The Repository Root Cause

Ocean Ranger: The Cover No Rule Told Anyone to Close

September 17, 2026 · Runtime 15:35 · Watch on YouTube

The story everyone tells about the Ocean Ranger is the storm. Two other rigs worked the same field that night and both rode it out, and the stability calculations say the wind pushed this one over by about four degrees. Every defence it needed that night was already bolted to the rig. Not one of them was written into a procedure.

Chapters

Transcript

A cover nobody closed 0:00

On the evening of February 14th, 1982, a wave broke a window in a small round room on an oil rig off Newfoundland. A few inches behind that glass, hinged to the frame, was a steel plate. It was called a deadlight, and it was put there for exactly this: to be closed over the glass when seas might break against it. Nobody closed it in time. Not because anyone decided against it. There was no instruction to use it, and no standing order that it be shut in a storm. Seven hours later the largest semisubmersible drilling rig in the world was upside down in two hundred and sixty feet of water. Eighty-four people were aboard. There were no survivors.

The storm, and the two rigs that rode it out 0:46

The story is that a storm sank the Ocean Ranger. It was a real storm. Hurricane force winds, seas over fifty feet, the worst weather the rig had seen in six years of work. But two other rigs were drilling the same field that night, eight and nineteen miles away. Both rode it out. And the stability calculations run after the accident say something the storm version cannot absorb. With the mooring holding, the wind that night pushed the Ocean Ranger over by about four degrees. The report is explicit: the rig had enough intact stability to survive that weather, provided nothing else was pushing it over. Something else was.

What a semisubmersible is 1:30

The Ocean Ranger was four hundred and eight feet long and, when it was built, the largest semisubmersible in the world. A semisubmersible does not sit on the sea floor and does not float like a ship. It rides on two long hulls held deep underwater, with columns rising from them to carry the deck above the waves. You hold it level by moving water between tanks inside those hulls. That is what ballast means here. On February 14th it was moored on the Grand Banks, a hundred and sixty-six miles east of St. John's, drilling for Mobil.

A round room inside a column 2:07

The tanks are underwater. The valves that fill and empty them are down there too. The man who works them is not. On the Ocean Ranger the ballast control room sat inside one of the columns, starboard side, aft, with its floor about twenty-eight feet above the waterline. The significant wave height that night averaged about thirty-four feet, and the biggest waves ran over fifty. It was a round room with four portlights of fixed tempered glass, three eighths of an inch thick, that did not open. The room was designed watertight, so the console inside it was not required to be.

The window was the instrument 2:46

Now the part that decides this episode. The operator had to know the draft of the rig, which is how deep it was sitting. That number is the whole job. There was no gauge on his panel that told him. Other rigs of that era had remote draft readouts. This one did not. His only way of reading the draft, short of calculating it, was to look out of those windows at the four corner columns and read the figures painted on them. At night, with a hand-held searchlight, in a storm. So closing the steel covers protected the hull and blinded the operator. Nothing on the rig chose between those two things. No instruction, no standing order. The commission put it plainly: the lack of a remote draft system made it necessary to keep the deadlights open as a routine matter. The habit followed. They were left open all the time.

The glass, and how it broke 3:45

Between a quarter to eight and eight in the evening, one of the portlights broke. The rig's owner later argued that debris carried on a wave must have hit it, which would mean very little water came in. The glass says otherwise. The recovered portlight showed the glass had failed under uniform pressure across its whole surface, not from a point impact. A sister portlight, recovered intact, was tested to failure at sixty-eight pounds per square inch. Breaking waves can generate shock pressures above a hundred and forty. And the glass that was fitted did not meet even the thickness written on the supplier's own drawings. Water and broken glass went into the room.

Button, relay, solenoid, valve 4:28

In that room stood a console built specially for this rig. The face of it is a mimic board: a drawing of the tanks and pipes, with a pair of buttons sitting on each tank. Green opens, red closes. Pressing green energises a holding relay. The relay energises a solenoid. The solenoid admits compressed air to the valve gear down in the pump room, and the valve opens. The relay keeps it there until you press red. The design has one genuinely good feature. If the air fails or the power fails, a spring shuts every valve. The safe state is closed. Investigators later took switches and relays of the same type and put seawater on them. Seawater completing the circuit at the base of a switch energises the holding relay, and the valve opens on its own. A drip on the relay terminals does the same without touching the switch at all.

Six hours of everything is normal 5:28

Here is what the rest of the field heard. Shortly before eight, from the Ocean Ranger's own internal radio: we have water and glass on the floor, all valves are opening on the portside. Then, a little later: it seems okay now. At eight forty-four the Mobil foreman aboard tells his superintendent ashore that the broken window is no problem and all of the equipment is functioning properly. At nine: valves are opening on their own, we need a technician, we have positive electric shock in the panel. At a quarter to ten: everything seems okay down here, we are cleaned up and normal. At ten, the superintendent asks directly about the window and is assured all equipment is functioning normally. At half past eleven the rig sends a routine weather report and mentions nothing. The next message is the distress call.

