Your SlideShare is downloading. ×
Safety for offshore structure
Upcoming SlideShare
Loading in...5

Thanks for flagging this SlideShare!

Oops! An error has occurred.

Saving this for later? Get the SlideShare app to save on your phone or tablet. Read anywhere, anytime – even offline.
Text the download link to your phone
Standard text messaging rates apply

Safety for offshore structure


Published on

Published in: Business, Technology

  • Be the first to comment

No Downloads
Total Views
On Slideshare
From Embeds
Number of Embeds
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

No notes for slide


  • 1. CORE Report No. 2005-04SAFETY OF OFFSHORESTRUCTURESbyTORGEIR MOANProfessorNorwegian University of Science and TechnologyandKeppel ProfessorNational University of SingaporeCentre for Offshore Research & Engineering National University of Singapore
  • 2. Keppel Offshore and Marine Lecture November 26. 2004Safety of Offshore Structures By Professor Torgeir Moan Director, Centre for Ships and Ocean Structures, Norwegian University of Science and Technology Keppel Professor, National University of Singapore
  • 3. ForewordThe Second Keppel Offshore & Marine Lecture was delivered by Professor TorgeirMoan at the National University of Singapore (NUS) on 26 November 2004. This reportis the written version of the lecture. The Lecture was supported by many professionalsocieties, including American Society of Mechanical Engineers (Singapore Section), TheInstitution of Engineers Singapore, The Institute of Structural Engineers, The JointBranch of Royal Institution of Naval Architects and Institute of Marine EngineeringScience & Technology, Society of Naval Architects and Marine Engineers Singapore,Singapore Shipping Association and Singapore Structural Steel Society.The Keppel Professorship in Ocean, Offshore and Marine Technology in NUS waslaunched officially by His Excellency, President S.R. Nathan of Singapore andChancellor of NUS on 19 September 2002. The Professorship has been establishedunder the Department of Civil Engineering, and is part of the bigger umbrella of theCentre for Offshore Research & Engineering (CORE) in NUS. CORE has received seedfunding from Keppel Offshore & Marine Ltd and Economic Development Board(Singapore). The Centre aims to be a focal point for industry participation and activitiesin Singapore, and promotes multi-disciplinary research by drawing on the expertise ofvarious universities, research institutes, and centres for integrated R&D.Professor Moan, the first Keppel Professor, is an academic of international staturethrough his 30 years of close involvement in the international offshore oil and gas andmarine fraternity. He brings a global perspective to promote R&D in Singapore, with aparticular emphasis on the technological interests of Keppel Offshore & Marine. He willserve as the beacon of guidance and inspiration for academics as well as industry.CORE acknowledges the significant support of everyone in Keppel Offshore & Marine,especially Mr Choo Chiau Beng, Mr Tong Chong Heong and Mr Charles Foo, for theirimmense contributions. CORE is working closely in partnership with Keppel on R&D,Education and Training to draw young talents into the offshore and marine industry.
  • 4. Safety of Offshore Structures Torgeir Moan Centre for Ships and Ocean Structures Norwegian University of Science and TechnologySummaryAn overview of important developments regarding safety management of offshorestructures is given. Based on relevant experiences with accidents, the hazards and themeans to control the associated risk are categorized from a technical-physical as wellas human and organizational point of view. This includes considerations of the riskassociated with fatigue, corrosion and other degrading phenomena. The risk can becontrolled by use of adequate design criteria, inspection, repair and maintenance ofthe structures as well as quality assurance and control of the engineering processes.Such measures are briefly outlined, while the emphasis is placed upon a quantitativedesign approach for dealing with structural robustness. In this connection the inherentdifferences in the robustness of various structural concepts are pointed out. The appli-cation of reliability methodology to obtain quantitative measures of structural safetyrelating to ultimate failure as well as handle the combined effect of design, inspec-tion and repair strategy on fatigue failure is highlighted. The application of riskanalysis to establish robustness criteria corresponding to a certain risk acceptancelevel is briefly mentioned. The challenges of Quality Assurance and Control to newstructures are briefly outlined, with particular reference to recent examples of newloading phenomena such as ringing and springing of platforms. i
  • 5. 1. IntroductionOil and gas are the dominant sources of energy in our society. Twenty percent ofthese hydrocarbons are recovered from reservoirs beneath the seabed. Various kindsof platforms are used to support exploratory drilling equipment, and the chemical(production) plants required to process the hydrocarbons. Large production platforms,such as some of those in the North Sea, represent investment of billions of U.S. dol-lars and significant operational costs. Pipelines or tankers are used to transport thehydrocarbons to shore. This paper is limited to deal with offshore structures, see Fig.1.a) Offshore oil and gas b) Platform for exploratory c) Platform for oil and gas exploitation drilling operation production (chemical processing)Fig. 1 Subsea oil and gas exploitationThe continuous innovations to deal with new serviceability requirements and demand-ing environments as well the inherent potential of risk of fires and explosions havelead to an industry which has been in the forefront of development of design andanalysis methodology. Fig. 2 shows phases in the life cycle of offshore structures. Thelife cycle of marine systems is similar to that of other systems. In view of the ecologi-cal issue removal or clean-up need to be considered. In this aspect the recycling of thematerial is an important issue. In the life cycle phases of structures the design phase isparticularly important. Offshore structures need to fulfil serviceability and safety re-quirements. Serviceability requirements depend upon the function of the structure,which is to provide a platform and support of equipment for drilling or for the produc-tion of hydrocarbons. Drilling units need to be mobile while production platforms aregenerally permanent. Production platforms are commonly designed to carry largechemical factories together with large hydrocarbon inventories (Fig. 1c). Safety re- 1
  • 6. quirements are introduced to limit fatalities as well as environmental and propertydamages.The focus here is on the structural safety during the life cycle of the platforms. A ra-tional safety approach should be based on: - Goal-setting; not prescriptive - Probabilistic; not deterministic - First principles; not purely experimental - Integrated total; not separately - Balance of safety elements; not hardware Design Data, methods, for criteria - serviceability & - producability - safety Layout/ Scantlings Fabrication - Fabrication plan - Fabrication & - Inspection/repair Operation data Operation - Operation plan Inspection/ monitoring/ repair / maintenance Reassessment Removal and reuseFig. 2: Life cycle phases of offshore structuresThe safety management of structures is different for different industries depending onthe organisation as well as regulatory contents. For instance the safety management ofoffshore structures differs from that for trading ships. One reason for this difference isthe fact that safety management of trading vessels emerged for centuries through em-piricism while off-shore structures have primarily come about in the last 50 yearswhen first principles of engineering science had been adequately developed to serveas basis for design. Similarly the regulatory regime differs between ships and offshorestructures in that offshore operation take place on continental shelves under the juris-diction of the local government. Typically authorities in the continental shelf stateshave to issue regulations. Examples of these are MMS/API in USA, HSE in UK andNPD in Norway. However the provisions for stability and other maritime issues arebased on those of IMO and their corresponding national organizations. Classificationsocieties primarily provide rules for drilling units and services for production facili-ties, which primarily are handled by national authorities. Since early 1990s ISO hasbeen developing a harmonized set of codes for offshore structures with contributionfrom all countries with major offshore operations.Over the time safety management of offshore structures has been developed, in paral-lel with the evolvement of the technology and the competence to deal with it. Initiallycivil engineering was the driving force for structural safety management. Later the 2
  • 7. aeronautical and nuclear industries also played an important role. However in the last20-30 years the developments in the offshore industry has had a significant impact onthe development of safety approaches. This is partly because the offshore industryplays a key role in the “world’s economy”. Moreover the oil and gas represent energywith large potential accident consequences. Companies involved in structures and/orfacilities that experience accidents may suffer loss of reputation and this may damagethe public’s trust on the companies.The rationalisation of safety management of offshore structures began in early 70’s.Among the milestones is the introduction of Risk Analysis in 1981 and AccidentalCollapse Design criterion in 1984 by the Norwegian Petroleum Directorate and theHSE Safety case approach in 1992, when the ALARP principle - as large as reasona-bly practicable – was introduced for determining the target safety level.To limit the likelihood of fatalities and environmental and property damages, offshorestructures should be designed, fabricated and operated in such a manner that the prob-ability of the following failure modes is adequately small: - overall, rigid body instability (capsizing) under permanent, variable and envi- ronmental loads - failure of (parts of) the structure foundation or mooring systems, considering permanent, variable, and environmental as well as accidental loadsStability requirements for floating platforms affect the layout and the internal struc-ture – subdivision in compartments. Criteria to prevent progressive structural failureafter fatigue failure or accidental damage would have implications on overall layoutof all types of platforms. Otherwise a structural strength criterion affects the scant-lings of the stiffened, flat, and cylindrical panels that typically constitute floating off-shore structures.If the location is far off shore then evacuation and rescue will be difficult. On theother hand, this implies that accidents on offshore facilities affect the general public toa lesser extent than accidents on similar facilities on land.In the following sections accident experiences on offshore structures will be brieflyexplained. Then, an outline of various measures to manage the safety or ensure thatthe risk is within acceptable limits, is given. This includes: Design and inspectioncriteria as well as reliability methodology to calibrate the partial safety factors to cor-respond to a defined acceptable safety level. In particular it is explained how fatiguefailures can be avoided by design as well as inspections and regular monitoring of thestructure. Emphasis is placed on how structural robustness can be ensured by usingso-called Accidental Collapse Limit State (ALS) criteria. Such criteria are exempli-fied in relation to fires, explosions and other accidental loads. Finally, Quality Assur-ance and/or Quality Control of the engineering process will be described with particu-lar reference to dealing with unknown wave loading and response phenomena.2. Accident Experiences2.1 Accident experiences at largeSafety may be regarded as the absence of accidents or failures. Hence the insightabout safety features can be gained from detailed information about accidents andfailures. To learn about the intrinsic nature of accidents, it is mandatory to study thedetailed accounts provided from investigations of catastrophic accidents since the 3
  • 8. necessary resources are then spent to investigate such accidents. Such studies includethose of the platforms Alexander Kielland in 1980 (ALK, 1981, Moan and Holand,1981b), Ocean Ranger in 1982 (OR, 1984), Piper Alpha in 1988 (PA, 1990), and P-36in 2001 (P-36, 2003). See also Bea (2000a, 2000b). In addition, the statistics aboutoffshore accidents, such as ones given in WOAD (1996), provide an overview.Global failure modes of concern are - capsizing/sinking - structural failure - positioning system failurethe former two modes represent catastrophic events while the latter one is only criticalfor Tension-leg platforms. Global failures normally develop in a sequence of technicaland physical events. However, to fully understand accidents it is necessary to interpretthem in the view of human and organizational factors (HOF). This includes possibledeficiencies in relevant codes, possible unknown phenomena that have materialized aswell as possible errors and omissions made in engineering processes, fabricationprocesses or in the operation itself. b) Model of Ocean c) Piper Alpha fire d) P - 36 accident in 2001 Ranger, which capsized in and explosion in 1988a) Alexander L. Kielland 1982, during survival before and after capsizing testing in 1980Fig. 3: Examples of accidents which resulted in a total loss.Let us consider an example: The platform shown in Figure 4a in the Gulf of Mexico.This is one of many platforms that were damaged during the passage of the hurricaneLilli. Physically there is no doubt that this accident was due to extreme wave forces.To explain from a human and organizational point of view why the platform was notstrong enough to resist the wave forces, we have to look at the decisions that weremade during the design phase regarding loads, load effects, resistance and safety fac-tors. The explanation might be that design was based on an inadequate wave condi-tions or load calculation. The damage could also be due to the occurrence of a particu-lar a wave phenomenon, such as an abnormal wave crest (see Fig. 4b) or another “un-known” wave phenomenon. In the case of the exceptional wave in Fig. 4b, the ques-tion is whether the extreme crest height of 18.5 m should be considered as the so-called “freak” wave or simply a rare wave. Alternatively, the reason could be inade-quate air-gap provided in the design. Yet another explanation might be that an im-proper strength formulation was used (as was the case in design of early generationplatforms). Finally, the safety factors might not have been sufficient to cover the in-herent uncertainties. For each of these possible causes, two explanations need to be 4
