazards with potentially critical or catastrophic effects on the aircraft. Individual hazard 

probabilities will be assessed as deemed necessary with the best engineering and reliability data 

available. 

HAZARD STATUS. 

The following definitions apply to hazard status categories 

• Open—Hazard needs to be addressed by end user immediately 

• Monitor—Hazard needs further review by end user before testing 

• Closed—Hazard requires no further review 

Only hazards with potentially critical or catastrophic effects on the aircraft will be left in monitor 

or open status. All other hazards will be closed. Any hazards with an open or monitor status 

should be closed, by consensus, at the test readiness review. 

9
CONCLUSIONS AND RECOMMENDATIONS

All hazards have been controlled to the satisfaction of the system developer/operator. All 

hazards having significant potential aircraft effects have adequate controls in place to ensure 

safety of operation, given the limited exposure of the measurement system to the flight test 

environment. 

REFERENCES

1. Roland, Harold E. and Moriarty, Brian, “System Safety Engineering and Management,” 

Wiley Press, 1990. 

10
APPENDIX A—PARTS LIST 

Entry 

Number Part Name Manufacturer Part Number 

1 1/4′′ NPT female Drain Trap (21.66 

cubic in.) 

Spirax Sarco, Inc. FA-150 

2 1/4′′ Calibration Selector Valve Swagelok Inc. --------- 

3 1/4′′ NPT female Flash Arrestor 

(Inlet) 

Matheson 6104

4 1/4′′ Tube Absolute Pressure 

Controller (inlet) 

MKS Instruments, Inc. 640A52TS1V32V 

Pressure Controller Power 

Supply/Readout 

MKS Instruments, Inc. 246C 

5 3/8′′ NPT female 8 Head Pump Air Dimensions Inc. 01780TS 

6 1/4′′ NPT female Coalescing Filter Parker Filtration 14RL/08UK 

7 Needle Valve Swagelok Inc. --------- 

8 1/4′′ NPT female 0.5-5.0 SCFH 

Flowmeter 

Dwyer Instruments RMB-49 

9 1/4′′ Inlet SS Sensor Housing Teledyne Analytical, Inc. Cell Block Assy 

10* Model 3290 Oxygen Analyzer Teledyne Analytical, Inc. M64643 

11 Check Valve

12 1/4′′ Tube Absolute Pressure 

Controller (outlet) 

MKS Instruments, Inc. 640A13TS1V42V 

Pressure Controller Power 

Supply/Readout 

MKS Instruments, Inc. 247D 

13 1/4′′ NPT female Flash Arrestor 

(Outlet) 

Matheson 6104

14 1/4′′ Bypass Selector Valve Swagelok Inc. --------- 

15 Swagelok Bulkhead Connection Generic

16* 1/4′′ Nylon 11 Tubing McMaster-Carr 5548k44

17* 1/4′′ 316 SS Tubing McMaster-Carr 89785k23

18 Sonic Venturi Ejector (0.060′′

orifice) 

Fox Valve Corp. 61121060 

19 Fluid Drain Swagelok Inc. --------- 

20 760 ae Shunt Diode Safety Barrier MTL 

21* RF-2500 Flow Indicator GEMS Sensor 155480 

22* Cannon Plug Generic

23* Power Chord Generic

24* Wire Harness Generic

*Items not labeled in figure 1. 

A-1/A-2
APPENDIX B—ONBOARD OXYGEN ANALYSIS SYSTEM WIRING DIAGRAM 

B-1/B-2
B-3/B-4 
APPENDIX C—POWER REQUIREMENTS FOR ONBOARD OXYGEN 

ANALYSIS SYSTEM 

Item Power

Pump Motor 12.0 amps 

4-Channel Pressure Controller Unit 0.65 amp 

Single-Channel Pressure Controller Unit 0.61 amp 

4-Channel Oxygen Analyzer (4 @ 0.3 amp) 1.2 amps 

--------------

Total = 14.5 amps 

Two 4-Channel Systems Require 2 * 14.5 amps - 29.0 amps 

• Pump Motors (2) – CL5009A Baldor Motor

HP: 1 Thermal Protection: Auto 

RPM: 3450 Class I, Group D 

Voltage: 115 Vac Class II, Group F & G, T4 

Amps: 12 U.L. & C.S.A. 

