This action might not be possible to undo. Are you sure you want to continue?
SAFETY OF OFFSHORE STRUCTURES
Professor Norwegian University of Science and Technology and Keppel Professor National University of Singapore
Centre for Offshore Research & Engineering National University of Singapore
Keppel Offshore and Marine Lecture
November 26. 2004
Safety of Offshore Structures
Professor Torgeir Moan
Director, Centre for Ships and Ocean Structures, Norwegian University of Science and Technology Keppel Professor, National University of Singapore
The Second Keppel Offshore & Marine Lecture was delivered by Professor Torgeir Moan at the National University of Singapore (NUS) on 26 November 2004. This report is the written version of the lecture. The Lecture was supported by many professional
societies, including American Society of Mechanical Engineers (Singapore Section), The Institution of Engineers Singapore, The Institute of Structural Engineers, The Joint Branch of Royal Institution of Naval Architects and Institute of Marine Engineering Science & Technology, Society of Naval Architects and Marine Engineers Singapore, Singapore Shipping Association and Singapore Structural Steel Society. The Keppel Professorship in Ocean, Offshore and Marine Technology in NUS was launched officially by His Excellency, President S.R. Nathan of Singapore and Chancellor of NUS on 19 September 2002. The Professorship has been established
under the Department of Civil Engineering, and is part of the bigger umbrella of the Centre for Offshore Research & Engineering (CORE) in NUS. CORE has received seed funding from Keppel Offshore & Marine Ltd and Economic Development Board (Singapore). The Centre aims to be a focal point for industry participation and activities in Singapore, and promotes multi-disciplinary research by drawing on the expertise of various universities, research institutes, and centres for integrated R&D. Professor Moan, the first Keppel Professor, is an academic of international stature through his 30 years of close involvement in the international offshore oil and gas and marine fraternity. He brings a global perspective to promote R&D in Singapore, with a particular emphasis on the technological interests of Keppel Offshore & Marine. He will serve as the beacon of guidance and inspiration for academics as well as industry. CORE acknowledges the significant support of everyone in Keppel Offshore & Marine, especially Mr Choo Chiau Beng, Mr Tong Chong Heong and Mr Charles Foo, for their immense contributions. CORE is working closely in partnership with Keppel on R&D, Education and Training to draw young talents into the offshore and marine industry.
Safety of Offshore Structures
Torgeir Moan Centre for Ships and Ocean Structures Norwegian University of Science and Technology
An overview of important developments regarding safety management of offshore structures is given. Based on relevant experiences with accidents, the hazards and the means to control the associated risk are categorized from a technical-physical as well as human and organizational point of view. This includes considerations of the risk associated with fatigue, corrosion and other degrading phenomena. The risk can be controlled by use of adequate design criteria, inspection, repair and maintenance of the structures as well as quality assurance and control of the engineering processes. Such measures are briefly outlined, while the emphasis is placed upon a quantitative design approach for dealing with structural robustness. In this connection the inherent differences in the robustness of various structural concepts are pointed out. The application of reliability methodology to obtain quantitative measures of structural safety relating to ultimate failure as well as handle the combined effect of design, inspection and repair strategy on fatigue failure is highlighted. The application of risk analysis to establish robustness criteria corresponding to a certain risk acceptance level is briefly mentioned. The challenges of Quality Assurance and Control to new structures are briefly outlined, with particular reference to recent examples of new loading phenomena such as ringing and springing of platforms.
Fig. 2 shows phases in the life cycle of offshore structures.S. The life cycle of marine systems is similar to that of other systems. such as some of those in the North Sea. Serviceability requirements depend upon the function of the structure. Drilling units need to be mobile while production platforms are generally permanent. Various kinds of platforms are used to support exploratory drilling equipment. Twenty percent of these hydrocarbons are recovered from reservoirs beneath the seabed. dollars and significant operational costs. represent investment of billions of U. Safety re1 . 1. and the chemical (production) plants required to process the hydrocarbons. Offshore structures need to fulfil serviceability and safety requirements. 1 Subsea oil and gas exploitation The continuous innovations to deal with new serviceability requirements and demanding environments as well the inherent potential of risk of fires and explosions have lead to an industry which has been in the forefront of development of design and analysis methodology. which is to provide a platform and support of equipment for drilling or for the production of hydrocarbons. In the life cycle phases of structures the design phase is particularly important. This paper is limited to deal with offshore structures. Introduction Oil and gas are the dominant sources of energy in our society. 1c). In this aspect the recycling of the material is an important issue. see Fig. In view of the ecological issue removal or clean-up need to be considered. Production platforms are commonly designed to carry large chemical factories together with large hydrocarbon inventories (Fig.1. Large production platforms. Pipelines or tankers are used to transport the hydrocarbons to shore. a) Offshore oil and gas exploitation b) Platform for exploratory drilling operation c) Platform for oil and gas production (chemical processing) Fig.
serviceability & . The focus here is on the structural safety during the life cycle of the platforms.quirements are introduced to limit fatalities as well as environmental and property damages. 2: Life cycle phases of offshore structures The safety management of structures is different for different industries depending on the organisation as well as regulatory contents.Fabrication plan .safety Data. methods. not purely experimental Integrated total. Typically authorities in the continental shelf states have to issue regulations. Initially civil engineering was the driving force for structural safety management. Later the 2 . A rational safety approach should be based on: Goal-setting. which primarily are handled by national authorities. not hardware Design for . Over the time safety management of offshore structures has been developed. in parallel with the evolvement of the technology and the competence to deal with it. However the provisions for stability and other maritime issues are based on those of IMO and their corresponding national organizations. Classification societies primarily provide rules for drilling units and services for production facilities.Operation plan Inspection/ monitoring/ repair / maintenance Reassessment Removal and reuse Fabrication & Operation data Fig. criteria Layout/ Scantlings Fabrication . not deterministic First principles. For instance the safety management of offshore structures differs from that for trading ships.producability . Since early 1990s ISO has been developing a harmonized set of codes for offshore structures with contribution from all countries with major offshore operations.Inspection/repair Operation . not separately Balance of safety elements. One reason for this difference is the fact that safety management of trading vessels emerged for centuries through empiricism while off-shore structures have primarily come about in the last 50 years when first principles of engineering science had been adequately developed to serve as basis for design. not prescriptive Probabilistic. Similarly the regulatory regime differs between ships and offshore structures in that offshore operation take place on continental shelves under the jurisdiction of the local government. Examples of these are MMS/API in USA. HSE in UK and NPD in Norway.
Such criteria are exemplified in relation to fires. an outline of various measures to manage the safety or ensure that the risk is within acceptable limits.aeronautical and nuclear industries also played an important role. Accident Experiences 2. Criteria to prevent progressive structural failure after fatigue failure or accidental damage would have implications on overall layout of all types of platforms. In particular it is explained how fatigue failures can be avoided by design as well as inspections and regular monitoring of the structure. Emphasis is placed on how structural robustness can be ensured by using so-called Accidental Collapse Limit State (ALS) criteria. Among the milestones is the introduction of Risk Analysis in 1981 and Accidental Collapse Design criterion in 1984 by the Norwegian Petroleum Directorate and the HSE Safety case approach in 1992. explosions and other accidental loads. this implies that accidents on offshore facilities affect the general public to a lesser extent than accidents on similar facilities on land. when the ALARP principle . On the other hand. fabricated and operated in such a manner that the probability of the following failure modes is adequately small: . variable. Moreover the oil and gas represent energy with large potential accident consequences. If the location is far off shore then evacuation and rescue will be difficult. Finally.as large as reasonably practicable – was introduced for determining the target safety level. Otherwise a structural strength criterion affects the scantlings of the stiffened. Quality Assurance and/or Quality Control of the engineering process will be described with particular reference to dealing with unknown wave loading and response phenomena. rigid body instability (capsizing) under permanent. However in the last 20-30 years the developments in the offshore industry has had a significant impact on the development of safety approaches. In the following sections accident experiences on offshore structures will be briefly explained. Companies involved in structures and/or facilities that experience accidents may suffer loss of reputation and this may damage the public’s trust on the companies.failure of (parts of) the structure foundation or mooring systems. Then. This includes: Design and inspection criteria as well as reliability methodology to calibrate the partial safety factors to correspond to a defined acceptable safety level. Hence the insight about safety features can be gained from detailed information about accidents and failures. considering permanent. The rationalisation of safety management of offshore structures began in early 70’s. This is partly because the offshore industry plays a key role in the “world’s economy”. To limit the likelihood of fatalities and environmental and property damages. flat. it is mandatory to study the detailed accounts provided from investigations of catastrophic accidents since the 3 . variable and environmental loads .1 Accident experiences at large Safety may be regarded as the absence of accidents or failures. 2. To learn about the intrinsic nature of accidents. offshore structures should be designed.overall. and environmental as well as accidental loads Stability requirements for floating platforms affect the layout and the internal structure – subdivision in compartments. and cylindrical panels that typically constitute floating offshore structures. is given.
load effects. Global failures normally develop in a sequence of technical and physical events. during survival testing c) Piper Alpha fire and explosion in 1988 d) P . 1984).36 accident in 2001 Fig. such as ones given in WOAD (1996). The explanation might be that design was based on an inadequate wave conditions or load calculation. 4b. fabrication processes or in the operation itself. This includes possible deficiencies in relevant codes. However. Ocean Ranger in 1982 (OR. Such studies include those of the platforms Alexander Kielland in 1980 (ALK.capsizing/sinking . Kielland before and after capsizing in 1980 b) Model of Ocean Ranger. the reason could be inadequate air-gap provided in the design. Moan and Holand. provide an overview. This is one of many platforms that were damaged during the passage of the hurricane Lilli. Finally. In the case of the exceptional wave in Fig. and P-36 in 2001 (P-36. The damage could also be due to the occurrence of a particular a wave phenomenon.positioning system failure the former two modes represent catastrophic events while the latter one is only critical for Tension-leg platforms. 1981b). resistance and safety factors. To explain from a human and organizational point of view why the platform was not strong enough to resist the wave forces. See also Bea (2000a. the question is whether the extreme crest height of 18. In addition. the safety factors might not have been sufficient to cover the inherent uncertainties.5 m should be considered as the socalled “freak” wave or simply a rare wave. a) Alexander L. Yet another explanation might be that an improper strength formulation was used (as was the case in design of early generation platforms). we have to look at the decisions that were made during the design phase regarding loads. Piper Alpha in 1988 (PA.structural failure . 1990). 3: Examples of accidents which resulted in a total loss. to fully understand accidents it is necessary to interpret them in the view of human and organizational factors (HOF). possible unknown phenomena that have materialized as well as possible errors and omissions made in engineering processes. 4b) or another “unknown” wave phenomenon. For each of these possible causes. Alternatively. which capsized in 1982. 2003). two explanations need to be 4 . Global failure modes of concern are . Let us consider an example: The platform shown in Figure 4a in the Gulf of Mexico. such as an abnormal wave crest (see Fig.necessary resources are then spent to investigate such accidents. 1981. 2000b). the statistics about offshore accidents. Physically there is no doubt that this accident was due to extreme wave forces.
closed electrical circuit. Table 1 shows accident rates for mobile (drilling) and fixed (production) platforms according to the initiating event of the accident WOAD (1996). 1995. 18 5 b) Wave record from a platform site in the North Sea on January 1. In this connection it is noted that several types of environmental load phenomena. P-36 was lost after: an accidental release of explosive gas. Table 1 is primarily based upon technical-physical causes. 4 Structural damage due to environmental loads The technical-physical sequence of events for the Alexander Kielland platform was: fatigue failure of one brace. if the phenomenon is known but subject to significant uncertainties. such as green water on deck and slamming (Fig. these two explanations have different implications on the risk reducing actions. progressive flooding. fires and explosions which should not occur but do so because of errors and omissions during operation. of course accidents caused by loads such as ship impacts. capsizing and sinking after 6 days. loss of column. Severe weather conditions would normally affect capsizing/ foundering as well as structural damage. In general. disabled ballast pumps. For floating platforms. flooding into deck. burst of emergency tank. overload failure of 5 other braces. Structural damage can cause progressive structural failure or flooding. 2) Errors and omission were made during design or fabrication! Obviously. The most notable in this connection is. In most cases there existed human errors or omissions by designers. accidents take place in sequences. In general. flooding through chain lockers and capsizing. as well as escalating explosion and fire events. the design approach taken is normally conservative. 4 c-d) are subjected to large uncertainties. erroneous ballast operation. fabricators or operators of the given installation was a major contributor to the accident. Progressive flooding at5 . Piper Alpha suffered total loss after: a sequence of accidental release of hydrocarbons. a)Severe damage caused on a jacket platform in the Gulf of Mexico by Hurricane Lilli c) Green water and deck slamming on FPSO d) Deck slamming on semisubmersible platform Fig. accidental explosion in a column. namely 1) The state of art in offshore engineering was inadequate at the time of design . the loss of buoyancy and stability is commonly an important aspect of total loss scenarios. For Ocean Ranger the accident sequence was: flooding through broken window in ballast control room.considered. and capsizing.
