**July-September 1999 *Fathom***

**Table of Contents**

**Sections**

Engineering Systems

Damage Control & Firefighting

Ship Control

Deck Seamanship

Electronics Material & Combat Systems

Amphibious Operations

Diving & Salvage

Industrial Hygiene & NavOSH

Publications & Information

**Cover**

An FA-18 Hornet is spotted on an aircraft elevator to be raised to the flight deck of an aircraft carrier.

**Features**

**Aircraft Elevator Kills One, Injures Another**

One shipyard worker is killed and another is injured seriously when they are crushed in a man-lift basket while greasing an aircraft carrier’s flight-deck stanchions.

*By MMCS(SW) Don Forrester.*

**Steam Leak Turns Shower Stall Into Coffin**

A PO3 dies and a PO2 is injured when the brazed joint on a steam-system fitting fails.

*By GSCS(SW) Brad Spahnie.*

**A Tough Decision**

A major fuel-oil fire erupts in the main-machinery space aboard an Australian oiler, trapping four people.

*By Lt. Paul Berthelotte.*

**A Sailor’s Nightmare**

Ignoring a caution sign, two Sailors crawl into a pitch-dark space so one of them can have a cigarette. Only one crawls out.

*By Cdr. Elizabeth Rowe.*

**Articles**

**Ways to Prevent Nightmares**

The author outlines precautions you can take to prevent mishaps involving tanks, voids, uptakes, and vent plenums.

*By CWO3 Dave Cerda.*

**How Much Is “Enough”?**

A CO refuses to believe a pilot who tells him there is enough room to moor his ship between two others at a foreign pier.

*By Ltjg. Daniel Altruz.*

**A Wanna-Be Stunt Man**

A RHIB coxswain gets thrown out of his boat, is picked up by a second RHIB coxswain, and suffers injuries while trying to leap from the buddy’s RHIB back into his own.

*By Ken Testorff.*

**When the Towed Array Takes a Dive**

Since 1994, surface ships and submarines have reported seven costly events involving towed arrays.

*By Cdr. Kevin Nicholas.*

**When Marine Mishaps Occur Aboard Navy Ships**

The author explains the differences in Navy and Marine Corps rules for handling mishaps involving Marines permanently assigned to ships or squadron staffs and those who are part of an embarked Marine unit.

*By Capt. Joseph Cleary, USMC.*

**Why Divers Can’t Afford To Blink**

Two diving mishaps less than a week apart show that divers provide the first and last safeguard against disaster.

*By MMC(SS/SW) Kevin Gest.*

**Risk Management Keeps Tow Afloat**

Thanks to ORM, a repair team keeps a flooding tow afloat and completes the mission without a single injury or loss of equipment.

*By Ltjg. Will Ranney and Ens. Chad Houllis.*

**From Rescuer to Victim**

Two mishaps reported within a few days of each other show the hazards of impulsive behavior.

*By Lt. Cathleen Donohue.*

**The Key to Mishap Prevention: Not What Happened, But Why**

Afloat-mishap reports received at the Naval Safety Center usually describe what happened. Analysts, however, need to know why it happened before they can identify trends in mishap causes or determine how to prevent recurrences.

*By Cdr. Elizabeth Rowe, LCdr. Rex Lacy, and Lt. Scott Sciretta.*

**Departments**

**ORM Corner**

**Editorial**

**Rudder Amidships**

**A Wanna-Be Stunt Man**

*By Ken Testorff,*

*Naval Safety Center*

“The good news is, ‘You won’t die’; the bad news is, ‘You may be disabled for the rest of your life.’” That could have been the initial report a ship’s doctor gave a PO2 who got run over by an out-of-control RHIB. Luckily, the victim healed better than expected and escaped with a partial disability to his leg.

The PO2’s problem started when he and a shipmate were assigned duty as RHIB coxswains to take some foreign navy divers ashore. On the trip back to the ship, the PO2 was ejected from his RHIB. Because he wasn’t wearing the kill switch, the boat kept running. The second coxswain saw what happened to the PO2, picked him up, and pulled alongside the runaway RHIB. The PO2 then tried to jump aboard but landed short and fell into the water. The runaway boat’s propeller caught him, slicing his ankle, severing his Achilles’ tendon, and fracturing his lower leg.

*[Note: Depending on the size and type of RHIB, it may not have a kill switch installed. We recommend you use operational risk management when deploying a RHIB. Ask these questions: Is there a kill switch? Will there be only one person (a coxswain) in the boat during the operation? After you answer these questions, you may find yourself adjusting the designed controls to protect your Sailors.--Cdr. Kevin Nicholas, former head of deck seamanship, Afloat Safety Programs Directorate, Naval Safety Center]*

How many of these wanna-be stunt men are there? No one knows. However, there is a growing list of people who have been injured in RHIB mishaps. Here are some examples:

**Off Balance and in Trouble**

During small-boat operations, a BM3 was seated on a sponson near the bow of a RHIB when it went over a wave. He lost his balance, and after the RHIB hit a second wave, he landed on his lower back on the deck. Doctors diagnosed a broken vertebra.

**Unwelcome Surprise**

A RHIB went alongside a vessel so members of a visit, board, search, and seizure (VBSS) team could board the vessel. As members of this VBSS team were boarding, the RHIB started taking on large quantities of water, which accumulated in the bilges and caused a ground in the alternator. Investigation also revealed that water splashing on the boat’s navigation light caused a second ground in the control panel. Metallic surfaces in the RHIB became energized with 24 volts direct current, and several team members received mild electrical shocks.

**RHIB Rocks to the Roll of the Sea**

As crewmen were recovering a RHIB with a ship’s crane, heavy rolls caused the boat to swing on the hook and bang the hull several times, throwing the boat engineer into the water. A line handler jumped in to rescue the engineer but injured himself, and a helicopter crew had to recover both Sailors. Doctors first thought the line handler had injured his spine; however, they later diagnosed a soft-tissue injury. The RHIB lost three antennas, and its radar dome and hull were damaged.

**Takes a Lickin’, But Keeps On Kickin’**

A Sailor was transferring from a RHIB to a ship at sea. He used a rope ladder to get to a stationary ladder on the ship. As he started up this ladder, 15-foot waves developed, so he decided just to cling to the ladder. He quickly changed his mind, though, when the RHIB started banging him from behind. By the time he finally reached the outstretched hands of helpers on the ship, he had injured his left shoulder, neck, back, both knees, and right ankle.

**Watch Your Throttle Setting**

That’s good advice, especially if you don’t want to end up with an injured line handler and a 4-square-foot hole in the fiberglass hull of your ship’s RHIB. An EM1 (the coxswain) and an EN3 (the line handler) had embarked the boat, with plans to move it to the other side of the ship for recovery. The EM1 started both engines but used only the starboard one to maneuver away from the ship because it was easier. While turning the boat, he engaged the port engine. Immediately, it raced out of control, and the EM1 lost his grip on the situation. The RHIB smashed into the ship, throwing the EM1 into the water. Meanwhile, the line handler flew forward but stayed in the boat. Both Sailors went to a hospital for an exam, but only the EN3 required treatment. Workers had to repair the hole and replace a crushed steering wheel and the throttle console that had been ripped from its stanchion.

*The author’s e-mail address is ktestorf@safetycenter.navy.mil.*

**When the Towed Array Takes a Dive**

*By Cdr. Kevin Nicholas,*

*Staff, ComPhibRon Six*

As Sailors aboard a surface ship huddle around display screens in darkened sonar spaces, crewmen aboard an “enemy” submarine lurk below, plotting ways to avoid detection. The stage is set for an undersea-warfare exercise. Who will win this war game? No one knows, but that’s not an important issue, anyway. If reports to the Naval Safety Center are any indication, the players involved should be more worried about whether they’ll still have all their equipment (in working order) when the game ends.

During an international undersea-warfare exercise, for example, a destroyer had its tactical towed-array sonar (TacTAS) deployed to 5,800 feet. Water depths in the op area exceeded 1,000 fathoms.

When the ship left this area, it transited a stretch of water with depths less than 100 fathoms. There was just one problem: The crew didn’t retrieve the TacTAS before leaving the deep water. Based on the destroyer’s speed and the amount of cable payed out, the array could have sunk to a depth of 200 fathoms if the water had been deeper.

