This document presents a safety management plan for offshore structures, emphasizing the importance of safety requirements during their life cycle, particularly in the oil and gas industry. It outlines the risks associated with offshore operations and stresses the necessity for rigorous design and regulatory standards to prevent accidents, which are often exacerbated by human and organizational factors. Historical accident analyses underscore the need for effective safety management and inspections to mitigate potential failures and enhance structural robustness.

1. MINISTRY OF EDUCATION
CONSTANTA MARITIME UNIVERSITY
FACULTATEA DE NAVIGATIE SI TRANSPORT NAVAL,
OFFSHORE OILAND GAS TECHNOLOGY AND MANAGEMENT
YEAR II ,SEMESTER 3 / 2025
PROJECT
Course: OFFSHORE REGULATIONS AND STANDARDS
Topic: Safety Management Plan on offshore structures
Professor: MR. JOAVINA RADU
Student: DESPINA- RUSU ILIE
1

2. Safety Management Plan on Offshore Structures
1. Introduction
Oil and gas are the dominant sources of energy in our society. Twenty percent of these
hydrocarbons are recovered from reservoirs beneath the seabed. Various kinds of
platforms are used to support exploratory drilling equipment, and the chemical
(production) plants required to process the hydrocarbons. Large production platforms,
such as some of those in the North Sea, represent investment of billions of U.S.
dollars and significant operational costs. Pipelines or tankers are used to transport the
hydrocarbons to shore. This paper is limited to deal with offshore structures.
Subsea oil and gas exploitation
a) Offshore oil and gas b) Platform for exploratory c) Platform for oil and gas
exploitation drilling operation production (chemical processing)
The continuous innovations to deal with new serviceability requirements and
demanding environments as well the inherent potential of risk of fires and explosions
have lead to an industry which has been in the forefront of development of design and
analysis methodology. Fig. shows phases in the life cycle of offshore structures. The
life cycle of marine systems is similar to that of other systems. In view of the
ecological issue removal or clean-up need to be considered. In this aspect the
recycling of the material is an important issue. In the life cycle phases of structures the
design phase is particularly important. Offshore structures need to fulfil serviceability
and safety requirements. Serviceability requirements depend upon the function of the
structure, which is to provide a platform and support of equipment for drilling or for
the production of hydrocarbons. Drilling units need to be mobile while production
platforms are generally permanent. Production platforms are commonly designed to
carry large chemical factories together with large hydrocarbon inventories.
2

3. Safety requirements are introduced to limit fatalities as well as environmental and
property damages.
The focus here is on the structural safety during the life cycle of the platforms. A
rational safety approach should be based on:
- Goal-setting; not prescriptive
- Probabilistic; not deterministic
- First principles; not purely experimental
- Integrated total; not separately
- Balance of safety elements; not hardware
Life cycle phases of offshore structures
The safety management of structures is different for different industries depending on
the organisation as well as regulatory contents. For instance the safety management of
offshore structures differs from that for trading ships. One reason for this difference is
the fact that safety management of trading vessels emerged for centuries through
empiricism while off-shore structures have primarily come about in the last 50 years
when first principles of engineering science had been adequately developed to serve as
basis for design. Similarly the regulatory regime differs between ships and offshore
structures in that offshore operation take place on continental shelves under the
jurisdiction of the local government. Typically authorities in the continental shelf
states have to issue regulations. Examples of these are MMS/API in USA, HSE in UK
and NPD in Norway. However the provisions for stability and other maritime issues
are based on those of IMO and their corresponding national organizations.
Classification societies primarily provide rules for drilling units and services for
production facilities, which primarily are handled by national authorities. Since early
1990s ISO has been developing a harmonized set of codes for offshore structures with
contribution from all countries with major offshore operations.
Over the time safety management of offshore structures has been developed, in
parallel with the evolvement of the technology and the competence to deal with it.
Initially civil engineering was the driving force for structural safety management.
Later the aeronautical and nuclear industries also played an important role. However
in the last 20-30 years the developments in the offshore industry has had a significant
3
Reassessment
Removal and reuse
maintenance
repair /
monitoring/
Inspection/
Operation plan
-
Operation
- Inspection/repair
-
Fabrication plan
-
Fabrication
safety
-
- producability
serviceability &
-
for
Design
Scantlings
Layout/
data
Operation
Fabrication &
criteria
Data, methods,

4. impact on the development of safety approaches. This is partly because the offshore
industry plays a key role in the “world’s economy”. Moreover the oil and gas
represent energy with large potential accident consequences. Companies involved in
structures and/or facilities that experience accidents may suffer loss of reputation and
this may damage the public’s trust on the companies.
The rationalisation of safety management of offshore structures began in early 70’s.
Among the milestones is the introduction of Risk Analysis in 1981 and Accidental
Collapse Design criterion in 1984 by the Norwegian Petroleum Directorate and the
HSE Safety case approach in 1992, when the ALARP principle - as large as
reasonably practicable – was introduced for determining the target safety level.
To limit the likelihood of fatalities and environmental and property damages, offshore
structures should be designed, fabricated and operated in such a manner that the
probability of the following failure modes is adequately small:
- overall, rigid body instability (capsizing) under permanent, variable and
environmental loads
- failure of (parts of) the structure foundation or mooring systems, considering
permanent, variable, and environmental as well as accidental loads
Stability requirements for floating platforms affect the layout and the internal structure
– subdivision in compartments. Criteria to prevent progressive structural failure after
fatigue failure or accidental damage would have implications on overall layout of all
types of platforms. Otherwise a structural strength criterion affects the scantlings of
the stiffened, flat, and cylindrical panels that typically constitute floating offshore
structures.
If the location is far off shore then evacuation and rescue will be difficult. On the other
hand, this implies that accidents on offshore facilities affect the general public to a
lesser extent than accidents on similar facilities on land.
In the following sections accident experiences on offshore structures will be briefly
explained. Then, an outline of various measures to manage the safety or ensure that
the risk is within acceptable limits, is given. This includes: Design and inspection
criteria as well as reliability methodology to calibrate the partial safety factors to
correspond to a defined acceptable safety level. In particular it is explained how
fatigue failures can be avoided by design as well as inspections and regular
monitoring of the structure. Emphasis is placed on how structural robustness can be
ensured by using so-called Accidental Collapse Limit State (ALS) criteria. Such
criteria are exemplified in relation to fires, explosions and other accidental loads.
Finally, Quality Assurance and/or Quality Control of the engineering process will be
described with particular reference to dealing with unknown wave loading and
response phenomena.
2. Accident Experiences
2.1 Accident experiences at large
Safety may be regarded as the absence of accidents or failures. Hence the insight
about safety features can be gained from detailed information about accidents and
failures. To learn about the intrinsic nature of accidents, it is mandatory to study the
detailed accounts provided from investigations of catastrophic accidents since the
necessary resources are then spent to investigate such accidents. Such studies include
those of the platforms Alexander Kielland in 1980 (ALK, 1981, Moan and Holand,
4

5. 1981b), Ocean Ranger in 1982 (OR, 1984), Piper Alpha in 1988 (PA, 1990), and P-36
in 2001 (P-36, 2003). See also Bea (2000a, 2000b). In addition, the statistics about
offshore accidents, such as ones given in WOAD (1996), provide an overview.
Global failure modes of concern are
- capsizing/sinking
- structural failure
- positioning system failure the former two modes represent catastrophic events
while the latter one is only critical for Tension-leg platforms. Global failures normally
develop in a sequence of technical and physical events. However, to fully understand
accidents it is necessary to interpret them in the view of human and organizational
factors (HOF). This includes possible deficiencies in relevant codes, possible
unknown phenomena that have materialized as well as possible errors and omissions
made in engineering processes, fabrication processes or in the operation itself.
a) Alexander L. Kielland before and after
capsizing in 1980’
b) Model of Ocean Ranger, which capsized in
1982, during survival testing
c) Piper Alpha fire and explosion in 1988
d) P - 36 accident in 2001
Examples of accidents which resulted in a total loss.
Let us consider an example: The platform shown in Figure in the Gulf of Mexico. This
is one of many platforms that were damaged during the passage of the hurricane Lilli.
Physically there is no doubt that this accident was due to extreme wave forces. To
explain from a human and organizational point of view why the platform was not
strong enough to resist the wave forces, we have to look at the decisions that were
made during the design phase regarding loads, load effects, resistance and safety
factors. The explanation might be that design was based on an inadequate wave
conditions or load calculation. The damage could also be due to the occurrence of a
particular a wave phenomenon, such as an abnormal wave crest (see Fig. b) or another
“unknown” wave phenomenon. In the case of the exceptional wave in Fig. b, the
question is whether the extreme crest height of 18.5 m should be considered as the
socalled “freak” wave or simply a rare wave. Alternatively, the reason could be
inadequate air-gap provided in the design. Yet another explanation might be that an
improper strength formulation was used (as was the case in design of early generation
5