0 1970-79 /80-95 1970-79 /80-95 1970-79 /80-95 Collision / contact 24. In other situations through-the-thickness cracks were detected by inspections before they caused catastrophic failures (Moan.5/0.2/1.1 1.8 1.9 Structural damage 25.1/6.6/ 18.9 0. see Fig.5 occurred for statically determinate platforms.3 10. 5: The total losses of Ranger I in 1979 and Alexander Kielland in 1981 were initiated by fatigue failure 6 .3/10.4 Column D ”Missing braces” – that cause no redundancy Ranger I.4/0.5 1.0/42.3/ 11.7/1.8 0.3 10.6/ 14.0/ 19.tributes to a greater probability of total loss of floating structures than progressive structural failure. Adapted after WOAD (1996).1/0.8/ 11.4/3.0/7.5/0.7 0. We need to be aware of this problem.3 4. especially for structures with a low fatigue life.0/5.2/ 6.9 6. Monitoring.6 4.5/0. World wide Type of accident Blowout Capsizing/ foundering Dropped object Explosion Fire Grounding Spill/release Mobile 18.0 0. 1979 Alexander Kielland. Maintenance and Repair (IMMR) effective or if there is lack of robustness.1/98. However.6 2.6/1.4 0. 5.4 24.3 12.0 0. fatigue can cause catastrophic accidents.5 North Sea Fixed 1970-79 /80-95 2. Both cases shown in Fig. Table 1: Number of accidents per 1000 platform-years.1 7.6/0. if the fatigue life is insufficient to make Inspection.5/0. maintenance related events for floating structures is limited.7 0.5 23. Degradation due to corrosion and fatigue crack growth are gradual phenomena.6 2.3/0.6/1.3/6.8/8.5 Fixed 2.3 18.0/7.1/3. Corrosion is not known to have caused accidents with floating offshore structures of significance. 1980 Fig.9/5.6 2.4 1.6 Gulf of Mexico Fixed 2. On the other hand.3/1. 2004).8 0.6/8.3/0.5 5.8 1.
S as indicated in Fig.An overall picture of the accident rate in an industry may be displayed by the socalled Frequency-Consequence diagram as shown in Figure 6. N. 1981). 100 Annual frquency of an event with N or more fatalities 10-1 10-2 Marginally acceptable Acceptable Oil platforms Mobile Fixed 10-3 10-4 Passenger ferries (not ro-ro) Tankers Merchant vessels 1 10 100 1000 10000 10-5 Number of lives lost. for instance as an abnormality caused by using a wet electrode.by a fabrication error (70 mm weld defect) as well as inadequate inspections (ALK. The Alexander L. etc. The horizontal axis is plotted the consequence. The vertical axis is shown the frequency of N or more fatalities per accident. plate misalignment. Fabrication imperfections (such as cracks. N Fig. The “normal” variability of welders performance. We see that the accident rate for mobile drilling units is much higher than for fixed production platforms. This is characterised by a smooth variation of the relevant imperfection parameter.2 Human and organizational factors Basically. Occasionally a deviation from “normal practice” does occur. which cannot be derived from the parameters affecting the “normal” variability of resistance. Floating production platforms are not included because of the limited experience with such platforms. 6: Comparison of experienced overall accident rates with respect to fatalities in the offshore and shipping industries 2. or another gross fabrication error. The risk is similar that that of passenger vessels and tankers. R is less than the load effect.5 years . accident in 1980 was caused by a fatigue failure of a brace and design checks had not been carried out. But the main causes of actual structural failures are the abnormal resistance and accidental loads due to human errors and omissions. and soon lead to a “normal” variability in the imperfection size. Although the fatigue failures that had been experienced in semi-submersibles in the period 1965-70 resulted in fatigue standards. environmental conditions. Design errors materialise as a deficient (or excessive) resistance. Fixed platforms are mainly used as production facilities. structural failure occurs when the resistance. these 7 .). in this case in terms of fatalities. The implied fatigue life was further reduced – to 3. 7. From a Human and Organizational Factor (HOF) point of view this can be due to too small safety factors to account for the normal uncertainty and variability in R and S relating to design criteria. are influenced by human actions. Moan and Holand (1981b) explained the main reasons for the differences in safety levels between mobile and fixed platforms. which also affect the resistance.
R&D Risk reduction Do the job properly in the first place Unknown material or load phenomenon Causes Do the job properly in the first place QA/QC of design Design error error QA/QC of the asfabricated structure Abnormally Failure low Fabrication resistance R<S QA/QC of Design error . This fact was evidenced in the extraordinary surveys undertaken after Alexander Kielland accident. ships are obviously more robust or damage-tolerant than mobile semi-submersible platforms. Man-made live loads also have a “normal” and an “abnormal” component. etc. The catastrophic explosion and fire on the Piper Alpha platform in 1988 was initiated by a gas leak from a blind flange of a condensation pump that was under maintenance but not adequately shut down (PA. The gas ignited and the initial explosion lead to damage of an oil pipe and subsequent oil fires and explosions. The accident was initiated by control room window breaking due to wave slamming.standards were not properly implemented even for platforms built in the 1970’s. and therefore appropriate control measures should be implemented.oversight of load … Operational error . etc) ULS: RC/γR > γS1SC1 + γS2SC2 FLS: D=Σni/Ni ≤ Dallowable Inadequate safety factors for normal variability of R and S ALS design check Apply adequate safety factors in ULS/FLS design check Fig. The resulting accidental ballast condition could not be controlled partly because of lack of crew training and partly because of inadequate ballast pumps. do not have a normal counterpart. The same happened to the first purpose built FPSO and shuttle tankers put into service in the mid-1980’s. Many platforms built in the 1970’s had joints with design fatigue lives as low as 2-5 years. A series of operational errors were identified as the main cause of the first event and also the sinking (P-36. The same applies to offshore structures. they are simply caused by operational errors or technical faults.accidental load design QA/QC of operation Event control (leak. The water entering the control room lead to the short circuit of the ballast valve system. 1990). 1984). accidental explosion and subsequent flooding capsizing and sinking. In 2001 the platform P-36 in Brazil experienced a collapse of the emergency drainage tank. The main issue that caused the initiation of this accident was the lack of communication between the maintenance team and the control room operators. 1976). notably fires and explosions. and open chain lockers (OR. However. thereby leading to a spurious operation of ballast valves. ship collisions. 8 . While some loads. The mobile platform Ocean Ranger capsized in the offshore of Newfoundland in 1982. It is a well known fact that the gross errors dominate as the cause of accidents. 2001). It is found that the gross errors cause 80-90% of the failure of buildings and bridges and other civil engineering structures (Matousek and Schneider. 7 Interpretation of causes of structural failure and risk reduction measures.
during operation. degradation failure mechanism of flexible risers. 3. different subsystems. However. Safety Management 3. In some cases. fabrication and. To do a truly risk based design. Quality Assurance and Control (QA/QC) of procedures and the structure during fabrication and use (operation) is crucial. by carrying out the design iteration on the basis of a risk acceptance criterion.1 General Offshore drilling. which implies a certain residual risk level. like: loads-carrying structure & mooring system process equipment evacuation and escape system are designed according to criteria given for that particular subsystems. Nevertheless they were observed in time before any catastrophic accident could occur.It has been observed that errors and omissions occur especially in dealing with novel materials and concepts as well as during periods with economic and time pressures. Different safety measures are required to control error-induced risks. accidents have been caused by inadequate engineering practice such as the lack of knowledge regarding new phenomena. and to achieve a design that satisfies the acceptable safety level. equipments and other hardware’s. weld defects and fatigue failures due to gross errors had occurred before the Kielland accident ballast errors had occurred before the Ocean Ranger accident fires and explosions had occurred before the Piper Alpha accident and so on 9 . The implicit risk associated with these common structural design criteria is generally small! The philosophy behind the Accidental Collapse Limit (ALS) criteria is discussed below. have been discovered. is not feasible. The safety management needs to be synchronised with the life cycle of the structure. Ideally these systems should be designed and operated to comply with a certain acceptable risk levels as specified for example by the probability of undesirable consequences and their implications. The nature of human errors differs from that of natural phenomena and “normal” man-made variability and uncertainty. For instance. safety criteria for structural design are given in terms of Ultimate Limit State (ULS) and Fatigue Limit State (FLS) criteria. Recently new phenomena such as ringing and spinning of TLPs. Therefore. as well as specified operational procedures and operational personnel. Structural failures are mainly attributed to errors and omissions in design. to achieve a certain target level. In reality. Using appropriate probabilistic definitions of loads and resistance together with safety factors. the desired safety level is achieved. A number of people maintain that gross errors are “Acts of God” and cannot be dealt with. especially. production or transport facilities are systems consisting of structures.
Improve inspection of the structure(FLS) .QA/QC of engineering process (for d) . escalate into total losses (Moan 1994).fabrication (f) .design (d) . Adequate evacuation and escape systems and associated procedures are crucial for controlling failure consequences in terms of fatalities. o) . Table 2 summarises the causes of structural failure from a risk management point of view. the QA/QC during fabrication and operation phases refers to inspection of the structure itself. self. quality assurance and control should be implemented in all stages of design. fabrication and operation. FLS. skills. o) . removal of marine growth. as well as carrying out load or response monitoring.Research & Development 3.. . Production platforms are usually made to be site. attitude and self-checking of those who do the design. when necessary. extinguishing of a fire by an automatically-activated deluge system. While the QA/QC in the design phase is concerned with scrutinizing the analysis. 10 . Table 2: Causes of structural failures and risk reduction measures Cause • Less than adequate safety margin to cover “normal” inherent uncertainties.g.specific. Accidental Collapse Limit State criteria are implemented to achieve robust offshore structures. These criteria are commonly specified by the owner. operational errors typically result in fires or explosions or other accidental loads.The occurrence of gross errors have been avoided by adequate competence. and by exercising “self-checking” in their work.operation (o) • Unknown phenomena Risk Reduction Measure . design checks and the final scantlings arrived at.2 Design and inspection criteria Adequate performance of offshore structures is ensured by designing them to comply with serviceability and safety requirements for a service life of 20 years or more. In addition.Inspection/repair of the structure (for f. that is to prevent that the “structural damage” occurring as fabrication defects or due to accidental loads. or to repair. e. and how the associated risk may be ameliorated.Direct design for damage tolerance (ALS) – and provide adequate damage condition (for f. or inspection and taking the necessary actions to reduce loads directly or indirectly.checking (for d. These actions are often denoted as “Event Control”.Improve skills. fabrication or operation in the first place. Finally.Increased safety factor or margin in ULS. • Gross error or omission during . o) . As mentioned above. f. Such events may be controlled by appropriate measures such as detecting the gas/oil leakage and activating shut down valve. while drilling units are commonly intended for operation in specific regions or world wide. competence. by. Serviceability criteria are introduced to make the structure comply with the functions required.
the increasing concern about environmental well-being can cause small damages to have severe economic implications. explosions and ship impacts .fatigue design checks depending upon consequences of failure (damagetolerance) and access for inspection .nonlinear analyses to demonstrate damage tolerance in view of inspection planning and progressive failure due to accidental damage Fatigue crack growth is primarily a local phenomenon. Fatigue strength is commonly described by SNcurves. and suitable fatigue criteria (e. In particular.g. and the most advanced codes are characterized by design criteria formulated in terms of limit states (ISO 19900. The current practice which is implemented in new offshore codes. by API (1993/97). current and wind loads. Fatalities and pollution obviously also have economic implications. Detailed information about crack propagation is also required to plan inspections and repair. Fracture mechanics analysis of fatigue strength have been adopted to assess more accurately the different stages of crack growth including calculation of residual fatigue life beyond throughthickness crack.Safety requirements are imposed to avoid ultimate consequences such as fatalities and environmental or property damages. It requires stresses to be calculated with due account of the long-term wave conditions. global behaviour as well as the geometric stress concentrations at all potential hot spot locations. Miner’s rule).considerations of loads that include payload. Depending upon the regulatory regime. which is normally defined as fatigue failure. which have been obtained by laboratory experiments.global and local structural analysis by finite element methods for ultimate strength and fatigue design checks .explicit accidental collapse design criteria to achieve damage-tolerance for the system . ISO 19900 (1994-) and NORSOK (1998a. wave. 11 . separate acceptance criteria for these consequences are established. 1998b. ice (for arctic structures). While fatalities caused by structural failures would be related to global failure. 2002) as well as by many classification societies.e. smaller structural damages may result in pollution.g. 1999. earthquake loads (for bottom supported structures). issued e. Property damage is measured in economic terms. capsizing or total failure of deck support. i.semi-probabilistic methods for ultimate strength design which have been calibrated by reliability or risk analysis methodology . or property damage which is costly to repair such as the damages of an underwater structure.g. as well as accidental loads such as e. fires. 1994) – see Table 3 .
