BP: ‘An accident waiting to happen’

April 20 People are jumping

It was a Tuesday evening in April, two hours past sunset. A half-lit moon hung overhead, its image perfectly reflected in the untroubled waters of the Gulf of Mexico. Alwin Landry, the 41-year-old Cajun captain of the Damon B. Bankston, was at his desk in the wheelhouse, writing in his log. Chief mate Paul Erickson, an old salt with twin hoops in his left ear, was at the helm, keeping watch.

The Bankston, a stout, blue-hulled supply ship with a 150-foot flatbed cargo deck in back, was nestled port to port with the Deepwater Horizon, a drilling rig the size of a sports arena. The Bankston’s mission was to ferry supplies back and forth from the shore, serving at the Horizon’s beck and call.

At this hour, on the night of April 20, neither vessel should have been here. The Horizon had been due at its next drilling site a month before. The Bankston, in turn, was supposed to be on its way to Port Fourchon, La., for a midnight crew change. But when Landry was asked to take on 4,500 gallons of used drilling mud, he postponed his departure. The crews ran a heavy hose from the rig to the Bankston‘s storage tanks, and the flow commenced in the early afternoon. Before they were done, though, the Horizon suspended the transfer. Landry was told to stand by; no need to disconnect the hose. All was calm — until the moment when it wasn’t.

Erickson saw it first: “a cascade of liquid,” as he would later describe it, pouring down from the rig in awful quantity, pelting the Bankston like a black rain. Landry’s first thought was that the hose had ruptured, and his first feeling, even as he rushed to secure the two steel hatches on the bridge, was annoyance. Cleaning up this mess will take days! Then Landry looked up. “When I seen the top of the derrick,” he would later tell Fortune, “I realized they got a problem.”

Unfolding before his eyes was an almost biblical scene of destruction. Twenty stories above the main deck of the Horizon, a volcano was erupting: part seawater and part mud, borne upward from the depths by a violent surge of natural gas. Birds were falling out of the sky.

Landry radioed the bridge of the Horizon: “What’s going on?”

“We’re having trouble with the well right now.”

Landry didn’t recognize the voice, but it sounded worried — he could hear that. Then someone else was speaking. Later Landry would learn that it was Curt Kuchta, the 34-year-old captain of the Horizon. Kuchta told Landry to back off 500 meters — immediately.

Easier said than done. “We have a hose on board,” he reminded Kuchta. It was a big hose, four inches in diameter — the coupling alone weighed 150 pounds. Disengaging usually involved a crane.

“Uh …” Kuchta paused two beats. And that’s when the first explosion hit. Landry perceived it as a green flash emanating from the main deck of the rig, behind the derrick, followed by a percussive jolt, a massive fireball, and a hailstorm of debris. It knocked out all the lights, plunging the rig into darkness.

Anthony Gervasio, the Bankston’s engineer, was in the engine room when he heard what sounded like a “blown tire, times 100,” and rushed upstairs to investigate. He saw the mud. He saw the Horizon go dark. “Oh,” he said to himself, and before he could get to “crap, that’s not good,” the second explosion hit, much bigger than the first.

“Rig just blew up, we gotta go!” screamed deckhand Louis Langlois, a 340-pound Mutt to Gervasio’s 160-pound Jeff. “Disconnect the hose!” They took off, dashing the length of the cargo deck through a maze of crates and spools, slipping and sliding on an inch of mud. Gervasio, an all-state defensive back during his high school football days in Rhode Island, got there first; he slapped a wrench on the joint and pulled.

Captain Landry was still in the wheelhouse. He had just given the order to disconnect the hose, but now he wasn’t sure he could wait. Forty feet from where he stood, the rig was in full flame. Barrels filled with volatile compounds were rocketing into the sky like missiles. He considered gunning the throttle and going — just ripping the hose. He knew he had enough horsepower. But not until he heard from his guys. “I already sent ’em out there,” he was thinking. “I don’t want to pinch ’em in a hose.”

Then he saw them: Gervasio and Langlois at the back of the boat, arms raised, thumbs up, and he saw the hose in the water, and now he was pulling back, finally putting distance between himself and the inferno. With the fire growing and the Bankston’s mercury-vapor lamps full on, the scene was strangely bright, surreal, all lit up like a movie set.

Nevertheless, when the first flash of reflective material cut through Landry’s line of sight, he told himself: “That can’t be!”

He looked at Erickson, who was looking at him. Another flash. People are jumping, they both realized. Horizon crew members were abandoning ship — leaping from the main deck, plummeting 70 feet into the sea.

At 10:04 p.m., Landry banged out an e-mail to the BP control room in Houston: “Horizon is on FIRE Well Blowout send out help!!!!!!!”

The graveyard

The giant rig would burn for two days, listing more and more until finally it tipped and sank, snapping the mile-long pipe that ran between the derrick on the surface and the wellhead at the bottom of the sea and unleashing a red-brown gusher of Middle Miocene sludge. Some 206 million gallons of oil would pour into the gulf before BP finally stanched the flow.

