The court of inquiry’s last recommendation was for “an organization, similar to that employed in Naval Aviation, in the interest of safe submarine operating procedures,” because, as its findings put it, “there is at present no organization at any level within the Navy with the sole responsibility for submarine safety.” What the Navy built instead of an organisation was a programme, and the programme is still running. This piece follows it from June 1963 to the hearing in 2003 at which it was offered to NASA as a model.
June 1963
On 3 June 1963, two days before the court closed, the chief of the Bureau of Ships directed the establishment of a submarine safety programme within the Bureau, under a Submarine Safety Steering Task Group chaired by his deputy, Rear Admiral Charles Curtze, with the heads of the ship design, submarine, hull, machinery and research divisions as members. Its instruction, BuShips Instruction 5100.18, was issued on 8 July 1963. It set sixteen tasks and ninety-one sub-tasks: a review of every sea-water system under submergence pressure; the materials, fabrication and testing of hazardous piping; the machinery components in sea-water systems; the mandatory use of class plans; the high-pressure air system and the ballast blow; readiness for builders’ and sea trials; protection of electrical systems from sea water; hull penetrations; a damage-control section for the ship’s information book; the reliability of ship control; habitability against safety; the feasibility of a pressure tank big enough to test a whole submarine; the safety of shock tests against manned submarines; an expanded quality assurance programme; diving trainers that could simulate flooding; and location, salvage and rescue. The group reviewed the court’s recommendations and those of a separate design appraisal board under Rear Admiral Andrew McKee against its own list. “No thought or recommendation of any group passed unconsidered,” Curtze told the Joint Committee on Atomic Energy in July 1964.
The first thing done was operational. Every submarine with a deep test depth was restricted, and the court’s record gives the figure: 500 feet. The restriction would stay, Vice Admiral Lawson Ramage told the committee, “until all subsafe measures have been accomplished and certified by the Bureau of Ships in the case of each submarine.” The trials themselves were rewritten. A post-overhaul deep dive would be made in water no deeper than one and a half times the test depth; a rescue ship would be in attendance “and tape records all communications”; the ballast blow would be tested at the pier and again on a shallow dive before the deep one; new submarines would make three controlled dives to a set depth, one for system integrity, one to test the emergency blow, one after the post-shakedown availability to repeat both. Before any trial the Bureau would audit the ship and the building records and certify her materially ready. Speed limits were set for each depth, submarines would keep positive buoyancy when they could, and the main coolant pumps would be run in slow speed on a deep dive, which was the court’s seventh opinion made into an order. On 18 February 1964 the Secretary of the Navy established a Submarine Safety Center at Groton.
December 1963
The programme’s founding document is the Submarine Safety Certification Criterion, issued by Bureau of Ships letter of 20 December 1963. It defined what a submarine had to have before the Bureau would certify her for unrestricted operation to her design test depth, and the list is the court’s findings turned into requirements.
The hull boundary and the critical piping systems, sea water, high-pressure air, hydraulics and oxygen, were to be given “the same painstaking fabrication and inspection treatment as is given to the hull structure.” Every joint in a sea-connected system between the hull and the back-up valve, and every joint inboard down to half an inch in a sea-water system open below 200 feet, had to be proved by ultrasonic inspection if brazed, or welded and radiographed. Above a certain size, every sea-water joint had to be welded. The high-pressure air piping that fed the new emergency blow, the hydraulic piping whose failure could cost the stern planes, and all oxygen piping came under the same rule. Flexible hoses of certain sizes were to be replaced with a more reliable design. Castings in the hull boundary were to be radiographed; aluminium bronze of certain compositions, found to corrode in sea water, was to come out; every fastener in the hull boundary was to be surveyed for the right material.
Then the recovery. “An emergency main ballast tank blow system in addition to the normal main ballast tank blow system must be provided,” able to recover the ship from a continuous flood through a hole of a size the record blacks out. The system “basically short circuits air from the air storage banks into the ballast tanks and has a minimum of components and piping which could fail or restrict the flow of air.” The conical strainers in the reducing valves were to be eliminated, and the system tested by a full blow of the air banks through the tanks, which no one had done before the Tinosa test froze its strainers in thirty seconds. Hull and back-up valves in sea-connected systems open below 200 feet were to be given centralised hydraulic control, so that a flood could be isolated from a station the water had not reached, and the work was to be done so that a crew could keep propulsion while shutting the maximum number of other valves “from a minimum number of levers.” Every ship was to be studied for whether the tight machinery arrangement, the silencing and the habitability improvements had put vital valves out of reach. All of it was to be documented so that the Bureau could audit and certify it.
