BP: 'An accident waiting to happen'January 24, 2011: 5:00 AM ET
When Tony Hayward took over BP in 2007 - after the oil giant had experienced a series of calamitous accidents - he vowed that safety would be his top priority. So how did he come to preside over one of the worst industrial disasters in history? A Fortune investigation reveals a saga of hubris, ambition, and a safety philosophy that focused too much on spilled coffee and not enough on drilling disasters.
By Peter Elkind and David Whitford with Doris Burke
April 20 People are jumping
It was a Tuesday evening in April, two hours past sunset. A half-lit moon hung overhead, its image perfectly reflected in the untroubled waters of the Gulf of Mexico. Alwin Landry, the 41-year-old Cajun captain of the Damon B. Bankston, was at his desk in the wheelhouse, writing in his log. Chief mate Paul Erickson, an old salt with twin hoops in his left ear, was at the helm, keeping watch.
The Bankston, a stout, blue-hulled supply ship with a 150-foot flatbed cargo deck in back, was nestled port to port with the Deepwater Horizon, a drilling rig the size of a sports arena. The Bankston's mission was to ferry supplies back and forth from the shore, serving at the Horizon's beck and call.
At this hour, on the night of April 20, neither vessel should have been here. The Horizon had been due at its next drilling site a month before. The Bankston, in turn, was supposed to be on its way to Port Fourchon, La., for a midnight crew change. But when Landry was asked to take on 4,500 gallons of used drilling mud, he postponed his departure. The crews ran a heavy hose from the rig to the Bankston's storage tanks, and the flow commenced in the early afternoon. Before they were done, though, the Horizon suspended the transfer. Landry was told to stand by; no need to disconnect the hose. All was calm -- until the moment when it wasn't.
Erickson saw it first: "a cascade of liquid," as he would later describe it, pouring down from the rig in awful quantity, pelting the Bankston like a black rain. Landry's first thought was that the hose had ruptured, and his first feeling, even as he rushed to secure the two steel hatches on the bridge, was annoyance. Cleaning up this mess will take days! Then Landry looked up. "When I seen the top of the derrick," he would later tell Fortune, "I realized they got a problem."
Unfolding before his eyes was an almost biblical scene of destruction. Twenty stories above the main deck of the Horizon, a volcano was erupting: part seawater and part mud, borne upward from the depths by a violent surge of natural gas. Birds were falling out of the sky.
Landry radioed the bridge of the Horizon: "What's going on?"
"We're having trouble with the well right now."
Landry didn't recognize the voice, but it sounded worried -- he could hear that. Then someone else was speaking. Later Landry would learn that it was Curt Kuchta, the 34-year-old captain of the Horizon. Kuchta told Landry to back off 500 meters -- immediately.
Easier said than done. "We have a hose on board," he reminded Kuchta. It was a big hose, four inches in diameter -- the coupling alone weighed 150 pounds. Disengaging usually involved a crane.
"Uh ..." Kuchta paused two beats. And that's when the first explosion hit. Landry perceived it as a green flash emanating from the main deck of the rig, behind the derrick, followed by a percussive jolt, a massive fireball, and a hailstorm of debris. It knocked out all the lights, plunging the rig into darkness.
Anthony Gervasio, the Bankston's engineer, was in the engine room when he heard what sounded like a "blown tire, times 100," and rushed upstairs to investigate. He saw the mud. He saw the Horizon go dark. "Oh," he said to himself, and before he could get to "crap, that's not good," the second explosion hit, much bigger than the first.
"Rig just blew up, we gotta go!" screamed deckhand Louis Langlois, a 340-pound Mutt to Gervasio's 160-pound Jeff. "Disconnect the hose!" They took off, dashing the length of the cargo deck through a maze of crates and spools, slipping and sliding on an inch of mud. Gervasio, an all-state defensive back during his high school football days in Rhode Island, got there first; he slapped a wrench on the joint and pulled.
Captain Landry was still in the wheelhouse. He had just given the order to disconnect the hose, but now he wasn't sure he could wait. Forty feet from where he stood, the rig was in full flame. Barrels filled with volatile compounds were rocketing into the sky like missiles. He considered gunning the throttle and going -- just ripping the hose. He knew he had enough horsepower. But not until he heard from his guys. "I already sent 'em out there," he was thinking. "I don't want to pinch 'em in a hose."
Then he saw them: Gervasio and Langlois at the back of the boat, arms raised, thumbs up, and he saw the hose in the water, and now he was pulling back, finally putting distance between himself and the inferno. With the fire growing and the Bankston's mercury-vapor lamps full on, the scene was strangely bright, surreal, all lit up like a movie set.
Nevertheless, when the first flash of reflective material cut through Landry's line of sight, he told himself: "That can't be!"
He looked at Erickson, who was looking at him. Another flash. People are jumping, they both realized. Horizon crew members were abandoning ship -- leaping from the main deck, plummeting 70 feet into the sea.
At 10:04 p.m., Landry banged out an e-mail to the BP control room in Houston: "Horizon is on FIRE Well Blowout send out help!!!!!!!"
The giant rig would burn for two days, listing more and more until finally it tipped and sank, snapping the mile-long pipe that ran between the derrick on the surface and the wellhead at the bottom of the sea and unleashing a red-brown gusher of Middle Miocene sludge. Some 206 million gallons of oil would pour into the gulf before BP finally stanched the flow.
Today the Macondo well, named for a cursed town in a Gabriel García Márquez novel, is sealed and abandoned. It's a graveyard for 11 men, a dump for what remains of the Deepwater Horizon, and a haunting symbol of excessive faith in the safety of deepwater drilling. It's also an enduring mystery.
It's not easy to blow up an offshore oil rig. It requires an astonishing collection of failures big and small, human and mechanical, by individuals and by organizations. In the industrial-accident investigation business, the classic metaphor is Swiss cheese. Each mistake is a hole in a single slice, and it's only when the errors stack up, with the holes aligning perfectly, that a disaster results.
Experts will debate the precise cause for years. Already the explosion at Macondo qualifies as one of the most intensely dissected industrial accidents in U.S. history, with at least nine separate investigations by government agencies, the National Academy of Engineering, three of the corporations involved, and a special presidential commission, which issued a 380-page report on Jan. 11. The Justice Department, which is weighing criminal charges, has already brought a civil case against BP, rig operator Transocean, and other companies. Plaintiffs lawyers, representing everyone from the families of the Horizon's dead to half-empty motels in Florida, have filed more than 350 lawsuits. At stake are billions in fines and damages.
