Professional Documents
Culture Documents
Report 2005-04 PDF
Report 2005-04 PDF
2005-04
SAFETY OF OFFSHORE
STRUCTURES
by
TORGEIR MOAN
Professor
Norwegian University of Science and Technology
and
Keppel Professor
National University of Singapore
Foreword
The Second Keppel Offshore & Marine Lecture was delivered by Professor Torgeir
Moan at the National University of Singapore (NUS) on 26 November 2004. This report
is the written version of the lecture.
under the Department of Civil Engineering, and is part of the bigger umbrella of the
Centre for Offshore Research & Engineering (CORE) in NUS. CORE has received seed
funding from Keppel Offshore & Marine Ltd and Economic Development Board
(Singapore). The Centre aims to be a focal point for industry participation and activities
in Singapore, and promotes multi-disciplinary research by drawing on the expertise of
various universities, research institutes, and centres for integrated R&D.
Professor Moan, the first Keppel Professor, is an academic of international stature
through his 30 years of close involvement in the international offshore oil and gas and
marine fraternity. He brings a global perspective to promote R&D in Singapore, with a
particular emphasis on the technological interests of Keppel Offshore & Marine. He will
serve as the beacon of guidance and inspiration for academics as well as industry.
CORE acknowledges the significant support of everyone in Keppel Offshore & Marine,
especially Mr Choo Chiau Beng, Mr Tong Chong Heong and Mr Charles Foo, for their
immense contributions. CORE is working closely in partnership with Keppel on R&D,
Education and Training to draw young talents into the offshore and marine industry.
Summary
1. Introduction
Oil and gas are the dominant sources of energy in our society. Twenty percent of
these hydrocarbons are recovered from reservoirs beneath the seabed. Various kinds
of platforms are used to support exploratory drilling equipment, and the chemical
(production) plants required to process the hydrocarbons. Large production platforms,
such as some of those in the North Sea, represent investment of billions of U.S. dollars and significant operational costs. Pipelines or tankers are used to transport the
hydrocarbons to shore. This paper is limited to deal with offshore structures, see Fig.
1.
The continuous innovations to deal with new serviceability requirements and demanding environments as well the inherent potential of risk of fires and explosions have
lead to an industry which has been in the forefront of development of design and
analysis methodology. Fig. 2 shows phases in the life cycle of offshore structures. The
life cycle of marine systems is similar to that of other systems. In view of the ecological issue removal or clean-up need to be considered. In this aspect the recycling of the
material is an important issue. In the life cycle phases of structures the design phase is
particularly important. Offshore structures need to fulfil serviceability and safety requirements. Serviceability requirements depend upon the function of the structure,
which is to provide a platform and support of equipment for drilling or for the production of hydrocarbons. Drilling units need to be mobile while production platforms are
generally permanent. Production platforms are commonly designed to carry large
chemical factories together with large hydrocarbon inventories (Fig. 1c). Safety re1
Fabrication
- Fabrication plan - Inspection/repair
Operation
- Operation plan
Inspection/
monitoring/
repair /
maintenance
Reassessment
Data, methods,
criteria
Layout/
Scantlings
Fabrication &
Operation
data
aeronautical and nuclear industries also played an important role. However in the last
20-30 years the developments in the offshore industry has had a significant impact on
the development of safety approaches. This is partly because the offshore industry
plays a key role in the worlds economy. Moreover the oil and gas represent energy
with large potential accident consequences. Companies involved in structures and/or
facilities that experience accidents may suffer loss of reputation and this may damage
the publics trust on the companies.
The rationalisation of safety management of offshore structures began in early 70s.
Among the milestones is the introduction of Risk Analysis in 1981 and Accidental
Collapse Design criterion in 1984 by the Norwegian Petroleum Directorate and the
HSE Safety case approach in 1992, when the ALARP principle - as large as reasonably practicable was introduced for determining the target safety level.
