Vulnerability and imagination in the Snorre A gas blowout and recovery

 The entrainment of safety-critical work in a culture of business performance optimization created conditions that led to a near-disastrous subsea blowout in 2004; the crew’s imaginative capabilities saved the day.

Ger Wackers, Narvik University College, Norway; and Mark Coeckelbergh, University of Twente, the Netherlands

In 2004, Statoil lost control of a well on the Snorre A TLP on the Norwegian Continental Shelf (NCS) during a slot recovery operation. The platform was engulfed in a cloud of gas, which fortunately did not ignite. Following safety procedures, oil production was shut down and main power was cut. Most personnel were evacuated by helicopter to nearby platforms. About 35 remained to regain control over the well. Violating several safety regulations, they restored main power and made several attempts to mix and pump drilling mud before finally killing the well.

This article argues that the loss of control was due to the entrainment of safety-critical work in a culture of business performance optimization, and that the successful recovery depended on the imaginative capabilities of the platform crew in trying to understand what was happening and in deciding on courses of action.

THE BATTLE FOR SAGA

Understanding the blowout’s deeper causes requires an account of the demise of Saga Petroleum, the company that built Snorre A, operated it for eight years and drilled the problem well, P-31A.

During the 1970s and 1980s the Norwegian state grew three oil companies: state-owned Statoil, half-state-owned Norsk Hydro and privately owned Saga Petroleum.^1,2 Saga was awarded its first operator responsibility in 1979, on what would become Snorre Field, the second-largest oil field on the NCS. Saga designed and built the Snorre A TLP together with Esso, Fig. 1. Production commenced in 1992.

Fig. 1 Saga built the Snorre A TLP with Esso and operated it for eight years before the company was taken over by Norsk Hydro and Statoil in 1999.

In the late 1990s, the Norwegian companies tried to establish themselves in foreign oil provinces. Their ability to generate the capital required for these foreign investments depended critically on the companies’ earning capability on the NCS. Both Statoil and Hydro were looking to optimize business performance.

Oil prices had dropped dramatically in the mid-1980s and were low through the ’90s. Toward the end of the decade, Saga was in financial trouble. Norsk Hydro and Statoil bought the company together in 1999 and split its assets.² Statoil acquired 25% of Saga’s field shares, boosting its proved and probable oil reserves by about 11%.

In the years before the takeover, Hydro had launched a large investment program as oil prices fell further, which led to negative cash flow. Hydro’s financial results in 1998 were very weak. That year Hydro launched a cost-cutting program called Agenda 99.³ The takeover of Saga was the second element in the strategy to turn this negative cash flow situation around: by growing the company’s portfolio. The acquisition increased Hydro’s oil production by 45% and its proved reserves by about 40%.^4,5

Saga’s takeover was an interactive, adaptive, optimizing search process in which interests were ameliorated in accordance with the relative strength of the partners, so it is understandable that the deal landed where it did. However, the way in which Snorre A was framed as a business asset deleted from this corporate culture the sensitivity, vocabulary and tools to assess the vulnerabilities that would result from the deals. (Vulnerability is defined here as a system’s reduced ability to anticipate, resist, cope with and recover from an event threatening the system’s functional integrity.⁶) In effect, the business frame created an imaginative deficit that, combined with the market stress of very low oil prices, was translated down to the operational level where safety-critical work is performed.

FREQUENT HANDOVERS

In the Saga takeover, Norsk Hydro agreed to take operator responsibility for Snorre A for 3.5 years and then hand it over to Statoil. A change of operator for a platform implies that most of the operations personnel transfer along with the platform to a new employer.

Snorre A personnel shifted from Saga to Norsk Hydro to Statoil within four years. With each shift of employer, transferring personnel had to establish new relationships within the new company, build new networks, get acquainted with new guiding documentation and protocols, and learn new routines. Two shifts in four years provoked in Snorre A personnel a resistive response and a desire to “be left alone.”⁵ The speed of the handovers-a solution that followed the logic of a corporate culture of production-was faster than the time it takes to build new relationships within the new company, and thus violated the temporal logic between processes in a complex system that is required for safe and reliable operation of high-risk technical systems.