The brass rods open valves 6:22

The Safety Board found the console design acceptable, and gave a reason. Control was never wholly lost, because there was a manual backup. Behind the panel sat banks of solenoids. Threaded into the end of each one was a small brass rod. Screw the rod in, it pushes the solenoid over, and air goes to the valve. That is the backup that made the electrics tolerable. In manual mode there was no display of any kind, so the operator had to hold every valve position in his head. There were no written instructions anywhere on the rig for using the rods, and no evidence that anyone aboard had ever used them once, in six years. The divers found the rods inserted. Screwing a rod in does not close a valve. It opens one. The Canadian commission concluded that the crew inserted them trying to shut valves, that up to fifteen tank valves opened, and that the effect was the opposite of what was intended.

Why pumping made it worse 7:24

Understand what an open valve means down there. Every tank hangs off one common manifold. Open two tanks at opposite ends of a hull and you have not moved anything yet. You have connected them. The rig was trimmed slightly by the bow, so water in the after tanks simply ran forward through the pipe, on its own, with no pump involved. Weight leaving the stern and arriving at the bow tips the rig further forward, which makes the water run faster. The commission's reconstruction has this happening almost imperceptibly for about twenty minutes. After that the trim goes over at roughly one degree a minute. The crew were pumping. They were pumping out of tanks that were refilling from behind them.

Four degrees of wind 8:11

So where did the list come from. Wind, with the mooring effective: about four degrees, and it was pushing the wrong way to explain this one. By one in the morning the Ocean Ranger reported ten to fifteen degrees down by the bow, and progressing. The calculations show water moved inside the port hull alone is enough to produce that and a great deal more. Transfer the after ballast in that hull all the way forward and you get twenty-three degrees. None of that is the storm. It is the rig's own ballast, in the rig's own pipes, moving to the wrong end.

The first point of downflooding 8:48

A rig can survive being down by the bow. What it cannot survive is the sea finding a way in. So the question is where. At the top of each of the four corner columns are the anchor chain lockers, about seventy feet above the water. Because this rig moored with chain and wire rope together, each locker had two openings in the deck: a chain pipe of about six square feet, and a wire box of twenty-two to twenty-eight. Three of each, per column. The classification society, the American Bureau of Shipping, had a name for those openings. They designated them the first point of downflooding. That is the first place above the waterline where the sea gets into the hull if the rig tips far enough. The society named the sea's front door. Now the Canadian commission's sentence about what that named door was given. No coverings for the openings. No drainage system in the lockers. No means installed for pumping water out. And no alarm to say that flooding had happened.

Eighteen square feet of ninety-three 9:57

There is a drawing on every rig called the damage control plan. Its entire job is to show where water can get in. On the Ocean Ranger's plan, the six-square-foot chain pipes are drawn. The wire boxes are not. The larger opening, three times the area, three of them per column, does not appear in the operating manual at all. Add it up per column and the plan shows about eighteen square feet of a total near ninety-three. And a flooded locker is not a leak. It is cargo. One forward chain locker, full, is one thousand and seventy-seven tons of water seventy feet up. On its own, in calm water, that alone would lay the rig over about seventeen and a half degrees. It floods because you are down by the bow, and then it puts you further down by the bow.

The angle was measured in still water 10:51

One more number, and it is the one that certified the rig as stable. Intact stability is approved against the downflooding angle: the angle at which the sea first reaches an opening. For this rig, that meant the chain lockers. That angle was worked out in still water. A flat sea, tilted. The commission ran model tests in storm conditions and found that flooding of the chain lockers began long before the downflooding angle was reached. The number that says the rig is safe in a storm was measured in a condition that does not exist in a storm. With no cover over the opening, the commission wrote, using static conditions appears unrealistic.

00:52 to 03:10 11:34

At fifty-two minutes past midnight the Ocean Ranger transmitted a distress message. At five past one, to the standby boat: we are listing to port, and all countermeasures are ineffective. At ten past one it asked another rig to broadcast a mayday on its behalf, and said that if there was no answer afterwards, they had gone to the boats. At half past one the crew went to liferaft stations. Two crewmen on a supply vessel watched the rig at a thirty-five degree list around a quarter to three. Between five and ten past three the radar contact disappeared, and two small contacts appeared where it had been, and then those went too. Those were the bottoms of the hulls, above the surface. Twenty-two bodies were recovered. Sixty-two people were never found.

Nine days earlier 12:27

Nine days earlier, the same console did a smaller version of the same thing. On February 6th the master, who had joined the rig eleven days before, was working the panel while the ballast operator was away from it. He was pumping with the sea valve open without noticing, and the rig went over five and a half degrees. The senior operator was called and corrected it. Afterwards, in the toolpusher's office, the master said: I think the best thing to do here is for me not to operate the console. He wrote it up on the eleventh. Mobil read it on the twelfth and asked the owner, Odeco, to calculate what would have happened if those two tanks had flooded completely. At the time of the accident, the report says, Odeco had not performed the analysis. One more date. The rig's Coast Guard certificate of inspection had expired on December 27th. The inspectors were booked to reach St. John's on the evening of February 15th.