But knowing who's to blame isn't nearly so important as understanding why this catastrophe happened -- and making sure it never happens again. A Fortune investigation reveals that the disaster was a long time in the making, the product of a corporate culture that venerated risk taking even as years of merger-driven growth and successive rounds of cost cutting consumed its leaders' focus.
In the decade before the Deepwater Horizon, BP (BP) had a history of serious accidents. Each time its CEO vowed to avoid a future disaster. In 2000, after a string of fires and equipment failures, CEO John Browne announced plans to "renew our commitment to safety." In 2005, after a horrific explosion killed 15 people at BP's Texas City refinery, he swore there'd be "no stone left unturned" to investigate what happened and correct any safety issues. In 2007, after being named Browne's successor in the aftermath of more problems, Tony Hayward promised to focus "like a laser" on safety -- only to oversee the worst oil spill in history.
Fortune's investigation shows how Hayward, a fast-rising geologist once known as "Teflon Tony," fell tragically short of his goal. Despite efforts to change, BP never corrected the underlying weakness in its safety approach, which allowed earlier calamities, such as the Texas City refinery explosion. Perhaps the most crucial culprit: an emphasis on personal safety (such as reducing slips and falls) rather than process safety (avoiding a deadly explosion). That might seem like a semantic distinction at first glance, but it had profound consequences.
Consider this: BP had strict guidelines barring employees from carrying a cup of coffee without a lid -- but no standard procedure for how to conduct a "negative-pressure test," a critical last step in avoiding a well blowout. If done properly, that test might have saved the Deepwater Horizon.
Indeed, BP executives warned of serious process-safety "gaps" in the Gulf of Mexico, Fortune has learned, in a never-before-reported strategy document dated December 2008. "It's become apparent," the BP document stated, "that process-safety major hazards and risks are not fully understood by engineering or line operating personnel. Insufficient awareness is leading to missed signals that precede incidents and response after incidents, both of which increases the potential for and severity of process-safety related incidents." The document called for stronger "major hazard awareness."
But BP failed. "They just did safety wrong," says Nancy Leveson, an industrial safety expert at MIT who served on a panel that investigated BP's safety practices after its refinery explosion; she has since taught safety classes to BP executives and also advised the presidential panel that investigated the Deepwater Horizon disaster. "They were producing a lot of standards," she says, "but many were not very good, and many were irrelevant." Leveson says that she was so troubled by BP's approach that in January 2010 she told colleagues, "They are an accident waiting to happen."
The world of the Horizon
Standing on the steel deck of the Deepwater Horizon, it was easy to forget that it was a ship -- even in stormy seas, its computerized positioning system kept it almost motionless. The Horizon was many things: a drilling rig, of course, a heliport, and a floating hotel. But fundamentally it was a very big ship.
Nine years old when it sank, the Horizon was born halfway around the world, at a Hyundai shipyard in South Korea. At the time it was state-of-the-art. The rig cost R&B Falcon, its original owner, $365 million and featured four squat legs standing on a pair of submerged pontoons. This underbody supported a 28,000-ton "drilling package." Raising that massive pile of steel onto the rig's legs -- a feat performed at the Korean shipyard by an Italian company, Fagioli -- established a world record for the heaviest object ever lifted.>
Compared with its peers, the Horizon was a floating palace. With accommodations for 160, it had a movie room, a gym, a sauna, a cave for smokers, even maid service. Its berths came complete with carpeting, in-room Internet, and satellite TV. The mess hall was open 24 hours. Not a bad place to be on Super Bowl Sunday, when they'd all gather to watch the game and the cook would put out nachos and hot wings.
On its maiden voyage from Korea, the Horizon sailed southwest at three to four knots -- the equivalent of a slow walk -- put in for a crew change at Cape Town in South Africa, then pushed northwest across the Atlantic, finally arriving in July 2001 at Freeport, Texas, on the Gulf of Mexico. Once the Horizon left Freeport, it would never again return to port, nor would it ever leave the gulf. By then R&B Falcon was no more, having been swallowed by the Horizon's new owner, a deepwater pioneer called Transocean (RIG), with nominal headquarters in Switzerland. And Vastar Resources, the Houston-based exploration company that had contracted to use the Horizon? It had been bought by BP.
The lightning rod
"I've got lots of time on my hands," says Tony Hayward, offering a bit of gallows humor. It's Sept. 29 -- a rainy morning in London, and two days before the CEO turns over the reins to his deputy, Bob Dudley. Hayward meets a Fortune writer at BP's starkly contemporary headquarters on St. James's Square before leading the way, beneath a shared umbrella, to a sidewalk café a few blocks away, on Haymarket Street. As double-decker buses roar by, he sits down with a bottle of San Benedetto water for the first in a series of in-depth conversations with Fortune.
The BP spill, he maintains, has turned out to be much less dire than initially believed. "The story of the environmental apocalypse is being rewritten as we speak," Hayward says. "The last thing the media needed was a success story. What the media wanted was a holy disaster. One of my biggest mistakes was that I allowed myself to become the lightning rod for hatred and anger." Face to face, Tony Hayward is a bit of a surprise: personable, direct, wryly self-mocking, sarcastic, and sometimes profane. He's also the Hayward that Americans have come to know and scorn: wounded, defensive, and tone-deaf.
"I genuinely feel this could have happened to anyone," Hayward continues. "This isn't BP. It's an industry accident." As he sees it, BP's reaction constituted "the most extraordinary corporate response in history." He defends his safety record, asserting that "BP has enormously more focus on process safety than it used to," though the company is still "on its journey." Hayward concedes that some of his comments about the environmental impacts of the spill, "taken out of context," were "deeply unhelpful," but quickly adds, "I don't want to sound defensive, but much of it's turning out to be true."
For now Hayward is happy to be back in England, where he says his countrymen have been supportive, buying him drinks. Not so in the U.S. Before the Macondo well was capped, Hayward, who'd been staying with the expatriate BP team at Houston's four-star Hotel Sorella, had to take refuge in an undisclosed location -- only his driver knew where he spent the night. "I was really being followed by the paparazzi," he says. "Not only had I become the most hated and clueless man in America, I'd become the most hunted."
The geologist and the tray men
When he launched his career in the oil business, Anthony Bryan Hayward seemed destined for a life in peaceful obscurity. He was completing his Ph.D. in geology at the University of Edinburgh with a dissertation titled "Tertiary Ophiolite-Related Sedimentation in S.W. Turkey." The 420-page paper reconstructs the formation of an ancient sedimentary basin -- a hot topic for someone interested in hunting for hydrocarbons. (The future CEO's thesis quoted lyrics from Bob Dylan's protest anthem "Blowin' in the Wind," including the line, "How many years can a mountain exist before it's washed to the sea?")