To limit the likelihood of fatalities and environmental and property damages, offshore
structures should be designed, fabricated and operated in such a manner that the probability of the following failure modes is adequately small:
- overall, rigid body instability (capsizing) under permanent, variable and environmental loads
- failure of (parts of) the structure foundation or mooring systems, considering
permanent, variable, and environmental as well as accidental loads
Stability requirements for floating platforms affect the layout and the internal structure subdivision in compartments. Criteria to prevent progressive structural failure
after fatigue failure or accidental damage would have implications on overall layout
of all types of platforms. Otherwise a structural strength criterion affects the scantlings of the stiffened, flat, and cylindrical panels that typically constitute floating offshore structures.
If the location is far off shore then evacuation and rescue will be difficult. On the
other hand, this implies that accidents on offshore facilities affect the general public to
a lesser extent than accidents on similar facilities on land.
In the following sections accident experiences on offshore structures will be briefly
explained. Then, an outline of various measures to manage the safety or ensure that
the risk is within acceptable limits, is given. This includes: Design and inspection
criteria as well as reliability methodology to calibrate the partial safety factors to correspond to a defined acceptable safety level. In particular it is explained how fatigue
failures can be avoided by design as well as inspections and regular monitoring of the
structure. Emphasis is placed on how structural robustness can be ensured by using
so-called Accidental Collapse Limit State (ALS) criteria. Such criteria are exemplified in relation to fires, explosions and other accidental loads. Finally, Quality Assurance and/or Quality Control of the engineering process will be described with particular reference to dealing with unknown wave loading and response phenomena.
2. Accident Experiences
2.1 Accident experiences at large
Safety may be regarded as the absence of accidents or failures. Hence the insight
about safety features can be gained from detailed information about accidents and
failures. To learn about the intrinsic nature of accidents, it is mandatory to study the
detailed accounts provided from investigations of catastrophic accidents since the
3
necessary resources are then spent to investigate such accidents. Such studies include
those of the platforms Alexander Kielland in 1980 (ALK, 1981, Moan and Holand,
1981b), Ocean Ranger in 1982 (OR, 1984), Piper Alpha in 1988 (PA, 1990), and P-36
in 2001 (P-36, 2003). See also Bea (2000a, 2000b). In addition, the statistics about
offshore accidents, such as ones given in WOAD (1996), provide an overview.
Global failure modes of concern are
- capsizing/sinking
- structural failure
- positioning system failure
the former two modes represent catastrophic events while the latter one is only critical
for Tension-leg platforms. Global failures normally develop in a sequence of technical
and physical events. However, to fully understand accidents it is necessary to interpret
them in the view of human and organizational factors (HOF). This includes possible
deficiencies in relevant codes, possible unknown phenomena that have materialized as
well as possible errors and omissions made in engineering processes, fabrication
processes or in the operation itself.
a) Alexander L. Kielland
before and after capsizing
in 1980
b) Model of Ocean
Ranger, which capsized in
1982, during survival
testing
d) P - 36 accident in 2001
Let us consider an example: The platform shown in Figure 4a in the Gulf of Mexico.
This is one of many platforms that were damaged during the passage of the hurricane
Lilli. Physically there is no doubt that this accident was due to extreme wave forces.
To explain from a human and organizational point of view why the platform was not
strong enough to resist the wave forces, we have to look at the decisions that were
made during the design phase regarding loads, load effects, resistance and safety factors. The explanation might be that design was based on an inadequate wave conditions or load calculation. The damage could also be due to the occurrence of a particular a wave phenomenon, such as an abnormal wave crest (see Fig. 4b) or another unknown wave phenomenon. In the case of the exceptional wave in Fig. 4b, the question is whether the extreme crest height of 18.5 m should be considered as the socalled freak wave or simply a rare wave. Alternatively, the reason could be inadequate air-gap provided in the design. Yet another explanation might be that an improper strength formulation was used (as was the case in design of early generation
platforms). Finally, the safety factors might not have been sufficient to cover the inherent uncertainties. For each of these possible causes, two explanations need to be
4
considered, namely 1) The state of art in offshore engineering was inadequate at the
time of design ; 2) Errors and omission were made during design or fabrication! Obviously, these two explanations have different implications on the risk reducing actions.
In this connection it is noted that several types of environmental load phenomena,
such as green water on deck and slamming (Fig. 4 c-d) are subjected to large uncertainties. In general, if the phenomenon is known but subject to significant uncertainties, the design approach taken is normally conservative.