The two damaged modules on the array cost $115,000.

That mishap is one of seven costly events involving towed arrays reported to the Naval Safety Center since 1994 by surface ships and submarines. Damage totaled about $6.7 million. Here are summaries of the other six events:

* After operating a TB-23 towed array, crewmen aboard an SSN retrieved the unit--or so they thought. The counter on the control panel showed the array was fully stowed. As they would learn later, though, 752 feet of the unit still were deployed. The first sign of a problem came when the crewmen tried to deploy the array again following engineering maneuvers. After the SSN returned to port, divers investigating this problem found 740 feet of the array wrapped around the screw. They also found 15 feet hanging from the bell mouth. The estimated cost from this mishap was $1 million.

* Three and a half hours into an undersea-warfare exercise, an FFG lost its TacTAS and cable when the unit unwound off the winch reel. Crewmen hadn’t made sure the winch-locking mechanism was engaged before the exercise started. Vibration, as well as tensioning and detensioning of the cable during frequent turns and high-speed runs, contributed to this mishap. It cost about $1.16 million to replace the towed array.

* Crewmen found no problems during a pre-deployment check of a destroyer’s TacTAS. They also were able to deploy, operate and retrieve the unit, but some problems arose. Crewmen found scrapes and punctures on 12 modules as they retrieved the unit. Because a review of the ship’s track didn’t show any areas of shallow water or underwater obstructions, investigators felt that sharks may have attacked the array. Repairs cost $727,000.

* An SSN and an FFG were part of an undersea-warfare exercise until the latter lost all display inputs from its TacTAS. Upon its retrieval, the FFG’s crew discovered that all array modules had been lost. Investigation revealed the crew didn’t know an assigned operating area had been given exclusively to the SSN. As a result, the SSN had become entangled in the FFG’s array. The SSN reported no damage, but it cost $1.6 million to replace the FFG’s array.

* While holding maneuvering drills with its TB-23 array deployed, an SSBN lost all array data after completing a back-emergency bell. Retrieval showed the array had been sheared off. The replacement cost was $1.23 million.

* Crewmen aboard a DD noticed fluctuations in the display of its AN/SQR-19 TacTAS during an undersea-warfare exercise. When they retrieved the unit, its last 17 modules were missing. A subsequent investigation listed the cause as an unexplained failure of the locking tab on the forward end of the low-frequency module. Repairs cost $950,000.

Some level of risk exists every time you deploy a towed-array sonar. As these mishaps reveal, the keys to success are extensive training and thorough planning. Recognize the hazards, determine if they can be controlled, decide whether to proceed based on risk versus benefit, implement necessary controls, and supervise the entire event. If we practice these basic steps, we’ll remember to watch our tails.

*The author was assigned to the Afloat Safety Programs Directorate at the Naval Safety Center when he wrote this article.*

**When Marine Mishaps Occur Aboard Navy Ships**

*By Capt. Joseph Cleary, USMC,*

*Naval Safety Center*

While working in the galley aboard an LHA, a Marine slips on a wet deck, spills boiling water on himself, and suffers second-degree burns to his hands and wrists.

*******

A Marine aboard an LPD is using an elevator when he gets his hand pinched between the door frame and the moving door. His injuries include fractured and dislocated bones, and the loss of part of the use of one finger.

*******

During an amphibious raid from an LPD, an infantry-boat company of 96 Marines, four Navy corpsmen, and one host-nation army officer ride in 17 CRRCs. A total of nine boats capsize (some as many as four times) in 20-foot surf, throwing 53 people overboard. One Marine drowns.

**Who reports mishaps like these?** Both the ship’s CO and the Marine CO are required to report and investigate mishaps in which a Marine dies or is injured, or property is damaged. However, there is no guidance that sets boundaries of responsibility. Here’s what we suggest:

If a Marine permanently assigned to a ship or squadron staff is involved in a mishap, the Navy reports it according to a Navy instruction1. If the mishap involves an embarked Marine or equipment (e.g., from a Marine Expeditionary Unit), the Marine Corps reports it according to a Marine Corps order2.

In the latter case, a Marine ground safety officer is the person who writes the report. He often holds this job as a collateral duty. Many times, he is the logistics officer in one of the four elements of an MEU: the staff, battalion landing team, air combat, or service-support group. The air-combat element also has an aviation-safety officer, who may be dual-hatted as the ground-safety officer. These officers should be distributed among all ships in an amphibious-readiness group.

**How does the Marine Corps report its mishaps?** When a Marine has a mishap, a ground-safety officer must submit a Message Mishap Report (MMR) or Serious Mishap Report (SMR) to the Commandant of the Marine Corps, safety division (CMC/SD), and the chain of command. Include the Naval Safety Center as an information addressee. In cases when an SMR is submitted, a Formal Safety Investigation Report (FSIR) also is required. This report is similar to the afloat Navy’s Mishap Investigation Report. Embarked Marine units should include the ship as an information addressee on any message mishap report or serious mishap report.

**Does the Navy and Marine Corps use the same classification systems and reporting criteria?** The classes of mishaps (Class A, B and C) are the same for both the Navy and Marine Corps. A primary difference is that the Marine Corps stipulates one lost workday (instead of the Navy’s five days) as a reportable Class C mishap. The Marine Corps also does not designate back injuries, electrical shocks, and chemical or toxic exposures as special-case mishaps, which are reportable for Marines only if they meet the lost-workday or cost requirements. However, explosive mishaps that result in injury or property damage, regardless of severity, must be reported and investigated, using an SMR and an FSIR, respectively.

**If a formal investigation is required, who does it?** Class A and B Marine Corps mishaps require investigation by a Ground Mishap Review Board. If a ship’s facility, system or procedure is a possible cause or contributing factor in a Marine mishap afloat, the review board should include Navy personnel with safety or technical expertise. If the members of the review board recommend that a ship’s CO take corrective action to eliminate or reduce a hazard, they must include the ship in the endorsing chain. Upon completion of the investigation, the senior member of the board sends the original FSIR and its supporting documents directly to CMC/SD, with a copy forwarded through the endorsing chain by mail. The endorsing chain usually is the same as the operational chain of command, but it can include other commands, such as systems commands and installations, that may need to take corrective action.

**What is the relationship between Navy and Marine safety officers?** Despite the differences in each service’s references, procedures and training, the Navy and Marine safety officers share an important goal: preventing and reporting mishaps. Both safety officers must cooperate to ensure mishap reports and investigations are accurate and timely.

*The author’s e-mail address is jcleary@safetycenter.navy.mil.*

**For More Info...**

1 Navy people report mishaps according to the guidance contained in Chapter A6 of the NavOSH Program Manual for Forces Afloat (OpNavInst 5100.19C), with change 1.

2 Embarked Marines report mishaps according to MCO 5102.1.

**How Much Is “Enough”?**

*By Ltjg. Daniel Altruz,*

*USS*Thach *(FFG 43)*

That’s the question the CO of USS *Thach* asked a foreign pilot who wanted to squeeze his ship between two others (a foreign frigate and a U.S. Navy destroyer) already moored at the same pier. “Looks like a tight fit to me,” said the CO during the sea-and-anchor detail.

The pilot responded, “The port facility assures me there is enough room.”

Still skeptical and unwilling to take any chances, the CO had the operations officer call the dockmaster on the bridge-to-bridge radio. The dockmaster assured him there was a 500-foot separation between the two other ships available for *Thach* to moor. During the line-up and approach, however, the ship’s safety observers on the fo’c’s’le and fantail saw clearly that *Thach* would not fit. They immediately told the CO and operations officer, and the CO halted the approach. He refused to moor until an alternate berthing assignment was made.

Measurements taken after the fact confirmed the original berth was only 460 feet long. This length would have allowed 3 feet leeway fore and aft. Because the foreign frigate was using its stern line as an aft tending spring line, *Thach*’s bow would have been riding on this line. Meanwhile, the ship’s stern would have been riding on the lines of the Navy destroyer moored in front. If the CO had let the pilot persuade him to moor between these two ships, all three would have been at risk.