6. platforms). Finally, the safety factors might not have been sufficient to cover the
inherent uncertainties. For each of these possible causes, two explanations need to be
considered, namely 1) The state of art in offshore engineering was inadequate at the
time of design ; 2) Errors and omission were made during design or fabrication!
Obviously, these two explanations have different implications on the risk reducing
actions.
In this connection it is noted that several types of environmental load phenomena,
such as green water on deck and slamming (Fig. c-d) are subjected to large
uncertainties. In general, if the phenomenon is known but subject to significant
uncertainties, the design approach taken is normally conservative.
Structural damage due to environmental loads
Wave record from a platform site in the North Sea on January 1. 19 b) Wave record from a platform site in the
North Sea on January 1. 1995.
c) Green water and deck slamming on FPSO
d) Deck slamming on semi-
submersible platform
6

7. The technical-physical sequence of events for the Alexander Kielland platform was:
fatigue failure of one brace, overload failure of 5 other braces, loss of column,
flooding into deck, and capsizing. For Ocean Ranger the accident sequence was:
flooding through broken window in ballast control room, closed electrical circuit,
disabled ballast pumps, erroneous ballast operation, flooding through chain lockers
and capsizing. Piper Alpha suffered total loss after: a sequence of accidental release of
hydrocarbons, as well as escalating explosion and fire events. P-36 was lost after: an
accidental release of explosive gas, burst of emergency tank, accidental explosion in a
column, progressive flooding, capsizing and sinking after 6 days.
Table 1 shows accident rates for mobile (drilling) and fixed (production) platforms
according to the initiating event of the accident WOAD (1996). Table 1 is primarily
based upon technical-physical causes. Severe weather conditions would normally
affect capsizing/ foundering as well as structural damage. In most cases there existed
human errors or omissions by designers, fabricators or operators of the given
installation was a major contributor to the accident. The most notable in this
connection is, of course accidents caused by loads such as ship impacts, fires and
explosions which should not occur but do so because of errors and omissions during
operation.
In general, accidents take place in sequences. For floating platforms, the loss of
buoyancy and stability is commonly an important aspect of total loss scenarios.
Structural damage can cause progressive structural failure or flooding. Progressive
flooding attributes to a greater probability of total loss of floating structures than
progressive structural failure.
Degradation due to corrosion and fatigue crack growth are gradual phenomena.
However, if the fatigue life is insufficient to make Inspection, Monitoring,
Maintenance and Repair (IMMR) effective or if there is lack of robustness, fatigue can
cause catastrophic accidents, see Fig. Both cases shown in Fig. occurred for statically
determinate platforms. In other situations through-the-thickness cracks were detected
by inspections before they caused catastrophic failures (Moan, 2004). Corrosion is not
known to have caused accidents with floating offshore structures of significance. On
the other hand, maintenance related events for floating structures is limited. We need
to be aware of this problem, especially for structures with a low fatigue life.
Table 1: Number of accidents per 1000 platform-years. Adapted after WOAD
(1996).
Type of accident
World wide Gulf of Mexico North Sea
Mobile Fixed Fixed Fixed
1970-79 /80-95 1970-79 /80-95 1970-79 /80-95 1970-79 /80-95
Blowout 18.8/ 11.4 2.5/0.9 2.2/1.0 2.6/1.6
Capsizing/
foundering
24.0/ 19.5 0.5/0.8 0.3/1.1 2.6/0.5
Collision / contact 24.6/ 14.6 1.6/1.0 1.3/0.7 5.1/6.3
Dropped object 4.2/ 6.1 0.5/0.8 0.1/0.4 10.3/10.6
Explosion 7.4/3.3 0.7/1.6 0.3/0.4 2.6/8.3
Fire 12.3/
11.9
2.0/7.5 1.0/7.8 18.0/42.5
7

8. Grounding 6.1/3.3 - - -
Spill/release 4.9/5.9 1.8/8.7 1.0/5.8 23.1/98.3
Structural damage 25.6/ 18.4 0.5/0.6 0.4/0.5 10.3/6.0
Fig. 5: The total losses of Ranger I in 1979 and Alexander Kielland in 1981 were
initiated by fatigue failure
2.2 Human and organizational factors
Basically, structural failure occurs when the resistance, R is less than the load effect, S
as indicated in Fig. 7. From a Human and Organizational Factor (HOF) point of view
this can be due to too small safety factors to account for the normal uncertainty and
variability in R and S relating to design criteria. But the main causes of actual
structural failures are the abnormal resistance and accidental loads due to human
errors and omissions.
Design errors materialise as a deficient (or excessive) resistance, which cannot be
derived from the parameters affecting the “normal” variability of resistance.
Fabrication imperfections (such as cracks, plate misalignment, etc.), which also affect
the resistance, are influenced by human actions. The “normal” variability of welders
performance, environmental conditions, and soon lead to a “normal” variability in the
imperfection size. This is characterised by a smooth variation of the relevant
imperfection parameter. Occasionally a deviation from “normal practice” does occur,
for instance as an abnormality caused by using a wet electrode, or another gross
fabrication error. The Alexander L. accident in 1980 was caused by a fatigue failure
of a brace and design checks had not been carried out. The implied fatigue life was
further reduced – to 3.5 years - by a fabrication error (70 mm weld defect) as well as
inadequate inspections (ALK, 1981). Although the fatigue failures that had been
experienced in semi-submersibles in the period 1965-70 resulted in fatigue standards,
these standards were not properly implemented even for platforms built in the 1970’s.
Many platforms built in the 1970’s had joints with design fatigue lives as low as 2-5
years. This fact was evidenced in the extraordinary surveys undertaken after
Alexander Kielland accident. The same happened to the first purpose built FPSO and
shuttle tankers put into service in the mid-1980’s. However, ships are obviously more
robust or damage-tolerant than mobile semi-submersible platforms.
8
redundancy
–thatcauseno
”Missing braces”
Column D
Alexander Kielland, 1980
Ranger I, 1979

9. Man-made live loads also have a “normal” and an “abnormal” component. While
some loads, notably fires and explosions, ship collisions, etc. do not have a normal
counterpart, they are simply caused by operational errors or technical faults. The
mobile platform Ocean Ranger capsized in the offshore of Newfoundland in 1982.
The accident was initiated by control room window breaking due to wave slamming.
The water entering the control room lead to the short circuit of the ballast valve
system, thereby leading to a spurious operation of ballast valves. The resulting
accidental ballast condition could not be controlled partly because of lack of crew
training and partly because of inadequate ballast pumps, and open chain lockers (OR,
1984).
The catastrophic explosion and fire on the Piper Alpha platform in 1988 was initiated
by a gas leak from a blind flange of a condensation pump that was under maintenance
but not adequately shut down (PA, 1990). The main issue that caused the initiation of
this accident was the lack of communication between the maintenance team and the
control room operators. The gas ignited and the initial explosion lead to damage of an
oil pipe and subsequent oil fires and explosions.
In 2001 the platform P-36 in Brazil experienced a collapse of the emergency drainage
tank, accidental explosion and subsequent flooding capsizing and sinking. A series of
operational errors were identified as the main cause of the first event and also the
sinking (P-36, 2001).
It is a well known fact that the gross errors dominate as the cause of accidents, and
therefore appropriate control measures should be implemented. It is found that the
gross errors cause 80-90% of the failure of buildings and bridges and other civil
engineering structures (Matousek and Schneider, 1976). The same applies to offshore
structures.
Fig. 7 Interpretation of causes of structural failure and risk reduction measures.
It has been observed that errors and omissions occur especially in dealing with novel
materials and concepts as well as during periods with economic and time pressures.
In some cases, accidents have been caused by inadequate engineering practice such as
the lack of knowledge regarding new phenomena. Recently new phenomena such as
ringing and spinning of TLPs, degradation failure mechanism of flexible risers, have
been discovered. Nevertheless they were observed in time before any catastrophic
accident could occur.
9

10. 3. Safety Management
3.1 General
Offshore drilling, production or transport facilities are systems consisting of
structures, equipments and other hardware’s, as well as specified operational
procedures and operational personnel. Ideally these systems should be designed and
operated to comply with a certain acceptable risk levels as specified for example by
the probability of undesirable consequences and their implications. The safety
management needs to be synchronised with the life cycle of the structure. Structural
failures are mainly attributed to errors and omissions in design, fabrication and,
especially, during operation. Therefore, Quality Assurance and Control (QA/QC) of
procedures and the structure during fabrication and use (operation) is crucial.
To do a truly risk based design, by carrying out the design iteration on the basis of a
risk acceptance criterion, and to achieve a design that satisfies the acceptable safety
level, is not feasible. In reality, different subsystems, like:
- loads-carrying structure & mooring system
- process equipment
- evacuation and escape system
are designed according to criteria given for that particular subsystems. For instance, to
achieve a certain target level, which implies a certain residual risk level, safety criteria
for structural design are given in terms of Ultimate Limit State (ULS) and Fatigue
Limit State (FLS) criteria. Using appropriate probabilistic definitions of loads and
resistance together with safety factors, the desired safety level is achieved. The
implicit risk associated with these common structural design criteria is generally
small! The philosophy behind the Accidental Collapse Limit (ALS) criteria is
discussed below.
The nature of human errors differs from that of natural phenomena and “normal” man-
made variability and uncertainty. Different safety measures are required to control
error-induced risks. A number of people maintain that gross errors are “Acts of God”
and cannot be dealt with.
However,
- weld defects and fatigue failures due to gross errors had occurred before the
Kielland accident
- ballast errors had occurred before the Ocean Ranger accident - fires and
explosions had occurred before the Piper Alpha accident and so on
The occurrence of gross errors have been avoided by adequate competence, skills,
attitude and self-checking of those who do the design, fabrication or operation in the
first place; and by exercising “self-checking” in their work.
In addition, quality assurance and control should be implemented in all stages of
design, fabrication and operation. While the QA/QC in the design phase is concerned
with scrutinizing the analysis, design checks and the final scantlings arrived at, the
QA/QC during fabrication and operation phases refers to inspection of the structure
itself.
10