18
The technical-physical sequence of events for the Alexander Kielland platform was:
fatigue failure of one brace, overload failure of 5 other braces, loss of column, flooding into deck, and capsizing. For Ocean Ranger the accident sequence was: flooding
through broken window in ballast control room, closed electrical circuit, disabled ballast pumps, erroneous ballast operation, flooding through chain lockers and capsizing.
Piper Alpha suffered total loss after: a sequence of accidental release of hydrocarbons,
as well as escalating explosion and fire events. P-36 was lost after: an accidental release of explosive gas, burst of emergency tank, accidental explosion in a column,
progressive flooding, capsizing and sinking after 6 days.
Table 1 shows accident rates for mobile (drilling) and fixed (production) platforms
according to the initiating event of the accident WOAD (1996). Table 1 is primarily
based upon technical-physical causes. Severe weather conditions would normally affect capsizing/ foundering as well as structural damage. In most cases there existed
human errors or omissions by designers, fabricators or operators of the given installation was a major contributor to the accident. The most notable in this connection is,
of course accidents caused by loads such as ship impacts, fires and explosions which
should not occur but do so because of errors and omissions during operation.
In general, accidents take place in sequences. For floating platforms, the loss of buoyancy and stability is commonly an important aspect of total loss scenarios. Structural
damage can cause progressive structural failure or flooding. Progressive flooding at5
Mobile
Fixed
Gulf of Mexico
North Sea
Fixed
Fixed
1970-79 /80-95
Blowout
18.8/ 11.4
2.5/0.9
2.2/1.0
2.6/1.6
Capsizing/
foundering
24.0/ 19.5
0.5/0.8
0.3/1.1
2.6/0.5
1.6/1.0
1.3/0.7
5.1/6.3
Dropped object
4.2/ 6.1
0.5/0.8
0.1/0.4
10.3/10.6
Explosion
7.4/3.3
0.7/1.6
0.3/0.4
2.6/8.3
Fire
12.3/
11.9
2.0/7.5
1.0/7.8
18.0/42.5
Grounding
6.1/3.3
Spill/release
4.9/5.9
1.8/8.7
1.0/5.8
23.1/98.3
0.5/0.6
0.4/0.5
10.3/6.0
Column D
Missing braces
that cause no
redundancy
Ranger I, 1979
Fig. 5: The total losses of Ranger I in 1979 and Alexander Kielland in 1981 were
initiated by fatigue failure
6
An overall picture of the accident rate in an industry may be displayed by the socalled Frequency-Consequence diagram as shown in Figure 6. The horizontal axis is
plotted the consequence, in this case in terms of fatalities, N. The vertical axis is
shown the frequency of N or more fatalities per accident. We see that the accident rate
for mobile drilling units is much higher than for fixed production platforms. Fixed
platforms are mainly used as production facilities. Moan and Holand (1981b) explained the main reasons for the differences in safety levels between mobile and fixed
platforms. Floating production platforms are not included because of the limited experience with such platforms. The risk is similar that that of passenger vessels and
tankers.
100
Marginally acceptable
Acceptable
10-1
Oil platforms
Mobile
Fixed
10-2
10-3
10-4
10-5
Passenger
ferries
(not ro-ro)
Tankers
Merchant
vessels
1
10
100
1000
10000
standards were not properly implemented even for platforms built in the 1970s.
Many platforms built in the 1970s had joints with design fatigue lives as low as 2-5
years. This fact was evidenced in the extraordinary surveys undertaken after Alexander Kielland accident. The same happened to the first purpose built FPSO and shuttle
tankers put into service in the mid-1980s. However, ships are obviously more robust
or damage-tolerant than mobile semi-submersible platforms.
Man-made live loads also have a normal and an abnormal component. While
some loads, notably fires and explosions, ship collisions, etc. do not have a normal
counterpart, they are simply caused by operational errors or technical faults. The mobile platform Ocean Ranger capsized in the offshore of Newfoundland in 1982. The
accident was initiated by control room window breaking due to wave slamming. The
water entering the control room lead to the short circuit of the ballast valve system,
thereby leading to a spurious operation of ballast valves. The resulting accidental ballast condition could not be controlled partly because of lack of crew training and
partly because of inadequate ballast pumps, and open chain lockers (OR, 1984).