Statoil was operator on the eight other production platforms that were closely located in the Tampen area, Fig. 2. By integrating Snorre A into the Statoil Tampen Area Result Unit, Statoil could reduce costs through synergy. Norsk Hydro used its years as Snorre A’s operator to reduce the platform’s operational costs. At the end of its term, Hydro tried to fix operational costs at the lowest level to maximize profit margins. Hydro and Statoil agreed that revenues from Snorre A’s oil production for partners in the license would be calculated on the basis of the operational cost level achieved by Hydro before the transfer. Any increases in cost thereafter would fall to the new operator, Statoil.

Fig. 2 When Statoil took control of Snorre A from Norsk Hydro in 2003, the platform was integrated with eight other nearby production platforms in the Statoil Tampen Area Result Unit, reducing costs through synergy.

Statoil’s management signed for the transfer of responsibility for Snorre A from Hydro without requiring independent or third-party reviews of the installation’s technical integrity, warding off inspections or reviews by the petroleum directorate. In practice, the agreement was dissolved after one year because it engendered too many disputes on the origin of cost increases, but it bears witness to the dominance of a culture of production into which Snorre A’s daily operations were entrained.

Having acquired Snorre A, Statoil’s Tampen Area Result Unit started negotiations with Odfjell Drilling to bring all drilling operations in the Tampen Area under one contract, replacing Snorre A’s previous drilling contractor, Prosafe. As is common in the industry, the contract’s terms rewarded uptime, not downtime (which includes maintenance time).

Offshore personnel must overcome a resistance to speak up and stop work in case of doubts about the safety of work in progress. But the contractor’s personnel on Snorre A faced double resistance to work stoppage. The operator’s onshore organization wanted to keep moving to maintain a detailed time schedule. The contractor’s onshore management also wanted to avoid downtime, because downtime would decrease cash flow and damage operational effectiveness statistics that would come up in future negotiations on contract renewals or effectuation of options. Time is not money, but contracts like these transform time into money.

The drilling contract renegotiation ran parallel in time to planning of the slot recovery operation for well P-31A. The renegotiation and consequent transfer of drilling personnel to a new employer were not considered reasons to postpone the slot recovery.

SLOT RECOVERY

The term slot refers to a site on a large subsea steel frame on the seafloor that is used to guide the drillstring. About 40 wells-30 oil producers and 10 water and gas injectors-operated from Snorre A were drilled using a single slot frame. The top sections of these boreholes are close together under the steel frame, but further down they diverge and run obliquely toward the reservoir. When a well is plugged and temporarily abandoned, the slot cannot be used for production or injection. This was the case for P-31A.

The first well for this slot, P-31, was drilled in 1994 as an observation well, was extended with a sidetrack in 1995 and completed as an oil production well, P-31A. P-31A had a troubled history. During tubing installation in 1994 a number of problems occurred that are relevant to the 2004 blowout.

Previous casing damage. From the end of the 9⅝-in. casing, an 8½-in. hole was drilled for the installation of a 5½-in. extension liner. Stands of the 5½-in. liner were attached to a driving string for installation. With the driving string still attached, cement was injected around the bottom of the liner to fix it to the surrounding rock. However, the cement hardened faster than expected, so the driving string itself was cemented inside the 9⅝-in. casing. The upper part of the driving string was successfully unscrewed down to 3,524 m, until a main bearing cracked and re-attachment of tools became impossible. About 150 m of the string remained in the well, cast in cement. This steel and cement mass had to be milled out. During this milling operation the 9⅝-in. casing sustained considerable wear (up to 40%), which was confirmed and measured using ultrasound logging.

Sometime later, the casing sustained further damage. Before completion of the well, the wellbore had to be cleaned, using a downhole, rotating, high-pressure washer. During this operation, repair and maintenance work had to be performed on the drilling deck and the washer stood still in one place for some time, at 1,561 m. The non-rotating jets of the washer eroded the 9⅝-in. casing and “washed” perforations into it. These holes were confirmed by ultrasound logging.

Despite the considerable damage, Saga did not replace the casing but rather inserted a 2.5-km-long, 7⅝-in. scabliner to cover the holes and other partially eroded sections. The scabliner was then pressure tested, after which the well was completed with 5½-in. production tubing. However, from 1996 forward it was used as a gas injection well.