The eldest of seven children, Hayward was raised in the industrial town of Slough, 20 miles west of London. His dad was a midlevel manager at a small textile company, his mother an administrator in the government health service. After getting his Ph.D., Hayward signed an employment contract with Mobil Oil, then reneged after British Petroleum's chief geologist recruited him personally. And he broke off an engagement in favor of his future wife, Maureen, whom he'd met at the University of Edinburgh.
When Hayward joined BP in 1982, the company was at a critical moment. Since its founding in 1909 as the Anglo-Persian Oil Co., it had operated like an arm of the British Empire. The government became its biggest shareholder, and the Middle East provided virtually all its oil. But by the time Hayward signed on, the Arab countries had given BP the boot. The days of easy access to bottomless reserves were over.
BP found two new sources of crude to replace a fraction of what it had lost, but in far riskier environments: Alaska's Prudhoe Bay and the North Sea. Hayward was dispatched to a rig exploring the Miller Field, 165 miles off the Scottish coast, in 330 feet of water. He reveled in the adventure of offshore exploration -- and he enjoyed a healthy dose of good luck. In interviews years later he giddily recalled the thrill of striking oil at 4 a.m. on Christmas Day, just months after he'd started work.
Hayward happily spent his first eight years as a globetrotting field geologist, working in such far-flung locales as Mongolia and Papua New Guinea. BP prided itself on finding oil -- the British explorer spirit ran deep. But it kept losing ground. Competitors derided it as a "two-pipeline company," too dependent on Alaska and the North Sea.
BP was also hampered by a starched, rigidly hierarchical management culture dominated by company lifers. Each headquarters employee above a certain rank used to receive his own towel and bar of soap on Monday morning. Senior employees, known as "tray men," got their afternoon tea and biscuits on a tray of their own.
Bureaucracy ruled and operating costs were sky-high. As a result BP's profit per employee was half that of Exxon (XOM).
All this would be left behind with the ascent of Edmund John Philip Browne, later known as Lord Browne of Madingley. Modern oil's first celebrity CEO, Browne was a brilliant and charismatic man, with degrees in physics and business from Cambridge and Stanford. Browne would define the future of BP, the entire oil industry -- and Tony Hayward.
BP goes deep
In 1989, after being placed in charge of BP's flagship exploration and production business, John Browne assigned the company's top 10 geologists to cook up a fresh strategy for finding oil. Hayward, then 32, was among them. They convened at a resort hotel outside London and emerged several days later with a plan.
Given its size, BP needed "elephants" -- monster fields that could make a big difference in its bottom line. To find them, the geologists concluded, it should drill in new places, where BP's diplomatic skill, ingenuity, and daring gave it an edge -- basins where few had gone before because they were either politically inaccessible or technologically difficult. The Caspian Sea was one such target; West Africa and Latin America were two others. Perhaps the most exciting prospect was deepwater -- especially in the Gulf of Mexico.
For the first time, technology permitted drilling below more than a mile of water, a hostile environment of total darkness, crushing pressures, and brutal temperatures. Sea-floor operations were carried out with remotely operated vehicles, known as ROVs -- unmanned subs with stubby arms that could connect sections of drill pipe or wield tools to cut through steel. Advances in seismic imaging made it possible to locate hidden oil deposits. Drilling in deepwater was risky and expensive; a single well could cost more than $100 million. But the payoffs were huge. The gulf had particular appeal: The U.S. offered a stable democracy, low taxes, and minimal regulation, as well as nearby refineries and an insatiable market.
BP rushed in, acquiring offshore leases, becoming the biggest player there. Over time, the deepwater gulf emerged as the engine of new U.S. oil production. All this was encouraged by American politicians, who cut taxes for offshore drilling and opened up new swaths of ocean for exploration. Meanwhile the government's Minerals Management Service -- the drillers' chief regulator -- operated like a promotional arm of the industry. Just about everybody, it seemed, liked offshore drilling.
The Sun King and Teflon Tony
John Browne's legacy as CEO would be enormous -- for better and worse. After taking over in 1995 he imposed a tough bottom-line mentality, ever focused on cutting costs. He delegated operating authority to his managers, who presided over their fiefdoms like mini-CEOs. But he made each of the top 250 sign an annual "performance contract" that set out aggressive profit and productivity targets. Browne then held them personally accountable.
Certain that BP needed to grow to survive, Browne built the company into a "super-major" through a whirlwind of dealmaking. He merged BP with Amoco and bought ARCO, Vastar, Burmah Castrol, and Veba. Browne negotiated moves into China and Azerbaijan and formed a lucrative joint venture in Russia called TNK-BP. By the time he was done BP had more than doubled its annual revenues (only Exxon and Shell (RDSA) were larger) and become the largest oil producer in the U.S. Its profits and stock price multiplied. Rivals rushed to keep up. Exxon merged with Mobil; Conoco (COP) and Phillips combined; Chevron (CVX) gobbled up Texaco.
Browne also transformed BP's image, recasting it as the first "green" oil company. In 1997 he broke with the industry by acknowledging the evidence of global warming. Browne invested billions in alternative fuels and launched a $200 million rebranding campaign. British Petroleum legally renamed itself BP and adopted an evocative (if vague) slogan: "Beyond petroleum." BP's eco-aspirations would later be derided as hypocrisy. But at the time it was magic, and the CEO was showered with honors: an Earth Day award from the United Nations, 18 honorary degrees, acclaim as Britain's "most admired" CEO. Queen Elizabeth knighted him. Dapper and cerebral, Browne collected Mapplethorpe photographs, loved opera, and attended state dinners with his widowed mother, who lived with him in London. He reveled in the accolades. The Financial Times christened him the "Sun King."
If Browne was king, then Hayward was a favored prince. In 1990, Browne plucked him from the geologist ranks and anointed him as one of his two executive assistants -- known within the company as "Turtles," after the comic book Teenage Mutant Ninja Turtles. Turtles did everything from carrying Browne's bags on overseas trips to sitting in on BP board meetings. Those who impressed moved on to the fast track. Hayward would later insist that until he'd become a Turtle, he'd never wanted to be more than a geologist -- that working with Browne "opened my eyes to the world of business." But, in an interview with Fortune, Browne says the glint of ambition was evident: "He never struck me as someone being dragged to the throne, as it were, in the papal sense."
In 1992, Hayward began a string of big assignments in the field, leapfrogging more experienced colleagues. Browne named him exploration manager in Colombia, one of the company's prime prospects, then, three years later, president of BP's Venezuela business. Hayward was a well-liked manager: approachable, direct, and decisive.
