The Submarine Safety Program (SUBSAFE) is a quality assurance program of the United States Navy designed to maintain the safety of its submarine fleet, specifically, to provide maximum reasonable assurance that submarine hulls will stay watertight, and that they can recover from unanticipated flooding.

SUBSAFE covers all systems exposed to sea pressure or critical to flooding recovery. All work done and all materials used on those systems are tightly controlled to ensure the material used in their assembly as well as the methods of assembly, maintenance, and testing are correct. They require certification with traceable quality evidence which track the item from the point of manufacture (including all records of the creation of the product, i.e. source materials as well as smelting and hardening process for metals) to the point of installation within a SUBSAFE boundary. These measures increase the cost of submarine construction and maintenance.

SUBSAFE addresses only flooding; mission assurance is not a concern, simply a side benefit. Other safety programs and organizations regulate such things as fire safety, weapons systems safety, and nuclear reactor systems safety.^[1]

From 1915 to 1963, the United States Navy lost 16 submarines to non-combat-related causes. Since SUBSAFE began in 1963, only one submarine, the non-SUBSAFE-certified USS Scorpion (SSN-589), has been lost.^[1]

History

On 10 April 1963, while on a deep test dive about 200 miles off the northeast coast of the United States, USS Thresher (SSN-593) was lost with all hands. The loss of the lead ship of a new, fast, quiet, deep-diving class of submarines led the Navy to re-evaluate the methods used to build its submarines. A "Thresher Design Appraisal Board" determined that, although the basic design of the Thresher class was sound, measures should be taken to improve the condition of the hull and the ability of submarines to control and recover from flooding casualties. It included addressing the following issues on Thresher:

• Some silver-brazed joints could have been substandard. One or more of these joints is believed to have failed, resulting in flooding in the engine room. There is however, no specific evidence of flooding and photographs of the hull suggest that the machinery spaces did not flood (no equalization).^[2]
• The crew was unable to access vital equipment to stop the flooding.
• Saltwater spray on electrical components caused short circuits, reactor shutdown, and loss of propulsion power.
• The main ballast tank blow system failed to operate properly at test depth. Various restrictions in the air system coupled with excessive moisture in the system probably led to ice formation in the blow system piping. The resulting blockage caused an inadequate blow rate. Consequently, the submarine was unable to overcome the increasing weight of water rushing into the engine room.^[1]

Certification

SUBSAFE certification is carried out in four areas: Design, Material, Fabrication, and Testing. The exact procedures are documented in the initial design and construction for new submarines, while undergoing routine maintenance in naval depots, and in the fleet maintenance manual for operating submarines. During each step, quality evidence is collected, reviewed, approved, and stored for the life of the submarine. This process is reinforced with external and internal audits.

NASA

After the loss of the Space Shuttle Columbia, the Columbia Accident Investigation Board described SUBSAFE as "successful safety programs and practices that could be models for NASA".^[3] Following this recommendation, a number of exchanges and conferences were held between SUBSAFE naval personnel and NASA.