In 2001 Hydro discovered extensive corrosion and leaks in P-31A, and extra tubing was run in to improve the well’s integrity.7 In December 2003, Statoil plugged and suspended the well after it failed a pressure test, losing pressure at less than half the reservoir pressure.⁸

Slot recovery planning. To make the slot productive again required work in the tail end of P-31A to prepare it for permanent abandonment and drilling of a new sidetrack, P-31B, from an intermediate level of the wellbore.

Despite the history of integrity problems in P-31, Statoil’s land-based Snorre A operations unit considered this a straightforward job. The paperwork in cabinets and files in electronic databases that documented the complicated well history had by this time moved offices twice: from Saga to Hydro to Statoil. Some of it may have been lost or misplaced. Because some of it existed only as paper copies and some was stored in different databases, this historical well information was no longer easily retrievable at the start of planning for the slot recovery.

Among the offshore personnel on Snorre A were people who had been involved in drilling P-31 in 1995 and were now involved in the slot recovery operation. They “knew” about the accidental hole in the 9⅝-in. tubing that was covered with the scabliner. However, prior to the 2004 blowout, the drilling and well organization in the field was little involved in the planning and discussion of drilling and well programs.⁹

The question is whether mobilization of this historical knowledge would have mattered that much. Although pulling the “plaster” would expose the holes in the 9⅝-in. tubing, this was not considered critical; the official investigation reports do not explain why. An important consideration may have been that, according to Statoil’s internal accident investigation report, in the initial plans, the damaged tubing section would never be exposed to the much higher reservoir pressure.10 The operation was to occur under lower and controllable pressures because the wellbore was mechanically plugged downhole. The slot recovery was to proceed with the plug in place-with no open connection to the reservoir. No work would be done under that plug.

Changes in plan. The production tubing runs through, and is perforated at, several zones in the reservoir. Oil had been produced for about a year from one zone, but thereafter gas had been injected into another zone to maintain reservoir pressure. Valves in the tubing, operated through well control equipment, separate the zones.

The Norsok industry standard on well integrity requires that “there shall be one well barrier in place during all well activities and operations, including suspended or abandoned wells, where a pressure differential exists that may cause uncontrolled cross flow in the wellbore between formation zones.”¹¹ During operation and suspension, this can be a well barrier element that requires activation to function. These barrier elements will not suffice for permanent abandonment, because the well control equipment will be removed.

To optimize the barrier situation and comply with the industry standard, the reservoir management unit requested that the reservoir section of P-31A’s production tubing be filled with concrete. This would effectively and permanently prevent crossflow between zones through the pipe. However, to allow injection of concrete below the plug, the plug had to be perforated.

The upper part of the scabliner had to be removed to prepare the site from which the new sidetrack would be drilled. However, the wireline operator for Snorre A felt that it would be easier for the perforating tool to enter the small-diameter liner holding the downhole mechanical plug if the scabliner was still in place to help guide the tool. Therefore he proposed to perforate the plug before pulling the scabliner.

These procedural changes-to inject concrete and to perforate the mechanical plug before pulling the scabliner-were accepted in a planning meeting on Nov. 2, 2004. Because the planners failed to think the complete barrier envelope through these procedural changes, the implications for the subsequent pulling of the scabliner were not properly explored.¹² The two operations, perforating the plug and pulling the scabliner, remained cognitively uncoupled, especially in terms of the consequences of opening the reservoir before pulling the scabliner in a well that had failed a pressure test in January 2003.

Vulnerabilities. The revised plan was approved at the last planning meeting for the slot recovery operation on Nov. 11. A meeting to discuss the associated risks was postponed eight days, to Nov. 19. In the interim, the drilling rig finished its previous work two days early. On Nov. 16 the rig was skidded to P-31A, and because time was considered money rather than a resource for safety, the slot recovery operation started on Nov. 19. The postponed risk assessment meeting, planned for that day, was cancelled.

