Goal based regulation – The NATO Naval

Ship Code
Paul James 1 B.Eng Wh.Sch C.Eng M.R.I.N.A
Judith McKay 2 M.Eng AMIMechE
Lloyd’s
Register EMEA

SYNOPSIS

Merchant ships operate within the framework of international legislation overseen by the International Maritime
Organisation (IMO). However, the key safety document, IMO SOLAS is unattractive for many naval ships because their
military role demands design and operating solutions that are not compatible with the provisions of SOLAS; in some cases
specifying compliance with SOLAS can lead to significant cost implications or a compromise of a ship’s capability.

Recognising these limitations, NATO actively explored the issue and through a specialist team of Navies and Class societies,
it developed the “Naval Ship Code” (ANEP77) to deliver: safety assurance benchmarked against statute, using common
standards that are familiar world-wide and which recognise military operating requirements. The Code developed, was a
goal based standard which offered a framework for safety regulation.

This paper aims to provide background on the manner in which the code was developed plus the key features of the Code
which are needed to make a goal based standard work. It contains a summary of the lessons learnt through the development
experience and some recent changes. The paper also shows how the tier structure compares to other goal based standards and
the manner in which platforms can be verified against the requirements of the Code.

INTRODUCTION

There is a clear regulatory trend towards goal based standards and there appear to be a number of issues driving
this.

In a number of industries, there is an increase in the complexity of systems and their interactions. Novel
technology arrives with increasing frequency and it is difficult to write all-encompassing prescriptive standards
that address technology for which all the risks are not fully understood. This requires flexible and adaptable
regulation which is all encompassing.

Organisations developing standards sense a need to update existing prescriptive standards and write a “complete
set” of objectives from first principles that fully encompass the perceived risks associated with equipment, at a
level where they can be applied to any technology or solution.

In the past, traditional prescriptive standards were developed mainly in response to incidents but this is no
longer seen by society as sufficient and there is an expectation that reasonably foreseeable risks should be
recognised and accounted for in a ship’s design and operation.

Prescription is still a key part of a goal based standard and it may be argued that a goal based standard without
prescription is not particularly helpful. Existing standards can by updated by either: adding a set of goals over
the top, using existing prescriptive text in the lower tiers of a new goal based standard or by setting out goals for
others to write the detail, developing in effect a standard for standards.

1
Paul James joined Lloyd’s Register in 1994 after graduating from Southampton University with a degree in Naval Architecture. He was
part of the team which developed LR’s Naval Ship Rules and has been involved in their application to a wide variety of projects such as
QEC, Type 45, Type 23, Type 26 and other projects such as NSRS and Astute. Paul currently works for Lloyd’s Register as the programme
manager for naval new construction and provides support to the secretariat of INSA.
2
Judith McKay joined Lloyd’s Register in 2007 after graduating from the University of the West of England with a degree in Mechanical
Engineering and spending 5 years post-graduation working for a naval design consultancy company. She provides support to the INSA
Secretariat including supporting working groups in the development of the Code and also undertakes classification rule development work
and supports other projects such as QEC and Type 26.
Committees developing codes have all recognised the challenge to ensure that the standards and associated
process are sufficiently robust to ensure a minimum level of safety but to also allow innovation. A correct
balance needs to be achieved.

This paper looks at some of the early adopters of goal based regulation and charts the development of the Naval
Ship Code comparing it to these and the IMO goal based framework. Some lessons learned from this
development process are discussed and the features of this particular goal based standard are described.

HISTORY OF GOAL BASED STANDARDS

Goal based standards are not a new innovation; they have been in use for a number of years. Sometimes referred
to as performance based standards, goal based standards were developed for the regulation of building safety in
response to advances in fire engineering and analysis, plus a desire to move from a prescriptive compliance
approach to a flexible goal based approach that considers the entirety of a system. Meacham (Ref 1) has
developed a comprehensive summary of the development of these codes and he observes the following:
‘The 1970s saw the beginnings of a dramatic shift in thinking from the traditional "complies with the
code/does not comply with the code" approach to a "systems" approach for evaluating and designing
building fire safety measures. During this period, a few visionaries began demonstrating that engineers
can view the building and the fire as integral components of a single system, and that by evaluating or
designing individual components without regard to the system, potentially severe shortcomings in the
design could result.

One of the earliest significant publications to use the approach was the National Fire Protection Associate NFPA
Building code developed in 1997, now known as NFPA 5000 the Building Construction and Safety Code.
Instructions to the working groups (Ref 2) advised technical committees how to develop a performance-based
code based on research by a NFPA in-house task group. This introduced a tiered structure of: intent and scope,
objectives, functional statements, performance requirement, criteria, goals and solutions.

