Connect with us

Diving Safety

Do ‘Bad Apples’ Actually Exist?

Human factors coach Gareth Lock explores and analyses the theory of “bad apples” as it applies to dive training. Are system failures the fault of individual agents or are they a result of the system in which they operate, or both? Lock’s answers and potential remedies will enlighten—he gets the core.



By Gareth Lock. Header image by Julian Mühlenhaus. Photos courtesy of Gareth Lock unless noted.

A diving instructor delivered a class in which one of the students misconfigured their equipment before entering the water. This misconfiguration led to hypoxia and the student’s subsequent drowning.

A boat caught fire during the night because of allegedly overloaded electrical circuits, and then 34 people died when they couldn’t escape the boat, despite the boat being accepted as seaworthy and general specifications being adhered to.

A diving instructor and two students died while undertaking a dive in a submerged mine system when visibility was reduced and they couldn’t follow the guideline back to the surface.

Each one of these cases is real, and each one will trigger a strong emotional response because we see, after the fact, it was likely that this event was going to happen given the conditions, actions, and decisions at the time. As a rule, we have a need to assign blame for tragedies, especially when there is loss of life, and even more especially when that loss strikes home. There is an impulse in us to hold someone accountable in light of a recognised standard of best practices, or good behaviour. And yet, at the same time, we know that those involved did not suspect they were going to die at the time; otherwise, they would have done something to prevent  it.  

We have some degree of confidence that the participants in these scenarios were balancing acceptable performance (safety), financial viability (affordability), and workload (physical ability), which refers to resource and people rather than physical ability, and that they were managing risk and uncertainty and balancing those risks and uncertainties with the associated rewards. This tension exists in pretty much everything we do and, in the main, we are pretty good at it. 

Within a system that goes right more often than wrong, bad events stick out like a sore thumb. Furthermore, when the adverse event is serious and ‘obvious’ we judge more harshly. We often believe that by getting rid of these ‘bad apples’ we can make the system safer. But as Sidney Dekker says “Reprimanding bad apples may seem like a quick and rewarding fix, but it’s like peeing in your pants. You feel relieved and perhaps even nice and warm for a little while, but then it gets cold and uncomfortable. And you look like a fool.” 

These negative or critical responses are due to well-known cognitive biases, severity bias, outcome bias, and the fundamental attribution bias or error. What we often forget though is that our behaviour is a product of the system we operate in, and the choices we make in the here and now are influenced by experiences (good and bad) and the rewards (kudos, money and social media recognition) or punishments (disciplinary action, financial hardship, social media retribution) we currently face or perceive we face. The more we look into an event, the more we realize that context is so important in understanding how it made sense for someone to do what they did, or what conditions were present that increased the likelihood of the adverse event occurring.

So, where do ‘bad apples’ come from?

The term ‘bad apples’ comes from the concept that a bad apple will spoil the barrel, as such we should get rid of it before we lose the harvest. Technically, all apples will spoil eventually because of the natural decay process, even when isolated from other apples. The term bad apples has then been applied to humans in social and organisational contexts where the worry is that a single individual will corrupt others around them (from a given standard) and performance will deteriorate, or the company will go bust because of a lack of financial viability. In the safety world, ‘bad apple theory’ states that your inherently safe system remains safe as long as you get rid of the bad apples. There is a certain irony to these ideas.

There have been numerous papers looking at bad apples across multiple domains, police corruption, financial corruption, and healthcare organisations and their impact on safety and performance. In each case, the research has recognised that those individuals did not start off as ‘bad apples’, they started as well-intentioned, sufficiently-trained individuals that gradually got absorbed into the culture of the system in which they were immersed.

Many believe that individuals still need to be held accountable for their actions, and the individual bad apples haven’t been ignored in the research, e.g., Shojania and Dixon-Woods showed that 3% of doctors lead to 49% of complaints and 1% of doctors covered all complaints in a hospital. However, that paper also recognised that those individuals were a product of a failed system. At some point, disciplinary action is needed, but it should only follow a learning-based investigation and not be the first tool that comes out of the box. 

The research recognizes that it wasn’t so much that the apples were bad, but rather the barrel in which they were being stored did not have the systems in place to stop the decay from developing. As such, we need to be looking more at the barrel rather than the apples if we want to make improvements to safety and performance in diving. As Professor James Reason said, “We cannot change the human condition, but we can change the conditions under which humans work.” Fundamentally, if the same ‘errors’ or ‘deviations’ keep happening at an individual level, it is likely to be a system problem, not an individual one.