Hertz: 60 

Phase: 1 

• Oxygen Analyzers (8) - Teledyne Model 3290 

Power Requirements: 

Voltage: 115 Vac 

Frequency: 60 Hz 

Amps: 0.3 amp 

Signal output: 0-10 Vdc 

• Inlet Pressure Controller Read Out (2) - Model 247D

Power Requirements for the 247D unit are: 

Voltage: 115 Vac 

Hertz: 60 

19 VA (with no pressure controllers attached) 

10 VA for each pressure controller attached (4) 

Additional 15VA for start-up 

Total VA = 19+40+15 = 74 VA 

Current = 0.6435 amp 

Signal output: 0-1Vdc (for all 4 channels) 

• Outlet Pressure Controller Read Out (2) - Model 246C 

Power Requirements for the 246C unit are: 

Voltage: 115 Vac 

Hertz: 60 

70 VA (maximum) 

Current = 0.6087 amps 

Signal output: 0-1Vdc

C-1/C-2 
APPENDIX D—SIGNAL CONNECTOR PIN DESIGNATIONS 

Oxygen Analyzer Connector 

Analyzer Channel Description Pin 

Oxygen Signal Channel # 1 - Signal Voltage A 

+ Signal Voltage B 

Shield C

Oxygen Signal Channel # 2 - Signal Voltage D 

+ Signal Voltage E 

Shield F

Oxygen Signal Channel # 3 - Signal Voltage G 

+ Signal Voltage H 

Shield J

Oxygen Signal Channel # 4 - Signal Voltage K 

+ Signal Voltage L 

Shield M

OPEN N

OPEN P

OPEN R

OPEN S

OPEN T

OPEN U

OPEN V

Pressure Regulator Connector 

Analyzer Channel Description Pin 

1-4 Return Pressure - Signal Voltage A 

+ Signal Voltage B 

Shield C

OPEN D

OPEN E

OPEN F

Inlet Pressure Channel #1 - Signal Voltage G 

+ Signal Voltage H 

Shield J

Inlet Pressure Channel #2 - Signal Voltage K 

+ Signal Voltage L 

Shield M

Inlet Pressure Channel #3 - Signal Voltage N 

+ Signal Voltage P 

Shield R

Inlet Pressure Channel #4 - Signal Voltage S 

+ Signal Voltage T 

Shield U

OPEN V

D-1/D-2
APPENDIX E—ONBOARD OXYGEN ANALYSIS SYSTEM OPERATIONAL 

PROCEDURES 

OBOAS START-UP PROCEDURES 

1. Ensure Power Transfer Switches (4) on rear of OBOAS are set to OFF 

2. Ensure all instrumentation units are OFF 

3. Ensure Unitron’s #1/#2 are set to OFF 

4. Perform visual inspection of all electrical connectors for proper security 

5. Provide Aircraft Power to Unitron’s #1/#2 (115 Vac/400 Hz/3 Phase) 

6. Turn both Unitron’s ON 

7. WAIT—Ensure Green LED’s are ON 

8. Power up instrumentation using switch #4 

9. Turn ON all instrumentation units 

10. Set all pressure controllers to ON 

11. Set all pressure controllers to FLOW

12. Verify inlet controllers (four-channel power supply) are set to 150 torr 

13. Verify return controllers (single channel) are set to 840 torr or lowest controllable 

pressure 

14. Ensure all float drain valves are closed (rear of OBOAS) 

15. Pressurize ejectors on both OBOAS units 

16. Verify ejector flow indicator is rotating 

17. Set inlet selector valves to Sample Port B—Cabin Air 

18. Set Return selector valves to Sample Dump

19. Start-up #1 OBOAS pump (switch #1) by selecting a Unitron 

20. Start-up #2 OBOAS pump (switch #2) by selecting a Unitron 

21. Allow 2 hours to warmup units 

E-1 
OBOAS CALIBRATION PROCEDURES 

1. Allow system to sample cabin air (Sample Port B) until the reading stabilizes 

2. Press SPAN once on each oxygen analyzer 

3. Using the arrow keys, adjust the displays to read the proper oxygen concentration (20.9) 

4. Ensure calibration/validation gas bottle is open and pressure regulator is set below 

10 psig 

5. Ensure calibration/validation gas sample line is connected to OBOAS 

6. Set inlet selector valves to CAL 

7. Allow all analyzers to stabilize. Validate the analyzers read the value given on the ticket 

