by Tom Shroder
Even when instructed to pare down the list to the bare essentials, the quote came in at more than one hundred thousand dollars.
And signs were just the beginning of the safety spending. Lifeboats, each costing the amount of an average American house, topped the list, but in aggregate the costs of preventing minor injuries was much higher. Teams of contractors descended on every newly built vessel to push safety videos, manuals, and contraptions of all types aimed at ensuring a safe work environment. They found a receptive market in Transocean executives, who competed to champion innovations in shipboard safety before they filled out their end-of-year self-evaluation forms, which had a place to list them. The emphasis on safety had resulted in some excellent ideas, such as positioning automatic defibrillators on the rig floor and in the engine room, but not all the ideas proved so practical. One company scoured public industry incident reports and found minor injuries related to the use of sledgehammers. They devised an alternative tool, a pole that would be centered on a stuck bolt with two handgrips, one to hold the pole steady, and the other to hoist up a sliding weight. The rig hand straddled the device and proceeded to pull up on the weight, a physical task accompanied with a grunt, then let it drop down the pole. Of course the device didn’t loosen bolts very well, but it was nevertheless used because the repeated action—pelvic thrust, grunt, pelvic thrust, grunt—always managed to illicit an adolescent response from coworkers.
Another safety device sold to the rigs was called a “back-scratcher,” a steel cage affixed to vertical ladders to prevent a climber from falling backward off the ladder. But that wasn’t safe enough. Transocean managers ordered containers full of wires, harnesses, carabiners, fall arrestors, and mounting gear, along with technicians who would bolt failsafe devices to any ladder over six feet high. Rig hands were then required to don five-point harnesses and clip into the failsafes. One employee became famous for voicing the prevailing sentiment: “I was never afraid of climbing a ladder until I came to work for Transocean.”
Though there were always some who griped about what sometimes seemed like overkill in safety initiatives, most rig workers—who, after all, had their fingers, toes, limbs, skull, and butts on the line—wholeheartedly supported the safety programs. Occasionally a little too wholeheartedly.
In 2009 Transocean asked each rig to produce its own footage of work situations that created a hand injury risk, for inclusion in a company-wide safety video. The idea was to get jaded rig crews to pay attention to these usually boring films by featuring real coworkers instead of hiring actors. One rig under BP contract—the Development Driller II—got the message, marked urgent, to send in video ASAP. The medic grabbed a willing crew member and, camcorder in hand, went down to the rig’s machine shop. His instruction to the crew member was to put his hand near the blade of the device to demonstrate the dangers of improper hand placement. They turned on the camcorder, turned on the saw, and proceeded to capture a more gruesome scene than the managers had asked for.
For Transocean execs, even the company’s cornerstone of safety—a mandatory time-out before even the simplest procedures to take a moment to assess potential dangers, called THINK—didn’t guarantee the level of safety awareness they were striving for. So they created another program with yet another acronym whose initials were a mystery to almost everyone. It was called START (See, Think, Act, Reinforce, Track, as it happens) and required all rig workers to become impromptu safety control managers. At least once a day, employees were required to circulate the deck with a pocketful of index cards, each slightly longer than a dollar bill and printed with a checklist of potential hazards. When they saw safety principles being violated, they were supposed to check the corresponding hazard on the START card. Was someone missing a hard hat? Check. Safety glasses? Check. Was heavy material being moved without regard for possible pinch points or crush points? Check. Were there any slippery surfaces in a work area? And so on.
No minimum number of cards was required, but the common wisdom on the rig was that “a START card a day keeps the rig manager away.”
Every check mark for major or minor violations of safety rules, every missing earplug or tripping hazard, was logged in a giant computer database onshore. The numbers were tracked—the amount of cards submitted by each division, rig, and even each individual employee could be spit out in an instant.
Often the data was used to make new safety policies. One year too many cards came in about missing hard hats, so the managers bought chin straps to keep the hard hats from blowing off in the wind. Of course most of the missing hard hats had nothing to do with wind, but that wasn’t the point. The point was that Transocean was tracking the potential for injury and actively working to correct problems.
The focus on safety expressed itself most immediately in the pre-job meetings—without which no procedure on the rig, however routine, can begin. All work is shut down and relevant personnel are gathered on the rig floor to review the procedure. The senior supervisors each take a turn saying things like, “I know you’ve all done it a million times, but you can’t let your guard down. It’s a big job. This is heavy machinery, heavy equipment, things can turn ugly, so keep your head on a swivel.” Some of the southerners—thoroughly used to the idea that everyone within hearing was male—might try for something a little more colorful, along the lines of “Men, make sure you don’t put your hands anywhere you wouldn’t put your dick…” Then all the other supervisors would pretty much repeat the same message, beginning, “As Jimmy says…”
The men made eye contact and nodded, but most were just waiting to get on with the job. They knew the drill, knew they had to appear as if they were hearing all this for the first time, even as they were engaged in a raging internal debate over whether the terrorists took over the skyscraper in Die Hard or Die Harder. It wasn’t that they didn’t care about safety. But they were like frequent flyers who had to listen to the attendant’s spiel about where to find the flotation cushions for the eight millionth time. They knew, they knew.