But both of those ventures were disappointments, and former colleagues say Hayward had a tendency to paint a rosy picture of how much oil would be found. Says Browne: "He biased things to the positive. That tends to be a characteristic if you come from the pure exploration side in the oil and gas business." (Hayward acknowledges BP found less oil than expected in Colombia, but asserts it turned out to be a "fantastic" investment. He blames political impediments for stymieing BP in Venezuela.)
Hayward's setbacks in South America did nothing to slow his ascent, prompting some colleagues to dub him "Teflon Tony." The promotions kept coming. He would have seven jobs in 11 years. In 2000, at 43, Hayward was named BP's treasurer -- not exactly his field of expertise. But it was a post Browne himself had held, and it prepared him for even greater things. In 2003, Hayward joined the BP board and was named CEO of exploration and production, the company's No. 2 job. Says former chief geologist Richard Hubbard: "John had chosen Tony as his heir apparent."
In truth, Lord Browne didn't want to hand over his job to anyone -- at least not anytime soon. The company had announced he would retire in December 2008, at 60. But Browne wanted to pull off one last spectacular deal to make BP the world's largest oil company. He began floating the idea of merging with Shell -- only to be shot down by the company's board. Says then-chairman Peter Sutherland, who chairs Goldman Sachs International: "It would have been an absolute disaster."
As some directors saw it, BP hadn't yet digested the businesses it had previously acquired. They worried that Browne had moved too harshly to cut costs and bank synergies from those deals. "There was a general feeling that they may have been running a bit faster than they should have," says a former director. John Mogford, one of Browne's key lieutenants, says, "John had taken BP so far he didn't look downwards or look back. He was constantly looking for the next thing. The next thing always, by definition, had to be bigger than the last thing."
"An intolerable risk situation"
For years, BP had prepared for catastrophe. Around the clock, one senior executive was designated to take the call alerting London to an emergency somewhere. Consultants drilled management on how to respond, staging disaster scenarios that would last two or three days. One had an oil tanker running aground in the Strait of Malacca. In another BP faced a catastrophic offshore blowout. As the choreographed episode unfolded, actors would show up on the doorstep of executives' homes, assuming the role of baying reporters.
On March 23, 2005, BP's crisis signal went out for real: Texas City was on fire. Located near Galveston, Texas City was BP's biggest -- and most troubled -- oil refinery. A tank cooking flammable gasoline additives had boiled over, generating a vapor cloud that ignited with the backfire of a pickup truck. The blast killed 15 people and injured 180. It was America's worst industrial accident in a decade.
BP had inherited the 71-year-old refinery from Amoco, which had long neglected maintenance and safety upgrades. Yet after BP took it over in 1999, London demanded a 25% budget cut. Chemical releases and minor fires were routine. In the three decades before the blast, Texas City had 23 fatalities -- three in 2004 alone. And BP management had plenty of notice: Safety audits and reports warned that the plant was "in complete decline," presented "an intolerable risk situation," and posed potential for "a major site accident." A month before the explosion the plant's manager showed BP's global refining chief slides of men who had been killed.
For years BP had touted its safety record, pointing to a steep decline in the number of slips, falls, and vehicle accidents that generate days away from work, a statistic that is closely followed by both the industry and its regulators. Under Browne, BP had established a dizzying array of rules that burnished this record, including prohibitions on driving while speaking on a cellphone, walking down a staircase without holding a handrail, and carrying a cup of coffee around without a lid. Bonuses for BP executives included a component tied to these personal-injury metrics. Browne says BP cut its injury rate dramatically after the Amoco merger. "The tragedy of Texas City is that it wasn't good enough," he says.
But BP's personal-safety achievements masked failures in assuring process safety. In the energy business, process safety generally comes down to a single issue: keeping hydrocarbons contained inside a steel pipe or tank. Disasters don't happen because someone drops a pipe on his foot or bumps his head. They result from flawed ways of doing business that permit risks to accumulate.
At the behest of the U.S. Chemical Safety Board, BP appointed a blue-ribbon panel chaired by former Secretary of State James Baker to study Texas City and its four other American refineries. The group found "a lack of operating discipline, toleration of serious deviations from safe operating practices, and apparent complacency toward serious process-safety risks." It concluded that Browne's "decentralized management system and entrepreneurial culture" had "delegated" safety issues. BP's global safety chief, for example, reported to a Browne deputy. In its own 341-page report, the Chemical Safety Board identified another major factor: corporate cost cutting.
In the explosion's aftermath Browne pledged to prevent another catastrophe. But Texas City wasn't the only major failure on his watch. Just four months later Thunder Horse, BP's giant new production platform in the Gulf of Mexico, nearly sank during a hurricane. In their rush to finish the $1 billion platform, workers had installed a valve backwards, allowing the ballast tanks to flood. Inspections revealed other shoddy work. Repairs costing hundreds of millions would keep Thunder Horse out of commission for three years.
Then, in March 2006, corrosion in BP's Prudhoe Bay pipelines caused a 267,000-gallon oil leak -- the worst spill ever on Alaska's North Slope. This accident resulted from the company's failure to properly test and clean miles of aging pipe. (BP ultimately paid $373 million in a combined settlement to resolve criminal and civil charges stemming from the pipeline leaks, the Texas City explosion, and unrelated charges of manipulating the propane market. The company pleaded guilty to a felony and a misdemeanor, signed a deferred-adjudication agreement, and agreed to three years of probation. It would pay another $2.1 billion to resolve 4,000 Texas City personal-injury suits.)
As U.S. criticism grew, Browne brought in a well-connected American with a reassuring accent to provide political cover. Bob Malone, the new chairman of BP America, was a native of rural Texas and a BP veteran. Browne came to describe him as "my human shield." With Malone on point, BP successfully pursued what had become its standard post-disaster approach: acknowledge mistakes and open its checkbook -- but steadfastly deny that BP had a systemic problem. Browne gave Malone unilateral authority to shut down any U.S. operation at the hint of a safety problem.
Malone's authority was tested in August 2006, when word arrived of yet more corrosion problems in BP's Alaska pipelines. Malone closed half of Prudhoe Bay -- America's single biggest oilfield -- to replace miles of decaying pipe. Hayward, who had authority over oilfield operations as exploration chief, was sailing at the time and couldn't be reached. When he got back he was furious that he hadn't been consulted on such a drastic decision. But Browne backed Malone.