Here are the factors that prevented this close call from being a serious mishap:

**Situational awareness of the watchstanders aboard *Thach*.** The CO, bridge team, and safety observers all realized what the pilot and port-control authority was telling them wasn’t right. The CO and watchstanders also knew about another ship that had been damaged when it tried to moor in a berth without enough space.

**Highly experienced safety observers (a BMCS and an FCCM) who strongly objected to the mooring.** Junior personnel may have lacked the forcefulness of character to tell the CO the mooring just wouldn’t work.

**Effective communication among all watch stations and the OOD.** The smooth flow of information allowed the CO to quickly assess the hazards and to take decisive action to avoid a mishap.

Although it’s human nature to want to believe what we’re told, a little cynicism in shiphandling can be a good thing. By being aware of the big picture and not taking assurances of the pilot and dockmaster as gospel, the CO avoided a costly situation. Take what you’re told with a grain of salt.

**Steam Leak Turns Shower Stall Into Coffin**

*By GSCS(SW) Brad Spahnie,*

*Naval Safety Center*

“Suddenly, I heard a deafening sound like a shotgun blast, followed by a loud roar. As I turned instinctively to the door of the washroom, a wave of heat from condensing steam threatened to blind me. Squinting and ducking down, I made my way to the door. Once I grasped its handle, I threw it open and dived headlong onto the deck of the berthing compartment.”

That’s how a PO2 described his painfully close encounter with death aboard a *Spruance*-class destroyer. A shipmate, a PO3, was killed in the same incident, which occurred when a brazed joint on a steam-system fitting failed.

The destroyer had completed a three-day transit to a liberty port. After the ship had moored, the in-port duty section was set, and the engineering plant went to auxiliary steaming, single-generator operation because shore power was not available. The CO had left liberty call to the discretion of department heads, and many shipmates had gone ashore or were resting.

In a forward berthing space, several Sailors sat watching a movie while one talked to the messenger of the watch (MOOW) by phone. Meanwhile, the PO3 was in a shower stall that was separated from the washroom by a fiberglass door. The PO2 had just entered the washroom and was standing at a sink with his back to the entrance door when he heard the deafening sound. Moments later, scalding condensate and steam poured down on his head, neck and back.

Those Sailors watching the movie were jolted to alertness by the explosive sound and instantly jumped up to help their injured shipmate. They removed his shirt, which was soaked.

On the quarterdeck, the MOOW heard the bang and loud hissing--“like you expect to hear from a freight train,” he later said. He also heard screaming just before the phone line went dead. After telling the OOD what he had heard, he requested permission to investigate, since he was part of the rapid-response team. Before he could leave, the watch received a medical-emergency call from berthing. Word was passed for a duty corpsman to lay to upper-ops berthing. Unknown to the OOD, however, a corpsman had not been assigned to the watch section.

In the meantime, a watch in the central-control station (CCS) received a call from upper-ops berthing about the steam leak. Because the CCS watch didn’t understand the severity of the leak, he sent the sounding-and-security watch to investigate. No word, though, was passed for the in-port, emergency-response team to deploy, and no one called the quarterdeck watch about passing the word on the casualty. In response to another call from someone in upper-ops berthing, the quarterdeck watch did pass word again over the 1MC for a duty corpsman.

About the same time, a stretcher-bearer from the duty section arrived in the berthing compartment as a result of hearing the first announcement. By now, the CCS watch was receiving more reports of a steam leak. The sounding-and-security watch still hadn’t reported anything, so the CCS watch ordered an equipment monitor and duty electrician’s mate to investigate.

Back in berthing, steam was filling the space through vents in the bottom of the joiner door. The PO2 was able to walk and, escorted by the stretcher-bearer, headed to medical. Finding medical locked, the duo proceeded to the quarterdeck, where a corpsman was returning from doing his laundry ashore. The corpsman and the stretcher-bearer helped the PO2 to medical for treatment, then took him to a local clinic.

During these events, the sounding-and-security watch found steam coming from the natural vent in the shower room and went to auxiliary machinery room No. 1 to tell his LPO, an EN1, who also was in a duty status. Meanwhile, the equipment monitor and duty electrician’s mate arrived at the mishap scene. The monitor left to isolate the leak, and the duty electrician’s mate called the CCS watch to report the extent of the casualty. The EN1 had been in the auxiliary room for 10 or 15 minutes, trying to lower the salinity of the online-distilling plant. He told the sounding-and-security watch to shut SS-17, one of the header cutouts feeding the forward main-steam system. While these two still were talking, the CDO told the quarterdeck watch to pass the word about a major steam leak--**10 minutes** after the leak occurred.

At this point in the events, steam-supply pressure to the distilling plant was reading 35 psig. Pressure returned to the normal 100 psig in a few moments, and the sounding-and-security watch left the space to isolate SS-17. When isolation was completed, the in-port emergency team used box fans to ventilate the space. Concerns for this team’s health prompted a heat-stress survey before letting anyone enter the washroom area. The first reading showed 156 degrees--close to the limit of the meter. Ventilation and readings continued until the space was safe to enter.

When the team members opened the door to the shower area, they were horrified to find the body of the PO3. No one knew he had been trapped and killed.

The source of the steam leak was the brazed joint on a 1.25-inch-to-0.75-inch tee fitting in the steam supply. The three-quarter-inch copper line that branched off the supply line had blown out of the tee. The fitting was a socket-type that required an alloy-ring insert for making the joint, but investigators could find no evidence to show the insert was in place when the system was installed.

The joint was assembled by a process called “face feeding.” This process involves applying braze to the exterior, joint-matting area of a pipe and fitting, then drawing the braze into the joint with heat. Face feeding is allowed on a grooved-type joint, but only after flowing the braze from an alloy-ring insert and verifying that at least two-thirds of the joint’s circumference shows brazing alloy. No history of repairs to this joint could be found, which made investigators believe the work was done during construction.

A metallurgist tasked to analyze the fitting and pipe section found cracks around the brazed joint, but no leaks were reported before the fitting failed. Investigators found a pattern of surface rust above the joint area, but this problem could have been the result of high humidity in the space, repeated problems with steam and condensate piping in an adjacent heater closet, or the fitting itself. The piping run was insulated, which also would have masked a small leak if one existed.

The investigators recommended several ways to address the soundness of auxiliary-steam systems on this class of ship. As a result, inspections have been ordered, and ShipAlts have been accelerated to upgrade the copper piping to a higher strength alloy.

*The author’s e-mail address is bspahnie@safetycenter.navy.mil.*

# Aircraft Elevator Kills One, Injures Another

*By MMCS(SW) Don Forrester,*

*Naval Safety Center*

“Once the aircraft elevator started rising, it took only a few seconds to crush the man-lift basket. But it took hours for rescue personnel to cut the victims out of the basket.” That’s how witnesses described a horrible mishap aboard an aircraft carrier, in which one victim was crushed to death, and the other escaped with a compound fracture to his ankle. The contract workers were pinned between the elevator and the overhang of the flight deck while they were greasing the flight-deck stanchions.

This tragedy started unfolding when a group of ship’s-force and contract workers had finished testing the sump pump on the same aircraft elevator. Two Sailors from the ship’s auxiliaries division were securing equipment used to test the sump pump when one of them, an MMFN, noticed a problem. The sight glass on a high-pressure tank was a little low. Thinking now would be a good time to return the level to normal, he used a main-hydraulic pump to start pumping hydraulic fluid from the low-pressure exhaust tank to the high-pressure tank--normal procedure if everything is aligned correctly.

About the same time, an MM2 heard the fluid rushing through the pipes. He also saw the hydraulic engine start moving the aircraft-elevator platform, because hydraulic fluid was going to a misaligned directional-control valve. The MMFN should have checked this valve before he started transferring the hydraulic fluid.

Here are other contributing factors in this tragedy:

***** The contract workers ignored rules1 and didn’t have the elevator platform tagged out before they started working on it. They should have asked the tagout be done when they finished testing the sump pump.

***** The pump-room placard containing procedures to be used to return the aircraft elevator to normal operation after an emergency run listed incorrect procedures, which didn’t agree with the technical manual. They left out the step to return the control valve to a neutral position.

***** The local SupShips’ sump-pump-test procedures didn’t include steps for returning the hydraulic plant to normal operation. It is standard procedure throughout the Navy to leave that task to ship’s force.