11. As mentioned above, operational errors typically result in fires or explosions or other
accidental loads. Such events may be controlled by appropriate measures such as
detecting the gas/oil leakage and activating shut down valve; extinguishing of a fire by
an automatically-activated deluge system. These actions are often denoted as “Event
Control”.
Finally, Accidental Collapse Limit State criteria are implemented to achieve robust
offshore structures, that is to prevent that the “structural damage” occurring as
fabrication defects or due to accidental loads, escalate into total losses (Moan 1994).
Table 2 summarises the causes of structural failure from a risk management point of
view, and how the associated risk may be ameliorated.
Adequate evacuation and escape systems and associated procedures are crucial for
controlling failure consequences in terms of fatalities.
Table 2: Causes of structural failures and risk reduction measures
Cause Risk Reduction Measure
• Less than adequate safety margin to
cover “normal” inherent
uncertainties.
- Increased safety factor or margin in ULS, FLS;
- Improve inspection of the structure(FLS)
• Gross error or omission
during
- design (d)
- fabrication (f)
- operation (o)
- Improve skills, competence, self- checking (for
d, f, o)
- QA/QC of engineering process (for d)
- Direct design for damage tolerance (ALS) – and
provide adequate damage condition (for f, o)
- Inspection/repair of the structure (for f, o)
• Unknown phenomena - Research & Development
3.2 Design and inspection criteria
Adequate performance of offshore structures is ensured by designing them to comply
with serviceability and safety requirements for a service life of 20 years or more, as
well as carrying out load or response monitoring, or inspection and taking the
necessary actions to reduce loads directly or indirectly, by, e.g., removal of marine
growth, or to repair, when necessary.
Serviceability criteria are introduced to make the structure comply with the functions
required. These criteria are commonly specified by the owner. Production platforms
are usually made to be site- specific, while drilling units are commonly intended for
operation in specific regions or world wide.
Safety requirements are imposed to avoid ultimate consequences such as fatalities and
environmental or property damages. Depending upon the regulatory regime, separate
acceptance criteria for these consequences are established. Property damage is
measured in economic terms. Fatalities and pollution obviously also have economic
implications. In particular, the increasing concern about environmental well-being can
cause small damages to have severe economic implications. While fatalities caused by
structural failures would be related to global failure, i.e. capsizing or total failure of
deck support, smaller structural damages may result in pollution; or property damage
which is costly to repair such as the damages of an underwater structure.
11

12. The current practice which is implemented in new offshore codes, issued e.g. by API
(1993/97), ISO 19900 (1994-) and NORSOK (1998a, 1998b, 1999, 2002) as well as
by many classification societies, and the most advanced codes are characterized by
- design criteria formulated in terms of limit states (ISO 19900, 1994) – see
Table3.
- semi-probabilistic methods for ultimate strength design which have been
calibrated by reliability or risk analysis methodology
- fatigue design checks depending upon consequences of failure (damagetolerance)
and access for inspection
- explicit accidental collapse design criteria to achieve damage-tolerance for the
system
- considerations of loads that include payload; wave, current and wind loads, ice (for
arctic structures), earthquake loads (for bottom supported structures), as well as
accidental loads such as e.g. fires, explosions and ship impacts
- global and local structural analysis by finite element methods for ultimate strength
and fatigue design checks
- nonlinear analyses to demonstrate damage tolerance in view of inspection planning
and progressive failure due to accidental damage
Fatigue crack growth is primarily a local phenomenon. It requires stresses to be
calculated with due account of the long-term wave conditions, global behaviour as
well as the geometric stress concentrations at all potential hot spot locations, and
suitable fatigue criteria (e.g. Miner’s rule). Fatigue strength is commonly described by
SNcurves, which have been obtained by laboratory experiments. Fracture mechanics
analysis of fatigue strength have been adopted to assess more accurately the different
stages of crack growth including calculation of residual fatigue life beyond
throughthickness crack, which is normally defined as fatigue failure. Detailed
information about crack propagation is also required to plan inspections and repair.
Table 3 Limit State Criteria for safety – with focus on structural integrity
L im it s ta te s P h y s ic a l a p p e a ra n c e o f fa
ilu re m o d e
R e m a rk s
U ltim a te (U L S )
-O v e ra ll “rig id b o d
y” s ta b ility
- s tru c tu re , m o o rin g o r
U ltim a te s tre n g th o f p
o s s ib le fo u n d a tio n
D iffe re n t fo r b o tto
m – s u p p o rte d , o r
b u o ya n t s tru c tu re
s .
C o m p o n e n t d e s ig n c h e
c k
12
Collapsed
cylinder

13. F a tig u e (F L S )
- F a ilu re o f w e ld e d jo in
ts d u e to re p e titiv e lo a d s
C o m p o n e n t d e s ig n
c h e c k d e p e n d in g o
n re s id u a l s ys te m s tre
n g th a n d a c c e s s fo r
in s p e c tio n
A c c id e n ta l c o lla p s e (A L S )
- U ltim a te c a p a c ity 1)
o f
d a m a g e d s tru c tu re w ith
“c re d ib le ” d a m a g e
S ys te m d e s ig n c h e c k
An adequate safety against fatigue failure is ensured by design as well as by
inspections and repairs. Fatigue design requirements depends upon inspect ability and
failure consequences. Current requirements for fatigue design check in NORSOK are
shown in Table 4. These values were established by the NPD code committee in 1984
by judgement.
Table 4 Fatigue design factor, FDF to multiply with the planned service life to obtain
the required design fatigue life (NORSOK N-001, 2002).
Access for inspection and repair
Accessible (inspection according to generic scheme
No access or in
the splash zone
is carried out)
Below splash zone
Above splash zone or
internal
Substantial
consequences
10 3 2
Without substantial
consequences
3 2 1
1)
The consequences are substantial if the Accidental Collapse Limit State (ALS) criterion is
not satisfied in case of a failure of the relevant welded joint considered in the fatigue check.
Traditionally we design for dead-loads, payloads as well as environmental loads. But,
loads can also be induced by human errors or omissions during operation – and cause
accidental loads. They commonly develop though a complex chain of events. For
instance hydrocarbon fires and explosions result as a consequence of an accidental
leak, spreading, ignition and combustion process. Accidental Collapse Limit State
(ALS) requirements are motivated by the design philosophy that “small damages,
which inevitably occur, e.g. due to ship impacts, explosions and other accidental
loads, should not cause disproportionate consequences”.
The first explicit requirements were established in Britain following the Ronan Point
apartment building progressive failure in 1968. In 1984 such criteria were extended by
NPD, to include such robustness criteria for the structure and mooring system. While
robustness requirements to the mooring are generally applied today, explicit ALS
criteria are not yet widespread. The World Trade Centre and other recent catastrophes
13
Fatigue-
fracture
Jack-up
collapsed

14. have lead to further developments of robustness criteria for civil engineering
structures. See Figure 8.
ALS checks should apply to all relevant failure modes as shown in Figure 9. It is
interesting in this connection to note that ALS-type criteria were introduced for
sinking/ instability of ships long before such criteria were established for structural
integrity as such. Thus, ALS were introduced in the first mobile platform rules (as
described e.g. by Beckwith and Skillman, 1976). The damage stability check has
typically been specified with damage limited to be one or two compartments flooded.
According to NPD this damage should be estimated by risk analysis, as discussed
subsequently. The criterion was formally introduced for all failure modes of offshore
structures in Norway in 1984 (NPD, 1984).
Applied
• Ronan point since
appartment building accident, 1968volume earlycodes
Flooded
•
Flixboroughexplosion,
a) Capsizing/sinking due to (progressive)
flooding
1974
• ECCS model codes, Gaining
1978
• Alexander L. Kielland accident, 1980
• NPD Regulations for Risk analysis, 1981
• NPD’s ALS criterion,
1984
• HSE Safety Case,
1992 One
• WTC, September 11., 2001tether
Fig. Historical development of ALS Fig. Accidental Collapse Limit State
assessment of structures (ALS) requirements
The assessment of structures during operation is necessary in connection with a
planned change of platform function, extension of service life, occurrence of overload
damage due to hurricanes (Dunlap and Ibbs, 1994), subsidence of North Sea jackets
(Broughton, 1997), explosions, fires and ship impact, updating of inspection plans etc
(ISO 19900). Basically, the reassessment involves the same analyses and design
checks as carried out during initial design. However, depending upon the inherent
damage tolerance ensured by the initial design, the measures that have to be
implemented to improve the strength of an existing structure may be much more
expensive than ones for a new structure. This fact commonly justifies more advanced
analyses of loads, responses, resistances as well as use of reliability analysis and risk-
based approaches than in the initial design (Moan, 2000a).
3.3 Inspection, Monitoring, Maintenance and Repair
Inspection, Monitoring, Maintenance and Repair (IMMR) are important measures for
maintaining safety, especially with respect to fatigue, corrosion and other deterioration
phenomena. To ensure structural integrity within the offshore sector in the North Sea,
the regulatory body defines the general framework while the audit of the oil
14
Motivation:
”small damages, which
inevitably occur, should
not cause
disproportionate
consequences!”
Failure of Dynamic
Positioning System
is handled in a similar
manner