What changed 13:29

The recommendations read like the episode in reverse. Install a permanent pumping system to dewater the chain lockers on every mobile drilling unit, new and existing. Install internal draft gauges with direct readouts in the ballast control room. Put detailed instructions for emergency manual operation of the ballast system into the manual. The Canadian commission asked for weathertight covers over the chain locker openings, flooding alarms inside them, and an enforced procedure for closing those covers when the forecast crosses a limit. It also asked that every piece of equipment critical to stability be analysed for how it can be damaged and whether its backup actually works.

Hardware, not procedure 14:12

Last episode, a bracket had no category to be analysed under, so it was never analysed. This episode, three defences existed as hardware and not one of them existed as a procedure. The deadlight was hinged and ready, and no document told anyone when to close it. The brass rods were the reason the console was approved, and nobody was taught which way they worked. The chain locker openings had a name in the class society's own paperwork, first point of downflooding, and no cover, no drain, no pump and no alarm. A part gets a procedure when someone owns it. A fitting just gets installed. Here the sea came in through a door that had been named and left open. Next case moves ashore. The first of June, 1974, in Lincolnshire, England. A chemical works at Flixborough. One of six reactors is cracked and taken out of line. To keep production running, fitters join the two neighbours with a temporary pipe. The Court of Inquiry found that no drawing of that pipe was ever made, other than in chalk on the workshop floor, and that it was never pressure tested. It held for two months. Twenty-eight people were killed, eighteen of them in the control room.

Description and sources

About 0300 on February 15th, 1982, the mobile offshore drilling unit Ocean Ranger capsized on the Grand Banks, 166 nautical miles east of St. John's, Newfoundland. Eighty-four people were aboard. Twenty-two bodies were recovered; sixty-two were never found.

Some time in the hour before eight the previous evening, a wave broke a portlight in the ballast control room, a round room inside one of the rig's columns with its floor 28 feet above the water. Behind each portlight was a hinged steel deadlight made to be closed when seas might break against it. There were no instructions for using them and no standing order to close them in a storm The portlights were the operator's only way of reading the rig's draft: the figures were painted on the four corner columns, read through the glass with a hand lamp. Closing the covers protected the hull and blinded the operator, and nothing on the rig chose between those two things.

Seawater reaching the console could energise a holding relay at the base of a switch and open a ballast valve on its own. For six hours the rig told the field it was fine. The crew then inserted the manual brass actuating rods — the backup that made the electrical console acceptable — for which there were no written instructions, no display of valve position, and no evidence anyone aboard had ever used them. Screwing a rod in opens a valve. The Canadian commission concluded that up to fifteen tank valves opened, the opposite of what was intended.

The NTSB's probable cause is the flooding of the anchor chain lockers in the forward columns once the rig took a 10 to 15 degree list. The American Bureau of Shipping had designated the openings into those lockers the first point of downflooding. They had no coverings, no drainage, no installed means of pumping out and no flooding alarm. Of the roughly 93 square feet of opening cut into each corner column, only the 18 square feet of chain pipes appear on the damage control plan; the three large wire rope trunks are not drawn at all. And the downflooding angle that certified the rig's intact stability was calculated in still water — the commission's model tests found the lockers began flooding long before that angle was reached in a storm.

PRINT-READY, FROM THIS CHANNEL

The Failure Atlas, Vol. 01 — Tacoma Narrows · Citicorp Center · Millennium Bridge · Apollo 13 · the 2003 blackout · Hyatt Regency

https://therepository.gumroad.com/l/failure-atlas

PRIMARY SOURCES

NTSB-MAR-83-2, Marine Accident Report: Capsizing and Sinking of the U.S. Mobile Offshore Drilling Unit OCEAN RANGER, February 15, 1982 (PB83-916402), National Transportation Safety Board, 1983. Read page by page: https://www.dco.uscg.mil/Portals/9/OCSNCOE/Casualty-Information/NTSB/MAR-83-2-Ocean-Ranger.pdf
Royal Commission on the Ocean Ranger Marine Disaster, Report One: The Loss of the Semisubmersible Drill Rig Ocean Ranger and its Crew, Ottawa, 1984. Read in full: https://archive.org/details/39290303060091

ARCHIVE PHOTOGRAPHS — the real structure, with title, author, date, archive and licence. All public-domain.

Ocean Ranger in Cook Inlet — U.S. Geological Survey | Wikimedia Commons | Public domain
OceanRanger — U.S. Coast Guard — 1983 | Wikimedia Commons | Public domain
Ocean Ranger Drilling Scheme — U.S. Coast Guard — 1983 | Wikimedia Commons | Public domain

The 30 technical plates in this video are illustrations generated for the channel by a diffusion image model, styled to match its cyanotype identity. They are diagrams of the system — the photographs above are the archive, the drawings are ours, not photographs of the hardware, and no person is depicted in any of them.

Root Cause investigates why engineered systems fail, using official investigation reports and primary technical literature. Sources for this episode are linked above.

Charts and dimensioned comparisons are drawn from the sources listed above; photographs of the Ocean Ranger are archive images, credited on screen and above.

#engineering #offshore #rootcause