Having clung to his job through disasters that cost lives and billions of dollars, the Sun King would lose it for a comparatively trivial mistake: He lied during a court battle in the hope of blocking a British tabloid from publishing an exposé about his personal life. Browne's former lover, 27-year-old Jeff Chevalier, had sold the paper his story. In the closed-door legal fight, conducted under strict English press laws, Browne falsely described how the relationship had begun, claiming they had met while jogging in a London park; it had actually been through Suited and Booted, an escort service. This deceit prompted a judge to clear the story for publication in May 2007 -- and led the BP board to accept Browne's immediate resignation.
Although the scandal accelerated Browne's departure, the board had already announced his successor. Says then-chairman Sutherland: "Tony Hayward was a slam-dunk."
Focusing on safety
BP's new CEO immediately made it clear that he'd be a less regal figure than his predecessor. Hayward had zero interest in a high profile. During his first 35 months as CEO -- until April 2010, that is -- Hayward gave just a handful of interviews. He didn't relish dealing with the press, and he'd never made a point of getting good at it -- a shortcoming that would soon become apparent. Hayward also didn't see the value in Browne's intense political and social involvements. He cut BP's government-relations staff and publicly complained that the company employed "too many people that were working to save the world." To deliver the message that BP was an operating company, "not an investment bank," Hayward replaced the modern artwork Browne had installed at headquarters with photos of workers in coveralls at refineries and on rigs.
Browne had transformed BP through his frenetic dealmaking; Hayward would concentrate on properly managing it. He promised the board a new mantra: "silent running."
The first step -- indeed, Hayward's mandate from the board -- was a commitment to safety. That, of course, meant avoiding any more disasters. Months after taking over, Hayward made a second pledge: to boost BP's "dreadful" bottom line. He promised to close an $8 billion "profit gap" with Shell. That, of course, meant cutting budgets.
Hayward was aware of the tension between safety, which is costly, and profits. A month before he was named CEO he declared, in a message to employees, that BP management had made a "virtue out of doing more for less." He explained, "The mantra of 'more for less' says that we can get 100% of the task completed with 90% of the resources -- which in some cases is okay and might work, but it needs to be deployed with great judgment and wisdom. When it isn't, you run into trouble."
As the new CEO saw it, he could juggle the conflicting imperatives. Hayward believed the business he'd inherited was inefficient and overly complex, and he could save billions -- and make the company run better -- by cutting out layers of bureaucracy. In late 2007 he announced a major reorganization, which would include the elimination of more than 5,000 jobs. At the same time he insisted he was beefing up BP's front-line technical expertise.
Hayward became involved with safety issues in ways that Browne never had. He had previously hired a safety coach to teach him how to ask tough questions during work site tours. As CEO he personally chaired BP's risk committee. Hayward also dispatched groups of executives to the newly established BP "Operations Academy," a program at MIT where they spent three two-week sessions learning to better manage their businesses and deal with risk. It included a case study on what went wrong at Texas City.
The process-safety lessons taught there are universal: Critical procedures should be formalized and carried out with rigor; it's essential to maintain multiple safeguards against an accident; it is dangerous to change operating plans on the fly; anomalies need to be clearly resolved; small incidents are warning signs that conditions are ripe for a disaster; and a long stretch without a serious accident breeds complacency -- people forget to be afraid.
The centerpiece of Hayward's new approach was a sweeping plan called the Operating Management System, known as OMS. Even today Hayward calls OMS "my most long-standing legacy." On paper it had much to recommend it. In much the same way as Exxon successfully did after the Valdez spill, OMS aimed to integrate safety into every aspect of operations, theoretically making each employee responsible for safety. Fully implementing this system was a massive undertaking that would take years. Hayward viewed it as a structure that would identify and correct flaws in the way BP did business companywide and, ultimately, prevent disasters.
Indeed, it was the OMS system that led BP to identify grave deficiencies in its Gulf of Mexico operations. Its December 2008 strategic plan identified six "priority gaps." The No 1. priority: mitigating serious risk. "There are many risk processes in action," the plan stated, "but they have become too complicated and cumbersome to effectively manage." One chart pointed out that a failure to address the issues could result in "multiple injuries/fatalities," "major environmental damage," "catastrophic loss of the facility," and "damage to corporate reputation." In January 2010, BP's gulf team completed a plan that was supposed to tackle those problems.
But just such a "catastrophic loss," of course, came only three months later -- in part because OMS had flaws of its own. It did a good job of integrating process safety into the planning stage, according to a presidential commission investigator, but it lacked effective procedures for guiding decisions during operations.
Perhaps the best proof that OMS wasn't solving BP's process-safety problems: The company continued to run into trouble -- precisely where it was under the most scrutiny and had the most incentive to improve. In 2009 the federal Occupational Safety and Health Administration (OSHA) proposed a record fine against BP for "failure to abate" previously cited hazards at Texas City. OSHA also cited BP for hundreds of new "willful" safety violations. (BP totaled 829 such refinery violations from June 2007 to February 2010, according to the Center for Public Integrity. The rest of the industry combined had 33.) There had been three more deaths at Texas City since the 2005 explosion.
The chairman of the federal Chemical Safety Board called the record OSHA fine evidence that BP had "yet to achieve an effective safety culture." He noted that the company had failed to comply with a "particularly important" CSB recommendation to appoint a process-safety expert to its board.
The world didn't seem to care. By 2010, Texas City and the Thunder Horse platform were back in full production, and Hayward's cost cuts had taken hold. The company had become more profitable than Shell, and its dividend and stock were rising. Investors and analysts loved Hayward. And by the traditional metrics of personal safety -- worker injuries -- BP was headed toward its best year ever. "We continue to show our ability to take on and manage risk, doing the difficult things that others either can't do or choose not to do," Hayward declared in February in BP's annual report.
It had been two decades since the last big oil spill in the Gulf of Mexico. President Obama judged operations so safe that on April 2, 2010, he announced plans to lift the 26-year ban on drilling off the East Coast. "It turns out," he declared, "that oil rigs today generally don't cause spills."
April 20 "What is that?"
Tuesday, April 20, was crew-change day. Among those converging on the Deepwater Horizon was Curt Kuchta, one of the rig's captains. He flew in from his Maryland home the previous night, slept in a hotel near the New Orleans airport, woke up at 7 a.m. to catch the crew bus, and boarded a helicopter in Houma, La., for the one-hour flight to the rig. A long commute, to be sure, but not unique. That's a big part of the appeal, for some, of 21 days on, 21 days off. You get to live wherever, as long as you're willing to work wherever.