15. companies or rig owners defines: inspection and maintenance needs, reports planned
activity, findings and evaluates conditions annually and every fourth or fifth year.
Hence, the inspection history of a given structure is actively incorporated in the
planning of future activities. The inspection and repair history is important for a
rational condition assessment procedure of the relevant structure and other, especially
for “sister” structures.
The objective of inspections is to detect cracks, buckling, corrosion and other
damages. Overload phenomena are often associated with a warning for which the
inspection can be targeted, while degradation needs continuous surveillance. However,
normally ample time for repair will be available in the latter cases.
An inspection plan involves:
- prioritizing which locations are to be inspected
- selecting inspection method (visual inspection, Magnet Particle Inspection, Eddy
Current) depending upon the damage of concern
- scheduling inspections
- establishing a repair strategy (size of damage to be repaired, repair method and
time aspects of repair)
Whether the inspection should be chosen to aim at detecting cracks by non-destructive
examination (NDE), close visual inspection, detect through-thickness cracks e.g. by
leak detection, or member failures would depend on how much resources are spent to
make the structure damage tolerant. The choice again would have implication on the
inspection method. The main inspection methods being the NDE methods consist of
detection of through-thickness crack by e.g. leak detection, and visual inspection by
failed members. The quality of visual inspection of NDE methods depends very much
upon the conditions during inspection. A large volume offshore structure is normally
accessible from the inside, while members with a small diameter such as TLP tethers
and joints in jacket braces, are not.
Permanent repairs are made by cutting out the old component and butt welding a new
component, re-welding, adding or removing scantlings, brackets, stiffeners, lugs or
collar plates.
Typically major inspections of offshore structures (special surveys, renewal surveys)
are carried every 4 - 5th
year, while intermediate and annual inspections are normally
less extensive. Further refinement of the inspection planning has been made by
introducing probabilistic methods as described below.
Inspection, monitoring and repair measures can contribute to the safety only when
there is a certain damage tolerance. This implies that there is an interrelation between
design criteria (fatigue life, damage tolerance) and the inspection and the repair
criteria. Fatigue design criteria, hence, depend upon inspection and failure
consequences as shown e.g. by Table 4.
However, during the operation, the situation is different. The strengthening of the
structure by increased scantlings is very expensive. The most relevant measure to
influence safety relating to fatigue and other degradation phenomena is by using an
improved inspection method or increased frequency of inspections. The following
section briefly describes how fatigue design and inspection plans (based on an
assumed inspection method) can be established by reliability analysis to ensure an
acceptable safety level.
15

16. 3.4 Quantitative Measures of Safety
Ideally the structural safety should be measured in a quantitative manner. Structural
reliability methods are applied to determine the failure probability, Pf which is
associated with normal uncertainties and variability in loads and resistance.
Quantitative risk assessment can be used to deal with the probability of undesirable
events and their consequences in general terms. This includes events induced by errors
and omissions, see Fig.
Consequences
Fig. Methods for quantifying the risk or safety level
The quantitative safety approach is based on estimating the implied failure probability
and comparing it with an acceptance level. This target safety level should depend
upon the following factors (e.g. Moan, 1998):
- type of initiating events (hazards) such as environmental loads, various accidental
loads, .. which may lead to different consequences
- type of SRA method or structural risk analysis, especially which uncertainties are
included
- failure cause and mode
- the possible consequences of failure in terms of risk to life, injury, economic losses
and the level of social inconvenience.
- the expense and effort required to reduce the risk.
In principle a target level which reflects all hazards (e.g. loads) and failure modes
(collapse, fatigue, ... ) as well as the different phases (in-place operation and
temporary phases associated with fabrication, installation and repair) is defined with
respect to each of the three categories of ultimate consequences. The most severe of
them governs the decisions to be made. If all consequences are measured in economic
terms, then a single target safety level could be established. However, in practice it is
convenient to treat different hazards, failure modes, and phases separately, with
separate target levels. This may be reasonable because it is rare that all hazard
scenarios and failure modes contribute equally to the total failure probability. The
principle of establishing target levels for each hazard separately was adopted by NPD
for accidental loads; see e.g. Moan et al. (1993b). It was also advocated by Cornell
(1995). In general it is recommended to calibrate the target level to correspond to that
inherent in structures which are considered to have an acceptable safety.
3.6 Safety implications of Ultimate and Fatigue Limit State criteria and Inspection,
Monitoring, Maintenace and Repair
The failure probability estimated by structural reliability analysis (SRA) normally
does not represent the experienced Pf for structures. This is because the safety factors
or margins normally applied to ensure safety are so large that Pf calculated by SRA
becomes much smaller than that related to other causes. For instance when proper
fatigue design checks and inspections have not been carried out, the likelihood of
fatigue failures (through-thickness cracks) for platforms (e.g. in the North Sea), is
large and cracks have occurred. However, with the exception of the Ranger I (1979)
16

17. and Alexander Kielland failure (1980) such cracks have been detected before they
caused total losses. As discussed above, errors and omissions in design, fabrication
and operation represent the main causes of the accidents experienced.
On the other hand, frequent occurrences of cracks provide a basis for correlating
actual crack occurrences with state of art predictions for various offshore structures.
Hence, the current predictions for jackets are found to be conservative (Vårdal and
Moan, 1997), while for semi-submersibles and ships, the predictions seem to be
reasonable, as summarized by Moan (2004). This agreement is achieved when the SN
approach (or a calibrated fracture mechanics approach) is applied to predict the
occurrence of fatigue failure (e.g. through thickness crack). Yet, if ULS and FLS
design checks are properly carried out, Pf will be “negligible” within the current safety
regime. This reserve capacity, implied by ULS and FLS requirements, provides some
resistance against other hazards like fires, explosions etc. However providing safety
for the mentioned hazards in this indirect manner is not an optimal risk-based design.
If more efforts were directed towards risk reduction actions by implementing ALS
criteria, then current safety factors for ULS and FLS could be reduced without
increasing the failure rate noticeably.
As explained above, SRA does not provide a measure of the actual total risk level
associated with offshore facilities. Yet, it is useful in ensuring that the ultimate
strength and fatigue design criteria are consistent by calibrating safety factors.
Moreover, SRA provides a measure of the influence of various parameters on the
reliability and, hence, the effect of reducing the uncertainty on the failure probability.
Finally, it is noted that the random uncertainties in the ultimate strength commonly
have limited effect on the reliability compared to that inherent in load effects. On the
other hand, the systematic uncertainty (bias) in strength and load effects has the same
effect on the reliability measure.
3.7 Risk assessment
Risk assessment (Qualitative Risk assessment or Formal Safety Analysis etc.) is a tool
to support decision making regarding the safety of systems. The application of risk
assessment has evolved over 25 years in the offshore industry (Moan and Holand,
1981b, NPD (1981)). The Piper Alpha disaster (PA, 1990), was the direct reason for
introducing PRA, (or QRA), in the UK in 1992 (HSE, 1992). In the last 5 years such
methods have been applied in the maritime industry, albeit in different directions
(Moore et al. 2003). The offshore industry has focused on the application of risk
assessment to evaluate the safety of individual offshore facilities. The maritime
industry has primarily focused on the application of risk assessment to further enhance
and bring greater clarity to the process of making new ship rules or regulations.
The risk assessment methods is used because they provide a reliable direct
determination of events probabilities e.g. probabilities as low as 10-4
per year. Up to
now the accumulated number of platform years world wide is about 120 000, 15 000
and 1 200 for fixed, mobile structures and FPSOs, respectively. However, to
determine probabilities as low as 10-4
per year requires about 23000 years of
experiences to have a 90% chance of one occurrence. A further complexity is that the
available data refer to various types of platforms and, not least, different technologies
over the years. Application of a systems risk assessment is therefore attractive. The
basis for this approach is the facts that : a)almost every major accidental events have
originated from a small fault and gradually developed through long sequences or
several parallel sequences of increasingly more serious events, and culminates in the
17