Decay (drift) is normal

As divers, and being human, we all have a tendency to drift. We want to find more efficient or effective ways of getting the dive done or completing the class given the local pressures we are facing to achieve the goals we’ve set, based on previous outcomes (right or wrong). Our adherence to the rules is based on multiple factors: ease of rule compliance, fear of non-social compliance, fear of litigation, financial constraints, who wrote the rules, how much value the rules have, whether we will get caught, and what is the worst thing is that can happen. 

The context is driving the behaviour. However, we should be creating an environment where adherence happens for two reasons – the rules match the environment, and those involved want to comply because they understand the value, risks, and bigger picture. Adherence should not be because those involved have to comply and are fearful of the consequences. This can lead to gaming of the system and misplaced motivation.

The normalisation of deviance, normalisation of risk, and practical drift’ (See Normalisation side box below) are all terms used to describe the slow movement away from the standards which have been decided upon, written down and published, potentially without recognition of a developing gap. Consequently, feedback is required to identify the deviations and provide corrections back to the standard, or maybe even change the standard. At the training agency level, this should be happening via the QC/QA processes, where the student provides some form of feedback to the agency about the standard of teaching and whether skills were taught or not. The problem with this is that unless the performance standards are available and briefed prior to the class, the student doesn’t know what they don’t know and won’t be able to spot drift. Therefore, unless there is a major deviation, which means that significant drift will have already occurred, drift is hard to spot. 


Normalisation of Deviance is “when people within an organization become so insensitive to deviant practice that it no longer feels wrong.” Vaughan “…had found no evidence of rule violation and misconduct by individuals.” Instead, the key to accepting risk in the past was what I called “the normalisation of deviance”: Normalisation of Deviance is not about breaking rules, it is a social construct based on having standards that are gradually being eroded. This is happening because the output takes priority, and the secrecy associated with discrete or siloed operations means that other stakeholders don’t know or can’t know what else is going on. In diving, this could be the gradual reduction in hours needed to undertake training to meet a competitive advantage or the acceptance that deviations are happening and, as long as it doesn’t end up with a serious injury or fatality, it is okay. Vaughan, Diane. The Challenger Launch Decision. University of Chicago Press. Kindle Edition. Location 86.

Normalisation of Risk is the gradual process through which risky/dangerous practices or conditions become acceptable over time. In diving, these can be: reducing the amount of gas remaining at the end of a dive because nothing has gone wrong, using CCR cells beyond 12 months of manufacture because they still work, or not having a continuous line to the surface while cave diving. See: ‘Shit Happens’: The Selling of Risk in Extreme Sport

Practical Drift comes from the work of Scott Snook examining the Blackhawk shootdown in April 1994. “Practical drift is the slow steady uncoupling of local practice from written procedure. It is this structural tendency for subunits to drift away from globally synchronized rule-based logics of action toward locally determined task-based procedures that places complex organizations at risk.” See: Snook, Scott A.. Friendly Fire (p. 24). Princeton University Press. Kindle Edition. 

Instructors, are you a “Bad Apple”? Check the results of our survey that we conducted with the Business of Diving Institute: Bad Apple Survey

Another dimension is the constant fear that if the student provides critical feedback to the agency about the instructor, the instructor will behave badly toward them in the future. As such, the student provides platitudes that add no value to learning. This problem is replicated at the Instructor Trainer and Course Director level. ITs and CDs drift as they are human too, but the consequences are more serious as their deviations become more widespread.

Photo by Sean Romanowski

Some agencies deal with individual instructor drift by undertaking a regular check of the instructor’s performance in a live class, or by recommending co-teaching sessions where drift or variability in performance can be identified and corrected. However, we have to be careful of the ‘observer effect’ or ‘Hawthorne effect’ as well as the possibility of individuals ‘playing the game’ to pass, meaning they know how to adhere to standards but choose to cut corners when not being observed.

At GUE, [Ed. note: G.Lock is on GUE’s Quality Control board] we have worked hard over the last four to five years to change the perception of feedback within the QC forms from being something to be feared to be something that is rewarding, especially when low scores or critical comments come in. I remember when an instructor from another agency had completed their internship and taught one of their early classes, I contacted them because of a comment in the form. I wanted to understand the background behind this comment with a view to them self-improving or getting them support. 

