6.1 Defence aircraft are fitted with breathing equipment to supply oxygen, or a mixture of air and oxygen, to crew and passengers to protect against the effects of hypoxia at cabin altitudes above 10,000 feet. Hypoxia occurs whenever a physiologically inadequate amount of oxygen is available to, or is utilised by, body tissues and the brain.
6.2 Defence experience with aircraft oxygen system failures (and subsequent impact on either crew or aircraft safety) has identified shortfalls in extant Codes and associated standards promulgated by civil and military Airworthiness Authorities as described in Section 1 of this manual. Consequently, the Authority has defined airworthiness design requirements for Defence aircraft oxygen systems to supplement these Codes.
6.3 This Chapter prescribes Authority supplementation to the aircraft oxygen system elements of recognised civil and military Airworthiness Codes. Importantly, the airworthiness design requirements in this chapter are not suitable for application in isolation from an Airworthiness Code. The Authority’s requirements for the application of recognised Airworthiness Codes are defined in Section 1 of this manual.
6.4 This section presents design requirements for oxygen systems fitted to new Defence aircraft. Additional design requirements specific to gaseous, liquid, on-board oxygen generating and chemical oxygen generating systems are presented at paragraphs 6.15 through 6.34.
6.5 Design Requirement (Essential). Defence aircraft oxygen systems must comply with the requirements of DASR ORO.60, Provision and Use of Oxygen in Aircraft.
6.6 To provide protection against the effects of hypoxia, DASR ORO.60 requires supplemental oxygen systems to support crew and passenger breathing when the aircraft is operating at defined altitudes.
6.7 Design Requirement (Essential). Cadmium plated components must not be used in oxygen systems where they are exposed to enriched oxygen flow.
6.8 Cadmium plated components exposed to enriched oxygen may release cadmium (which has known adverse health effects) into the oxygen flow.
6.9 Design requirement (Essential). Oxygen system venting must be shown by analysis to not pose a hazard to safe aircraft operation.
6.10 Routing of oxygen system vent lines into internal aircraft compartments may lead to high oxygen concentrations in the vicinity of fuel sources, which increases the risk of fire. Overboard venting usually provides an effective means of ensuring that vented oxygen does not pose a hazard to the aircraft operators or maintainers. Where venting internally is proposed, a cavity analysis must be conducted to identify any potential hazards associated with oxygen venting and the analysis must confirm that relevant oxygen system safety objectives have been met (in particular fire risk, which should be verified via a relevant Oxygen Hazards and Fire Risk Analysis (OHFRA)). Venting near fuel or ignition sources must not occur.
6.11 Design Requirement (Essential). For aircraft in which the cabin altitude is not maintained below 10,000 feet at all aircraft operating altitudes during normal operation, an indication must be provided that warns the flight crew when the cabin altitude is greater than 10,000 feet and nil or continuous oxygen flow occurs for at least 15 seconds on any oxygen regulator.
6.12 An indication of nil or continuous flow warns the crew that a sufficient supply of oxygen (to prevent the onset of hypoxia) may not be available if the cabin altitude remains above 10,000 feet. Supplemental oxygen is required at cabin altitudes above 10,000 feet, hence a nil flow warning is required, while a continuous flow warning may be an indication of failure either before or after the regulator or of mask removal. Appropriate warning to the crew may be provided by a master caution light in conjunction with a warning panel light and an audible warning signal.
6.13 Design Requirement (Recommended). Materials used in aircraft oxygen systems should meet the requirements defined in ASTM G63 and ASTM G94, supplemented with the following:
annealed copper tubing qualified to AS 1572-1998 should be used where tubing is exposed to oxygen pressures greater than 500 psi
corrosion resistant steel tubing qualified to ASTM A269 should only be used where tubing is exposed to oxygen pressures less than 500 psi
aluminium alloy tubing qualified to MIL-T-7081D should only be used where tubing is exposed to oxygen pressures less than 150 psi.
6.14 The selection of appropriate materials for use in aircraft oxygen systems depending on oxygen pressure, and design of the storage, distribution and delivery system, reduces the likelihood of oxygen system fires. Oxygen system designs that are certified as compliant with Authority recognised Codes will have been designed to comply with materials properties that satisfy relevant safety objectives. However, for changes to designs, adoption of the requirements detailed ASTM G63 Standard Guide for Evaluating Nonmetallic Materials for Oxygen Service and ASTM G94 Standard Guide for Evaluating Metals for Oxygen Service will inform the selection of materials having the appropriate characteristics to ensure safe oxygen system design. Nevertheless, the inherent flexibility in these standards may lead to system tubing being used that does not result in associated fire hazards (and risks) being minimised so far as is reasonably practicable. Therefore, the Authority has prescribed an adaptation of these standards that represents current good practice material selection and should be reasonably practicable to implement for Defence aircraft oxygen system design changes.