This approach was derived from the New Zealand Building Regulations adopted in 1992 (Ref 3) shown in figure
I. This standard had a series of tiers and was an early adopter of a goal based structure and contained:
a. Objectives - The social objective that completed building work must achieve,
b. Functional requirements - What the completed building work must do to satisfy the social objective
c. Performance criteria - Qualitative or quantitative criteria with which buildings must comply in their
intended use.
 Figure I New Zealand Building Regulations.

Against these goals, acceptable solutions are published in separate documents that provide solutions for a
variety of different building types covering particular clauses (Objectives) of the Building Code. These are
supported by guidance in the form of commentaries. In addition, the Code allows for alternative solutions to be
put forward with suitable evidence to demonstrate compliance. These are assessed using a suitable Verification
method provided by the Code.

The history of the New Zealand building code is interesting for two reasons. Firstly, it was one of the first goal
based regulations and has influenced the structure of subsequent standards. Secondly, because there has been
significant debate around the degree of prescription and innovation that should be allowed in the Code (Ref 4).
It received a significant update in 2004, which required more rigor in, and scrutiny of alternative solutions
following an inquiry instigated because of building failures, due to inadequate cladding. The Minister
responsible made an interesting observation (Ref 5).
We are keeping the performance-based model provided by the 1991 Act. This model encourages and
supports innovation. The pendulum has swung too far one way, and it was our challenge to ensure that
it didn‘t swing too far the other way. The changes represent a position of balance. However, there are
those who overstate the “innovation verses prescription line”, implying that they are opposites. They
are not. Innovation cannot be used as an excuse not to meet minimum standards that are prescribed to
ensure health, safety and amenity.

Following the development of building regulations in the 1990s which looked for a more effective and efficient
regulatory approach, other goal based standards have emerged with relevance to the maritime industry.

The Defence Standard 00-56, first published in 2004, provides a standard for ‘Safety Management
Requirements for Defence Systems’. It contains a generic set of safety requirements which are to be supported
by specific safety requirements, derived from compliance with legislation, regulations, standards and MOD
Policy. Kelly et al (Ref 6) describe the standard in goal based terms and identify 12 objectives amplified by shall
statements. Guidance for application of the standard is provided in Part 2.

The International Atomic Energy Agency adopted a new, long-term structure for their safety standards in 2008.
This structure was goal based and implemented to enable a consistent framework to be applied by all its member
states in their national regulation. The structure (Ref 7) consists of: Safety Fundamentals (SF-1) or principles,
General Safety Requirements (GSR) and General Safety Guides (GSG). These are complemented by Specific
Safety Requirements (SSR) and Specific Safety Guides (SSG).
The International Maritime Organisation IMO first discussed the notion of “goal-based ship construction
standards” in 2002 (Ref 8). Subsequently, the Maritime Safety Committee commenced detailed technical work
and held a comprehensive debate of the issues in 2004. The committee agreed a five-tier system consisting of
the following.
a. Tier I Goals to be met in order to build and operate safe and environmentally friendly ships.
b. Tier II Functional requirements relevant to the functions of the ship structures to be complied with in
order to meet the above-mentioned goals.
c. Tier III Verification of compliance criteria to provide the instruments necessary for demonstrating that
the detailed requirements in Tier IV comply with the higher level goals and functional requirements.
d. Tier IV Technical procedures and guidelines, including national and international standards,
comprising detailed requirements developed by IMO, national Administrations or classification
societies.
e. Tier V Industry standards, codes of practice and safety and quality systems for shipbuilding, ship
operation, maintenance, training, manning,
The organisation is going through a verification process assessing standards and codes produced by
classification societies against the Goals

In 2006 a NATO specialist team developed a draft Safety Code for Naval ships which was published as ANEP
77: Naval Ship Code in 2009, this also used a goal based frame work derived from previous goal based
standards. The structure of this Code is described in detail below.

Even though these goal based standards are all from different industries, they have a similar structure and it is
possible to align the standards to show the correlation between the tiers. They all have high level goals, usually
split into two or three tiers, followed by a tier of prescriptive standards supplemented by guidance. See Figure II.
It is clear from this initial comparison that the industry would benefit from a common terminology, consistent
words and an agreed description of the tier content.

Figure II Comparison of Goal based standards.

