Exxon Valdez: how three tolerated deviations spilled 11 million gallons

Here is an uncomfortable observation from two decades of closing 8Ds: a root-cause analysis that ends at "operator error" has not ended. It has stopped. Exxon Valdez is the proof. A tired third mate, a dead radar, an ice watch nobody was keeping: three deviations the organisation had learned to live with, each patched with a workaround that became the standard way of running the ship. The tanker did not fail despite its defences. It failed through them, one tolerated layer at a time.

The situation

Prince William Sound in March is a high-consequence environment: remote, freezing, home to fisheries of enormous value. Ice calved from the Columbia Glacier drifted across the outbound lanes, and tankers had standing permission to swing wide of it. That is context, not cause. On the bridge that night: a radar broken long enough to become unremarkable, a master who had been drinking that evening and was asleep below deck, and a third mate — awake for the better part of a day — holding the watch alone.

How it unfolded

The manoeuvre was routine: swing wide of the ice, re-enter the lanes further on. The helmsman was sent below. The autopilot held the course. One officer, one turn to make, no working radar, no second pair of eyes, no reserve of alertness. He missed the turn. At four minutes past midnight the hull tore open on Bligh Reef.

Then came the second failure, the one people forget. The response plan promised containment equipment on the water within hours. None of it was staged. The barge was not ready. When a storm arrived two days later, the oil went wherever the wind wanted.

Root-cause anatomy

Strip the drama away and the failure mode is one line: vessel transits an ice-strewn channel at night with degraded detection. In PFMEA terms, severity was never in doubt — a laden tanker in that sound is a 10. Occurrence climbed with darkness, ice and fatigue. Detection was supposed to be the rescue: radar, a two-person bridge watch, the coast-guard vessel-traffic service. Every layer was down or degraded that night. Each had fallen through its own small tolerance.

The organisational layer is where the real cause lives. The radar had been out of service long enough that repair had become a debate about cost. Manning a night transit through ice had drifted down to a single officer. The coast-guard traffic watch had eroded away years before. This is normalisation of deviance — and the public memory of "the drunk captain ran it aground" is exactly the operator-level narrative I spend my working life rejecting.

An unchallenged deviation is simply a standard that has not met its reef yet.

Where the quality system failed

Run the failure through the standard disciplines and every missed gate shows. The PFMEA's detection ranking assumed radar, watchkeeping and coast-guard oversight — controls that existed on paper. A detection score that survives the loss of the control is fiction. That night, detection was in truth a 10.

The maintenance gate failed first and cheapest. A broken radar is an open defect with no containment. Deferral is legitimate with a documented interim mitigation and an expiry date; this one had neither, and the least expensive item in the whole case was the repair nobody authorised. Change control failed quietly too: one officer on a night ice transit was an operating-configuration change made without a risk review. In plants I have audited, the same shortcut is labelled "temporary" and lasts three years.

Process audit is where all of it surfaces. Ask for the deferred-maintenance list. Ask for the risk sign-offs. Ask to walk a night transit in reality, VDA 6.3 style. Those questions find every finding above — before the environment does.

What would have caught it

Nothing exotic. Five boring disciplines, applied with teeth:

• A control-loss escalation rule: radar down, sensor on bypass, poka-yoke disabled for changeover — the line slows or stops until the control returns. Add a lookout, wait for daylight, or refuse the risk.
• Deferred-maintenance sign-off: every deferral carries a named owner, a risk assessment and an expiry date. No signature, no deferral.
• Fatigue as an engineering input: manning for a high-risk transit is set by the risk, not the roster. A second officer on the bridge at night in ice is not comfort. It is a detection control.
• 8D gate discipline: any D4 that names "human error" as root cause comes back unanswered. The missed turn is where the analysis starts, not where it ends.
• Drills against a clock: the spill-response plan gets tested unannounced and the result goes to the board. An untested contingency plan is a brochure.

My take

I was not there and never saw the company's files. What I have is the public record and two decades of the same pattern in lighter industries. At Witte Automotive I closed QRQC and A3 cases where "operator error" dissolved the moment you asked what the operator had been given to work with — missing detection layers, tolerances everyone had quietly absorbed. At SNOP I built a quality function for 900+ people on one principle: detection layers are cheap until they are absent, and deferrals are where quality goes to hide.

In my world an angry customer escalates and you get a quarter to fix it. The sea does not escalate. It just grades you.

Eleven million gallons is what a stack of small tolerances costs when they fail together — and they fail together because normalisation of deviance links them. The cost of poor quality stays invisible only until something runs the audit for you. Run it first: roughly, routinely, without glamour. The reef charges for the lesson, and it takes payment in coastline.