18. final event b) it is often reasonably well known how a system responds to a certain
event.
By combining the knowledge about system build-up with the knowledge about failure
rates for the elements of the system, it is possible to achieve an indication of the risks
in the system (Vinnem, 1999; Moan, 2000b).
The risk analysis process normally consists in the following steps (Fig 15):
- definition and description of the system
- identification of hazards
- analysis of possible causal event of hazards
- determination of the influence of the environmental conditions
- determination of the influence of active/passive safety systems (capacity;
reliability, accident action integrity, maintenance system …..)
- estimation of event probabilities/event magnitudes
- estimation of risk
Fig. General approach for risk based decision making
In most cases an Event-Fault Tree technique (Figure down) is the most appropriate
tool for systematizing and documenting the analyses made. Although the Event-Fault
tree methodology is straightforward, there are many problems. An important
challenge is to determine the dominant of the (infinitely) many sequences. Events are
not uniquely defined in a single sequence but appear in many combinations.
Moreover, human factors are difficult to account for in the risk assessment. However,
operational errors that result in accidental loads are implicitly dealt with by using data
on experienced releases of hydrocarbons, probability of ignition etc. Explicit
prediction of design and fabrication errors and omissions for a given structure is
impossible. However, it is possible to rate the likelihood of accidents as compared to
gross errors (Bea, 2000a-b, Lotsberg et al., to appear).
The risk analysis methodology currently applied in offshore engineering is reviewed
in detail by Vinnem (1999). In connection with accidental loads, the purpose of the
18
Tolerable
Unacceptable
Acceptable
Acceptable
Criteria
Acceptance
Risk
Criteria
Acceptance
Risk
Risk Evaluation
Risk Evaluation
Analysis
Consequence
Analysis
Frequency
Measures
Reducing
Risk
Measures
Reducing
Risk
Risk Picture
Risk Picture
Hazard Identification
Hazard Identification
System Definition
System Definition
Risk Analysis Planning
Risk Analysis Planning
RISK ESTIMATION
RISK ESTIMATION
RISK ANALYSIS
RISK ANALYSIS

19. risk analysis is to determine the accidental events which annually are exceeded by a
probability of 10-4
.
Consequences
Fig. Schematic sketch of the event – fault tree method.
3.8 Failure probability implied by Accidental Collapse Limit State Criteria
The initial damage in the ALS criterion, (e.g. due to fires explosions, ship impacts, or,
fabrication defects causing abnormal fatigue crack growth), corresponds to a
characteristic event for each of the types of accidental loads which is exceeded by an
annual probability of 10-4
, as identified by risk analyses. The (local) damage, or
permanent deformations or rupture of components need to be estimated by accounting
for nonlinear effects.
The structure is required to survive in the various damage conditions without global
failure when subjected to expected still-water and characteristic sea loads which are
exceeded by an annual probability of 10-2
. In some cases compliance with this
requirement can be demonstrated by removing the damaged parts and then
accomplishing a conventional ULS design check based on a global linear analysis and
component design checks using truly ultimate strength formulations. However, such
methods may be very conservative and more accurate nonlinear analysis methods
should be applied, as described subsequently.
The conditional probability of failure in a year, for the damaged structure, can be
estimated by Eqs. (1-2), assuming that the system failure can be modelled by one
failure mode and that the design criterion is fully utilized. The design checks in the
ALS criterion is based on a characteristic value of the resistance corresponding to a
95% or 5% fractile, implying a BR = 1.1. The characteristic load effect due to
functional and sea loads are 1.0-1.2 and 1.2-1.3 of the corresponding mean annual
values, respectively. The safety (load and resistance) factors are generally equal to 1.0
for both checks. For environmental loads, this conditional failure probability will be
of the order of 0.1.
The intended probability of total loss implied by the ALS criterion for each category
of abnormal strength and accidental load would then be of the order of 10-5
(Moan,
1983). Obviously, such estimates are not possible to substantiate by experiences.
3.9 Design for damage tolerance
Introduction
The current regulations for offshore structures in Norway are based on the following
principles:
- Design the structure to withstand environmental and operational loading
throughout its lifecycle.
19
Fault tree Event tree
event
End
event
Critical

20. - Prevent accidents and protect against their effects
- Tolerate at least one failure or operational error without resulting in a major hazard
or damage to structure
- Provide measures to detect, control, and mitigate hazards at an early time
accidental escalation.
Accidental Collapse Limit State criteria can be viewed as a means to reduce the
consequences of accidental events (Fig. 17). The NORSOK N-001 code specifies
quantitative ALS criteria based on an estimated damage condition and a survival
check. The robustness criteria in most other codes, however, do not refer to any
specific hazard but rather require that progressive failure of the structure with one
element removed at a time, is prevented. Hence, no performance objective for a “real
threat” is created.
The weakness with such a criterion is that it does not distinguish between the
differences in vulnerability
In a risk analysis perspective the ALS check of offshore structures is aimed at
preventing progressive failure and hence reduce the consequences due to accidental
loads, as indicated in Figure 17. Beside progressive structural failure, such events
may induce progressive flooding and hence the capsizing of floating structures.
End events:
Fig. The role of ALS in risk control Fig. Accidental Collapse Limit State
(NPD, 1984)
The relevant accidental loads and abnormal conditions of structural strength are drawn
from the risk analysis, see e.g. Vinnem (1999) and Moan (2000b), where the relevant
factors that affect the accidental loads are accounted for. In particular, the risk
reduction can be achieved by minimizing the probability of initiating events: leakage
and ignition (that can cause fire or explosion), ship impact, etc. or by minimizing the
consequences of hazards. The passive or active measures can be used to control the
magnitude of an accidental event and, thereby, its consequences. For instance, fire
loads are partly controlled by sprinkler/inert gas system or firewalls. Fenders are
commonly used to reduce the damage due to collisions.
ALS checks apply to all relevant failure modes as indicated in Table 6. An account of
accidental loads in conjunction with the design of the structure, equipment, and safety
systems is a crucial safety measure to prevent escalating accidents. Typical situations
20

21. where direct design may affect the layout and scantlings are indicated by Table 7 for
different subsystems:
- loads-carrying structure & mooring system
- process equipment
- evacuation and escape system
Table 6 Examples of accidental loads for relevant failure modes of platforms.
Structural
concept
Failure mode Relevant accidental load or condition
Fixed platforms Structural failure All
Floating
platforms
Structural failure All
Instability • Collision, dropped object, unintended
pressure…, unintended ballast that
initiate flooding
Mooring system strength • Collision on platform
• Abnormal strength
Tension-leg
platforms
Structural failure All
Mooring - slack
system - strength
• Accidental actions that initiate flooding
• Collision on platform
• Dropped object on tether
• (Abnormal strength)
Table 7 Design implications of accidental loads for hull structure
Load Structure Equipment
Passive protection
system
Fire
Columns /deck (if not
protected)
Exposed equipment (if not
protected)
Fire barriers
Explosion Topside (if not protected)
Exposed equipment (if not
protected)
Blast / Fire
barriers
Ship
impact
Waterline structure
(subdivision) (if not
protected)
Possibly exposed risers, (if
not protected)
Possible fender
systems
Dropped
object
Deck Buoyancy elements
Equipment on deck, risers
and subsea (if not protected) Impact protection
Fig. Fire and explosion scenarios.
The fire thermal flux may be calculated on the basis of the type of hydrocarbons, its
release rate, combustion, time and location of ignition, ventilation and structural
geometry, using simplified conservative semi-empirical formulae or
analytical/numerical models of the combustion process. The heat flux may be
determined by empirical, phenomenological or numerical method (SCI, 1993;
BEFETS, 1998). Typical thermal loading in hydrocarbon fire scenarios may be 200-
21

22. 300 kW/m2
for a 15 minutes up to a two hours period. The structural effect is
primarily due to the reduced strength with increasing temperature. An A-60 fire
protection wall may be applied for a heat load of 100kW/m2
and less, while H-rated
protection walls are needed for higher heat loading.
In the case of explosion scenarios, the analysis of leaks is followed by a gas dispersion
and possible formation of gas clouds, ignition, combustion and the development of
overpressure. Tools such as FLACS, PROEXP, or AutoReGas are available for this
purpose (Moan, 2000b; Czujko, 2001, Walker et al., 2003). The variability of
conditions is accounted for by using a probabilistic approach.
The results from the gas explosion simulations are the pressure – time history. If the
pressure duration is short compared to the natural period, the pressure impulse
governs the structural response. Figure compares the predicted impulse by state of a
state of the art CFD method with measured values in large scale tests for deterministic
explosion scenarios. The vertical axis is a logarithmic plot of the ratio of the predicted
and measured value. The scattering is seen to be significant. The pressure peaks would
obviously be even more uncertain.
ExperimentNo
Fig. Comparison of predicted and measured pressure impulse for “deterministic”
explosion scenarios, obtained by the computer code FLACS.
The typical overpressures for topsides of North Sea platforms are in the range 0.2-0.6
barg, with duration of 0.1-0.5s., while an explosion in open air at the drill floor
typically implies 0.1 barg with duration of 0.2s. The explosion pressure in a totally
enclosed compartment might be 4 barg.
The damage due to explosions may be determined by simple and conservative
singledegree-of freedom models (NORSOK N-004). In several cases where simplified
methods have not been calibrated, nonlinear time domain analyses based on numerical
methods like the finite element method should be applied. A recent overview of such
methods may be found in Czujko (2001). Fig. shows an explosion panel with
deformations as determined by an experiment and finite element analysis. The
calculated and measured deflections of the specimen are compared in Figure 21c.
Fire and explosion events that result from the same scenario of released combustibles
and ignition should be assumed to occur at the same time, i.e. to be fully dependent.
22
Ratio ofpredictedand measuredImpulse
0.1
1.0
10.0

