Technical Presentation: Seaworthiness Assurance in the Royal Australian Navy

Technical Presentation 3rd May 2023: Seaworthiness Assurance in the Royal Australian Navy

CAPT Sands Skinner RAN, Director, Navy Materiel Seaworthiness Assurance Agency, gave a presentation on Seaworthiness Assurance in the Royal Australian Navy, to a joint meeting with the IMarEST in the Henry Carmichael Theatre, Sydney Mechanics School of Arts in the Sydney CBD, and streamed live on 3 May. The presentation was attended by 20 with an additional 19 online.

Introduction

Sands began his presentation with the definition of some key concepts in assurance.

Regulation is any measure or intervention which seeks to change (or maintain) the behaviour of individuals or groups.

Ensure is to make sure, certain or safe.

Assure is to give confidence or to reassure.

 

Why does Regulation Exist?

It shouldn’t surprise anyone that both regulation and assurance are not free goods; they require energy and resources—financial, time, and human thought and capacity. So why do we do it?

Regulation is a natural and inherent part of human society. For our society to function and advance, there is a need to shape, control and change the behaviour of people. The reality is that most parts of our lives are either informally or formally regulated to some degree—what we wear; units of time, distance and weight; how fast we drive; the food we eat, etc.

Regulation is enforced through assurance. Whilst some people consider assurance activities a burden or constraint on their free will, others appreciate the clarity and efficiency which regulation provides in an increasingly complex world. Society does this for mostly benevolent and practical reasons, such as to assure personal safety, create order and reduce transaction costs.

As important as ‘Why’ we do it is ‘Where or When’ we do it, particularly when we are discussing formal regulations. Typically, we introduce regulations to protect society from a negative outcome which is otherwise less likely to be controlled. This can be because market forces do not necessarily produce required outcomes, think monopolies, or where there can be negative externalities, for example, impacts on third parties, think mandatory Compulsory Third Party Insurance vs voluntary Comprehensive Car Insurance. We also do it when there are high cost of controls, to prevent corner cutting and provide a consistent standard and finally, we regulate where there is a knowledge asymmetry, typically in technically-complex fields.

In the last example, think of the transactional cost to society if ferry construction and maintenance were regulated and passengers had to form their own assessment of the seaworthiness of the Manly ferry, each and every time they boarded. Similarly, whenever we fly anywhere, we trust that airlines are safe, not necessarily because it’s in their commercial interests, but because CASA assures us that they are.

Finally, regulations are shaped by what is important to us, and this is often heavily influenced by seminal events. Take, for example the Exxon Valdez environmental disaster.

 

Exxon Valdez

On 2 March 1989, the VLCC Exxon Valdez ran aground, penetrating her single hull and discharging an estimated 250 000 to 750 000 barrels of crude oil into Prince William Sound, Alaska. This event occurred in pristine regional Alaskan wilderness causing immense environmental damage. The resulting litigation and clean-up cost well over

$3 billion USD with continued effects. It was the largest oil-spill disaster in the USA until Deep Water Horizon, and remains the largest due to bulk crude oil transport.

 

In response, the USA passed the Oil Pollution Act of 1990 which excludes single-hulled tankers of 5000 tons or more from US waters which, in turn, led to the European Union also banning single-hulled tankers from 2010. This led to the adoption of double-hulling as the new standard for this class of shipping, despite its increased build complexity and cost.

In 2009 the 264 m tanker SKS Satilla struck a submerged jack-up rig in the Gulf of Mexico. The US Coast Guard reported that, despite sustaining significant damage and taking on an 8 degree list to port, an environmental disaster was averted because the vessel was constructed with a double hull and the inner hull was not breached. All 1.3 million barrels of oil were safely offloaded.

Road Toll

Another example can be found in the introduction of regulations to curb an increasing road toll over time. The gradual decline of deaths per capita and some of the seminal shaping events and regulations which have impacted it are evident in a graph.

Not all of this improvement is due to regulation, with vast improvements to vehicle safety also being driven by market forces (think Volvo), however, regulation and assurance have undoubtedly been significant contributors.

