Written 2026-11-10. The facts are as of that date, from the sources listed at the end.
On the morning of 23 August 1991 a finished concrete oil-platform base was being lowered in a Norwegian fjord, and it sank. The usual short account says that a computer model got a number wrong by 47%. That is true as far as it goes, but the primary records say something more specific. The official investigation, by the research institute SINTEF, named two errors: an inaccurate computer analysis of the loads, and inadequate reinforcement at a corner of the wall. The oil company Statoil counted three. The Toronto engineers who analysed the failure, who were retained by the designer, add a point about the strength side: that the design code's shear check overstated what the wall could take. Whether the code shares the blame is disputed in the sources. The same Toronto engineers say why the engineers' hand checks missed the ends of the failed walls: the understated load and the overstated strength kept those ends off the list of critical locations. What the quality-assurance reviewers themselves checked, and why their review missed the errors, the records I could read do not show. This post sets out what is documented, what is only reported second-hand, and what I could not read.
The structure was the concrete gravity base for the Sleipner A platform. A gravity base is a hollow concrete foundation, built in cells like a honeycomb, that stays on the seabed by its own weight. The one in this story was being ballasted (filled with water) in Gandsfjorden, near Stavanger, as a controlled test before the platform deck was fitted. The designer was the Norwegian firm Dr. techn. Olav Olsen a.s. (Collins et al., Canadian Consulting Engineer, 2000). The builder was Norwegian Contractors, whose yard was at Stavanger (Oil & Gas Journal, "Mishaps Dominate Weather Window Activity", 28 October 1991).
The main report of the SINTEF investigation (SINTEF is a Norwegian research institute) says that the base "sprang a leak and was lost in 18 minutes." (Holand, Report 17, abstract on OSTI). Lindberg's history for the Norwegian Petroleum Museum gives the times: "a loud bang was heard from within by those on board and alongside at 05.49." Then: "About 18 minutes later, the Sleipner A GBS went to the bottom." GBS stands for gravity base structure. 05:49 plus 18 minutes is about 06:07, which is my arithmetic. A trade-press report from 2 September 1991 (Oil & Gas Journal) said the unit sank in less than 15 minutes; the later sources say 18, and I use 18. According to Collins and colleagues, the structure was about 5 metres short of the planned deck-mating depth, the depth at which the deck was to be fitted, when it failed.
One account online disagrees on the number of people: a student paper says 14 were aboard. That does not hold up against the other sources. (The student paper itself says the people aboard were rescued without injuries, which fits the rest.)
All four sources agree on 22 people. Two of them, Lindberg and Sandberg, say the 22 got off without injury. Oil & Gas Journal says all were evacuated safely. Klikk says no lives were lost and says nothing about injuries. The figure of 14 appears in a 2013 student paper. I did not find an official police or regulator record, so this rests on trade press and museum histories that agree with each other.
SINTEF's main report is dated December 1997, and I could read only its catalogue abstract, not the report itself. The abstract says: "The loss is assumed to be caused by failure in two tri-cell walls adjacent to the drill shaft." A tri-cell is a three-sided space between adjoining cylindrical cells; Lindberg writes that investigations by both NC and Statoil, as well as later tests, indicated that the sinking was caused by a fracture in the concrete wall between the drilling shaft and "an internal (three-sided) tricell." Note the words assumed and indicated. Soon after the sinking, Oil & Gas Journal reported (2 September 1991) that Norwegian Contractors said "the extent of the damage would make it impossible to determine the cause of the incident by examining wreckage." The next sentence of the report reads: "The company is checking documentation for the design to establish theories for the sinking." As I read the contractor's statement, the wreckage could not show the cause, but the design papers might.
The abstract continues: "There are two main reasons for the failure: a serious inaccuracy in the global FEM analysis and an inadequate reinforcement of the corner between the tri-cell walls and the adjacent cell wall." FEM means finite element method. It is a way of calculating stresses in a large structure by dividing it into many small pieces, called elements, solving each piece, and joining the results. Global means one model of the whole structure rather than of one part. Another SINTEF report says: "Calculations indicate that the loss was probably primarily due to shear failure of the tri-cell corners." (Thorenfeldt and Braa, Report 6). Shear is the sliding kind of stress, where one part of a wall is pushed past its neighbour.
