SUBSAFE and the NASA / Navy Benchmarking Exchange CAPT(s) S. E. Iwanowicz, USN Director of Submarine Safety & Quality Assurance Naval Sea Systems Command

Agenda Origins of SUBSAFE Program Overview Origins of the NASA / Navy Benchmarking Exchange Program Questions

Origins

USS THRESHER (SSN-593) was launched in 1960. The first ship of her class the leading edge of US submarine technology: combining nuclear power with a modern hull design; including many newly-designed components and equipment. She was fast, quiet, and deep diving

While engaged in a deep test dive April 10, 1963: While engaged in a deep test dive approximately 200 miles off the northeast coast of the United States, THRESHER was lost at sea with all aboard 112 Officers and Enlisted; 17 civilians died

USS THRESHER Investigations Court of Inquiry Design Appraisal Board Congressional Committee Hearings Focus: Design Construction Operation

Investigation Results “… too far, too fast…” Deficient Specifications Deficient Shipbuilding and Maintenance Practices Incomplete or Non-Existent Records Work Accomplished Critical Materials Critical Processes Deficient Operational Procedures

Investigation Conclusions Catastrophic Flooding in the Engine Room Unable to secure from flooding Salt water spray on electrical switchboards Loss of propulsion power Unable to blow Main Ballast Tanks

Inception of SUBSAFE “the 20 December 1963 Letter” established Submarine Safety Certification Criterion Defined the basic foundation and structure of the program that is still in place today: Design Requirements Initial SUBSAFE Certification Requirements & Process Certification Continuity Requirements and Process

Purpose & Focus The purpose of the SUBSAFE Program is to provide “maximum reasonable assurance” of: Hull integrity to preclude flooding Operability and integrity of critical systems and components to control and recover from a flooding casualty

“Maximum Reasonable Assurance” Achieved by: Initial SUBSAFE Certification Each submarine meets SUBSAFE requirements upon delivery to the Navy Maintaining SUBSAFE Certification Required throughout the life of the submarine The SUBSAFE Certification status of a submarine is fundamental to its mission capability

Establishing & Maintaining SUBSAFE Certification The Triad: Audits Re-Entry Control URO/MRC Program All atop a Base of SUBSAFE Technical Requirements Maximum reasonable assurance is achieved through establishing the initial certification and then by maintaining it through the life of the submarine

SUBSAFE Program Success 1915 – 1963 16 submarines lost to non-combat causes 1915: USS F-4 (SS-23) 1917: USS F-4 (SS-20) 1920: USS H-1 (SS-28) USS S-5 (SS-110) 1923: USS O-5 (SS-66) 1926: USS S-51 (SS-162) 1927: USS S-4 (SS-109) 1939: USS SQUALUS (SS-192) 1941: USS O-9 (SS-70) 1942: USS S-26 (SS-131) USS R-19 (SS-96) 1943: USS R-12 (SS-89) 1944: USS S-28 (SS-133) 1949: USS COCHINO (SS-345) 1958: USS STICKLEBACK (SS-415) 1963: USS THRESHER (SSN-593) 1963 - Present 1 submarine lost to non-combat causes 1968: USS SCORPION (SSN-598) SCORPION was not SUBSAFE certified Loss would not have been prevented by the SUBSAFE Program NO SUBSAFE-CERTIFIED SUBMARINE HAS EVER BEEN LOST SUBSAFE Program inception after THRESHER was lost

Video The THRESHER Disaster

2. SUBSAFE Overview “trust, but verify…”

SUBSAFE Culture The SUBSAFE Program provides: a thorough and systematic approach to quality a philosophy and an attitude that permeates the entire submarine community SUBSAFE Technical Requirements: applied at design inception carried through to purchasing, material receipt, and assembly / installation examined & included at the component level, the system level, the interactions between systems, and aggregate effects (DFSs) included in maintenance / modernization and operating parameters

SUBSAFE Culture Work Discipline Material Control Documentation Knowledge / Training Compliance Material Control Correct Material Installed Correctly Documentation Design Products Objective Quality Evidence (OQE)

LOK &Training Annual NAVSEA SUBSAFE Training Provides an overview of the SUBSAFE program. Covers deficiencies and trends encountered throughout the previous years. Discusses the necessity to avoid complacency in your job and how to effectively implement long-term corrective and preventive actions to resolve problems.

LOK & Training Activity Based Training Activity-specific training plans are established to concentrate on areas that require additional attention. Activity-specific training plans are reviewed for compliance during Functional Audits. LOK assessments are performed during Functional Audits

Material Control & Documentation Objective Quality Evidence Certification is strictly based on OQE OQE is any statement of fact pertaining to the quality of a product or service based on observations, measurements, or tests which can be verified. either quantitative or qualitative OQE is defined from technical requirements Based on the integrity & responsibility of individuals OQE provides verifiable evidence that deliberate steps were taken to comply with requirements

Trust, but Verify SUBSAFE Audits SUBSAFE Certification Audits review the Objective Quality Evidence associated with an individual ship to ensure that the material condition of that specific submarine is satisfactory for sea trial and unrestricted operations SUBSAFE Functional Audits review the policies, procedures, and practices used by activities to perform SUBSAFE work to ensure that they comply with SUBSAFE requirements

Vertical Audits & Horizontal Audits An intensive examination of the documentation that was used to SUBSAFE certify components from receipt through final installation. Horizontal Audit: the parts equaling the whole In SUBSAFE Certification Audits specific areas of the SUBSAFE boundary are audited. Examples are, Hull Structure, Piping, Testing, Configuration Management, etc. The results of auditing these specific areas provides an overall picture of the work performed on a specific hull.