should not cause disproportionate consequences”. C o m p o n e n t d e s ig n c h e c k F a tig u e (F L S ) . For instance hydrocarbon fires and explosions result as a consequence of an accidental leak. Current requirements for fatigue design check in NORSOK are shown in Table 4. Traditionally we design for dead-loads. explosions and other accidental loads.F a ilu r e o f w e ld e d jo in t s d u e t o r e p e t it iv e lo a d s F a t ig u e fra c tu re C o m p o n e n t d e s ig n c h e c k d e p e n d in g o n r e s i d u a l s y s te m s tre n g th a n d a c c e s s f o r in s p e c t io n A c c id e n ta l c o lla p s e ( A L S ) . But. 2002). FDF to multiply with the planned service life to obtain the required design fatigue life (NORSOK N-001. loads can also be induced by human errors or omissions during operation – and cause accidental loads. payloads as well as environmental loads.O v e r a l l “ r ig i d b o d y ” s t a b i lit y . due to ship impacts. 12 . Accidental Collapse Limit State (ALS) requirements are motivated by the design philosophy that “small damages. e. spreading. ignition and combustion process. They commonly develop though a complex chain of events. Fatigue design requirements depends upon inspect ability and failure consequences.Table 3 Limit State Criteria for safety – with focus on structural integrity L im it s ta te s P h y s ic a l a p p e a r a n c e o f fa ilu r e m o d e R e m a rk s U ltim a te (U L S ) . which inevitably occur.g. Access for inspection and repair No access or in the splash zone Substantial consequences Without substantial consequences 1) Accessible (inspection according to generic scheme is carried out) Below splash zone 3 2 Above splash zone or internal 2 1 10 3 The consequences are substantial if the Accidental Collapse Limit State (ALS) criterion is not satisfied in case of a failure of the relevant welded joint considered in the fatigue check. m o o r in g o r p o s s ib le f o u n d a t io n C o lla p s e d c y lin d e r D if f e r e n t f o r b o t t o m – s u p p o rte d . o r b u o y a n t s tru c tu re s .U lt im a t e s t r e n g t h o f s t r u c t u r e . Table 4 Fatigue design factor.U lt im a t e c a p a c it y 1 ) o f d a m a g e d s t r u c t u r e w it h “ c r e d i b le ” d a m a g e J a c k -u p c o lla p s e d S y s t e m d e s ig n c h e c k An adequate safety against fatigue failure is ensured by design as well as by inspections and repairs. These values were established by the NPD code committee in 1984 by judgement.
should not cause disproportionate consequences!” Flooded volume a) Capsizing/sinking due to (progressive) flooding Explosion damage Gaining acceptance b) Structural failure e. 1997). the reassessment involves the same analyses and design checks as carried out during initial design. depending upon the inherent damage tolerance ensured by the initial design. However. This fact commonly justifies more advanced analyses of loads. extension of service life. 1976). 2000a). 2001 Motivation: ”small damages. According to NPD this damage should be estimated by risk analysis. the measures that have to be implemented to improve the strength of an existing structure may be much more expensive than ones for a new structure.. ALS were introduced in the first mobile platform rules (as described e. to include such robustness criteria for the structure and mooring system. occurrence of overload damage due to hurricanes (Dunlap and Ibbs... 1968 Flixborough explosion. 1980 NPD Regulations for Risk analysis. subsidence of North Sea jackets (Broughton. Applied since early codes • • • • • • • • Ronan point appartment building accident. 1981 NPD’s ALS criterion.g. responses. as discussed subsequently. The damage stability check has typically been specified with damage limited to be one or two compartments flooded. explosions. fires and ship impact.. Thus. 1994). Kielland accident. Basically. 9: Accidental Collapse Limit State (ALS) requirements The assessment of structures during operation is necessary in connection with a planned change of platform function. The criterion was formally introduced for all failure modes of offshore structures in Norway in 1984 (NPD. explicit ALS criteria are not yet widespread. 8: Historical development of ALS assessment of structures Fig. 1992 WTC. The World Trade Centre and other recent catastrophes have lead to further developments of robustness criteria for civil engineering structures. due to impact damage. 1978 Alexander L. 1984 HSE Safety Case.The first explicit requirements were established in Britain following the Ronan Point apartment building progressive failure in 1968. 13 . resistances as well as use of reliability analysis and risk-based approaches than in the initial design (Moan. ALS checks should apply to all relevant failure modes as shown in Figure 9. updating of inspection plans etc (ISO 19900). which inevitably occur. See Figure 8. by Beckwith and Skillman. Failure of Dynamic Positioning System is handled in a similar manner One tether failed One mooring line failed Generally applied c) Failure of mooring system due to "premature" failure Fig. While robustness requirements to the mooring are generally applied today.g. In 1984 such criteria were extended by NPD. 1984). It is interesting in this connection to note that ALS-type criteria were introduced for sinking/ instability of ships long before such criteria were established for structural integrity as such.. 1974 ECCS model codes. September 11.
findings and evaluates conditions annually and every fourth or fifth year. adding or removing scantlings. while members with a small diameter such as TLP tethers and joints in jacket braces. Permanent repairs are made by cutting out the old component and butt welding a new component. corrosion and other damages. Eddy Current) depending upon the damage of concern .g. detect through-thickness cracks e. Monitoring. monitoring and repair measures can contribute to the safety only when there is a certain damage tolerance. Further refinement of the inspection planning has been made by introducing probabilistic methods as described below.5th year. The objective of inspections is to detect cracks. while degradation needs continuous surveillance. while intermediate and annual inspections are normally less extensive. hence. especially with respect to fatigue. The inspection and repair history is important for a rational condition assessment procedure of the relevant structure and other.prioritizing which locations are to be inspected . brackets.selecting inspection method (visual inspection.scheduling inspections .g. leak detection. An inspection plan involves: . Inspection. The quality of visual inspection of NDE methods depends very much upon the conditions during inspection. Overload phenomena are often associated with a warning for which the inspection can be targeted. repair method and time aspects of repair) Whether the inspection should be chosen to aim at detecting cracks by non-destructive examination (NDE). However. The strengthening of the structure by increased scantlings is very expensive. This implies that there is an interrelation between design criteria (fatigue life. Maintenance and Repair (IMMR) are important measures for maintaining safety. To ensure structural integrity within the offshore sector in the North Sea. damage tolerance) and the inspection and the repair criteria. buckling. Maintenance and Repair Inspection.3. or member failures would depend on how much resources are spent to make the structure damage tolerant. stiffeners. the inspection history of a given structure is actively incorporated in the planning of future activities. Monitoring. The choice again would have implication on the inspection method. renewal surveys) are carried every 4 . Fatigue design criteria. the regulatory body defines the general framework while the audit of the oil companies or rig owners defines: inspection and maintenance needs. Hence. by leak detection. lugs or collar plates. are not. Magnet Particle Inspection. reports planned activity. corrosion and other deterioration phenomena. A large volume offshore structure is normally accessible from the inside. and visual inspection by failed members.3 Inspection. by Table 4. Typically major inspections of offshore structures (special surveys.establishing a repair strategy (size of damage to be repaired. normally ample time for repair will be available in the latter cases. However. re-welding. during the operation.g. close visual inspection. especially for “sister” structures. The most relevant measure to influence safety relating to fatigue and other degradation phenomena is by using an im- 14 . depend upon inspection and failure consequences as shown e. The main inspection methods being the NDE methods consist of detection of through-thickness crack by e. the situation is different.
see Fig. Moan.g. Structural reliability methods are applied to determine the failure probability. Pf which is associated with normal uncertainties and variability in loads and resistance.the expense and effort required to reduce the risk. then a single target safety level could be established. The following section briefly describes how fatigue design and inspection plans (based on an assumed inspection method) can be established by reliability analysis to ensure an acceptable safety level. with separate target levels. fatigue.failure cause and mode .. The most severe of them governs the decisions to be made. ) as well as the different phases (in-place operation and temporary phases associated with fabrication. .. installation and repair) is defined with respect to each of the three categories of ultimate consequences.4 Quantitative Measures of Safety Ideally the structural safety should be measured in a quantitative manner. and phases separately.proved inspection method or increased frequency of inspections.the possible consequences of failure in terms of risk to life. 3.. 10: Methods for quantifying the risk or safety level The quantitative safety approach is based on estimating the implied failure probability and comparing it with an acceptance level. If all consequences are measured in economic terms. . This includes events induced by errors and omissions.type of initiating events (hazards) such as environmental loads. However. which may lead to different consequences . economic losses and the level of social inconvenience. density function Column Load effect fS(s) R. 10. especially which uncertainties are included . In principle a target level which reflects all hazards (e. This target safety level should depend upon the following factors (e. various accidental loads. Structural reliability analysis Deck Prob. injury. . Quantitative risk assessment can be used to deal with the probability of undesirable events and their consequences in general terms. This may be reasonable because it is rare that all hazard scenarios 15 . loads) and failure modes (collapse. failure modes.S Resistance fR(r) Wave pressure PF=P[R≤S] r.g.s Quantitative risk analysis Uncertainty in R and S can be modelled by probability density End events Critical event Event tree Consequences Fault tree Fig. 1998): .type of SRA method or structural risk analysis. in practice it is convenient to treat different hazards.
load effects and resistance. and ‘expert’ judgment. One type of uncertainty (Type 1) is natural or inherent. numerical data.g. Moan et al. β = βLN can be exactly written as follows. Often it is not possible to develop explicit separations of Type 1 and Type 2 uncertainties and it is important not to include them twice. 1999). SRA is applied to determine the failure probability considering fundamental variability. Melchers (1999): ⎡µ 1+V 2 ⎤ S⎥ ln ⎢ R ⎢ µS 1+V 2 ⎥ ln ( µR /µS ) R⎦ ⎣ = β' LN ≈ β LN = 2 )(1 + 2 )] ln[(1 + V R VS V 2 +V 2 R S (2) This simple expression has turned out to be useful and was applied in the API reliability based code calibration (Moses. Melchers. (1993b). as well as uncertainties due to the lack of knowledge in loads.g. for instance. The state of the art methods for calculating the failure probability are the numerical First Order and Second Order Reliability as well as Monte Carlo simulation methods (e. see e. and the reliability index. including field test data. and state uncertainties. A second type of uncertainty (Type 2) is associated with modelling. The failure probability can be calculated as P (R<S). The failure probability is expressed by: Pf = P( g () ≤ 0) = Φ ( −β) or β = −Φ −1 ( Pf ) (1) where Φ(-β) is the standard cumulative normal distribution.5 Structural reliability analysis General Structural reliability methods for calculating the failure probability are readily available. 3. If the uncertainty in the resistance R and load effect S are described by probability density functions. The principle of establishing target levels for each hazard separately was adopted by NPD for accidental loads. analytical solutions exists for a few cases. However. parametric. A variety of methods can be used to characterize the model uncertainty. when failure is expressed by g( ) =R – S ≤ 0 and both the resistance R and the load effect S are lognormal random variables. this type of uncertainty is ‘information sensitive’ and systematic. this type of uncertainty is ‘information insensitive’ and random. Type 2 model uncertainties may be defined as the ratio of the actual or true value of the variable to the predicted or nominal (design) value of the variable.g.and failure modes contribute equally to the total failure probability. see e. In general it is recommended to calibrate the target level to correspond to that inherent in structures which are considered to have an acceptable safety. It was also advocated by Cornell (1995). laboratory test data. 1987). with numerical values as shown in Table 5. It is important to recognize that there are different types of uncertainties used to determine the resultant uncertainties associated with loads and resistances. The analytical formulation can also conveniently be used to express the relationship between Pf and safety factors. 16 .