***** Engineering operational sequencing system (EOSS) procedures didn’t exist. The engineering department didn’t have locally prepared EOSS procedures as required.2 Instead, personnel used a technical manual written in the 1960s, which listed only a few cautions and warnings.

***** The MMFN never had run an aircraft elevator in the emergency mode. Although this usually is a requirement to qualify as an elevator operator, the ship had waived it. Instead, candidates were briefed on the procedure during classroom training.

***** No one knew the elevator could be lowered in the emergency mode. As a result, the rescue took longer than it should have.

As I visit ships during surveys, I cringe each time I see a Sailor working around an aircraft elevator, a cargo-weapons elevator, a stores conveyor, or other man-killer. I always wonder if I’ll read a mishap report about this shipmate in tomorrow’s message traffic.

*The author’s e-mail address is dforrest@safetycenter.navy.mil. Some information for this article came from Jim Wilder, mishap-investigation division head in the Shore Safety Programs Directorate at the Naval Safety Center.*

**For More Info...**

1 Instructions in paragraph 630.17 of the Standard Organization and Regulations of the U.S. Navy (OpNavInst 3120.32C) require workers to tag out an elevator platform before starting work on it.

2 Locally prepared EOSS procedures are required by the Engineering Department Organization and Regulations Manual (EDORM).

**A Tough Decision**

*By Lt. Paul Berthelotte,*

*Naval Safety Center*

Commanding officers face many unique decisions, but none may be more difficult than a life-or-death call like the one the CO of an Australian Navy oiler had to make less than a year ago. His ship was clearing the outbound channel from Fremantle, with restricted-maneuvering doctrine in effect, when a major fire erupted in the main-machinery room.

Should he flood the space with CO2, and let it cool down? In most cases, flooding would have been the right thing to do, but this CO had heard reports that four people might be trapped in the space. The ship’s main-space fire doctrine didn’t cover this circumstance.

**What Happened in Engineering?**

Before getting underway, the ship had undergone an assisted maintenance period. During that time, members of the ship’s company, along with workers from an intermediate maintenance activity and several contractors, had replaced the fuel-oil supply lines to the main engines. They used flexible hoses in place of the original fixed-steel piping. The ship’s maintenance officer and the contractor made this decision without doing enough research to determine if the flexible hoses met standards and would work.

The ship had steadied on course after turning onto the final leg of the deepwater channel when the engineer in main control called the OOD. He asked for permission to bring the engines to all stop or “emergency de-clutch.”

Moments before this request, a roving patrol had found liquid spewing from the inboard side of a main engine when he entered the main-machinery space from the main-control room. Because he didn’t know if the liquid was water or fuel, he descended a short centerline ladder to investigate. Suddenly, the strong smell of fuel oil hit him. *[U.S. Navy ships are manned at all times when the diesel is running so watchstanders may act immediately to control leaks.--Head, Engineering, Damage Control & Firefighting Division, Afloat Safety Programs Directorate]*

The petty officer had to return to the main-control room to report the fuel leak. He couldn’t call from the main-machinery space because the engines made too much noise. *[Aboard U.S. Navy ships, a 5JV circuit provides amplified communications on all levels of the machinery spaces.--Head, Engineering, Damage Control & Firefighting Division, Afloat Safety Programs Directorate]*

When the engineering warrant officer went to inspect the problem, he found what he later described as “a major, high-pressure leak.” More fuel than a garden hose would expel was streaming into the bilge. In the meantime, the petty officer who had discovered the leak was isolating it manually. As the warrant officer headed back to the main-control room, he saw a misty vapor cloud rising above the port main engine. *[U.S. Navy procedures call for setting negative ventilation to remove vapors and smoke.--Head, Engineering, Damage Control & Firefighting Division, Afloat Safety Programs Directorate]*

The EOOW ordered fire hoses to be faked out on deck. One hose was faked out on the middle plates, but it wasn’t charged. By this time, members of the at-sea fire party had arrived in the main-control room and were dressing out in combat coveralls, steel-toed boots, flash gear, and open-circuit, compressed-air, breathing apparatuses. The EOOW ordered the fire party into the main-machinery space, but the engineer said to stay in the main-control room. He was concerned about the team slipping in the fuel on the deck. He also thought the two members wearing breathing apparatuses would have trouble descending the ladders into the space.

Once the fuel to the port main engine had been isolated, the engineering warrant officer searched for the cause of the leak. He found a damaged banjo bolt and started replacing it.  

Meanwhile, a petty officer assigned to lay out the fire hoses in the main space was heading forward when he noticed a bubbling liquid on the exhaust covers of the starboard main engine. Suddenly, a flame about one meter in diameter erupted from the liquid. A big fireball immediately followed. It shot up and out, covering much of the starboard side of the space.

Flames from the fire on the starboard main engine hit a bulkhead, then headed up to the plates that form the deck of the main-control and main-switchboard rooms. Rolling forward and aft, the flames quickly burned electrical cables directly above the main engines. These cables provided power for machinery, communication to the bridge, and the evacuation siren for the main-machinery space. Burning insulation covering the cables added to the amount of smoke and toxic gases being generated in the main-machinery space. Some of this dense, black smoke seeped into the main-control room through cable openings in the deck.

At this point, two petty officers in the burning space tried to fight the fire with a 90-liter, AFFF extinguisher. The fire hoses still weren’t charged. One of the petty officers saw a massive fireball erupt from the top of the main engine and heard a loud “woof” sound. He also felt intense heat, as if the very air itself were on fire.

A second fireball sent everyone scurrying to evacuate the space. The petty officer with the AFFF extinguisher quickly realized the inferno was out of control, and he tried to flee. He was overcome by the smoke and toxic gases, though, and passed out while trying to find the workshop door at the top of the port ladder. This petty officer made what could have been a fatal error: He didn’t put on an emergency-escape-breathing device. He survived only because the engineering warrant officer opened the workshop door for one more look and saw the petty officer on the deck. The warrant officer dragged him inside to safety and shut the door. He was the last one to leave the main space alive.

Three junior enlisted and one midshipman died of smoke inhalation within 10 minutes after the fire started. None of the victims had taken emergency-escape-breathing devices (which were readily available) from their holders.

The main-control room soon had to be evacuated. As required by standard operating procedures, the EOOW was the last to leave. A petty officer and the engineering warrant officer helped fit the EOOW with a breathing apparatus. As he left the space, en route to damage-control central, he grabbed a pegboard used to indicate the whereabouts of engineering personnel--specifically, those who were in the main space. Unfortunately, personnel didn’t always use the pegboard, and it was inaccurate this day.

After the CO2 drench flood, a check revealed that only 45 percent of the cylinders had released. Loose wires on the release mechanisms of all the others forced the engineering warrant officer to activate them manually. A decision then was made for a hose team to reenter the space because temperatures still had not dropped. In fact, they seemed to be rising. The ship’s hose teams alternated fighting the fire until all the hot spots were cool and the fire was out. *[U.S. Navy procedures require waiting 15 minutes before checking several locations for the effectiveness of the CO2 or Halon flooding. A decision then is made about how long to wait before allowing reentry. If the fire isn’t spreading, you should wait for the space to cool before reentry.--Head, Engineering, Damage Control & Firefighting Division, Afloat Safety Programs Directorate]*

**What Happened on the Bridge?**

The EOOW called the bridge and reported a major fuel-oil leak in the main space, then requested an “emergency de-clutch” of the port main engine. *[U.S. Navy procedures call for going to GQ for a major fuel-oil leak and activating the bilge-sprinkling system.--Head, Engineering, Damage Control & Firefighting Division, Afloat Safety Programs Directorate]* The OOD granted this request, but the navigator rescinded it and issued the correct one, which was “Stop.” If the navigator hadn’t intervened, the ship would have lost power to both main engines for about four minutes.

While the at-sea fire party, the equivalent of a flying squad, mustered in the main-control room, the navigator used the 1MC to let the crew know what was happening. He also told the OOD to start planning what to do if the fuel oil were to ignite.

Four minutes later, the EOOW reported that he had a main-space fire. Simultaneously, fire alarms sounded on the alarm panel. The EOOW initially said the fire was in the main-control room. When the navigator asked for verification, though, the EOOW corrected his report and said the fire was in the main-machinery space. The EOOW next asked permission to shut down the starboard main engine because it was on fire. Thirty-one seconds after the EOOW reported the fire, word was passed on the 1MC to go to general quarters.