  • 9. considered, namely 1) The state of art in offshore engineering was inadequate at thetime of design ; 2) Errors and omission were made during design or fabrication! Ob-viously, these two explanations have different implications on the risk reducing ac-tions.In this connection it is noted that several types of environmental load phenomena,such as green water on deck and slamming (Fig. 4 c-d) are subjected to large uncer-tainties. In general, if the phenomenon is known but subject to significant uncertain-ties, the design approach taken is normally conservative. 18 5 b) Wave record from a platform site in the North Sea on January 1. 1995. a)Severe damage caused on a jacket platform in the Gulf of Mexico by Hurricane Lilli c) Green water and deck slamming d) Deck slamming on semi- on FPSO submersible platformFig. 4 Structural damage due to environmental loadsThe technical-physical sequence of events for the Alexander Kielland platform was:fatigue failure of one brace, overload failure of 5 other braces, loss of column, flood-ing into deck, and capsizing. For Ocean Ranger the accident sequence was: floodingthrough broken window in ballast control room, closed electrical circuit, disabled bal-last pumps, erroneous ballast operation, flooding through chain lockers and capsizing.Piper Alpha suffered total loss after: a sequence of accidental release of hydrocarbons,as well as escalating explosion and fire events. P-36 was lost after: an accidental re-lease of explosive gas, burst of emergency tank, accidental explosion in a column,progressive flooding, capsizing and sinking after 6 days.Table 1 shows accident rates for mobile (drilling) and fixed (production) platformsaccording to the initiating event of the accident WOAD (1996). Table 1 is primarilybased upon technical-physical causes. Severe weather conditions would normally af-fect capsizing/ foundering as well as structural damage. In most cases there existedhuman errors or omissions by designers, fabricators or operators of the given installa-tion was a major contributor to the accident. The most notable in this connection is,of course accidents caused by loads such as ship impacts, fires and explosions whichshould not occur but do so because of errors and omissions during operation.In general, accidents take place in sequences. For floating platforms, the loss of buoy-ancy and stability is commonly an important aspect of total loss scenarios. Structuraldamage can cause progressive structural failure or flooding. Progressive flooding at- 5
  • 10. tributes to a greater probability of total loss of floating structures than progressivestructural failure.Degradation due to corrosion and fatigue crack growth are gradual phenomena. How-ever, if the fatigue life is insufficient to make Inspection, Monitoring, Maintenanceand Repair (IMMR) effective or if there is lack of robustness, fatigue can cause catas-trophic accidents, see Fig. 5. Both cases shown in Fig.5 occurred for statically deter-minate platforms. In other situations through-the-thickness cracks were detected byinspections before they caused catastrophic failures (Moan, 2004). Corrosion is notknown to have caused accidents with floating offshore structures of significance. Onthe other hand, maintenance related events for floating structures is limited. We needto be aware of this problem, especially for structures with a low fatigue life.Table 1: Number of accidents per 1000 platform-years. Adapted after WOAD (1996). World wide Gulf of Mexico North SeaType of Mobile Fixed Fixed Fixedaccident 1970-79 /80-95 1970-79 /80-95 1970-79 /80-95 1970-79 /80-95Blowout 18.8/ 11.4 2.5/0.9 2.2/1.0 2.6/1.6Capsizing/ 24.0/ 19.5 0.5/0.8 0.3/1.1 2.6/0.5founderingCollision / contact 24.6/ 14.6 1.6/1.0 1.3/0.7 5.1/6.3Dropped object 4.2/ 6.1 0.5/0.8 0.1/0.4 10.3/10.6Explosion 7.4/3.3 0.7/1.6 0.3/0.4 2.6/8.3Fire 12.3/ 2.0/7.5 1.0/7.8 18.0/42.5 11.9Grounding 6.1/3.3 - - -Spill/release 4.9/5.9 1.8/8.7 1.0/5.8 23.1/98.3Structural damage 25.6/ 18.4 0.5/0.6 0.4/0.5 10.3/6.0 Column D ”Missing braces” – that cause no redundancy Ranger I, 1979 Alexander Kielland, 1980Fig. 5: The total losses of Ranger I in 1979 and Alexander Kielland in 1981 were initiated by fatigue failure 6
  • 11. An overall picture of the accident rate in an industry may be displayed by the so-called Frequency-Consequence diagram as shown in Figure 6. The horizontal axis isplotted the consequence, in this case in terms of fatalities, N. The vertical axis isshown the frequency of N or more fatalities per accident. We see that the accident ratefor mobile drilling units is much higher than for fixed production platforms. Fixedplatforms are mainly used as production facilities. Moan and Holand (1981b) ex-plained the main reasons for the differences in safety levels between mobile and fixedplatforms. Floating production platforms are not included because of the limited ex-perience with such platforms. The risk is similar that that of passenger vessels andtankers. 100 Marginally acceptable Acceptable Annual frquency of an event 10-1 with N or more fatalities Oil platforms Mobile 10-2 Fixed 10-3 Passenger ferries 10-4 (not ro-ro) Tankers 10-5 Merchant vessels 1 10 100 1000 10000 Number of lives lost, NFig. 6: Comparison of experienced overall accident rates with respect to fatalities in the offshore and shipping industries2.2 Human and organizational factorsBasically, structural failure occurs when the resistance, R is less than the load effect,S as indicated in Fig. 7. From a Human and Organizational Factor (HOF) point ofview this can be due to too small safety factors to account for the normal uncertaintyand variability in R and S relating to design criteria. But the main causes of actualstructural failures are the abnormal resistance and accidental loads due to human er-rors and omissions.Design errors materialise as a deficient (or excessive) resistance, which cannot bederived from the parameters affecting the “normal” variability of resistance. Fabrica-tion imperfections (such as cracks, plate misalignment, etc.), which also affect theresistance, are influenced by human actions. The “normal” variability of welders per-formance, environmental conditions, and soon lead to a “normal” variability in theimperfection size. This is characterised by a smooth variation of the relevant imper-fection parameter. Occasionally a deviation from “normal practice” does occur, forinstance as an abnormality caused by using a wet electrode, or another gross fabrica-tion error. The Alexander L. accident in 1980 was caused by a fatigue failure of abrace and design checks had not been carried out. The implied fatigue life was furtherreduced – to 3.5 years - by a fabrication error (70 mm weld defect) as well as inade-quate inspections (ALK, 1981). Although the fatigue failures that had been experi-enced in semi-submersibles in the period 1965-70 resulted in fatigue standards, these 7
  • 12. standards were not properly implemented even for platforms built in the 1970’s.Many platforms built in the 1970’s had joints with design fatigue lives as low as 2-5years. This fact was evidenced in the extraordinary surveys undertaken after Alexan-der Kielland accident. The same happened to the first purpose built FPSO and shuttletankers put into service in the mid-1980’s. However, ships are obviously more robustor damage-tolerant than mobile semi-submersible platforms.Man-made live loads also have a “normal” and an “abnormal” component. Whilesome loads, notably fires and explosions, ship collisions, etc. do not have a normalcounterpart, they are simply caused by operational errors or technical faults. The mo-bile platform Ocean Ranger capsized in the offshore of Newfoundland in 1982. Theaccident was initiated by control room window breaking due to wave slamming. Thewater entering the control room lead to the short circuit of the ballast valve system,thereby leading to a spurious operation of ballast valves. The resulting accidental bal-last condition could not be controlled partly because of lack of crew training andpartly because of inadequate ballast pumps, and open chain lockers (OR, 1984).The catastrophic explosion and fire on the Piper Alpha platform in 1988 was initiatedby a gas leak from a blind flange of a condensation pump that was under maintenancebut not adequately shut down (PA, 1990). The main issue that caused the initiation ofthis accident was the lack of communication between the maintenance team and thecontrol room operators. The gas ignited and the initial explosion lead to damage of anoil pipe and subsequent oil fires and explosions.In 2001 the platform P-36 in Brazil experienced a collapse of the emergency drainagetank, accidental explosion and subsequent flooding capsizing and sinking. A series ofoperational errors were identified as the main cause of the first event and also thesinking (P-36, 2001).It is a well known fact that the gross errors dominate as the cause of accidents, andtherefore appropriate control measures should be implemented. It is found that thegross errors cause 80-90% of the failure of buildings and bridges and other civil engi-neering structures (Matousek and Schneider, 1976). The same applies to offshorestructures. R&D Risk reduction Do the job Unknown material or Do the job properly in load phenomenon properly in the first place the first place Causes QA/QC Design QA/QC of Abnormally Design error design of design error low Failure - oversight of load QA/QC of QA/QC Fabrication resistance R<S … operation error Operational error of the as- Event - accidental load fabricated control structure ULS: RC/γR > γS1SC1 + γS2SC2 (leak, etc) FLS: D=Σni/Ni ≤ Dallowable ALS Inadequate safety factors for design normal variability of R and S check Apply adequate safety factors in ULS/FLS design checkFig. 7 Interpretation of causes of structural failure and risk reduction measures. 8
  • 13. It has been observed that errors and omissions occur especially in dealing with novelmaterials and concepts as well as during periods with economic and time pressures.In some cases, accidents have been caused by inadequate engineering practice such asthe lack of knowledge regarding new phenomena. Recently new phenomena such asringing and spinning of TLPs, degradation failure mechanism of flexible risers, havebeen discovered. Nevertheless they were observed in time before any catastrophicaccident could occur.3. Safety Management3.1 GeneralOffshore drilling, production or transport facilities are systems consisting of struc-tures, equipments and other hardware’s, as well as specified operational proceduresand operational personnel. Ideally these systems should be designed and operated tocomply with a certain acceptable risk levels as specified for example by the probabil-ity of undesirable consequences and their implications. The safety management needsto be synchronised with the life cycle of the structure. Structural failures are mainlyattributed to errors and omissions in design, fabrication and, especially, during opera-tion. Therefore, Quality Assurance and Control (QA/QC) of procedures and the struc-ture during fabrication and use (operation) is crucial.To do a truly risk based design, by carrying out the design iteration on the basis of arisk acceptance criterion, and to achieve a design that satisfies the acceptable safetylevel, is not feasible. In reality, different subsystems, like:- loads-carrying structure & mooring system- process equipment- evacuation and escape systemare designed according to criteria given for that particular subsystems. For instance, toachieve a certain target level, which implies a certain residual risk level, safety criteriafor structural design are given in terms of Ultimate Limit State (ULS) and FatigueLimit State (FLS) criteria. Using appropriate probabilistic definitions of loads andresistance together with safety factors, the desired safety level is achieved. The im-plicit risk associated with these common structural design criteria is generally small!The philosophy behind the Accidental Collapse Limit (ALS) criteria is discussed be-low.The nature of human errors differs from that of natural phenomena and “normal”man-made variability and uncertainty. Different safety measures are required to con-trol error-induced risks. A number of people maintain that gross errors are “Acts ofGod” and cannot be dealt with.However,- weld defects and fatigue failures due to gross errors had occurred before the Kiel- land accident- ballast errors had occurred before the Ocean Ranger accident- fires and explosions had occurred before the Piper Alpha accidentand so on 9
  • 14. The occurrence of gross errors have been avoided by adequate competence, skills,attitude and self-checking of those who do the design, fabrication or operation in thefirst place; and by exercising “self-checking” in their work.In addition, quality assurance and control should be implemented in all stages of de-sign, fabrication and operation. While the QA/QC in the design phase is concernedwith scrutinizing the analysis, design checks and the final scantlings arrived at, theQA/QC during fabrication and operation phases refers to inspection of the structureitself.As mentioned above, operational errors typically result in fires or explosions or otheraccidental loads. Such events may be controlled by appropriate measures such as de-tecting the gas/oil leakage and activating shut down valve; extinguishing of a fire byan automatically-activated deluge system. These actions are often denoted as “EventControl”.Finally, Accidental Collapse Limit State criteria are implemented to achieve robustoffshore structures, that is to prevent that the “structural damage” occurring as fabri-cation defects or due to accidental loads, escalate into total losses (Moan 1994).Table 2 summarises the causes of structural failure from a risk management point ofview, and how the associated risk may be ameliorated.Adequate evacuation and escape systems and associated procedures are crucial forcontrolling failure consequences in terms of fatalities.Table 2: Causes of structural failures and risk reduction measuresCause Risk Reduction Measure• Less than adequate safety margin to - Increased safety factor or margin in ULS, FLS; cover “normal” inherent uncertain- - Improve inspection of the structure(FLS) ties.• Gross error or omission - Improve skills, competence, self- checking (for during d, f, o) - design (d) - QA/QC of engineering process (for d) - fabrication (f) - Direct design for damage tolerance (ALS) – and - operation (o) provide adequate damage condition (for f, o) - Inspection/repair of the structure (for f, o)• Unknown phenomena - Research & Development3.2 Design and inspection criteriaAdequate performance of offshore structures is ensured by designing them to complywith serviceability and safety requirements for a service life of 20 years or more, aswell as carrying out load or response monitoring, or inspection and taking the neces-sary actions to reduce loads directly or indirectly, by, e.g., removal of marine growth,or to repair, when necessary.Serviceability criteria are introduced to make the structure comply with the functionsrequired. These criteria are commonly specified by the owner. Production platformsare usually made to be site- specific, while drilling units are commonly intended foroperation in specific regions or world wide. 10