respectively.8 for wave-induced load effects. VS). due to model uncertainty.13 10 -4 4.6 0. R be defined by their mean value (µ) and the coefficient of variation (V): µS = BSSC . However. ISSC.BR ≥ 1.(2) β LN ′ ≈ ln ( µR /µS ) VR2 + VS2 = ln(BR γR γS /BS ) VR2 + VS2 or γR γS = (BR /BS ) exp(β' L N VR2 +VS2 ) (4) With γR γS = 1.15 − 0.47 10 -2 3. a typical BS = 0.g.8 0.) and the characteristic load effect (typically the 100 year value) as well as a possible bias in predicting wave load effects. VS = 0. 1994).(3) into the approximate expression of Eq.081 Reliability estimates are found to be sensitive to the distributions used for R and S. Yet it is important to estimate the mean bias of the resistance. By inserting the design equation Eq.2 0.21 10—5 Pf 0.2 0. An evaluation of previous efforts on calibration of offshore codes was provided by Moan (1995) in conjunction with the ISO effort to harmonize the safety level in codes for offshore structures across the variety of structural types (ISO.16 0.4 1.1.34 10 -3 3. Moan (1988). VR) and (BS.4 0.8 0. safety factors on loads are not properly varied to reflect the differences in uncertainty in load predictions for different types of structures.14 10 -2 3.1 The BS reflects the ratio of the mean load (which refers to an annual maximum if the annual failure probability is to be calculated.30 µR = BR R C . At the same time it is noted that the uncertainty in R has minimal influence on the safety level. By decreasing BR/BS by 10 % reduces β’LN by 15%.72 10 -4 4.0 0. Lloyd and Karsan (1988).Table 5 Relation between β and Pf. This can be achieved by considering a load effect S that refers to an annual or service life time maximum value. BR accurately.1 and VR = 0. Let the (true) random load effect.0 1. It is also possible to approximately express R and S by (BR. BR = 1. β 1. The failure probability should refer to a time interval.5. e. it is found that β’LN is about 3. S and resistance. consider the simplest design format. a year or the service life.036 2. e.20. R c /γ R ≥ γ SSc (3) where Rc and Sc are characteristic resistance and load effect.014 2. Jordan and Maes (1991) to calibrate their codes to a certain reliability. We note that the results of code calibration depend upon the choice of reference period. It is noted that the Similarly. In particular the efforts by Fjeld (1977). VR = 0. Moan. Reliability based code calibration Reliability methods are increasingly used to make optimal decisions regarding safety and the life cycle costs of offshore structures (see e.BS ≥ 1. often used in code calibration.g.6 0. respectively. and 17 . by increasing Vs by 10 % reduces β’LN by 8%. the uncertainty in resistance and loads as well as Pf .g. To illustrate the relationship between partial safety factors. 1988-1994. This reliability index corresponds to a Pf of 6 10-4.2 for a VS of 0. 1994).
stdv (lnA )=0.0E-06 1 2 3 4 5 6 7 8 9 10 Fatigue de s ign factor Fig. It is shown that the cumulative failure probability in the service life varies from 10-1 to 10-4 when FDF varies from 1 to 10. Melchers. WSD: RC/γ > DC + LC + EC Target Pf or β LRFD: RC/γR > γDDC + γLLC + γEEC Load ratio. stdv (lnA )=0.0E-05 1.15 Cumulative.’ Thus.15 1. Ec/(Lc+Ec) Goal: Implied Pf ≅ Pft R — resistance D. FDF. there exists sources of ‘bias’ that must be recognized quantitatively by the Bi's.0E+00 Cumulative f ailure probability 1.hence to express partial factors by the relevant uncertainties. L. 2004).3 A nnual f ailure probability A nnual.g. In Figure 12 the solid line with diamond symbol shows the fatigue failure probability in the service life as a function of the design criterion – the fatigue design factor. 1.0E-03 1. E — load effects due to • permanent • live load • environmental effects Fig.0E-02 Failure probability A nnual.0E-04 1. A is an equivalent constant stress range that represents the long term stress level (Moan. Fatigue Reliability Analysis Structural reliability methods can also be used to calculate the probability of fatigue failure. 18 . stdv (lnA )=0. stdv (lnA )=0. 12: Fatigue failure probabilities in the 20 year service period. It is important to recognize that variables used in designing offshore structures are often ‘conservative. 1999). by varying the FDF versus the effect of an inspection program as well as the consequences of failure. A consistent fatigue safety level can be achieved.3 1. as a function of the fatigue design factor and the uncertainty level.0E-01 Cumulative. (e. 11: Schematic illustration on how the implied safety level in a design code for ultimate strength can be calibrated to be close to a given target level.
t (N-cycles) can be formulated Pf ( t ) = P(a f . (1993a) showed. the outcomes (e. Equation (7) can be generalised to cover cases with several inspections with two alternative outcomes.a N ≤ 0 ) = P [ F ( 0. then the failure probability in the period t ≥ tI is Pf (t) = P [ F(t I . by Madsen and Sørensen (1990). t I ) and F(t I .Reliability estimates by account of inspection The effect of the inspection on the reliability level can be illustrated by representing the crack depth using a random variable. At the design stage.. The reliability index β increases at the time of inspection as illustrated by the example shown in Fig. On the other hand if no failure has occurred before time tI and it is known that no crack is detected at time tI. how the allowable cumulative damage (D) at the design stage can be relaxed when inspections are carried out. during the design phase. respectively. (5-6) can be recasted into a convenient form for analysis as shown e.g. based on reliability analysis. The failure probability at the time. t )] (5) where af and aN are the crack size at failure and after N cycles. t I )] + P [S(0. Eqs. two outcomes: D and ND are possible. If the effect of inspections is estimated before they are carried out. crack detection or no detection) are not known. The distribution of Ad corresponds to the Probability of Detection (POD) curve for the inspection method in question. Ad. Based on the Paris’ crack propagation law. Such analyses served as basis for Table 4.g. 13. t) | I ND (t I )]⋅ P [ I ND (t I )] (7) where F(t1. t) | ID (t I )] ⋅ P [ ID (t I )] + P [S(0. g. The quality of the inspection in terms of the detectable crack size is also represented by a random variable. 19 . t) | I ND (t I )] (8) The knowledge of survival up to time tI and no crack detection at time tI reduces the uncertainty and makes the failure probability drop. the failure probability in the period t ≥ tI can be determined by: Pf (t) = P [ F(0. A(t) which is a function of time t.t2).t2) and S(t1. it is difficult to determine the distribution of the crack size (A) explicitly when taking into account all uncertainties that affect the distribution as well as the effect of inspections. mean failure and survival in time period (t1.t2) are. When a single inspection is assumed to be made at time tI and possible cracks detected are repaired. The exact outcome is not known but the probability of the outcomes can be estimated based on the reliability method. which are described by: I ND ( t ) : a N -a d ≤ 0 I D ( t ):a N -a d ≥ 0 (6a) (6b) In general. respectively. The effect of inspection may be viewed in two different ways depending upon whether it is assessed before inspections are done. e. Moan et al. or afterwards during operation. t I )and F(t1 . The outcomes of inspections are assumed to be no crack detection (ND) or crack detection (D) at time t after N cycles.
In such cases. the design fatigue life is in principle exhausted at the end of the planned service life. 2002) The updating methodology is useful in connection with extension of service life for structures with joints governed by the fatigue criterion (Vårdal et al. The failure probability in Eq. In this case the Eq. (9) is applicable when the inspection event I aims at detecting cracks before the failure of individual members. (9) for each joint separately by allowing a 20 . before they have caused rupture of the member). A further simplification is to update the failure probability of each joint based on the inspection result for that joint. for which the failure probability P[FSYS(U)|Fj] should be calculated. and. The calculation of the system failure probability after inspection may be approximated by independent system failure modes (Moan et al. ⎣ ⎦ ⎣ ⎦ j=1 n (9) .0 mm..1 – 0. This formulation is based on modeling the ultimate failure of the system by a single mode.4 mm.0 – 2. full inspection history Upd.5×10-2 Pf 20 2 1 0 5 10 15 Time (years) Fig. Nevertheless. rather such an inspection and repair strategy will have implication on the time period. 2002. it is not possible to bring the structure back to its initial condition by inspection only. Another inspection strategy would be to apply visual inspection to detect members failure and repair failed members after the winter season in which those particular members failed..7 Event tree analysis Basic case. Inspection Event Tree analysis is based on predictions at the design stage. (i. while the initial crack depth is 0. but nonconservative if cracks are detected. 2004) PFSYS|up = P [ FSYS | I]≈P [ FSYS(U)] + ∑ P ⎡ Fj | I ⎤ ⋅ P ⎡ FSYS(U) | Fj ⎤ +. Inspections may be prioritized by using Eq. (9) will have to be modified as follows: the individual fatigue failures of components (Fj ) does not depend on the inspection event. The other curves are based on inspections with known outcome during the service life (Ayala-Uraga and Moan. 1999. 2000). the formulation is limited to failure modes initiated by a single fatigue failure and followed by ultimate global failure. This is conservative if no cracks are detected. Moreover. if no cracks have been detected during inspections. 13: Reliability index as a function of time and inspection strategy. However.. This is because the mean detectable crack depth by NDE methods typically is 1. No inspection 6 Upd. ONLY last inspection 5 Reliability Index 4 Inspection during operation with No crack detection 3 No inspection 10-3 3×10-3 Effect of Inspection predicted at design stage 3.. then a remaining fatigue life can be demonstrated.e.
frequent occurrences of cracks provide a basis for correlating actual crack occurrences with state of art predictions for various offshore structures. while for semi-submersibles and ships. 1997). PfSYS(T) is obtained by generalizing the acceptance criteria implied by Table 4. Yet. PFfT(i) is then obtained from PfSYS(i) = P[FSYS | Fi ] ⋅ PFfT(i) ≤ PfSYS(T) (10) where the system failure probability. 3. However. PfSYS(i) is associated with a fatigue failure of member (i) followed by an ultimate system failure. This is because the safety factors or margins normally applied to ensure safety are so large that Pf calculated by SRA becomes much smaller than that related to other causes. in the North Sea). Maintenace and Repair The failure probability estimated by structural reliability analysis (SRA) normally does not represent the experienced Pf for structures. 1999). Reliability level. This methodology is used to calibrate fatigue design requirements. if ULS and FLS design checks are properly carried out. As discussed above.g. PfSYS(T) to each term in the sum of Eq. On the other hand. implied by ULS and FLS requirements. For instance when proper fatigue design checks and inspections have not been carried out. This agreement is achieved when the SN approach (or a calibrated fracture mechanics approach) is applied to predict the occurrence of fatigue failure (e. Monitoring. (9). It is then found that the criteria in Table 4 are slightly “non-conservative”. Given the target level for a given joint. This approach has been implemented for template-space frame structures (Moan et al.g.certain target probability level. This reserve capacity. errors and omissions in design. provides some 21 . 14: Scheduling of inspections to achieve a target safety level of PFfT(i). is large and cracks have occurred. Pf will be “negligible” within the current safety regime. the current predictions for jackets are found to be conservative (Vårdal and Moan. with the exception of the Ranger I (1979) and Alexander Kielland failure (1980) such cracks have been detected before they caused total losses. as summarized by Moan (2004). the predictions seem to be reasonable. fabrication and operation represent the main causes of the accidents experienced. 14.6 Safety implications of Ultimate and Fatigue Limit State criteria and Inspection.. β No inspection Inspection at time t=8 with no crack detection Target level for a given joint 0 4 8 12 16 20 Time (years) 1st inspection 2nd inspection Fig. Hence. The target fatigue failure probability for joint i. inspections and repairs by grinding or other modifications are scheduled to maintain the reliability level at the target level as shown in Fig. the likelihood of fatigue failures (through-thickness cracks) for platforms (e. through thickness crack).