The catastrophic explosion and fire on the Piper Alpha platform in 1988 was initiated
by a gas leak from a blind flange of a condensation pump that was under maintenance
but not adequately shut down (PA, 1990). The main issue that caused the initiation of
this accident was the lack of communication between the maintenance team and the
control room operators. The gas ignited and the initial explosion lead to damage of an
oil pipe and subsequent oil fires and explosions.
In 2001 the platform P-36 in Brazil experienced a collapse of the emergency drainage
tank, accidental explosion and subsequent flooding capsizing and sinking. A series of
operational errors were identified as the main cause of the first event and also the
sinking (P-36, 2001).
It is a well known fact that the gross errors dominate as the cause of accidents, and
therefore appropriate control measures should be implemented. It is found that the
gross errors cause 80-90% of the failure of buildings and bridges and other civil engineering structures (Matousek and Schneider, 1976). The same applies to offshore
structures.
R&D
Risk
reduction
Do the job
properly in
the first place
QA/QC
of design
QA/QC
of the asfabricated
structure
Unknown material or
load phenomenon
Do the job
properly in
the first place
Causes
Design
error
Abnormally
Failure
low
Fabrication resistance
R<S
error
QA/QC of
Design error
- oversight of load
Operational error
- accidental load
design
QA/QC of
operation
Event
control
(leak, etc)
ALS
design
check
It has been observed that errors and omissions occur especially in dealing with novel
materials and concepts as well as during periods with economic and time pressures.
In some cases, accidents have been caused by inadequate engineering practice such as
the lack of knowledge regarding new phenomena. Recently new phenomena such as
ringing and spinning of TLPs, degradation failure mechanism of flexible risers, have
been discovered. Nevertheless they were observed in time before any catastrophic
accident could occur.
3. Safety Management
3.1 General
Offshore drilling, production or transport facilities are systems consisting of structures, equipments and other hardwares, as well as specified operational procedures
and operational personnel. Ideally these systems should be designed and operated to
comply with a certain acceptable risk levels as specified for example by the probability of undesirable consequences and their implications. The safety management needs
to be synchronised with the life cycle of the structure. Structural failures are mainly
attributed to errors and omissions in design, fabrication and, especially, during operation. Therefore, Quality Assurance and Control (QA/QC) of procedures and the structure during fabrication and use (operation) is crucial.
To do a truly risk based design, by carrying out the design iteration on the basis of a
risk acceptance criterion, and to achieve a design that satisfies the acceptable safety
level, is not feasible. In reality, different subsystems, like:
-
are designed according to criteria given for that particular subsystems. For instance, to
achieve a certain target level, which implies a certain residual risk level, safety criteria
for structural design are given in terms of Ultimate Limit State (ULS) and Fatigue
Limit State (FLS) criteria. Using appropriate probabilistic definitions of loads and
resistance together with safety factors, the desired safety level is achieved. The implicit risk associated with these common structural design criteria is generally small!
The philosophy behind the Accidental Collapse Limit (ALS) criteria is discussed below.
The nature of human errors differs from that of natural phenomena and normal
man-made variability and uncertainty. Different safety measures are required to control error-induced risks. A number of people maintain that gross errors are Acts of
God and cannot be dealt with.
However,
-
weld defects and fatigue failures due to gross errors had occurred before the Kielland accident
ballast errors had occurred before the Ocean Ranger accident
fires and explosions had occurred before the Piper Alpha accident
and so on
The occurrence of gross errors have been avoided by adequate competence, skills,
attitude and self-checking of those who do the design, fabrication or operation in the
first place; and by exercising self-checking in their work.
In addition, quality assurance and control should be implemented in all stages of design, fabrication and operation. While the QA/QC in the design phase is concerned
with scrutinizing the analysis, design checks and the final scantlings arrived at, the
QA/QC during fabrication and operation phases refers to inspection of the structure
itself.