Further examination of these different goal based standards allows us to draw out some common principles.
a. The top levels of the standards have a structured hierarchy of aims, goals and objectives. There are a
variety of ways in which a standard can be divided up or structured. This division is key, because it
could restrict the scope of the regulation and could unduly influence the focus of the standard.
b. All of the standards reviewed have at least one detailed prescriptive solution to the upper tiers.
Sometimes it is of limited scope and applicability but the solution allows easy and cost effective
assessment of straight forward designs with a known operating context
 c. The majority of the standards include a verification process to describe how designs can be consistently
assessed against the prescriptive solution. Verification methods often include a variety of processes
used in combination: design review, testing, modelling, analysis, risk assessment, survey and
inspection.
d. All standards recognise the importance of including guidance, to amplify and expand on many aspects
of the Code. Guidance is typically provided on: how the Code is applied, verification methods, how
prescriptive solutions are justified, best practice and origin of the Code.
e. A key driver for many of the standards is the ability to accommodate alternative solutions and the
Codes often include methods for justifying these against the upper tiers.
.
DEVELOPMENT OF THE NATO NAVAL SHIP CODE

The origin of the Naval Ship Code can be traced back to 2002 and a meeting of the NATO Naval Group 6 on
Ship Design where a specialist team was established to investigate the subject of naval ship safety and
classification. The recommendation from this first meeting was to develop a Naval Ship Code which was to be
goal based and draw upon IMO SOLAS to provide “a good balance between transparency of rules and
efficiency of development” (Ref 9). A draft structure for the Code and goals was agreed, based on the IMO goal
based structure, and work on an initial set of goals was undertaken by UK MoD, Netherlands Navy and DNV
(Ref 10). Study groups worked on developing the text in accordance with guidance provided by the specialist
team chair, they produced a completed draft in 2007 and the first edition of the Code was published in 2009.

The guidance issued contained some key principles (Ref 11) which are listed below.
a. Development of the Code should recognise the environment (Military Operational Context) in which
the Code will be applied.
b. The Code must be written in such a way as to be effective in the military procurement and in-service
support environments which are different to the commercial one.
c. The text of the Code should always start with goal-based requirements and strive to include
prescriptive criteria wherever possible.
d. The level of detail is to be sufficient to support the detailed design, construction, assessment and
acceptance processes which may be achieved either within the Code, or by referring to other relevant
standards.
e. The requirements developed must be benchmarked against existing standards and publications
f. The Code must provide adequate definition of requirements and acceptance events to support
progressive acceptance, so that key risks can be dealt with early in the program.

The guidance encouraged study groups to make use of (MSC/Circ.1023) ‘Guidelines for Formal Safety
Assessment (FSA) for Use in the IMO Rule Making Process’, which described recognised techniques for the
development of a standard using: hazard identification, risk assessment, risk control and cost-benefit analysis.
Recommendations for Code content were presented to the specialist team along with records of development
activities for each tier.

On completion, the first published version of the Code differed from the IMO Goal based approach as shown in
Figure II. An additional tier of Performance Requirements was added to further expand on the Functional Areas,
which were renamed Functional Objectives. These were used to form the structure of the document and define
the scope i.e. what is covered. In the Code, verification of tier 4 was called justification or validation and
included in tier 5. Tier 4 mirrored the IMO model and consisted of either Code text or external technical
standards. This tier was originally called Verification Requirements but subsequently changed and called
Solutions, as shown in Figure III. The Solutions were to include verification methods by which a design could
be assessed. Finally, tier 5 contained the aforementioned justification plus guidance information. This was
different from IMO tier 5 which contained industry standards and codes to support the manufacture, operation
and in-service support of ships. The Code included these requirements primarily in Chapter I but also called up
survey, test and operational information throughout the Code.

Figure III Historical Development of the NATO Naval Ship Code.

Recently, there has been a division of the Code into parts, and clarification of the terms Verification and
Justification. Justification has been expanded to cover validation of each tier against the other tiers not just tier
4.

Following initial development of the draft in 2008 there was a discussion regarding the ongoing maintenance of
the Code. The specialist team recognised the importance of ensuring that the Code remained current and up-to
date. Members of the specialist team set up the International Naval Safety Association (INSA) to maintain and
develop the Code which it continues to do with more navies and classification societies becoming engaged.
 LESSONS LEARNED

From the initial development, a number of lessons were learned which are explored here.

A variety of methods were used in combination to help to develop comprehensive upper tiers (functional
objectives and performance requirements). As discussed, these were quite important in shaping the final scope
and content of the Code. The methods included:
a. Professionally facilitated hazard identification workshops (HAZID) which were used to test the tiers
and served as a useful background document.
b. Process maps, which involved a walk through of incidents to generate the scope of the performance
requirements and order for the functional objectives.
c. Reverse engineering of hazards and risks from existing standards.
d. A Comprehensive review of existing standards to identify areas for study: International, EU,
Commercial, Naval, Class society.

A key decision for the study groups was whether to adopt a System (ships systems and equipment) or functional
breakdown (processes and activities). Most of the Code had a functional breakdown but both methods worked.

