CCR Safety Analysis · 2026
The CCR diving community discusses risk in terms of equipment: sensor failure, solenoid failure, scrubber failure. This is necessary but insufficient. Incident data consistently shows that the machine often warns before it fails — and the fatality occurs when the diver fails to respond. This is an honest analysis of where the real risks lie and what that demands of every CCR diver.
Rebreather diving carries a higher reported fatality rate per dive than open-circuit scuba. This is a fact, and it is not minimised here. But "higher rate" does not tell you why — and understanding the "why" is the only information that enables you to actually manage the risk. The data on causation is consistent: the pattern in CCR incident analysis is a cascade of events, any single one of which a trained diver should have been able to manage. The fatality occurs when that cascade overwhelms a diver whose responses were incorrect, slow, or absent.
"Many diving fatalities are the result of a cascade of incidents overwhelming the diver, who should be able to manage any single reasonably foreseeable incident." This framing shifts the analytical question from "did the machine fail?" to "was the diver capable of managing what happened?" These are very different questions — and the second one leads to actionable safety improvements where the first leads only to equipment blame.
The machine presented a problem. The human failed to provide the solution. This does not mean CCR is safe — it means that CCR safety is substantially within the control of the diver, not the manufacturer.
Cause: Depleted oxygen cylinder, electronics failure, closed O₂ valve, incorrect setup.
Danger: The body has no reliable early warning system for hypoxia. A diver can experience sudden loss of consciousness with no preceding sensation of distress. No headache, no shortness of breath — just sudden unconsciousness.
Management: Continuous PPO2 monitoring via HUD and primary computer. Pre-dive O₂ cylinder check and sensor calibration are the primary preventive controls.
Cause: Solenoid stuck open, incorrect setpoint programming, high O₂ fraction at depth.
Danger: CNS oxygen toxicity can cause a grand mal seizure underwater — an almost certainly fatal event in a CCR diver. The mouthpiece is lost; the diver drowns. Onset can occur rapidly with no premonitory symptoms.
Management: Correct setpoint programming, pre-dive O₂ analysis, monitoring CNS% display on the dive computer throughout the dive.
Cause: Exhausted or improperly packed Sofnolime, scrubber channelling, diving beyond rated scrubber duration.
Danger: Symptoms include increasing shortness of breath, headache, and panic. Onset can be rapid and can overwhelm a diver before they can execute a bailout. A flooded scrubber adds caustic cocktail risk.
Management: Fresh Sofnolime every dive, correct canister packing, strict adherence to rated scrubber duration. See our Sofnolime guide.
The term originates from the sociological analysis of the Space Shuttle Challenger disaster — an organisational failure in which repeated warnings about O-ring behaviour in cold temperatures were progressively normalised and dismissed. Each flight that survived despite the risk became evidence that the risk was acceptable. Until it wasn't.
In CCR diving, the dynamic is individual: the diver becomes their own normalisation agent. It operates below conscious awareness. The diver is not telling themselves "I'm being reckless." They are telling themselves "I know this unit well enough to know when to worry and when not to." That confidence itself becomes the hazard.
The mechanism of harm: each small safety shortcut individually carries a low probability of causing a fatality. But they erode safety margins cumulatively. When a second, unrelated problem occurs — a down-current, a buddy emergency, a light failure in a cave — the previously "manageable" tolerated issue becomes the trigger for a fatal cascade.
The most dangerous divers in the CCR community are not beginners — beginners are appropriately cautious and supervised. They are experienced divers who have "gotten away with it" enough times that the deviation no longer registers as one:
Each individually survivable. Combined with one unexpected problem: the fatal cascade.
"The checklist is not bureaucracy. It is the mechanism by which you maintain your safety margins. The day you stop treating it as essential is the day you begin the normalisation process."
The tendency to see what you expect to see. If your target PPO2 is 1.3 bar and two sensors read 1.3 while a third reads 0.7, confirmation bias drives you to dismiss the outlier as a faulty sensor — rather than considering that the two agreeing sensors have failed high and your actual PPO2 is 0.7 bar. Sensor voting logic is designed to protect against this. So is the habit of actively questioning outlier readings rather than dismissing them.