Moreover. albeit in different directions (Moore et al. different technologies over the years. Moan. was the direct reason for introducing PRA. 2003). hence. If more efforts were directed towards risk reduction actions by implementing ALS criteria. The maritime industry has primarily focused on the application of risk assessment to further enhance and bring greater clarity to the process of making new ship rules or regulations. NPD (1981)). However providing safety for the mentioned hazards in this indirect manner is not an optimal risk-based design. On the other hand. maintenance system …. 3. (or QRA). By combining the knowledge about system build-up with the knowledge about failure rates for the elements of the system. Yet. not least. it is useful in ensuring that the ultimate strength and fatigue design criteria are consistent by calibrating safety factors. probabilities as low as 10-4 per year.7 Risk assessment Risk assessment (Qualitative Risk assessment or Formal Safety Analysis etc. A further complexity is that the available data refer to various types of platforms and. it is noted that the random uncertainties in the ultimate strength commonly have limited effect on the reliability compared to that inherent in load effects. The basis for this approach is the facts that : a)almost every major accidental events have originated from a small fault and gradually developed through long sequences or several parallel sequences of increasingly more serious events. it is possible to achieve an indication of the risks in the system (Vinnem. Finally. As explained above. The Piper Alpha disaster (PA. 15 000 and 1 200 for fixed. 1992). respectively. SRA provides a measure of the influence of various parameters on the reliability and. explosions etc.) 22 . 2000b). reliability.) is a tool to support decision making regarding the safety of systems. the systematic uncertainty (bias) in strength and load effects has the same effect on the reliability measure. SRA does not provide a measure of the actual total risk level associated with offshore facilities. 1990). 1981b. Up to now the accumulated number of platform years world wide is about 120 000. mobile structures and FPSOs. accident action integrity. The risk analysis process normally consists in the following steps (Fig 15): definition and description of the system identification of hazards analysis of possible causal event of hazards determination of the influence of the environmental conditions determination of the influence of active/passive safety systems (capacity. However.g.resistance against other hazards like fires. The application of risk assessment has evolved over 25 years in the offshore industry (Moan and Holand. 1999.. then current safety factors for ULS and FLS could be reduced without increasing the failure rate noticeably. to determine probabilities as low as 10-4 per year requires about 23000 years of experiences to have a 90% chance of one occurrence. In the last 5 years such methods have been applied in the maritime industry. in the UK in 1992 (HSE. the effect of reducing the uncertainty on the failure probability. Application of a systems risk assessment is therefore attractive. The risk assessment methods is used because they provide a reliable direct determination of events probabilities e. The offshore industry has focused on the application of risk assessment to evaluate the safety of individual offshore facilities. and culminates in the final event b) it is often reasonably well known how a system responds to a certain event.
operational errors that result in accidental loads are implicitly dealt with by using data on experienced releases of hydrocarbons.- estimation of event probabilities/event magnitudes estimation of risk Risk Analysis Planning Risk Analysis Planning System Definition System Definition Hazard Identification Hazard Identification Risk Risk Reducing Reducing Measures Measures Risk Risk Acceptance Acceptance Criteria Criteria Frequency Analysis RISK ESTIMATION RISK ESTIMATION Consequence Analysis Risk Picture Risk Picture RISK ANALYSIS RISK ANALYSIS Risk Evaluation Risk Evaluation Tolerable Acceptable Acceptable Unacceptable Fig. Events are not uniquely defined in a single sequence but appear in many combinations. there are many problems. In connection with accidental loads. to appear).16 Schematic sketch of the event – fault tree method. 2000a-b. An important challenge is to determine the dominant of the (infinitely) many sequences. Lotsberg et al. 23 . However. End event Critical event Fault tree Event tree Consequences Fig. Explicit prediction of design and fabrication errors and omissions for a given structure is impossible. Moreover. 15: General approach for risk based decision making In most cases an Event-Fault Tree technique (Figure 16) is the most appropriate tool for systematizing and documenting the analyses made.. the purpose of the risk analysis is to determine the accidental events which annually are exceeded by a probability of 10-4. probability of ignition etc. human factors are difficult to account for in the risk assessment. it is possible to rate the likelihood of accidents as compared to gross errors (Bea. Although the Event-Fault tree methodology is straightforward. The risk analysis methodology currently applied in offshore engineering is reviewed in detail by Vinnem (1999). However.
9 Design for damage tolerance Introduction The current regulations for offshore structures in Norway are based on the following principles: Design the structure to withstand environmental and operational loading throughout its lifecycle. fabrication defects causing abnormal fatigue crack growth). such estimates are not possible to substantiate by experiences. however. The intended probability of total loss implied by the ALS criterion for each category of abnormal strength and accidental load would then be of the order of 10-5 (Moan. The (local) damage. (e. implying a BR = 1.8 Failure probability implied by Accidental Collapse Limit State Criteria The initial damage in the ALS criterion. assuming that the system failure can be modelled by one failure mode and that the design criterion is fully utilized. as identified by risk analyses. ship impacts. such methods may be very conservative and more accurate nonlinear analysis methods should be applied.0-1. In some cases compliance with this requirement can be demonstrated by removing the damaged parts and then accomplishing a conventional ULS design check based on a global linear analysis and component design checks using truly ultimate strength formulations. Accidental Collapse Limit State criteria can be viewed as a means to reduce the consequences of accidental events (Fig. (1-2). For environmental loads. Obviously. or permanent deformations or rupture of components need to be estimated by accounting for nonlinear effects. The robustness criteria in most other codes. The characteristic load effect due to functional and sea loads are 1. no performance objective for a “real threat” is created. this conditional failure probability will be of the order of 0. However.0 for both checks. 24 . 1983). 3.3. is prevented.g. Prevent accidents and protect against their effects Tolerate at least one failure or operational error without resulting in a major hazard or damage to structure Provide measures to detect. The structure is required to survive in the various damage conditions without global failure when subjected to expected still-water and characteristic sea loads which are exceeded by an annual probability of 10-2. Hence. The conditional probability of failure in a year.1.2 and 1.2-1. The NORSOK N-001 code specifies quantitative ALS criteria based on an estimated damage condition and a survival check. control. or. do not refer to any specific hazard but rather require that progressive failure of the structure with one element removed at a time. corresponds to a characteristic event for each of the types of accidental loads which is exceeded by an annual probability of 10-4.1. The safety (load and resistance) factors are generally equal to 1. can be estimated by Eqs. respectively. and mitigate hazards at an early time accidental escalation. for the damaged structure. as described subsequently. 17). The design checks in the ALS criterion is based on a characteristic value of the resistance corresponding to a 95% or 5% fractile. due to fires explosions.3 of the corresponding mean annual values.
Risk control of accidental events A A P. In particular. Beside progressive structural failure. the risk reduction can be achieved by minimizing the probability of initiating events: leakage and ignition (that can cause fire or explosion). and safety systems is a crucial safety measure to prevent escalating accidents. etc. The passive or active measures can be used to control the magnitude of an accidental event and. ALS checks apply to all relevant failure modes as indicated in Table 6.redundancy . Typical situations where direct design may affect the layout and scantlings are indicated by Table 7 for different subsystems: .loads-carrying structure & mooring system . 1984) The relevant accidental loads and abnormal conditions of structural strength are drawn from the risk analysis. An account of accidental loads in conjunction with the design of the structure. or. its consequences.robustness . thereby. considering P. F Critical event Event tree End events: Accidental loads Survival check of the damaged structure as a whole. ship impact.g. fire loads are partly controlled by sprinkler/inert gas system or firewalls. where the relevant factors that affect the accidental loads are accounted for.Accidental loads • Risk Analysis. as indicated in Figure 17. 17: The role of ALS in risk control Fig. Vinnem (1999) and Moan (2000b). such events may induce progressive flooding and hence the capsizing of floating structures.apply risk analysis to establish design accidental loads Reduce probability Reduce consequences "known events" "unknown events" Indirect design .evacuation and escape system 25 . F and environmental loads ( E ) at a probability of 10 -2 Reduce errors & omissions Event Control Direct ALS design . see e. F • Estimate the damage due to accidental loads (A) at an annual probability of 10 -4 . For instance.ductility Fault tree P. 18: Accidental Collapse Limit State (NPD. or by minimizing the consequences of hazards.process equipment .The weakness with such a criterion is that it does not distinguish between the differences in vulnerability In a risk analysis perspective the ALS check of offshore structures is aimed at preventing progressive failure and hence reduce the consequences due to accidental loads.Abnormal resistance . Fenders are commonly used to reduce the damage due to collisions. equipment. Prescriptive code requirements E Target annual probability of total loss: 10 -5 for each type of hazard Fig.
collisions. heat flux and duration for a fire.Table 6 Examples of accidental loads for relevant failure modes of platforms.g. risers and subsea (if not protected) Passive protection system Fire barriers Blast / Fire barriers Possible fender systems Impact protection Explosion Topside (if not protected) Ship impact Dropped object Waterline structure (subdivision) (if not protected) Deck Buoyancy elements Design accidental loads The characteristic value of accidental loads is defined as the load which annually is exceeded by a probability of 10-4 and should be determined by risk analysis.. A finite number of events have to be selected by judgement. 2000b): establish exceedance diagram for the load on each component allocate a certain portion of the reference exceedance probability (10-4) to each component determine the characteristic load for each component from the relevant load exceedance diagram and reference probability.slack system . explosions.strength All • • • • Table 7 Design implications of accidental loads for hull structure Load Fire Structure Columns /deck (if not protected) Equipment Exposed equipment (if not protected) Exposed equipment (if not protected) Possibly exposed risers. unintended ballast that initiate flooding Collision on platform Abnormal strength Accidental actions that initiate flooding Collision on platform Dropped object on tether (Abnormal strength) Mooring system strength • • Tension-leg platforms Structural failure Mooring . (if not protected) Equipment on deck. dropped object. If the accidental load is described by several parameters (e.) there is normally a continuous spectrum of accidental events. unintended pressure…. . 26 . pressure peak and duration for an explosion) design values may be obtained from the joint probability distribution by contour curves (NORSOK N-003. Structural concept Fixed platforms Floating platforms Failure mode Structural failure Structural failure Instability Relevant accidental load or condition All All • Collision. For each physical phenomenon (fire. These events represent different load intensity at different probabilities. The characteristic accidental load on different components of a given installation can be determined as follows (Moan. 1999).
However. However. Yet significant analysis efforts are involved in identifying the relevant design scenarios for the different types of accidental loads. Analysis tools for estimating the initial damage and survival Current ultimate strength code checks of marine structures are commonly based on load effects (member and joint forces) that are obtained by a linear global analysis. While in general the nonlinear finite element methods are applied.g. rupture etc of parts of the structure). 1977). Such an approach has also been extended to estimate the ultimate capacity of the damaged hull girder (Smith. a more pragmatic approach is sufficient. the outcomes of risk analyses tend to confirm the results of previous analyses. To estimate damage. Fires and explosions effects The dominant fire and explosion events are associated with hydrocarbon leak from flanges. This fact together with the desire to simplify design practice suggests using specific. Commonly the effect of 40 – 60 scenarios needs to be analyzed. in that they provide insight which results in systems that have significant increase in safety at the same expense. For each design accident scenario. (2000). represent an initial crack type damage which could cause rupture before reaching the ultimate capacity obtained by calculation models based upon ductile material behaviour. As indicated in Fig. in view of the uncertainties associated with the probabilistic analysis. Recently. for mature systems. based on plastic mechanisms) are developed and calibrated using more refined methods. and. However. Paik and Thayamballi (2003) gave an overview of methods for ultimate strength analysis of steelplated structures. essentially based on Smith’s work (1977). The risk analysis of novel structures and systems. is found to be useful. 19 fire and explosion events are strongly correlated. to limit the computational effort required. Hence. therefore. Examples of typical values for some accidental loads are given in subsequent sections. simplified methods (e. it is necessary to further investigate the implication of an initial damage that involves rupture and. the damage imposed on the offshore installation needs to be estimated followed by an analysis of the residual ultimate strength of the damaged structure in order to demonstrate survival of the installation. which is of main concern. This means that the location and magnitude of relevant hydrocarbon 27 . (permanent deformation. Simplified methods for calculating the hull girder strength are based on considerations of the intact longitudinal elements and beam theory. Skallerud and Amdahl (2002) prepared a state-of-the-art review of methods for nonlinear analysis of space frame offshore structures. valves. By using such methods a more realistic measure of the overall strength of structures is achieved.g. This applies in particular to the topside system. hence. make it possible to account for redistribution of the forces and subsequent component failures until the system’s collapse. the nonlinear material and the geometrical structural behaviour need to be accounted for. Yao et al. generic values for such cases. and reviewed by e. Experiments or theory which accounts for plasticity and large deflections are used to obtain resistances of the members and joints. nozzles etc. this methodology focuses on the first failure of a structural component and not the overall collapse of the structure. The advent of computer technology and the finite element method have made it possible to develop analysis tools that account for nonlinear geometrical and material effects. equipment seals.