Just after the fire started, the navigator announced, “We’ve got to decide whether to anchor.” Four minutes later, the helmsman reported that the ship had lost steerageway. The priority of the bridge watch then became containing the fire and determining if there were any casualties. The bridge watch continued to fix ship’s position, but with no electrical power to the gyros and power spikes affecting other navigation equipment, they had their hands full.

After losing both main engines, the disabled ship lay in the channel, with shoals on both sides. Because the beam lay to the wind, the ship began to drift closer and closer to shallow water. The CO, in consultation with the navigator, decided not to drop the anchor, because they weren’t sure they would be able to raise it. “What if the fire rages out of control, and the ship has to be towed clear of the coast?” they wondered. “What if the fire is extinguished, but the ship has to be towed back to port?”

The engineer phoned the bridge and told the CO there was a major fire in the main-machinery space. He recommended a CO2 drench, but added, “I think there’s at least one person still in the space.” The CO decided to wait and ordered a hose team to search for missing personnel. Because he was concerned about the quality of the phone communications, the CO went to the fire-control room and spoke with the EOOW to ensure he had received the correct message.

The CO then went to damage-control central and talked to the engineer about the crisis. Again, the engineer strongly suggested a CO2 drench. The engineer was left with the impression that the CO wanted him to search for five more minutes, then activate the CO2. The engineer passed this word to the chief petty officer in charge of the hose teams. His next order was to withdraw the team from the main-machinery space.

The CO later stated that he had not approved the CO2 drench. It wasn’t until he returned to the bridge that he concluded it would have been impossible for anyone to survive in the space for 25 minutes after the fire started. Five minutes later, the engineer again called the CO and asked for approval of a CO2 drench. The captain ordered, “Pull out and execute the CO2 drench.”

*The author’s e-mail address is pberthel@safetycenter.navy.mil.*

# A Sailor’s Nightmare

*By Cdr. Elizabeth Rowe,*

*Naval Safety Center*

Two Sailors assigned to a ship in the yards have just finished evening chow on the messdecks in an attached barge. One Sailor is on restriction as a result of the CO’s non-judicial punishment; the other is bored.

“What do we do now?” the one asks.  

“I know,” says the other. “Let’s grab a smoke.”

“Naw! I don’t smoke, and besides, you have to get a second class to escort you off the ship to the smoking area since you’re restricted.”

“That’s what you think. There’s a place on the ship that some of us know about where you can smoke with no fear of ever getting caught.”

“Really?”

“Sure! Let me show you.”

“OK. Let’s go!”

The Sailors leave the mess decks and return to their ship. In some spaces, contractors are hard at work, but many spaces have been deserted since the yard period started. All berthing and messing facilities have moved off the ship.

Shipyard workers have removed more than 300 access covers in bulkheads and decks for the yard period, with warning signs posted, saying, “Caution--Do not enter this space without proper ventilation.” In the passing months, however, Sailors have explored and discovered areas that are “safe”--no toxic gas, and ducting that provides ventilation--like the exhaust trunk this pair is headed toward.

“Just crawl through this access in the bulkhead. There’s a deck and plenty of room to stand up inside.”

“OK.”

The Sailors crawl into the space just as the sun is setting. Although a large ventilation duct is just to their left, the space inside the trunk rapidly is becoming dark.

“Hey, man, get away from that vent. The CO’s porthole is just outside, and he might see us." The non-smoker moves to his right while the restricted Sailor fumbles for his cigarettes. They are now in total darkness.

“Where does this go?” asks the first Sailor. The smoker is going to tell him not to wander too far, but before he can utter the warning, he hears sounds that make his blood run cold. First, there’s a clunk, then a startled cry, followed by a muffled thump. The Sailor has tripped over the lip next to the vertical drop in the exhaust trunk and fallen to his death, five levels below.

This mishap speaks volumes about the shortcomings of warning signs. Although it seems obvious you should follow a sign that says to “keep out,” that frequently isn’t the way things work in the fleet. In time, Sailors stop paying attention, especially when they have learned that some of the signs are just there for shipyard convenience. In this case, the sign meant what it said.

When a ship is in the yards, the safety officer and division safety petty officers must work extra hard to educate the crew about the new hazards they face. Warning signs are important, but they obviously aren’t foolproof. Speaking of foolproof, I can’t think of any way to describe wandering around in a pitch-dark, unfamiliar space as other than “foolish.” Don’t go where you’re not supposed to go; this is a basic lesson in risk assessment. If you have to enter an unfamiliar space, use a flashlight. And while you’re at it, quit smoking.

*The author’s e-mail address is erowe@safetycenter.navy.mil.*

sidebar

**Ways To Prevent Nightmares**

*By CWO3 Dave Cerda,*

*Naval Safety Center*

Mishaps involving tanks, voids, uptakes, and vent shafts don’t always end in death. For example, crewmen aboard an amphibious ship left off a manhole cover to a ballast tank during ballasting operations. No one was injured, but flooding caused $20,000 worth of water damage in four compartments.

In an incident aboard a destroyer, a Sailor holding sweepers stepped on a temporary manhole cover that didn’t fit right. She fell and injured her face.

Here are some things you can do to prevent mishaps like these:

***** Use the daily damage-control closure log1. Damage-control assistants, fire marshals, and division officers must know what manhole covers are removed.

***** Damage-control officers and their assistants must know the requirements for entering confined and enclosed spaces2. They must hold shipwide training for all hands. Special training must be provided as operations and situations dictate.

***** Train maintenance personnel to follow procedures for entering tanks and voids. These procedures include getting permission, tagging out, logging open, gas-freeing, using PPE, and posting safety observers.

***** Inspect manhole covers and gaskets3. Besides looking for bad gaskets, check for missing bolts, nuts, washers, and stripped or damaged threads. Replace or repair as required. **Note:** Gaskets that may come in contact with fuel or other petroleum products have special requirements4.

***** Use guardrails or chains, supported by stanchions or pads, when you leave accesses in bulkheads or decks open that usually are closed5. The Naval Safety Center also recommends using a safeguard to keep people from falling into a tank or void. This device can be a temporary cover made of heavy-gauge, expanded metal in the shape of the manhole, complete with fittings so you can bolt it to the manhole. Another example of a safeguard would be a 2-inch-wide-by-0.25-inch-thick piece of flat bar bent in a U-shape, with two 90-degree ears on each end. Drill a 0.75-inch hole in each ear, and you can bolt the safeguard to the manhole. If you choose this type of safeguard, you can use enough flat bar so the device will stand about two or three feet high. Use photoluminescent tape and striped caution tape to make the safeguard more visible. As a last resort, post a watch to prevent people from falling into a tank or void.

*The author’s e-mail address is dcerda@safetycenter.navy.mil.*

**For More Info...**

1 Naval Surface Ship Survivability NWP 3-20.31, Paragraph 2.1.15, requires ships to use the damage-control closure log.

2 Requirements for entering confined and enclosed spaces are described in the NSTM, Chapter 074, Vol. 3 (Gas-Free Engineering).

3 Refer to MIPs 1230/003-95 and 1230/002-93 for inspecting manhole covers and gaskets.

4 Gaskets that may come into contact with fuel or other petroleum products must meet requirements of Mil-R-15624, Class 3. You can use the Damage Control Watertight Closures Inspection, Maintenance and Repair Booklet (NavSea S9169-AW-DCB-101) as a guide.

5 Guardrails or chains, suitably supported by stanchions or pads, are the prescribed precautions in paragraphs C0102ab and D0102ab of the NavOSH Program Manual for Forces Afloat (OpNavInst 5100.19C), with change 1, any time you have open accesses in bulkheads and decks that usually are closed.

**From Rescuer to Victim**

*By Lt. Cathleen Donohue,*

*Naval Safety Center*

A Sailor trips and falls overboard from the flight deck of an aircraft carrier--a drop of 65 feet--while it is doing 30 knots. Another Sailor on the flight deck sees his shipmate fall, calls, 

“Man overboard!” on the flight-deck radio, and jumps overboard to rescue the shipmate. Both Sailors suffer multiple internal injuries and are lost to the command.