The acceptance standard for a brazed joint went from an average 40 per cent bond to 60 per cent. Brockett and Curtze did not go the whole way to welding at once. “We don’t think with our present knowledge of silver-brazed joints, Mr. Chairman, that we are in as bad a position as we thought we were a year ago,” Curtze said in 1964; with trained people and the ultrasonic test, “we need not backfit all of these submarines with welded joints and fittings.” But for the submarine then being contracted, SSN-671, every joint in a critical system would be welded, and “we wish to try for all critical systems to be welded from 671 on out.” Representative Holifield thought this inconsistent: a requirement for safety in future ships that was not applied to existing ones. Curtze’s answer was space; an existing boat’s piping could not be opened up for a welder’s torch without rebuilding her, and Mare Island was developing automatic pipe-welding machines for constricted spaces.
What it cost
Curtze gave the committee the money. Certification and the safety improvements would cost about 4.2 million dollars for an early attack submarine, the Skipjack-class SSN-585, and about 8.3 to 8.4 million dollars for a Polaris submarine. The programme as a whole would spend 34 million dollars in the fiscal year 1964, 50 million in 1965 and 46 million in 1966, over and above construction funds. Polaris submarines under construction would be modified on a not-to-delay basis but would not have their depth restrictions lifted until certified; new construction from the 1963 programme onward would be delivered certified; older boats would be certified as they came in for overhaul. The committee’s foreword put the moral: “It now appears that the cost to upgrade our submarine program will be greater than if at the outset the higher standards comparable to those used in the nuclear powerplant had been adopted throughout the ship. The lesson is obvious. There is no substitute for proper attention to quality of material and workmanship in the first instance.”
Rickover, who had run his reactor plants this way from the start, was not gracious about it. Curtze’s prepared statement ran to twenty-three pages, he observed, and “one of the questions that should result from this testimony is why it has been necessary to have a 23-page discussion of items that are now being corrected as a result of the loss of Thresher. Unless we find the answer to that question, we cannot be sure that we have taken all steps necessary to prevent another accident.” Written procedures, audits, records kept for seven years, no deviation from specifications without the Bureau’s permission: “We have always required this for the nuclear plant.”
Curtze’s own closing words on quality assurance are the ones that lasted: “No matter what we do on paper, without quality assurance and the means of achieving it, the program would fall on its face. Pressure and vigilance must be eternal, performance can never be taken for granted, the assumption must be made that no one will always perform to the required standards.”
1974, 1985, 2003
Over the next eleven years the criterion was changed thirty-seven times, and in 1974 the requirements were codified in the Submarine Safety Requirements Manual, which is still the programme’s base document. The boundary it draws, the “SUBSAFE Certification Boundary”, is the set of structures, systems and components critical to watertight integrity and to recovery from flooding, and nothing else; the programme’s stated purpose is “to provide maximum reasonable assurance of watertight integrity and recovery capability,” and its officers insist that it “does not spread or dilute its focus beyond this purpose.” Work inside the boundary is controlled by a re-entry process; certified ships are kept certified by periodic inspection and by audits, of the ships, of the yards and of the headquarters itself.
In 1984 the Naval Sea Systems Command ordered a review of the whole programme, and in 1985 set up an independent Submarine Safety and Quality Assurance office. What the review found, in the Navy’s own words to Congress in 2003, was “an unacceptable level of complacency fostered by past success; standards were beginning to be seen as goals vice hard requirements; and there was a generally lax attitude toward aspects of submarine configuration.” It was the court’s finding about Portsmouth in 1963, twenty-two years on and inside the programme built to prevent it. The loss of the shuttle Challenger in January 1986, the Navy said, “added impetus to this effort.”
In 2003 the Columbia Accident Investigation Board named SUBSAFE and Naval Reactors as examples of independent safety programmes that NASA might learn from, and on 29 October 2003 Rear Admiral Paul Sullivan, the technical authority for the programme, gave the House Committee on Science its history and its record. Between 1915 and 1963 the Navy had lost sixteen submarines to causes other than war, one every three years. Since 1963 it had lost one, Scorpion, in May 1968, with ninety-nine men; she had not been certified, and “the evidence indicates that she was lost for reasons that would not have been mitigated by the SUBSAFE Program.” “We have never lost a SUBSAFE certified submarine,” he said, and then, in the same statement: “We must constantly remind ourselves that it only takes a moment to fail.”
Sources
- Joint Committee on Atomic Energy, Loss of the U.S.S. “Thresher”, hearing of 1 July 1964: the statements of Vice Admiral Ramage and Rear Admiral Curtze on the submarine safety programme, the certification criterion, the plan of accomplishment and its costs; Rickover’s remarks; Representative Holifield’s questions; and the committee’s foreword of December 1964. purl.stanford.edu
- Record of Proceedings of a Court of Inquiry into the loss of USS Thresher, Volume 1: Findings of Fact 157 and 159, Opinions 7 and 8, and Recommendations 13, 14 and 20. documentcloud.org
- Rear Admiral Paul E. Sullivan, oral and prepared statements on the SUBSAFE Program, House Committee on Science, 29 October 2003, Serial No. 108-30. govinfo.gov