while H-rated protection walls are needed for higher heat loading. ignition.300 kW/m2 for a 15 minutes up to a two hours period. No damage No Ignition Damage to Personnel and Material Immediate Ignition Release of Gas and/or Liquid Fire Formation of Combustible Fuel-Air Cloud (Pre-mixed) Fire Ignition (delayed) Gas Explosion Fire and BLEVE Fig. or AutoReGas are available for this purpose (Moan.leaks. Czujko. 2000b. BEFETS. phenomenological or numerical method (SCI. The vertical axis is a logarithmic plot of the ratio of the predicted and measured value. Typical thermal loading in hydrocarbon fire scenarios may be 200. the pressure impulse governs the structural response. The fire thermal flux may be calculated on the basis of the type of hydrocarbons. time and location of ignition. ventilation and structural geometry. PROEXP. If the pressure duration is short compared to the natural period.. 1998). Walker et al. combustion and the development of overpressure. An A-60 fire protection wall may be applied for a heat load of 100kW/m2 and less. using simplified conservative semi-empirical formulae or analytical/numerical models of the combustion process. 2003). 2001. as well as the combustion and temperature development (in a fire) and the pressure-time development (for an explosion) need to be estimated and followed by a structural assessment of the potential damage. In the case of explosion scenarios. The pressure peaks would obviously be even more uncertain. 19: Fire and explosion scenarios. combustion. The results from the gas explosion simulations are the pressure – time history. Tools such as FLACS. its release rate. The structural effect is primarily due to the reduced strength with increasing temperature. Figure 20 compares the predicted impulse by state of a state of the art CFD method with measured values in large scale tests for deterministic explosion scenarios. 1993. The variability of conditions is accounted for by using a probabilistic approach. the likelihood of ignition. The scattering is seen to be significant. The heat flux may be determined by empirical. 28 . the analysis of leaks is followed by a gas dispersion and possible formation of gas clouds.
i.7 0. with duration of 0.1 Experiment No Fig. 2001). The calculated and measured deflections of the specimen are compared in Figure 21c. while an explosion in open air at the drill floor typically implies 0. nonlinear time domain analyses based on numerical methods like the finite element method should be applied.4 0.0 0..5 0. Fire and explosion events that result from the same scenario of released combustibles and ignition should be assumed to occur at the same time. 21: Explosion response of an explosion wall (Czujko.1-0. obtained by the computer code FLACS. 21 shows an explosion panel with deformations as determined by an experiment and finite element analysis.2-0. A recent overview of such methods may be found in Czujko (2001). 20: Comparison of predicted and measured pressure impulse for “deterministic” explosion scenarios. The explosion pressure in a totally enclosed compartment might be 4 barg.1 barg with duration of 0.0 Ratio of predicted and measured Impulse 1.6 0.10.5s. 0. to be fully dependent. The fire and blast analyses should be performed by taking into account the effects of one on the other. The typical overpressures for topsides of North Sea platforms are in the range 0. Fig.1 0 Experiment Analysis 0 20 40 60 DISPLACEMENT [mm] 80 100 a) Experiment b) FE analysis c) Load–response histories Fig.2 0. In several cases where simplified methods have not been calibrated.e. The damage due to explosions may be determined by simple and conservative singledegree-of freedom models (NORSOK N-004).2s. The damage done to the fire protection by an explosion preceding the fire should be considered.6 barg. 29 .3 PRESSURE [N/ 2] 0.
The analysis of ship impacts on offshore structures follows the same principles but the collision scenarios and consequences are different. 2003). Fig.. Ship traffic may therefore for this purpose be divided into categories: trading vessels and other ships outside the offshore activity. and supply or other service vessels. offshore tankers. The impact velocity can be determined based on the assumption of a drifting ship or on the assumption of erroneous operation of the ship. The upper left figure in this slide illustrates the deck structure of a floating production platform. as reviewed by the ISSC Committee on Collision and Grounding (Paik et al. 23b the stern impact on the FPSO by the shuttle tanker is a challenge (Chen and Moan. 2004 ) 30 . Ship impacts Significant efforts have been devoted to ship-ship collisions. In this case it is assumed that the panels are badly damaged that they can be removed. Fig. 22: “Survival analysis” of a deck suffering explosion damage (Amdahl. NORSOK N-003 and -004 as well as Amdahl (1999). The lower figure shows the deformation pattern of the damaged deck.g. Deformations in the lower figure are not to scale. 2003).Pmax > 5bar Fig. 22 shows results from an analysis of a deck structure in a floating platform (Amdahl. All ship traffic in the relevant area of the offshore installation should be mapped and should account for possible future changes in the operational pattern of vessels. see e. 2003). For the scenario in Fig. The design pressure on the East Wall is also indicated. Merchant vessels are often found to be the greatest platform collision hazard which depends upon the location of the structure relative to shipping lanes. 23a indicates situations where offshore structures are operating in close proximity.
respectively.a) Semi.i FPSO dwi Internal mechanics Energy dissipated by vessel and offshore structure Equal force level Area under force-def. 24: Simplified methods for calculating impact damage (NORSOK N. 23: Special offshore collision scenarios. 24). Impact scenarios are established by considering bow. For the general case where both structures absorb energy. and side impacts on the structure as appropriate. Methods for assessing the impact damage are described by Amdahl (1999). A minimum accidental load corresponding to 14 MJ and 11 MJ sideways and head-on impact.s dws Ship Es. External mechanics The fraction of the kinetic energy to be absorbed as deformation energy (structural damage) is determined by means of: Conservation of momentum Conservation of energy External mechanics Rs Ri Es. stern. is required to be considered. the analysis has to be carried out incrementally on the basis of the current deformation field. risk analysis models are necessary to predict other types of impacts.submersible and jacket b) FPSO and shuttle tanker Fig. The impact damage can normally be determined by splitting the problem into two uncoupled analyses. curve Internal mechanics Fig. contact area and force distribution over the contact area. NORSOK N-003(1999) and Moan (2000b)).g. The external mechanics analysis is carried out by assuming a central impact and applying the principle of conservation of momentum and conservation of energy. They are the external collision mechanics dealing with global inertia forces and hydrodynamic effects and internal mechanics dealing with the energy dissipation and distribution of damage in the two structures (Fig. such as incidents caused by trading vessels (see e. The next step is to estimate how the energy is shared among the offshore structure and the ship. While historical data provides information about supply vessel impacts.004) 31 . based on simplified load-indentation curves or direct finite element analysis.
hence. The crack initiation and propagation should be based on fracture mechanics analysis using the J-integral or Crack Tip Opening Displacement method rather than simple strain considerations. as expressed by the indentation. loss of buoyancy.5000 tons which caused bow impacts on a typical side structure of an FPSO with displacement of about 100 000 t. We recall that rupture of plate material is very uncertain such that the quoted energy level should be used with cautiously. A 75-100 MJ impact may be required to cause an indentation equal to the column radius (Moan and Amdahl. 1989). 25: Shuttle tanker in ballast condition impacting FPSO stern (Moan and Amdahl. at 3700 mm bow displacement. it was demonstrated that it was feasible to strengthen the stern of the FPSO corresponding to ice-strengthening dimensions so that all dissipation could occur in the shuttle tanker bow.The recent advances in computer hardware and software have made nonlinear finite element analysis (NLFEM) a viable tool for assessing collisions. The energy at 1500mm bow indentation was estimated to be ~43 MJ while the limiting energy for rupture of the inner side is ~230 MJ. This corresponds to a critical speed of 18. However most of the time the force oscillates between 15-25 MN. see Fig. is also a concern for floating structures. A ship impact involving the minimum energy of 14 MJ will normally imply an indentation of 0. Shuttle U p p er tanker d ec k F o r ca s tle d ec k FPSO Fig. the main effect for buoyant structures is damage that can lead to flooding and. Another situation dealt with by Moan and Amdahl was stern impact on the FPSO caused by a shuttle tanker. Moan and Amdahl (2001) considered supply or merchant vessels with a displacement of 2000. A careful choice of element type and mesh is required.5 knots for a 5000 tons displacement vessel.2 m in a semi-submersible column. However. A 70 kdwt shuttle tanker was found to penetrate the machine room of a 140 kdwt FPSO after an energy dissipation of 38 MJ. The effect is highly dependent upon the location of impact contact area relative to decks and bulkheads in the column. This problem is yet to be solved. 2001). 32 . A major challenge in NLFEM analysis is the prediction of ductile crack initiation and propagation. reduction of structural strength. While the main concern about ship impacts on fixed platforms is the reduction of structural strength and possible progressive structural failure. For this case the limiting energy for rupture of the outer ship side was found to be ~10 MJ (700mm bow displacement). then the maximum collision force (peak force) is 30 MN. On the other hand. in the case of large damage.4 – 1. The measure of such damages is the maximum indentation implying loss of water tightness. If the FPSO side structure is assumed to be sufficiently rigid to ensure that all energy is absorbed by the bow. 23b and 25. It is found that a particularly fine mesh is required in order to obtain accurate results for components deformed by axial crushing.
becomes Fc(-4)/Fc(-2) = (H(-4)/H(-2))α = (1. the ALS criterion based on the 104 wave event may govern the dimensions. implying that the wave force will increase very fast with the wave height. at a certain wave height.23)α/B. Otherwise. F=c⋅Hα and that the wave height follows a Weibull distribution with a shape parameter B. 2000.0. 26: Wave in deck load for a fixed platform However. Courtesy: Statoil. with high crest or other unusual shape – which is not a simple “extrapolation” of the 10-2 event (Haver. F.9-1. 2002).e. Prevost and Forristall. The most interesting case is when the wave reaches the platform deck. 33 . g. the ULS criterion would normally be governing.with B=0. using risk analyses.8-2. the two-step ALS procedure then becomes a survival check based on a load event which annually is exceeded by a probability of 10-4. H i.g. Assume that F is a smooth function of wave height. The second issue is the possible sudden change in force.2. respectively. The ratio of the required strength would then be Rc(-4)/Rc(-2) = Fc(-4)/ (γT Fc(-2) ) = 1. This condition was established in the aftermath of the Alexander Kielland accident and was initially aimed to cover the effects of frequently occurring ship impacts relating to supply vessels as well as abnormal fatigue cracks. By ensuring a deck clearance such that the 10-4 crest does not reach the deck. the ratio between the loads at a 10-4 and 10-2 annual probability level. If it is assumed that there are 5·108 waves in 100 years. abnormal resistance has been explicitly specified by generic values for specific types of structures based on some considerations of the vulnerability of the structural components. H.0. Consider a wave loading. For instance. there are two issues that need to be observed in this connection. In benign conditions (e. Obviously. This implies that ULS will be governing for North Sea and other conditions (B=0. due to fabrication defects). This damage condition is also applicable to the tether and other mooring systems.23α/B/γT where γT is the total ULS safety factor while the safety factor for ALS is 1.0) if α< 1. Marintek Fig. Up to now. the ALS check is carried out for platforms with slender braces by considering the damage in terms of severed individual braces. Abnormal resistance It is not possible to determine the abnormal resistance (e. which for simplicity is characterised only by the wave height.6) ULS will be governing if α< 1. The first issue is the occurrence of possible “abnormal” waves.Environmental events The ALS criterion is supposed to be applicable to any “abnormal” wave loading as well. F.
the potential of gross fabrication defects (e. They are designed with a Fatigue Design Factor of 10 and the ALS criterion is implemented by requiring survival of any tether failed. at least for critical components.g. the speed reduction and the heading angle toward wave can be used for the tanker to re- 34 . Abnormal defects. repair and failure costs vary significantly. possibly using the Leak Before Break principle An adequate design fatigue life gives ample time to detect cracks.e. because of difficult access). the tethers in the Heidrun platform in the North Sea. Since inspections after fabrication on shore can be carried at less costs and with higher reliability than during operation offshore. Furthermore a 60-70 % X-ray examination for internal defects after fabrication was carried out in the yard. are tubular members which were joined by butt welds ground flush and were inspected twice with respect to surface defects on the outside and the inside of the tubular wall. When inspections are prioritised. A major difference between a trading tanker and an FPSO is that the routing. which makes the corrosion development gradual and. observations with jackets show that 2-3 % of cracks found in inspections can be attributed to abnormal defects. in general needs to include a combination of the following safety measures: design for adequate fatigue life and critical crack size design for robustness in relation to member failure plan inspection of the as-fabricated structure as well as during the service life. Moreover. i. The crack growth is more critical because cracks can result is a sudden rupture. For instance. consider tethers in TLPs. if the fatigue life from the occurrence of a through thickness cracks to rupture is 25 % of the fatigue life determined by SN-curves.Crack control Most degradations of the structure are due to corrosion and crack growth. The crack control in semi-submersibles with slender braces is based on a balanced fatigue design criterion and ALS according to Table 4 as well as leak detection during operation. it is worthwhile to emphasise such inspections. As an example of structural components with particular safety focus. hence. Therefore. cracks are hard to detect because they are small for a significant part of the time service life. The implementation of the Accidental Collapse Limit State criteria obviously provides a safety barrier with respect to the system failure given the fatigue failure of a member in a framed structure. This is because the existing structures possess different robustness and because inspection. be easy to control. This also occurs in other offshore structures. Moreover. defects much larger than those implicit in fatigue design curves. The effect of corrosion is ameliorated by corrosion allowance or a protection system. The first service inspection is now taking place after 10 years in service. Different strategies may be relevant for different types of offshore structures. As mentioned by Moan (2004). the crack control strategy. are also of concern. should also be considered. a 20-year characteristic life implies a characteristic value of the time to failure of 5 years and a mean time to failure of 15 years after a possible leak.