23. The fire and blast analyses should be performed by taking into account the effects of
one on the other. The damage done to the fire protection by an explosion preceding the
fire should be considered.
a) Experiment b) FE analysis c) Load–response histories
Fig. Explosion response of an explosion wall (Czujko, 2001).
Fig. “Survival analysis” of a deck suffering explosion damage (Amdahl, 2003).
Deformations in the lower figure are not to scale.
Fig. shows results from an analysis of a deck structure in a floating platform
(Amdahl, 2003). The upper left figure in this slide illustrates the deck structure of a
floating production platform. The design pressure on the East Wall is also indicated. In
this case it is assumed that the panels are badly damaged that they can be removed.
The lower figure shows the deformation pattern of the damaged deck.
23
Experiment Analysis
PRESSURE[N/2]
DISPLACEMENT [mm]
0.7
0.6
0.5
0.4
0.3
0.2
0.1
0
100
80
60
20
0 40
5bar
>
max
P

24. Ship impacts
Significant efforts have been devoted to ship-ship collisions, as reviewed by the ISSC
Committee on Collision and Grounding (Paik et al., 2003). The analysis of ship
impacts on offshore structures follows the same principles but the collision scenarios
and consequences are different; see e.g. NORSOK N-003 and -004 as well as Amdahl
(1999).
All ship traffic in the relevant area of the offshore installation should be mapped and
should account for possible future changes in the operational pattern of vessels. The
impact velocity can be determined based on the assumption of a drifting ship or on the
assumption of erroneous operation of the ship. Ship traffic may therefore for this
purpose be divided into categories: trading vessels and other ships outside the offshore
activity, offshore tankers, and supply or other service vessels. Merchant vessels are
often found to be the greatest platform collision hazard which depends upon the
location of the structure relative to shipping lanes. Fig. a indicates situations where
offshore structures are operating in close proximity. For the scenario in Fig. 23b the
stern impact on the FPSO by the shuttle tanker is a challenge (Chen and Moan, 2004 )
a) Semi- submersible and jacket b) FPSO and shuttle tanker
Fig. Special offshore collision scenarios.
Impact scenarios are established by considering bow, stern, and side impacts on the
structure as appropriate.
While historical data provides information about supply vessel impacts, risk analysis
models are necessary to predict other types of impacts, such as incidents caused by
trading vessels (see e.g. NORSOK N-003(1999) and Moan (2000b)). A minimum
accidental load corresponding to 14 MJ and 11 MJ sideways and head-on impact,
respectively, is required to be considered.
The impact damage can normally be determined by splitting the problem into two
uncoupled analyses. They are the external collision mechanics dealing with global
inertia forces and hydrodynamic effects and internal mechanics dealing with the
energy dissipation and distribution of damage in the two structures (Fig.).
The external mechanics analysis is carried out by assuming a central impact and
applying the principle of conservation of momentum and conservation of energy.
The next step is to estimate how the energy is shared among the offshore structure and
the ship. Methods for assessing the impact damage are described by Amdahl (1999),
based on simplified load-indentation curves or direct finite element analysis. For the
general case where both structures absorb energy, the analysis has to be carried out
incrementally on the basis of the current deformation field, contact area and force
distribution over the contact area.
24

25. External mechanics¾ The fraction of the kinetic
energy to be absorbed as deformation
energy (structural
damage) is
determined by means of: 9 Conservation of
momentum
9 Conservation of energy
External mechanics
Internal mechanics
¾ Energy dissipated
by vessel
and offshore structure
9 Equal force level
9 Area under force-def. curve
dws Ship FPSO dwi
Internal mechanics
Fig. Simplified methods for calculating impact damage (NORSOK N- 004)
The recent advances in computer hardware and software have made nonlinear finite
element analysis (NLFEM) a viable tool for assessing collisions. A careful choice of
element type and mesh is required. It is found that a particularly fine mesh is required
in order to obtain accurate results for components deformed by axial crushing. A
major challenge in NLFEM analysis is the prediction of ductile crack initiation and
propagation. This problem is yet to be solved. The crack initiation and propagation
should be based on fracture mechanics analysis using the J-integral or Crack Tip
Opening Displacement method rather than simple strain considerations.
While the main concern about ship impacts on fixed platforms is the reduction of
structural strength and possible progressive structural failure, the main effect for
buoyant structures is damage that can lead to flooding and, hence, loss of buoyancy.
The measure of such damages is the maximum indentation implying loss of water
tightness. However, in the case of large damage, reduction of structural strength, as
expressed by the indentation, is also a concern for floating structures.
A ship impact involving the minimum energy of 14 MJ will normally imply an
indentation of 0.4 – 1.2 m in a semi-submersible column. A 75-100 MJ impact may be
required to cause an indentation equal to the column radius (Moan and Amdahl,
1989). The effect is highly dependent upon the location of impact contact area relative
to decks and bulkheads in the column.
Moan and Amdahl (2001) considered supply or merchant vessels with a displacement
of 2000- 5000 tons which caused bow impacts on a typical side structure of an FPSO
with displacement of about 100 000 t. For this case the limiting energy for rupture of
the outer ship side was found to be ~10 MJ (700mm bow displacement). The energy at
1500mm bow indentation was estimated to be ~43 MJ while the limiting energy for
rupture of the inner side is ~230 MJ, at 3700 mm bow displacement. This corresponds
to a critical speed of 18.5 knots for a 5000 tons displacement vessel. We recall that
rupture of plate material is very uncertain such that the quoted energy level should be
used with cautiously. If the FPSO side structure is assumed to be sufficiently rigid to
25
,i
s
E
s,s
E
s
R
i
R

26. ensure that all energy is absorbed by the bow, then the maximum collision force (peak
force) is 30 MN. However most of the time the force oscillates between 15-25 MN.
Another situation dealt with by Moan and Amdahl was stern impact on the FPSO
caused by a shuttle tanker, see Fig.
A 70 kdwt shuttle tanker was found to penetrate the machine room of a 140 kdwt
FPSO after an energy dissipation of 38 MJ. On the other hand, it was demonstrated
that it was feasible to strengthen the stern of the FPSO corresponding to ice-
strengthening dimensions so that all dissipation could occur in the shuttle tanker bow.
Fig. 25: Shuttle tanker in ballast condition impacting FPSO stern (Moan and
Amdahl, 2001).
3.10 Quality assurance and control of the design process
The quality assurance and control of the engineering process have to address two
different situations, which require different type of attention, namely:
- detect, control and mitigate errors made in connection with technology that is
known in the engineering community as such
- identify possible unknown phenomena, e.g. associated with load, response and
resistance, and clarify the basis for accounting for such phenomena in design
Offshore structures are developed in several stages: conceptual, engineering and
detailed engineering phases. QA/QC needs to be hierarchical, too, with an emphasis of
the latter QA/QC process in the conceptual and early design phases.
Errors can occur due to individual errors and omissions, inadequate procedures,
software and lack of robustness of the organizations. Errors of omission and
commission, violations (circumventions), mistakes, rejection of information, and
incorrect transmission of information (communication errors) have been the dominant
causes of failures. The lack of adequate training, time, and teamwork or back-up
(insufficient redundancy) have been responsible for not detecting and correcting many
of these errors (Bea, 2000b).
With the advent of computers and their integration into many aspects of the design,
construction, and operation of oil and gas structures, software errors are also a
concern. Newly developed, advanced, and frequently very complex design technology
applied in the development of design procedures and the design of the offshore
structures has not been sufficiently debugged and failures have resulted.
Software errors, in which incorrect and inaccurate algorithms were coded into
computer programs, have been at the root-cause of several recent failures of offshore
structures. Guidelines have been developed to address the quality of the computer
software for the performance of finite element analyses. An extensive benchmark
26
FPSO
tanker
Shuttle
Forcastledeck
Upperdeck