  • 15. Safety requirements are imposed to avoid ultimate consequences such as fatalities andenvironmental or property damages. Depending upon the regulatory regime, separateacceptance criteria for these consequences are established. Property damage is meas-ured in economic terms. Fatalities and pollution obviously also have economic impli-cations. In particular, the increasing concern about environmental well-being cancause small damages to have severe economic implications. While fatalities caused bystructural failures would be related to global failure, i.e. capsizing or total failure ofdeck support, smaller structural damages may result in pollution; or property damagewhich is costly to repair such as the damages of an underwater structure.The current practice which is implemented in new offshore codes, issued e.g. by API(1993/97), ISO 19900 (1994-) and NORSOK (1998a, 1998b, 1999, 2002) as well asby many classification societies, and the most advanced codes are characterized by - design criteria formulated in terms of limit states (ISO 19900, 1994) – see Table 3 - semi-probabilistic methods for ultimate strength design which have been cali- brated by reliability or risk analysis methodology - fatigue design checks depending upon consequences of failure (damage- tolerance) and access for inspection - explicit accidental collapse design criteria to achieve damage-tolerance for the system - considerations of loads that include payload; wave, current and wind loads, ice (for arctic structures), earthquake loads (for bottom supported structures), as well as accidental loads such as e.g. fires, explosions and ship impacts - global and local structural analysis by finite element methods for ultimate strength and fatigue design checks - nonlinear analyses to demonstrate damage tolerance in view of inspection plan- ning and progressive failure due to accidental damageFatigue crack growth is primarily a local phenomenon. It requires stresses to be calcu-lated with due account of the long-term wave conditions, global behaviour as well asthe geometric stress concentrations at all potential hot spot locations, and suitablefatigue criteria (e.g. Miner’s rule). Fatigue strength is commonly described by SN-curves, which have been obtained by laboratory experiments. Fracture mechanicsanalysis of fatigue strength have been adopted to assess more accurately the differentstages of crack growth including calculation of residual fatigue life beyond through-thickness crack, which is normally defined as fatigue failure. Detailed informationabout crack propagation is also required to plan inspections and repair. 11
  • 16. Table 3 Limit State Criteria for safety – with focus on structural integrity L im it s ta te s P h y s ic a l a p p e a r a n c e R e m a rk s o f fa ilu r e m o d e U ltim a te (U L S ) D if f e r e n t f o r b o t t o m – - O v e r a l l “ r ig i d b o d y ” s u p p o rte d , o r b u o y a n t s t a b i lit y C o lla p s e d s tru c tu re s . - U lt im a t e s t r e n g t h o f c y lin d e r C o m p o n e n t d e s ig n c h e c k s t r u c t u r e , m o o r in g o r p o s s ib le f o u n d a t io n F a tig u e (F L S ) C o m p o n e n t d e s ig n c h e c k - F a ilu r e o f w e ld e d jo in t s F a t ig u e - d e p e n d in g o n r e s i d u a l d u e t o r e p e t it iv e lo a d s fra c tu re s y s te m s tre n g th a n d a c c e s s f o r in s p e c t io n A c c id e n ta l c o lla p s e ( A L S ) S y s t e m d e s ig n c h e c k - U lt im a t e c a p a c it y 1 ) o f J a c k -u p d a m a g e d s t r u c t u r e w it h c o lla p s e d “ c r e d i b le ” d a m a g eAn adequate safety against fatigue failure is ensured by design as well as by inspec-tions and repairs. Fatigue design requirements depends upon inspect ability and fail-ure consequences. Current requirements for fatigue design check in NORSOK areshown in Table 4. These values were established by the NPD code committee in 1984by judgement.Table 4 Fatigue design factor, FDF to multiply with the planned service life to obtain the required design fatigue life (NORSOK N-001, 2002). Access for inspection and repair Accessible (inspection according to generic scheme No access or is carried out) in the splash zone Above splash zone Below splash zone or internalSubstantial 10 3 2consequencesWithout substantial 3 2 1consequences1) The consequences are substantial if the Accidental Collapse Limit State (ALS) criterion isnot satisfied in case of a failure of the relevant welded joint considered in the fatigue check.Traditionally we design for dead-loads, payloads as well as environmental loads. But,loads can also be induced by human errors or omissions during operation – andcause accidental loads. They commonly develop though a complex chain of events.For instance hydrocarbon fires and explosions result as a consequence of an acciden-tal leak, spreading, ignition and combustion process. Accidental Collapse Limit State(ALS) requirements are motivated by the design philosophy that “small damages,which inevitably occur, e.g. due to ship impacts, explosions and other accidentalloads, should not cause disproportionate consequences”. 12
  • 17. The first explicit requirements were established in Britain following the Ronan Pointapartment building progressive failure in 1968. In 1984 such criteria were extendedby NPD, to include such robustness criteria for the structure and mooring system.While robustness requirements to the mooring are generally applied today, explicitALS criteria are not yet widespread. The World Trade Centre and other recent catas-trophes have lead to further developments of robustness criteria for civil engineeringstructures. See Figure 8.ALS checks should apply to all relevant failure modes as shown in Figure 9. It is in-teresting in this connection to note that ALS-type criteria were introduced for sinking/instability of ships long before such criteria were established for structural integrity assuch. Thus, ALS were introduced in the first mobile platform rules (as described Beckwith and Skillman, 1976). The damage stability check has typically beenspecified with damage limited to be one or two compartments flooded. According toNPD this damage should be estimated by risk analysis, as discussed subsequently.The criterion was formally introduced for all failure modes of offshore structures inNorway in 1984 (NPD, 1984). Applied • Ronan point since Motivation: early appartment building codes ”small damages, Flooded accident, 1968 which inevitably occur, volume • Flixborough explosion, should not cause a) Capsizing/sinking due to (progressive) flooding 1974 disproportionate • ECCS model codes, consequences!” Gaining Explosion damage acceptance 1978 • Alexander L. Kielland accident, 1980 • NPD Regulations for Risk analysis, 1981 b) Structural failure e.g. due to impact damage,.... • NPD’s ALS criterion, 1984 • HSE Safety Case, 1992 Failure of Dynamic One One Generally • WTC, September 11., 2001 Positioning System tether mooring applied is handled in a similar failed line failed manner c) Failure of mooring system due to "premature" failureFig. 8: Historical development of ALS Fig. 9: Accidental Collapse Limit State assessment of structures (ALS) requirementsThe assessment of structures during operation is necessary in connection with aplanned change of platform function, extension of service life, occurrence of overloaddamage due to hurricanes (Dunlap and Ibbs, 1994), subsidence of North Sea jackets(Broughton, 1997), explosions, fires and ship impact, updating of inspection plans etc(ISO 19900). Basically, the reassessment involves the same analyses and designchecks as carried out during initial design. However, depending upon the inherentdamage tolerance ensured by the initial design, the measures that have to be imple-mented to improve the strength of an existing structure may be much more expensivethan ones for a new structure. This fact commonly justifies more advanced analyses ofloads, responses, resistances as well as use of reliability analysis and risk-based ap-proaches than in the initial design (Moan, 2000a). 13
  • 18. 3.3 Inspection, Monitoring, Maintenance and RepairInspection, Monitoring, Maintenance and Repair (IMMR) are important measures formaintaining safety, especially with respect to fatigue, corrosion and other deteriora-tion phenomena. To ensure structural integrity within the offshore sector in the NorthSea, the regulatory body defines the general framework while the audit of the oilcompanies or rig owners defines: inspection and maintenance needs, reports plannedactivity, findings and evaluates conditions annually and every fourth or fifth year.Hence, the inspection history of a given structure is actively incorporated in the plan-ning of future activities. The inspection and repair history is important for a rationalcondition assessment procedure of the relevant structure and other, especially for “sis-ter” structures.The objective of inspections is to detect cracks, buckling, corrosion and other dam-ages. Overload phenomena are often associated with a warning for which the inspec-tion can be targeted, while degradation needs continuous surveillance. However, nor-mally ample time for repair will be available in the latter cases.An inspection plan involves:- prioritizing which locations are to be inspected- selecting inspection method (visual inspection, Magnet Particle Inspection, Eddy Current) depending upon the damage of concern- scheduling inspections- establishing a repair strategy (size of damage to be repaired, repair method and time aspects of repair)Whether the inspection should be chosen to aim at detecting cracks by non-destructiveexamination (NDE), close visual inspection, detect through-thickness cracks e.g. byleak detection, or member failures would depend on how much resources are spent tomake the structure damage tolerant. The choice again would have implication on theinspection method. The main inspection methods being the NDE methods consist ofdetection of through-thickness crack by e.g. leak detection, and visual inspection byfailed members. The quality of visual inspection of NDE methods depends very muchupon the conditions during inspection. A large volume offshore structure is normallyaccessible from the inside, while members with a small diameter such as TLP tethersand joints in jacket braces, are not.Permanent repairs are made by cutting out the old component and butt welding a newcomponent, re-welding, adding or removing scantlings, brackets, stiffeners, lugs orcollar plates.Typically major inspections of offshore structures (special surveys, renewal surveys)are carried every 4 - 5th year, while intermediate and annual inspections are normallyless extensive. Further refinement of the inspection planning has been made by intro-ducing probabilistic methods as described below.Inspection, monitoring and repair measures can contribute to the safety only whenthere is a certain damage tolerance. This implies that there is an interrelation betweendesign criteria (fatigue life, damage tolerance) and the inspection and the repair crite-ria. Fatigue design criteria, hence, depend upon inspection and failure consequencesas shown e.g. by Table 4.However, during the operation, the situation is different. The strengthening of thestructure by increased scantlings is very expensive. The most relevant measure to in-fluence safety relating to fatigue and other degradation phenomena is by using an im- 14
  • 19. proved inspection method or increased frequency of inspections. The following sec-tion briefly describes how fatigue design and inspection plans (based on an assumedinspection method) can be established by reliability analysis to ensure an acceptablesafety level.3.4 Quantitative Measures of SafetyIdeally the structural safety should be measured in a quantitative manner. Structuralreliability methods are applied to determine the failure probability, Pf which is asso-ciated with normal uncertainties and variability in loads and resistance. Quantitativerisk assessment can be used to deal with the probability of undesirable events andtheir consequences in general terms. This includes events induced by errors and omis-sions, see Fig. 10. Structural reliability analysis Deck Column Prob. density function Load effect fS(s) R,S Wave pressure Resistance fR(r) PF=P[R≤S] Uncertainty in R and S can be r,s modelled by probability density Quantitative risk analysis End events Critical event Fault tree Event tree ConsequencesFig. 10: Methods for quantifying the risk or safety levelThe quantitative safety approach is based on estimating the implied failure probabilityand comparing it with an acceptance level. This target safety level should dependupon the following factors (e.g. Moan, 1998):- type of initiating events (hazards) such as environmental loads, various accidental loads, .. which may lead to different consequences- type of SRA method or structural risk analysis, especially which uncertainties are included- failure cause and mode- the possible consequences of failure in terms of risk to life, injury, economic losses and the level of social inconvenience.- the expense and effort required to reduce the risk.In principle a target level which reflects all hazards (e.g. loads) and failure modes(collapse, fatigue, ... ) as well as the different phases (in-place operation and tempo-rary phases associated with fabrication, installation and repair) is defined with respectto each of the three categories of ultimate consequences. The most severe of themgoverns the decisions to be made. If all consequences are measured in economicterms, then a single target safety level could be established. However, in practice it isconvenient to treat different hazards, failure modes, and phases separately, with sepa-rate target levels. This may be reasonable because it is rare that all hazard scenarios 15