Today the Macondo well, named for a cursed town in a Gabriel García Márquez novel, is sealed and abandoned. It’s a graveyard for 11 men, a dump for what remains of the Deepwater Horizon, and a haunting symbol of excessive faith in the safety of deepwater drilling. It’s also an enduring mystery.

It’s not easy to blow up an offshore oil rig. It requires an astonishing collection of failures big and small, human and mechanical, by individuals and by organizations. In the industrial-accident investigation business, the classic metaphor is Swiss cheese. Each mistake is a hole in a single slice, and it’s only when the errors stack up, with the holes aligning perfectly, that a disaster results.

Experts will debate the precise cause for years. Already the explosion at Macondo qualifies as one of the most intensely dissected industrial accidents in U.S. history, with at least nine separate investigations by government agencies, the National Academy of Engineering, three of the corporations involved, and a special presidential commission, which issued a 380-page report on Jan. 11. The Justice Department, which is weighing criminal charges, has already brought a civil case against BP, rig operator Transocean, and other companies. Plaintiffs lawyers, representing everyone from the families of the Horizon’s dead to half-empty motels in Florida, have filed more than 350 lawsuits. At stake are billions in fines and damages.

But knowing who’s to blame isn’t nearly so important as understanding why this catastrophe happened — and making sure it never happens again. A Fortune investigation reveals that the disaster was a long time in the making, the product of a corporate culture that venerated risk taking even as years of merger-driven growth and successive rounds of cost cutting consumed its leaders’ focus.

In the decade before the Deepwater Horizon, BP (BP) had a history of serious accidents. Each time its CEO vowed to avoid a future disaster. In 2000, after a string of fires and equipment failures, CEO John Browne announced plans to “renew our commitment to safety.” In 2005, after a horrific explosion killed 15 people at BP’s Texas City refinery, he swore there’d be “no stone left unturned” to investigate what happened and correct any safety issues. In 2007, after being named Browne’s successor in the aftermath of more problems, Tony Hayward promised to focus “like a laser” on safety — only to oversee the worst oil spill in history.

Fortune‘s investigation shows how Hayward, a fast-rising geologist once known as “Teflon Tony,” fell tragically short of his goal. Despite efforts to change, BP never corrected the underlying weakness in its safety approach, which allowed earlier calamities, such as the Texas City refinery explosion. Perhaps the most crucial culprit: an emphasis on personal safety (such as reducing slips and falls) rather than process safety (avoiding a deadly explosion). That might seem like a semantic distinction at first glance, but it had profound consequences.

Consider this: BP had strict guidelines barring employees from carrying a cup of coffee without a lid — but no standard procedure for how to conduct a “negative-pressure test,” a critical last step in avoiding a well blowout. If done properly, that test might have saved the Deepwater Horizon.

Indeed, BP executives warned of serious process-safety “gaps” in the Gulf of Mexico, Fortune has learned, in a never-before-reported strategy document dated December 2008. “It’s become apparent,” the BP document stated, “that process-safety major hazards and risks are not fully understood by engineering or line operating personnel. Insufficient awareness is leading to missed signals that precede incidents and response after incidents, both of which increases the potential for and severity of process-safety related incidents.” The document called for stronger “major hazard awareness.”

But BP failed. “They just did safety wrong,” says Nancy Leveson, an industrial safety expert at MIT who served on a panel that investigated BP’s safety practices after its refinery explosion; she has since taught safety classes to BP executives and also advised the presidential panel that investigated the Deepwater Horizon disaster. “They were producing a lot of standards,” she says, “but many were not very good, and many were irrelevant.” Leveson says that she was so troubled by BP’s approach that in January 2010 she told colleagues, “They are an accident waiting to happen.”

The world of the Horizon

Standing on the steel deck of the Deepwater Horizon, it was easy to forget that it was a ship — even in stormy seas, its computerized positioning system kept it almost motionless. The Horizon was many things: a drilling rig, of course, a heliport, and a floating hotel. But fundamentally it was a very big ship.

Nine years old when it sank, the Horizon was born halfway around the world, at a Hyundai shipyard in South Korea. At the time it was state-of-the-art. The rig cost R&B Falcon, its original owner, $365 million and featured four squat legs standing on a pair of submerged pontoons. This underbody supported a 28,000-ton “drilling package.” Raising that massive pile of steel onto the rig’s legs — a feat performed at the Korean shipyard by an Italian company, Fagioli — established a world record for the heaviest object ever lifted.

[cnnmoney-video vid=/video/news/2011/01/21/n_f_deepwater_horizon_rig.fortune]

Compared with its peers, the Horizon was a floating palace. With accommodations for 160, it had a movie room, a gym, a sauna, a cave for smokers, even maid service. Its berths came complete with carpeting, in-room Internet, and satellite TV. The mess hall was open 24 hours. Not a bad place to be on Super Bowl Sunday, when they’d all gather to watch the game and the cook would put out nachos and hot wings.