27. testing is required to assure that the software performs as it should and that the
documentation is sufficient. One particular importance is the provision of independent
checking procedures that can be used to validate the results from analyses.
It is found that errors are often made by individuals in organizations with a culture that
does not promote quality and reliability in the design process. The culture and the
organizations do not provide the incentives, values, standards, goals, resources, and
controls that are required to achieve adequate quality.
The loss of corporate memory in companies responsible for structural safety also has
been a factor contributing to many cases of structural failures. Knowledge of the
painful lessons in the past was lost and the lessons were repeated with generally even
more painful results. Such loss of corporate memory is particularly probable in times
of down-sizing, outsourcing and mergers (Bea, 2000a-b).
QA/QC of the engineering process
QA is the proactive process in which the planning is developed to help preserve
desirable quality. QC is the interactive element in which the planning is implemented
and carried out. QA/QC measures are focused both on error prevention and error
detection and correction (Harris and Chaney, 1969). There can be a real danger in
excessively formalized QA/QC processes. If not properly managed, they can lead to
generation of paperwork, a waste of scarce resources that can be devoted to QA/QC,
and a minimum compliance mentality.
It is important that the QA/QC is hierarchical, in other words it should be performed
by designers and others doing the work, their colleagues, and third parties. While
selfchecking is very important, Matousek and Schneider (1976) found that 87% of the
errors causing accidents in the construction industry, could have been detected either
by the person next in line or by properly organized additional checks. Therefore, an
additional QA/QC is necessary. A good support in organization by experienced
managers, who have daily responsibilities for the quality of the project organizations
and processes, is crucial. In the same way as the structure should be damage tolerant,
the design organizations also need to be robust. It is when the organization or the
operating team encounters defects and damage – and is under serious stress, that the
benefits of robustness become evident. Robust organizations have extensive auditing
procedures to help spot safety problems and they have reward systems that encourage
risk mitigating behaviours.
Nevertheless, knowledgeable, trained, experienced, and sensitive third parties can
help, encourage, and assist the owners of the concept to improve. The third-party QA
and QC checking measures which are an integral part of the offshore structure design
process provide an independent review. This checking should start with the basic tools
(guidelines, codes, computer programs) of the structure design process to assure that
‘standardized errors’ have not been embedded in the design tools. The checking
should continue through the major phases of the design process, with a particular
attention given to the loading analysis. Moreover the plans for fabrication and
operation (manuals) also constitute an important part of the QA and QC process. The
provision of adequate resources and motivations is also necessary, particularly the
willingness of management and engineering to provide integrity to the process and to
be prepared to deal adequately with ‘bad news’.
The true value of QA and QC lies in the disciplined process. The main objective of
QA/QC is detection of errors and omissions and not their prediction. Yet the attempt
made by Lotsberg et al. (to appear) is an interesting effort to assess the risk associated
27

28. with gross errors and omissions. Unfortunately, sometimes the results of formal risk
analysis approaches are only used to justify a compliance with regulatory targets and,
in some cases the implementation is not clearly justified and needs improvements in
the reliability of an engineered system.
The intensity and the extent of the design checking process need to be matched to the
particular design situation. Repetitive designs that have been adequately tested in
operations to demonstrate that they have the required quality do not need to be
verified and checked as closely as those that are ‘first-offs’ and ‘new designs’ that may
push the boundaries of the current technology. New technologies compound the
problems of latent system flaws (Reason, 1997).
4. Concluding remarks
Various measures to ensure an adequate safety in offshore structures have been
reviewed based upon relevant accidents. A design criteria as well as load and
structural analysis methods have been briefly presented. It is demonstrated how
structural reliability analysis can be used to establish consistent design criteria for
ultimate resistance and fatigue, and especially how refinement of analysis methods
and additional information reduce uncertainty and hence the necessary safety factors.
On the other hand, it is shown that the failure probability implied by current ultimate
and fatigue limit state criteria is small and does not show up in the accident statistics.
The main cause of accidents is human and organizational errors and omissions.
Therefore, to achieve an acceptable safety level, QA and QC of the engineering
process are required. This includes inspection, monitoring and repair of the structure,
as well as design for structural robustness. The QA and QC tasks, to possibly identify
new phenomena, especially associated with the loading and dynamic response, are
particularly challenging in connection with novel concepts for new environmental
conditions or new functions. In this paper, a particular emphasis is placed on the
Accidental Collapse Limit State design check related to accidental loads and abnormal
strength. The philosophy behind this robustness criterion is described and it is shown
how information has been established for a proper implementation of the criterion. In
the view of the aging of offshore structures, crack growth and rupture are particularly
addressed. It is shown how fatigue and robustness design criteria, as well as inspection
strategy can be combined for different types of offshore structures, to yield an
acceptable safety level.
References
ALK (1981) “The Alexander L. Kielland Accident”, (in Norwegian – English translation
available), NOU 1981:11, Oslo.
Almar-Næss, A. (ed.) (1985). ‘Fatigue Handbook for Offshore Steel Structures’, Tapir Publ., Trondheim.
Amdahl, J. (1999) ‘Structural Response to Accidental Loads’, Lecture Notes, Dept. of Marine
Technology, Norwegian University of Science and Technology, Trondheim.
Amdahl, J. (2003) FABIG
API (1993/1997) ‘Recommended Practice for Planning, Designing and Constructing Fixed
Offshore Platforms”, API RP2A-WSD July 1993 with Supplement 1 with Sect., 17.0,
‘Assessment of Existing Platform’, February 1997. American Petroleum Institute, Dallas.
28

29. Ayala-Uraga, E. and Moan, T. (2002) “System Reliability issues of Offshore Structures
considering Fatigue Failure and Updating based on Inspection”, First Int. ASRANet
Colloquium, Glasgow, Scottland.
Bach-Gansmo, O., Carlsen, C.A. and Moan, T. (1987) “Fatigue Assessment of Hull Girder for
Ship Type Floating Production Vessels,” Proc. Conf. on Mobile Offshore Units, London:
City University.
Bea, RG (2000a) Achieving step change in Risk Assessment & Management (RAM), Centre for
Oil & Gas Engineering, http://www.oil-gas.uwa.edu.au, University of Western Australia,
Nedlands, WA.
Bea RG (2000b) Performance Shaping Factors in Reliability Analysis of Design of Offshore
Structures, J. OMAE, Vol. 122, ASME, New York, NY.
Beckwith, I. and Skillman, M. (1975) “Assessment of the Stability of Floating Platforms”,
North East Coast Inst. of Naval Architects.
BEFETS (1998) ‘Blast and Fire Engineering for Topside Systems’, Phase 2, SCI Publication
No. 253, Ascot, UK.
Bjørheim, L., Berge, S. and Skaret, H. (2004) “Damage Tolerance of FPSOs with Fatigue
Cracks”, Proc. ISOPE Conference.
Broughton, P. (1997) "Engineering Challenges of Ekofisk, the First North Sea Oil Field’,
Proc. 8th
BOSS Conf., Pergamon Press, New York, Vol. I, pp 41-70.
BS 7910 (1999) “Guidance on Methods for Assessing the Acceptability of Flaws in Fusion Welded
Structures”, BS 7910:1999, British Standard, London, UK.
Chen, H. and Moan, T. (2004) “Probabilistic Modeling and Evaluation of Collision between Shuttle Tanker
and FPSO in Tandem Offloading”, J. Reliability Engineering and System Safety, 84, 2, 169-186.
Cornell, C.A. (1995) “Structural Reliability- Some contributions to Offshore Technology“,
Paper No. OTC 7753, Proc. 27th
Offshore Technology Conference, Houston.
Czujko, J., ed. (2001) ‘Design of Offshore Facilities to Resist Gas Explosion Hazard’',
Engineering Handbook, Offshore Design, Oslo.
Dunlap, W.A., and Ibbs, C.W. (eds) (1994) Proc. Int. Workshop on Assessment and
Requalification of Offshore Production Structures, New Orleans, Offshore Technology
Research Center, Texas A&M University and University of California, Berkeley, CA.
Fjeld, S. (1977) “Reliability of Offshore Structures”, Paper No. OTC 3027, Proc. 9th
Offshore
Technology Conf., Houston, Vol. 4, 459-472.
Harris, D. and Chaney, F. (1969) “Human Factors in Quality Assurance”, John Wiley & Sons,
London, UK.
Haver, S., ( 2000) “Evidences of the Existence of Freak Waves”, Proc. Rogue Waves 2000,
Brest, France, 129-140.
HSE (1992) “Safety Case Regulations”, Health and Safety Executive, HMSO, London.
ISO 19900 (1994) ‘Petroleum and Natural Gas Industries – Offshore Structures – Part 1:
General Requirements’, (1994), ‘Part 2: Fixed Steel Structures’, (2001), Draft,. Int.
Standardization Organization, London.
ISO 2394 (1998) “General Principles on Reliability for Structures”, International Standards
Organisation, London., Draft for approval.
ISSC (1988-1994) Proceedings of the International Ship and Offshore Structures Congress in
1988 (Lyngby, Denmark); 1991 (Wuxi, China); 1994 (St.Johns, Canada).
Jordaan, I.J. and Maes, M.A. (1991) “Rational for Load Specifications and Load Factors in the
New CSA Code for Fixed Offshore Structures”. C.J. Civil Engng. 18, 3, 454-464.
Lloyd, J.R. and Karsan, D.I. (1988) “Development of a Reliability-based Alternative to API
RP2A”, Paper No. OTC 5882, Proc. 20th . Offshore Technology Conf., Vol. 4, Houston,
593-600.
Lotsberg, I. et al. (to appear) “Risk Assessment of Loss of Structural Integrity of a Floating
Production Platform due to Gross Errors”, J. Marine Structures.
Madsen, H.O. & S.D. Sørensen (1990). “Probability-Based Optimization of Fatigue Design
Inspection and Maintenance”. Presented at Int. Symp. on Offshore Structures, University
of Glasgow.
29