The operations unit’s leadership had made “delivery on production” the goal that set standards for norms, work practice, knowledge and competence.¹³ Critical remarks from employees concerning the well control side of the operation were suppressed.¹⁴ Empirical research on time pressure suggests that when people experience time stress, they tend to focus on an increasingly narrow range of task-relevant cues. Under time pressure, there is an increased tendency to “seize and freeze” on a certain definition of a situation without adequately probing to see if that definition is the most appropriate, leading to less information disclosure and faster arrival at shared, but not necessarily good, solutions.¹⁵

THE BLOWOUT

The downhole mechanical plug was perforated first, as planned, establishing an open connection between the high-pressure reservoir and the inside of the wellbore up to the BOP on the drilling deck. The scabliner was cut, and the upper part was stripped through a hole in the BOP. Pulling the scabliner from the dense mud created a swabbing effect. Gas that had been injected into the reservoir now flooded the wellbore, expanding as it rose.

The pressurized, expanding gas passed behind the scabliner and through the old 1995 holes in the 9⅝-in. casing, through unknown damages in the 13⅜-in. casing and into the shallow formations. The gas created large craters in the seafloor, close to the anchors of the platform’s tension legs, and rose through the water and out into the open air. Now there was a large pressure gradient between the reservoir and platform’s ambient atmosphere, sufficient for spontaneous, and now uncontrolled, gas production, Fig. 3.

Fig. 3 Pulling the scabliner from the dense mud created a negative pressure, causing gas to flood the wellbore. The gas bubbles rose through the tubing to the BOP, which was unable to close around or cut the scabliner, and also behind the scabliner and through holes in the 9 5⁄8-in. casing and up through the seafloor. Hence, there were parallel blowouts, one erupting from the seafloor and the other from the BOP.

Flangs and shearing devices in the BOP were not appropriate to close around or cut the scabliner that was being pulled. A safety valve was not accessible and could not be activated. Gas rising through the tubing could not be contained by the BOP. Hence, there were parallel blowouts, one erupting from the seafloor and the other from the BOP, with gas in water, in air and inside the installation (in cooling systems, fire-fighting systems, ventilation systems and rooms).

The first gas alarm occurred in the cooling water of the Vigdis subsea satellite’s gas processing module, followed soon by more alarms. In compliance with safety regulations, the system was shut down in three steps over two hours. The Vigdis module was shut down first, followed 15 minutes later by Snorre A’s main oil production and processing system.

The main emergency shutdown system was activated 105 minutes later, cutting main power, after gas was observed in the seawater. The power reduction from 82 MW to the 4 MW supplied by the emergency diesel generators further reduced the system’s ability to cope with the blowout. Killing the blowout would require pumping down mud or cement under higher-than-reservoir pressure. However, the heavy equipment to mix and pump mud or cement can only be operated properly with main power.

Main power was also required to extinguish the flare; there was no valve that could be shut manually to cut off the feed of gas. Regulations prohibit such a valve to ensure that after emergency shutdowns no pressurized gas remains in the installation. Consequently, the flare continued to burn for several hours into the blowout.

Seeing that the well situation was getting out of hand, the platform manager activated the “preparedness and (first tier) crisis management organization,” shifting discretionary power to himself from the onshore operations unit that had run the slot recovery program.

When the main emergency shutdown system was activated, company regulations supported full evacuation. So did Statoil’s second-tier crisis management group gathered at Sandsli near Bergen, and the third tier, gathered at company headquarters in Stavanger. The platform manager decided against full evacuation in violation of company regulations, instead reducing personnel on board to 75 and then 35. If people were killed attempting to recover the developing crisis, the platform manager would bear the brunt of criminal investigation and possibly criminal prosecution and punishment.

RECOVERY

Disaster was imminent; the gas cloud could ignite any moment. There was no time for risk analyses, calculations or assessment. It was under these trying circumstances that the remaining crew regained control of the well, saving not only their own lives, but the platform and the company as well.

A number of resources were important for this successful recovery: professional experience and skills, trust in each others’ skill and experience, regular emergency preparedness exercises simulating a range of serious incidents, familiarity with the installation deriving from years of corrective maintenance and handling component failures on an ad hoc basis. Of particular interest, however, is the role and nature of imagination in developing a shared understanding of what was happening, what could happen and what could be done without getting killed in the attempt.