 

The Case for regulation in Defence

Airworthiness was the first of the modern regulatory frameworks within Defence. The chart below shows the total number of defence aviation accidents from 1980 to now. The bars represent numbers of aircraft lost, blue as non- fatal losses and red as fatal losses. The numbers above the bars represent the numbers of lives lost in the calendar year due to those accidents. If you focus on the early years leading up to 1990 it is evident that aircraft accidents were a regular feature, to the point that they were considered the cost of doing business in defence aviation. 1991 in particular was a seminal year with the loss of 6 aircraft, all fatal, with 15 lives lost.

 

As a result, in 1997 the position of Director General of Technical Airworthiness was established and appointed as the Technical Airworthiness Regulator of the ADF. The organisation set about promulgating the Technical Airworthiness Regulations TAREGs), the Technical Airworthiness Maintenance Manual and the Aviation Design Requirement Manual, amongst other important regulatory documents.

 

Despite being constructed as best-in-class, the system was not without issues. It was an amalgam of best practice from all three services, which meant that it was bespoke and, as such, very difficult and complex to maintain. It was also very prescriptive and rules based as opposed to more modern goal oriented, or outcome based, regulations.

Notwithstanding these relatively-minor detractions, the TAREGs established the first system across Defence which governed how aircraft were designed, built, maintained and operated to approved standards, by qualified and authorised personnel, using approved processes to ensure safety of flight.

These would form the cornerstone of Defence aviation regulation for nearly two decades, and would come to provide the building blocks for the Navy Technical Regulatory System. But not yet, and not without impetus.

 

HMAS Westralia Fire

On the morning of 5 May 1998, a fire occurred in the engine room of HMAS Westralia as she was proceeding to sea off the coast of Fremantle in Western Australia.

Shortly after a fuel leak was detected in the engine room, a fireball, extending some two metres, erupted in the main machinery space. This was followed by repeated fireballs. Both evacuation of personnel and fire-fighting efforts were made extremely hazardous by the intensity of the fire. The heat of the fire caused metal doors to buckle, making them inoperable, and the degree of heat in the metal on the railings of the escape ladders and deck plates caused burns on contact. Visibility was reduced to zero as the air was permeated with smoke and toxic gases. Hot plastic dripping from the light fittings fell on personnel as they fought the fire. Conditions in the main machinery space eventually deteriorated to the extent that all personnel in the area had to be evacuated. Four Navy personnel were overcome by toxic fumes and smoke, and perished in the fire.

 

Shortly after the accident, a Board of Inquiry was convened to ascertain its causal factors. The Board found that the fire was caused by fuel spraying under pressure from a hole in a newly-fitted flexible fuel hose on the starboard main engine coming into contact with a hot machinery component. The new flexible fuel hoses were fitted by a subcontractor to ADI during March and April 1998. The flexible fuel hose change to the main engines was a configuration change which bypassed the prescribed processes. It was not approved by appropriate authorities and did not comply with Lloyd’s Register’s requirements. Although the hoses were capable of withstanding the expected static system pressure, the arrangement was poorly engineered and the design did not take into account dynamic considerations.

The Board made 114 recommendations and, in doing so, it attempted to take a broad view of the systemic causes as well as the specifics of the flexible hoses. The BoI concluded that the weaknesses identified were symptomatic of wider problems within the RAN and ADI. Recommendations included configuration management, quality assurance, system safety management, inadequate engineering processes, and technical expertise.

On Quality Assurance, the BoI found that the principal organisations involved in the fuel hose work (ADI, the hose manufacturer and Ordering Authority Western Australia) were all accredited to a quality standard, but that the quality-management systems in place were either inadequate or inadequately implemented to prevent the provision of a nonconforming product.

 

Navy Technical Regulatory System

In response to the Westralia BoI, and in concert with direction from CDF to establish three environmental regulators, by 2002, the Navy Technical Regulatory System was promulgated. The NTRS was modelled from the successful Technical Airworthiness System; specifically, the Technical Airworthiness Regulations. As such, it carried the same hallmarks of complexity and prescriptiveness—but was further undermined by considerable under resourcing compared to the DGTA organisation.

It also suffered from a perceived lack of regulatory teeth in exercising its remit. In aviation—if an organisation loses its authorisation—it stops work; in the maritime environment the outcome was less clear, potentially due to a perceived risk difference between the two environments. When a vessel suffers a failure, it is typically benign and recoverable—when an aircraft suffers a failure, things have a very high potential of ending catastrophically. Such was the case in 2005 when Sea King helicopter ‘Shark 02’ crashed on Nias Island.