As mentioned above, operational errors typically result in fires or explosions or other
accidental loads. Such events may be controlled by appropriate measures such as detecting the gas/oil leakage and activating shut down valve; extinguishing of a fire by
an automatically-activated deluge system. These actions are often denoted as Event
Control.
Finally, Accidental Collapse Limit State criteria are implemented to achieve robust
offshore structures, that is to prevent that the structural damage occurring as fabrication defects or due to accidental loads, escalate into total losses (Moan 1994).
Table 2 summarises the causes of structural failure from a risk management point of
view, and how the associated risk may be ameliorated.
Adequate evacuation and escape systems and associated procedures are crucial for
controlling failure consequences in terms of fatalities.
Table 2: Causes of structural failures and risk reduction measures
Cause
Unknown phenomena
10
Safety requirements are imposed to avoid ultimate consequences such as fatalities and
environmental or property damages. Depending upon the regulatory regime, separate
acceptance criteria for these consequences are established. Property damage is measured in economic terms. Fatalities and pollution obviously also have economic implications. In particular, the increasing concern about environmental well-being can
cause small damages to have severe economic implications. While fatalities caused by
structural failures would be related to global failure, i.e. capsizing or total failure of
deck support, smaller structural damages may result in pollution; or property damage
which is costly to repair such as the damages of an underwater structure.
The current practice which is implemented in new offshore codes, issued e.g. by API
(1993/97), ISO 19900 (1994-) and NORSOK (1998a, 1998b, 1999, 2002) as well as
by many classification societies, and the most advanced codes are characterized by
-
- semi-probabilistic methods for ultimate strength design which have been calibrated by reliability or risk analysis methodology
- fatigue design checks depending upon consequences of failure (damagetolerance) and access for inspection
- explicit accidental collapse design criteria to achieve damage-tolerance for the
system
- considerations of loads that include payload; wave, current and wind loads, ice
(for arctic structures), earthquake loads (for bottom supported structures), as
well as accidental loads such as e.g. fires, explosions and ship impacts
- global and local structural analysis by finite element methods for ultimate
strength and fatigue design checks
- nonlinear analyses to demonstrate damage tolerance in view of inspection planning and progressive failure due to accidental damage
Fatigue crack growth is primarily a local phenomenon. It requires stresses to be calculated with due account of the long-term wave conditions, global behaviour as well as
the geometric stress concentrations at all potential hot spot locations, and suitable
fatigue criteria (e.g. Miners rule). Fatigue strength is commonly described by SNcurves, which have been obtained by laboratory experiments. Fracture mechanics
analysis of fatigue strength have been adopted to assess more accurately the different
stages of crack growth including calculation of residual fatigue life beyond throughthickness crack, which is normally defined as fatigue failure. Detailed information
about crack propagation is also required to plan inspections and repair.
11
Table 3 Limit State Criteria for safety with focus on structural integrity
L im it s ta te s
P h y s ic a l a p p e a r a n c e
o f fa ilu r e m o d e
U ltim a te
(U L S )
- O v e r a l l r ig i d b o d y
s t a b i lit y
- U lt im a t e s t r e n g t h o f
s t r u c t u r e , m o o r in g o r
p o s s ib le f o u n d a t io n
D if f e r e n t f o r b o t t o m
s u p p o rte d , o r b u o y a n t
s tru c tu re s .
C o m p o n e n t d e s ig n c h e c k
C o lla p s e d
c y lin d e r
F a tig u e
(F L S )
- F a ilu r e o f w e ld e d jo in t s
d u e t o r e p e t it iv e lo a d s
C o m p o n e n t d e s ig n c h e c k
d e p e n d in g o n r e s i d u a l
s y s te m s tre n g th a n d
a c c e s s f o r in s p e c t io n
F a t ig u e fra c tu re
A c c id e n ta l c o lla p s e ( A L S )
- U lt im a t e c a p a c it y 1 ) o f
d a m a g e d s t r u c t u r e w it h
c r e d i b le d a m a g e
R e m a rk s
S y s t e m d e s ig n c h e c k
J a c k -u p
c o lla p s e d
An adequate safety against fatigue failure is ensured by design as well as by inspections and repairs. Fatigue design requirements depends upon inspect ability and failure consequences. Current requirements for fatigue design check in NORSOK are
shown in Table 4. These values were established by the NPD code committee in 1984
by judgement.