g. BS 7910. it is desirable to clarify the crack propagation and critical crack length of large cracks. With the advent of computers and their integration into many aspects of the design. and frequently very complex design technology applied in the development of design procedures and the design of the offshore structures has not been sufficiently debugged and failures have resulted. the number of potential crack sites in FPSOs and tankers emphasises such a consideration. associated with load. with an emphasis of the latter QA/QC process in the conceptual and early design phases. until adequate confidence is gained. but not for the FPSO. Errors can occur due to individual errors and omissions. leading to an explosion hazard. inadequate procedures. software errors are also a concern. as well as large uncertainty in the response. rejection of information. e. On the other hand. software and lack of robustness of the organizations. The treatment of residual stresses and constraint seems to be important factors in this connection (Bjørheim et al. and clarify the basis for accounting for such phenomena in design Offshore structures are developed in several stages: conceptual. this issue is still open for debate. This is because new structures involve a high utilisation of static strength. new structural details. the significant residual strength of damaged ships makes it possible to detect cracks using the leak-before-break detection and a close visual inspection. the required cumulative damage is D = 1. 2000b). The fatigue criteria for FPSOs were established before they became common practice for tankers (Bach-Gansmo et al. 3. and incorrect transmission of information (communication errors) have been the dominant causes of failures. Also. However. The lack of adequate training.duce wave loads. need a more rigorous monitoring and inspection. Normally. which require different type of attention.10 Quality assurance and control of the design process The quality assurance and control of the engineering process have to address two different situations. (e. and teamwork or back-up (insufficient redundancy) have been responsible for not detecting and correcting many of these errors (Bea. 1999) is found to be much smaller than crack lengths experienced in ship hulls. a dry-docking for inspections is more complicated for FPSOs because it needs to be stationary at the offshore site.0 for a 20-year service life for production ships. namely: detect. violations (circumventions). and operation of oil and gas structures. The thousands of welded joints of similar type and location encountered in the ships imply a high probability of fatigue cracking which suggests application of a more restrictive fatigue criterion.g. engineering and detailed engineering phases. For that matter.. The critical crack length estimated by current methods. However. Errors of omission and commission. too. time.. 35 . This may be the case when the crack causes a leak from the cargo tank into the ballast tank. possibly with high stress concentration. Newly developed. QA/QC needs to be hierarchical. mistakes. for economical reasons. construction. 1987). response and resistance. Novel structures. advanced. it may be advantageous to apply more restrictive fatigue criteria when the consequences are high. 2004). However. for which there is no or limited service experiences. control and mitigate errors made in connection with technology that is known in the engineering community as such identify possible unknown phenomena.
and assist the owners of the concept to improve. Nevertheless. codes. The checking should continue through the major phases of the design process. Such loss of corporate memory is particularly probable in times of down-sizing. The loss of corporate memory in companies responsible for structural safety also has been a factor contributing to many cases of structural failures. and third parties. computer programs) of the structure design process to assure that ‘standardized errors’ have not been embedded in the design tools. have been at the root-cause of several recent failures of offshore structures. It is found that errors are often made by individuals in organizations with a culture that does not promote quality and reliability in the design process. Knowledge of the painful lessons in the past was lost and the lessons were repeated with generally even more painful results. in other words it should be performed by designers and others doing the work. QC is the interactive element in which the planning is implemented and carried out. the design organizations also need to be robust. encourage. and a minimum compliance mentality. and sensitive third parties can help. particularly the willingness 36 . is crucial. It is when the organization or the operating team encounters defects and damage – and is under serious stress. could have been detected either by the person next in line or by properly organized additional checks. their colleagues. This checking should start with the basic tools (guidelines. The culture and the organizations do not provide the incentives. 2000a-b). Robust organizations have extensive auditing procedures to help spot safety problems and they have reward systems that encourage risk mitigating behaviours. There can be a real danger in excessively formalized QA/QC processes. While selfchecking is very important.Software errors. and controls that are required to achieve adequate quality. values. QA/QC of the engineering process QA is the proactive process in which the planning is developed to help preserve desirable quality. If not properly managed. in which incorrect and inaccurate algorithms were coded into computer programs. standards. An extensive benchmark testing is required to assure that the software performs as it should and that the documentation is sufficient. that the benefits of robustness become evident. knowledgeable. QA/QC measures are focused both on error prevention and error detection and correction (Harris and Chaney. a waste of scarce resources that can be devoted to QA/QC. trained. with a particular attention given to the loading analysis. they can lead to generation of paperwork. Matousek and Schneider (1976) found that 87% of the errors causing accidents in the construction industry. an additional QA/QC is necessary. In the same way as the structure should be damage tolerant. Moreover the plans for fabrication and operation (manuals) also constitute an important part of the QA and QC process. resources. The third-party QA and QC checking measures which are an integral part of the offshore structure design process provide an independent review. Guidelines have been developed to address the quality of the computer software for the performance of finite element analyses. experienced. A good support in organization by experienced managers. The provision of adequate resources and motivations is also necessary. One particular importance is the provision of independent checking procedures that can be used to validate the results from analyses. It is important that the QA/QC is hierarchical. outsourcing and mergers (Bea. Therefore. goals. who have daily responsibilities for the quality of the project organizations and processes. 1969).
but more obvious.5m 30 20 Moment (kNm) 10 0 -10 -20 -30 • QA/QC of novel conceptsrepresent particular challenges . It is noted that these phenomena.4m 267m Ø 44. 27.requiresrobust control. Examples of phenomena “discovered” in the recent two decades include the ringing experienced in connection with the Draugen mono-tower shown in Fig.InnovationdependsuponR&D Linear analysis Lineæ beregning r Ikkelineæ beregning r -40 Nonlinear analysis 1860 1865 1870 1875 1880 1885 1890 1895 1900 Tim (s) e e. the safety was ensured by operational restrictions.e. New technologies compound the problems of latent system flaws (Reason. The phenomenon was discovered when most of the manufacturing process had been completed. Unfortunately.g.g. 27: Ringing in Draugen monotower Fig. Repetitive designs that have been adequately tested in operations to demonstrate that they have the required quality do not need to be verified and checked as closely as those that are ‘first-offs’ and ‘new designs’ that may push the boundaries of the current technology. became important due to a combination of nonlinear wave load excitation at certain natural structural frequencies. The main objective of QA/QC is detection of errors and omissions and not their prediction. Ringing in the Draugen platform Fig. (to appear) is an interesting effort to assess the risk associated with gross errors and omissions. in relatingto floatingplatform s/ risers/offloadingof gas) Ø 16. Identification of new phenomena The early phases of design are particularly important for the QA and QC of novel concepts. Novel concepts that could imply new physical phenomena relating for instance to loads and response need particular attention. 1997). Another recent. 28: Springing and ringing in TLP 37 . like many others in the history of offshore structures.partlym ature (m anyaspectsof fixedplatformtechnology) . • Offshore structural engineeringtoday . in some cases the implementation is not clearly justified and needs improvements in the reliability of an engineered system. indepent reviews .of management and engineering to provide integrity to the process and to be prepared to deal adequately with ‘bad news’. Another example is the high frequency springing and ringing response of TLPs. The intensity and the extent of the design checking process need to be matched to the particular design situation.partlyinnovative technologyem erging (e. In this case the extreme loading increased by about 30% due to a particular combination of hydrodynamic excitation on large diameter columns and a natural structural period in the range of 2-8s. issue is the possible ship impact scenario associated with the tandem off-loading. i. Yet the attempt made by Lotsberg et al. Model testing is crucial in this connection. sometimes the results of formal risk analysis approaches are only used to justify a compliance with regulatory targets and. So. The true value of QA and QC lies in the disciplined process.
Concluding remarks Various measures to ensure an adequate safety in offshore structures have been reviewed based upon relevant accidents.. A design criteria as well as load and structural analysis methods have been briefly presented. there is a strong incentive to reduce the uncertainties to limit the design conservatism for economical reasons.From a safety point of view. Then sloshing in FPSOs with several “slack tanks” as well as possible interaction between fluid in tanks and rigid body motions of the vessels. the most important issue is to identify a new phenomenon that represents a new or altered hazard. for instance in connection with new environmental conditions. the development of new offshore facilities are still expected in the future. the aging of the existing offshore structures. especially due to crack growth. S afe ty issu es C o m plex and com pact p rocess facility (fire/e xplosion hazards) C o nsequence of LN G leakage P rocess near sto rage facility (m ight im ply e scalation of fire. 29: Safety assessment of transport system for Liquefied Natural Gas 4.i.e. needs attention in the years to come. Yet. When it is identified. as well as design for structural robustness. a particular emphasis is placed on the Accidental Collapse Limit State design check related to accidental loads and abnormal strength. The QA and QC tasks. especially associated with the loading and dynamic response. Therefore. The main cause of accidents is human and organizational errors and omissions. In this paper. This includes inspection. need attention. The 38 . and especially how refinement of analysis methods and additional information reduce uncertainty and hence the necessary safety factors. to achieve an acceptable safety level. are particularly challenging in connection with novel concepts for new environmental conditions or new functions. monitoring and repair of the structure. involving new combinations of wind waves and swell or ice or use of novel concepts in connection with production and transport of liquefied natural gas. it is shown that the failure probability implied by current ultimate and fatigue limit state criteria is small and does not show up in the accident statistics. to possibly identify new phenomena. It is demonstrated how structural reliability analysis can be used to establish consistent design criteria for ultimate resistance and fatigue. To a large extent the offshore industry has matured. On the other hand. In general. QA and QC of the engineering process are required. the uncertainties associated with the hazard are commonly accounted for by conservative design approach. However.) F loa ting production of LN G C a rgo transfe r in open sea s S loshing of LN G in partly filled tanks (m ight im pair ta nk integrity) O p e ration of vessels close to p roduction/term inal fa cilities (collision hazard) O ffsho re off-loa ding term ina ls (a w a y from den sly populate d a rea s and busy ports) Fig.
SCI Publication No.philosophy behind this robustness criterion is described and it is shown how information has been established for a proper implementation of the criterion. Trondheim. Amdahl. Glasgow. E. Vol.. S. I would also like to thank the many people I have been working with in carrying out the research as well as code development for the Norwegian Petroleum Directorate. (2004) “Damage Tolerance of FPSOs with Fatigue Cracks”. T. RG (2000a) Achieving step change in Risk Assessment & Management (RAM). Ascot. North East Coast Inst. however. I. BEFETS (1998) ‘Blast and Fire Engineering for Topside Systems’. Kielland Accident”. Pergamon Press. Berge. Almar-Næss. S. of Marine Technology. Bea. P.E.oil-gas. (ed. Scottland. Nedlands. New York. Centre for Oil & Gas Engineering. and Skillman. (2003) FABIG API (1993/1997) ‘Recommended Practice for Planning. ISO and other regulatory bodies that are reported in this paper. London. J. ASRANet Colloquium. Designing and Constructing Fixed Offshore Platforms”. on Mobile Offshore Units.au. and Moan. Tapir Publ.. (2004) “Probabilistic Modeling and Evaluation of Collision between 39 . London: City University. are those of the author. C. ‘Assessment of Existing Platform’. Fjeld. T. pp 41-70. Trondheim. ASME.uwa. J. Holand (deceased). H. as well as inspection strategy can be combined for different types of offshore structures. H. It is shown how fatigue and robustness design criteria. http://www. M. Ayala-Uraga. crack growth and rupture are particularly addressed.” Proc. A. NY. UK. First Int. I.) (1985). Phase 2. and Skaret. Carlsen. OMAE. J.A. WA. Dallas. Bea RG (2000b) Performance Shaping Factors in Reliability Analysis of Design of Offshore Structures. British Standard. (1975) “Assessment of the Stability of Floating Platforms”. BS 7910:1999. New York. Proc. Amdahl. Bjørheim. the First North Sea Oil Field’. Karsan. NOU 1981:11. Dept. (2002) “System Reliability issues of Offshore Structures considering Fatigue Failure and Updating based on Inspection”. BS 7910 (1999) “Guidance on Methods for Assessing the Acceptability of Flaws in Fusion Welded Structures”. Lecture Notes. (in Norwegian – English translation available). J. L.. Broughton. Acknowledgement I would like to acknowledge the invitation to serve a Keppel Professor at the National University of Singapore as well as the cooperation with its Department of Civil Engineering and the Centre for Offshore Research and Enginneering. ISOPE Conference. Chen... and Moan. Vol. Proc. Haver. I. Norwegian University of Science and Technology. O. Bach-Gansmo. 122. to yield an acceptable safety level. S. API RP2A-WSD July 1993 with Supplement 1 with Sect. Conf. and Moan. University of Western Australia. Amdahl. ‘Fatigue Handbook for Offshore Steel Structures’. of Naval Architects. Lloyd and J. 8th BOSS Conf.0. UK.edu.Vinnem. Oslo. In the view of the aging of offshore structures. February 1997. Beckwith. The opinions expressed. (1999) ‘Structural Response to Accidental Loads’. 253. They particularly include J. T. References ALK (1981) “The Alexander L. American Petroleum Institute. (1997) "Engineering Challenges of Ekofisk. (1987) “Fatigue Assessment of Hull Girder for Ship Type Floating Production Vessels. 17. D.