on the calibration gas bottle. 

8. Return the inlet selector valves to B 

9. Verify the analyzers stabilize around 20.9 

OBOAS FUEL TANK SAMPLING PROCEDURES 

1. Set inlet selector valves to A—Sample line from center wing fuel tank 

2. Set Return selector valves to Return to Tank 

OBOAS SAMPLE LINE PURGING PROCEDURES 

1. Secure the line to be purged by turning OFF the inlet pressure controller 

2. Set the purge selector valve to the proper sample line 

3. Set the return selector valve to Sample Line Purge 

4. Allow time for the purge, then set the return selector valve to Return to Tank 

5. Return the inlet pressure controller to the ON position 

6. Verify flow is resumed or repeat as needed 

OBOAS SECURING PROCEDURES 

1. Set inlet selector valves to Sample Port B—Cabin Air 

2. Set return selector valves to Sample Dump

3. Allow adequate time to sample from cabin air prior to shutdown 

4. Shutdown #2 OBOAS pump—Switch #2 to OFF 

5. Shutdown #1 OBOAS pump—Switch #1 to OFF 

6. Set inlet selector valves to OFF 

7. Set return selector valves to OFF 

8. Turn off pressurized air source for the ejectors 

9. Set all pressure controllers to OFF 

E-2 
10. Turn OFF all instrumentation units 

11. Secure instrumentation—Set switch #4 to OFF 

12. Turn both Unitron’s OFF 

13. Secure aircraft power to Unitron’s #1 and #2 (115 Vac/400 Hz/3 Phase) 

14. Inspect for liquid in all float drain valves then close (rear of OBOAS) 

E-3/E-4 
APPENDIX F—FAILURE MODE EFFECTS CRITICALITY ANALYSIS HAZARD LISTING 

FOR ONBOARD OXYGEN ANALYSIS SYSTEM 

F-1/F-2 
ID Component Failure Mode Failure Cause Component Effect System Effect Aircraft Effect* 

Hazard

Cat. 

Hazard

Prob. Status Controls Comments

1a Fluid trap float 

valve 

Float valve stuck open 

Bent or broken float arm, severe aircraft attitude 

Float valve does not block the passage of fuel into the system 

Single channel fills with fuel, contaminates pump and pressure controllers, damages sensors 

Corrupted return sampleline 

II N/A Closed Operator monitors system for fuel 

contamination 

1b Float valve

stuck closed 

Stuck switch mechanism 

Gas sample cannot pass through trap 

Single channel fails to operate, loss of data 

No effect II N/A Closed Operator checks system for correct 

operation prior to test 

2a Input selector

valve 

Blocked Sample line

contamination 

Gas sample cannot pass through valve 

Single channel fails to operate, loss of data 

No effect II N/A Closed Lines have traps, filters, and flash 

arrestors 

2b Stuck Mechanical failure Operator cannot select 

calibration or off in flight 

Change/no effect No effect IV N/A Closed 

2c Indicator

indicates incorrectly 

Mechanical failure Indicator indicates sample

when it is off or on calibration line 

System would sample from cabin, calibration line, or be off instead of tank 

No effect II N/A Closed Obvious failure mode to user; highly 

reliable hardware 

3a Inlet flame

arrestor

Fails closed Accidentally tripped 

due to vibration, impact 

Arrestor blocked Single channel blocked closed, 

loss of data 

No effect II N/A Closed 

3b Fails open Mechanical failure Arrestor will not trip in the 

event of an inline detonation 

No effect No effect IV N/A Closed Unlikely flame front will propagate “up 

stream” back to tank; down stream flame arrestor; ignition sources and ullage sample have been separated; reliable, proven effective part 