Division of chapters and delegation of development helped to speed up generation of the Code, but consistency
in the output needed to be managed. This was initially the responsibility of the specialist team chair but later
became one function of the INSA secretariat. This was also the case for maintaining common definitions which
were centrally held to ensure consistency.

Key discussion items for the study groups included whether the level of safety should be for combat or
peacetime, and what the balance was between ship safety and success of the missions. This required some key
principles to be developed, as the source standards, SOLAS and defence standards approached the subject, with
a very different view of ship operation. Different participants also had different requirements for the Code. As
lower tiers were developed, clarification of the overall philosophy became more important. Whatever
philosophy was decided upon, it was essential to ensure that this was communicated and understood by all study
groups using a clear and concise policy document. Where study groups were not clear about the philosophy, it
took a lot of time to rectify Code text once written.

This also applied to the words used to describe features of a goal based standards, for example, what is a
performance requirement? Succinct and clear policy documents had to be developed and time taken to ensure a
common understanding. At times it was like learning a new ‘goal based’ language.

A key element of the Code was the Concept of Operations Statement, (ConOpS). In the commercial world, a
ship’s role is taken for granted, for example everyone knows what a bulk carrier does. For more complex ships
such as a naval ship, the role can not be assumed, so the ConOpS is vital to the application of the Code and a
blank template was provided in the Code. The ConOpS was needed to define the context in which a naval ship
will be used, covering subjects such as: operating scenarios, environment, support philosophy and manning, for
peacetime and combat. It was also necessary to capture each Navy’s approach to the safety of the ship and
embarked personnel as this may be secondary to the safety of those under the protection of the Naval ship.
During the initial development, a set of Naval Ship Characteristics were developed to assist the study groups
bound the development and these are included as an Annex to the Code (Ref. 12). For tier 4, some Chapters also
have a default ConOpS or assumptions document to better bound the solution.

With the development of a new Code, there was a lot of historical and corporate knowledge within historical
standards that needed to be retained; in some areas of the Code the guidance in printed form has become larger
than the solution text. INSA has also learned the importance of the tier 5 justification not only for users of the
Code, but also to assist with future development. In the future, more sophisticated methods of managing this
information may be necessary. In other areas, it was possible to capture the experience directly in the text, which
emphasised the importance of the tier 4 solution for storing lessons learned in the same way that classification
rules reflect experience gained over time.

The use of risk based methods to develop text was successful but it tended to be qualitative, the data necessary
for quantative analysis was not available. To compensate it was necessary to ensure there was sufficient expert
participation in the hazard identification and also ensure a sufficiently wide trawl of relevant standards.
The aim was always to provide a straight-forward and cost-effective prescriptive tier 4 solution even if that
meant the solution needed to be bounded. To allow alternative designs and novel technology, a risk based
assessment method was included within Chapter I, which was scalable for minor and more significant issues.

STRUCTURE OF THE NATO NAVAL SHIP CODE

The tier structure of the Naval Ship Code is well defined within the document itself and although it has been
subject to some degree of evolution since the initial publication in 2009, it has not changed significantly. Figure
IV illustrates the 6 tier levels. Appendix 1 provides two examples of the Code tier hierarchy.

Figure IV Structure of the NATO Naval Ship Code.

.

Tier 0 Aim
The Aim of the Naval Ship Code bounds the scope of the Code and is the overarching principle: The overall aim
of the Naval Ship Code is to provide an internationally accepted standard for naval surface ship safety based on
and benchmarked against IMO conventions and resolutions that embraces the majority of ships operated by
Navies. It covers all chapters.

Tier 1 Goal
Each of the Chapters has a Goal which addresses the primary concern of the Chapter and is designated as
Regulation 0. The Tier 1 Goals are not intended to set prescriptive requirements or to give specific solutions and
they should be capable of adapting to changes in technology. The Code goals are written in terms that are
potentially measurable, even if the precise measurement scale is not specified.

Tier 2 Functional Objectives

For each Chapter there will be a number of factors or strategic approaches which can contribute to achieving the
Goal. These are identified as the Functional Objectives and they set the Regulation structure for the Chapter.
Across several Topic Areas, there may well be common Functional Objectives. For example, fire safety may
identify containment or boundaries as a functional area to be considered in achieving the fire safety goal.
Containment or boundaries will also be identified as a Functional Objective for stability and watertight integrity
issues. Identifying common Functional Objectives will assist in cross-referencing requirements.
Risk assessment techniques to identify hazards were used to establish the Functional Objectives. Study groups
also conducted a literature survey of relevant publications, including SOLAS, the HSC Code and other relevant
statutory and naval standards. In some cases process maps, where developed, looked at a process such as fire
initiation, detection, containment, extinguishing and damage control and identified the functional areas required
at each stage of the process.
Tier 3 Performance Requirements
At the third tier, a set of safety performance requirements relevant to the Functional Objectives were defined.
These were developed based on the hazard analysis, review of existing texts and process maps. Their origin can
be identified in the Code development documentation.