  • 20. and failure modes contribute equally to the total failure probability. The principle ofestablishing target levels for each hazard separately was adopted by NPD for acciden-tal loads; see e.g. Moan et al. (1993b). It was also advocated by Cornell (1995). Ingeneral it is recommended to calibrate the target level to correspond to that inherent instructures which are considered to have an acceptable safety.3.5 Structural reliability analysisGeneralStructural reliability methods for calculating the failure probability are readily avail-able. If the uncertainty in the resistance R and load effect S are described by probabil-ity density functions. The failure probability can be calculated as P (R<S). It is impor-tant to recognize that there are different types of uncertainties used to determine theresultant uncertainties associated with loads and resistances. One type of uncertainty(Type 1) is natural or inherent; this type of uncertainty is ‘information insensitive’ andrandom. A second type of uncertainty (Type 2) is associated with modelling, paramet-ric, and state uncertainties; this type of uncertainty is ‘information sensitive’ and sys-tematic. Type 2 model uncertainties may be defined as the ratio of the actual or truevalue of the variable to the predicted or nominal (design) value of the variable. A va-riety of methods can be used to characterize the model uncertainty, including field testdata, laboratory test data, numerical data, and ‘expert’ judgment. Often it is not possi-ble to develop explicit separations of Type 1 and Type 2 uncertainties and it is impor-tant not to include them twice.SRA is applied to determine the failure probability considering fundamentalvariability, as well as uncertainties due to the lack of knowledge in loads, load effectsand resistance. The state of the art methods for calculating the failure probability arethe numerical First Order and Second Order Reliability as well as Monte Carlosimulation methods (e.g. Melchers, 1999). However, analytical solutions exists for afew cases, for instance, when failure is expressed by g( ) =R – S ≤ 0 and both theresistance R and the load effect S are lognormal random variables.The failure probability is expressed by:Pf = P( g () ≤ 0) = Φ ( −β) or β = −Φ −1 ( Pf ) (1)where Φ(-β) is the standard cumulative normal distribution, with numerical values asshown in Table 5, and the reliability index, β = βLN can be exactly written as follows,see e.g. Melchers (1999): ⎡µ 1+V 2 ⎤ ln ⎢ R S⎥ ⎢ µS 1+V 2 ⎥ ⎣ R⎦ ln ( µR /µS )β LN = ≈ = β LN (2) 2 )(1 + 2 )] ln[(1 + V R VS V 2 +V 2 R SThis simple expression has turned out to be useful and was applied in the API reliabil-ity based code calibration (Moses, 1987). The analytical formulation can also conven-iently be used to express the relationship between Pf and safety factors. 16
  • 21. Table 5 Relation between β and Pf.β 1.0 1.4 1.8 2.2 2.6 3.0 3.4 3.8 4.2 4.6 -2 -2 -3 -4 -4Pf 0.16 0.081 0.036 0.014 0.47 10 0.14 10 0.34 10 0.72 10 0.13 10 0.21 10—5Reliability estimates are found to be sensitive to the distributions used for R and S.The failure probability should refer to a time interval, e.g. a year or the service life. Thiscan be achieved by considering a load effect S that refers to an annual or service lifetime maximum value. We note that the results of code calibration depend upon thechoice of reference period.Reliability based code calibrationReliability methods are increasingly used to make optimal decisions regarding safetyand the life cycle costs of offshore structures (see e.g. ISSC, 1988-1994; Moan, 1994).In particular the efforts by Fjeld (1977); Lloyd and Karsan (1988), Moan (1988), Jor-dan and Maes (1991) to calibrate their codes to a certain reliability. An evaluation ofprevious efforts on calibration of offshore codes was provided by Moan (1995) inconjunction with the ISO effort to harmonize the safety level in codes for offshorestructures across the variety of structural types (ISO, 1994). However, safety factorson loads are not properly varied to reflect the differences in uncertainty in load predic-tions for different types of structures.To illustrate the relationship between partial safety factors, the uncertainty in resis-tance and loads as well as Pf , consider the simplest design format, often used in codecalibration, R c /γ R ≥ γ SSc (3)where Rc and Sc are characteristic resistance and load effect, respectively. Let the (true)random load effect, S and resistance, R be defined by their mean value (µ) and thecoefficient of variation (V): µS = BSSC ,BS ≥ 1; VS = 0.15 − 0.30 µR = BR R C ,BR ≥ 1; VR = 0.1The BS reflects the ratio of the mean load (which refers to an annual maximum if theannual failure probability is to be calculated,) and the characteristic load effect (typi-cally the 100 year value) as well as a possible bias in predicting wave load effects,e.g. due to model uncertainty.By inserting the design equation Eq.(3) into the approximate expression of Eq.(2) ln ( µR /µS ) ln(BR γR γS /BS ) β LN ′ ≈ = or γR γS = (BR /BS ) exp(β L N VR2 +VS2 ) (4) VR2 + VS2 VR2 + VS2With γR γS = 1.5; a typical BS = 0.8 for wave-induced load effects; BR = 1.1 and VR =0.1, it is found that β’LN is about 3.2 for a VS of 0.20. This reliability index corre-sponds to a Pf of 6 10-4. By decreasing BR/BS by 10 % reduces β’LN by 15%. It isnoted that the Similarly, by increasing Vs by 10 % reduces β’LN by 8%. At the sametime it is noted that the uncertainty in R has minimal influence on the safety level. Yetit is important to estimate the mean bias of the resistance, BR accurately. It is also pos-sible to approximately express R and S by (BR, VR) and (BS, VS), respectively, and 17
  • 22. hence to express partial factors by the relevant uncertainties. (e.g. Melchers, 1999).It is important to recognize that variables used in designing offshore structures areoften ‘conservative.’ Thus, there exists sources of ‘bias’ that must be recognizedquantitatively by the Bis. WSD: Goal: Implied Pf ≅ Pft RC/γ > DC + LC + EC Target R — resistance Pf or β D, L, E — load effects due to LRFD: • permanent • live load RC/γR > γDDC + γLLC + γEEC • environmental effects Load ratio, Ec/(Lc+Ec)Fig. 11: Schematic illustration on how the implied safety level in a design code for ultimate strength can be calibrated to be close to a given target level.Fatigue Reliability AnalysisStructural reliability methods can also be used to calculate the probability of fatiguefailure. In Figure 12 the solid line with diamond symbol shows the fatigue failureprobability in the service life as a function of the design criterion – the fatigue designfactor, FDF. It is shown that the cumulative failure probability in the service life var-ies from 10-1 to 10-4 when FDF varies from 1 to 10. 1.0E+00 Cumulative f ailure probability 1.0E-01 Cumulative, stdv (lnA )=0.15 Cumulative, stdv (lnA )=0.3 A nnual f ailure probability A nnual, stdv (lnA )=0.15 1.0E-02 A nnual, stdv (lnA )=0.3 Failure probability 1.0E-03 1.0E-04 1.0E-05 1.0E-06 1 2 3 4 5 6 7 8 9 10 Fatigue de s ign factorFig. 12: Fatigue failure probabilities in the 20 year service period, as a function of the fatigue design factor and the uncertainty level. A is an equivalent constant stress range that represents the long term stress level (Moan, 2004).A consistent fatigue safety level can be achieved, by varying the FDF versus the ef-fect of an inspection program as well as the consequences of failure. 18
  • 23. Reliability estimates by account of inspectionThe effect of the inspection on the reliability level can be illustrated by representingthe crack depth using a random variable, A(t) which is a function of time t. The qual-ity of the inspection in terms of the detectable crack size is also represented by a ran-dom variable, Ad. The distribution of Ad corresponds to the Probability of Detection(POD) curve for the inspection method in question.The failure probability at the time, t (N-cycles) can be formulated Pf ( t ) = P(a f - a N ≤ 0 ) = P [ F ( 0, t )] (5)where af and aN are the crack size at failure and after N cycles, respectively.The outcomes of inspections are assumed to be no crack detection (ND) or crack de-tection (D) at time t after N cycles, which are described by: I ND ( t ) : a N -a d ≤ 0 (6a) I D ( t ):a N -a d ≥ 0 (6b)In general, it is difficult to determine the distribution of the crack size (A) explicitlywhen taking into account all uncertainties that affect the distribution as well as theeffect of inspections. Based on the Paris’ crack propagation law, Eqs. (5-6) can berecasted into a convenient form for analysis as shown e.g. by Madsen and Sørensen(1990).The effect of inspection may be viewed in two different ways depending uponwhether it is assessed before inspections are done, e. g. during the design phase, orafterwards during operation. If the effect of inspections is estimated before they arecarried out, two outcomes: D and ND are possible. The exact outcome is not knownbut the probability of the outcomes can be estimated based on the reliability method.At the design stage, the outcomes (e.g., crack detection or no detection) are notknown. When a single inspection is assumed to be made at time tI and possible cracksdetected are repaired, the failure probability in the period t ≥ tI can be determined by:Pf (t) = P [ F(0, t I )] + P [S(0, t I ) and F(t I , t) | ID (t I )] ⋅ P [ ID (t I )] + P [S(0, t I )and F(t1 , t) | I ND (t I )]⋅ P [ I ND (t I )] (7)where F(t1,t2) and S(t1,t2) are, respectively, mean failure and survival in time period(t1,t2). Equation (7) can be generalised to cover cases with several inspections withtwo alternative outcomes. Moan et al. (1993a) showed, based on reliability analysis,how the allowable cumulative damage (D) at the design stage can be relaxed wheninspections are carried out. Such analyses served as basis for Table 4.On the other hand if no failure has occurred before time tI and it is known that nocrack is detected at time tI, then the failure probability in the period t ≥ tI is Pf (t) = P [ F(t I , t) | I ND (t I )] (8)The knowledge of survival up to time tI and no crack detection at time tI reduces theuncertainty and makes the failure probability drop. The reliability index β increases atthe time of inspection as illustrated by the example shown in Fig. 13. 19
  • 24. 7 Event tree analysis Basic case, No inspection 6 Upd, full inspection history Upd, ONLY last inspection 5 Inspection during Reliability Index operation with 4 No crack detection 3 No inspection 10-3 3×10-3 2 Effect of Inspection 3.5×10-2 predicted at design stage 1 Pf 0 5 10 15 20 Time (years)Fig. 13: Reliability index as a function of time and inspection strategy. Inspection Event Tree analysis is based on predictions at the design stage. The other curves are based on inspections with known outcome during the service life (Ayala-Uraga and Moan, 2002)The updating methodology is useful in connection with extension of service life forstructures with joints governed by the fatigue criterion (Vårdal et al, 2000). In suchcases, the design fatigue life is in principle exhausted at the end of the planned servicelife. Nevertheless, if no cracks have been detected during inspections, then a remain-ing fatigue life can be demonstrated. However, it is not possible to bring the structureback to its initial condition by inspection only. This is because the mean detectablecrack depth by NDE methods typically is 1.0 – 2.0 mm, while the initial crack depthis 0.1 – 0.4 mm.The calculation of the system failure probability after inspection may be approxi-mated by independent system failure modes (Moan et al., 1999, 2002, 2004) n PFSYS|up = P [ FSYS | I]≈P [ FSYS(U)] + ∑ P ⎡ Fj | I ⎤ ⋅ P ⎡ FSYS(U) | Fj ⎤ +.... ⎣ ⎦ ⎣ j=1 ⎦ (9) .This formulation is based on modeling the ultimate failure of the system by a singlemode. Moreover, the formulation is limited to failure modes initiated by a single fa-tigue failure and followed by ultimate global failure. The failure probability in Eq. (9)is applicable when the inspection event I aims at detecting cracks before the failure ofindividual members, (i.e. before they have caused rupture of the member). Anotherinspection strategy would be to apply visual inspection to detect members failure andrepair failed members after the winter season in which those particular membersfailed. In this case the Eq. (9) will have to be modified as follows: the individual fa-tigue failures of components (Fj ) does not depend on the inspection event, and, rathersuch an inspection and repair strategy will have implication on the time period, forwhich the failure probability P[FSYS(U)|Fj] should be calculated.A further simplification is to update the failure probability of each joint based on theinspection result for that joint. This is conservative if no cracks are detected, but non-conservative if cracks are detected.Inspections may be prioritized by using Eq. (9) for each joint separately by allowing a 20
  • 25. certain target probability level, PfSYS(T) to each term in the sum of Eq. (9). The targetfatigue failure probability for joint i, PFfT(i) is then obtained from PfSYS(i) = P[FSYS | Fi ] ⋅ PFfT(i) ≤ PfSYS(T) (10) where the system failure probability, PfSYS(i) is associated with a fatigue failure ofmember (i) followed by an ultimate system failure. PfSYS(T) is obtained by generalizingthe acceptance criteria implied by Table 4. This approach has been implemented fortemplate-space frame structures (Moan et al., 1999).Given the target level for a given joint, inspections and repairs by grinding or othermodifications are scheduled to maintain the reliability level at the target level asshown in Fig. 14. Reliability level, β No Inspection at time t=8 inspection with no crack detection Target level for a given joint 0 4 8 12 16 20 Time (years) 1st inspection 2nd inspectionFig. 14: Scheduling of inspections to achieve a target safety level of PFfT(i).This methodology is used to calibrate fatigue design requirements. It is then foundthat the criteria in Table 4 are slightly “non-conservative”.3.6 Safety implications of Ultimate and Fatigue Limit State criteria and Inspection,Monitoring, Maintenace and RepairThe failure probability estimated by structural reliability analysis (SRA) normallydoes not represent the experienced Pf for structures. This is because the safety factorsor margins normally applied to ensure safety are so large that Pf calculated by SRAbecomes much smaller than that related to other causes. For instance when properfatigue design checks and inspections have not been carried out, the likelihood of fa-tigue failures (through-thickness cracks) for platforms (e.g. in the North Sea), is largeand cracks have occurred. However, with the exception of the Ranger I (1979) andAlexander Kielland failure (1980) such cracks have been detected before they causedtotal losses. As discussed above, errors and omissions in design, fabrication and op-eration represent the main causes of the accidents experienced.On the other hand, frequent occurrences of cracks provide a basis for correlating ac-tual crack occurrences with state of art predictions for various offshore structures.Hence, the current predictions for jackets are found to be conservative (Vårdal andMoan, 1997), while for semi-submersibles and ships, the predictions seem to be rea-sonable, as summarized by Moan (2004). This agreement is achieved when the SNapproach (or a calibrated fracture mechanics approach) is applied to predict the occur-rence of fatigue failure (e.g. through thickness crack). Yet, if ULS and FLS designchecks are properly carried out, Pf will be “negligible” within the current safety re-gime. This reserve capacity, implied by ULS and FLS requirements, provides some 21