6.15 In addition to the oxygen system design requirements prescribed at paragraphs 5 through 14, the following airworthiness design requirements are applicable to Defence aircraft gaseous oxygen systems.
6.16 Design Requirement (Essential). A filter with particle retention of 10 micron or less must be used in gaseous oxygen system filler valves or the level of filtration incorporated into the design must be demonstrated by analysis to afford an equivalent level of safety.
6.17 Particulate contamination in gaseous oxygen systems, particularly high pressure systems, can result in a significantly increased likelihood of oxygen system fire, through the action of particle impact in high velocity flow environments generating sufficient heat to ignite materials. While extant civil and military oxygen system design standards require fitment of an inlet filter, this is often of a considerably higher micron rating that does not adequately capture particles known to have caused fires in Defence aircraft. However, the combination of inlet filter, maintenance practices during refilling, cleanliness of supply and additional supply filtration all assist in preventing particulate contamination of oxygen systems that could cause a fire hazard. Therefore, where inlet filtration greater than 10 micron is proposed, the designer must demonstrate through analysis that the combination of these factors affords an equivalent level of safety.
6.18 Design Requirement (Essential). Pressure reduction in high pressure oxygen systems must occur at, or as close as possible to, the supply source.
6.19 The direct supply of high pressure oxygen to oxygen system regulators or other system components results in high velocity gas flows through regulator valves and components where oxygen flow is restricted. This increases the risk of oxygen system fires through both particle impact and adiabatic heating processes. Designing high pressure piping to be as short as possible, significantly reduces the potential for these ignition mechanisms to be present.
6.20 Design Requirement (Essential). Where aluminium oxygen cylinders, or composite oxygen cylinders with an aluminium liner, are proposed to be used in Defence aircraft, an analysis of the operating environment must demonstrate that the cylinder will not pose a hazard to the aircraft during operation.
6.21 The use of aluminium or composite oxygen cylinders in aircraft increases the likelihood of the cylinder experiencing an explosive failure if it suffers a ballistic impact. Aluminium and composite cylinders are often used in civil aircraft oxygen system designs due to their improved weight versus pressure holding capability. Where an aluminium or composite oxygen cylinder is proposed for use in a Defence aircraft, the capability manager must be engaged to confirm that the Defence aircraft operating environment does not pose an increased likelihood of ballistic impact compared to the baseline aircraft.
6.22 In addition to the oxygen system design requirements prescribed at paragraphs 5 through 14, the following airworthiness design requirements are applicable to Defence aircraft liquid oxygen systems.
6.23 Design Requirement (Essential). Liquid oxygen systems fitted to Defence civil derivative aircraft must be certified as compliant with an approved military airworthiness code or must be certified by an Authority recognised civil NAA as having met the relevant safety objectives for aircraft oxygen systems.
6.24 Current civil NAA airworthiness codes do not define sufficient design requirements for liquid oxygen systems. Consequently, where a civil derivative aircraft design includes liquid oxygen systems, such systems must be certified using either a recognised military airworthiness code (which will include appropriate requirements for liquid oxygen systems) or certified by an Authority recognised civil NAA as having met a suite of airworthiness design requirements that the Authority has determined provide an equivalent level of safety (usually defined within a Special Condition to the original NAA type certification).
6.25 Design Requirement (Essential). Stabilisation times must be established and promulgated for non-stabilised liquid oxygen converters used in Defence aircraft.
6.26 Non-stabilised liquid oxygen converters can suffer from thermal stratification, which can lead to loss of oxygen supply if the converter is moved/shaken before thermal equilibrium has been reached. Stabilisation of liquid oxygen converters can take many hours and, during this period, there will be an increased likelihood of oxygen system failure. Where a non-stabilised converter is fitted to a Defence aircraft and is designed to be replenished in-situ, the stabilisation time must be documented in the relevant aircraft maintenance publications. Where a non-stabilised converter can be removed for replenishment and allowed to stabilise prior to reinstallation, required stabilisation times must be promulgated in relevant oxygen replenishment instructions.
6.27 In addition to the oxygen system design requirements defined at paragraphs 5 through 14, the following airworthiness design requirements are applicable to Defence aircraft OBOG systems.
6.28 Design Requirement (Essential). Defence aircraft OBOGS must comply with the airworthiness design requirements prescribed in:
DEF STAN 00-970 Part 13, or
an alternative standard agreed by the Authority.