The instructor’s initial response to me was very defensive, which confused me. Afterwards, they explained the reason for their reaction was that in the past the only reason QC contacted an instructor was because there was likely to be a lawsuit inbound, and so everything had to be documented as per the standards! 

If the diving industry and training agencies (barrels) want divers and diving instructors (apples) to improve, they need to provide an environment where variability in performance is visible, recognised, and not hidden. This means that there is a need for psychological safety to speak up before something happens, and a Just Culture so learning from adverse events can happen. 

Unfortunately, this need is not helped by litigation and the discovery process, where anything written down can be demanded in the case of a lawsuit. For example, at the top of one of the major training agency’s incident report forms, it says, “This form is being prepared in the event of litigation.” This guidance is not likely to help anyone understand how it made sense for people to do what they did, especially if they were deviating from standards to achieve certain goals. If it isn’t written down, then it didn’t ‘exist’ and therefore can’t be produced! However, the lack of documentation makes it difficult or even impossible to detect drift. Furthermore, the lack of clear and coherent standards across the industry—and the limited visibility of these—means that it is harder to spot drift developing. Fundamentally, what acceptable standards are you drifting from?

Understanding one of the ‘bad apples’ above

The following list looks at the conditions surrounding the first event and shows how variability at multiple levels caused this tragic event.

  • A number of instructors had filed complaints to their agency about the instructor involved. It is not clear what the agency did about these complaints, as nothing appeared to change in terms of the instructor’s behaviour. 
  • Students did not have easy access to the agency’s standards and, when located, said standards were difficult to understand and contained contradictions. 
  • The agency HQ staff (as with most agencies) was very small and so had limited opportunities to undertake QC checks. 
  • The financial margins for dive training are small, so efficiencies are found. Instructors holding multiple unit training certifications means proficiency cannot be as high when compared to specialisation. Multiple unit certification increases instructor teaching opportunities for a limited market. 
  • The bespoke class was based on combining multiple classes and didn’t formally exist in the manner it was being taught. 
  • The class schedule was constantly changing due to the availability of staff and students.
  • The urgency to complete the task was driven by financial pressures for fear of handing grants back. 
  • There appeared to be a perception that photographic media was needed for the shop that the deceased student worked at, and the instructor was the manager/owner of that shop. 
  • The students in the class did not feel that they could challenge the developing situation on the boat, likely for reasons of social conformance and culture. 
  • There was no ‘team’ on the boat, with the perception of four students plus an instructor, rather than a learning team working together around a common purpose. 
  • There had been a very similar error made by the student on a previous dive two weeks prior, and this didn’t appear to have been picked up by the diver or dive team.

If we look at Snook’s definition of ‘Practical Drift’ (See Normalisation side box) we can see that over time each of the different parts of the system gradually drifted away from a standard and there was no effective check in place to bring those involved back to the expected, and possibly unclear, standards.

Opportunities for change.

The following provides some opportunities for improvement.

  • If the financial viability of your dive business is struggling; you have two choices: you can cut corners and be more cost efficient, or you can fold and find another job. The problem with cutting corners is that you don’t know where the ‘accident line’ is until you step over it. Get an external view of how you teach and what margins are being eroded, and listen to that feedback. It might save you a significant amount in the future.
  • If you are a lone instructor, and you do not have any form of checking performance and don’t co-teach with others, then you will very likely drift. You need to be proactive in arresting this drift by involving others and accepting feedback from them. Own the likelihood of drift.
  • If you are an agency and your instructor trainers are not checked on a regular basis, do not be surprised that your instructors will not be performing at the standards they should be following. When drift or deviations occur at the top e.g., ITs and CDs, the impact at the lower levels is magnified. There is a need to create a psychologically-safe environment so that feedback is expected, can be provided, and is then shared amongst other instructors. This change starts with leaders.


There are two ways of looking at the question, “Do Bad apples exist?” in the diving industry (and life in general). One answer would be “No, they don’t exist” because everyone has the potential to be a ‘bad apple’ based on the context in which they are operating. The other way is “Yes, because at some point good apples turn bad,” but the reason they turn bad is because of the system.

