The panel above your head snaps open and four yellow cups drop on clear plastic tubes. Somewhere in the cabin a bag rustles. Within a minute or two, passengers start to notice a smell — hot metal, a hint of something scorched, the sort of smell that in any other enclosed space would be a reason to get out.

Nothing is wrong. That smell is the system working exactly as designed. Directly above the seat, inside a stainless steel tube roughly the size of a thermos, a chemical reaction is burning its way through a core of sodium chlorate at a case temperature the manufacturers cap at 500 degrees Fahrenheit. It cannot be turned down, paused or switched off. It will run until the core is gone.

That device is a chemical oxygen generator, and it is the least understood object on a commercial aircraft. It also answers the question passengers ask most often about the masks: how long does the oxygen actually last? The number is smaller than most people assume, and the reason it is enough has almost nothing to do with the mask.

What is actually inside the yellow cup

The mask itself has barely changed since the late 1950s. The FAA’s Civil Aerospace Medical Institute went looking for a reason to redesign it in 2021 and concluded there was not one. Its report put the point neatly: the yellow Dixie-Cup mask “has changed little since the late 1950s, but its deceptively simple appearance belies a well-thought-out design.”

What looks like a paper cup on a tube is a three-valve breathing machine. Oxygen flows continuously from the generator into a reservoir bag that sits between the tubing and the facepiece. The bag fills through the whole breathing cycle — inhaling, exhaling, and the pauses in between. When you breathe in, a one-way check valve opens and the concentrated oxygen in that bag goes first, which puts it deep in the lungs where gas exchange actually happens.

If the bag runs out before your breath is finished, a second valve opens and lets ordinary cabin air in, so you get a full breath rather than the panic of a mask that suddenly stops giving. A third valve dumps everything you exhale overboard. Nothing you breathe out goes back into the bag.

The design is a compromise, and a deliberate one. Carrying enough compressed oxygen to give several hundred passengers pure oxygen for half an hour would cost an airline a great deal of weight and volume. Phase dilution buys most of the benefit for a fraction of the mass, by spending the concentrated oxygen only at the moment in the breath when it does the most good.

The generator is a small controlled fire above your head

Pull the mask and a lanyard yanks a retaining pin. A spring-loaded striker hits a percussion cap loaded with lead styphnate and tetracene. That tiny charge heats the core past its decomposition temperature and the reaction starts.

The NTSB described the chemistry in its ValuJet investigation: the oxidiser core is sodium chlorate, mixed with less than 5 per cent barium peroxide and less than 1 per cent potassium perchlorate. The FAA’s own fire research adds the part the NTSB left out — the core also contains iron particles, the fuel that keeps the decomposition front moving. Sodium chlorate breaks down into ordinary table salt and free oxygen.

And it does so hot. The NTSB is blunt about it.

An Alaska Airlines maintenance work card quoted in the same report translates that into the language mechanics actually use: unexpended generators “generate case temperatures in excess of 500 degrees F. (260 degrees C.),” and if one starts firing in your hands, put it on something that will not burn. The manufacturer’s own label is shorter still. It reads, in capitals: THIS UNIT GETS HOT.

That is what passengers are smelling. A UK Air Accidents Investigation Branch bulletin on an Airbus A320 over the English Channel in June 2000 recorded passengers “disturbed by… the pungent smell created by the hot canisters,” and noted that the heat and the burning smell are simply what the device does. After a similar case in 1995 the AAIB recommended that crews be told to warn passengers about the smell as soon as the masks drop, precisely so that nobody concludes the aircraft is on fire.

There is no valve, no controller and no off switch. Oxidiser and fuel are intimately mixed in one solid core, so there is nothing to starve and nothing to close. Northwest Airlines put it to US regulators in terms that made it into the Federal Register: unlike a cylinder, a generator provides its own heat source and, once initiated, releases an uncontrolled flow of oxygen. Maintenance manuals treat this as a one-way door — a generator is not to be disposed of until it has been fired and its core fully expended.

Twelve to twenty minutes — and why that is enough

Here is the number everyone wants. The FAA’s 2021 mask study states it plainly: the decomposition “produces a continuous flow of nearly 100% oxygen for approximately 12 to 20 minutes, depending on the type and size of the generator installed.” Safran, which has built more than 1.3 million of these units, sells a generator it simply calls the 12-minute model, certified for the Boeing 737, 757 and 767. The NTSB found that some MD-80 generators ran 18 to 20 minutes against a 15-minute manufacturer minimum.