CHAPTER EIGHT
THE FLOOD
May 2008
Gulf of Mexico
One day in the spring of 2008, Dave Young was onshore, dry and comfortable in his Connecticut home, when he decided to check in with the rig. One of the watch crew, a dynamic positioning officer, answered the phone on the bridge. Dave could immediately hear the strain in his voice.
“Something bad is happening right now, right?” Dave asked.
“Yeah,” the DPO replied.
“How bad?”
“I’ve got to go,” he said, and then hung up.
The crisis began, as crises so often do, with plumbing.
By the time the Horizon had been on station in the Gulf for seven years, it had drilled more than twenty wells. Middle-aged now, it was no longer the newest, most advanced rig in the fleet. The maintenance requirements grew longer with every shift. The Horizon was showing its age.
And the staff had shrunk.
Doug Brown hated to see anyone go, bound as he was with his crew. But his frustrations were growing less from personal concerns—the sort that kept Jack Parento’s coffee cup in the engine control room seven years after his heart attack—than from professional ones.
When the Horizon left Korea, his department had a chief engineer, a first engineer, two second engineers, two third engineers, and four motormen. A few years in, Doug saw his staff begin to thin. Transocean removed a motorman and a third engineer, followed nine months later by the first engineer. At first, Brown could understand. In the rig’s early years, when all the equipment was new, he had to admit some of his people were just sitting around. But as the years went by, he found that things started to break down more often.
The workload increased dramatically.
Doug still loved his job. Each time he began his hitch he’d go down into the engine rooms to check up on his babies, the six gargantuan diesels, and see how they’d fared in his absence. “Did you miss me?” he’d ask.
It wasn’t just the engines he was concerned about. Doug was the shepherd, and his flock consisted of all the moving parts of the rig not connected with the drilling machinery. If air-conditioning went down in the accommodations, Doug and his crew repaired it. If the fresh water started coming out salty, they tackled the desalination system. A thruster wasn’t giving full output? Doug got into the innards and set it to rights. But increasingly, he couldn’t give his charges all the attention they needed. He began to feel that preventive maintenance was going unattended. Whenever Doug expressed his concern that he was oversubscribed and understaffed, he’d get no satisfaction from the response: “I’ll look into it,” he’d hear, or “Town is working on the problem.”
“Town” of course, meant the corporate headquarters in Houston, which too often seemed to be located on another planet. In any case, Doug got no relief.
Many of those who found themselves dealing with any but the most urgent problems, ones with the visual evidence of burnt parts, water spraying high and low or when the drill bit stopped spinning, quickly became frustrated with time-consuming paperwork. The administrative hurdling began with detailed documentation of the problem in EMPAC, the rig’s computerized records management database programmed in the late 1990s (and by all appearances never really updated) for warehouse managers and shoehorned, it seemed, to fit Transocean’s needs offshore. They found the system counterintuitive, with cumbersome drop-down menus, complex coding, and archaic search capability that seemed designed to make it as difficult as possible to find what they needed. The request was followed by a wait for authorization to order parts. Then, even if the parts were right there in the rig’s warehouse, yet another EMPAC work order was required to actually get them issued. If a spare part was not aboard, it could take weeks, sometimes months, for Transocean’s buyers to get it there.
With parts in hand, a final risk analysis had to be written and signed, lock-out notices posted warning people away from out-of-service equipment, and permits to work authorized by multiple parties before a repair could proceed.
The combination of shrinking staff and bureaucratic processes added up to a growing list of deferred maintenance needs, and there’s more than one way that can make trouble. Small problems can become big ones. Things can break at just the wrong time. Or an overwhelmed maintenance crew can begin making mistakes.
Sometimes the mistakes go unnoticed. But sometimes they can cascade, as they did in May 2008.
The Horizon’s constant exposure to salt water combined with the unyielding element of time had degraded miles of complex piping that carried the water used for everything from ballast to engine coolant. In the course of drilling more than twenty wells in seven years of service without ever touching shore, the Horizon had reached the point where the obvious solution would be a complete replumbing. This would have required the rig to be drydocked at huge expense. Instead, it was decided that the rig mechanics would begin a patchwork replacement of the most corroded steel.
One section of pipe identified for replacement was a spool piece on the discharge side of a saltwater pump in the forward starboard support column, seventy-five feet below the waterline. The pipe carried seawater to auxiliary systems like the freshwater maker and the thruster cooling system.