4a Inlet pressure

regulator 

Fails full open Mechanical failure 

Logic control failure 

Regulator/controller allows pressure on pump inlet to rise to atmospheric

Single channel fails to maintain correct sample pressure; degraded data; increased pump work/heat rejection 

No effect III N/A Closed 

4b Fails full

closed 

Mechanical failure Logic control failure 

Regulator/controller shuts off flow 

Single channel fails to operate; loss of data 

No effect II N/A Closed 

4c Fails to

regulate correctly

Logic control failure Regulator/controller fails to 

regulate pressure within acceptable limits, oscillates, or spikes 

Single channel fails to maintain correct sample pressure; degraded data accuracy; increased pump work/heatrejection; pressure surge/swingsdamage sensor 

No effect II N/A Closed 

4d Regulator

electrical case short

Electrical failure, EMI Regulator electronics 

arcs/sparks; possible deflagration internal to regulator; possible failure of regulator valving/casing

Single channel failure, loss of data; possible loss of ancillary equipment, rack damage, secondary aircraft damage

Possible release of flammable vapors; and/orsmall-scale deflagration fire/smoke, ancillary damage, release of noxious fumes 

II Monitor Operator monitors for correct operation;

internal fusing of controller unit; external power circuit breakers; hand-held fire extinguishers on aircraft 

* To be qualified by end user

F-3/F-4
ID Component Failure Mode Failure Cause Component Effect System Effect Aircraft Effect

Hazard

Cat. 

Hazard

Prob. Status Controls Comments

5a Pump Contained

motor failure 

Faulty rotating part, motor short 

Pump stops Complete sample train 

shutdown, all channels failed 

No effect I N/A Closed Two redundant four-channel systems 

5b Uncontained

motor failure 

Unbalanced highoutput state, faulty rotating part 

Pump stops Complete sample train 

shutdown, all channels failed 

Possible breach of pressure vessel/aircraft depressurization; possible in-flight breakup of fuselage 

I 1.00E-06 Monitor Motor meets ANSI standard for failure 

containment IAW explosion-proof specification 

Tech Center excepts this limitation 

5c Pump head

failure 

Blown seal, diaphragm failure 

Pump head stops moving air 

Single channel fails to operate; loss of data 

No effect II N/A Closed 

5d Bad head delta 

P 

Diaphragm fouled or damaged 

Pump fails to increasesample pressure adequately 

Loss of pressure rise on single channel, degraded/bad data 

No effect III N/A Closed 

5e Motor electrical

case short

Electrical failure, EMI Motor arcs/sparks, shorts

into OBUSS 

Possible failure of internal components, breach of sample train; possible deflagration,release of flammable vapors, failure of system, loss of data; possible loss of ancillary equipment, rack damage, secondary aircraft damage

Possible release of flammable vapors and/orsmall-scale deflagration fire/smoke, ancillary damage, release of noxious fumes 

I 1.66E-05 Monitor Motor bonded to rack via OBUSS; 

internal motor fusing; external power circuit breakers; hand-held fire extinguishers in cabin 

6a Coalescing

filter 

Clogs Fouled sample Gas sample cannot pass 

through separator 

Single channel fails to operate; loss of data 

No effect II N/A Closed 

6b Fails to

eliminate moisture 

Mechanical failure Separator fails to eliminate

moisture 

Failure of oxygen sensor; single channel fails to operate 

No effect II N/A Closed 

7a Needle valve Fails open Mechanical failure Valve cannot change flow

rate of sample 

Failure to regulate volume flow IAW calibration; degraded data, possible lost data 