The aim throughout the whole process was to maintain the link to the statutory base line and only introduce
different requirements where naval practice required. A hierarchy was developed (Ref 11) to categorise
requirements into: compatible statutory requirements, essential naval ship safety requirements, important naval
ship safety features and optional naval ship requirements with a safety benefit. Naval ship requirements with no
safety implications were not included in the Code.

Where possible, the requirements were written in performance terms so that they could be independent of the
technical or operational solution. This, together with the grouping of issues into performance requirements,
made it easier to develop and assess alternative solutions to ensure they that addressed all the relevant issues.
Also, parts of the NSC could more easily be augmented with national requirements.

National standards and classification society rules which may be used as solutions could also be formally
assessed against this structure to ensure they have sufficient scope to address the naval requirement.

Tier 4 Solutions
The purpose of this tier is to provide prescriptive regulation that allows safety to be assured. The requirements in
the solution are to fully cover the performance requirements of Tier 3. The Solution is one way of meeting the
performance requirements and where selected, is to be complied with and verified during design, construction
and operation. The solution in the Code may have certain assumptions associated with it that limit its application
to all vessel types and operational scenarios.

In the fourth tier, study groups developed standard verification text that describes suitable methods to confirm
that a naval ship is in compliance with the performance requirements.

Verification could be achieved through several means; compliance with prescriptive criteria laid down in Tier 4
of the Code, compliance with a classification society standard or compliance with a national standard. The
standards selected are to be listed in a standards plan and the Code has a template in Chapter I.

Solutions text has not been developed for all Chapters. Where Classification Society rules of multiple societies
typically contain prescriptive requirements which meet the Code Performance Requirements, Code solutions are
not required. Table 1 indicates the different Solutions which may be used.
Tier 4 Solution type Example Standards Chapters Addressed
Naval Ship Code Chapter VI Fire Safety Chapter VI Fire Safety

Classification Society Rules Lloyd’s Register Rules and Regulations for the
Classification of Naval Ships
National Standard UK Defence Standard Def Stan 02-900
US Design Data Sheet DDS-079
Table 1: Tier 4 Solutions to the Code
Chapter II Structures
Chapter IV Engineering Systems
Chapter III Buoyancy, Stability and
Controllability

The Code default solution is aimed at providing a minimum acceptable safety baseline for foreseeable naval
operating conditions. It is important to note that this may fall short of a navy’s expectation which could include
the ability to deal with extreme threats and damage. For example, the fire chapter provides a solution that deals
with one large or two small fires, a navy may have a requirement to fight four or more fires. If identified as a
requirement, additional fire fighting equipment and systems can be added. To assist in this process of scoping a
navy’s requirement, the ConOpS is to be developed describing the role of the ship and the expected level of
threat to be dealt with. Chapter I of the Code contains a template and instructions regarding its use.

Tier 5 Justification
The final tier contains information that describes how the Code text for Performance Requirements and
Solutions has been derived and how it satisfies the aim, philosophies, principles and goal. This section is
essential for configuration control of the Code, and captures all the key arguments and issues exposed during the
course of developing the text. Some Chapters also have interpretation of the Code requirements and guidance on
application of the Code.
 THE NAVAL SHIP CODE AND ASSURANCE

Effective assurance of ships against the Naval Ship Code requires Justification (of Solutions) by the Naval
Administration (NA) and Verification (of ships) by the Naval Organisation or their Recognised Organisation
(RO) as illustrated in Figure V.

Figure V: Justification and Verification

Justification of the Code

Justification activity is defined as validation of Solutions against Performance Requirements, Functional
Objectives and Goals. It refers to the Validation of Tier 4 against Tiers 1-3. It is relevant for both Code solutions
and external solutions such as class society rules.

Edition E of the Code introduced the requirement for Naval Administrations to undertake validation of the
Solutions they select (i.e. Class Rules or National Standards) against the goals of the Code. The Naval
Administration can select the tier level to which they undertake the analysis but it is suggested that it should be
carried out at Performance Requirement level and guidance on the process is provided at Tier 5. It is proposed
that the assessment is undertaken in the format of table I to encourage a common approach among Navies.