Statoil, the oil company that operated the field, reported its own findings in October 1991. Oil & Gas Journal (28 October 1991) reported Statoil's finding that structural failure of the tricell unit linking the D-3 drilling shaft and adjoining base units was the most likely cause of the loss of the Sleipner structure, and that the failure occurred because the tricell walls and adjacent joints were underdesigned.
Statoil's findings, as Oil & Gas Journal reported them, include these two sentences: "The results were incorrect for the areas where the failure occurred." "The shear forces were only 53% of the correct values." For the global analysis, the article says, the structure had been divided into 23,000 finite elements.
The figure that circulates is 47%. A page at the University of Minnesota, which reproduces an excerpt from a SINTEF report, says: "The shear stresses were underestimated by 47%, leading to insufficient design." That page does not say which report it excerpts, and it does not mark where the excerpt ends.
The two figures describe one error, as my arithmetic shows:
By that arithmetic, the 47% figure and the nearly-double figure describe the same fact. A 2025 preprint (arXiv 2506.13821, listed below) gives 45%. A 2026 engineering blog on the Dlubal site says of the model: "It captured only about 53 to 55 % of the shear forces that actually occurred." The only figure I found traced to a contemporary source is 53%. I found no primary source for 45%.
SINTEF's second cause, quoted above, is "an inadequate reinforcement of the corner between the tri-cell walls and the adjacent cell wall." Holand's 1997 conference abstract describes it as "an unfortunate detailing of the reinforcement." Those are the investigators' wording. The next account is a different framing, and its source matters: Collins, Vecchio, Selby and Gupta are the Toronto engineers who studied the failure, and they were "retained by Dr. techn.Olav Olsen a.s., the Norwegian structural engineering firm responsible for the design." A reader should weigh their framing with that in mind.
They put the load error and a strength-side error into one sentence, and they tie the missing reinforcement to both. In their words, the tricell wall that failed did not contain stirrups because the global finite element analysis performed as part of the design seriously underestimated the magnitude of the shear at the ends of the wall, "while the sectional design procedures used seriously overestimated the beneficial effects of axial compression on the shear strength of the wall." Stirrups are the loops of steel bar that tie a wall against shearing. On my reading of that sentence, the missing stirrups are the result of the two errors, not a third parallel factor. The same authors also give these two errors as the reason the wall ends escaped the engineers' hand checks (see "How did it get through checking?" below).
A sectional procedure is a hand-style check of one cross-section of a wall. Axial compression is squeezing along the wall, which does help concrete resist shear, but the procedure credited too much of that help. The authors write that the design procedures were those contained in the 1977 Norwegian concrete code, which they say had been influenced by the shear provisions of the 1971 code of the American Concrete Institute (ACI). In a separate sentence they write that these provisions, which they say remain unchanged in the current ACI code, predicted failure of the tricell wall when the water pressure reached a head of 120 metres, "almost twice the observed failure pressure." A water head gives a pressure as the depth of water that would produce it: a head of 120 metres is the pressure 120 metres below the surface. On my reading, these provisions are the ACI ones as the authors evaluated them. I found no figure in the article for what the Norwegian code itself gave. The authors write that the wall in fact failed under a water head of about 65 metres, "whereas it should have been capable of safely resisting a water head of 70 metres." Their next sentence: "To give a factor of safety of 1.5 the wall should not have failed until the water head reached 105 metres."
The arithmetic: 120 ÷ 65 = 1.846, so the ACI provisions, as the authors evaluated them, were too optimistic by a factor of about 1.85.