In another case, two shipmates are moving a piece of equipment off a barge when one loses her balance and falls backward. She lands where she might tumble into the water. The other Sailor quickly reaches to his fallen shipmate in an awkward, unstable way and injures his back.

These two mishaps, which were reported within a few days of each other, are examples of Sailors who lived but sustained serious injury due to impulsive behavior. A few years ago, however, the Navy lost three Sailors while they tried to rescue a shipmate who had gotten pinned between heavy metal sheeting and a bulkhead. The shipmate managed to crawl to safety, but the would-be rescuers were crushed to death.

In the Navy, there are all types of heroes. They can be officers, enlisted, surface warriors, aviators, old, young, or any mix of personal and professional characteristics. I often read messages about Sailors who try to be heroes. Sometimes, their efforts lead to tragedy. Instead of calling for help, donning protective gear, or taking precautions, they leap into a situation and pay the ultimate price... The true hero is a solution to a problem, not another casualty. 

We should focus on risk analysis because Sailors need to know their limitations, as well as the potential consequences of hasty action and how it can complicate an already bad situation. Identifying and assessing the hazards at hand and training on the unforeseen are the basis of operational risk management (ORM), which must be taught at all levels to be successful.

*The author’s e-mail address is cdonohue@safetycenter.navy.mil.*

**Why Divers Can’t Afford To Blink**

*By MMC(SS/SW) Kevin Gest,*

*Naval Safety Center*

Always question; never assume. When we fail to obey these two laws of survival, the best we can hope for is to live and learn from our mistakes. Two diving incidents that happened less than a week apart make this point.

**Flags Should Have Gone Up**

As a submarine neared the end of its maintenance period, the ship’s 3M coordinator asked divers to remove a blank flange in a system that was being repaired. This move was aimed at avoiding a schedule conflict between the diving operations and the start-up of the reactor.

Piping downstream from the flanged system still was disconnected, but the hull and backup valves had passed hydrostatic testing. There was little danger of flooding as long as everyone followed procedures.

The divers contacted the shipyard’s lead work center to verify the job, which was scheduled the following afternoon. The next morning, a dive-locker representative reviewed the diver-safety tagout aboard the submarine and briefed the ship’s duty officer (SDO) on other work planned in main-ballast tank (MBT) No. 5. During this brief, the SDO requested that the divers also look at a loose range pinger that contract divers previously had reported. No one, however, mentioned removing the blank flange.

When the divers had completed the job in MBT No. 5, the diving supervisor spoke to the ship’s duty CPO about the divers removing the blank hull flange. The duty CPO realized the flange still had danger tags attached that would have to be removed. Before going below to have these tags cleared, the duty CPO reminded the diving supervisor about the loose range pinger, assuming the divers knew about the uncleared tags on the hull flange. He figured they first would look at the pinger.

Unfortunately, the dive team went straight to work on the hull flange while the tether and hull-stop valves still were danger tagged. By the time the duty CPO returned topside, the divers already had removed the flange. The only reason the submarine hadn’t flooded through the open downstream piping was because the hull and backup valves were shut. To regain control of the situation, the SDO had the divers reinstall the blank flange.

A critical stage of every ship’s-husbandry dive is the liaison between ship’s company and the dive team’s on-board representatives, who are the dive supervisor’s eyes, ears and voice. Before going aboard, the representatives must be briefed thoroughly about all planned work and must know what questions the dive supervisor wants answered.

During the liaison, ship’s company must make every effort to clarify any questions about the work. It also is crucial for them to ensure the dive-team representatives understand the ship’s status and any requirements the ship may have. After returning to the dive side, the on-board representatives brief the dive supervisor before any divers enter the water.

**Swim Call in a Pump Room**

Divers aboard a DDG 993-class ship had to install a blank flange over the fathometer transducer so ship’s force could replace it. The work request for this job described the location of the transducer and said that ship’s force would supply the blank flange.

The docking drawing supported the documentation on the work request, so tags were hung and diving operations started. The divers saw a second transducer, identified as an Atlantic Undersea Test and Evaluation Center (AUTEC) transducer on the docking drawing, less than 2 feet forward of their work site. After comparing the diameters and bolt-hole descriptions of the two openings with the drawing, the divers felt they were at the correct hull opening.

Once the divers had installed the blank flange, ship’s force loosened the nuts on the studs and pried up the transducer a quarter-inch to make sure the blank flange was in place and sealed. As expected, a small amount of water came through the flange, and the pressure between it and the transducer appeared to be relieved. Ship’s force signed the work package, verifying the blank flange was in place, and the diving supervisor left for the dive barge until the job was completed.

Ship’s force went ahead and removed the nuts from all the studs, then used a chain fall and pry bar to lift the transducer a little farther. Suddenly, water gushed into the void from around its sealing surface. The void was so small it only could hold one person, and he quickly left. Moments later, the transducer broke free, flooding the void and the pump room above it. Three Sailors in the latter space escaped without injury and closed the external hatch. In about 30 seconds, the pump room flooded to the overhead, submerging pump motors and controllers.

The diving supervisor, who was still aboard, recalled the divers to install another blank flange and to check the other one. A flat patch, provided by the dive locker, was installed over what was thought to be the opening for the AUTEC transducer. The patch instantly sucked up to the hull and was secured with a standoff and hogging line. Ship’s force then pumped down the water level in the pump room and finished changing out the transducer.

The root cause of this problem was an error in the docking plan. It showed the wrong hull opening for the AN/UQN-4A transducer. In this case, the technical documentation led maintenance people to believe the correct hull opening was blanked. In actuality, the transducer was installed in a hull opening other than the one indicated on the docking drawing. Placing a diver inside the ship to pound at the target opening with a hammer is a way to make sure you’re at the right flange. If this method had been used, the dive team would have known that something was out of place--namely, their blank flange.

A second cause was prematurely removing all nuts from the transducer studs. The efforts of ship’s force to verify the transducer seal weren’t enough to break the actual seal between the flange and the hull. It’s never a good shop practice to remove the nuts from all the studs until the flange is fully broken from the hull. Also, when work involves blanking a hull opening, and the installed flange constitutes single-valve protection, dive supervisors should consider remaining on station until they hear that the flange seal is fully broken.

Policies and checklists are fine, but it’s the diver who provides the first and last safeguard against disaster. A danger tag won’t reach out and shake a diver; neither will a faulty ship’s drawing ring its own alarms. The diving supervisor and the dive team provide the only continuous thread of vision for in-water repairs. For them to blink is to invite a catastrophe.

*The author’s e-mail address is kgest@safetycenter.navy.mil.*

**Risk Management Keeps Tow Afloat**

*By Ltjg. Will Ranney*

*and Ens. Chad Houllis,*

*USS*Safeguard*(ARS 50)*

The French scientist Louis Pasteur once said, “Chance favors the prepared mind.” That statement rang true for our crew during an open-ocean tow of a decommissioned destroyer.

After a textbook hookup in Port Hueneme, Calif., we set out for Pearl Harbor. We inspected the destroyer before getting underway and found it to be in a state of disrepair, but it was seaworthy for the transit. The first few days were uneventful. On the third night, however, during the early hours of the midwatch, the bridge team reported that flood-warning lights and audible alarms were sounding intermittently on the tow. The OOD told the CO about the alarms, then started preparing a team to board the ship at first light and investigate. From the moment the first alarm sounded, we began using the operational risk management (ORM) process and kept using it throughout the transit.

We discussed the feasibility of sending a team to the ship, weighing the safety of crew members against the importance of completing the assignment. Once we had decided the benefits of deploying a team to investigate the extent of damage outweighed the risks, we began planning the operation.

We picked the people for the boarding team; then, the ship’s master diver thoroughly briefed the members. During this briefing, he discussed the various risks of the job:

***** injuring personnel or damaging equipment while offloading them from a RHIB to the destroyer in 3-to-5-foot seas

***** loss of voice communications while coordinating efforts of the bridge, launch-and-recovery, and the away teams

***** the weather getting bad enough to strand the boarding team on the tow

***** problems with rigging lights in the interior of the tow so people wouldn’t be working in the dark

***** carbon-monoxide poisoning and the need for OBAs while running the pre-staged P-100 pumps in an enclosed space

***** the likelihood of causing more damage to the vessel if extensive repairs were necessary on the deteriorating hull.

With preparations complete, the boarding team deployed. When the members had boarded the destroyer, they found 3 feet of water in the after machinery room caused by a 2-foot crack in the hull. Their work to dewater the space and repair the crack required several changes (often made on the fly) to the original plan, but everyone’s well-being remained the team’s main concern.