 

Sea King ‘Shark 02’ on Nias island

On 2 April 2005, a Royal Australian Navy Sea King helicopter ‘Shark-02’ crashed on the island of Nias in Indonesia whilst participating in an Australian Defence Force humanitarian aid operation, causing the tragic death of nine Australian Defence Force members and severely injuring two more.

The subsequent BOI determined that the primary cause of the accident was a failure of the flight control system caused by separation of the fore/aft bellcrank from the pitch control linkages in the aircraft’s mixing unit. The mixing unit couples and directs pilot input controls to the main and tail rotor systems of a helicopter. This separation was the result of a series of errors and non-compliances with the Maintenance Regulations which ultimately led to the deficient fitment of the split-pin and nut that secured the pivot bolt of the fore/aft bellcrank to the mixing unit assembly. The deficient fitment was not detected because a quality inspection was not conducted. This maintenance activity occurred some 57 days before the accident.

The BoI found that the causal factors were directly related to inadequate maintenance. An uninstalled split pin allowed the nut and bolt securing the fore-aft bellcrank in the mixer unit to work free, in effect disconnecting the pilots control of the aircraft.

The Board further found a complex interaction of individual and systemic failings across the ADF contributed to the inadequate maintenance and, ultimately, the accident. The Board made 256 Recommendations, which were all adopted. The BoI found causal themes of non-compliant practices, poor communication, lack of understanding, compliance, inadequate airworthiness surveillance/assurance, and no clear accountability.

 

Airworthiness—the Case for Change

The Sea King BoI and new WHS Legislation provided the basis for a review. In 2011 Defence commenced a sweeping review into best-practice aviation safety regulations, to address both the recommendations of the Board of Inquiry and to satisfy the legal obligations placed on duty holders by the new Workplace Health and Safety Legislation.

The review identified that the TAREGs had evolved organically over 20 years; however, they had not evolved in line with contemporary principles of regulating, which had also shifted from a rules-based prescriptive system to a goal-based and hazard-focussed frame.

The review found specifically that the TAREGs were bespoke for ADF aviation, and highly prescriptive with very limited flexibility provisions beyond an undesirable exemption from the regulations. It also found the system internationally isolated and unable to recognise, or be recognised by, other partner nations. The TAREGs, as bespoke and unique regulations, were also extremely onerous to maintain.

 

DASA and DASR

The review settled on the European Aviation Safety Authority and its European Military Aviation Regulations (EMARs), as the basis for the new Defence Aviation Safety Regulations (DASR) and in 2016, the CDF and Secretary announced the establishment of the Defence Aviation Safety Authority (DASA).

The new regulations promulgated by DASA were based on an internationally-recognised framework adopted by EASA and aligned with the FAA. It critically provided the clear lines of accountability that the Sea King BoI found lacking, clearly identifying Command as responsible for ensuring safety, and the Safety Authority as responsible for assuring safety. The regulations were structured to be largely outcome focussed, with prescribed means of compliance and the ability to demonstrate alternate means of compliance.

The regulations are hazard based—every regulation is designed to control a hazard. From an assurance perspective, success is measured not in the binary of compliance or not, but in the effectiveness of a system in controlling the underlying hazard.

It also enshrines the concept of risk-based assurance, where the level of assurance applied is assessed against the risk of an unsafe occurrence developing. This allows for the effective application of the assurance resource to those areas deemed most in need of attention or support.

 

Finally, it is worth pointing out that the regulations are safety centric. Just as CASA isn’t interested in the profitability of an airline, DASA and the DASR do not regulate operational effect. It is quite possible for an aircraft to be considered ‘airworthy’ and ‘safe’ without a single functioning mission system and be unable to perform anything but basic flight.

Effects

So as we reach the present day in our examination of aviation regulation, we reintroduce the chart showing Defence aviation accidents, this time overlaid with the systemic regulatory and safety system improvements which have been introduced since 1991.

 

Whilst, as with the road toll, not all safety gains are due to the highlighted systemic changes, they clearly contribute significantly.