  • 26. resistance against other hazards like fires, explosions etc. However providing safetyfor the mentioned hazards in this indirect manner is not an optimal risk-based design.If more efforts were directed towards risk reduction actions by implementing ALScriteria, then current safety factors for ULS and FLS could be reduced without in-creasing the failure rate noticeably.As explained above, SRA does not provide a measure of the actual total risk levelassociated with offshore facilities. Yet, it is useful in ensuring that the ultimatestrength and fatigue design criteria are consistent by calibrating safety factors. More-over, SRA provides a measure of the influence of various parameters on the reliabilityand, hence, the effect of reducing the uncertainty on the failure probability.Finally, it is noted that the random uncertainties in the ultimate strength commonlyhave limited effect on the reliability compared to that inherent in load effects. On theother hand, the systematic uncertainty (bias) in strength and load effects has the sameeffect on the reliability measure.3.7 Risk assessmentRisk assessment (Qualitative Risk assessment or Formal Safety Analysis etc.) is a toolto support decision making regarding the safety of systems. The application of riskassessment has evolved over 25 years in the offshore industry (Moan and Holand,1981b, NPD (1981)). The Piper Alpha disaster (PA, 1990), was the direct reason forintroducing PRA, (or QRA), in the UK in 1992 (HSE, 1992). In the last 5 years suchmethods have been applied in the maritime industry, albeit in different directions(Moore et al. 2003). The offshore industry has focused on the application of risk as-sessment to evaluate the safety of individual offshore facilities. The maritime industryhas primarily focused on the application of risk assessment to further enhance andbring greater clarity to the process of making new ship rules or regulations.The risk assessment methods is used because they provide a reliable direct determina-tion of events probabilities e.g. probabilities as low as 10-4 per year. Up to now theaccumulated number of platform years world wide is about 120 000, 15 000 and 1 200for fixed, mobile structures and FPSOs, respectively. However, to determine prob-abilities as low as 10-4 per year requires about 23000 years of experiences to have a90% chance of one occurrence. A further complexity is that the available data refer tovarious types of platforms and, not least, different technologies over the years. Appli-cation of a systems risk assessment is therefore attractive. The basis for this approachis the facts that : a)almost every major accidental events have originated from a smallfault and gradually developed through long sequences or several parallel sequencesof increasingly more serious events, and culminates in the final event b) it is oftenreasonably well known how a system responds to a certain event.By combining the knowledge about system build-up with the knowledge about failurerates for the elements of the system, it is possible to achieve an indication of the risksin the system (Vinnem, 1999; Moan, 2000b).The risk analysis process normally consists in the following steps (Fig 15):- definition and description of the system- identification of hazards- analysis of possible causal event of hazards- determination of the influence of the environmental conditions- determination of the influence of active/passive safety systems (capacity; reliabil- ity, accident action integrity, maintenance system …..) 22
  • 27. - estimation of event probabilities/event magnitudes- estimation of risk Risk Analysis Planning Risk Analysis Planning System Definition System Definition Risk Risk Acceptance Acceptance Risk Criteria Hazard Identification Risk Criteria Hazard Identification Reducing Reducing Measures Measures Frequency Consequence Analysis Analysis RISK ESTIMATION RISK ESTIMATION Risk Picture Risk Picture RISK ANALYSIS RISK ANALYSIS Risk Evaluation Risk Evaluation Unacceptable Tolerable Acceptable AcceptableFig. 15: General approach for risk based decision makingIn most cases an Event-Fault Tree technique (Figure 16) is the most appropriate toolfor systematizing and documenting the analyses made. Although the Event-Fault treemethodology is straightforward, there are many problems. An important challenge isto determine the dominant of the (infinitely) many sequences. Events are not uniquelydefined in a single sequence but appear in many combinations. Moreover, human fac-tors are difficult to account for in the risk assessment. However, operational errorsthat result in accidental loads are implicitly dealt with by using data on experiencedreleases of hydrocarbons, probability of ignition etc. Explicit prediction of design andfabrication errors and omissions for a given structure is impossible. However, it ispossible to rate the likelihood of accidents as compared to gross errors (Bea, 2000a-b,Lotsberg et al., to appear).The risk analysis methodology currently applied in offshore engineering is reviewedin detail by Vinnem (1999). In connection with accidental loads, the purpose of therisk analysis is to determine the accidental events which annually are exceeded by aprobability of 10-4. End event Critical eventFault tree Event tree ConsequencesFig.16 Schematic sketch of the event – fault tree method. 23
  • 28. 3.8 Failure probability implied by Accidental Collapse Limit State CriteriaThe initial damage in the ALS criterion, (e.g. due to fires explosions, ship impacts, or,fabrication defects causing abnormal fatigue crack growth), corresponds to a charac-teristic event for each of the types of accidental loads which is exceeded by an annualprobability of 10-4, as identified by risk analyses. The (local) damage, or permanentdeformations or rupture of components need to be estimated by accounting fornonlinear effects.The structure is required to survive in the various damage conditions without globalfailure when subjected to expected still-water and characteristic sea loads which areexceeded by an annual probability of 10-2. In some cases compliance with this re-quirement can be demonstrated by removing the damaged parts and then accomplish-ing a conventional ULS design check based on a global linear analysis and componentdesign checks using truly ultimate strength formulations. However, such methods maybe very conservative and more accurate nonlinear analysis methods should be applied,as described subsequently.The conditional probability of failure in a year, for the damaged structure, can be es-timated by Eqs. (1-2), assuming that the system failure can be modelled by one failuremode and that the design criterion is fully utilized. The design checks in the ALS cri-terion is based on a characteristic value of the resistance corresponding to a 95% or5% fractile, implying a BR = 1.1. The characteristic load effect due to functional andsea loads are 1.0-1.2 and 1.2-1.3 of the corresponding mean annual values, respec-tively. The safety (load and resistance) factors are generally equal to 1.0 for bothchecks. For environmental loads, this conditional failure probability will be of theorder of 0.1.The intended probability of total loss implied by the ALS criterion for each categoryof abnormal strength and accidental load would then be of the order of 10-5 (Moan,1983). Obviously, such estimates are not possible to substantiate by experiences.3.9 Design for damage toleranceIntroductionThe current regulations for offshore structures in Norway are based on the followingprinciples:- Design the structure to withstand environmental and operational loading through- out its lifecycle.- Prevent accidents and protect against their effects- Tolerate at least one failure or operational error without resulting in a major haz- ard or damage to structure- Provide measures to detect, control, and mitigate hazards at an early time acciden- tal escalation.Accidental Collapse Limit State criteria can be viewed as a means to reduce the con-sequences of accidental events (Fig. 17). The NORSOK N-001 code specifies quanti-tative ALS criteria based on an estimated damage condition and a survival check. Therobustness criteria in most other codes, however, do not refer to any specific hazardbut rather require that progressive failure of the structure with one element removed ata time, is prevented. Hence, no performance objective for a “real threat” is created. 24
  • 29. The weakness with such a criterion is that it does not distinguish between the differ-ences in vulnerabilityIn a risk analysis perspective the ALS check of offshore structures is aimed at pre-venting progressive failure and hence reduce the consequences due to accidentalloads, as indicated in Figure 17. Beside progressive structural failure, such eventsmay induce progressive flooding and hence the capsizing of floating structures. P, F • Estimate the damage due to accidental loads (A) Risk control of accidental events at an annual probability of 10 -4 A - apply risk analysis to establish A design accidental loads Reduce probability Reduce consequences "unknown "known events" Critical events" event Indirect design Fault Event treeReduce Direct ALS design - robustness treeerrors & - Abnormal resistance P, F End events: Event - redundancy Accidental loadsomissions Control - Accidental loads - ductility • Survival check of the damaged structure as a whole, considering P, F and environmental loads ( E ) at a probability of 10 -2 Risk Analysis, or, Target annual probability of total loss: Prescriptive code requirements 10 -5 for each type of hazard EFig. 17: The role of ALS in risk control Fig. 18: Accidental Collapse Limit State (NPD, 1984)The relevant accidental loads and abnormal conditions of structural strength aredrawn from the risk analysis, see e.g. Vinnem (1999) and Moan (2000b), where therelevant factors that affect the accidental loads are accounted for. In particular, therisk reduction can be achieved by minimizing the probability of initiating events:leakage and ignition (that can cause fire or explosion), ship impact, etc. or by mini-mizing the consequences of hazards. The passive or active measures can be used tocontrol the magnitude of an accidental event and, thereby, its consequences. For in-stance, fire loads are partly controlled by sprinkler/inert gas system or firewalls.Fenders are commonly used to reduce the damage due to collisions.ALS checks apply to all relevant failure modes as indicated in Table 6. An account ofaccidental loads in conjunction with the design of the structure, equipment, and safetysystems is a crucial safety measure to prevent escalating accidents. Typical situationswhere direct design may affect the layout and scantlings are indicated by Table 7 fordifferent subsystems: - loads-carrying structure & mooring system - process equipment - evacuation and escape system 25
  • 30. Table 6 Examples of accidental loads for relevant failure modes of platforms.Structural Failure mode Relevant accidental load or conditionconceptFixed platforms Structural failure All Structural failure AllFloating Instability • Collision, dropped object, unintendedplatforms pressure…, unintended ballast that initiate flooding Mooring system strength • Collision on platform • Abnormal strengthTension-leg plat- Structural failure Allforms Mooring - slack • Accidental actions that initiate flooding system - strength • Collision on platform • Dropped object on tether • (Abnormal strength)Table 7 Design implications of accidental loads for hull structure Passive protection Load Structure Equipment system Columns /deck (if not pro- Exposed equipment (if notFire Fire barriers tected) protected) Exposed equipment (if not Blast / FireExplosion Topside (if not protected) protected) barriersShip Waterline structure (subdivi- Possibly exposed risers, (if Possible fenderimpact sion) (if not protected) not protected) systems Equipment on deck, risersDropped Impact Deck Buoyancy elements and subsea (if not pro-object protection tected)Design accidental loadsThe characteristic value of accidental loads is defined as the load which annually isexceeded by a probability of 10-4 and should be determined by risk analysis. For eachphysical phenomenon (fire, explosions, collisions, ..) there is normally a continuousspectrum of accidental events. A finite number of events have to be selected byjudgement. These events represent different load intensity at different probabilities.The characteristic accidental load on different components of a given installation canbe determined as follows (Moan, 2000b): - establish exceedance diagram for the load on each component - allocate a certain portion of the reference exceedance probability (10-4) to each component - determine the characteristic load for each component from the relevant load exceedance diagram and reference probability.If the accidental load is described by several parameters (e.g. heat flux and durationfor a fire; pressure peak and duration for an explosion) design values may be obtainedfrom the joint probability distribution by contour curves (NORSOK N-003, 1999). 26