No sooner had Kuchta landed on the rig and assumed command than he was back up on the helipad to greet an arriving party of VIPs. Two executives from BP and two from Transocean were out for an overnight visit. A recent audit of the Horizon's "safety culture" had suggested that management needed to do a better job bridging the "disconnect between the top boys and the rig." The VIPs had also come to recognize a remarkable achievement: seven years without a lost-time incident on the Deepwater Horizon.
As it happens, nothing about the Deepwater Horizon's current project, Macondo No. 1, had gone smoothly. The Horizon wasn't even supposed to drill this well. Transocean's Marianas rig was knocked out of commission in November 2009 by Hurricane Ida. So the Horizon took over in early 2010 -- and quickly encountered problems of its own. On March 8, two miles below the ocean floor, the drill pipe got stuck in the rock, forcing BP to back up and drill around it. Throughout the spring, there were numerous "lost circulation" episodes, which occur when drilling mud seeps through cracks in the wellbore, and "kicks," which signal unexpected gas pressure entering the well. All costly, all time-consuming, all potentially dangerous. Once viewed as a run-of-the-mill project, Macondo had fallen 45 days behind schedule and $58 million over budget. Some of the crew had taken to calling it "the well from hell."
Even as Kuchta led the VIPs around the rig, the metaphoric Swiss cheese slices -- those failures that, while tolerable individually, are potentially cataclysmic when aligned -- were accumulating. The final well design called for 21 centralizers to correctly position the casing (the carbon-steel lining inside the drill hole) so the cement could provide a good seal. BP didn't have that many centralizers on the rig and ordered more. But when they arrived, they appeared to be the wrong kind. Using too few, BP contractor Halliburton (HAL) warned, could result in a "severe gas flow problem." But facing delays and added costs, BP went with the six centralizers it had on hand. "Who cares," BP drilling engineer Brett Cocales wrote from Houston to a colleague aboard the Horizon. "It's done, end of story, will probably be fine."
Then another slice of Swiss cheese: Halliburton, whose late founder Erle Halliburton was memorialized in the book Genius With Cement, prepared a foamed mixture that failed multiple tests in Halliburton's own labs -- results that BP may never have seen. BP, for its part, never verified the cement was reliable.
Yet another slice: After the cementing work was done, BP elected not to conduct a planned test on it, which would have meant more delays. Experts from Schlumberger (SLB) who had flown out to the rig to conduct the test were sent home.
Now one critical task remained to identify any previously missed problems: the "negative-pressure test," designed to make sure no oil or gas was seeping into the well. The results would tell the crew whether it was safe to finish displacing heavy drilling mud inside the casing with lighter seawater, set the top cement plug, disconnect the drilling pipe, and move on -- a process known as temporary abandonment. Once that was accomplished, BP would send a production platform to begin drawing oil from the well.
The negative test almost didn't happen. Jimmy Harrell, Transocean's white-haired senior drilling officer -- a father figure to many of the men -- was surprised to see no mention of it in BP's daily work plan on April 19. That concerned him: A negative-pressure test is standard procedure. Normally Harrell would defer to BP. Although it had only a handful of people on the rig, BP was the final arbiter on all drilling decisions. But in this case, especially after all that had happened already, Harrell was unwilling to bend. The test went back on the schedule -- one of many last-minute changes. "There is no evidence," the presidential commission would later conclude, "that these changes went through any sort of formal risk assessment or management of change process." More Swiss cheese.
Around 5 p.m., Halliburton's Ryan Haire began the negative-pressure test. He opened a direct line into the drill pipe and bled off pressure. As the pressure dropped, fluid began rising in the well, collecting in twin 10-barrel measuring tanks. Some flow was to be expected, but not this much. Before long, Haire called the drilling floor: "My tanks are full," he said. "I'll have to shut the well in."
Once shut, the pressure in the well began to climb again. Both the pressure increase and the rising fluids clearly indicated that somewhere hydrocarbons were invading the well. The crew tried the test twice more and got similar results. Up on the drilling floor, the decision-makers were puzzled. BP (unlike, say, Exxon Mobil) had no established procedure for conducting this test -- and none for interpreting the results. One veteran driller offered a convoluted explanation, suggesting that drilling mud was exerting pressure on a valve in the blowout preventer, transferring pressure to the drill pipe -- something he referred to as the "bladder effect." A discussion ensued. The explanation -- which investigators would later dismiss as impossible -- was accepted. Nobody bothered to consult with safety experts on shore.
BP's Donald Vidrine ordered the crew to perform the test yet again, this time on a side channel into the drill pipe called a "kill line." In theory, since the kill line and drill pipe are parts of a closed system, tests on each line should generate identical results. But this time the well passed the test: No fluid and no pressure buildup. (Investigators would later theorize that the kill line was clogged.) Deciding that one successful test in the kill line was more telling than three failed tests in the drill pipe, the BP men on board gave the final go-ahead: The well could be plugged.
Night was falling. In a meeting room below decks the VIPs congratulated the crew on its spotless seven-year safety record. They discussed new, more ambitious goals for 2010.
Shortly after 9 p.m. the VIPs adjourned and made their way to the bridge. It was an impressive place, especially after dark, all glowing screens and blinking lights. They ended up at the dynamic positioning simulator, a training device that played like a videogame, designed to mimic extreme conditions that could knock the rig off the well. They were having fun. But the game was about to end.
Later, analysis of real-time data would pinpoint early signs of a pressure "imbalance" deep in the well at 6:52 p.m. Meaning that for the past couple of hours -- slowly at first, gradually growing in force and velocity -- hydrocarbons had been surging toward the surface. Yet the crew members in charge of monitoring the well failed to detect the problem.
The first signal on the bridge that something was amiss was a sudden, high-frequency vibration. Everybody felt it. "What is that?" asked Captain Kuchta.
April 20 "Fire! Fire! Fire!"
Mike Williams, the Horizon's chief electronics technician, was on the phone with his wife when he heard what he would later describe as "a hissing noise and a thump." He told her he had to hang up.
Ship's engine No. 3 began revving uncontrollably. Light bulbs popped. Computer monitors shattered. The rig went dark. The first explosion blew Williams clear across the room. The second knocked him another 35 feet. Blinded by blood from a gash in his head, gagging on carbon dioxide, and dragging an injured leg, he made his way to the bridge.
Leo Lindner, a former English professor turned drilling fluid specialist (the money was better), was asleep when the first explosion occurred. By the time the second one hit, he was out of bed, standing barefoot in his skivvies, trying to get his bearings. The air was thick with smoke. That's odd, Lindner thought: He could see his buddy, Ryan Haire, there on the other side of what used to be a wall. He heard Yancy Keplinger on the ship's intercom, yelling "Fire! Fire! Fire! This is not a drill!" He reached for some clothes. "I thought I should die with some pants on," he later told Fortune.
