Fire on the Horizon (12 page)

“Something bad is happening right now, right?” Dave asked.

“Yeah,” the DPO replied.

“How bad?”

“I’ve got to go,” he said, and then hung up.

The crisis began, as crises so often do, with plumbing.

By the time the Horizon had been on station in the Gulf for seven years, it had drilled more than twenty wells. Middle-aged now, it was no longer the newest, most advanced rig in the fleet. The maintenance requirements grew longer with every shift. The Horizon was showing its age.

And the staff had shrunk.

Doug Brown hated to see anyone go, bound as he was with his crew. But his frustrations were growing less from personal concerns—the sort that kept Jack Parento’s coffee cup in the engine control room seven years after his heart attack—than from professional ones.

When the Horizon left Korea, his department had a chief engineer, a first engineer, two second engineers, two third engineers, and four motormen. A few years in, Doug saw his staff begin to thin. Transocean removed a motorman and a third engineer, followed nine months later by the first engineer. At first, Brown could understand. In the rig’s early years, when all the equipment was new, he had to admit some of his people were just sitting around. But as the years went by, he found that things started to break down more often.

The workload increased dramatically.

Doug still loved his job. Each time he began his hitch he’d go down into the engine rooms to check up on his babies, the six gargantuan diesels, and see how they’d fared in his absence. “Did you miss me?” he’d ask. It wasn’t just the engines he was concerned about. Doug was the shepherd, and his flock consisted of all the moving parts of the rig not connected with the drilling machinery. If air-conditioning went down in the accommodations, Doug and his crew repaired it. If the fresh water started coming out salty, they tackled the desalination system. A thruster wasn’t giving full output? Doug got into the innards and set it to rights. But increasingly, he couldn’t give his charges all the attention they needed. He began to feel that preventive maintenance was going unattended. Whenever Doug expressed his concern that he was oversubscribed and understaffed, he’d get no satisfaction from the response: “I’ll look into it,” he’d hear, or “Town is working on the problem.”

“Town” of course, meant the corporate headquarters in Houston, which too often seemed to be located on another planet. In any case, Doug got no relief.

Many of those who found themselves dealing with any but the most urgent problems, ones with the visual evidence of burnt parts, water spraying high and low or when the drill bit stopped spinning, quickly became frustrated with time-consuming paperwork. The administrative hurdling began with detailed documentation of the problem in EMPAC, the rig’s computerized records management database programmed in the late 1990s (and by all appearances never really updated) for warehouse managers and shoehorned, it seemed, to fit Transocean’s needs offshore. They found the system counterintuitive, with cumbersome drop-down menus, complex coding, and archaic search capability that seemed designed to make it as difficult as possible to find what they needed. The request was followed by a wait for authorization to order parts. Then, even if the parts were right there in the rig’s warehouse, yet another EMPAC work order was required to actually get them issued. If a spare part was not aboard, it could take weeks, sometimes months, for Transocean’s buyers to get it there.

With parts in hand, a final risk analysis had to be written and signed, lock-out notices posted warning people away from out-of-service equipment, and permits to work authorized by multiple parties before a repair could proceed.

The combination of shrinking staff and bureaucratic processes added up to a growing list of deferred maintenance needs, and there’s more than one way that can make trouble. Small problems can become big ones. Things can break at just the wrong time. Or an overwhelmed maintenance crew can begin making mistakes.

Sometimes the mistakes go unnoticed. But sometimes they can cascade, as they did in May 2008.

The Horizon’s constant exposure to salt water combined with the unyielding element of time had degraded miles of complex piping that carried the water used for everything from ballast to engine coolant. In the course of drilling more than twenty wells in seven years of service without ever touching shore, the Horizon had reached the point where the obvious solution would be a complete replumbing. This would have required the rig to be drydocked at huge expense. Instead, it was decided that the rig mechanics would begin a patchwork replacement of the most corroded steel.