Statoil and its Snorre A operations unit had an established management policy for a crisis on the platform: They would assume a worst-case scenario being played out. The preconceived scenario of the “abnormal well situation” (irregular pressure surges) was the loss of control over the (single) well, a blowout. Based on previous experience, the site of oil or gas release was expected to be on the drilling deck. This was one of the emergency situations that the operations unit trained for regularly.

However, a subsea blowout, let alone a parallel blowout, had not been anticipated. Platform management imagined loss of the platform as the worst-case scenario, and the mechanisms that could bring this about as:

1. Loss of buoyancy due to coalescing gas bubbles under the platform

2. Loss of one or more anchors in combination with the forceful jet stream under the platform.

In either case, the platform would topple and sink. Inherent in its design, Snorre A had no anchor chains that would allow it to float out of harm’s way; thus the platform would go down on site, ripping off the risers and destroying the steel frame that collected 40 wells and related equipment. The worst-case scenario was not a single, topside blowout, but a massive oil and gas blowout from multiple wells in 350-m-deep water.

Disaster images mobilized. In their decision-making, platform management explicitly mobilized three familiar images to elaborate the consequences and to discriminate the current situation from previous scenarios.

The first of these images is the April 1977 Bravo oil blowout, on the production deck of the Phillips-operated Bravo platform in Ekofisk Field. It was the first major oil blowout in the then-young North Sea offshore industry. Many had seen on TV the fountain of oil erupting into the air and spilling tons of crude into the sea for days. However, this was a blowout from a single wellhead on deck, and it was (relatively) easily accessible.

The second image mobilized was the equally well-known scene of the multiple Kuwaiti oil wells that were set on fire by the retreating Iraqi army in the first Gulf War. Bulging black smoke clouded the sky and tons of oil polluted land and water. It took months to regain control of the installations. Yet, they were on land and far apart, hence readily accessible.

In the worst-case scenario of Snorre A, the wells spilling oil would be only a few meters apart, at 350-m water depth, and probably covered by the wreck of the platform. Oil would flow freely and contaminate the ocean in massive amounts for months. And the platform manager imagined that the oil would reach the Norwegian shore and destroy wildlife, nature and tourism for decades. Clearing the coast would incur insurmountable costs for local communities and seriously burden Norwegian society and the state. Statoil would be engaged in cleaning the coast for decades, and probably would go bankrupt. Furthermore, Norway’s reputation and that of its major oil companies (Statoil and Norsk Hydro) would be seriously damaged.

The platform manager did not fully evacuate the platform but instead tried to regain control over the well. Some people were asked to volunteer to stay on board, taking into account the skills needed to handle the situation. The 35 who remained knew and trusted each other, as well as the platform manager. But trust would not go all the way if people felt that they would die trying to save the installation and the company.

Another well-known, rich image was mobilized that vividly illustrated the remaining crew’s possible death: the 1988 Piper Alpha disaster in the British North Sea. Following an initial explosion and due to reduced fire-fighting capabilities, a series of further explosions and hot gas fires destroyed the topside structure of the platform within a few hours, killing 165 people: in the fire itself, while jumping from the platform, or by drowning while waiting for rescue. If the gas cloud ignited, Snorre A would become a second Piper Alpha, or so it seemed.

Defusing the imagery. To make personnel stay voluntarily, the platform manager had to defuse the Piper Alpha imagery. He had to make it plausible that staying on board would not necessarily result in death. To do so he made a distinction between, on one hand, the ignition of the gas cloud and, on the other hand, the hot gas fire that would burn from the sea surface under the platform, fed by the jet stream of gas coming from the seafloor.

For each of these components he recruited different images. For the ignition itself, he called upon the experiences of many people who have tried to ignite an underpressurized gas stove: There will be a dull pop, but not the violent release of energy that you see in an explosion. Pressurized gas will explode, but not unpressurized gas in ambient air. Being dispersed by the wind, this gas will burn away quickly. Hence, in case of ignition, they would not die in an explosion. Yet, the ignition would ignite the gas fires that would burn like torches from the sea surface under the platform. However, these fires would not necessarily kill those on board either, since fire-fighting ships, covering the underside of the platform with a horizontal screen of water, would buy those on board enough time to evacuate by helicopter or lifeboat.