The plan changed again once the dewatering and repairs were complete. The team decided to use salvage pumps capable of higher vertical lifts. They rigged these pumps on the main deck, so no one had to use an OBA, and extra lighting wasn’t necessary. The decision also made it easier to do the dewatering that had to continue daily throughout the rest of the transit. Further repairs to the crack were impossible.

We completed towing the destroyer to Pearl Harbor with no injuries or loss of equipment, even though the repair team made 10 trips back and forth during the trip.

From their first day of training, people in the diving and salvage community learn the necessity of ORM. The very nature of the environment in which divers work demands that they rely on ORM as a means of accomplishing their mission while reducing needless risks. Before every dive or salvage operation, they review a comprehensive checklist and scrutinize every detail of the plan to eliminate potential hazards.

**The Key to Mishap Prevention:**

**Not What Happened, But Why**

*By Cdr. Elizabeth Rowe,*

*Naval Safety Center,*

*LCdr. Rex Lacy,*

*Staff, ComOpTEvFor, and*

*Lt. Scott Sciretta,*

*Naval Postgraduate School, Monterey*

On June 20, 1992, a Navy ship slammed into a merchant vessel southeast of the one-fathom bank in the Strait of Malacca. This collision caused $19.4 million in damage to the Navy ship’s hull, interior and sonar system. Why did it happen? Investigators found the CO and key subordinates failed to establish and use specific procedures. This failure answers the “why” and offers an excellent example of how human factors cause mishaps.

Studies show the cost of human error is increasing as the Navy introduces larger, faster and more sophisticated ships. At the same time, however, the means for countering human error in shipboard mishaps has not kept pace. As a result, during the past five years, damage from afloat mishaps cost an average $33.3 million per year.

After mishaps, the chain of command normally identifies those who are to blame through the legal investigation. But those people weren’t working in a vacuum; they were affected by many outside influences, including supervisors, equipment design, crew coordination, stresses, time pressures, and the culture of the organization. Pointing fingers at people doesn’t change these factors. To make a real difference and to prevent recurrence, we must understand and change the environment in which they live and work.

The National Academy of Science’s Maritime Transportation Research Board studied commercial-ship mishaps and near-mishaps and identified 14 factors that are either major or potential causes. The list includes inattention, an ambiguous relationship between the pilot and master, inefficient bridge design, poor operational procedures, poor physical fitness, poor eyesight,  fatigue, alcohol use, excessive personnel turnover, high levels of calculated risk, inadequate lights and markers, misuse of radar, uncertain use of sound signals, and failures to follow prescribed navigation rules.

In much the same way, analysts at the Naval Safety Center and the Naval Postgraduate School in Monterey, Calif., have joined forces to identify and analyze the human causes of naval mishaps. The studies first focused on naval aviation but have been expanded and modified for use aboard surface ships, submarines and with divers.

Psychologists at the Naval Safety Center developed a hierarchy called the Human Factors Accident Classification System (HFACS), which provides a comprehensive view of possible human factors. The four levels of human failure are:

**Unsafe acts of the operator.** These acts include errors and violations. People make errors in following procedures because they stop paying attention, forget things, or lack experience. Violations are considered deliberate acts, rather than mistakes. 

**Unsafe supervision.**This level of human failure has two parts: inadequate supervision and supervisory violations. The former includes such things as the supervisor being absent, not providing proper training or supervision when present, or not fixing known problems. Supervisory violations are deliberate, wrongful acts or a supervisor’s blatant disregard for authority. An example would be a supervisor authorizing work on equipment without tagging it out because “it takes too much time.”

**Unsafe conditions of the operator.** There are two categories of unsafe conditions: medical and crew-resource management. Medical conditions include everything from stress in a crew member’s personal life (if it causes poor performance) to obesity, which limits the crew member’s agility aboard ship. Poor crew-resource management is the result of not matching people assigned to a watch team or not training team members. As a result, communication breaks down, the team lacks coordination, and team members don’t support one another.

**Organizational influences.** External organizational influences are those a ship cannot affect because the CO does not have the authority (e.g., budgetary allocations to the unit or manning percentages). Internal organizational influences include the chain of command, policies, culture (how things really get done within a command), and, finally, oversight (how frequently the ship reviews its safety procedures, or how well established and supported the safety program is).

In analyzing Class A mishaps (which cost $1 million or more, kill or permanently, totally disable someone) occurring between 1992 and 1998, studies indicate it’s not only individual human factors that cause mishaps. Instead, it’s a combination of the factors just discussed, plus three other factors--**material**, **design** and **procedures**.

**Material** causes involve equipment that fails for reasons other than a flawed design. Let’s say a piece of equipment breaks because of corrosion, injuring someone. If this equipment had been properly maintained, the mishap would have a material cause.

**Design** errors also cause mishaps. For example, two ships collide, and one of the factors leading to the mishap is a radar that wasn’t used because it is awkward or hard to use.

Problems with **procedures** don’t mean a Sailor didn’t follow the rules--that would be human error. Instead, it means the problem was with the procedures themselves. Perhaps there were no written procedures for doing a job, but Sailors needed some. Or the procedures may have been too complicated to follow or had a step that was incorrect or missing. For example, a mishap occurs during a weapons exercise because the procedures didn’t specify a safety observer had to check a critical area before firing.

The Naval Safety Center gets about one thousand afloat-mishap reports annually. In most instances, these reports tell us what happened but not why it happened. Without understanding why, we can’t identify specific trends in mishap causes and determine how to prevent their recurrence.

The Navy must train safety officers and others who might investigate mishaps so they know what to look for and can recognize what they see. We revised the instruction1 that governs afloat-mishap investigation to ensure a command’s safety officers, as well as assigned investigators, have the necessary guidance to identify causes. In the future, we also plan to provide software that will simplify the job of drafting mishap reports. You’ll be able to select from lists to provide consistent data, identify meaningful causes, and accurately classify mishaps.

Gathering data to identify the “why” in mishaps is only the first step. Developing ways to reduce human factors is next. We must identify trends among the overall factors in mishaps. From this knowledge, we can determine methods to correct problems throughout the fleet. All ships--not just those involved in mishaps--will benefit from accurate assessments and analysis.

*Cdr. Rowe’s e-mail address is erowe@safetycenter.navy.mil.*

**For More Info...**

1 The instruction that governs afloat-mishap investigation and reporting is the NavOSH Program Manual for Forces Afloat (OpNavInst 5100.19C), with change 1.

**Editorial:**

# Flight-Deck Fire Parties: A Pilot’s Perspective

*By Lt. Chuck Stoffa,*

*HSL-42*

As a LAMPS Mk-III pilot, I spend more than half my tours embarked in ships. Accordingly, I have a vested interest in the well-being of the ship, as well as our aircraft. Every air-capable ship in the fleet counts on flight-deck fire parties for protection.

This group forms the first line of defense after an aircraft mishap. Fire-party members shouldn’t take their responsibility lightly because pilots rely on them to save their lives. In similar fashion, every ship’s CO relies on the fire party to save the ship.

During a recent flight quarters, I was crew-swapping with the previous crew. I walked through the hangar just in time to see a scene that is repeated aboard many ships: Members of the fire party were in various states of readiness--or was it unreadiness? Some were reading, others were sleeping, and a few actually were paying attention to what was happening around them.

“What if a disaster occurred?” I wondered, as I had many times before. “Would these guys get out there in time to save my life?” I wasn’t too sure, and little did I know that I would nearly have my “what if” answered later the same day.

I was looking over a turning helicopter when one of the detachment’s maintainers came over and anxiously tried to tell me something. Because of the rotor noise, I couldn’t hear what he was saying, so he got on his hands and knees and opened a latched door on the bottom of the helo. He then put his hands in a liquid I could see streaming from the helo and brought it to my nose. Realizing the liquid was fuel, I quickly got in the aircraft, cleared the rotor area, and shut down the helo.