One section of pipe identified for replacement was a spool piece on the discharge side of a saltwater pump in the forward starboard support column, seventy-five feet below the waterline. The pipe carried seawater to auxiliary systems like the freshwater maker and the thruster cooling system.

The engineer who removed it was a maritime academy graduate with an engineering degree and experience interpreting the spaghetti-like piping diagrams. He was required by job description to know every valve, pipe, and pump function. But he was also pressed by the huge backload of maintenance and the workload that came from being undermanned. Skipping the paperwork that would have made sure everyone knew of the ongoing repair, he simply called the bridge to let the DPO know what he was doing, then removed the corroded pipe.

When his shift changed, he turned the job over to his partner and went to bed. Instead of completing the repair, the relief engineer went on to other projects.

Meanwhile, the watch team also changed shifts. On the afternoon of May 26, 2008, the new DPO noticed that the rig’s ballast was off-kilter. He opened a series of valves to correct the rig’s bal
ance, including the out-of-service valve the mechanic had failed to lock out. Seawater—which weighs about as much per volume as steel—gushed out from where the corroded pipe had been removed, quickly flooding the pump room.

A bilge alarm sounded. Chief mate Marcel Muise and an assistant DPO went to investigate. They hadn’t gotten far when another alarm sounded for the Number 2 thruster compartment. The flooding was spreading. Marcel called the bridge and ordered a general alarm.

By 8 p.m., seventy-seven crew members had been transferred to a nearby workboat to wait for the danger to pass.

Before the personnel who remained on the rig could attempt to fix the problem, they would have to make sure they understood what had caused the flooding and why it was spreading. An emergency team would have to descend, far below the waterline, to the flooded area in the support column.

It was just about then that the phone rang on the bridge. It was Dave Young, checking in.

The DPO couldn’t stay on the phone even for a second. He needed to focus all his attention on the rig’s vessel management computers, which, among many other things, controlled the remotely operated valves that directed water within the rig’s ballast system. Theoretically, the bridge team could, with a few clicks of the mouse and the opening and closing of valves from the emergency ballast panel, reverse the plumbing and pump the flooded chamber dry. But the flood had fried the sensors that indicated which valves were opened and which were closed. They were flying blind, which meant they would have to be extremely careful. The mistaken opening or closing of one wrong valve could turn a tense situation into a disaster.
To rectify the problem, they would have to find the exact positioning of the relevant valves so they could realign them to pump the flooded chamber dry. That would have been one thing if the valve sensor system had been operating. Now that it had been compromised, they’d have to do it the old-fashioned way.

Marcel darted back down the aft column to work his way through each compartment of the starboard pontoon forward to the pump room where the section of pipe had been removed. The heavy watertight doors between one compartment and the next slowed his progress. Finally he approached the second-to-last door before the flooded compartment and throttled the hydraulic lever to open it. It was a mistake. Marcel had made an assumption that the water hadn’t spread this far. The fallacy of that assumption poured down on him. He had to close the door, and fast, to stop the compartment from filling with water, but the door throttle was already consumed by the flood. Instinctively he pushed his body into the torrent and grabbed the lever. The powerful door pushed back against the surge and closed tight, but the pressure was so great, water was still spraying through the door gasket. Lightbulbs shattered and the power went down. Marcel’s radio no longer could transmit in the absence of the VHF repeater signal. Wet and cold in the dark, he knew he needed to think clearly. If they didn’t pump the water out, and fast, the slow spread could become a rampaging flood.

He hurried back to the bridge, where the rig’s senior leaders were also having difficulties. The DPOs pored though complex line diagrams of the plumbing, waiting for the company’s engineering department ashore to assist them in finding a solution. Assistance never came.

Despite cabinets and computer servers overflowing with technical drawings, no one in Houston could seem to locate the rig’s pip
ing diagram at this late hour. Marcel had tried to e-mail the needed diagrams as soon as the flooding began, but he discovered that the Internet connection had been shut down by the OIM. Marcel thought he knew why: No OIM wanted to see his rig on CNN.