Crew members gathered at the two forward lifeboats (the two in the rear were blocked by flames). Muster leaders with clipboards checked off names, trying to get an accurate count, but everyone could see it was hopeless: Some crew members had already jumped. After what seemed like an interminable delay, both boats launched, leaving a handful of people behind. For them, the only remaining option, short of jumping, was an inflatable life raft.
Toolpusher Wyman Wheeler, gravely injured and screaming in pain, arrived on a gurney. But Wheeler's helpers couldn't load the stretcher onto the raft, now dangling over the edge of the deck. Flames were approaching. The heat was almost unbearable. Little explosions were erupting all around them. Finally, chief engineer Steve Bertone managed to shove the gurney into the life raft and follow.
Captain Kuchta didn't board the raft. He jumped. So did Williams. "There was so much heat coming up, I thought for sure the life raft was going to pop or melt," Williams later told investigators, "and the people inside were going to cook."
It was a miracle not yet known to those still desperately trying to escape that there would be no more dying that night. That part was over. Wheeler, like all the injured, would survive. But 10 of their fellow crew members had been consumed by flames on the drilling floor. Another had fallen from the starboard crane. He was last seen lying face down on the deck in a pool of blood by a co-worker who checked for a pulse, detected none, and fled.
April 20 The sea is burning
Louis Langlois and Anthony Gervasio, the Mutt-and-Jeff team on the Damon Bankston, saw the jumpers. Seconds after receiving the order from Captain Landry to go, they were in the Bankston's rescue boat, motoring toward the burning rig.
On the first sweep Langlois and Gervasio delivered four jumpers to the Bankston, then headed out again, searching for more. The Horizon's forward lifeboats were descending. By now the sea itself was burning.
High overhead, hanging from the main deck of the Horizon like a big orange spider on a tendril of silk, was the raft, cocked at a crazy angle. As it came down, Horizon crew members were splashing into the sea beside it.
Langlois and Gervasio pulled five people out of the water, including Williams, still bleeding heavily. The life raft, meanwhile, was sitting right up under the edge of the rig, and it wasn't moving. Overhead a two-inch gas overflow pipe emptied beneath the main deck. It was spitting flame like an upside-down torch, laying down a puddle of fire on the water and roaring so loudly that the rescuers, five feet apart, could barely hear each other's shouts.
They nudged the rescue craft in closer. Seven or eight people were in the water, trying to pull the raft away from the flames. Langlois tossed a line to the raft, and as soon as it was secure, Gervasio threw his boat into reverse, eager to get away.
But the raft wouldn't budge. The painter, a white rope, was still tied to the rig. It had a weak link -- a node that's supposed to pop under 10 pounds of force -- but for some reason it wasn't popping. Gervasio gunned the throttle. The painter grew taut, but didn't break.
Luckily, Langlois had a knife, a six-inch folding Buck. He passed it to Kuchta, who swam back and cut the painter, severing the last connection to the burning rig.
The scene aboard the Bankston was "controlled chaos," as Captain Landry would later describe it. His crew of 12 was hard at work: handing out boots, socks, blue jeans, and cigarettes, serving up rice and beans and hamburgers, tending to the injured. There was a logjam at the top of the Bankston's rope ladder. As each stunned Horizon crew member clambered aboard, he turned and loitered, peering over the side to see who was coming up next -- who had made it and who had not.
The first headcount came up 15 short. Then 11, then 11 again, and that's where it settled. Officially the search and rescue mission continued for four days. But none among the dazed and disbelieving survivors standing in clusters on the Bankston's main deck -- some of them still in their underwear, some crying, most simply staring fixedly across the water at the howling pyre they'd just escaped -- had any illusions about the fate of their missing comrades. "I don't know what I'm gonna tell his wife," one of them murmured.
The first Coast Guard helicopter arrived at 11:15 p.m., screaming out of the north at 150 miles per hour, to begin carrying off the seriously injured.
Not until 8:13 the following morning did the Bankston depart the scene. Normally it's a 12- to 14-hour trip to Port Fourchon. But the Bankston had to make a couple of out-of-the-way stops at other rigs: first to take on two medics and drop off four Horizon crew members, who would try to activate the rig's blowout preventer remotely; and second to board a contingent of company lawyers (for the Bankston's owner, Tidewater Marine) and government investigators who had helicoptered out from the mainland to begin taking statements.
At 1:27 a.m. on Thursday, April 22, the Bankston finally arrived at C-port, slip No. 1, in Port Fourchon. Waiting at the dock was a line of Porta Potties. It had been 27 hours since the explosion -- not too late to test for alcohol and drugs. Also waiting were white buses that would carry them all to a hotel in Kenner, 90 minutes north. There they were released to their loved ones -- and a world waiting to hear what had happened.
"I'd like my life back."
"We've got a big problem in the Gulf of Mexico." Everyone at BP remembers how they got the news. For Tony Hayward, it arrived in a voicemail at 7:24 a.m. London time -- almost four hours after the Deepwater Horizon blew up -- from Andy Inglis, head of exploration and production. Hayward listened to it after returning from a five-mile run in Hyde Park.
BP's top executives gathered in a war room at their London headquarters, staring at CNN. The blazing rig looked like "a big Roman candle," Hayward recalls. Boats were pouring water onto its deck. "Christ," Hayward told Inglis, "if we keep going like this, the bloody thing's going to sink!"
Orders soon went out to the boats spraying the Horizon: They should lower their water cannons to the rig's legs. As long as the Horizon stayed afloat, the gusher of hydrocarbons remained contained, traveling up through the mile-long riser pipe and fueling the inferno atop the rig. BP and Transocean launched a desperate effort to trigger the blowout preventer and shut off the well before that changed.
All such efforts, of course, would fail. After burning for 36 hours, the Deepwater Horizon sank at 10:22 a.m. on April 22. Hayward arrived at BP's U.S. headquarters in Houston in time to get the bad news: Macondo No. 1 was gushing crude.
This was a problem for which BP and its CEO were utterly unprepared. No one had ever tried to seal a hemorrhaging well a mile underwater -- or wrestled with an environmental crisis in the hothouse of the 24-hour news cycle. In Houston, Hayward took charge of the company's response on both the operational and PR fronts.