30. Matousek, M. and Schneider, J. (1976) “Untersuchungen Zur Struktur des Zicherheitproblems
bei Bauwerken”, Institut für Baustatik und Konstruktion der ETH Zürich, Bericht No. 59,
ETH, Zürich.
Melchers, R.E. (1999) “Structural Reliability Analysis and Prediction”, John Wiley & Sons,
Chichester, UK.
Moan, T.(1983) “Safety of Offshore Structures”, Proc. 4th
ICASP Conference, Firenze,
Pitagora Editrice.
Moan, T. (1985) “The Progressive Structural Failure of the Alexander L. Kielland Platform” in
“Case Histories in Offshore Engineering”, G. Maier (ed.) Springer-Verlag: Berlin.
Moan, T. (1988) “The Inherent Safety of Structures Designed According to the NPD
Regulations”. Report No. F88043 , SINTEF, Trondheim.
Moan, T. (1994) “Reliability and Risk Analysis for Design and Operations Planning of
Offshore Structures”. Keynote lecture, Proc. 6th
ICOSSAR, Structural Safety and
Reliability, Vol. I, Balkema, Rotterdam, 21-43.
Moan, T. (1995) “Safety Level Across Different Types of Structural Forms and Material –
Implicit in Codes for Offshore Structures”, SINTEF Report STF70 A95210, Trondheim,
Prepared for ISO/TC250/SC7.
Moan, T. (1998) “Target levels for structural reliability and risk analysis of offshore
structures”, in Risk
Reliability in Marine Technology, Guedes Soares, C. (ed), A.A. Balkema publishers,
351368.
Moan,T. (2000a) “Recent Research and Development Relating to Platform Requalification” J.
OMAE, ASME, Vol. 122, New York, 20-32.
Moan,T. (2000b) “Accidental Actions. Background to NORSOK N-003”, Dept. of Marine
Technology, Norwegian University of Science and Technology, Trondheim.
Moan, T. (2004) “Reliability-based Management of Inspection, Maintenance and Repair of
Offshore Structures”, J. Structure and Infrastructure Engineering,
Moan, T., Berge, S. and Holthe, K., (1981a) “Analysis of the Fatigue Failure of the Alexander
L. Kielland”, ASME Winter Annual Meeting, Washington D.C.
Moan, T. and Holand, I. (1981b) “Risk Assessment of Offshore Structures Experiences and
Principles”. Proc. 3rd
ICOSSAR, Elsevier, Amsterdam, 803-820.
Moan, T and Amdahl, J. (1989) “Catastrophic Failure Modes of Marine Structures” in
Structural Failure, T.Wierzbicki and N. Jones (eds), John Wiley & Sons, Inc, New York.
Moan, T. et al. (1993a) ”Reliability-Based Fatigue Design Criteria for Offshore Structures
Considering the Effect of Inspection and Repair”, Paper No. OTC 7189, Proc. 25th
Offshore Technology Conference, Vol. 2, Houston, 591-599.
Moan, T., Karsan, D. and Wilson, T (1993b) “Analytical Risk Assessment and Risk Control of
Floating Platforms Subjected to Ship Collisions and Dropped Objects”. Paper No. OTC
7123, Proc. 25th
Offshore Technology Conf., Vol. 1, Houston, 407-418.
Moan, T., Vårdal, O.T. and Johannesen, J.M. (1999) “Probabilistic Inspection Planning of
Fixed Offshore Structures,” Proc.8th
ICASP, Applications of Statistics and Probability,
A.A. Balkema, Rotterdam, 191-200.
Moan, T. and Amdahl, J. (2001) “Risk Analysis of FPSOs, with Emphasis on Collision Risk”,
Report RD 2001-12, American Bureau of Shipping, Houston.
Moan, T. Amdahl, J. Wang, X. and Spencer, J. (2002) “Risk Analysis of FPSO, with particular
emphasis on collisions”, Trans SNAME., Vol. 110, 307-339.
Moore, W. et al (2003) “Report of Specialist Committee V.1 Risk Assessment” Proc. 15th
ISSC Congress, Vol. 2, Elsevier, Amsterdam.
Moses, F. (1987). “Load and Resistance Factor Design-Recalibration LFRD” Report API
PRAC 87-22. API, Dallas, Texas.
NORSOK N-001 (2002) “Structural Design”, Norwegian Technology Standards, Oslo.
NORSOK N-003 (1999) “Actions and Action Effects”, Norwegian Technology Standards,
Oslo.
NORSOK N-004 (1998b) “Steel Structures”, Norwegian Technology Standards, Oslo.
NORSOK Z-013 (1998a) “Risk and Emergency Preparedness Analysis”, NORSOK Standard
Z-013, NTS, Oslo, Rev. 1.
30

31. NPD (1977) “Regulation for the Design of Fixed Structures on the Norwegian Continental
Shelf”. Norwegian Petroleum Directorate, Stavanger.
NPD (1981) “Guidelines for Safety Evaluation of Platform Conceptual Design.” Norwegian
Petroleum Directorate, Stavanger.
NPD (1984) “Regulations for load-carrying structures for extraction or exploitation of
petroleum”, The Norwegian Petroleum Directorate, Stavanger.
NPD (1991) “Regulations Relating to Implementation and Use of Risk Analysis in the
Petroleum Activities”, Norwegian Petroleum Directorate, Stavanger.
OR (1984) Royal Commission on the Ocean Ranger Marine Disaster: “Report One: The Loss
of the Semi-submersible Drill Rig Ocean Ranger and its Crew”, Edifice Fort William, St.
Johns Newfoundland.
Paik, J.K. et al (2003) “Report of Committee V.2 Collision and Grounding”, Proc. 15th
ISSC,
Vol. 2, Elsevier, Amsterdam.
Paik, J.K. and Thayamballi, A.K. (2003) “Ultimate Limit State Design of Steel-Plated
Structures”, John Wiley & Sons, Chichester.
P-36 (2001) “Workshop on the Accident with the P-36 Platform”, Petrobas and Coppe (eds),
Rio de Janeiro, Brazil.
PA (1990) “The Public Inquiry in the Pipe Alpha Disaster”, Inquiry Commission HMSO,
London.
Prevosto, M. and Forristall, G.Z. (2002) “Statistics of wave crests from models vs.
measurements”, Paper No. 28443, Proc. 21st OMAE Conference, Oslo.
Reason, J. (1997) “Managing the Risks of Organizational Accidents”, Ashgate Publishers,
Aldershot, UK.
Sarpkaya, T. and Isaacson, M. (1981) “Mechanics of Wave Forces on Offshore Structures”,
Van Nostrand Reinholdt, New York.
SCI(1993) “Interim Guideance Notes for the Design and Protection of Topside Structures
against Explosion and Fire”, Steel Construction Institute, Document SCI-P-112/503,
London.
Sigurdsson, G., Lotsberg, I., Myhre, T. and Ørbeck-Nilssen, K. (2000) “Fatigue Reliability of
Old Semi-submersibles,” OTC Paper no 11950, Proc. Offshore Technology Conference,
Houston.
Skallerud, B. and Amdahl, J. (2002) “Nonlinear Analysis of Offshore Structures”, Research Studies
Press.
Smith, C.S. (1977) “Influence of Local Compressive Failure on Ultimate Longitudinal Strength of
Ships hull” Proc. PRADS, Tokyo, 73-79.
Vårdal, O.T. and Moan, T. (1997) "Predicted versus Observed Fatigue Crack Growth.
Validation of Probabilistic Fracture Mechanics Analysis of Fatigue in North Sea Jackets",
Paper No. 1334, Proc. 16th
OMAE Conference, Yokohama, Japan.
Vårdal. O.T. , Moan, T. and Bjørheim, L.G. (2000) "Applications of Probabilistic Fracture
Mechanics Analysis for Reassessment of Fatigue Life of a Floating Production
UnitPhilosophy and Target Levels", Paper No. 00-2078, Proc. 19th
OMAE Conference,
New Orleans.
Vinnem, J.E. (1999) “Offshore Risk Assessment”, Kluwer Academic Publishers, Doordrecht.
Walker, S. et al. (2003) “New Guidance on the Design of Offshore Structures to Resist the
ExplosionHazard” Paper No. 203-37120, Proc. 22nd
OMAE Conference, Cancun, Mexico.
Wirsching, P.H. (1983) “Probability-based Fatigue Design Criteria for Offshore Structures”
Report API-PRAC Project No. 81-15, Dept. of Aerospace and Mechanical Engng.
University of Arizona, Tucson.
WOAD: “Worldwide Offshore Accident Databank”, Det Norske Veritas, Oslo, 1996.
Yao, T, et al. (2000) “Report of ISSC Committee VI.2. Ultimate Hull Girder Strength”, Proc.
14th
ISSC Congress, Nagasaki.
Acronyms
31

32. ALS - Accidental Collapse Limit State
API - American Petroleum Institute
FDF – Fatigue Design Factor
(to multiply with the service life to get desired characteristic value of fatigue
life)
FLS - Fatigue Limit State
HOF - Human and Organizational Factors
HSE - Health and Safety Executive, UK
IMO - International Maritime Organization
ISO - International Standardization Organization
MMS-Mineral Management Services, USA
NPD - Norwegian Petroleum Directorate (now: Petroleum Safety Authority, Norway)
TLP - Tension Leg Platform
WOAD – World Accident Data Bank, issued by Det Norske Veritas
32