In SUBSAFE

The leaders in SUBSAFE describe other benefits beyond preventing the loss of critical assets. Because those operating the submarines have complete confidence... 

These fundamentals, coupled with a questioning attitude and what those in SUBSAFE term a chronic uneasiness, are credited for SUBSAFE success. The fundamentals are taught and embraced throughout the submarine community. The members of this community believe that it is absolutely critical that they do not allow themselves to drift away from the fundamentals. 

AccountabUity is important in SUBSAFE and the ITA is held accountable for exercising these responsibilities. 

Compliance verification in SUBSAFE is treated as a process, not just one step in a process or program. The Navy demands that each Navy facility participate fully in the process, including the use of inspection, surveillance, and audits to confirm their own compliance. Audits are used to verily that this process is working. They are conducted either at fixed intervals or when a specific condition is found to exist that needs attention. 

This complacency factor is so common that any system safety effort must include ways to deal with it. SUBSAFE, the US. nuclear submarine safety program, has been particularly successful at accomplishing this goal. The SUBSAFE program is described in chapter 14. 

Is such a hard line approach impractical SUBSAFE, the US. nuclear submarine safety program established after the Thresher loss, described in chapter 14, has not allowed waiving the SUBSAFE safety requirements for more than forty-five years, with one exception. In 1967, four years after SUBSAFE was established, SUBSAFE requirements for one submarine were waived in order to satisfy pressing Navy performance goals. That submarine and its crew were lost less than a year later. The same mistake has not been made again. 

The experience in the nuclear submarine community is a testament to the fact that such dynamics can be overcome. The SUBSAFE program (described in the next chapter) was established after the loss of the Thresher in 1963. Since that time, no submarine in the SUBSAFE program, that is, satisfying the SUBSAFE requirements, has been lost, although such losses were common before SUBSAFE was established. 

This book is filled with examples of accidents and of what not to do. One possible conclusion might be that despite our best efforts accidents are inevitable in complex systems. That conclusion would be wrong. Many industries and companies are able to avoid accidents the nuclear Navy SUBSAFE program is a shining example. By any measure, SUBSAFE has been remarkably successful In nearly fifty years since the beginning of SUBSAFE, no submarine in the program has been lost. 

Looking at a successful safety program and trying to understand why it has been successful can be very instructive. This chapter looks at the history of the program and what it is, and proposes some explanations for its great success. SUBSAFE also provides a good example of most of the principles expounded in this book. 

One loss did occur in 1968—the USS Scorpion—hnX. it was not SUBSAFE certified. In a rush to get Scorpion ready for service after it was scheduled for a major overhaul in 1967, the Chief of Naval Operations allowed a reduced overhaul process and deferred the required SUBSAFE inspections. Ihe design changes deemed necessary after the loss of Thresher were not made, such as newly designed central valve control and emergency blow systems, which had not operated properly on Thresher. Cold War pressures prompted the Navy to search for ways to reduce the duration of overhauls. By not following SUBSAFE requirements, the Navy reduced the time Scorpion was out of commission. 

In addition, the high quality of the submarine components required by SUBSAFE, along with intensified structural inspections, had reduced the availability of critical parts such as seawater piping [8], A year later, in May 1968, Scorpion was lost at sea. Although some have attributed its loss to a Soviet attack, a later investigation of the debris field revealed the most likely cause of the loss was one of its own torpedoes exploding inside the torpedo room [8]. After the Scorpion loss, the need for SUBSAFE was reaffirmed and accepted. 

The rest of this chapter outlines the SUBSAFE program and provides some hypotheses to explain its remarkable success. The reader will notice that much of the program rests on the same systems thinking fundamentals advocated in this book. 

A decision was made in 1963 to concentrate the SUBSAFE program on the essentials, and a program was designed to provide maximum reasonable assurance of two things ... 

SUBSAFE requirements, as documented in the SUBSAFE manual, permeate the entire submarine community. These requirements are invoked in design, construction, operations, and maintenance and cover the following aspects of submarine development and operations ... 

In addition to the technical and managerial risk management fundamentals listed earher, SUBSAFE also has cultural principles built into the program ... 

In 1963, a SUBSAFE certification boundary was defined. Certification focuses on the structures, systems, and components that are critical to the watertight integrity and recovery capability of the submarine. 

At some point near the end of the new construction period, usually lasting five or so years, every submarine obtains its initial SUBSAFE certification. This process is very formal and preceded by scrutiny and audit conducted by the shipbuilder, the supervising authority, and finally, by a NAVSEA Certification Audit Team assembled and led by the Office of Safety and Quality Assurance at NAVSEA. The initial certification is in the end granted at the flag officer level. 

The second process, the Unrestricted Operations Maintenance Requirements Card (URO MRC) program, involves periodic inspections and tests of critical items to ensure they have not degraded to an unacceptable level due to use, age, or environment. In fact, URO MRC did not originate with SUBSAFE, but was developed to extend the operating cycle of USS Queenflsh by one year in 1969. It now provides the technical basis for continued unrestricted operation of submarines to test depth. 

Responsibility assignments in the SUBSAFE compliance control structure. 

The audit philosophy is part of the reason for SUBSAFE success. Audits are treated as a constructive, learning experience. Audits start from the assumption that policies, procedures, and practices are in compliance with requirements. The goal of the audit is to confirm that compliance. Audit findings must be based on a clear violation of requirements or must be identified as an operational improvement. ... 

One lesson learned has been that developing a robust compliance verification program is difficult. Along the way they learned that (1) clear ground rules for audits must be established, communicated, and adhered to (2) it is not possible to audit in requirements and (3) the compliance verification organization must be equal with the program managers and the technical authority. In addition, they determined that not just anyone can do SUBSAFE work. The number of activities authorized to perform SUBSAFE activities is strictly controlled. 

SUBSAFE believes that lessons learned are integral to submarine safety and puts emphasis on problem reporting and critiques. Significant problems are defined as those that affect ship safety, cause significant damage to the ship or its equipment, delay ship deployment or incur substantial cost increase, or involve severe personnel injury. Trouble reports are prepared for all significant problems encountered in the construction, repair, and maintenance of naval ships. Systemic problems and issues that constitute significant lessons learned for other activities can also be identified by trouble reports. Critiques are similar to trouble reports and are utilized by the fleet. 

Can the SUBSAFE principles be transferred from the military to commercial companies and industries The answer lies in why the program has been so effective and whether these factors can be maintained in other implementations of the principles more appropriate to non-military venues. Remember, of course, that private contractors form the bulk of the companies and workers in the nuclear Navy, and they seem to be able to satisfy the SUBSAFE program requirements. The primary difference is in the basic goals of the organization itself. 

Some factors that can be identified as contributing to the success of SUBSAFE, most of which could be translated into a safety program in private industry are ... 

Continual feedback and improvement. When something does not conform to SUBSAFE specifications, it must be reported to NAVSEA headquarters along with the causal analysis (including the systemic factors) of why it happened. Everyone at every level of the organization is wilhng to examine his or her role in the incident. 

One of O Keefe s initiatives was a benchmarking study comparing the safety organizations and culture of the shuttle program with those at the Navy Subsafe program. In the interim report of December 20, 2002, about six weeks before the Columbia accident, O Keefe s charter letter to the team discussed the need to... 

---