On its maiden voyage from Korea, the Horizon sailed southwest at three to four knots — the equivalent of a slow walk — put in for a crew change at Cape Town in South Africa, then pushed northwest across the Atlantic, finally arriving in July 2001 at Freeport, Texas, on the Gulf of Mexico. Once the Horizon left Freeport, it would never again return to port, nor would it ever leave the gulf. By then R&B Falcon was no more, having been swallowed by the Horizon’s new owner, a deepwater pioneer called Transocean (RIG), with nominal headquarters in Switzerland. And Vastar Resources, the Houston-based exploration company that had contracted to use the Horizon? It had been bought by BP.

The lightning rod

“I’ve got lots of time on my hands,” says Tony Hayward, offering a bit of gallows humor. It’s Sept. 29 — a rainy morning in London, and two days before the CEO turns over the reins to his deputy, Bob Dudley. Hayward meets a Fortune writer at BP’s starkly contemporary headquarters on St. James’s Square before leading the way, beneath a shared umbrella, to a sidewalk café a few blocks away, on Haymarket Street. As double-decker buses roar by, he sits down with a bottle of San Benedetto water for the first in a series of in-depth conversations with Fortune.

The BP spill, he maintains, has turned out to be much less dire than initially believed. “The story of the environmental apocalypse is being rewritten as we speak,” Hayward says. “The last thing the media needed was a success story. What the media wanted was a holy disaster. One of my biggest mistakes was that I allowed myself to become the lightning rod for hatred and anger.” Face to face, Tony Hayward is a bit of a surprise: personable, direct, wryly self-mocking, sarcastic, and sometimes profane. He’s also the Hayward that Americans have come to know and scorn: wounded, defensive, and tone-deaf.

“I genuinely feel this could have happened to anyone,” Hayward continues. “This isn’t BP. It’s an industry accident.” As he sees it, BP’s reaction constituted “the most extraordinary corporate response in history.” He defends his safety record, asserting that “BP has enormously more focus on process safety than it used to,” though the company is still “on its journey.” Hayward concedes that some of his comments about the environmental impacts of the spill, “taken out of context,” were “deeply unhelpful,” but quickly adds, “I don’t want to sound defensive, but much of it’s turning out to be true.”

For now Hayward is happy to be back in England, where he says his countrymen have been supportive, buying him drinks. Not so in the U.S. Before the Macondo well was capped, Hayward, who’d been staying with the expatriate BP team at Houston’s four-star Hotel Sorella, had to take refuge in an undisclosed location — only his driver knew where he spent the night. “I was really being followed by the paparazzi,” he says. “Not only had I become the most hated and clueless man in America, I’d become the most hunted.”

The geologist and the tray men

When he launched his career in the oil business, Anthony Bryan Hayward seemed destined for a life in peaceful obscurity. He was completing his Ph.D. in geology at the University of Edinburgh with a dissertation titled “Tertiary Ophiolite-Related Sedimentation in S.W. Turkey.” The 420-page paper reconstructs the formation of an ancient sedimentary basin — a hot topic for someone interested in hunting for hydrocarbons. (The future CEO’s thesis quoted lyrics from Bob Dylan’s protest anthem “Blowin’ in the Wind,” including the line, “How many years can a mountain exist before it’s washed to the sea?”)

BP’s first century in the oil business

When Hayward joined BP in 1982, the company was at a critical moment. Since its founding in 1909 as the Anglo-Persian Oil Co., it had operated like an arm of the British Empire. The government became its biggest shareholder, and the Middle East provided virtually all its oil. But by the time Hayward signed on, the Arab countries had given BP the boot. The days of easy access to bottomless reserves were over.

BP found two new sources of crude to replace a fraction of what it had lost, but in far riskier environments: Alaska’s Prudhoe Bay and the North Sea. Hayward was dispatched to a rig exploring the Miller Field, 165 miles off the Scottish coast, in 330 feet of water. He reveled in the adventure of offshore exploration — and he enjoyed a healthy dose of good luck. In interviews years later he giddily recalled the thrill of striking oil at 4 a.m. on Christmas Day, just months after he’d started work.

Hayward happily spent his first eight years as a globetrotting field geologist, working in such far-flung locales as Mongolia and Papua New Guinea. BP prided itself on finding oil — the British explorer spirit ran deep. But it kept losing ground. Competitors derided it as a “two-pipeline company,” too dependent on Alaska and the North Sea.

BP was also hampered by a starched, rigidly hierarchical management culture dominated by company lifers. Each headquarters employee above a certain rank used to receive his own towel and bar of soap on Monday morning. Senior employees, known as “tray men,” got their afternoon tea and biscuits on a tray of their own.

Bureaucracy ruled and operating costs were sky-high. As a result BP’s profit per employee was half that of Exxon (XOM).