Learning comes about via exploring boundaries and making ‘errors’ and reflecting on them afterwards. This ability to learn from our own and others’ mistakes is relatively immature in the diving industry—not just looking at outcomes but also at local rationality. We only have to look at social media to see the conflict and judgment that happens when an adverse event is made public. Unfortunately, we have an innate bias to look for individual fault rather than systemic weakness and often ignore the context that is driving those behaviours. This is especially true in the US with a litigious culture that looks to blame and sue, rather than learn and understand. There is a long journey ahead to improve the orchard and barrels, but we will get there more quickly if we stop focusing on the ‘bad apples’.

Instructors, are you a “Bad Apple”? Check the results of our survey that we conducted with the Business of Diving Institute: Bad Apple Survey

Gareth Lock has been involved in high-risk work since 1989. He spent 25 years in the Royal Air Force in a variety of front-line operational, research and development, and systems engineering roles which have given him a unique perspective. In 2005, he started his dive training with GUE and is now an advanced trimix diver (Tech 2) and JJ-CCR Normoxic trimix diver. In 2016, he formed The Human Diver with the goal of bringing his operational, human factors, and systems thinking to diving safety. Since then, he has trained more than 350 people face-to-face around the globe, taught nearly 2,000 people via online programmes, sold more than 4,000 copies of his book Under Pressure: Diving Deeper with Human Factors, and produced “If Only…,” a documentary about a fatal dive told through the lens of Human Factors and A Just Culture. 

Subscribe for the InDepth Newsletter

Diving Safety

When Easy Doesn’t Do It: Dual Rebreathers in Extended-Range Cave Diving

Rebreather technology has enabled cave explorers to extend their underwater envelope significantly deeper and longer. As a result, a few teams are pushing beyond the practical limits of open circuit bailout and so have turned to bailout rebreathers. But they are not without challenges, as Tim Blömeke, who dives into the latest research and field experience, explains.




by Tim Blömeke. Lead image: KUR divers Bob Beckner and Derek Ferguson in the 124m/407 ft deep Mount Doom chamber in Weeki Wachee Spring, Florida, courtesy of Kirill Egorov.

Dual rebreathers are becoming a thing among the elite of extended-range cave diving. Yet the “Blueprint for Survival” for this type of equipment configuration has yet to be written, and practitioners are faced with difficult trade-offs between competing design goals—like fitness for purpose, logistical feasibility, simplicity, reliability, and ease of use, all of which interact with the peculiarities of human nature. A new research paper proposes a pathway for risk assessment. 

The introduction of rebreathers has considerably extended the range of exploration in cave diving. This is true especially for deeper dives, where open circuit technology faces the combined challenges of greater required gas volumes and higher required helium content, which make such dives both difficult to execute logistically due to the sheer number of cylinders involved, and prohibitively expensive due to the amount of helium in each of these cylinders.

By conserving the metabolically inert components of the breathing gas (most notably the helium), the use of closed circuit rebreathers (CCR) eliminates a good chunk of this problem, but not all of it: Traditional CCR diving procedures require that each diver have enough open-circuit bailout gas available to safely end the dive in the event of a rebreather failure. 

Granted, the amount of bailout gas required for a CCR dive is only a fraction of what would be needed to perform the same dive on open circuit, and if all goes well, the bailout gas will never be breathed by anyone and can be reused for future dives. However, bleeding-edge explorers being who they are and doing what they do, after having used their CCRs to push the range of operations a few miles deeper into the cave systems, they began to encounter an issue very similar to the one that prompted the switch to CCR in the first place: cost and logistics. 

As a real-world example, bailing out from a long-distance cave penetration of 7,500 meters at an average diver propulsion vehicle (DPV) travel speed of 40 m/min takes 187 minutes. Assuming a mean ambient pressure of 6 ATA (50 m depth) and a respiratory minute volume (RMV) of 14 l/min, the amount of bailout gas (not including decompression) required to reach the entrance would be 15,708 liters, or more than seven AL80 cylinders filled to 200 bar. This RMV is likely not conservative enough, given the extreme distance and the possibility of a hypercapnic event being the cause of the bailout so, in practice, a safety margin of at about 50% would be added, giving a total of 10-11 AL80 bailout cylinders. 