Twelve minutes sounds alarmingly short for an aircraft seven miles above the ocean. It is not, because the mask was never meant to keep you alive at altitude. It is meant to keep you conscious while the altitude goes away.

A jet losing pressurisation at cruise does not stay there. The crew rolls into a rapid descent and aims to be at 10,000 feet, where the air is breathable without help, in the order of ten minutes. The regulation that sizes the flight crew’s own supply assumes exactly that profile: 14 CFR 121.333(b) defines the required two hours as the oxygen needed for “a constant rate of descent from the airplane’s maximum certificated operating altitude to 10,000 feet in ten minutes and followed by 110 minutes at 10,000 feet.”

Twelve to twenty minutes of generator, against a ten-minute descent. The margin is thin but it is deliberate, and it is sized against the one manoeuvre that actually solves the problem.

The bag that does not inflate

This is the single most common misreading of the system, and it has a documented history. In the mid-1970s the NTSB looked into a run of rapid decompressions on DC-10s and L-1011s and found passengers and cabin crew concluding the equipment had failed, because the reservoir bag never puffed up. Many, the FAA later recorded, “were unaware that 10 to 15 seconds must elapse after generator activation for sufficient oxygen flow to fill the bag.”

The FAA’s advice today is unambiguous, and it is worth reading twice before your next flight.

A flat bag at a modest cabin altitude is the system behaving correctly: lower flow, higher ambient pressure, less visible inflation. The industry’s answer to the confusion was not a bigger bag but a small in-line flow indicator on the tubing that turns green when oxygen is moving — positioned, as the FAA notes, at roughly eye level for a standing flight attendant walking the aisle.

Three things the mask will not do

It is not 100 per cent oxygen. The certification standard it is built to, SAE AS8025 via FAA TSO-C64, describes a continuous-flow, phase-dilution mask. Dilution is in the name. The generator produces near-pure oxygen; what reaches your lungs is that oxygen plus whatever cabin air the ambient valve lets in at the end of the breath. The FAA report declines to publish a delivered percentage at all, on the grounds that suppliers treat the detail as proprietary, so anyone quoting you a precise figure is guessing.

It is not smoke protection. This is the most dangerous misunderstanding, because the instinct in a smoke-filled cabin is exactly wrong. The FAA states it directly: the mask “is not intended to provide fire/smoke/fume protection due to the inhalation valve that permits the flow of ambient air, including potential smoke and fumes.” The valve that stops you suffocating in a decompression is the same valve that will feed you smoke in a fire. Investigators found the problem from the other direction too — after an uncontained engine failure at Chicago in 2016 and another at Las Vegas in 2015, passengers became combative when crews did not drop the masks, slowing the evacuation.

It does not work above about 40,000 feet. The design is explicitly a get-me-down device rated for hypoxia protection to 40,000 feet. Above that, useful protection requires pure oxygen delivered under positive pressure, which is what military aircrew and U-2 pilots wear pressure suits for. Not coincidentally, at 40,000 feet the FAA puts the time of useful consciousness at under ten seconds — “essentially the time it takes the blood to circulate from the lungs to the brain.”

Why the crew gets two hours and you get twelve minutes

The asymmetry is not favouritism. The flight crew has to keep flying, and a pilot who is merely conscious is not good enough. So their equipment is a different class of thing entirely: a diluter-demand or pressure-demand mask fed from the aircraft’s own oxygen supply, delivering on demand rather than in a continuous dribble, and sized for two hours.

It also has to go on faster than yours. 14 CFR 25.1447(c)(2) requires that a flight crew quick-donning mask can be taken from its ready position, secured, sealed and supplying oxygen “with one hand, within five seconds and without disturbing eyeglasses or causing delay in proceeding with emergency duties” — while still allowing normal radio communication.

Cabin crew sit in a third category. Above flight level 250 they need portable equipment with a 15-minute supply, or enough distributed outlets that oxygen is immediately available wherever in the cabin they happen to be. Fifteen minutes is enough to move down the aisle helping passengers during the descent, which is precisely what it is for.

Two other details in 25.1447 are worth knowing as a passenger. There must be at least 10 per cent more masks and outlets than seats, uniformly distributed — so if your unit fails there is spare capacity nearby, and so a lap infant has somewhere to breathe. And each lavatory gets at least two units, because being in the toilet during a decompression is a foreseeable problem rather than a joke.