The engineer who removed it was a maritime academy graduate with an engineering degree and experience interpreting the spaghetti-like piping diagrams. He was required by job description to know every valve, pipe, and pump function. But he was also pressed by the huge backload of maintenance and the workload that came from being undermanned. Skipping the paperwork that would have made sure everyone knew of the ongoing repair, he simply called the bridge to let the DPO know what he was doing, then removed the corroded pipe.
When his shift changed, he turned the job over to his partner and went to bed. Instead of completing the repair, the relief engineer went on to other projects.
Meanwhile, the watch team also changed shifts. On the afternoon of May 26, 2008, the new DPO noticed that the rig’s ballast was off-kilter. He opened a series of valves to correct the rig’s balance, including the out-of-service valve the mechanic had failed to lock out. Seawater—which weighs about as much per volume as steel—gushed out from where the corroded pipe had been removed, quickly flooding the pump room.
A bilge alarm sounded. Chief mate Marcel Muise and an assistant DPO went to investigate. They hadn’t gotten far when another alarm sounded for the Number 2 thruster compartment. The flooding was spreading. Marcel called the bridge and ordered a general alarm.
By 8 p.m., seventy-seven crew members had been transferred to a nearby workboat to wait for the danger to pass.
Before the personnel who remained on the rig could attempt to fix the problem, they would have to make sure they understood what had caused the flooding and why it was spreading. An emergency team would have to descend, far below the waterline, to the flooded area in the support column.
It was just about then that the phone rang on the bridge. It was Dave Young, checking in.
The DPO couldn’t stay on the phone even for a second. He needed to focus all his attention on the rig’s vessel management computers, which, among many other things, controlled the remotely operated valves that directed water within the rig’s ballast system. Theoretically, the bridge team could, with a few clicks of the mouse and the opening and closing of valves from the emergency ballast panel, reverse the plumbing and pump the flooded chamber dry. But the flood had fried the sensors that indicated which valves were opened and which were closed. They were flying blind, which meant they would have to be extremely careful. The mistaken opening or closing of one wrong valve could turn a tense situation into a disaster. To rectify the problem, they would have to find the exact positioning of the relevant valves so they could realign them to pump the flooded chamber dry. That would have been one thing if the valve sensor system had been operating. Now that it had been compromised, they’d have to do it the old-fashioned way.
Marcel darted back down the aft column to work his way through each compartment of the starboard pontoon forward to the pump room where the section of pipe had been removed. The heavy watertight doors between one compartment and the next slowed his progress. Finally he approached the second-to-last door before the flooded compartment and throttled the hydraulic lever to open it. It was a mistake. Marcel had made an assumption that the water hadn’t spread this far. The fallacy of that assumption poured down on him. He had to close the door, and fast, to stop the compartment from filling with water, but the door throttle was already consumed by the flood. Instinctively he pushed his body into the torrent and grabbed the lever. The powerful door pushed back against the surge and closed tight, but the pressure was so great, water was still spraying through the door gasket. Lightbulbs shattered and the power went down. Marcel’s radio no longer could transmit in the absence of the VHF repeater signal. Wet and cold in the dark, he knew he needed to think clearly. If they didn’t pump the water out, and fast, the slow spread could become a rampaging flood.
He hurried back to the bridge, where the rig’s senior leaders were also having difficulties. The DPOs pored though complex line diagrams of the plumbing, waiting for the company’s engineering department ashore to assist them in finding a solution. Assistance never came.
Despite cabinets and computer servers overflowing with technical drawings, no one in Houston could seem to locate the rig’s piping diagram at this late hour. Marcel had tried to e-mail the needed diagrams as soon as the flooding began, but he discovered that the Internet connection had been shut down by the OIM. Marcel thought he knew why: No OIM wanted to see his rig on CNN.
Marcel huddled with the watch crew to figure out the needed alignment of valves and pumps on their own. After working feverishly, they thought they had the solution. If they had gotten it wrong, instead of pumping water out, they could be pumping it in. Marcel, the chief mechanic and the toolpusher, went back down the column to make sure that didn’t happen. The wate
rtight doors to the flooded compartments were still holding, but water was gushing from a hole behind a control panel in the adjoining wall. It was a small hole, so the water flowing through it was negligible. But Marcel realized that since he couldn’t see inside the compartment to know if the water was subsiding, this hole would provide the confirmation he needed that the plan was working.
The pumps were engaged, but the water kept spurting through the hole. A valve they thought had been closed must have been open. But which one? It took several tense hours for them to manually track and test all the possibilities, but finally they found the open valve and shut it. They fired up the pumps again. This time the telltale spout of water slowly lost force, then stopped. They were in the clear.
It could have gone differently. In a vessel like the Horizon, so big and complex, even a small problem could lead to bigger problems and threaten to plunge out of control. A hasty repair had led to a miscommunication that resulted in a flood. The flood shorted out sensors critical to diagnosing the problem and pushing the water back out of the rig. If the cascade of bad luck and bad consequences had continued, it conceivably could have all ended in a half-billion-dollar rig capsizing and sinking to the bottom.