All this would be left behind with the ascent of Edmund John Philip Browne, later known as Lord Browne of Madingley. Modern oil’s first celebrity CEO, Browne was a brilliant and charismatic man, with degrees in physics and business from Cambridge and Stanford. Browne would define the future of BP, the entire oil industry — and Tony Hayward.

In 1989, after being placed in charge of BP’s flagship exploration and production business, John Browne assigned the company’s top 10 geologists to cook up a fresh strategy for finding oil. Hayward, then 32, was among them. They convened at a resort hotel outside London and emerged several days later with a plan.

BP rushed in, acquiring offshore leases, becoming the biggest player there. Over time, the deepwater gulf emerged as the engine of new U.S. oil production. All this was encouraged by American politicians, who cut taxes for offshore drilling and opened up new swaths of ocean for exploration. Meanwhile the government’s Minerals Management Service — the drillers’ chief regulator — operated like a promotional arm of the industry. Just about everybody, it seemed, liked offshore drilling.

The Sun King and Teflon Tony

John Browne’s legacy as CEO would be enormous — for better and worse. After taking over in 1995 he imposed a tough bottom-line mentality, ever focused on cutting costs. He delegated operating authority to his managers, who presided over their fiefdoms like mini-CEOs. But he made each of the top 250 sign an annual “performance contract” that set out aggressive profit and productivity targets. Browne then held them personally accountable.

Browne also transformed BP’s image, recasting it as the first “green” oil company. In 1997 he broke with the industry by acknowledging the evidence of global warming. Browne invested billions in alternative fuels and launched a $200 million rebranding campaign. British Petroleum legally renamed itself BP and adopted an evocative (if vague) slogan: “Beyond petroleum.” BP’s eco-aspirations would later be derided as hypocrisy. But at the time it was magic, and the CEO was showered with honors: an Earth Day award from the United Nations, 18 honorary degrees, acclaim as Britain’s “most admired” CEO. Queen Elizabeth knighted him. Dapper and cerebral, Browne collected Mapplethorpe photographs, loved opera, and attended state dinners with his widowed mother, who lived with him in London. He reveled in the accolades. The Financial Times christened him the “Sun King.”

If Browne was king, then Hayward was a favored prince. In 1990, Browne plucked him from the geologist ranks and anointed him as one of his two executive assistants — known within the company as “Turtles,” after the comic book Teenage Mutant Ninja Turtles. Turtles did everything from carrying Browne’s bags on overseas trips to sitting in on BP board meetings. Those who impressed moved on to the fast track. Hayward would later insist that until he’d become a Turtle, he’d never wanted to be more than a geologist — that working with Browne “opened my eyes to the world of business.” But, in an interview with Fortune, Browne says the glint of ambition was evident: “He never struck me as someone being dragged to the throne, as it were, in the papal sense.”

A short history of drilling in the Gulf of Mexico

But both of those ventures were disappointments, and former colleagues say Hayward had a tendency to paint a rosy picture of how much oil would be found. Says Browne: “He biased things to the positive. That tends to be a characteristic if you come from the pure exploration side in the oil and gas business.” (Hayward acknowledges BP found less oil than expected in Colombia, but asserts it turned out to be a “fantastic” investment. He blames political impediments for stymieing BP in Venezuela.)

In truth, Lord Browne didn’t want to hand over his job to anyone — at least not anytime soon. The company had announced he would retire in December 2008, at 60. But Browne wanted to pull off one last spectacular deal to make BP the world’s largest oil company. He began floating the idea of merging with Shell — only to be shot down by the company’s board. Says then-chairman Peter Sutherland, who chairs Goldman Sachs International: “It would have been an absolute disaster.”

“An intolerable risk situation”

For years, BP had prepared for catastrophe. Around the clock, one senior executive was designated to take the call alerting London to an emergency somewhere. Consultants drilled management on how to respond, staging disaster scenarios that would last two or three days. One had an oil tanker running aground in the Strait of Malacca. In another BP faced a catastrophic offshore blowout. As the choreographed episode unfolded, actors would show up on the doorstep of executives’ homes, assuming the role of baying reporters.

On March 23, 2005, BP’s crisis signal went out for real: Texas City was on fire. Located near Galveston, Texas City was BP’s biggest — and most troubled — oil refinery. A tank cooking flammable gasoline additives had boiled over, generating a vapor cloud that ignited with the backfire of a pickup truck. The blast killed 15 people and injured 180. It was America’s worst industrial accident in a decade.

For years BP had touted its safety record, pointing to a steep decline in the number of slips, falls, and vehicle accidents that generate days away from work, a statistic that is closely followed by both the industry and its regulators. Under Browne, BP had established a dizzying array of rules that burnished this record, including prohibitions on driving while speaking on a cellphone, walking down a staircase without holding a handrail, and carrying a cup of coffee around without a lid. Bonuses for BP executives included a component tied to these personal-injury metrics. Browne says BP cut its injury rate dramatically after the Amoco merger. “The tragedy of Texas City is that it wasn’t good enough,” he says.