SUBSAFE Culture The SUBSAFE program relies upon recruiting, training, and retaining highly qualified people who are held personally accountable and responsible for safety In the SUBSAFE program, complacency is addressed by: Performing periodic rigorous audits of all SUBSAFE Activities & Products Maintaining command level visibility Maintaining the independent authority of the SUBSAFE Program Director – accountable for safety, not cost or schedule

Main Points The SUBSAFE Program permeates all levels of the submarine community: the Fleet, shipbuilders, maintenance providers, NAVSEA, Operational Commanders, etc. They believe in it and understand it. Oversight and enforcement of Program tenets are vital to continued success The entire program is based on personal responsibility & personal accountability - without it, you are lost Compliance verification & OQE are fundamental to certification for URO Talented dedicated people & good training are key Vigilance, vigilance, vigilance – FIGHT COMPLACENCY The more complex a system, the more assurance you need Team effort & x-pollination pay big dividends Continual assaults on the Program from real-world constraints The real challenge is to properly manage the non-conformances

3. Origins of the NASA / Navy Benchmarking Exchange Program

NNBE Beginnings NASA/Navy Benchmarking Exchange (NNBE) initiated by NASA Administrator letter to Secretary of the Navy dated 13 Jun 02 Purpose: identify practices and procedures and share lessons learned in NASA’s human space flight program and the Navy’s submarine program Focus: safety and mission assurance policies, processes, accountability, and control measures

Similarities Extreme environments High energy systems Required integration of complex systems in highly complex vehicles. Highest levels of safety & reliability must be maintained for craft to perform their missions, often over long periods of time. Design, testing, operation, and maintenance of the craft require firm technical basis and compliance verification. Critical systems exist whose failure or lack of operation will have catastrophic consequences.

Differences Operating environments Cultural environments Degrees of reliance on evolution and legacy of design Weight and volume criticalities Safety and mission assurance requirements management Verification and compliance approaches

NNBE Audits & Projects Program MOA signed 15 Feb 05 Reciprocal rights to participate in audits & projects Conducted at the invitation of the party of the program or project Provides a learning opportunity for each party

MOA between NAVSEA and NASA Responsibilities: NAVSEA to provide opportunity for NASA participation in audits Provide read ahead material, on-site space, establish number of participants NASA to provide opportunities for Navy participation in review and assessment of NASA Engineering and QA audits Headquarters-led institutional and programmatic audits MOA reviewed every two years for the purpose of Reaffirming organizational commitment Share lessons learned to strengthen each others audit objectives

NNBE Scope NNBE team to closely examined two aspects of submarine safety New design / construction (initial certification) Maintenance & Modernization (sustaining certification) Major Themes Management & Organization Safety Requirements (technical and administrative) Safety Implementation Processes Safety Compliance Verification Processes Safety Certification Processes

Phase 1 NASA learns about the Navy Visits & activities coordinated by NAVSEA 07Q: NAVSEA HQ NAVSEA 08 Brief (1 Oct 02) SUBSAFE Working Group (17 Sept 02) PMS450 NAVSEA 05 PMS392 SUPSHIP GROTON SSFA (23 Sept 02) EB CORP (16 Oct 02) PNSY (21Oct 02) SUBMEPP (22 Oct 02) SHAPEC (23 Oct 02) NAVSEALOGCEN (23 Oct 02)

Key Observations of SUBSAFE Processes Excerpts from NNBE reports: Clearly documented and achievable safety requirements, with minimal use of waivers or tailoring A centralized technical authority and a large operational experience base facilitate continuous learning and improvement in design, manufacturing, and operations. Enables evolutionary design (from one ship class to next) Requirements implemented through capable and carefully controlled processes

Key Observations of SUBSAFE Processes Compliance is verified through rigorous in-line management control and assurance processes Compliance is also verified independently of program management by a separate compliance verification organization Strong submarine community-wide safety culture with emphasis (training & awareness) on understanding and learning from past failures

Phase 2 Navy learns about NASA Visits coordinated by NASA office of Safety & Mission Assurance: NASA HQ (5 Nov 02) Johnson Space Center (JSC-1) (5 Nov 02) Kennedy Space Center (KSC-1) (7 Jan 03) Observed Flight Readiness Review for COLUMBIA launch (9 Jan 03)

The bitterness of poor quality lingers long after the sweetness of meeting a schedule is forgotten

4. Questions