The imagery mobilized in this case of crisis management should not be seen as representations of a reality. Questions of their truthfulness are irrelevant here. There was no time to do a reality check. Imaginative capabilities are important because they facilitate communication, generate a shared definition of the situation, coordinate actions and provide cues for possible actions and consequences, all in times of great uncertainty where there typically are no rules to guide decision making.

Improvisation. The ability to improvise depends on knowledge, skills and experience, but also on the local familiarity with a particular installation. For the Snorre A crew, this familiarity resulted from extensive exposure to the installation in frequent corrective maintenance jobs that were due to a sustained emphasis on cost reduction and deferral of preventive maintenance, as well as from regular emergency training sessions. The crew did not suffer from what could be called a reliability paradox-the loss of maintenance skills and experience due to the increase of system reliability. Paradoxically, operating Snorre A like a money machine maintained the improvisatory skills that saved the day.

Improvisations in two domains proved particularly important. In compliance with safety regulations, the platform lost main power when the emergency shutdown system was activated. The electrical system had to be re-arranged to allow the main power reactivation, a tricky procedure that could have caused a total blackout, forcing full evacuation. However, main power was successfully reestablished, allowing operation of the heavy equipment needed to mix and pump the mud.

The second improvisation concerned the air intakes. Gas in the air under the platform had not been anticipated in the design and location of the air intakes for the ventilation systems and pumps. These were placed at the platform’s underside to prevent ingress of rain. To restore gas-free air for pumps, ventilation of rooms and cooling of computer systems, the intakes were rearranged to the topside.

With main power restored, the crew attempted to regain control of the well by bullheading-pumping heavy mud under high pressure, forcing the jet stream of gas down and back into the reservoir. The mud weight must be sufficient, after removing the extra pressure from the pumps, to counterbalance the reservoir pressure. When this is achieved the pressure at the level of the drilling deck will be zero. When the density of the mud is too low, or when mud is lost through cracks or openings in the tubing, reservoir pressure will result in new pressure surges. Calculating the required mud weight in a bullheading operation requires specific skills and judgment.

The technician responsible for mixing mud had, by mistake, been evacuated, but was available on a nearby platform to assist by phone. But the crew had to make do with the fluids and dry matter for mixing mud that were already available on the platform; ships with new supplies could not be offloaded because of the gas cloud. It took several attempts with different densities and compositions before the pressure in the well was stable at zero. When this was achieved, around 10 a.m. on Nov. 29, about 13 hours after the observation of gas in the sea, almost no mud was left. If this last attempt to stabilize the well had failed, another one would not have been possible. Final and full evacuation would then have been the only option left.

With the well stabilized and the source of gas contained, wind dispersed the gas around the platform. Supply ships, relief personnel and new equipment could now reach the platform and begin work to further secure the well.

CONCLUSION

What lessons should be learned from this account? Looking at the processes immediately preceding the loss of control we find violations of regulations, but we also find locally optimizing and rational proposals, attempts to do the job as well as possible. The problem with these solutions was that they reflected an inability to imagine the consequences of the actions for the ability to maintain a proper barrier status. They were locally optimizing but uncoupled. The ability to think the whole barrier envelop, in a sense, provides a metaphor for the cognitive, imaginative capabilities required and able to keep locally optimizing solutions coupled within an integrating perspective. This was the “lack of competence” identified by the accident investigation reports, which we have called an imaginative deficit. Given this imaginative deficit, it is not certain that the cancelled risk assessment meeting would have solved the problem.

The Snorre A incident provides evidence of an imaginative deficit and associated uncoupling of locally optimizing solutions at the corporate level. Of course, at that higher level of aggregation it takes a different shape. Here it is in the inability to imagine the consequences of takeover deals, cost-reduction programs and economic incentives in contracts for the ability of lower-level units involved in safety-critical work to maintain technical system integrity. The result is a gradual deletion of technical system integrity concerns in the negotiation of solutions that restore, improve and optimize business performance.

Technical integrity concerns are delegated to lower levels and deferred in time. The stress that derives from low and falling oil prices is transferred to safety-critical engineering and maintenance work. Safety-critical work is thus entrained in a culture of business performance optimization. For lower-level management, expressions of process quality derive from this culture, not from technical reliability and system integrity concerns.