When attention becomes so narrowly focused on a secondary task — photography, navigation, deploying a lift bag, managing a student diver — that primary life-support monitoring stops. Divers have died while trying to fix malfunctioning cameras, their PPO2 dropping into the hypoxic range unnoticed. The brain has limited bandwidth. CCR operation requires that a portion of that bandwidth is permanently allocated to loop monitoring, regardless of what else is happening.
"I've done this hundreds of times" is one of the most dangerous phrases in CCR diving. Experience that should make a diver safer can instead breed a dangerous sense of immunity to the risks that catch less experienced divers. Checklists get abbreviated. Sensor calibrations get skimmed. Briefings get skipped. The knowledge that something has never gone wrong becomes a prediction that it never will — which is not what it actually is.
These cognitive traps are amplified by cold water, nitrogen narcosis, physical exhaustion, and psychological stress. A diver whose body is already under the physiological load of a deep CCR dive — dealing with VGE, inflammatory response, and oxidative stress (see the data in our JJ-CCR review's physiology section) — has less cognitive capacity to resist these traps.
Not all CCR training is equal. Instructor quality, current diving experience on your specific unit, and emphasis on failure drills over procedural familiarity are what distinguish good training from the minimum. Training standards for rebreather instructors must emphasise currency and active diving — not just historical certification counts. Training is not a one-time event. It is the beginning of a continuous commitment. Agencies: TDI, IANTD. See our full CCR training guide for how to evaluate instructor quality.
Fitness to dive is not purely physical — it is a moment-to-moment psychological state. Are you distracted by problems at work? Feeling pressured to make a dive you are not fully comfortable with? Have the discipline to call a dive for a small nagging issue? The hardest safety skill in CCR diving is the willingness to be the person who calls the dive. It must be easier than proceeding with doubt.
The pre-dive checklist is a covenant with the machine. The danger is executing it as a rote ritual while mentally elsewhere — ticking boxes without engaging with what each step verifies and why. A completed checklist that was executed mindlessly provides less protection than a partially completed checklist where each verified step was genuinely verified. Emergency procedures must be drilled to the point of automatic execution under maximum stress — not recalled with effort.
Rebreather diving has a higher reported incident rate per dive than open-circuit scuba. However, extensive analysis confirms that the majority of CCR fatalities result from diver procedural error, not equipment failure. A well-trained, procedure-disciplined CCR diver who respects checklists, maintains their equipment, and dives within their training manages a different risk profile from open-circuit — not necessarily a greater one.
Analysis of rebreather diving fatalities consistently shows that diver procedural error — not spontaneous equipment failure — is the dominant cause. This includes failure to complete pre-dive checklists, ignoring alarm warnings, diving with known equipment issues, and the gradual normalisation of safety shortcuts. The machine often provides a warning that goes unheeded. A single manageable failure becomes fatal when the diver's response is incorrect, delayed, or absent.
CCR introduces three failure modes not present in open-circuit scuba: hypoxia (too little oxygen — sudden unconsciousness without warning), hyperoxia (too much oxygen — CNS seizure, typically fatal underwater), and hypercapnia (CO2 buildup from scrubber failure). All three can develop without obvious warning signs, making continuous HUD monitoring essential throughout every CCR dive.
Normalisation of deviance is the process by which a diver progressively accepts lower safety standards as normal — through a series of small, seemingly insignificant compromises that each go unpunished. Each compromise gets away and becomes the new baseline, eroding safety margins until a second, unrelated problem creates a fatal cascade. The term originates from the organisational culture analysis of the Space Shuttle Challenger disaster.
The best risk mitigation in CCR diving is quality instruction from a current, experienced TDI or IANTD instructor. Our course guide explains exactly what to look for.
⚠ Not diving instruction. Rebreather diving requires mandatory certified training before any in-water use.