  • 31. However, in view of the uncertainties associated with the probabilistic analysis, amore pragmatic approach is sufficient. Yet significant analysis efforts are involved inidentifying the relevant design scenarios for the different types of accidental loads.For each design accident scenario, the damage imposed on the offshore installationneeds to be estimated followed by an analysis of the residual ultimate strength of thedamaged structure in order to demonstrate survival of the installation. To estimatedamage, (permanent deformation, rupture etc of parts of the structure), the nonlinearmaterial and the geometrical structural behaviour need to be accounted for. While ingeneral the nonlinear finite element methods are applied, simplified methods (e.g.based on plastic mechanisms) are developed and calibrated using more refined meth-ods, to limit the computational effort required.The risk analysis of novel structures and systems, is found to be useful, in that theyprovide insight which results in systems that have significant increase in safety at thesame expense. This applies in particular to the topside system. However, for maturesystems, the outcomes of risk analyses tend to confirm the results of previous analy-ses. This fact together with the desire to simplify design practice suggests using spe-cific, generic values for such cases. Examples of typical values for some accidentalloads are given in subsequent sections.Analysis tools for estimating the initial damage and survivalCurrent ultimate strength code checks of marine structures are commonly based onload effects (member and joint forces) that are obtained by a linear global analysis.Experiments or theory which accounts for plasticity and large deflections are used toobtain resistances of the members and joints. Hence, this methodology focuses on thefirst failure of a structural component and not the overall collapse of the structure,which is of main concern. The advent of computer technology and the finite elementmethod have made it possible to develop analysis tools that account for nonlineargeometrical and material effects, and, therefore, make it possible to account for redis-tribution of the forces and subsequent component failures until the system’s collapse.By using such methods a more realistic measure of the overall strength of structures isachieved. Recently, Skallerud and Amdahl (2002) prepared a state-of-the-art reviewof methods for nonlinear analysis of space frame offshore structures. Paik and Tha-yamballi (2003) gave an overview of methods for ultimate strength analysis of steel-plated structures.Simplified methods for calculating the hull girder strength are based on considerationsof the intact longitudinal elements and beam theory, essentially based on Smith’swork (1977), and reviewed by e.g. Yao et al. (2000). Such an approach has also beenextended to estimate the ultimate capacity of the damaged hull girder (Smith, 1977).However, it is necessary to further investigate the implication of an initial damage thatinvolves rupture and, hence, represent an initial crack type damage which could causerupture before reaching the ultimate capacity obtained by calculation models basedupon ductile material behaviour.Fires and explosions effectsThe dominant fire and explosion events are associated with hydrocarbon leak fromflanges, valves, equipment seals, nozzles etc. As indicated in Fig. 19 fire and explo-sion events are strongly correlated. Commonly the effect of 40 – 60 scenarios needs tobe analyzed. This means that the location and magnitude of relevant hydrocarbon 27
  • 32. leaks, the likelihood of ignition, as well as the combustion and temperature develop-ment (in a fire) and the pressure-time development (for an explosion) need to be esti-mated and followed by a structural assessment of the potential damage. No damage No Ignition Damage to Personnel and Material Immediate Ignition FireRelease ofGas and/orLiquid Formation of Fire Combustible Fuel-Air Cloud (Pre-mixed) Ignition Gas Explosion (delayed) Fire and BLEVEFig. 19: Fire and explosion scenarios.The fire thermal flux may be calculated on the basis of the type of hydrocarbons, itsrelease rate, combustion, time and location of ignition, ventilation and structural ge-ometry, using simplified conservative semi-empirical formulae or analyti-cal/numerical models of the combustion process. The heat flux may be determined byempirical, phenomenological or numerical method (SCI, 1993; BEFETS, 1998).Typical thermal loading in hydrocarbon fire scenarios may be 200- 300 kW/m2 for a15 minutes up to a two hours period. The structural effect is primarily due to the re-duced strength with increasing temperature. An A-60 fire protection wall may be ap-plied for a heat load of 100kW/m2 and less, while H-rated protection walls are neededfor higher heat loading.In the case of explosion scenarios, the analysis of leaks is followed by a gas disper-sion and possible formation of gas clouds, ignition, combustion and the developmentof overpressure. Tools such as FLACS, PROEXP, or AutoReGas are available for thispurpose (Moan, 2000b; Czujko, 2001, Walker et al., 2003). The variability of condi-tions is accounted for by using a probabilistic approach.The results from the gas explosion simulations are the pressure – time history. If thepressure duration is short compared to the natural period, the pressure impulse gov-erns the structural response. Figure 20 compares the predicted impulse by state of astate of the art CFD method with measured values in large scale tests for deterministicexplosion scenarios. The vertical axis is a logarithmic plot of the ratio of the predictedand measured value. The scattering is seen to be significant. The pressure peakswould obviously be even more uncertain. 28
  • 33. 10.0 Ratio of predicted and measured Impulse 1.0 0.1 Experiment NoFig. 20: Comparison of predicted and measured pressure impulse for “deterministic” explosion scenarios, obtained by the computer code FLACS.The typical overpressures for topsides of North Sea platforms are in the range 0.2-0.6barg, with duration of 0.1-0.5s., while an explosion in open air at the drill floor typi-cally implies 0.1 barg with duration of 0.2s. The explosion pressure in a totally en-closed compartment might be 4 barg.The damage due to explosions may be determined by simple and conservative single-degree-of freedom models (NORSOK N-004). In several cases where simplifiedmethods have not been calibrated, nonlinear time domain analyses based on numericalmethods like the finite element method should be applied. A recent overview of suchmethods may be found in Czujko (2001). Fig. 21 shows an explosion panel with de-formations as determined by an experiment and finite element analysis. The calcu-lated and measured deflections of the specimen are compared in Figure 21c.Fire and explosion events that result from the same scenario of released combustiblesand ignition should be assumed to occur at the same time, i.e. to be fully dependent.The fire and blast analyses should be performed by taking into account the effects ofone on the other. The damage done to the fire protection by an explosion precedingthe fire should be considered. 0.7 0.6 0.5 0.4 0.3 PRESSURE [N/ 0.2 0.1 Experiment Analysis 0 0 20 40 60 80 100 2] DISPLACEMENT [mm]a) Experiment b) FE analysis c) Load–response historiesFig. 21: Explosion response of an explosion wall (Czujko, 2001). 29
  • 34. Pmax > 5barFig. 22: “Survival analysis” of a deck suffering explosion damage (Amdahl, 2003). Deformations in the lower figure are not to scale.Fig. 22 shows results from an analysis of a deck structure in a floating platform (Am-dahl, 2003). The upper left figure in this slide illustrates the deck structure of a float-ing production platform. The design pressure on the East Wall is also indicated. Inthis case it is assumed that the panels are badly damaged that they can be removed.The lower figure shows the deformation pattern of the damaged deck.Ship impactsSignificant efforts have been devoted to ship-ship collisions, as reviewed by the ISSCCommittee on Collision and Grounding (Paik et al., 2003). The analysis of ship im-pacts on offshore structures follows the same principles but the collision scenarios andconsequences are different; see e.g. NORSOK N-003 and -004 as well as Amdahl(1999).All ship traffic in the relevant area of the offshore installation should be mapped andshould account for possible future changes in the operational pattern of vessels. Theimpact velocity can be determined based on the assumption of a drifting ship or on theassumption of erroneous operation of the ship. Ship traffic may therefore for this pur-pose be divided into categories: trading vessels and other ships outside the offshoreactivity, offshore tankers, and supply or other service vessels. Merchant vessels areoften found to be the greatest platform collision hazard which depends upon the loca-tion of the structure relative to shipping lanes. Fig. 23a indicates situations where off-shore structures are operating in close proximity. For the scenario in Fig. 23b the sternimpact on the FPSO by the shuttle tanker is a challenge (Chen and Moan, 2004 ) 30
  • 35. a) Semi- submersible and jacket b) FPSO and shuttle tankerFig. 23: Special offshore collision scenarios.Impact scenarios are established by considering bow, stern, and side impacts on thestructure as appropriate.While historical data provides information about supply vessel impacts, risk analysismodels are necessary to predict other types of impacts, such as incidents caused bytrading vessels (see e.g. NORSOK N-003(1999) and Moan (2000b)). A minimumaccidental load corresponding to 14 MJ and 11 MJ sideways and head-on impact, re-spectively, is required to be considered.The impact damage can normally be determined by splitting the problem into twouncoupled analyses. They are the external collision mechanics dealing with globalinertia forces and hydrodynamic effects and internal mechanics dealing with the en-ergy dissipation and distribution of damage in the two structures (Fig. 24).The external mechanics analysis is carried out by assuming a central impact and ap-plying the principle of conservation of momentum and conservation of energy.The next step is to estimate how the energy is shared among the offshore structure andthe ship. Methods for assessing the impact damage are described by Amdahl (1999),based on simplified load-indentation curves or direct finite element analysis. For thegeneral case where both structures absorb energy, the analysis has to be carried outincrementally on the basis of the current deformation field, contact area and forcedistribution over the contact area. External mechanics The fraction of the kinetic energy to be absorbed as deformation energy (structural damage) is determined by means of: Conservation of momentum Conservation of energy External mechanics Rs Ri Internal mechanics Energy dissipated by vessel and offshore structure Es,s Es,i Equal force level Ship Area under force-def. curve dws FPSO dwi Internal mechanicsFig. 24: Simplified methods for calculating impact damage (NORSOK N- 004) 31
  • 36. The recent advances in computer hardware and software have made nonlinear finiteelement analysis (NLFEM) a viable tool for assessing collisions. A careful choice ofelement type and mesh is required. It is found that a particularly fine mesh is requiredin order to obtain accurate results for components deformed by axial crushing. A ma-jor challenge in NLFEM analysis is the prediction of ductile crack initiation andpropagation. This problem is yet to be solved. The crack initiation and propagationshould be based on fracture mechanics analysis using the J-integral or Crack TipOpening Displacement method rather than simple strain considerations.While the main concern about ship impacts on fixed platforms is the reduction ofstructural strength and possible progressive structural failure, the main effect forbuoyant structures is damage that can lead to flooding and, hence, loss of buoyancy.The measure of such damages is the maximum indentation implying loss of watertightness. However, in the case of large damage, reduction of structural strength, asexpressed by the indentation, is also a concern for floating structures.A ship impact involving the minimum energy of 14 MJ will normally imply an inden-tation of 0.4 – 1.2 m in a semi-submersible column. A 75-100 MJ impact may be re-quired to cause an indentation equal to the column radius (Moan and Amdahl, 1989).The effect is highly dependent upon the location of impact contact area relative todecks and bulkheads in the column.Moan and Amdahl (2001) considered supply or merchant vessels with a displacementof 2000- 5000 tons which caused bow impacts on a typical side structure of an FPSOwith displacement of about 100 000 t. For this case the limiting energy for rupture ofthe outer ship side was found to be ~10 MJ (700mm bow displacement). The energyat 1500mm bow indentation was estimated to be ~43 MJ while the limiting energy forrupture of the inner side is ~230 MJ, at 3700 mm bow displacement. This correspondsto a critical speed of 18.5 knots for a 5000 tons displacement vessel. We recall thatrupture of plate material is very uncertain such that the quoted energy level should beused with cautiously. If the FPSO side structure is assumed to be sufficiently rigid toensure that all energy is absorbed by the bow, then the maximum collision force (peakforce) is 30 MN. However most of the time the force oscillates between 15-25 MN.Another situation dealt with by Moan and Amdahl was stern impact on the FPSOcaused by a shuttle tanker, see Fig. 23b and 25. A 70 kdwt shuttle tanker was foundto penetrate the machine room of a 140 kdwt FPSO after an energy dissipation of 38MJ. On the other hand, it was demonstrated that it was feasible to strengthen the sternof the FPSO corresponding to ice-strengthening dimensions so that all dissipationcould occur in the shuttle tanker bow. F o r ca s tle d ec k Shuttle tanker d ec k U p p er FPSOFig. 25: Shuttle tanker in ballast condition impacting FPSO stern (Moan and Amdahl, 2001). 32
  • 37. Environmental eventsThe ALS criterion is supposed to be applicable to any “abnormal” wave loading aswell. Obviously, the two-step ALS procedure then becomes a survival check based ona load event which annually is exceeded by a probability of 10-4. Consider a waveloading, F, which for simplicity is characterised only by the wave height, H. Assumethat F is a smooth function of wave height. H i.e. F=c⋅Hα and that the wave heightfollows a Weibull distribution with a shape parameter B. If it is assumed that there are5·108 waves in 100 years, the ratio between the loads at a 10-4 and 10-2 annual prob-ability level, respectively, becomes Fc(-4)/Fc(-2) = (H(-4)/H(-2))α = (1.23)α/B. The ratio ofthe required strength would then be Rc(-4)/Rc(-2) = Fc(-4)/ (γT Fc(-2) ) = 1.23α/B/γT where γTis the total ULS safety factor while the safety factor for ALS is 1.0. This implies thatULS will be governing for North Sea and other conditions (B=0.9-1.0) if α< 1.8-2.0.In benign conditions (e.g.with B=0.6) ULS will be governing if α< 1.2. Courtesy: Statoil, MarintekFig. 26: Wave in deck load for a fixed platformHowever, there are two issues that need to be observed in this connection. The firstissue is the occurrence of possible “abnormal” waves, with high crest or other unusualshape – which is not a simple “extrapolation” of the 10-2 event (Haver, 2000, Prevostand Forristall, 2002). The second issue is the possible sudden change in force, F, at acertain wave height. The most interesting case is when the wave reaches the platformdeck, implying that the wave force will increase very fast with the wave height. Byensuring a deck clearance such that the 10-4 crest does not reach the deck, the ULScriterion would normally be governing. Otherwise, the ALS criterion based on the 10-4 wave event may govern the dimensions.Abnormal resistanceIt is not possible to determine the abnormal resistance (e. g. due to fabrication de-fects), using risk analyses. Up to now, abnormal resistance has been explicitly speci-fied by generic values for specific types of structures based on some considerations ofthe vulnerability of the structural components. For instance, the ALS check is carriedout for platforms with slender braces by considering the damage in terms of severedindividual braces. This condition was established in the aftermath of the AlexanderKielland accident and was initially aimed to cover the effects of frequently occurringship impacts relating to supply vessels as well as abnormal fatigue cracks. This dam-age condition is also applicable to the tether and other mooring systems. 33