 

NTRS

Whilst Defence’s aviation regulation was enjoying some successes, the NTRS was less so, and this was headlined

very publically by the Navy’s failing at the time of Cyclone Yasi.

Here Sands showed a video, with comments on the events leading up and subsequent to the establishment of our new Defence Seaworthiness System by:

VADM Russell Crane, Chief of Navy 2006–08 VADM Michael Noonan, Chief of Navy 2018–22

RADM Colin Lawrence, Head Navy Engineering 2016–21 VADM Tim Barrett, Chief of navy 2014–2018

Hon. Stephen Smith MP, Minister for Defence 2010–13 RADM Mike Uzzell, Head Navy Engineering 2011–16 VADM Ray Griggs, Chief of Navy 2011–14

 

The RIZZO Review and the NTRS

As discussed by Admiral Griggs in the video, the report led by Mr Paul Rizzo entitled Plan to Reform Support Ship Repair and Management Practices, commissioned in the wake of both Cyclone Yasi and the near grounding of HMAS Kanimbla, was about considerably more than just support ship repair and maintenance. Its themes applied across Navy and provided the blueprint for the development of the current Navy Seaworthiness System. The report was summarised by the ABC as identifying: organisational complexity and blurred accountabilities, inadequate risk management, poor compliance and assurance, a ‘hollowed-out’ Navy engineering function, resource shortages, and a culture which placed the short-term operational mission above the need for technical integrity.

The Rizzo review considered the NTRS to have failed, levelling four key criticisms at it:

• The NTRS had established Authorised Engineering Organisations, similar to those in Aviation, but they were all DMO or Navy Where work was conducted in industry, no regulatory oversight was provided, instead relying on contract provisions to ensure compliance with requirements. The report also found that, unlike aviation, there are no Authorised Maintenance Organisations.

 

• Regulations were out-of-date, spread across many documents, and required
• While the regulatory concepts were sound, compliance was lacking, and
• Assurance frameworks were considerably

Defence Seaworthiness Management System

In June 2012, a Joint Directive was issued by the Secretary and CDF to the Chief of Navy (CN), authorising the development of the Defence Seaworthiness Management System. The Directive identified CN as the Defence Seaworthiness Authority (DSwA) over Defence, who subsequently appointed Head Navy Engineering (HNE) as the Defence Seaworthiness Regulator (DSwR).

The DSwR is the single Defence Seaworthiness Regulator, responsible for establishing, managing and continually improving a system known as the Defence Seaworthiness Management System (DSwMS) to regulate and assure the management of seaworthiness. The Defence Seaworthiness Regulations Manual, outlining this system, was promulgated in 2017. The regulations are codified in through 15 Governance and Management Compliance Obligations (GMCOs) and 19 Activity and Condition Compliance Obligations (ACCOs), all goal-based outcome focussed Obligations.

 

The DSwMS defines a ‘seaworthy outcome’ as one which maximises the likelihood of achieving operational effect for the defined tasking, where efforts have been made to eliminate or minimise, so far as is reasonably practicable, hazards or risks to personnel the public or the environment.

The system requires that each maritime mission system be managed under a Seaworthiness Case. The Seaworthiness Case is a ‘living’ body of information which together provides the context, claims, arguments and evidence necessary to support seaworthiness judgments relating to a maritime mission system and its enabling support system. The claim of a ‘seaworthy maritime mission system’ is made and argued through the implementation of the compliance strategy, within the context of each individual maritime mission system’s Operating and Support Intent.

The Operating and Support Intent is central to the management of Seaworthiness. The DSwMS requires that a Capability Manager has an authorised Operating and Support Intent for each maritime mission system. It consists of the requirements, constraints and assumptions for the maritime mission system, which can be traced, through a maritime program, to government direction. In essence it is the concept which ties together how a capability will be both operated and supported. It identifies that these two concepts are intrinsically linked and should remain balanced through the capability life cycle. Where there is an imbalance, for example where there is an increased operational requirement which is provided at the expense of maintenance, then there is an increased risk of an unseaworthy outcome—as we saw with the LPAs at the start of the last decade. This is not to say that the Seaworthiness System limits the ability of Capability Managers to deliver Operational Effect, but it does place obligation on them to manage the risks associated with doing so – now and into the future.