No effect III N/A Closed 

7b Fails closed Mechanical failure Gas sample cannot pass 

through valve 

Single channel fails to operate; loss of data 

No effect II N/A Closed 

8a Flow meter Clogs Fouled sample Gas sample cannot pass 

through meter 

Single channel fails to operate; loss of data 

No effect II N/A Closed 

8b Indicates

incorrectly 

Mechanical failure Incorrect or inconsistent

sample flow rate 

Single channel degraded data accuracy

No effect III N/A Closed 

9a Oxygen

sensor

Output fails Cell expires, electrical 

failure 

Sensor has no electrical output 

Single channel fails to operate; loss of data 

No effect II N/A Closed 

9b Short to

housing 

Electrical failure Sensor low-power shorts

on case 

Single channel fails to operate; loss of data 

No effect II N/A Closed Low power on sensor, wiring done 

IAW sound practices 

F-5/F-6
ID Component Failure Mode Failure Cause Component Effect System Effect Aircraft Effect

Hazard

Cat. 

Hazard

Prob. Status Controls Comments

10a Oxygen

analyzer 

Fails Electrical failure Analyzer has no output Single channel output fails; loss 

of data 

No effect II N/A Closed 

10b Indicates

incorrectly 

Electrical failure Analyzer has incorrect 

output 

Degraded or bad data No effect III N/A Closed 

10c Analyzer case

short

Electrical defect, EMI Analyzer arcs/sparks; 

possible smoke/fire 

Single channel failure, loss of data; possible loss of ancillary equipment, rack damage

Possible release of flammable vapors and/or small-scale deflagration fire/smoke, ancillary damage, release of noxious fumes 

II N/A Closed Operator monitors for correct 

operation; internal fusing ofanalyzer unit; external power circuit breakers; hand-held fire extinguishers in cabin 

10d Analyzer case

short energizes sensor

Electrical defect, EMI Housing/sensor 

arcs/sparks; possible deflagration in housing, explosion, smoke/fire 

Single channel failure, loss of data; possible loss of ancillary equipment, rack damage

Possible release of flammable vapors and/or small-scale deflagration, fire/smoke, ancillary damage, release of noxious fumes 

II 1.00E-09 Monitor Fusing/circuit breakers;

intrinsically safe barriers between analyzer and sensor housing, hand-held fire extinguishers in cabin 

11a Check valve Stuck closed Blocked, mechanical 

failure 

Gas sample cannot pass through valve 

Single channel fails to operate; loss of data 

No effect II N/A Closed 

11b Fails open Mechanical failure Reverse flow in system will 

not be prevented 

No effect No effect IV N/A Closed 

12a Outlet

pressure regulator 

Fails full open Mechanical failure 

Logic control failure 

Regulator/controller allows pressure drop on pump outlet 

All four channels fail to maintain correct sample pressure; incorrect data; possible damage to sensor 

No effect I N/A Closed 

12b Fails full closed Mechanical failure 

Logic control failure 

Regulator/controller shuts off flow 

All four channels fail to operate; loss of system data 

No effect I N/A Closed 

12c Fails to

regulate correctly

Logic control failure Regulator/controller fails to 

regulate pressure within acceptable limits, oscillates, or spikes 

All four channels fail to maintain correct sample pressure; bad data accuracy; increased pump work/heat rejection; pressure surges/swings damage sensor

Box could heat up, pose potential burn hazard 

I N/A Closed

12d Regulator

electrical case short

Electrical failure, EMI Regulator electronics 

arcs/sparks; possible deflagration internal to regulator; possible failure of regulator valving/casing

All four channels fail, loss of all data; possible loss of ancillary equipment, rack damage, secondary aircraft damage

Possible release of flammable vapors and/or small-scale fire/smoke, release of noxious fumes

I Monitor Operator monitors for correct 

operation; internal fusing ofcontroller unit; external power circuit breakers; hand-held fire extinguishers 

12e Controller unit

arcs/sparks 

Electrical failure, EMI Controller unit arcs/sparks;

possible smoke/flames

All four channels fail, loss of all data; possible loss of ancillary equipment, rack damage, secondary aircraft damage

Possible small-scale fire, smoke, release of noxiousfumes

I N/A Closed Operator monitors for correct 

operation; internal fusing ofcontroller unit; external power circuit breakers; hand-held fire extinguishers in cabin 

F-7/F-8
ID Component Failure Mode Failure Cause Component Effect System Effect Aircraft Effect

Hazard

Cat. 