On the reinforcement, the authors' preceding sentence describes stirrups near the walls' mid-height; "These stirrups stopped just below the failure location." The wall ends also held T-headed bars: straight reinforcing bars with steel plates welded on their ends to anchor them in the concrete. The authors say the bar used was about 1 metre long. Their finding on these bars depends on both the stirrups and the bar length. Without stirrups, they write, "when the tricell walls do not contain stirrups, the T-headed bars only marginally increase the strength of the tricell until the length of these bars is long enough to penetrate three-quarters of the way into the cell wall (i.e., a length of 1.3 metres)." With stirrups, "the T-headed bars significantly increase the strength of the tricell once the bars are long enough to penetrate one-quarter of the way into the cell wall (i.e., a length of about 0.8 metres)." And: "The tricell could have resisted about an additional 20 metres of water head if either the stirrups had been continued higher up the wall or if the T-headed bars in regions with no stirrups had been about half a metre longer." On my reading, half a metre more would have taken the bar of about 1 metre past the 1.3 metres the authors give for walls without stirrups, which is why longer bars alone would have helped. 65 + 20 = 85 metres, which is my sum. That is more than the 70 metres the wall should have resisted safely, but still short of the 105 metres at which, by the authors' own standard, it should first have failed. As shares of 105 metres: 65 ÷ 105 = 0.62 and 85 ÷ 105 = 0.81. On my reading, the extra 20 metres measures what the missing reinforcement cost; it does not show that either remedy alone would have given the wall its full margin.
I have not combined the two factors into a single figure for a hidden safety margin. The 0.53 is a shear force at a section and the 1.85 is a failure head, so they are not measured on the same basis, and no source combines them.
Statoil counted differently. Oil & Gas Journal (28 October 1991) reports that Statoil found three decisive errors, which occurred separately but taken together contributed to the structural failure. As I summarise the article, the three are that the global analysis underestimated shear, that the corner reinforcement was improperly detailed, and that the tricell joint was not designed separately from the adjacent walls. In short, SINTEF's main report and Holand's abstract each count two errors; Collins and colleagues' two are the load analysis and the code's sectional check; Statoil counts three.
I found no statement from Olav Olsen or Norwegian Contractors defending their method. The sources pull in different directions.
Pointing at the code or its application:
Pointing away from the code:
Report 4 and Report 8 do not obviously agree, and Collins and colleagues, who were retained by the designer, say more against the code than Report 4 does. Report 8's finding is about reliability in shear checks under the Norwegian standard, not about whether this design followed or misused it. I cannot settle whether the fault lay in the shear rules, in how one team used the analysis, or in both.
It is tempting to say that the software was wrong. No primary source I read says that. Wikipedia (secondary) puts the root cause down to inaccurate NASTRAN calculations, citing SINTEF Report 16, which I could not read. The University of Minnesota page names NASTRAN, which it calls a popular finite element program, and says the post-accident investigation traced the error to an inaccurate finite element approximation of the linear elastic model of the tricell. A linear elastic model treats the material as stretching in direct proportion to the load. But the wording quoted in the sections above is different: SINTEF's main report names an inaccuracy in the global FEM analysis; Statoil, the operator, a design done by computer without enough control of the separate steps; and Sandberg's museum history the inaccurate use of computer programs at Olav Olsen.
Ivar Holand, author of the main report, is probably the author listed as Ivar. H on the abstract of a 1997 conference paper (that identification is my inference). The abstract says two simultaneous errors caused the loss. It lists these lessons, in my summary: a renewed emphasis on basic structural mechanics in teaching; better co-ordination of preliminary design and global finite element analysis; more robust calculation of stress resultants; and requirements for automatic warnings about the risk of errors in commercial software. Stress resultants are the forces and moments at a wall section, worked out from the stresses the model gives. These lessons read most naturally as a use-of-the-tool problem and a missing-warning problem rather than a bug, but the abstract is short and the call for automatic warnings about errors in commercial software could be read more than one way. No primary source I read says NASTRAN computed wrongly; the secondary sources above do.
Whether the inaccuracy came from a mesh that was too coarse is also not shown by a primary text I could read. The mesh, also called the discretisation, is the pattern of elements a finite element model divides the structure into; a coarse mesh uses fewer, larger elements. A 2025 preprint (arXiv 2506.13821) says the discretisation used for a critical component was too coarse and contained some skewed, that is badly shaped, elements, and it puts the error at 45%. A 2026 engineering blog on the Dlubal site says: "Irregular elements were used in the critical tri-cell region." Both are secondary. Holand's wording hints that the step of turning element stresses into section forces was involved, but that is my reading of an abstract, not something he states.