But BP’s personal-safety achievements masked failures in assuring process safety. In the energy business, process safety generally comes down to a single issue: keeping hydrocarbons contained inside a steel pipe or tank. Disasters don’t happen because someone drops a pipe on his foot or bumps his head. They result from flawed ways of doing business that permit risks to accumulate.

At the behest of the U.S. Chemical Safety Board, BP appointed a blue-ribbon panel chaired by former Secretary of State James Baker to study Texas City and its four other American refineries. The group found “a lack of operating discipline, toleration of serious deviations from safe operating practices, and apparent complacency toward serious process-safety risks.” It concluded that Browne’s “decentralized management system and entrepreneurial culture” had “delegated” safety issues. BP’s global safety chief, for example, reported to a Browne deputy. In its own 341-page report, the Chemical Safety Board identified another major factor: corporate cost cutting.

In the explosion’s aftermath Browne pledged to prevent another catastrophe. But Texas City wasn’t the only major failure on his watch. Just four months later Thunder Horse, BP’s giant new production platform in the Gulf of Mexico, nearly sank during a hurricane. In their rush to finish the $1 billion platform, workers had installed a valve backwards, allowing the ballast tanks to flood. Inspections revealed other shoddy work. Repairs costing hundreds of millions would keep Thunder Horse out of commission for three years.

As U.S. criticism grew, Browne brought in a well-connected American with a reassuring accent to provide political cover. Bob Malone, the new chairman of BP America, was a native of rural Texas and a BP veteran. Browne came to describe him as “my human shield.” With Malone on point, BP successfully pursued what had become its standard post-disaster approach: acknowledge mistakes and open its checkbook — but steadfastly deny that BP had a systemic problem. Browne gave Malone unilateral authority to shut down any U.S. operation at the hint of a safety problem.

Having clung to his job through disasters that cost lives and billions of dollars, the Sun King would lose it for a comparatively trivial mistake: He lied during a court battle in the hope of blocking a British tabloid from publishing an exposé about his personal life. Browne’s former lover, 27-year-old Jeff Chevalier, had sold the paper his story. In the closed-door legal fight, conducted under strict English press laws, Browne falsely described how the relationship had begun, claiming they had met while jogging in a London park; it had actually been through Suited and Booted, an escort service. This deceit prompted a judge to clear the story for publication in May 2007 — and led the BP board to accept Browne’s immediate resignation.

Although the scandal accelerated Browne’s departure, the board had already announced his successor. Says then-chairman Sutherland: “Tony Hayward was a slam-dunk.”

Focusing on safety

Browne had transformed BP through his frenetic dealmaking; Hayward would concentrate on properly managing it. He promised the board a new mantra: “silent running.”

The first step — indeed, Hayward’s mandate from the board — was a commitment to safety. That, of course, meant avoiding any more disasters. Months after taking over, Hayward made a second pledge: to boost BP’s “dreadful” bottom line. He promised to close an $8 billion “profit gap” with Shell. That, of course, meant cutting budgets.

Hayward was aware of the tension between safety, which is costly, and profits. A month before he was named CEO he declared, in a message to employees, that BP management had made a “virtue out of doing more for less.” He explained, “The mantra of ‘more for less’ says that we can get 100% of the task completed with 90% of the resources — which in some cases is okay and might work, but it needs to be deployed with great judgment and wisdom. When it isn’t, you run into trouble.”

Hayward became involved with safety issues in ways that Browne never had. He had previously hired a safety coach to teach him how to ask tough questions during work site tours. As CEO he personally chaired BP’s risk committee. Hayward also dispatched groups of executives to the newly established BP “Operations Academy,” a program at MIT where they spent three two-week sessions learning to better manage their businesses and deal with risk. It included a case study on what went wrong at Texas City.

The centerpiece of Hayward’s new approach was a sweeping plan called the Operating Management System, known as OMS. Even today Hayward calls OMS “my most long-standing legacy.” On paper it had much to recommend it. In much the same way as Exxon successfully did after the Valdez spill, OMS aimed to integrate safety into every aspect of operations, theoretically making each employee responsible for safety. Fully implementing this system was a massive undertaking that would take years. Hayward viewed it as a structure that would identify and correct flaws in the way BP did business companywide and, ultimately, prevent disasters.

But just such a “catastrophic loss,” of course, came only three months later — in part because OMS had flaws of its own. It did a good job of integrating process safety into the planning stage, according to a presidential commission investigator, but it lacked effective procedures for guiding decisions during operations.

