SUBSAFE

This complacency factor is so common that any system safety effort must include ways to deal with it. SUBSAFE, the US. nuclear submarine safety program, has been particularly successful at accomplishing this goal. The SUBSAFE program is described in chapter 14. 

Is such a hard line approach impractical SUBSAFE, the US. nuclear submarine safety program established after the Thresher loss, described in chapter 14, has not allowed waiving the SUBSAFE safety requirements for more than forty-five years, with one exception. In 1967, four years after SUBSAFE was established, SUBSAFE requirements for one submarine were waived in order to satisfy pressing Navy performance goals. That submarine and its crew were lost less than a year later. The same mistake has not been made again. 

The experience in the nuclear submarine community is a testament to the fact that such dynamics can be overcome. The SUBSAFE program (described in the next chapter) was established after the loss of the Thresher in 1963. Since that time, no submarine in the SUBSAFE program, that is, satisfying the SUBSAFE requirements, has been lost, although such losses were common before SUBSAFE was established. 

The leaders in SUBSAFE describe other benefits beyond preventing the loss of critical assets. Because those operating the submarines have complete confidence... 

This book is filled with examples of accidents and of what not to do. One possible conclusion might be that despite our best efforts accidents are inevitable in complex systems. That conclusion would be wrong. Many industries and companies are able to avoid accidents the nuclear Navy SUBSAFE program is a shining example. By any measure, SUBSAFE has been remarkably successful In nearly fifty years since the beginning of SUBSAFE, no submarine in the program has been lost. 

Looking at a successful safety program and trying to understand why it has been successful can be very instructive. This chapter looks at the history of the program and what it is, and proposes some explanations for its great success. SUBSAFE also provides a good example of most of the principles expounded in this book. 

I am particularly grateful to Rear Admiral Walt Cantrell, A1 Ford, and Commander Jim Hassett for their insights on and information about the SUBSAFE program. 

SUBSAFE was established just fifty-four days after the loss of Thresher. It was created on June 3,1963, and the program requirements were issued on December 20 of that same year. Since that date, no SUBSAFE-certified submarine has ever been lost. 

One loss did occur in 1968—the USS Scorpion—hnX. it was not SUBSAFE certified. In a rush to get Scorpion ready for service after it was scheduled for a major overhaul in 1967, the Chief of Naval Operations allowed a reduced overhaul process and deferred the required SUBSAFE inspections. Ihe design changes deemed necessary after the loss of Thresher were not made, such as newly designed central valve control and emergency blow systems, which had not operated properly on Thresher. Cold War pressures prompted the Navy to search for ways to reduce the duration of overhauls. By not following SUBSAFE requirements, the Navy reduced the time Scorpion was out of commission. 

In addition, the high quality of the submarine components required by SUBSAFE, along with intensified structural inspections, had reduced the availability of critical parts such as seawater piping [8], A year later, in May 1968, Scorpion was lost at sea. Although some have attributed its loss to a Soviet attack, a later investigation of the debris field revealed the most likely cause of the loss was one of its own torpedoes exploding inside the torpedo room [8]. After the Scorpion loss, the need for SUBSAFE was reaffirmed and accepted. 

The rest of this chapter outlines the SUBSAFE program and provides some hypotheses to explain its remarkable success. The reader will notice that much of the program rests on the same systems thinking fundamentals advocated in this book. 

No SUBSAFE certified submarine has been lost since 1963... 

A decision was made in 1963 to concentrate the SUBSAFE program on the essentials, and a program was designed to provide maximum reasonable assurance of two things ... 

SUBSAFE requirements, as documented in the SUBSAFE manual, permeate the entire submarine community. These requirements are invoked in design, construction, operations, and maintenance and cover the following aspects of submarine development and operations ... 

SUBSAFE is founded on a basic set of risk management principles, both technical and cultural. These fundamentals are ... 

These fundamentals, coupled with a questioning attitude and what those in SUBSAFE term a chronic uneasiness, are credited for SUBSAFE success. The fundamentals are taught and embraced throughout the submarine community. The members of this community believe that it is absolutely critical that they do not allow themselves to drift away from the fundamentals. 

In addition to the technical and managerial risk management fundamentals listed earher, SUBSAFE also has cultural principles built into the program ... 

SUBSAFE separation of powers ( three-legged stool ). 

SUBSAFE has created a unique management structure they call separation of powers or, less formally, the three-legged stool (figure 14.2). This structure is the cornerstone of the SUBSAFE program. ResponsibUify is divided among three distinct entities providing a system of checks and balances. 

AccountabUity is important in SUBSAFE and the ITA is held accountable for exercising these responsibilities. 

This management structure only works because of support from top management. When Program Managers complain that satisfying the SUBSAFE requirements will make them unable to satisfy their program goals and deliver new submarines, SUBSAFE requirements prevail. 

In 1963, a SUBSAFE certification boundary was defined. Certification focuses on the structures, systems, and components that are critical to the watertight integrity and recovery capability of the submarine. 

Certification is also strictly based on what the SUBSAFE program defines as Objective Quality Evidence (OQE). OQE is defined as any statement of fact, either quantitative or qualitative, pertaining to the quality of a product or service, based on observations, measurements, or tests that can be verified. Probabilistic risk assessment, which usually cannot be verified, is not used. 

Each of these certification elements is defined by detailed, documented SUBSAFE requirements. 

At some point near the end of the new construction period, usually lasting five or so years, every submarine obtains its initial SUBSAFE certification. This process is very formal and preceded by scrutiny and audit conducted by the shipbuilder, the supervising authority, and finally, by a NAVSEA Certification Audit Team assembled and led by the Office of Safety and Quality Assurance at NAVSEA. The initial certification is in the end granted at the flag officer level. 

After the submarine enters the fleet, SUBSAFE certification must be maintained through the life of the slip. Three tools are used the Reentry Control (REC) Process, the Unrestricted Operations Maintenance Requirements Card (URO MRC) program, and the audit program. 

The Reentry Control (REC) process carefully controls work and testing within the SUBSAFE boundary, that is, the structures, systems, and components that are critical to the watertight integrity and recovery capability of the submarine. The purpose of REC is to provide maximum reasonable assurance that the areas disturbed have been restored to their fully certified condition. The procedures used provide an identifiable, accountable, and auditable record of the work performed. 

Compliance verification in SUBSAFE is treated as a process, not just one step in a process or program. The Navy demands that each Navy facility participate fully in the process, including the use of inspection, surveillance, and audits to confirm their own compliance. Audits are used to verily that this process is working. They are conducted either at fixed intervals or when a specific condition is found to exist that needs attention. 

---