This is the question I most wanted to answer, and the records I could read answer it only in part.
What is on record:
What is not on record in anything I read: what the quality-assurance reviewers checked, who they were, and when. Whether the sectional code check counted as an independent check in the quality-assurance sense is not shown either.
So the engineers' hand checks have a stated reason, from the designer-retained Toronto authors: the same two errors kept the wall ends off the list of places to check. On why the quality-assurance checking missed the errors, only one later account I read goes further: the preprint, which says the independent check's mesh was too coarse, and which rests on a report I could not read. Two other retellings can look as if they say more, but they do not. Wikipedia's crediting of Report 16 with finding inaccurate NASTRAN calculations is a claim about the cause, not about why the checking missed it. The Dlubal blog's line that the errors were not detected by quality control says no more than Collins and colleagues already do. On the quality-assurance review itself, the records I could read say only that it missed the errors and that the reasons are discussed in a report I could not read.
Sandberg's history of the Draugen field, another Norwegian platform, adds a consequence that is seldom told: "Worse – the same error had been made on the Draugen GBS." He writes that the operator, Shell, initiated independent analyses, both in-house and externally, and he quotes a Shell manager: "it became necessary to test all the important conclusions with independent experts." He also writes that as early as the day of the incident, Norwegian Contractors' representatives visited Shell's offices to explain that the sinking was probably caused by under-dimensioning of tricells, meaning that they were sized too small for their loads. He does not say when anyone knew that the same error was in the Draugen base. After about three months, he writes, Shell got the same answers that NC had obtained through its model trials, and construction could resume. On my reading of Sandberg, Shell's independent analyses confirmed NC's explanation; they were not what first found the error.
Sandberg adds that NC commissioned a full-scale model trial which checked eight test sections, and which, in his words, "confirmed the causes identified by the engineers." Lindberg writes that Statoil and NC jointly decided to build the replacement base in 19 months, with much more reinforcement steel than the first, and that it was completed in the summer of 1993.
The University of Minnesota page says: "More careful finite element analysis, made after the accident, predicted that failure would occur with this design at a depth of 62m, which matches well with the actual occurrence at 65m." It does not say in that sentence who did the analysis, but it lists Selby, Vecchio and Collins (1997) among its references. The only original source I found for the 62 m figure is Collins and colleagues, who were retained by the designer and who used software tools developed at the University of Toronto. They write: "The first computer run on the Sleipner analytical model predicted that the as-built structure would fail when the applied water pressure on the inner faces of the tricell reached a head of 62 metres, a value in excellent agreement with the estimated 65 metres head that caused Sleipner to fail." I found no SINTEF figure of 62 m, so I attribute it to the Toronto authors. The gap is 65 − 62 = 3 m, and 3 ÷ 65 = 4.6%. Two cautions: the authors call the 65 m estimated, and their analysis was run after the event, when the answer was known.
Collins and colleagues draw a lesson: they write that it is always possible to obtain most of the important design parameters by relatively simple hand calculations. Their further advice: "when designing for shear, even for shear in walls, it is prudent to be generous with the use of stirrups."
Here is what the record supports, as a method of my own drawing, not one the sources prescribe. If you rely on a model's output, work out the same quantity a second way that shares no steps with the model, and compare. Here that would be an estimate of the shear at the wall ends from simple equilibrium, set against the model's figure. I have not done that estimate, and I cannot show numbers a reader could redo; no source I read gives one. The Toronto authors say the software picked out critical locations for the engineers to check by hand, and that, because the applied shear was underestimated and the shear strength overestimated, the ends of the tricell walls were not among them. On my reading, the wall ends were therefore not on the list of places the engineers checked by hand. A related benchmark exists (NAFEMS Benchmark Challenge No. 6, 2016, which, by a secondhand description of it, asks how to get section forces that balance at a design section of this structure), but I could not read it and do not know its method.
The sources disagree and I cannot reconcile them:
I found no breakdown of the $700 million.
All read 2026-11-10 unless stated.