Hazard

Prob. Status Controls Comments

13a Outlet flame

arrestor

Fails closed Clogged Arrestor blocked All four channels blocked 

closed; loss of all data 

No effect I N/A Closed Gas sample desiccated and 

filtered 

13b Fails open Very powerful explosion 

within sample train 

Arrestor will not arrest flame front in the event of an outflow line detonation 

No effect No effect IV N/A Closed Ignition sources and sample train 

separated 

Failure mode borderline credible

14a Bypass

selector valve

Blocked Sample line

contamination 

Gas sample cannot pass through valve 

All four channels fails to operate; loss of data 

No effect I N/A Closed Lines have traps, filters, and flash 

arrestors 

14b Stuck Mechanical failure Operator cannot select 

outflow in tank in flight 

No effect No effect IV N/A Closed 

14c Indicator

indicates incorrectly 

Mechanical failure Indicator indicates sample

when it is off or on calibration line 

Sample would be routed to outflow valve instead of tank; could bias data 

No effect III N/A Closed Highly reliable hardware 

15a Swagelok

connection

Leaks Vibration, incorrect

connection, bad swage 

Positive Pressure Section: 

Single-channel gas sampleleaks into box

Positive Pressure Section: 

Single channel has bad sample volume IAW calibration procedures, possible degraded data quality/accuracy 

Positive Pressure Section: Possible release of flammable vapors, release of noxious fumes 

III N/A Closed Box leak checked after assembly 

Negative Pressure Section: 

Single-channel gas sampledrafts box air into sample line 

Negative Pressure Section: 

Single channel contaminated sample; bad data 

Negative Pressure Section: 

No effect

II N/A Closed Failure most likely noticed by 

operator; box leak checked after assembly 

16a Nylon tubing Cracks/leaks Age/vibration/chaffing Positive Pressure Section: 

Single-channel gas sampleleaks into box

Positive Pressure Section: 

Single channel has bad sample volume IAW calibration procedures, possible degraded data quality/accuracy 

Positive Pressure Section: Possible release of flammable vapors, release of noxious fumes 

III N/A Closed

Negative Pressure Section: 

Single-channel gas sampledrafts box air into sample line 

Negative Pressure Section: 

Single channel contaminated sample; bad data 

Negative Pressure Section: 

No effect

II N/A Closed Failure most likely noticed by 

operator 

17a Stainless steel

tubing 

Cracks/leaks Vibration/bad bend Positive Pressure Section: 

Single-channel gas sampleleaks into box

Positive Pressure Section: 

Single channel has bad sample volume IAW calibration procedures, possible degraded data quality/ accuracy 

Positive Pressure Section: Possible release of flammable vapors, release of noxious fumes 

III N/A Closed

Negative Pressure Section: 

Single-channel gas sampledrafts box air into sample line 

Negative Pressure Section: 

Single channel contaminated sample; bad data 

Negative Pressure Section: 

No effect

II N/A Closed Failure most likely noticed by 

operator 

18a Sonic ejector/

evacuator 

Clogged Contaminated supply 

line/ejector drafts particulate matter 

Ejector fails to draft air from box 

Ullage sampling systemcontainment box fails to maintain a negative pressure 

No effect IV N/A Closed 

F-9/F-10
ID Component Failure Mode Failure Cause Component Effect System Effect Aircraft Effect

Hazard

Cat. 