593-600. (eds) (1994) Proc.. Moan. SINTEF Report STF70 A95210. SINTEF.. (1994). 6th ICOSSAR. Vol. Presented at Int. 122. Proc. 459-472. Vol. ETH. Rogue Waves 2000. Int. Moan. Offshore Technology Conf. Harris. Jordaan. Fjeld. HMSO.A. John Wiley & Sons. Rotterdam. C. Houston. T.O. Reliability Engineering and System Safety. HSE (1992) “Safety Case Regulations”. CA. 4. W. ASME. (1991) “Rational for Load Specifications and Load Factors in the New CSA Code for Fixed Offshore Structures”. Lotsberg. T. Report No.. Canada). Engineering Handbook. Proc. (1994) “Reliability and Risk Analysis for Design and Operations Planning of Offshore Structures”. (1999) “Structural Reliability Analysis and Prediction”. Kielland Platform” in “Case Histories in Offshore Engineering”. OTC 5882. 4. Houston. J. China). Int. Haver. C.. Draft for approval. on Offshore Structures. (1998) “Target levels for structural reliability and risk analysis of offshore structures”. Draft. (2001). Offshore Technology Research Center. ( 2000) “Evidences of the Existence of Freak Waves”. 169-186. London. Oslo. “Probability-Based Optimization of Fatigue Design Inspection and Maintenance”. J. Offshore Design. Firenze. John Wiley & Sons. London. Pitagora Editrice. T. (1977) “Reliability of Offshore Structures”. 1994 (St. University of Glasgow. ‘Part 2: Fixed Steel Structures’. 40 . Moan.A. Zürich.) Springer-Verlag: Berlin. (1988) “The Inherent Safety of Structures Designed According to the NPD Regulations”. 18. Proc. 129-140. Vol. Bericht No. T. 4th ICASP Conference. M. Melchers. A. 20-32. Moan. 2.W. Denmark). D. T. Paper No. Proc.(1983) “Safety of Offshore Structures”.J. Keynote lecture.T. ed. Balkema. ISO 2394 (1998) “General Principles on Reliability for Structures”. Moan. and Ibbs. Balkema publishers. Moan. Houston. 351368. Chichester. New York. I. 20th . Standardization Organization. (ed). OMAE. (1988) “Development of a Reliability-based Alternative to API RP2A”. Paper No. and Schneider. Matousek. Maier (ed. Workshop on Assessment and Requalification of Offshore Production Structures. Trondheim. UK. C. Texas A&M University and University of California. Dunlap. I. Institut für Baustatik und Konstruktion der ETH Zürich. et al. S.I.. Madsen. Lloyd. London.Shuttle Tanker and FPSO in Tandem Offloading”. in Risk Reliability in Marine Technology. 84.A. 27th Offshore Technology Conference. Moan. and Chaney.R. Paper No. M. Czujko. (2000a) “Recent Research and Development Relating to Platform Requalification” J.A. Structural Safety and Reliability. Brest. ISSC (1988-1994) Proceedings of the International Ship and Offshore Structures Congress in 1988 (Lyngby. F. F88043 . International Standards Organisation. (1995) “Safety Level Across Different Types of Structural Forms and Material – Implicit in Codes for Offshore Structures”. I. Trondheim. (1976) “Untersuchungen Zur Struktur des Zicherheitproblems bei Bauwerken”. G. Symp. T. OTC 7753. New Orleans. C. (to appear) “Risk Assessment of Loss of Structural Integrity of a Floating Production Platform due to Gross Errors”. Proc. France. Health and Safety Executive. and Maes. 9th Offshore Technology Conf. D. 454-464. (1995) “Structural Reliability. Marine Structures.J. J. Guedes Soares.. London. R.Johns. (1985) “The Progressive Structural Failure of the Alexander L. OTC 3027. Civil Engng. Berkeley. 3. H. 21-43. ISO 19900 (1994) ‘Petroleum and Natural Gas Industries – Offshore Structures – Part 1: General Requirements’. Proc. S. J. (2001) ‘Design of Offshore Facilities to Resist Gas Explosion Hazard’'.D.E. and Karsan. Sørensen (1990). 59. Cornell. Vol. UK. & S.Some contributions to Offshore Technology“. J. Prepared for ISO/TC250/SC7.. 1991 (Wuxi. (1969) “Human Factors in Quality Assurance”.
Elsevier. Paper No. 3rd ICOSSAR. Chichester. 25th Offshore Technology Conference. NTS.” Norwegian Petroleum Directorate. American Bureau of Shipping. Dallas. OTC 7123. ASME Winter Annual Meeting. et al (2003) “Report of Committee V.C. New York. (1989) “Catastrophic Failure Modes of Marine Structures” in Structural Failure. Petrobas and Coppe (eds).. Proc.1 Risk Assessment” Proc. J. Amsterdam. Vol. Texas. Paik. Stavanger.K. Houston. Wang. Vol. 15th ISSC Congress. Rotterdam. Vol.. NPD (1984) “Regulations for load-carrying structures for extraction or exploitation of petroleum”. API. Amdahl. Moan. T. London. Stavanger. (2003) “Ultimate Limit State Design of Steel-Plated Structures”.. and Holand. Dept. Proc.. S. Background to NORSOK N-003”. Aldershot. John Wiley & Sons. Elsevier. Vol. Karsan. with particular emphasis on collisions”. et al (2003) “Report of Specialist Committee V. of Marine Technology.T. M. John Wiley & Sons. J. The Norwegian Petroleum Directorate. 591-599. Moan. (2002) “Statistics of wave crests from models vs. 803-820. Rev. T. Brazil. 25th Offshore Technology Conf. Berge. Norwegian Technology Standards. Inquiry Commission HMSO. Amsterdam.Z. Paper No. T. 1.. (1981b) “Risk Assessment of Offshore Structures Experiences and Principles”.8th ICASP. (1981a) “Analysis of the Fatigue Failure of the Alexander L. Kielland”. and Spencer.M. NPD (1977) “Regulation for the Design of Fixed Structures on the Norwegian Continental Shelf”. A. Moan. NPD (1981) “Guidelines for Safety Evaluation of Platform Conceptual Design. F. T. and Amdahl. T. Norwegian Technology Standards. and Holthe.Moan. Proc. NORSOK Z-013 (1998a) “Risk and Emergency Preparedness Analysis”. Balkema. Houston.K. Oslo.Wierzbicki and N. 191-200. NORSOK N-004 (1998b) “Steel Structures”. Amsterdam. St. Washington D. 2. I. Proc. J. and Forristall. T and Amdahl. 41 . Stavanger. (1987). NORSOK N-003 (1999) “Actions and Action Effects”. Elsevier. Moan. Norwegian Petroleum Directorate. Applications of Statistics and Probability. Proc. Inc. “Load and Resistance Factor Design-Recalibration LFRD” Report API PRAC 87-22. Moan. G. Rio de Janeiro. J. 15th ISSC.A. NPD (1991) “Regulations Relating to Implementation and Use of Risk Analysis in the Petroleum Activities”. (1997) “Managing the Risks of Organizational Accidents”. Norwegian Technology Standards. W. (1999) “Probabilistic Inspection Planning of Fixed Offshore Structures. 1. J. Structure and Infrastructure Engineering. Vårdal. Moan. T. J. PA (1990) “The Public Inquiry in the Pipe Alpha Disaster”. Trans SNAME. P-36 (2001) “Workshop on the Accident with the P-36 Platform”. Norwegian Petroleum Directorate. Oslo. Maintenance and Repair of Offshore Structures”. Paik. Stavanger. T. J. measurements”. Vol. Johns Newfoundland. (1993a) ”Reliability-Based Fatigue Design Criteria for Offshore Structures Considering the Effect of Inspection and Repair”. NORSOK Standard Z-013. OTC 7189. Oslo. 307-339. and Johannesen. O.K. Moan. Ashgate Publishers. D. X. et al.2 Collision and Grounding”. (2000b) “Accidental Actions. (2001) “Risk Analysis of FPSOs. Reason. Moan. Houston. J. with Emphasis on Collision Risk”.T. Oslo. Oslo. A. Report RD 2001-12. 28443. T. 21st OMAE Conference. J. T (1993b) “Analytical Risk Assessment and Risk Control of Floating Platforms Subjected to Ship Collisions and Dropped Objects”. 2. Moses. 110. Edifice Fort William. Jones (eds). (2002) “Risk Analysis of FPSO. UK. and Thayamballi. Norwegian University of Science and Technology. Trondheim. Moan. NORSOK N-001 (2002) “Structural Design”.. T. (2004) “Reliability-based Management of Inspection. K. Prevosto. Moore. 407-418. and Wilson. OR (1984) Royal Commission on the Ocean Ranger Marine Disaster: “Report One: The Loss of the Semi-submersible Drill Rig Ocean Ranger and its Crew”. 2. Paper No.” Proc.
. Cancun. 14th ISSC Congress. and Bjørheim. et al. Proc. Proc. Wirsching. Van Nostrand Reinholdt.Norwegian Petroleum Directorate (now: Petroleum Safety Authority. Norway) TLP . Lotsberg. G. 19th OMAE Conference. and Isaacson. 1996. J. Smith. WOAD: “Worldwide Offshore Accident Databank”. Paper No.Tension Leg Platform WOAD – World Accident Data Bank. Validation of Probabilistic Fracture Mechanics Analysis of Fatigue in North Sea Jackets". Document SCI-P-112/503. Steel Construction Institute. Offshore Technology Conference. Dept. Nagasaki. Kluwer Academic Publishers.Sarpkaya. Skallerud. T. J. New York. 00-2078. Mexico. Houston. Sigurdsson. 16th OMAE Conference. USA NPD . and Ørbeck-Nilssen. Doordrecht.Health and Safety Executive. B. C.G. UK IMO . Tucson. Proc.2.International Standardization Organization MMS-Mineral Management Services. Proc. University of Arizona. and Moan. I.H. T. issued by Det Norske Veritas 42 . Paper No. Vårdal. K. of Aerospace and Mechanical Engng. (1977) “Influence of Local Compressive Failure on Ultimate Longitudinal Strength of Ships hull” Proc.. 81-15. Tokyo. Walker.Human and Organizational Factors HSE . P. Oslo.. 22nd OMAE Conference. Acronyms ALS . 1334.American Petroleum Institute FDF – Fatigue Design Factor (to multiply with the service life to get desired characteristic value of fatigue life) FLS . T. O. Vinnem.E. (1999) “Offshore Risk Assessment”. Proc. Research Studies Press. Japan. New Orleans. L.Accidental Collapse Limit State API .International Maritime Organization ISO . PRADS. O. 203-37120. and Amdahl.T. 73-79. T.” OTC Paper no 11950. (2000) “Report of ISSC Committee VI. Myhre. (1983) “Probability-based Fatigue Design Criteria for Offshore Structures” Report API-PRAC Project No. Ultimate Hull Girder Strength”. (2003) “New Guidance on the Design of Offshore Structures to Resist the ExplosionHazard” Paper No. (1997) "Predicted versus Observed Fatigue Crack Growth. Yokohama. Yao. T.Fatigue Limit State HOF . SCI(1993) “Interim Guideance Notes for the Design and Protection of Topside Structures against Explosion and Fire”. Moan. Vårdal. (2002) “Nonlinear Analysis of Offshore Structures”. London. (2000) “Fatigue Reliability of Old Semi-submersibles. S.S. (1981) “Mechanics of Wave Forces on Offshore Structures”. et al. (2000) "Applications of Probabilistic Fracture Mechanics Analysis for Reassessment of Fatigue Life of a Floating Production UnitPhilosophy and Target Levels". Det Norske Veritas. M.T.