Marcel huddled with the watch crew to figure out the needed alignment of valves and pumps on their own. After working feverishly, they thought they had the solution. If they had gotten it wrong, instead of pumping water out, they could be pumping it in. Marcel, the chief mechanic and the toolpusher, went back down the column to make sure that didn’t happen. The watertight doors to the flooded compartments were still holding, but water was gushing from a hole behind a control panel in the adjoining wall. It was a small hole, so the water flowing through it was negligible. But Marcel realized that since he couldn’t see inside the compartment to know if the water was subsiding, this hole would provide the confirmation he needed that the plan was working.

The pumps were engaged, but the water kept spurting through the hole. A valve they thought had been closed must have been open. But which one? It took several tense hours for them to manually track and test all the possibilities, but finally they found the open valve and shut it. They fired up the pumps again. This time the telltale spout of water slowly lost force, then stopped. They were in the clear.

It could have gone differently. In a vessel like the Horizon, so big and complex, even a small problem could lead to bigger problems and threaten to plunge out of control. A hasty repair had led to a miscommunication that resulted in a flood. The flood shorted out sensors critical to diagnosing the problem and pushing the water back out of the rig. If the cascade of bad luck and bad consequences had continued, it conceivably could have all ended in a half-billion-dollar rig capsizing and sinking to the bottom.

By 2 a.m., though, the flooded compartments had been pumped dry, ballast had been rearranged to correct the list, and all personnel were back on the rig. No injuries or pollution resulted from the incident.

The following day, a Transocean team led by Buddy Trahan, an experienced executive who had worked at almost every possible rig job, arrived to help the Horizon’s people get the Horizon cleaned up and ready to restart operations. It would take several months to repair all the bilge sensors, valve indicators, and pumps, but thanks to the Horizon’s built-in redundancy of functions, the crew was back drilling ninety-six hours after the incident. A collective pride glowed from the drill floor to the bridge. Nature had pressed hard against the rig’s inner walls but the crew had averted disaster using teamwork and experience, with no assistance from shore.

The investigations everyone feared, the ones that could shut down operations, were canceled. Neither the Coast Guard nor the federal Minerals Management Service (MMS) decided to pursue the incident with investigations whose focus could have widened to include the Horizon’s other urgent maintenance needs. The readiness of the MMS to close the books on the incident was to some degree understandable. The federal agency charged with managing the nation’s oil, natural gas, and mineral resources was called to investigate thousands of serious oil-related incidents each year. In a recent three-year period, the incidents included 30 worker deaths, 1,298 injuries, 514 fires, and 23 blowouts that left wells out of control.

For all of this they had just sixty inspectors.

The relief lasted only until the next morning, when another helicopter brought a joint BP/Transocean investigation team out to the rig and the expected praise turned into admonishment. Investigators made the conference room over into a war room, filled
binders with photocopied permit-to-work documents and interviewed key personnel. Despite the considerable energy expended and some harsh conclusions, the investigation seemed to miss some important lessons, like the need for better engineering support from Town, the strain that maintaining an aging vessel put on a shrinking technical crew, the paperwork blindness caused by a burdensome bureaucracy.

The investigators did not leave empty-handed. After making their way through the trail of paper, they faulted the original mechanic for failing to file the warning notices. He was terminated and eyes turned to the rest of the crew, finally settling on the Deepwater Horizon’s captain.

The easiest questions in the Coast Guard’s merchant marine officer licensing examinations always go something like this: “If a seaman slips on a wet deck and gets a concussion, who is responsible?” Or it could be about a faulty valve deep in the bowels of the ship’s engine room that opens to leak oil in a bay, or contraband found in a shipping container sealed long before it ever arrived on deck, or a dispute over a toothbrush. Or a flood.

There’s only ever one correct answer: the captain. The captain is responsible, always. Within weeks, Transocean would be looking for someone new to skipper the Deepwater Horizon.