Looking back at the 87 days it took to stop the flow of oil, it's hard to fault what BP actually did -- in struggling to cap the well, keep oil from reaching shore, clean the fouled beaches, and committing to pay the economically injured. Because BP held the Macondo lease, U.S. law required it to pay all cleanup costs. But Hayward never sought to hide behind a cap passed after the Exxon Valdez accident, limiting damages for oil spills to $75 million. Indeed, BP will pay far more, far more quickly, to far more people than the company would have ever had to pay in the U.S. civil court system. BP now projects its price tag for the disaster at more than $40 billion -- 10 times what Exxon spent in Alaska.
BP's public strategy, on the other hand, was its own disaster. It overshadowed BP's response, added billions to its tab, cost Hayward his job, and even jeopardized the oil giant's survival.
"What the hell did we do to deserve this?" Hayward asked colleagues shortly after the explosion. The comment perfectly captured his perspective: BP hadn't done anything wrong. Hayward downplayed the size and significance of the spill and minimized BP's role. "It wasn't our accident," he said, blaming both Transocean and the "unprecedented" failure of the rig's blowout preventer.
BP repeatedly raised expectations that it would soon end the crisis. A tipping point came five weeks in, when its "top kill/junk shot" failed -- after Hayward had predicted a 60% to 70% chance of success. Says a senior company executive, the message was clear: "Don't trust BP. They don't know what the fuck they're doing."
Hayward made matters worse, attaining infamy when he vented his own frustration. He'd been in the U.S. for weeks. He and his family had received death threats. His wife (who had joined a Facebook group called "Lay off Tony Hayward!") had undergone surgery while he was away. And he was spending much of his time leading tours of sludge-stained beaches for reporters, who demanded to know how he felt about destroying the livelihood of so many struggling Americans. "We're sorry," Hayward replied to the cameras in Venice, La. "We're sorry for the massive disruption it's caused to their lives." Then, sounding annoyed: "And you know, there's no one who wants this thing over more than I do. I'd like my life back."
By June the situation had mushroomed into a national rage. President Obama told NBC he was seeking advice on "whose ass to kick." Congress began drafting proposals to bar BP from U.S. waters. The company's stock dropped 48%, wiping out $91 billion in market value.
This was generating what BP's current CEO, Bob Dudley, describes as a "near-death" experience. BP, which funded its working capital needs with about $10 billion in short-term paper, found itself shut out of the overnight markets. Trading partners shunned the company. A liquidity crisis loomed. Hayward says he directed his financial team to shore up the business with fresh bank lines, to make BP "bulletproof." He adds: "If we hadn't dealt with it in a very draconian way, we would have had a big problem."
It was then, on June 16, that Hayward led a BP delegation summoned to the White House. What resulted was widely portrayed in the press as a corporate capitulation. BP would establish a $20 billion escrow fund to pay damage claims. To preserve cash, the company would suspend its quarterly dividend for the rest of 2010.
In truth, BP got what it desperately needed, starting with a limit on its damages outlay -- enormous, to be sure, but manageable for a company that had made $6 billion in the first quarter of 2010. Obama also promised to end his market-rattling assault, telling the world, "BP is a strong and viable company, and it is in all of our interests that it remain so." Says Hayward: "We needed political calmness. We needed to stop being attacked by the most powerful government in the world."
The next day Hayward appeared before a congressional subcommittee, where lawmakers took turns berating him. He then flew home for a break -- and a final PR disaster. Hayward was photographed in a yacht race off the Isle of Wight, sailing with his son in the spill-free English waters. Said White House Chief of Staff Rahm Emanuel mockingly: "He's got his life back."
"Systematic failures … in the entire industry"
BP finally stopped the leak on July 15 and permanently sealed Macondo by cementing it shut three weeks later. By this point, trust in BP had sunk so low that it had to spend an extra $2 billion until the well could be sealed from the bottom after it had already been closed from the top. Hayward, meanwhile, was history. BP had named Mississippi native Bob Dudley as its first American CEO, effective Oct. 1.
As the other investigations dragged on, BP was quick to offer its own judgment. In a 192-page report released last fall, the company admitted oversight mistakes but placed most of the blame on its contractors, especially Transocean and Halliburton. Dismissing widespread criticism of its well design as irrelevant, BP cited the flawed cement work, concluding that it had allowed gas to enter the well through the bottom; the botched negative-pressure test; the rig crew's failure to respond to signs of trouble; and the impotence of the blowout preventer. BP's conclusion was that the Horizon was an industry accident, with lessons for all, not an indictment of its own practices.
In truth, any fair reckoning of responsibility places BP at the top of the list. Its contractors made critical mistakes. But at virtually every step, BP made decisions that increased risk and displayed a lack of oversight and operational discipline. All were failures in process safety -- and all saved the company time and money. As the presidential commission noted, BP's record suggests "its approach to managing safety has been on individual worker occupational safety but not on process safety. These incidents and subsequent analyses indicate that the company does not have consistent and reliable risk-management processes -- and thus has been unable to meet its professed commitment to safety."
That said, it's also perilous to assume that BP stands alone. The offshore-drilling industry has experienced a chilling array of accidents in the past decade -- fires, blowouts, oil spills, and close calls -- including 20 in the gulf. As the presidential commission observed, "The Macondo well blowout can be traced to a series of identifiable mistakes made by BP, Halliburton, and Transocean that reveal such systematic failures in risk management that they place in doubt the safety culture of the entire industry."
Today the Gulf of Mexico is back open for business. Beaches are largely clean, the vast majority of its fishing waters no longer off limits. The oil has receded from view -- thanks in good part to the gulf's warm natural ecosystem, filled with bacteria that rapidly consume oil. But the lasting environmental impact remains uncertain. A recent Audubon Society report called it "the largest uncontrolled science experiment in our country."
Dudley has announced a major reorganization, aimed at averting yet another disaster. He created a new safety division with broad powers to intervene in company operations. And BP finally appointed a board member with expertise in process safety.
Fortune met with Dudley at BP's London headquarters in November. Dudley is more careful with his words than Hayward, the personification of likable calm. But though his tone and accent are different, the substance of his message is eerily familiar.
Dudley says that what happened in the gulf is "complicated -- there's multiple causes." He says, "I do not believe that BP is an unsafe company," but acknowledges, "We clearly now have to go one more step in terms of putting in place another organization that will have checks and balances over our line organization." Rather than "just run from" risk, as he puts it, "we want to do this as well as anybody in the industry, if not the best ... Because if you learn to manage risk, a company can actually take on more risk. And that will only come in time."
Dudley insists that BP made great strides on safety over the past decade. "If you put aside this Macondo incident," he says without irony, "2009 was the best year we'd had, and 2010 was also heading in that direction." Spoken like a true BP man.
--Doris Burke contributed to this article.