1. EUR2013 High Reliability Conference 1 Ralph T. Soule, Captain, US Navy, retired Division Director Aircraft Carrier Test, Evaluation, and Certification Naval Sea Systems Command ralph.soule@gmail.com www.ralphsoule.com High Reliability from Disaster DISTRIBUTION STATEMENT A: Approved for public release; distribution is unlimited.

2. Presentation Name EUR2013 High Reliability Conference 2 Risks of Submarine Operations Risks Designers Can/Cannot Control Case Study: THRESHER Risks to Ships of Industrial Operations Firefighting Aboard Ship is Complex Case Study: MIAMI 2

3. Presentation Name EUR2013 High Reliability Conference  Laid down, 28 May 1958, at Portsmouth Naval Shipyard, Kittery, ME.  Launched on 9 July 1960.  13 th nuclear powered attack submarine.  The first ship of its Class; leading edge of US submarine technology:  combining nuclear power with modern hull design  newly-designed equipment and components 3 USS THRESHER (SSN-593) USS THRESHER launching ceremonies at the Portsmouth Naval Shipyard, Kittery, Maine, 9 July 1960. Ship was fast, quiet, and deep diving

4. Presentation Name EUR2013 High Reliability Conference 4 Submerging and surfacing Navigation under the water Resistance to sea pressure Fire and flooding 4 Question: What risks of normal operations can designers control?

5. Presentation Name EUR2013 High Reliability Conference 5 Crew training Compliance with procedures Worker attitudes and responsibility Equipment maintenance performance What problems are worthy of attention 5 Question: What risks of normal operations are beyond the designers' control?

6. Presentation Name EUR2013 High Reliability Conference 6 How people respond to problems How people communicate risks and problems Supplier conformance to specifications Shipyard conformance to specifications Material performance under operations (does it behave the way you assumed?) 6 Question: What risks of normal operations are beyond leaders' control? (or are they?)

7. Presentation Name EUR2013 High Reliability Conference 7 Background Piping systems cannot be made of single pieces, connections (joints) must be leak free Ship is in overhaul Other ships in the same shipyard, all competing for the same resources Much pressure to complete the overhaul on time 145 critical piping joints being inspected (of more than 3000) 7 USS THRESHER Case Study

8. Presentation Name EUR2013 High Reliability Conference 8 Problem – Some pipe joints do not meet standard Inspections show that about 14 percent of the sea water piping joints checked require repair or replacement. 8 USS THRESHER Case Study

9. Presentation Name EUR2013 High Reliability Conference 9 What to do? Inspect more joints Disassemble joints to understand failures Analyze which assumptions of original design were wrong and why Change/test fabrication procedures Report failure/unexpected results to higher authority Inspect other ships to gather more data Document what went wrong and what you learned 9 USS THRESHER Case Study

10. On April 10, 1963, while engaged in a deep test dive, approximately 200 miles off the northeastern coast of the United States, the U.S.S. THRESHER (SSN-593), was lost at sea with all persons aboard - 112 naval personnel and 17 civilians. THRESHER wreckage: About 200 miles off Cape Cod in 8,400 ft of water PNSY

11. Presentation Name EUR2013 High Reliability Conference 11 Investigation Conclusions 11 Loss of propulsion power Flooding in the engine room Unable to secure from flooding Spray on electrical switchboards Unable to blow ballast tanks

12. Presentation Name EUR2013 High Reliability Conference 12 SUBSAFE PROGRAM LOSS of THRESHER Overhaul/Construction MAINTENANCE PROCESS CHANGES Navy Response: SUBSAFE and Significant Culture Change

13. USS MIAMI Case Study Background USS MIAMI (SSN 755) 2012 – US Navy Nuclear-powered Attack Submarine – In month 2 of a 20 month overhaul – Location: Portsmouth Naval Shipyard (PNSY), Maine Ship was in dry dock Crew had moved off the ship All weapons removed Many spaces empty of personnel Reactor shut down 13 EUR2013 High Reliability Conference www.ralphsoule.com

