Section 3 Performance requirements

3.1.1 A process is to be established for the management of submarine safety in accordance with recognised standards. The process should include a definition of the:

1. Activities to be carried out;
2. Required inputs and outputs;
3. Roles and responsibilities of key personnel;
4. Competence of key personnel;
5. Schedules for the activities; and
6. Records to be made and retained.

3.1.2 A risk management procedure is to be established in order to ensure that risks are addressed, in particular risks associated with:

1. Structural and watertight integrity;
2. Power and propulsion, power generation and distribution;
3. Submarine control systems: manoeuvring;
4. Ballast, trim and compensating system;
5. Munitions handling;
6. Life support systems; and
7. Integrated damage control and fire protection system.

3.1.3 The procedure is to consider the hazards associated with installation, operation, maintenance and disposal of the system, component or product in normal, abnormal and emergency operating conditions.

3.1.4 The procedure is to identify all relevant stakeholders and stakeholder requirements.

3.1.5 The procedure is to take account of the operating context, see Vol 1, Pt 2, Ch 2, 1 Concept.

3.1.6 The procedure is to ensure that hazards are identified using acceptable and recognised hazard identification techniques and that the effects of the following influences are considered:

1. Operations that the submarine is intended to perform as defined in the Concept of Operations Statement during trials, in-service, while docking and in harbour, including mission specific activities with degraded and reversionary modes of operation;
2. Submarine conditions under all reasonably foreseeable normal, abnormal and emergency operating conditions arising from failures or misuse of ship equipment or systems;
3. Configurations and modes of operation provided for the intended control of submarine systems;
4. The environmental conditions that the systems, equipment and components will experience due to their location within the submarine and due to the geographical location in which the submarine operates, see Vol 1, Pt 4, Ch 2 Transverse Criteria;
5. The reliance and effects on the operation of systems, equipment and components of the provision and availability of supplies and services and user interaction, including assessment of interdependencies; and
6. The environmental impact of the submarine throughout its lifecycle, including disposal.

3.1.7 The procedure is to ensure that risks are analysed using acceptable and recognised risk assessment techniques, and that the following consequences are considered:

1. Loss of function;
2. Loss of services essential to the safety of the submarine, services essential to the safety of embarked personnel and services essential to the protection of the environment;
3. Damage to components; and
4. Damage caused by fire, explosion, electric shock, harmful releases and hazardous releases.

3.1.8 The procedure is to ensure that risks are eliminated wherever possible. Risks which cannot be eliminated are to be mitigated as necessary.

3.1.9 Details of risks, and the means by which they are mitigated, are to be included in the operating manual.

3.2.1 Appropriate targets are to be set for the risk to the individual, group risk and for the loss of the submarine and these are to be agreed with the Naval Administration.

3.2.2 Targets are to reflect the full range of possible consequences for the submarine and embarked persons.

3.3.1 Risk assessments are to be undertaken using an acceptable and recognised technique carried out in accordance with the relevant International Standard or applicable National Standard. A justification is to be provided which demonstrates the suitability of the standard and analysis technique chosen.

3.3.2 The risk assessment is to demonstrate that adequate risk mitigation has been achieved for all normal, abnormal and emergency conditions identified. The scope of analysis required is to:

1. Identify the equipment or sub-system and their modes of operation and the equipment;
2. Identify potential failure modes and damage situations and their causes;
3. Evaluate the effects on the system of each failure mode and damage situation;
4. Identify measures for reducing the risks associated with each failure mode;
5. Identify measures for failure mitigation; and
6. Identify trials and testing necessary to prove conclusions.

3.3.3 Normal, abnormal and emergency foreseeable conditions are to be identified using a formal and rigorous process:

1. Using analysis processes that are capable of revealing abnormal conditions;
2. Employing a mix of personnel including: designers, Operators, persons who carry out maintenance, those with relevant domain knowledge and understanding and competent safety/risk professionals to apply the processes;
3. Referencing relevant events and historic data; and
4. Documenting the results of the analysis.

3.3.4 The risk assessment is to be organised in terms of items of equipment and function. The effects of item failures or damage at stated levels and at higher levels are to be analysed to determine the effects on the system as a whole. Actions for mitigation are to be determined.

3.3.5 Suitable records are to be made of the risk assessment activity including methods of assessment, assumptions, design basis assessed and recommendations.

3.4.1 Where changes are made to the submarine or the Concept of Operations Statement, the risk assessments undertaken are to be reviewed to determine if the change affects the assumptions made in the assessment. If necessary, the risk assessments are to be repeated.

3.4.2 The impact of the change is to be assessed for all systems, equipment and components influenced by that change.

3.4.3 The records of the risk assessment and analysis are to be maintained and held for the lifetime of the submarine.