Hazard

Prob. Status Controls Comments

19a Fluid drain Clogged Mechanical failure Fluid cannot be drained from 

trap or water separator 

If not noticed by operator could cause separator or trap to fill with fluid; possible bad data or damages sensor/loss of single channel 

No effect II N/A Closed Failure most likely noticed by 

operator in the form of bad data on one channel 

19b Leaks Mechanical failure Fluid spills/leaks from 

component 

No effect Fluid spills/accumulates 

under instrumentation racks; possible noxious vapors 

III N/A Closed Fluid/smell most likely noticed by 

operator 

20a Cannon plug Pin-to-pin short Bent pin, cracked or

damaged insert 

No effect Possible signal failure; incorrect 

data, bad data on one channel 

No effect II N/A Closed Pins installed IAW proper handling 

procedures 

20b Case short Bent pin, cracked or

damaged insert 

Damaged connector Possible signal failure; incorrect 

data, bad data, noisy data on multiple channels 

No effect II N/A Closed Cannon plug shorts are rare 

21a Power chord Internal short Chaffed wire, faulty 

chord 

Failed electrical path, wireoverheats, possible smoke and fire 

Failed primary equipment, loss of data on some or all channels; possible ancillary damage 

Possible ancillary damage from smoke/fire; possible minor burns and/or noxious fumes

I N/A Closed Chords tested and inspected prior 

to construction; power chordsbundled and tied to preventchaffing; circuit breakers in line to protect wire runs and equipment from overheating and fire; handheld fire extinguisher in cabin 

21b Short to

aircraft/rack

Chaffed wire Failed electrical path, wire

overheats, possible smoke and fire 

Failed primary equipment, loss of data on some or all channels; possible ancillary damage 

Possible ancillary damage from smoke/fire; possible severe burns and/or noxious fumes

I N/A Closed Chords tested and inspected prior 

to construction; power chordsbundled and tied to preventchaffing; circuit breakers in line to protect wire runs and equipment from overheating and fire; handheld fire extinguisher in cabin 

22a Wire harness Wire short Chaffed/cracked wire Failed electrical path, 

possible wire overheat 

Failed signal path, loss of data on some or all channels; possible equipment damage overheating 

Possible ancillary damage from overheating 

II N/A Closed Aircraft-grade wire installed IAW 

sound practices inspected prior to construction, wires bundled and tied to prevent chaffing, low powersignals and excitation on wires only 

F-11/F-12
APPENDIX G—DESCRIPTION AND ANALYSIS OF LAB-BASED OXYGEN ANALYSIS 

SYSTEM FOR USE WITH FLIGHT TEST INERT GAS GENERATOR 

A tertiary analysis of a lab-based altitude oxygen analyzer was performed to determine what 

features would be required to provide an equivalent level of safety for measuring the oxygen 

concentration of the product and permeate oxygen concentration of an onboard inert gas 

generator (OBIGGs) during a flight test. It was determined that the OBIGGs has sufficient 

controls to prevent flammable vapors and liquids from being present during operation. This 

eliminates the need for a purged containment system with liquid traps and other related safety 

equipment. The only hazard analyzed with significant aircraft effects, which is not a direct result 

of flammable liquids or vapors at the sample location, is the uncontained failure of the pump 

motor (see appendix F, hazard 5b). This hazard can be controlled by using an explosion-proof 

pump that has a motor designed to contain fragments in the event of a failure. This would allow 

for an equivalent level of safety to the onboard oxygen analysis system (OBOAS) by using a 

laboratory altitude oxygen analyzer to measure the oxygen concentration from an OBIGGs 

during a flight test. 

The two-channel laboratory oxygen analyzer developed by the Federal Aviation Administration 

has gas sample interfaces similar to OBOAS on the rear access panel as well as the sample 

return. It does not require purge air but does have a port for calibration, and the sample return 

has the option to bypass the sample or return it to the system. It has similar power requirements 

to the OBOAS, as it uses a four-headed pump (for two gas sample channels) that uses the same

explosion-proof motor. This system must be rack-mounted in 14 vertical inches of a 19-inch 

instrumentation rack with adequate space beneath to mount the large pump. The system

interfaces to the data acquisition system with the same two cannon plugs described in 

appendix D, with the output for oxygen signals 1 and 2, inlet pressures 1 and 2, and the return 

pressure all being on the same pins identified. All other pins on the connectors are open. The 

system is operated identically to the OBOAS. 

G-1/G-2