Table I: Suggested format for Validation Table

Class Societies have undertaken assessment work between the Code and their naval rules and also between the
Code and in-service vessels on the basis of their Classification at the time of build. These studies involve listing
all the Performance Requirements of the Code and identifying the appropriate section of the rules (including any
optional notations to be selected) to meet each Performance Requirement. Some societies have developed their
rules to increase the level of compliance with the Code. Where it is identified that the Rules do not currently
meet a performance requirement (e.g. operational requirements, requirements outside class scope) these can be
clearly documented for any Naval Administration applying the Rules as the Tier 4 Solution.
It is recognised that the same process should be formally applied to the Code Solutions and documented at Tier
5. A programme is in place to include this justification evidence for the Code Solutions in the coming years.

Verification of the Code

Verification activity is defined as verification a ship meets the requirements of the Code: using plan approval,
modelling, simulation, analysis, testing or survey and inspection.

Verification will be undertaken against the solution level tier 4 of the Code to verify that a ship is compliant
with the prescriptive text of a solution. Standard verification text is used at the start of each Solution to define
the method and responsibilities for verification. Chapter 1 describes elements of the verification process in a
very general sense; the focus is on survey activity at present.
7 The surveys referred to in paragraph 3 shall be carried out as follows:
7.1 the initial survey shall include an appraisal:
7.1.1 of the purposes and mode of operation(s) which is to include:
7.1.1.1 use appropriate to the Ship Type;
7.1.1.2 use as amplified in the Concept of Operations Statement;
7.1.2 of the design assumptions made;
7.1.3 of the material state on completion of build; ( NSC Ch1 Para 7)

To clarify the approach for verification it is proposed to update NSC in the coming year to describe the
verification process in more detail and provide guidance about the type of verification evidence to be provided.
Verification evidence is typically in the form of: plan approval documents, certificates, survey reports and audit
reports. Detail on the content of these documents may be provided in the guidance, including templates, if this is
deemed necessary. The requirements will also state that the verification evidence is to be maintained for the life
of the ship in a document similar to a technical construction file.

One approach to provide clarity of verification methods is that taken within Chapter VI which has specific
requirements describing the verification activity to be undertaken, in each regulation. For example:
Plan appraisal survey and testing
26 Plans showing critical structure, load bearing structure and proposed insulation arrangements are to be
submitted for appraisal. (NSC Ch VI Reg 2 Para 26)
Plan appraisal survey and testing
22 Details of ventilation arrangements and control arrangement for safety systems are to be submitted for
appraisal.
23 Details of tests and certification for materials are to be submitted for appraisal, together with calculations for
use of combustible materials.
24 After installation on-board, independent verification of the functioning of safety systems are to be carried out in
accordance with the agreed test programme. (NSC Ch VI Reg 4 Paras 22-24)

Where Classification Society Rules are selected at Tier 4, the Verification requirements will be as required by
that Society. A typical breakdown of the design appraisal and material verification requirements for a DIESO
system are contained in Table 2. A similar level of assurance should be able to be derived from the verification
statements in tier 4 Solutions.

System Scope Notations Design Appraisal MATERIAL Equipment

Equipment and standard Verification/ Verification/
certification Certification
Ship's Fuel (DIESO) Class +LMC Mobility Naval Rules + FMEA - -
Pressure>7 bar CCS
PSMR*
RAS(ABV)
EP
DIESO Pumps Class None Class Soc Cert Class Soc Cert
DIESO Filters Class Naval Rules as per Rules Class Soc Cert
DIESO Centrifuge modules Class Type Tested Class Soc Cert Class Soc Cert
Centrifuge
Table 2 System list equipment breakdown – DIESO system
 CONCLUSION

The paper has demonstrated from a brief review that there is a lot of information and learning experience
available from organisations that have developed goal based standards in a variety of industries. This should be
utilised when developing any new standards as many lessons have already been learnt. It is interesting to note
that one of the earliest Codes, the New Zealand building regulation, has many features in common with the final
form of the Naval Ship Code and some features which may yet be explored, for example, multiple deemed to
satisfy solutions. The similar structure within these codes is very evident and there is a potential need for some
common terminology.

From the development of the Naval Ship Code there are some clear lessons. Several stand out: the importance of
describing the operational context for both the authors and the users of a code; the need to include bounded
prescriptive requirements to enable effective design and survey; the need to utilise robust risk based methods in
the development of the Code to ensure adequate scope and the potential influence of the upper tier structure on
the eventual content and coverage of the Code. For the Naval Ship Code in particular, there have been many
discussions regarding the level of safety to be provided which highlights the need for clear policy and guidance
for authors and users of the Code.

The Code itself has a clear structure which accommodates both internally developed prescriptive solutions and
standards external to the Code from other organisations. In this latter scenario, the Code will work as a standard
for standards with a clear method of justification for these external documents. This enables national naval
administrations to apply a consistent and fair approach to assessment of standards proposed as solutions.
Alternative arrangements, which often drive the need for goal based standards, can be verified using an
assessment process which can be scaled to the risk associated with the alternative proposal.