  • 38. Crack controlMost degradations of the structure are due to corrosion and crack growth. The effectof corrosion is ameliorated by corrosion allowance or a protection system, whichmakes the corrosion development gradual and, hence, be easy to control. The crackgrowth is more critical because cracks can result is a sudden rupture. Moreover,cracks are hard to detect because they are small for a significant part of the time ser-vice life.Abnormal defects, i.e. defects much larger than those implicit in fatigue design curves,are also of concern. As mentioned by Moan (2004), observations with jackets showthat 2-3 % of cracks found in inspections can be attributed to abnormal defects. Thisalso occurs in other offshore structures.Therefore, the crack control strategy, in general needs to include a combination of thefollowing safety measures:- design for adequate fatigue life and critical crack size- design for robustness in relation to member failure- plan inspection of the as-fabricated structure as well as during the service life, pos- sibly using the Leak Before Break principleAn adequate design fatigue life gives ample time to detect cracks. For instance, if thefatigue life from the occurrence of a through thickness cracks to rupture is 25 % of thefatigue life determined by SN-curves, a 20-year characteristic life implies a character-istic value of the time to failure of 5 years and a mean time to failure of 15 years aftera possible leak.The implementation of the Accidental Collapse Limit State criteria obviously pro-vides a safety barrier with respect to the system failure given the fatigue failure of amember in a framed structure.When inspections are prioritised, the potential of gross fabrication defects (e.g. be-cause of difficult access), should also be considered. Since inspections after fabrica-tion on shore can be carried at less costs and with higher reliability than during opera-tion offshore, it is worthwhile to emphasise such inspections, at least for critical com-ponents.Different strategies may be relevant for different types of offshore structures. This isbecause the existing structures possess different robustness and because inspection,repair and failure costs vary significantly.As an example of structural components with particular safety focus, consider tethersin TLPs. They are designed with a Fatigue Design Factor of 10 and the ALS criterionis implemented by requiring survival of any tether failed. Moreover, the tethers in theHeidrun platform in the North Sea, are tubular members which were joined by buttwelds ground flush and were inspected twice with respect to surface defects on theoutside and the inside of the tubular wall. Furthermore a 60-70 % X-ray examinationfor internal defects after fabrication was carried out in the yard. The first service in-spection is now taking place after 10 years in service.The crack control in semi-submersibles with slender braces is based on a balancedfatigue design criterion and ALS according to Table 4 as well as leak detection duringoperation.A major difference between a trading tanker and an FPSO is that the routing, thespeed reduction and the heading angle toward wave can be used for the tanker to re- 34
  • 39. duce wave loads, but not for the FPSO. Also, a dry-docking for inspections is morecomplicated for FPSOs because it needs to be stationary at the offshore site. The fa-tigue criteria for FPSOs were established before they became common practice fortankers (Bach-Gansmo et al., 1987). Normally, the required cumulative damage is D= 1.0 for a 20-year service life for production ships. The thousands of welded joints ofsimilar type and location encountered in the ships imply a high probability of fatiguecracking which suggests application of a more restrictive fatigue criterion. On theother hand, the significant residual strength of damaged ships makes it possible todetect cracks using the leak-before-break detection and a close visual inspection.However, it is desirable to clarify the crack propagation and critical crack length oflarge cracks. The critical crack length estimated by current methods, (e.g. BS 7910,1999) is found to be much smaller than crack lengths experienced in ship hulls. Thetreatment of residual stresses and constraint seems to be important factors in this con-nection (Bjørheim et al., 2004). However, this issue is still open for debate.However, for economical reasons, it may be advantageous to apply more restrictivefatigue criteria when the consequences are high. This may be the case when the crackcauses a leak from the cargo tank into the ballast tank, leading to an explosion hazard.For that matter, the number of potential crack sites in FPSOs and tankers emphasisessuch a consideration.Novel structures, for which there is no or limited service experiences, need a morerigorous monitoring and inspection, until adequate confidence is gained. This is be-cause new structures involve a high utilisation of static strength, new structural de-tails, possibly with high stress concentration, as well as large uncertainty in the re-sponse.3.10 Quality assurance and control of the design processThe quality assurance and control of the engineering process have to address two dif-ferent situations, which require different type of attention, namely:- detect, control and mitigate errors made in connection with technology that is known in the engineering community as such- identify possible unknown phenomena, e.g. associated with load, response and resistance, and clarify the basis for accounting for such phenomena in designOffshore structures are developed in several stages: conceptual, engineering and de-tailed engineering phases. QA/QC needs to be hierarchical, too, with an emphasis ofthe latter QA/QC process in the conceptual and early design phases.Errors can occur due to individual errors and omissions, inadequate procedures, soft-ware and lack of robustness of the organizations. Errors of omission and commission,violations (circumventions), mistakes, rejection of information, and incorrect trans-mission of information (communication errors) have been the dominant causes offailures. The lack of adequate training, time, and teamwork or back-up (insufficientredundancy) have been responsible for not detecting and correcting many of theseerrors (Bea, 2000b).With the advent of computers and their integration into many aspects of the design,construction, and operation of oil and gas structures, software errors are also a con-cern. Newly developed, advanced, and frequently very complex design technologyapplied in the development of design procedures and the design of the offshore struc-tures has not been sufficiently debugged and failures have resulted. 35
  • 40. Software errors, in which incorrect and inaccurate algorithms were coded into com-puter programs, have been at the root-cause of several recent failures of offshorestructures. Guidelines have been developed to address the quality of the computersoftware for the performance of finite element analyses. An extensive benchmark test-ing is required to assure that the software performs as it should and that the documen-tation is sufficient. One particular importance is the provision of independent check-ing procedures that can be used to validate the results from analyses.It is found that errors are often made by individuals in organizations with a culturethat does not promote quality and reliability in the design process. The culture and theorganizations do not provide the incentives, values, standards, goals, resources, andcontrols that are required to achieve adequate quality.The loss of corporate memory in companies responsible for structural safety also hasbeen a factor contributing to many cases of structural failures. Knowledge of the pain-ful lessons in the past was lost and the lessons were repeated with generally evenmore painful results. Such loss of corporate memory is particularly probable in timesof down-sizing, outsourcing and mergers (Bea, 2000a-b).QA/QC of the engineering processQA is the proactive process in which the planning is developed to help preserve desir-able quality. QC is the interactive element in which the planning is implemented andcarried out. QA/QC measures are focused both on error prevention and error detectionand correction (Harris and Chaney, 1969). There can be a real danger in excessivelyformalized QA/QC processes. If not properly managed, they can lead to generation ofpaperwork, a waste of scarce resources that can be devoted to QA/QC, and a mini-mum compliance mentality.It is important that the QA/QC is hierarchical, in other words it should be performedby designers and others doing the work, their colleagues, and third parties. While self-checking is very important, Matousek and Schneider (1976) found that 87% of theerrors causing accidents in the construction industry, could have been detected eitherby the person next in line or by properly organized additional checks. Therefore, anadditional QA/QC is necessary. A good support in organization by experienced man-agers, who have daily responsibilities for the quality of the project organizations andprocesses, is crucial. In the same way as the structure should be damage tolerant, thedesign organizations also need to be robust. It is when the organization or the operat-ing team encounters defects and damage – and is under serious stress, that the benefitsof robustness become evident. Robust organizations have extensive auditing proce-dures to help spot safety problems and they have reward systems that encourage riskmitigating behaviours.Nevertheless, knowledgeable, trained, experienced, and sensitive third parties canhelp, encourage, and assist the owners of the concept to improve. The third-party QAand QC checking measures which are an integral part of the offshore structure designprocess provide an independent review. This checking should start with the basictools (guidelines, codes, computer programs) of the structure design process to assurethat ‘standardized errors’ have not been embedded in the design tools. The checkingshould continue through the major phases of the design process, with a particular at-tention given to the loading analysis. Moreover the plans for fabrication and operation(manuals) also constitute an important part of the QA and QC process. The provisionof adequate resources and motivations is also necessary, particularly the willingness 36
  • 41. of management and engineering to provide integrity to the process and to be prepared to deal adequately with ‘bad news’. The true value of QA and QC lies in the disciplined process. The main objective of QA/QC is detection of errors and omissions and not their prediction. Yet the attempt made by Lotsberg et al. (to appear) is an interesting effort to assess the risk associated with gross errors and omissions. Unfortunately, sometimes the results of formal risk analysis approaches are only used to justify a compliance with regulatory targets and, in some cases the implementation is not clearly justified and needs improvements in the reliability of an engineered system. The intensity and the extent of the design checking process need to be matched to the particular design situation. Repetitive designs that have been adequately tested in op- erations to demonstrate that they have the required quality do not need to be verified and checked as closely as those that are ‘first-offs’ and ‘new designs’ that may push the boundaries of the current technology. New technologies compound the problems of latent system flaws (Reason, 1997). Identification of new phenomena The early phases of design are particularly important for the QA and QC of novel concepts. Novel concepts that could imply new physical phenomena relating for in- stance to loads and response need particular attention. Examples of phenomena “dis- covered” in the recent two decades include the ringing experienced in connection with the Draugen mono-tower shown in Fig. 27. In this case the extreme loading increased by about 30% due to a particular combination of hydrodynamic excitation on large diameter columns and a natural structural period in the range of 2-8s. The phenome- non was discovered when most of the manufacturing process had been completed. So, the safety was ensured by operational restrictions. Another example is the high fre- quency springing and ringing response of TLPs. It is noted that these phenomena, like many others in the history of offshore structures, became important due to a combina- tion of nonlinear wave load excitation at certain natural structural frequencies. Model testing is crucial in this connection. Another recent, but more obvious, issue is the possible ship impact scenario associated with the tandem off-loading. • Offshore structural engineeringtoday Ø - partlymature 16.4m (m anyaspectsof fixedplatformtechnology) 267m - partlyinnovative technologyem erging (e.g. in relatingto floatingplatforms/ risers/offloadingof gas) Ø 44.5m • QA/QC of novel conceptsrepresent 30 particular challenges - requiresrobust control, i.e. indepent reviews 20 - InnovationdependsuponR&D 10Moment (kNm) 0 -10 -20 -30 Linear analysis Lineæ beregning r e.g. Ringing in the Draugen platform Ikkelineæ beregning r -40 Nonlinear analysis 1860 1865 1870 1875 1880 1885 1890 1895 1900 Tim (s) e Fig. 27: Ringing in Draugen monotower Fig. 28: Springing and ringing in TLP 37
