Overlooked among the systems that apparently failed in the Deepwater Horizon catastrophe is what could be the most crucial safety device of all: the human blowout preventer. Every person working on the oil rig in the Gulf of Mexico had the authority to stop action, according to the company that owned the Deepwater Horizon, if he or she considered the situation unsafe. Yet people exposed to an array of hazards refrained from demanding a halt, reflecting a pattern that extends to almost any office cubicle or industrial site. It is hard to rock the boat _ until it bursts into flames and sinks to the bottom of the ocean _ and a safety policy based on the assumption that any individual will rock the boat is likely to be flawed. Case in point: Michael Williams, a chief electronics technician on the Deepwater Horizon who displayed remarkable courage during the disaster and who brought those challenges into focus in testimony to a federal investigative board last month. He described speaking up about problems but there were limits to what he could or would do. Williams, an employee of rig owner Transocean, said he thought that the blowout preventer _ the last line of defense against a gusher _ had been damaged and that he had seen chunks of its black rubber innards ejected from the well. There was never enough time to keep up with scheduled maintenance on the rig, he said, and some parts were so old that it took a year to get replacements custom made. In addition, to avoid the nuisance of false alarms, a system meant to automatically warn the entire crew about fire or leaking gas was routinely deactivated. Meanwhile, a computer used to monitor and control drilling operations intermittently crashed, leaving the driller staring at 'the blue screen of death.' In the middle of sensitive operations, the driller could switch chairs and move to backup computers, but if the backups failed, Williams said, the next step would be to 'abandon ship.' Switching to a backup is not without risk, he pointed out: During the drilling of an earlier well, while the computer was out of commission for several seconds, the rig incurred a kick of gas, he said. At the government hearing in Kenner, La., attorneys for BP, Transocean and the captain of the Deepwater Horizon pressed Williams about his power to shut down the rig. 'I want to ask whether or not you knew that you in fact not only had a right but you had an obligation to stop anything that you believed to be unsafe,' asked Kyle Schonekas, an attorney for the captain. 'Yes,' Williams said. 'You ever ask to stop operations on the rig because of the blue screen of death?' BP attorney Richard Godfrey asked. 'No, I did not. We had two other chairs,' Williams answered. 'Did anyone ever ask anyone to stop operations on the rig because of the inhibited alarms?' 'Not to my knowledge.' 'You never did that?' 'No, I did not.' In an interview, a lawyer for Williams, Scott R. Bickford, said Williams stopped work 'all the time' for 'minor infractions' _ for example, to caution a co- worker to use ear plugs. When it came to the alarm configuration, Williams reported concerns to superiors, and he considered his responsibility fulfilled when he was told that management wanted it that way, Bickford said. The blue screen of death was known up and down the chain of command, Williams testified. What was Williams supposed to do, his attorney asked, stand in the middle of the Deepwater Horizon and say, 'I'm shutting the rig down'? 'Realistically, you're painting a situation that _ that doesn't make much sense.' Investigations of the drilling of the Macondo well have shown that a variety of concerns arose _ about issues as diverse as the type of cement job and the number of devices used to center the pipe in the hole _ and the work continued. Transocean, the company that operated the Deepwater Horizon under contract to BP, placed such emphasis on its timeout-for-safety policy that it spelled it out in a health and safety manual, reinforced it through training and recognized employees for exercising it. The company condensed its stop-work policy to an oxymoronic acronym: START, for see, think, act, reinforce and track. 'In fact, we promote them to stop the job ... even if it turns out that it actually was safe but they had doubts about it,' Adrian Rose, Transocean's health, safety and environmental manager, told federal investigators in May. Daniel Becnel, a Louisiana lawyer representing victims of the oil spill, suggested that the expectation is unrealistic. 'They kept telling you that any man could have stopped the rig at any time. But that never happens in real life,' he said. 'If anybody would do it, that would be the last hitch they would be on an offshore drilling rig.' Yet it does happen. Rose estimated that over the past five years, across the Transocean fleet of '100-odd rigs,' the stop-work policy has been invoked hundreds of times. But BP well team leader John Guide testified that during the drilling of the Macondo well, such events mainly involved 'lifting-type operations' _ situations where somebody might be in the wrong place while equipment is being moved. Guide said he did not recall any such steps involving 'the well bore construction operation.' Aboard the Deepwater Horizon, addressing concerns about the engineering of the well or the condition of the rig would have required more than a momentary pause in action. A government investigation of another incident in the Gulf of Mexico shows that even where crew complaints reach the boiling point it can be a mistake to depend on people to call a timeout. The Minerals Management Service investigation of a 2006 blowout found that several crew members thought that operations on a Forest Oil platform were so dangerous that they took a boat back to shore, even after the man leading the operations said they would be fired for leaving, according to a government report. The man allegedly issuing the orders stayed behind with a shorthanded crew and was killed when equipment ejected from the well. Before the blowout, a supervisor refused to carry out an instruction from the boss, fearing it could leave the well out of control. The supervisor 'felt the job was unsafe from the beginning,' wanted to get off the platform and would have boarded the boat with the others if he had been awake at the time, the report said. Despite his worries, he did not shut down the job. 