“If that fuel had ignited as it dripped over electrical wires, would the fire party have been able to prevent a disaster?” I mused. I’m not confident they could have. They undoubtedly were properly trained and had the abilities, but the real question was: Were they **prepared** to prevent a disaster?

I ask that all members of fire parties take a good look at their responsibilities. If an aircraft mishap occurs aboard ship, nearly everyone, from the pilots in the aircraft to the seamen in the galley, can be affected. You have not been trained just to draw that much deserved flight-deck, hazardous-duty pay. You have been trained to save lives, shipmates. What greater responsibility is there?

*Rather than having your flight-deck fire party just look at what their responsibilities are, have your DCA revise the ship’s instruction to clearly define when the fire party will be dressed fully and standing by with hoses charged and equipment ready. For example:*

· *When the helo is on short and final, the fire party should be standing by, not reading, sleeping or playing basketball.*

· *During hot pumping or crew swap, the fire party may assume a looser stance, but all equipment should be laid out and ready for instant use.*

*Senior leadership, whether on the air or surface side, must take a firm stand on these vital safety issues.--Head, Engineering, Damage Control and Firefighting Division, Afloat Safety Programs Directorate*

**ORM Corner:**

**Helping You Succeed**

*By Lt. Tom Binner,*

*Naval Safety Center*

In FY91, the Army had the second worst aviation-safety record of all the services. One year later, it had the best record. What caused this dramatic turnaround? It was operational risk management (or ORM, as most people call it). “We decided to implement the principles of ORM in all our training and combat evolutions,” an Army spokesman said.

“So, what’s the big deal?” you say. “We practice ORM, too.”

If that’s the case, why are Sailors still being careless? For example, we have ships colliding with other ships, people transferring fuel to the wrong tank, people falling down ladders, and elevators and jet-blast deflectors crushing people. We also have people flooding shaft alleys where people are working on shaft seals, and how about the 105 traffic deaths we’ve had in the past year? That’s not saying much for the Navy’s ORM efforts, which started in April 19971.

All the news in the Navy isn’t bad, though. The ORM light has come on at some commands. As the safety officer aboard USS *Harry S. Truman* (CVN 75) reported, “We do risk assessments on people who plan to travel outside the area on long weekends. These assessments have paid off. ORM has increased everyone’s awareness about dangers on the road, as well as the risks of off-duty activities.”

In the same vein, the safety officer aboard USS *Saipan* (LHA 2) wrote, “I recently had a Sailor tell me that our ORM matrix for driving had made him realize he was planning to drive too far on one leg of a trip. He decided to split the trip into two legs and spend a night in a motel.”

The safety officer aboard USS *Seawolf* (SSN 21) noted that ORM is used at every level aboard his ship. “The CO ultimately makes the decisions involving risk management, but he gets inputs from all supervisors--from LPO to department head. We use the ORM process for such things as acoustic trials, weapons testing, small-boat-personnel transfers, and complex drydocking availabilities.”

I’ve also seen reports from many ships showing that ORM is used to heighten awareness during live-fire exercises. Others say they incorporate ORM into planning all drills. As the safety officer aboard USS *Ford* (FFG 54) reported, “Since we started using ORM, we haven’t had a single person injured during a shipboard drill.”

We know there are more ORM success stories out there, and we’d like to have you share them with us, so we can pass them along to the entire fleet. We will feature similar stories in every issue of *Fathom*. Here’s your chance to blow your own horn. Sound off and be counted for ORM. It’s not just another program; it’s a way of life. Send your contributions to the *Fathom* editor, e-mail ktestorf@safetycenter.navy.mil.

*The author’s e-mail address is tbinner@safetycenter.navy.mil.*

**For More Info...**

1 Navy ORM started with the publication of OpNavInst 3500.39.

**Rudder Amidships:**

**A High-Tech Handle on Heat Stress**

*By Ken Testorff,*

*Naval Safety Center*

Just 70 minutes into a five-hour watch, a fireman glances at a thermometer near the reduction gear in a ship’s No. 2 engineroom. The temperature is a sizzling 110 degrees F. Sweat glistens on every inch of the fireman’s exposed skin, and his clothes are soaked.

Keeping cool aboard ships in the Arabian Gulf is a full-time job for Sailors who work in a heat-stress environment. Areas where the temperature can exceed 100 degrees F and 50 percent humidity include engineering spaces (firerooms and enginerooms), steam-catapult spaces, galleys, bake shops, sculleries, laundries, and auxiliary-machinery spaces.

Shipmates who work topside also feel the sting of brutally hot environments like the Arabian Gulf. In some cases, deckhands don’t wait for reveille to sound before they start chipping paint and repairing lines. They’re awakened at 4 a.m. and are at work a half-hour later. Noon finds them securing and resting until 5:30 p.m., when they go back to work for another 90 minutes. Then they take a “Navy” shower--two minutes max to conserve water--and hit their racks.

Conditions like these make it important to track the physiological heat-exposure limit (PHEL) stay times for people who work in the spaces. To determine stay times, medical and engineering personnel must do heat-stress surveys with hand-held meters. A complete survey, which measures the wet-bulb-globe temperature (WBGT) in all the high-heat areas aboard a ship, takes three to five hours, depending on the size of the ship. In a year, the time spent doing heat-stress surveys (according to the Naval Health Research Center) aboard a destroyer totals about 3,300 hours. That number rises to about 5,500 hours for an aircraft carrier.

Thanks to a collaboration of industry, Navy medical research, and Navy surface engineering, these numbers are falling faster than Sailors can shave, shower and hit the beach after a long at-sea period. The working group includes Jay Heaney of the Naval Health Research Center, Elias Aboujaoude of Deban Enterprises, Inc., and Vincent Vizzard of the Naval Surface Warfare Center (Carderock Division), Ship Systems Engineering Station. They have developed software and hardware for an automated heat-stress system (AHSS) that will save hundreds of hours doing surveys.

The new system includes sensors that automatically scan the various high-heat areas throughout a ship and transmit the WBGT information into computers. The software program then displays the PHEL stay times, stores the data in a spreadsheet file, and prints the required information on a heat-stress form. This process can be completed in minutes instead of hours. The AHSS can be used with a desktop or laptop computer, or it can be integrated with the smart-ship operational platform.

In August 1997, an automated WBGT data-acquisition system was tested aboard USS *Constellation* (CV 64) in the Arabian Gulf. A short while later, the first two prototype sensors designed to interface with the smart-ship computer system were installed aboard USS *Rushmore* (LSD 47). Since that time, interest in the AHSS technology has spread throughout the fleet. USS *Mahan* (DDG 72) became the first smart ship to have the system installed in all high-heat workspaces. Other ships with the system include USS *Decatur* (DDG 73) and USS *McFaul* (DDG 74). USS *Bataan* (LHD 5) has a desktop PC running the AHSS in the laundry. Future installations are planned for USS *Donald Cook* (DDG 75), USS *Porter* (DDG 78), USS *Higgins* (DDG 76), and USS *Bonhomme Richard* (LHD 6).

The new automated system will replace the manual method of doing heat-stress surveys. Information about the AHSS will be included in a future revision of the *NavOSH Program Manual for Forces Afloat*1, which was spearheaded by LCdr. David Horn when he was at the Naval Sea Systems Command.

For Sailors who have to work in high-heat or humid work areas, the automated system keeps them healthier and helps them work better. Like the other SecNav smart-ship initiatives, the AHSS allows today’s down-sized crews more time to focus on urgent operations--a benefit that draws big praise from LCdr. Mark Johnson, engineer officer aboard USS *Mahan*.

There’s another plus, too: The new automated system provides continuous information 24 hours a day, seven days a week. “This flow allows watchstanders in the central control station to respond instantly to heat-stress problems,” said LCdr. Johnson. “The up-to-the-minute data also provides a more realistic picture of conditions that exist before special operations start. The manual system, on the other hand, provided information that could be as much as two hours old.”

*The author’s e-mail address is ktestorf@safetycenter.navy.mil.*

**For More Info...**

1 The NavOSH Program Manual for Forces Afloat is OpNavInst 5100.19C, with change 1.