14. Question: Risks of Submarine Overhaul? Fire (sources?) Flooding, sinking Explosion Many personnel risks – Electric shock – Falls – Dropping heavy things – Lack of breathable air 14 EUR2013 High Reliability Conference www.ralphsoule.com

15. If a Fire Occurred, What Makes Response Challenging? Normal ship systems disabled Firefighting equipment and crew removed from ship Shipyard firefighters not familiar with ship Many support hoses and cables complicate access Ship compartments small Hard to locate fire 15 EUR2013 High Reliability Conferencewww.ralphsoule.com

16. Fire Location Fire Initiation Site 16 EUR2013 High Reliability Conferencewww.ralphsoule.com

17. Fire Event Major fire occurred in forward ship section – Date: 23 May 2012, ~1730 hrs – Duration of fire: over 10 hours – Cause: Arson – Initial Source: Combustible material – Damage: > $750M US estimate to repair, but submarine will be scrapped instead 17

18. Example of Damage 18 EUR2013 High Reliability Conference www.ralphsoule.com

19. MIAMI Lessons Learned Breathing air canister capacity insufficient Too much combustible material present Shipyard and ship’s crew had not rehearsed response sufficiently 19 EUR2013 High Reliability Conference www.ralphsoule.com

20. MIAMI Lessons Learned Industrial environment complicates fire and response. – Crew firefighting equipment removed – Hull cut provided air to feed the fire – Hatches and temporary services complicated access by emergency responders Early detection and rapid response extremely important – Fire set in remote location – Heavy black smoke confused early reports of location Command structure inadequate for complex, extended firefighting – 20 mutual aid fire departments augmented shipyard resources – Need integrated Command structure, interoperable radios, and coordinated fire fighting strategy 20 EUR2013 High Reliability Conferencewww.ralphsoule.com

21. Questions 21 EUR2013 High Reliability Conferencewww.ralphsoule.com

22. 22

23. 23

24. 24

25. 25

26. 26

27. 27

28. 28

29. 29

30. BACK-UP SLIDES 30

31. Getting it Wrong

32. Presentation Name EUR2013 High Reliability Conference Navy Response to Loss of USS THRESHER  Immediately limited diving depth of all submarines  Court of Inquiry  THRESHER Design Appraisal Board  Focus:  Design  Construction  Operation  Testimony Before Congress 32

33. Bierly and Spender (1995). Culture and High Reliability Organizations: The Case of the Nuclear Submarine. Journal of Management: Vol. 21, no. 4, pp. 639-656. Holzmann, Mischari, Goldberg, and Ziv (2012). New tools for learning: a case of organizational problem analysis derived from debriefing records in a medical center. The Learning Organization: Volume 19, Issue 2, pp. 148-162. Better, Atul Gwande Loss of the USS Thresher, Hearings Before the Joint Committee on Atomic Energy (http://www.perfectpr.com/Thresher2.html) What Sank the Thresher? Dean J. Golembeski The Challenger Launch Decision, Vaughan 33 References

34. Key Lessons “The loss of the Thresher should not be viewed solely as the result of failure of a specific braze, weld, system, or component, but rather should be considered a consequence of the philosophy of design, construction, and inspection … it is important that we reevaluate our present practices where, in the desire to make advancements, we may have forsaken the fundamentals of good engineering. ” – ADM Rickover 34

35. “Those who cannot remember the past are condemned to repeat it.” - George Santayana 35 “A good pre-event briefing beats an accident investigation any day.” - ADM Kinnaird R. McKee

36. USS MIAMI Action Categories Fire Prevention Fire Fighter Training Fire Detection Immediate Fire Response Extended Fire Response 36

37. New Manual 37 Applies to all platforms in industrial environments Covers maintenance and modernization work

38. New Requirements-8010 Manual Firefighting system and temporary hoses Alarms and communications, portable radios, lighting Emergency escape and casualty responder access, temporary services locations, fire & smoke boundaries Enhanced fire drill requirements Annual major fire drill at each shipyard Special submarine fire hazards (e.g., acoustic coating, battery compartment) must be managed 38