Critically, the Seaworthiness System requires Capability Managers to consider their decisions through the context of the whole capability lifecycle—not just to borrow from tomorrow’s Navy to meet the obligations of the now. And, finally, the system provides clear accountabilities within Navy for the delivery of a Seaworthy Outcome.

 

Navy Materiel Seaworthiness Policy

Navy’s response to the Defence Seaworthiness Regulations—how it meets its compliance obligations—are codified in the N Library. This Library provides a common, logical and hierarchical structure for the eight sub- libraries which contain Navy’s critical knowledge management references. The N Library establishes clear authority and accountability for policy development and implementation.

At the heart of the Materiel Seaworthiness construct is the entity called an Authorised Materiel Seaworthiness Delivery Organisation (AMSDO). If you work in, or with Defence, this is the most likely touch point that you will have with our Seaworthiness System. It is a reimagining of the old SPO and Engineering Organisation constructs to provide integration of engineering, maintenance and supply support functions to our fleet. It is structured around authorised Organisations (AEOs, AMOs and ASOs), with qualified, experienced, authorised and accountable principles working to an executive consisting of both the NSSG Director and Navy Capability Manager Representative.

 

Seaworthiness Assurance Framework

Seaworthiness has adopted a system of assurance based on a Three Line of Defence (LoD) Governance Framework.

The 3rd LoD develops the rules and regulations which govern the system; it then monitors and assure that systemic and emerging risks are identified, managed and remediated by Capability Managers through adherence to the DSwMS Regulations.

The 2nd LoD builds the organisation’s compliance strategy to the regulations—it is the systems response to the requirement, and conducts assurance activities to provide confidence in the integrity of the system which has been used to develop the Seaworthiness Case.

The 1st LoD establishes and maintains the Seaworthiness Case. It does this through a robust set of processes, plans and controls that comply with the Seaworthiness System to deliver the outcome. In essence it is the first physical checkpoint that assures controls, directly applied through the ACCOs, are being effectively implemented to minimise the short to medium term hazards at the mission system level;

 

 

Navy’s implementation of this governance and assurance mode, controls are embedded within the N Library and assurance is conducted over those controls.

Sands’ organisation, the Navy Materiel Seaworthiness Assurance Agency, conduct assurance at the 2nd Line of Defence, over the Materiel Seaworthiness Policies and Systems established in the Tier 2 and 3 documents of the N library.

 

Airworthiness and Seaworthiness Comparison

In reviewing airworthiness and seaworthiness systems, some comparison are inevitably drawn. Both reflect modern outcome-based regulatory suits, although the seaworthiness system has more fully embraced a goal-based regulatory framework.

Whilst both are concerned with safety, they differ, in that airworthiness explicitly does not regulate capability, where seaworthiness exists to regulate the nexus between capability and safety. This is largely informed by events which have shaped their evolution. As we have seen, formative aviation events are nearly always safety critical whereas Navy events are as often capability centric, such as Cyclone Yasi.

Both have now established clear lines of accountability where duty holders within the system have clear understandings of their accountabilities and responsibilities.

Both systems represent contemporary best practice for their environments; however, the seaworthiness system is still bespoke to the RAN whereas aviation regulation is based on an internationally-recognised standard. The establishment of the Australian Naval Classification Agency and formal integration of classification society rule sets will seek to remediate some of this.

Finally, both systems have adopted a risk-based assurance framework; however, aviation has no intermediary, the regulatory is also the assurance agency and operates on a two-tier system, compared to the three line of defence system implemented in the seaworthiness system.

 

Conclusion

Seaworthiness assurance in the RAN has had a long gestation period, commencing with airworthiness for the ADF as a result of aircraft losses in the 1980s and 1990s and the loss of Sea King helicopter ‘Shark 02’. The fire on HMAS Westralia, the near-grounding of HMAS Kanimbla, the lack of availability of Navy vessels for relief operations flowing Cyclone Yasi, and the culmination of events precipitating the Rizzo Review led to the establishment of the Navy Seaworthiness Management System, which is how the RAN now assures seaworthiness of its fleet.

 

Questions

Question time was lengthy and elicited some further interesting points.

The presentation was recorded and is expected to be available soon on the RINA YouTube channel.

The vote of thanks was proposed, and the “thank you” bottle of wine presented, by Len Michaels. The vote was carried with acclamation.