INSA is currently working with navies to develop a Naval Submarine Code with an assurance framework which
is common to the Ship Code where possible and applying the experience gained to date to this new project.

Future development of the Code will include strengthening the verification requirements to align with those
provided by other standards. This will provide clarity for designers and manufactures of ships and equipment.

ACKNOWLEDGEMENTS

The authors would like to thank colleagues in both INSA and Lloyd’s Register for their support in developing
this paper.

REFERENCES

1. B Meacham ‘The Evolution of Performance-Based Codes and Fire Safety Design Methods’, NIST,
Gaithersburg, MD, (1998)
2. ‘Primer 1: Performance- Based Goals, Objects and criteria’, NFPA, (1997)
3. http://www.dbh.govt.nz/about-the-building-code
4. P.Mumford ‘Enhancing performance-based regulation: lessons from New Zealand’s building control
system’ Thesis Victoria University of Wellington (2010)
5. L Dalziel, ‘Design and Build it Right First Time’ Weathertightness News, 2 (June 2003)
6. T Kelly et Al, ‘Goal-Based Safety Standards: Opportunities and Challenges’ 23rd International System
Safety Conference, (2005)
7. http://www-ns.iaea.org/standards/
8. H. Hoppe ‘Goal-based standards – a new approach to the international regulation of ship construction’
Maritime Safety Division, International Maritime Organization (2008)
9. UK MoD ‘Naval Ship Safety and Classification’ Brief for NG/6, ( June 2004)
10. G. Rudgley et Al. ‘Development of a NATO Naval Ship Code’ RINA Safety Regulations and Naval
Classification II (2005)
11. UK MoD ‘Guide to the Conduct of the Specialist Team in developing the Code of Safety for Naval
Ships (or Naval Ship Code (NSC))’ NG6 Specialist Team “Naval Ship Safety and Classification”
(November 2004)
12. NATO ‘ANEP 77 The Naval Ship Code’ Edn E (2014)
 DISCLAIMER

Lloyd's Register Group Limited, its subsidiaries and affiliates and their respective officers, employees or agents
are, individually and collectively, referred to in this clause as ‘Lloyd's Register’. Lloyd's Register assumes no
responsibility and shall not be liable to any person for any loss, damage or expense caused by reliance on the
information or advice in this document or howsoever provided, unless that person has signed a contract with the
relevant Lloyd's Register entity for the provision of this information or advice and in that case any responsibility
or liability is exclusively on the terms and conditions set out in that contract.
 APPENDIX 1: TIER EXAMPLES

Tier Example 1: Where Code Provides Solution

The following example illustrates how the methodology works in practice. This example is based on fire as a
hazard.

Tier 1
The goal of the chapter, in this case chapter VI fire safety, is contained in Reg 0 Para 1.
For effective fire safety, the ship and its arrangements are to be designed, constructed, maintained and
operated in such a way that as far as is practicable, fire can be prevented, detected, contained and
extinguished whilst maintaining essential safety functions during and after the outbreak of a fire.

Tier 2
Defines Functional Objectives. In this case a fire process map was used to derive functional objectives. In this
case the functional objective is Containment of fire and Reg 8 Para 1 contains the straight forward objective.
To contain a fire in the space of origin.

Tier 3
This defines Performance Requirements which in this case are related to SOLAS Purpose statements in SOLAS
II-2 Reg 9 but modified to address naval solutions and methods of containing fire, for example boundary
cooling.
2 The ship shall be subdivided by thermal and structural boundaries or equivalent.
2.1 Fire containment at boundaries shall have due regard to the fire risk of the
space, function of the space, and function of adjacent spaces.
2.2 The fire integrity of the boundary shall be maintained at openings and
penetrations.
2.3 Active and/or passive containment arrangements may be provided
3 Fire boundaries, openings and penetrations shall be demonstrated in accordance with
a recognised standard.

Tier 4
This defines a solution to the performance requirements which provides a minimum baseline solution, Structural
fire protection. which is derived from SOLAS Passenger ship requirements Ch II-2 Reg 9 Para 2.2.1.1.1 and is
applied to large Naval Ships (Type A) such as Aircraft Carriers or LPDs. The paragraph has been modified to
remove the SOLAS relaxation of insulation on way of low fire risk spaces as this is not appropriate.
4.1 In all type A ships, the hull, superstructure and deckhouses shall be subdivided into
main vertical zones by "A-60" class divisions. Steps and recesses shall be kept to a
minimum, but where they are necessary they shall also be "A-60" class divisions.
where fuel oil tanks are on both sides of the division the standard may be reduced to "A-0".