  • 42. From a safety point of view, the most important issue is to identify a new phenome-non that represents a new or altered hazard. When it is identified, the uncertaintiesassociated with the hazard are commonly accounted for by conservative design ap-proach. However, there is a strong incentive to reduce the uncertainties to limit thedesign conservatism for economical reasons.To a large extent the offshore industry has matured. Yet, the development of new off-shore facilities are still expected in the future, for instance in connection with newenvironmental conditions- i.e. involving new combinations of wind waves and swellor ice or use of novel concepts in connection with production and transport of lique-fied natural gas. Then sloshing in FPSOs with several “slack tanks” as well as possi-ble interaction between fluid in tanks and rigid body motions of the vessels, need at-tention. In general, the aging of the existing offshore structures, especially due tocrack growth, needs attention in the years to come. S afe ty issu es C o m plex and com pact p rocess facility (fire/e xplosion hazards) C o nsequence of LN G leakage P rocess near sto rage facility (m ight im ply e scalation of fire..) C a rgo transfe r in open sea s F loa ting production of LN G S loshing of LN G in partly filled tanks (m ight im pair ta nk integrity) O p e ration of vessels close to p roduction/term inal fa cilities (collision hazard) O ffsho re off-loa ding term ina ls (a w a y from den sly populate d a rea s and busy ports)Fig. 29: Safety assessment of transport system for Liquefied Natural Gas4. Concluding remarksVarious measures to ensure an adequate safety in offshore structures have been re-viewed based upon relevant accidents. A design criteria as well as load and structuralanalysis methods have been briefly presented. It is demonstrated how structural reli-ability analysis can be used to establish consistent design criteria for ultimate resis-tance and fatigue, and especially how refinement of analysis methods and additionalinformation reduce uncertainty and hence the necessary safety factors. On the otherhand, it is shown that the failure probability implied by current ultimate and fatiguelimit state criteria is small and does not show up in the accident statistics. The maincause of accidents is human and organizational errors and omissions. Therefore, toachieve an acceptable safety level, QA and QC of the engineering process are re-quired. This includes inspection, monitoring and repair of the structure, as well asdesign for structural robustness. The QA and QC tasks, to possibly identify new phe-nomena, especially associated with the loading and dynamic response, are particularlychallenging in connection with novel concepts for new environmental conditions ornew functions. In this paper, a particular emphasis is placed on the Accidental Col-lapse Limit State design check related to accidental loads and abnormal strength. The 38
  • 43. philosophy behind this robustness criterion is described and it is shown how informa-tion has been established for a proper implementation of the criterion. In the view ofthe aging of offshore structures, crack growth and rupture are particularly addressed.It is shown how fatigue and robustness design criteria, as well as inspection strategycan be combined for different types of offshore structures, to yield an acceptablesafety level.AcknowledgementI would like to acknowledge the invitation to serve a Keppel Professor at the NationalUniversity of Singapore as well as the cooperation with its Department of Civil Engi-neering and the Centre for Offshore Research and Enginneering. I would also like tothank the many people I have been working with in carrying out the research as wellas code development for the Norwegian Petroleum Directorate, ISO and other regula-tory bodies that are reported in this paper. They particularly include J. Amdahl, S.Fjeld, S. Haver, I. Holand (deceased), D. Karsan, J. Lloyd and J.E.Vinnem. The opin-ions expressed, however, are those of the author.ReferencesALK (1981) “The Alexander L. Kielland Accident”, (in Norwegian – English translation available), NOU 1981:11, Oslo.Almar-Næss, A. (ed.) (1985). ‘Fatigue Handbook for Offshore Steel Structures’, Tapir Publ., Trondheim.Amdahl, J. (1999) ‘Structural Response to Accidental Loads’, Lecture Notes, Dept. of Marine Technology, Norwegian University of Science and Technology, Trondheim.Amdahl, J. (2003) FABIGAPI (1993/1997) ‘Recommended Practice for Planning, Designing and Constructing Fixed Offshore Platforms”, API RP2A-WSD July 1993 with Supplement 1 with Sect., 17.0, ‘As- sessment of Existing Platform’, February 1997. American Petroleum Institute, Dallas.Ayala-Uraga, E. and Moan, T. (2002) “System Reliability issues of Offshore Structures con- sidering Fatigue Failure and Updating based on Inspection”, First Int. ASRANet Collo- quium, Glasgow, Scottland.Bach-Gansmo, O., Carlsen, C.A. and Moan, T. (1987) “Fatigue Assessment of Hull Girder for Ship Type Floating Production Vessels,” Proc. Conf. on Mobile Offshore Units, London: City University.Bea, RG (2000a) Achieving step change in Risk Assessment & Management (RAM), Centre for Oil & Gas Engineering,, University of Western Austra- lia, Nedlands, WA.Bea RG (2000b) Performance Shaping Factors in Reliability Analysis of Design of Offshore Structures, J. OMAE, Vol. 122, ASME, New York, NY.Beckwith, I. and Skillman, M. (1975) “Assessment of the Stability of Floating Platforms”, North East Coast Inst. of Naval Architects.BEFETS (1998) ‘Blast and Fire Engineering for Topside Systems’, Phase 2, SCI Publication No. 253, Ascot, UK.Bjørheim, L., Berge, S. and Skaret, H. (2004) “Damage Tolerance of FPSOs with Fatigue Cracks”, Proc. ISOPE Conference.Broughton, P. (1997) "Engineering Challenges of Ekofisk, the First North Sea Oil Field’, Proc. 8th BOSS Conf., Pergamon Press, New York, Vol. I, pp 41-70.BS 7910 (1999) “Guidance on Methods for Assessing the Acceptability of Flaws in Fusion Welded Structures”, BS 7910:1999, British Standard, London, UK.Chen, H. and Moan, T. (2004) “Probabilistic Modeling and Evaluation of Collision between 39
  • 44. Shuttle Tanker and FPSO in Tandem Offloading”, J. Reliability Engineering and System Safety, 84, 2, 169-186.Cornell, C.A. (1995) “Structural Reliability- Some contributions to Offshore Technology“, Paper No. OTC 7753, Proc. 27th Offshore Technology Conference, Houston.Czujko, J., ed. (2001) ‘Design of Offshore Facilities to Resist Gas Explosion Hazard’, Engi- neering Handbook, Offshore Design, Oslo.Dunlap, W.A., and Ibbs, C.W. (eds) (1994) Proc. Int. Workshop on Assessment and Requali- fication of Offshore Production Structures, New Orleans, Offshore Technology Research Center, Texas A&M University and University of California, Berkeley, CA.Fjeld, S. (1977) “Reliability of Offshore Structures”, Paper No. OTC 3027, Proc. 9th Offshore Technology Conf., Houston, Vol. 4, 459-472.Harris, D. and Chaney, F. (1969) “Human Factors in Quality Assurance”, John Wiley & Sons, London, UK.Haver, S., ( 2000) “Evidences of the Existence of Freak Waves”, Proc. Rogue Waves 2000, Brest, France, 129-140.HSE (1992) “Safety Case Regulations”, Health and Safety Executive, HMSO, London.ISO 19900 (1994) ‘Petroleum and Natural Gas Industries – Offshore Structures – Part 1: General Requirements’, (1994), ‘Part 2: Fixed Steel Structures’, (2001), Draft,. Int. Stan- dardization Organization, London.ISO 2394 (1998) “General Principles on Reliability for Structures”, International Standards Organisation, London., Draft for approval.ISSC (1988-1994) Proceedings of the International Ship and Offshore Structures Congress in 1988 (Lyngby, Denmark); 1991 (Wuxi, China); 1994 (St.Johns, Canada).Jordaan, I.J. and Maes, M.A. (1991) “Rational for Load Specifications and Load Factors in the New CSA Code for Fixed Offshore Structures”. C.J. Civil Engng. 18, 3, 454-464.Lloyd, J.R. and Karsan, D.I. (1988) “Development of a Reliability-based Alternative to API RP2A”, Paper No. OTC 5882, Proc. 20th . Offshore Technology Conf., Vol. 4, Houston, 593-600.Lotsberg, I. et al. (to appear) “Risk Assessment of Loss of Structural Integrity of a Floating Production Platform due to Gross Errors”, J. Marine Structures.Madsen, H.O. & S.D. Sørensen (1990). “Probability-Based Optimization of Fatigue DesignInspection and Maintenance”. Presented at Int. Symp. on Offshore Structures, University of Glas-gow.Matousek, M. and Schneider, J. (1976) “Untersuchungen Zur Struktur des Zicherheitproblems bei Bauwerken”, Institut für Baustatik und Konstruktion der ETH Zürich, Bericht No. 59, ETH, Zürich.Melchers, R.E. (1999) “Structural Reliability Analysis and Prediction”, John Wiley & Sons, Chichester, UK.Moan, T.(1983) “Safety of Offshore Structures”, Proc. 4th ICASP Conference, Firenze, Pita- gora Editrice.Moan, T. (1985) “The Progressive Structural Failure of the Alexander L. Kielland Platform” in “Case Histories in Offshore Engineering”, G. Maier (ed.) Springer-Verlag: Berlin.Moan, T. (1988) “The Inherent Safety of Structures Designed According to the NPD Regula- tions”. Report No. F88043 , SINTEF, Trondheim.Moan, T. (1994) “Reliability and Risk Analysis for Design and Operations Planning of Off- shore Structures”. Keynote lecture, Proc. 6th ICOSSAR, Structural Safety and Reliability, Vol. I, Balkema, Rotterdam, 21-43.Moan, T. (1995) “Safety Level Across Different Types of Structural Forms and Material – Implicit in Codes for Offshore Structures”, SINTEF Report STF70 A95210, Trondheim, Prepared for ISO/TC250/SC7.Moan, T. (1998) “Target levels for structural reliability and risk analysis of offshore struc-tures”, in Risk Reliability in Marine Technology, Guedes Soares, C. (ed), A.A. Balkema publishers, 351-368.Moan,T. (2000a) “Recent Research and Development Relating to Platform Requalification” J. OMAE, ASME, Vol. 122, New York, 20-32. 40
  • 45. Moan,T. (2000b) “Accidental Actions. Background to NORSOK N-003”, Dept. of Marine Technology, Norwegian University of Science and Technology, Trondheim.Moan, T. (2004) “Reliability-based Management of Inspection, Maintenance and Repair of Offshore Structures”, J. Structure and Infrastructure Engineering,Moan, T., Berge, S. and Holthe, K., (1981a) “Analysis of the Fatigue Failure of the Alexander L. Kielland”, ASME Winter Annual Meeting, Washington D.C.Moan, T. and Holand, I. (1981b) “Risk Assessment of Offshore Structures Experiences and Principles”. Proc. 3rd ICOSSAR, Elsevier, Amsterdam, 803-820.Moan, T and Amdahl, J. (1989) “Catastrophic Failure Modes of Marine Structures” in Struc- tural Failure, T.Wierzbicki and N. Jones (eds), John Wiley & Sons, Inc, New York.Moan, T. et al. (1993a) ”Reliability-Based Fatigue Design Criteria for Offshore Structures Considering the Effect of Inspection and Repair”, Paper No. OTC 7189, Proc. 25th Off- shore Technology Conference, Vol. 2, Houston, 591-599.Moan, T., Karsan, D. and Wilson, T (1993b) “Analytical Risk Assessment and Risk Control of Floating Platforms Subjected to Ship Collisions and Dropped Objects”. Paper No. OTC 7123, Proc. 25th Offshore Technology Conf., Vol. 1, Houston, 407-418.Moan, T., Vårdal, O.T. and Johannesen, J.M. (1999) “Probabilistic Inspection Planning of Fixed Offshore Structures,” Proc.8th ICASP, Applications of Statistics and Probability, A.A. Balkema, Rotterdam, 191-200.Moan, T. and Amdahl, J. (2001) “Risk Analysis of FPSOs, with Emphasis on Collision Risk”, Report RD 2001-12, American Bureau of Shipping, Houston.Moan, T. Amdahl, J. Wang, X. and Spencer, J. (2002) “Risk Analysis of FPSO, with particu- lar emphasis on collisions”, Trans SNAME., Vol. 110, 307-339.Moore, W. et al (2003) “Report of Specialist Committee V.1 Risk Assessment” Proc. 15th ISSC Congress, Vol. 2, Elsevier, Amsterdam.Moses, F. (1987). “Load and Resistance Factor Design-Recalibration LFRD” Report API PRAC 87-22. API, Dallas, Texas.NORSOK N-001 (2002) “Structural Design”, Norwegian Technology Standards, Oslo.NORSOK N-003 (1999) “Actions and Action Effects”, Norwegian Technology Standards, Oslo.NORSOK N-004 (1998b) “Steel Structures”, Norwegian Technology Standards, Oslo.NORSOK Z-013 (1998a) “Risk and Emergency Preparedness Analysis”, NORSOK Standard Z-013, NTS, Oslo, Rev. 1.NPD (1977) “Regulation for the Design of Fixed Structures on the Norwegian Continental Shelf”. Norwegian Petroleum Directorate, Stavanger.NPD (1981) “Guidelines for Safety Evaluation of Platform Conceptual Design.” Norwegian Petroleum Directorate, Stavanger.NPD (1984) “Regulations for load-carrying structures for extraction or exploitation of petro- leum”, The Norwegian Petroleum Directorate, Stavanger.NPD (1991) “Regulations Relating to Implementation and Use of Risk Analysis in the Petro- leum Activities”, Norwegian Petroleum Directorate, Stavanger.OR (1984) Royal Commission on the Ocean Ranger Marine Disaster: “Report One: The Loss of the Semi-submersible Drill Rig Ocean Ranger and its Crew”, Edifice Fort Wil- liam, St. Johns Newfoundland.Paik, J.K. et al (2003) “Report of Committee V.2 Collision and Grounding”, Proc. 15th ISSC, Vol. 2, Elsevier, Amsterdam.Paik, J.K. and Thayamballi, A.K. (2003) “Ultimate Limit State Design of Steel-Plated Struc- tures”, John Wiley & Sons, Chichester.P-36 (2001) “Workshop on the Accident with the P-36 Platform”, Petrobas and Coppe (eds), Rio de Janeiro, Brazil.PA (1990) “The Public Inquiry in the Pipe Alpha Disaster”, Inquiry Commission HMSO, London.Prevosto, M. and Forristall, G.Z. (2002) “Statistics of wave crests from models vs. measure- ments”, Paper No. 28443, Proc. 21st OMAE Conference, Oslo.Reason, J. (1997) “Managing the Risks of Organizational Accidents”, Ashgate Publishers, Aldershot, UK. 41
  • 46. Sarpkaya, T. and Isaacson, M. (1981) “Mechanics of Wave Forces on Offshore Structures”, Van Nostrand Reinholdt, New York.SCI(1993) “Interim Guideance Notes for the Design and Protection of Topside Structures against Explosion and Fire”, Steel Construction Institute, Document SCI-P-112/503, Lon- don.Sigurdsson, G., Lotsberg, I., Myhre, T. and Ørbeck-Nilssen, K. (2000) “Fatigue Reliability of Old Semi-submersibles,” OTC Paper no 11950, Proc. Offshore Technology Conference, Houston.Skallerud, B. and Amdahl, J. (2002) “Nonlinear Analysis of Offshore Structures”, Research Studies Press.Smith, C.S. (1977) “Influence of Local Compressive Failure on Ultimate Longitudinal Strength of Ships hull” Proc. PRADS, Tokyo, 73-79.Vårdal, O.T. and Moan, T. (1997) "Predicted versus Observed Fatigue Crack Growth. Valida- tion of Probabilistic Fracture Mechanics Analysis of Fatigue in North Sea Jackets", Paper No. 1334, Proc. 16th OMAE Conference, Yokohama, Japan.Vårdal. O.T. , Moan, T. and Bjørheim, L.G. (2000) "Applications of Probabilistic Fracture Mechanics Analysis for Reassessment of Fatigue Life of a Floating Production Unit- Philosophy and Target Levels", Paper No. 00-2078, Proc. 19th OMAE Conference, New Orleans.Vinnem, J.E. (1999) “Offshore Risk Assessment”, Kluwer Academic Publishers, Doordrecht.Walker, S. et al. (2003) “New Guidance on the Design of Offshore Structures to Resist the ExplosionHazard” Paper No. 203-37120, Proc. 22nd OMAE Conference, Cancun, Mexico.Wirsching, P.H. (1983) “Probability-based Fatigue Design Criteria for Offshore Structures” Report API-PRAC Project No. 81-15, Dept. of Aerospace and Mechanical Engng. Univer- sity of Arizona, Tucson.WOAD: “Worldwide Offshore Accident Databank”, Det Norske Veritas, Oslo, 1996.Yao, T, et al. (2000) “Report of ISSC Committee VI.2. Ultimate Hull Girder Strength”, Proc. 14th ISSC Congress, Nagasaki.AcronymsALS - Accidental Collapse Limit StateAPI - American Petroleum InstituteFDF – Fatigue Design Factor (to multiply with the service life to get desired characteristic value of fatigue life)FLS - Fatigue Limit StateHOF - Human and Organizational FactorsHSE - Health and Safety Executive, UKIMO - International Maritime OrganizationISO - International Standardization OrganizationMMS-Mineral Management Services, USANPD - Norwegian Petroleum Directorate (now: Petroleum Safety Authority, Norway)TLP - Tension Leg PlatformWOAD – World Accident Data Bank, issued by Det Norske Veritas 42