The required amount of bailout gas became too large to be carried on the person of the diver, so that cylinders again needed to be staged in a series of set-up dives. Preparations for extended range exploration dives became ever more involved, and logistics became just as difficult to manage as those of old-school open circuit dives–even more so, arguably, due to the considerably greater distance of the staging points from the cave exit. As happens so often, overcoming one obstacle resulted in the discovery of others further down the road.

Corroded stage cylinders.

New safety concerns started to appear as well: For large-scale exploration projects, bailout cylinders needed to remain in a cave system for months at a time, sustaining severe corrosion damage at the tank neck and tank valve interface in the process due to the galvanic reaction between the chrome-plated brass valve and the aluminum cylinder. This isn’t merely a hypothetical concern: On many occasions, the corrosion was so severe that the integrity of the seal was compromised, and explorers found their previously staged bailout cylinders empty when checking them on their way into the cave. While this can be counteracted by installing a magnesium anode on the cylinder (magnesium is lower in the Galvanic series than aluminum and replaces the latter in the reaction), explorers found that the countermeasure only mitigates the issue but does not eliminate it. Long story short, for extreme extended-range dives, open circuit bailout was becoming ever more impractical and problematic.

Enter The  Bailout Rebreather

As a solution to these problems, some explorers began to do away with open circuit bailout altogether and carry a redundant rebreather system—a closed circuit rebreather, or a semi-closed rebreather (SCR) instead. While this practice has gained significant traction recently, the concept itself isn’t new. In his book Into the Unknown, famed Welsh explorer Martyn Farr reports that his German colleague, pioneering cave diver Jochen Hasenmayer, had experimented with a dual unit he dubbed the Speleo-Twin Rebreather (STR-80) as early as 1981. 

Bill Stone flying FRED outside the Wakulla Springs decompression habitat. Photo courtesy of the US Deep Caving Team

In 1987, Dr. Bill Stone delivered a proof of concept by spending 24 hours underwater on a dual CCR, he dubbed “Failsafe Rebreather for Exploration Diving” (FRED), during his visionary Wakulla Springs Project 1987. However, it appears that the first person to utilize redundant rebreathers in actual exploration was Olivier Isler from Switzerland. On August 12, 1990, he first used a triple RI2000 semi-closed unit in his crossing of the Emergence du Ressel (Doux de Coly, France), covering a distance of 1850 m/6070 ft at a maximum depth of 81 m/266 ft. The following year, Isler went on to push through the 4000 m/2.5 mi penetration barrier for the first time. More than a decade later, in 2002, Reinhard Buchaly and Michael Waldbrenner pushed the exploration of the Doux de Coly farther using dual RB80s, which were originally designed by Buchaly and continue to be produced to this day by Halcyon.

Bill Stone spent 24 hours underwater on the fully redundant Cis-Lunar Mk 1, “FRED” during the at Wakulla Springs Project 1987. Here is Stone in the Wakulla deco habitat. Photo courtesy of the US Deep Caving Team

The decision to replace open-circuit bailout with a rebreather is as obvious as it is bold: Obvious because it replicates the successful solution to a past problem and restores the ability of a diver to carry all the gas they need on their person. Bold because… well. Put yourself in the drysuit boots of a cave diver, hours and hours away from the surface, who just survived an assassination attempt by a complex piece of life support equipment. All technical aspects aside, wouldn’t it be reassuring to fall back on a less complex piece of life support equipment whose proper functioning can be ascertained reliably within a few seconds? 

Olivier Isler sporting his triple redundant RI2000 SCR at Doux de Coly. Photo courtesy of O. Isler

Expressed in numbers, a paper by Andrew Fock, Analysis of recreational closed-circuit rebreather deaths 1998-2010, published in 2013, analyzed dive accident statistics for the period from 1998 to 2010 and found that CCR diving is associated with an increase in the risk of death by a factor of up to ten compared with open circuit diving. That ratio essentially applied to CCR dives, which used open circuit bailout. Rebreather technology and diving practices certainly have improved since the time under investigation, but the fact still remains that the complexity of the equipment adds to the overall risk.

With this in mind, taking a closer look at and trying to define the specific risks and benefits of replacing open-circuit bailout with a redundant SCR or CCR seems a reasonable idea. And this is precisely what a team of authors headed by Derek B. Covington did in a recent (March 2022) research paper, asking the question, “Is more complex safer in the case of bailout rebreathers for extended range cave diving?” 