The 110 people who proved the generator was dangerous

On 11 May 1996 at 1413:42 eastern daylight time, a Douglas DC-9-32 registered N904VJ crashed into the Florida Everglades about ten minutes after leaving Miami for Atlanta. It was ValuJet flight 592. Both pilots, three flight attendants and 105 passengers were killed, 110 people in all.

In the forward cargo hold were five boxes of chemical oxygen generators, removed from two MD-80s undergoing maintenance at a contract facility and shipped back as company material. They were expired. Crucially, they had not been fired, which meant every one still held a live core and a live ignition train. The safety caps that stop the percussion cap being struck were not fitted — the facility had never done the job before and did not stock them. Several lanyards were loose. The boxes were padded with bubble wrap.

The shipping ticket described the contents as “Oxy Cannisters [sic] – ‘Empty’.” The receiving clerk had seen green repairable tags on them and assumed green meant empty. It meant expired.

A DC-9 forward hold was a Class D compartment, designed to put a fire out by starving it of oxygen. That logic fails completely when the cargo is an oxygen generator. The NTSB said so in its finding: some cargo, specifically oxidisers, “can generate sufficient oxygen to support combustion in the reduced ventilation environment of a class D cargo compartment.” There was no smoke detector and no suppression system, and neither was required.

At the FAA’s fire test facility that November, investigators packed boxes of generators around a tyre in an instrumented cargo compartment and pulled a pin. Within about eleven and a half minutes the temperature at the ceiling exceeded the range of the instruments, above 3,200 °F. Aluminium burns through at around 1,000 °F.

The most uncomfortable part of the report is that none of this was new. After a 1988 in-flight fire the NTSB had asked the FAA to require fire and smoke detection and extinguishing in all Class D compartments. In August 1993 the FAA replied that compliance would cost more than $350 million, did not meet the cost-benefit criteria, and that rulemaking would be terminated. The Board closed both recommendations “Closed — Unacceptable Action” that October, two and a half years before Miami.

Afterwards the rules moved fast. Within thirteen days generators were barred from passenger aircraft as cargo; by the end of 1996 that extended to all oxygen generators; and Class D was eliminated from the certification standards altogether, with roughly 2,800 aircraft converted to Class C by March 2001. Today 49 CFR 173.168 states it flatly: a chemical oxygen generator is forbidden for transportation aboard a passenger-carrying aircraft.

How often do the masks really drop?

Rarely, and almost never fatally. In support of a 2013 rulemaking the FAA identified roughly 2,800 occasions over 40 years on which supplemental oxygen was needed — about seventy a year across the entire US fleet — and, in the agency’s own words, “there was no reported loss of life due to lack of oxygen.”

A fair share of those deployments are not decompressions at all. The image above is an accidental drop during boarding; the masks in this article’s header came down the same way on a Delta 737-900. Once a panel opens, the generators have not fired — the pull does that, not the drop — but every mask hanging in the aisle is now one tug from a 500-degree reaction, which is why cabin crew treat a spurious deployment as a maintenance event rather than an inconvenience.

Generators have not vanished, either. Chemical units remain standard across the Boeing 737, 747, 757, 767 and 777 and across most of the Airbus range including the A320 family, the A330 and the A350. The Boeing 787 is the notable exception, using compressed gaseous cylinders at each passenger service unit. One category has been deliberately emptied: since 2011, lavatory oxygen generators on the US fleet have been rendered inoperative on security grounds. Anyone in the toilet during a decompression has to get to a seat.

So: twelve to twenty minutes, burning hot, impossible to stop, delivering diluted oxygen through a fifty-year-old design that the FAA looked hard at and decided not to change. It sounds like a compromise because it is one. It has also never, on the published record, failed to keep anybody alive.

Sources: FAA Civil Aerospace Medical Institute, Passenger Oxygen Mask Design Study (DOT/FAA/AM-21/11, March 2021); NTSB Aircraft Accident Report AAR-97/06, ValuJet flight 592; 14 CFR 25.1447, 25.1443, 121.333 and 49 CFR 173.168 via the eCFR; FAA technical notes DOT/FAA/AR-TN98/32 and AR-TN03/35; US Chemical Safety Board Safety Advisory 2007-I-NC-01-SA; PHMSA final rule 72 FR 4442; UK AAIB Bulletin 7/2002; Safran Aerosystems and Collins Aerospace product documentation.