Perhaps the best proof that OMS wasn’t solving BP’s process-safety problems: The company continued to run into trouble — precisely where it was under the most scrutiny and had the most incentive to improve. In 2009 the federal Occupational Safety and Health Administration (OSHA) proposed a record fine against BP for “failure to abate” previously cited hazards at Texas City. OSHA also cited BP for hundreds of new “willful” safety violations. (BP totaled 829 such refinery violations from June 2007 to February 2010, according to the Center for Public Integrity. The rest of the industry combined had 33.) There had been three more deaths at Texas City since the 2005 explosion.

The chairman of the federal Chemical Safety Board called the record OSHA fine evidence that BP had “yet to achieve an effective safety culture.” He noted that the company had failed to comply with a “particularly important” CSB recommendation to appoint a process-safety expert to its board.

It had been two decades since the last big oil spill in the Gulf of Mexico. President Obama judged operations so safe that on April 2, 2010, he announced plans to lift the 26-year ban on drilling off the East Coast. “It turns out,” he declared, “that oil rigs today generally don’t cause spills.”

April 20 “What is that?”

Tuesday, April 20, was crew-change day. Among those converging on the Deepwater Horizon was Curt Kuchta, one of the rig’s captains. He flew in from his Maryland home the previous night, slept in a hotel near the New Orleans airport, woke up at 7 a.m. to catch the crew bus, and boarded a helicopter in Houma, La., for the one-hour flight to the rig. A long commute, to be sure, but not unique. That’s a big part of the appeal, for some, of 21 days on, 21 days off. You get to live wherever, as long as you’re willing to work wherever.

As it happens, nothing about the Deepwater Horizon’s current project, Macondo No. 1, had gone smoothly. The Horizon wasn’t even supposed to drill this well. Transocean’s Marianas rig was knocked out of commission in November 2009 by Hurricane Ida. So the Horizon took over in early 2010 — and quickly encountered problems of its own. On March 8, two miles below the ocean floor, the drill pipe got stuck in the rock, forcing BP to back up and drill around it. Throughout the spring, there were numerous “lost circulation” episodes, which occur when drilling mud seeps through cracks in the wellbore, and “kicks,” which signal unexpected gas pressure entering the well. All costly, all time-consuming, all potentially dangerous. Once viewed as a run-of-the-mill project, Macondo had fallen 45 days behind schedule and $58 million over budget. Some of the crew had taken to calling it “the well from hell.”

Then another slice of Swiss cheese: Halliburton, whose late founder Erle Halliburton was memorialized in the book Genius With Cement, prepared a foamed mixture that failed multiple tests in Halliburton’s own labs — results that BP may never have seen. BP, for its part, never verified the cement was reliable.

Now one critical task remained to identify any previously missed problems: the “negative-pressure test,” designed to make sure no oil or gas was seeping into the well. The results would tell the crew whether it was safe to finish displacing heavy drilling mud inside the casing with lighter seawater, set the top cement plug, disconnect the drilling pipe, and move on — a process known as temporary abandonment. Once that was accomplished, BP would send a production platform to begin drawing oil from the well.

The negative test almost didn’t happen. Jimmy Harrell, Transocean’s white-haired senior drilling officer — a father figure to many of the men — was surprised to see no mention of it in BP’s daily work plan on April 19. That concerned him: A negative-pressure test is standard procedure. Normally Harrell would defer to BP. Although it had only a handful of people on the rig, BP was the final arbiter on all drilling decisions. But in this case, especially after all that had happened already, Harrell was unwilling to bend. The test went back on the schedule — one of many last-minute changes. “There is no evidence,” the presidential commission would later conclude, “that these changes went through any sort of formal risk assessment or management of change process.” More Swiss cheese.

Around 5 p.m., Halliburton’s Ryan Haire began the negative-pressure test. He opened a direct line into the drill pipe and bled off pressure. As the pressure dropped, fluid began rising in the well, collecting in twin 10-barrel measuring tanks. Some flow was to be expected, but not this much. Before long, Haire called the drilling floor: “My tanks are full,” he said. “I’ll have to shut the well in.”

BP’s Donald Vidrine ordered the crew to perform the test yet again, this time on a side channel into the drill pipe called a “kill line.” In theory, since the kill line and drill pipe are parts of a closed system, tests on each line should generate identical results. But this time the well passed the test: No fluid and no pressure buildup. (Investigators would later theorize that the kill line was clogged.) Deciding that one successful test in the kill line was more telling than three failed tests in the drill pipe, the BP men on board gave the final go-ahead: The well could be plugged.

Night was falling. In a meeting room below decks the VIPs congratulated the crew on its spotless seven-year safety record. They discussed new, more ambitious goals for 2010.

Shortly after 9 p.m. the VIPs adjourned and made their way to the bridge. It was an impressive place, especially after dark, all glowing screens and blinking lights. They ended up at the dynamic positioning simulator, a training device that played like a videogame, designed to mimic extreme conditions that could knock the rig off the well. They were having fun. But the game was about to end.

The first signal on the bridge that something was amiss was a sudden, high-frequency vibration. Everybody felt it. “What is that?” asked Captain Kuchta.