Of course, this should not be the case. Safety-critical work should be protected from the regularity gradient that corporate-level executives project as a force field through their organization. The challenge will be to replace local expressions of process quality that privilege business performance with those that favor safety and reliability. This requires at least partial reversal of the pricing of time as it is currently practiced through contracts, to make time available as a resource for safety.

The successful recovery bears evidence that resilience resides in people, not in procedures or in technology. It also provides, albeit tentatively, a view on the kind of imaginative resources that were mobilized into the management of the crisis. Given the impossibility of anticipating all possible system failure mechanisms as design base accidents, the problem will not be solved by making better technical designs or designing better procedures. The challenge will be to design technical systems and procedures that enhance the resilience that resides in people instead of systems that make them more vulnerable.

LITERATURE CITED

 1 Ryggvik, H., “Norsk oljepolitikk mellom det internasjonale og det nasjonale,” in Olsen, O. E. and Sejersted, Oljevirksomheten som teknologiutviklingsprosjekt, ad Notam Gyldendal, Oslo, 1997, pp. 26-78.
2 Ryggvik, H. “De tre bukkene Saga, Norsk Hydro og Statoil. Fra nasjonal beskyttelse til internasjonal ekspansjon,” in Olsen, O. E. And Sejersted, Oljevirksomheten som teknologiutviklingsprosjekt, 1997, pp. 198-247.
3 Lie, E., Oljerikdommer og internasjonal ekspansjon. Hydro 1977-2005. Bind 3 av Hydros Historie 1905-2005, Pax Forlag, Oslo, 2005, p. 416.
4 Ibid., p. 410 ff.
5 Schiefloe, P. M. and K. Mauseth Vikland, Årsaksanalyse etter Snorre A hendelsen 28.11.2004, Statoil, 2005.
6 Wackers, G. and J. Kørte, “Drift and vulnerability in a complex technical system: Reliability of condition monitoring systems in North Sea offshore helicopter transport,” International Journal of Engineering Education, 19, No. 1, 2003, pp. 192-205.
7 Statoil, Ukontrollert brønnsiutasjon I brønn 34/7-P-31 A på Snorre A den 28. november 2004, Synergi nr 285274 (14-1-2005), 2005.
8 Brattbak, M., Østvold, L-Ø., Zwaag, C. v.d. and H. Hiim, Gransking av gassutblåsning på Snorre A, brønn 34/7-P-31 A 28.11.2004, Petroleum Safety Authority Norway, 2005.
9 Schiefloe and Mauseth Vikland, 2005, p. 43.
10 Statoil, 2005, p. 6.
11 Norsok Standard, D-010 Well integrity in drilling and well operations. Rev. 3, August 2004, Standards Norway, Lysaker, 2004, p. 15.
12 The accident investigation report mentions several “deviations from rules and regulations”: insufficient attendance to planning meetings, hasty and partial risk analyses, failure to uncover the deterioration of the barrier status through the formally required control and verification of plans by higher level officials and lack of involvement of senior management.
13 Schiefloe and Mauseth Vikland, 2005, p. 38.
14 Ibid., pp. 20-21.
15 Blount, S., Waller, M. J. and S. Leroy, “Coping with temporal uncertainty: When rigid, ambitious deadlines don’t make sense,” in Starbuck, W. H. and M. Farjoun, eds., Organization at the Limit: Lessons from the Columbia Disaster, Blackwell Publishing, Oxford, 2005, pp. 122-139.

THE AUTHORS
	Ger Wackers holds a PhD degree in science and technology studies from the University of Maastricht, the Netherlands. He works on a research project concerning the vulnerability of complex technological systems. The research on the Snorre A blowout was hosted by the Centre for Technology, Innovation and Culture of the University of Oslo, Norway. He now holds a position as associate professor at the engineering school of Narvik University College, Norway. He can be contacted at ger.wackers@hin.no.
	Mark Coeckelbergh lectures in philosophy at the University of Twente, the Netherlands. He is the author of Imagination and Principles (2007), The Metaphysics of Autonomy (2004), and Liberation and Passion (2002) as well as articles on professional ethics and ethics of technology. His current research focuses on problems concerning responsibility in engineering practice. He also works on ethics of human enhancement and robotics. He can be contacted at m.coeckelbergh@utwente.nl.