Using a qualitative approach, the authors discuss the reasoning behind bailout rebreather use, its history, different configurations and the various advantages and disadvantages and, finally, the additional potential for human error created by increasing the complexity of the equipment.

Olivier Isler at a deco stop in Doux de Coly

Bailout SCR vs. Dual CCRs

In terms of configurations, there are two main choices for a bailout rebreather: SCR or CCR. With an SCR, the diver still has to carry bailout gas. However, an SCR (such as the side-mounted Halcyon RBK) extends the use of this gas by a factor somewhere between four and ten, thereby drastically reducing the number of cylinders needed while being only the size of a single AL80 cylinder itself. Other advantages of a bailout SCR are that its relative simplicity and lack of sensors or other electronics make it much easier to set up, maintain, and use than a secondary CCR.

These advantages, however, do not come without downsides. With an SCR, the diver does not have the option of adding oxygen into the loop, and the actual oxygen content of the gas breathed is always somewhat lower than the oxygen content of the gas in the cylinders carried. How much lower exactly depends on the portion of the gas vented into the water on each operating cycle of the unit—or the rate of fresh gas supply into the unit—as well as the metabolic needs of the diver. 

Therein lies the crux: For normal operation, the amount of oxygen consumed by the diver, and thus the resulting effective composition of the breathing gas, can be calculated quite reliably. In a bailout scenario, however, it isn’t unlikely for the metabolic needs of the diver to be increased due to higher workload. Without sensors to measure PO2, the precise composition of the breathing gas in the SCR loop becomes unknown, creating a risk of hypoxia, with all the potential consequences that come with it. This risk is unique to SCRs and not present when diving open circuit (where the cylinder sticker tells us what we’re breathing) or while on a CCR (where sensors tell us what we’re breathing).

The other approach is to go for a redundant CCR, as Stone envisioned back in 1987. While seemingly the “purest” in concept—replacing like with like—and optimizing redundancy, the added complexity is significant. Everybody who owns a CCR (especially an eCCR) knows that these machines need lots of love to remain in good working condition. Now multiply that by two: twice the number of sensors, two scrubbers, two sets of primary electronics, two sets of secondary electronics … and that’s just out of the water. 

Some open water explorers are also turning to dual rebreathers. Here is RAID president Paul Toomer in blue water wearing a back mount Divesoft Liberty with a sidemount Liberty bailout. Photo courtesy of Kristof Goovaerts.

To have the redundant system available to them at all times during the dive, divers now need to manage the contents of two breathing loops instead of one. Furthermore, in order to be able to provide assistance in the event of a problem, divers working in a team need to be aware of the failure modes of and emergency procedures for not only their own units, but also the units used by their teammates. Unless everybody on the team is using the same machines for primary and bailout, this considerably adds to the training requirements, as well as to the complexity of the decision-making tree in an emergency situation. Nevertheless, by maximally reducing the required amount of gas to be carried by each diver, a redundant CCR theoretically provides the greatest degree of independence and offers the greatest potential range of exploration.

Approaches to Risk Assessment

To date, the use of dual rebreathers is still too rare for a quantitative, empirical assessment of its safety to be practical, and there is no systematic process in place for collecting data on dual-rebreather dives. “It’s really almost impossible to put a number on it,” said researcher and explorer Andy Pitkin, who co-authored the study. “I think there are only a small number of divers in the world who really need a bailout rebreather, but there are probably quite a few who use them because the idea appeals to them more than using OC bailout. Of course, there is no hard dividing line between the two groups. Where does logistical difficulty become impossible? That’s a very subjective judgment.”

The diversity of configurations and procedures used is another obstacle to objective study. “Are we using identical primary and bailout rebreathers, or is one unit specifically designed as a backup? If the latter, should the bailout unit be another CCR or an SCR? If the former, what are the diving procedures? Does the diver switch between loops at regular intervals, analogous to the procedures for independent doubles or sidemount diving? This would arguably add to task loading. Do the units have separate DSVs or a single, shared one, like that used by Richard Harris and Craig Challen of the Wet Mules? If the diver doesn’t alternate between units, then what other procedures are in place to ensure that both loops remain breathable at all times, especially during depth changes? If using dual CCRs, then what is the approach to ensuring redundancy of the diluent and oxygen supplies?”