Mike Williams, the Horizon’s chief electronics technician, was on the phone with his wife when he heard what he would later describe as “a hissing noise and a thump.” He told her he had to hang up.

Leo Lindner, a former English professor turned drilling fluid specialist (the money was better), was asleep when the first explosion occurred. By the time the second one hit, he was out of bed, standing barefoot in his skivvies, trying to get his bearings. The air was thick with smoke. That’s odd, Lindner thought: He could see his buddy, Ryan Haire, there on the other side of what used to be a wall. He heard Yancy Keplinger on the ship’s intercom, yelling “Fire! Fire! Fire! This is not a drill!” He reached for some clothes. “I thought I should die with some pants on,” he later told Fortune.

Crew members gathered at the two forward lifeboats (the two in the rear were blocked by flames). Muster leaders with clipboards checked off names, trying to get an accurate count, but everyone could see it was hopeless: Some crew members had already jumped. After what seemed like an interminable delay, both boats launched, leaving a handful of people behind. For them, the only remaining option, short of jumping, was an inflatable life raft.

Toolpusher Wyman Wheeler, gravely injured and screaming in pain, arrived on a gurney. But Wheeler’s helpers couldn’t load the stretcher onto the raft, now dangling over the edge of the deck. Flames were approaching. The heat was almost unbearable. Little explosions were erupting all around them. Finally, chief engineer Steve Bertone managed to shove the gurney into the life raft and follow.

It was a miracle not yet known to those still desperately trying to escape that there would be no more dying that night. That part was over. Wheeler, like all the injured, would survive. But 10 of their fellow crew members had been consumed by flames on the drilling floor. Another had fallen from the starboard crane. He was last seen lying face down on the deck in a pool of blood by a co-worker who checked for a pulse, detected none, and fled.

April 20 The sea is burning

Louis Langlois and Anthony Gervasio, the Mutt-and-Jeff team on the Damon Bankston, saw the jumpers. Seconds after receiving the order from Captain Landry to go, they were in the Bankston’s rescue boat, motoring toward the burning rig.

High overhead, hanging from the main deck of the Horizon like a big orange spider on a tendril of silk, was the raft, cocked at a crazy angle. As it came down, Horizon crew members were splashing into the sea beside it.

They nudged the rescue craft in closer. Seven or eight people were in the water, trying to pull the raft away from the flames. Langlois tossed a line to the raft, and as soon as it was secure, Gervasio threw his boat into reverse, eager to get away.

Luckily, Langlois had a knife, a six-inch folding Buck. He passed it to Kuchta, who swam back and cut the painter, severing the last connection to the burning rig.

The scene aboard the Bankston was “controlled chaos,” as Captain Landry would later describe it. His crew of 12 was hard at work: handing out boots, socks, blue jeans, and cigarettes, serving up rice and beans and hamburgers, tending to the injured. There was a logjam at the top of the Bankston’s rope ladder. As each stunned Horizon crew member clambered aboard, he turned and loitered, peering over the side to see who was coming up next — who had made it and who had not.

The first headcount came up 15 short. Then 11, then 11 again, and that’s where it settled. Officially the search and rescue mission continued for four days. But none among the dazed and disbelieving survivors standing in clusters on the Bankston’s main deck — some of them still in their underwear, some crying, most simply staring fixedly across the water at the howling pyre they’d just escaped — had any illusions about the fate of their missing comrades. “I don’t know what I’m gonna tell his wife,” one of them murmured.

Not until 8:13 the following morning did the Bankston depart the scene. Normally it’s a 12- to 14-hour trip to Port Fourchon. But the Bankston had to make a couple of out-of-the-way stops at other rigs: first to take on two medics and drop off four Horizon crew members, who would try to activate the rig’s blowout preventer remotely; and second to board a contingent of company lawyers (for the Bankston’s owner, Tidewater Marine) and government investigators who had helicoptered out from the mainland to begin taking statements.

At 1:27 a.m. on Thursday, April 22, the Bankston finally arrived at C-port, slip No. 1, in Port Fourchon. Waiting at the dock was a line of Porta Potties. It had been 27 hours since the explosion — not too late to test for alcohol and drugs. Also waiting were white buses that would carry them all to a hotel in Kenner, 90 minutes north. There they were released to their loved ones — and a world waiting to hear what had happened.

“I’d like my life back.”

BP’s top executives gathered in a war room at their London headquarters, staring at CNN. The blazing rig looked like “a big Roman candle,” Hayward recalls. Boats were pouring water onto its deck. “Christ,” Hayward told Inglis, “if we keep going like this, the bloody thing’s going to sink!”

All such efforts, of course, would fail. After burning for 36 hours, the Deepwater Horizon sank at 10:22 a.m. on April 22. Hayward arrived at BP’s U.S. headquarters in Houston in time to get the bad news: Macondo No. 1 was gushing crude.