A solution is not provided for the alternative of fixed boundary cooling but a justification for its use could be
built up based on the performance requirements that need to be satisfied.

Tier 5
The Justification is not covered in the rules and in general contains the links to the base Code or new
requirements.

NSC Regulation NSC Paragraph Reference Doc / Comment Ref Doc Paragraph
Regulation 8 4 SOLAS Modified Ch. II-2 Reg. 9.2.2.1
Containment of Fire 5 SOLAS Ch. II-2 Reg. 9.2.2.2
6.1 SOLAS Ch. II-2 Reg. 9.2.2.3
Example 2 Where Classification Society Rules Provide Solution
The following example illustrates how the methodology worked in practice. The example is based on machinery
as a hazard.

Tier 1
The goal of the chapter, in this case chapter IV Engineering systems, is contained in Reg 0 Para 1, only one part
of the goal is relevant in this example.
The Engineering Systems shall be designed, constructed, operated and maintained to:
1.1 Minimise danger to embarked personnel in all foreseeable operating conditions;
1.2 Provide high availability and minimise the risk of mal-operation in all foreseeable operating
conditions;
1.3 Ensure the watertight and weathertight integrity of the hull, and meet the requirements of
Chapter III (Buoyancy and Stability);
1.4 Enable the restarting of shut-down systems and equipment necessary to provide essential
safety functions (“dead ship” starting) without external aid;
1.5 Provide support to the embarked personnel and provide essential safety functions in the event
of all foreseeable damage at least until the personnel have reached a place of safety or the threat has
receded.

Tier 2
Defines Functional Objectives. In this case the functional objective relates to propulsion and Reg 4 Para 1
contains the objective.
The propulsion machinery shall enable the ship to manoeuvre as and when required by the
Command but still remain within the designed or imposed limitations.

Tier 3
This defines Performance Requirements which in this case are related to SOLAS Chapter II-1 Reg 26.
2 To enable the vessel to manoeuvre, this regulation shall be applied in conjunction
with Regulation 5 Manoeuvring.
3 Redundancy of propulsion equipment shall be provided. The Naval Administration
shall give consideration of the reliability of single essential propulsion components
on application.
4 The propulsion equipment and systems shall be designed, constructed and
maintained to minimise danger to personnel onboard in all foreseeable operating
conditions.
5 Essential safety functions shall be continuously available or recoverable without
compromising the safety of the vessel following a single operational action or
system / equipment fault.
Tier 4
This defines a solution to the performance requirements which is based on classification Society Rules, Lloyd’s
Register Naval Ship Rules are used in this example. In this case the only way to satisfy the regulation is to select
the optional notation PMR from Vol 3 Pt1 Chapter 3. In this section of the Rules there are several options for
compliance. PMR* which allows for the loss of an entire compartment, PMRL which allows a reduced
capability (less than 50% propulsive power) in the damage condition. These options will need to be discussed
with the Navy.
1.1.1. This Chapter states the requirements for ships having machinery redundancy, and
are in addition to the relevant requirements of the Rules and Regulations for the
Classification of Naval Ships contained in Volumes 1 and 2.
1.1.2. The requirements, which are optional, cover machinery arrangements and control systems
necessary for ships which have propulsion and steering systems configured such that, in the
event of a single failure of a system or item of equipment, the ship will retain the ability to use
available installed prime mover capacity and installed propulsion systems that are unaffected
by the failure. The ship is also to retain steering capability at a service speed of not less than
seven knots.
 1.1.3. The requirements also cover machinery arrangements where the propulsion and steering
systems are installed in separate compartments such that, in the event of a loss of one
compartment, the ship will retain availability of propulsion power and manoeuvring
capability.
1.1.4. Requirements additional to these Rules may be imposed by the Naval Authority.
The assessment of standards is the responsibility of the Naval Administration; they could agree standards as a
one-off activity or on a project by project basis.

Tier 5
The Justification is not covered in the rules and in this case the Code contains more detail about the expectation
for the chosen solution.

CODE REQUIREMENTS GUIDANCE ONLY

Redundancy of propulsion
3 equipment shall be provided. The Risk: Vessel at sea with no propulsive power due to loss of a single component
Naval Administration shall give The use of non-duplicated machinery & systems or lack of redundancy can only
consideration of the reliability of be accepted by a Naval Administration upon demonstration of the Machinery or
single essential propulsion System reliability using appropriate risk assessment tools.
components on application.
The Naval Administration may require a separate source of propulsion power
sufficient to give the ship a navigable speed, especially in the case of
unconventional arrangements.
Operation of several craft together or within a distance from support nominated
by the Naval Administration may be a mitigation against single propulsion
failure.