The Wet Mules dual Megalodon CCR rebreather connected at the Bail Out Valve (BOV). Photo courtesy of Richard Harris.

The number of open questions and the range of possible, viable answers seem endless. Similar to the situation in the early days of cave diving, the book on bailout rebreathers has yet to be written. While many of the timeless principles from Sheck Exley’s famous booklet, Basic Cave Diving: A Blueprint for Survival continue to apply accordingly, there is no broad consensus yet on best practices, no SOP Manual, no standardized configuration, no published training standards for dual rebreather diving by any training agency. People are still working things out for themselves or their teams.

In consideration of these difficulties, and as a starting point for a discussion, the authors of Is more complex safer… propose a generalized approach to assessing the risks of dual-rebreather diving. Rather than delving into the minutiae of the failure modes of each individual diver’s equipment setup and diving procedures, they outline a method for identifying potential error-producing conditions (i.e., opportunities for human operators to make mistakes) based on a theoretical model originating in risk assessment for nuclear power plants: the WITH/TWIN model (Table 1). The acronym WITH stands for Workplace Design, Individual Capabilities, Task Design, Human Nature. TWIN refers to the same items (Task, Workplace, Individual, Nature).

The underlying idea of this approach is to move beyond merely looking at “human error” prima facie—oh, the diver failed to pack his scrubber properly? How could they! They neglected to monitor their PO2? Pay more attention!—and instead, analyze the conditions that are conducive to such errors. For the purposes of the model, a diver’s equipment configuration is part of their Workplace, their training and fitness belong in Individual Capabilities, the mission, including not only managing one’s gear but also navigation, linework, photography/videography, and surveying fall under Task. 

All these aspects interact with Human Nature. We get stressed when things get exciting, we get complacent when things go smoothly. We are prone to false assumptions, we are terrible at intuitive probability assessment, and our ability to pay attention falls off rapidly once the number of items that need our attention increases significantly beyond the number of voices in our heads. Much like running a nuclear power plant, excellence in cave diving isn’t achieved by sporadic strokes of genius but instead by consistently avoiding mistakes, and an important aspect of the design of equipment and procedures for either is to compensate for the inherent weaknesses of the human mind.

In the words of the study’s authors: 

“Divers and explorers need to consider not just the technical aspects of operating the dual CCR as an equipment-based system, but also the socio-technical aspects and error-producing conditions that adding additional complicated equipment has to the wider system, especially when it comes to training for and executing abnormal operations when workout levels will be high and awareness will be reduced. Nonetheless, as the use of this configuration grows, the risks and benefits will become clearer to investigators and divers alike.”

It will be exciting to observe the future development of dual-rebreather diving as it matures and see where the consensus for best practices will end up… stay tuned and stay safe!


Diving and Hyperbaric Medicine: Is more complex safer in the case of bail-out rebreathers for extended range cave diving? Derek B Covington, Charlotte Sadler, Anthony Bielawski, Gareth Lock, Andrew Pitkin

Fock AW. Analysis of recreational closed-circuit rebreather deaths 1998-2010. Diving Hyperb Med. 2013;43(2):78-85.

NSS-CDS (free download): Basic Cave Diving: A Blueprint for Survival by Sheck Exley

Dive Deeper

InDEPTH: The RB80 Semi-closed Rebreather: A Successful Exploration Tool by David Rhea

Halcyon: Using The RB80 As A Side-mounted Bailout Rebreather by Andy Pitkin, Karst Underwater Research (2018)I

InDepth: Rebreather Holiday Shopping Guide (2020)

aquaCORPS Pioneer Interviews: Stoned: Interview With Dr. William Stone (1994) by Michael Menduno

InDEPTH: Diving Beyond 250 Meters: The Deepest Cave Dives Today Compared to the Nineties by Michael Menduno and Nuno Gomes

Deep Tech: Victory At Last (1998) by John Simenon: Olivier Isler is setting penetration records with a triple-redundant semi-closed rebreather

Tim Blömeke is a cave, wreck and CCR diver who teaches in Taiwan and the Philippines. You can reach him on Facebook:, and Instagram:

Subscribe for free
Continue Reading

Thank You to Our Sponsors


Education, Conservation, and Exploration articles for the diving obsessed. Subscribe to our monthly blog and get our latest stories and content delivered to your inbox every Thursday.

Latest Features