6.29 The oxygen system airworthiness design requirements prescribed in the Authority recognised civil Airworthiness Codes are generic in nature and do not include a complete and consistent suite of requirements for evolving oxygen system technologies such as OBOGS. Further, the civil requirements may not adequately cover aspects of military operations, such as the need for crew to be supplied with a continuous source of oxygen for the duration of flight. Consequently, the Authority has prescribed a benchmark standard, DEF STAN 00-970, which presents a complete and consistent suite of OBOGS design requirements for the military context.
6.30 Design Requirement (Essential). Where the back-up oxygen supply is also used to support crew breathing during the ejection sequence, analysis must demonstrate that the back-up supply has sufficient capacity to support breathing for all crew during:
any foreseeable OBOGS failures
ejection following OBOGS failure.
6.31 Using the same oxygen source for both OBOGS back-up and ejection increases the likelihood that the source will be depleted during an OBOGS failure, which may pose a hypoxia hazard to the crew if ejection above 10,000 feet is required. ADF experience has revealed that OBOGS designs suffer from failure modes that result in the crew using the back-up supply more frequently than assumed. In these circumstances, the crew may be unaware of, or unable to ascertain, the remaining capacity of the back-up oxygen supply. This may result in insufficient oxygen being available should an ejection subsequently be required at an altitude where breathing cannot be sustained. Further, given that the OBOGS relies on engine operation to supply oxygen, an engine failure at altitude (for a single engine aircraft) may lead to depletion of the back-up supply before a height is reached at which safe ejection can occur. The designer must confirm that the capacity of the ejection sequence oxygen supply, when also used as the OBOGS back-up, provides an adequate level of protection against hypoxia, and satisfies the associated oxygen system design safety objectives.
6.32 The following airworthiness requirement is applicable to Defence aircraft chemical oxygen generators.
6.33 Design Requirement (Essential). Where an oxygen system design change includes the installation of chemical oxygen generators, airworthiness design requirements for the chemical oxygen generator must be defined and proposed for Authority agreement.
6.34 Chemical oxygen generators may pose unique hazards associated with the exothermic chemical reaction if not designed and certified for use in an aircraft environment. Authority recognised NAAs have included some requirements for chemical oxygen generators in their associated Airworthiness Codes (eg FAR 25.1450), and compliance with these requirements as part of an NAA certification will satisfy relevant oxygen system safety objectives. However, where chemical oxygen generators are not part of the original certified design, and are proposed to be fitted to a Defence aircraft, the NAA requirements may not be suitable for adoption in the military context of use. Therefore, the airworthiness requirements to be applied to the chemical oxygen generators must be defined, and proposed for Authority agreement. SAE AS 1304 Rev B Continuous Flow Chemical Oxygen Generators and SAE AS 1303 Portable Chemical Oxygen may assist designers in establishing suitable equipment and performance requirements for chemical oxygen generators, noting that these standards may require tailoring to accommodate unique military role and operating environment considerations.
6.35 Design attributes in Defence aircraft oxygen systems may result in interoperability constraints or fire hazards that could result in loss of an aircraft during maintenance activities (and potentially have WHS implications for personnel). Consequently, the following requirements, while not prescribed by the Authority, should be considered for aircraft acquisitions and modifications where interoperability or capability issues are determining factors.
6.36 Interoperability design requirement. Gaseous and liquid oxygen replenishment couplings should comply with the requirements defined in AFIC AIR STD FG 4030, Characteristics of Gaseous Breathing Oxygen, Liquid Breathing Oxygen and Supply pressures, Hoses and Replenishment Couplings.
6.37 Defence aircraft oxygen systems designs may adversely impact interoperability with other nations and/or continued operational availability, if they are not designed to permit replenishment using support equipment at deployed locations. In particular, civil-derivative aircraft may not be designed for interoperability.
6.38 Capability design requirement. Oxygen cylinders should have an ON/OFF valve that provides a means of gradually increasing system oxygen pressure in a controlled fashion.
6.39 Fast acting ON/OFF valves on aircraft oxygen cylinders release a high velocity ‘slug’ of oxygen that may impact on components in the distribution system, generating substantial heat and increasing the likelihood of a fire. Given that supply on/off valves in aircraft can only be operated by ground crew during maintenance, such fires are likely to result in capability impacts as a result of loss of the aircraft and pose a WHS hazard to personnel.
6.40 Further guidance on implementing the oxygen systems requirements prescribed in this chapter can be provided by the chapter sponsor.