Looking back at the 87 days it took to stop the flow of oil, it’s hard to fault what BP actually did — in struggling to cap the well, keep oil from reaching shore, clean the fouled beaches, and committing to pay the economically injured. Because BP held the Macondo lease, U.S. law required it to pay all cleanup costs. But Hayward never sought to hide behind a cap passed after the Exxon Valdez accident, limiting damages for oil spills to $75 million. Indeed, BP will pay far more, far more quickly, to far more people than the company would have ever had to pay in the U.S. civil court system. BP now projects its price tag for the disaster at more than $40 billion — 10 times what Exxon spent in Alaska.

BP’s public strategy, on the other hand, was its own disaster. It overshadowed BP’s response, added billions to its tab, cost Hayward his job, and even jeopardized the oil giant’s survival.

“What the hell did we do to deserve this?” Hayward asked colleagues shortly after the explosion. The comment perfectly captured his perspective: BP hadn’t done anything wrong. Hayward downplayed the size and significance of the spill and minimized BP’s role. “It wasn’t our accident,” he said, blaming both Transocean and the “unprecedented” failure of the rig’s blowout preventer.

Hayward made matters worse, attaining infamy when he vented his own frustration. He’d been in the U.S. for weeks. He and his family had received death threats. His wife (who had joined a Facebook group called “Lay off Tony Hayward!”) had undergone surgery while he was away. And he was spending much of his time leading tours of sludge-stained beaches for reporters, who demanded to know how he felt about destroying the livelihood of so many struggling Americans. “We’re sorry,” Hayward replied to the cameras in Venice, La. “We’re sorry for the massive disruption it’s caused to their lives.” Then, sounding annoyed: “And you know, there’s no one who wants this thing over more than I do. I’d like my life back.”

By June the situation had mushroomed into a national rage. President Obama told NBC he was seeking advice on “whose ass to kick.” Congress began drafting proposals to bar BP from U.S. waters. The company’s stock dropped 48%, wiping out $91 billion in market value.

This was generating what BP’s current CEO, Bob Dudley, describes as a “near-death” experience. BP, which funded its working capital needs with about $10 billion in short-term paper, found itself shut out of the overnight markets. Trading partners shunned the company. A liquidity crisis loomed. Hayward says he directed his financial team to shore up the business with fresh bank lines, to make BP “bulletproof.” He adds: “If we hadn’t dealt with it in a very draconian way, we would have had a big problem.”

In truth, BP got what it desperately needed, starting with a limit on its damages outlay — enormous, to be sure, but manageable for a company that had made $6 billion in the first quarter of 2010. Obama also promised to end his market-rattling assault, telling the world, “BP is a strong and viable company, and it is in all of our interests that it remain so.” Says Hayward: “We needed political calmness. We needed to stop being attacked by the most powerful government in the world.”

“Systematic failures … in the entire industry”

As the other investigations dragged on, BP was quick to offer its own judgment. In a 192-page report released last fall, the company admitted oversight mistakes but placed most of the blame on its contractors, especially Transocean and Halliburton. Dismissing widespread criticism of its well design as irrelevant, BP cited the flawed cement work, concluding that it had allowed gas to enter the well through the bottom; the botched negative-pressure test; the rig crew’s failure to respond to signs of trouble; and the impotence of the blowout preventer. BP’s conclusion was that the Horizon was an industry accident, with lessons for all, not an indictment of its own practices.

In truth, any fair reckoning of responsibility places BP at the top of the list. Its contractors made critical mistakes. But at virtually every step, BP made decisions that increased risk and displayed a lack of oversight and operational discipline. All were failures in process safety — and all saved the company time and money. As the presidential commission noted, BP’s record suggests “its approach to managing safety has been on individual worker occupational safety but not on process safety. These incidents and subsequent analyses indicate that the company does not have consistent and reliable risk-management processes — and thus has been unable to meet its professed commitment to safety.”

That said, it’s also perilous to assume that BP stands alone. The offshore-drilling industry has experienced a chilling array of accidents in the past decade — fires, blowouts, oil spills, and close calls — including 20 in the gulf. As the presidential commission observed, “The Macondo well blowout can be traced to a series of identifiable mistakes made by BP, Halliburton, and Transocean that reveal such systematic failures in risk management that they place in doubt the safety culture of the entire industry.”

Dudley has announced a major reorganization, aimed at averting yet another disaster. He created a new safety division with broad powers to intervene in company operations. And BP finally appointed a board member with expertise in process safety.

A visit with BP’s new CEO

Fortune met with Dudley at BP’s London headquarters in November. Dudley is more careful with his words than Hayward, the personification of likable calm. But though his tone and accent are different, the substance of his message is eerily familiar.

Dudley insists that BP made great strides on safety over the past decade. “If you put aside this Macondo incident,” he says without irony, “2009 was the best year we’d had, and 2010 was also heading in that direction.” Spoken like a true BP man.

Oil’s future is in deepwater drilling

BP claims: Get paid ‘quick’ if you don’t sue