Table 4 Fatigue design factor, FDF to multiply with the planned service life to
obtain the required design fatigue life (NORSOK N-001, 2002).
Access for inspection and repair
No access or
in the splash zone
Substantial
consequences
10
Without substantial
consequences
1)
The consequences are substantial if the Accidental Collapse Limit State (ALS) criterion is
not satisfied in case of a failure of the relevant welded joint considered in the fatigue check.
12
The first explicit requirements were established in Britain following the Ronan Point
apartment building progressive failure in 1968. In 1984 such criteria were extended
by NPD, to include such robustness criteria for the structure and mooring system.
While robustness requirements to the mooring are generally applied today, explicit
ALS criteria are not yet widespread. The World Trade Centre and other recent catastrophes have lead to further developments of robustness criteria for civil engineering
structures. See Figure 8.
ALS checks should apply to all relevant failure modes as shown in Figure 9. It is interesting in this connection to note that ALS-type criteria were introduced for sinking/
instability of ships long before such criteria were established for structural integrity as
such. Thus, ALS were introduced in the first mobile platform rules (as described e.g.
by Beckwith and Skillman, 1976). The damage stability check has typically been
specified with damage limited to be one or two compartments flooded. According to
NPD this damage should be estimated by risk analysis, as discussed subsequently.
The criterion was formally introduced for all failure modes of offshore structures in
Norway in 1984 (NPD, 1984).
Ronan point
appartment building
accident, 1968
Flixborough explosion,
1974
ECCS model codes,
1978
Alexander L. Kielland
accident, 1980
NPD Regulations for
Risk analysis, 1981
NPDs ALS criterion,
1984
HSE Safety Case, 1992
WTC, September 11., 2001
Applied
since
early
codes
Motivation:
small damages,
which inevitably occur,
should not cause
disproportionate
consequences!
Flooded
volume
Gaining
acceptance
Failure of Dynamic
Positioning System
is handled in a similar
manner
One
tether
failed
One
mooring
line failed
Generally
applied
13
14
proved inspection method or increased frequency of inspections. The following section briefly describes how fatigue design and inspection plans (based on an assumed
inspection method) can be established by reliability analysis to ensure an acceptable
safety level.
3.4 Quantitative Measures of Safety
Ideally the structural safety should be measured in a quantitative manner. Structural
reliability methods are applied to determine the failure probability, Pf which is associated with normal uncertainties and variability in loads and resistance. Quantitative
risk assessment can be used to deal with the probability of undesirable events and
their consequences in general terms. This includes events induced by errors and omissions, see Fig. 10.
Structural reliability analysis
Prob. density function
Deck
Column
Load effect
fS(s)
R,S
Resistance fR(r)
Wave
pressure
PF=P[RS]
r,s
Fault
tree
Critical
event
Event
tree
Consequences
The quantitative safety approach is based on estimating the implied failure probability
and comparing it with an acceptance level. This target safety level should depend
upon the following factors (e.g. Moan, 1998):
- type of initiating events (hazards) such as environmental loads, various accidental
loads, .. which may lead to different consequences
- type of SRA method or structural risk analysis, especially which uncertainties are
included
- failure cause and mode
- the possible consequences of failure in terms of risk to life, injury, economic losses
and the level of social inconvenience.
- the expense and effort required to reduce the risk.
In principle a target level which reflects all hazards (e.g. loads) and failure modes
(collapse, fatigue, ... ) as well as the different phases (in-place operation and temporary phases associated with fabrication, installation and repair) is defined with respect
to each of the three categories of ultimate consequences. The most severe of them
governs the decisions to be made. If all consequences are measured in economic
terms, then a single target safety level could be established. However, in practice it is
convenient to treat different hazards, failure modes, and phases separately, with separate target levels. This may be reasonable because it is rare that all hazard scenarios
15
and failure modes contribute equally to the total failure probability. The principle of
establishing target levels for each hazard separately was adopted by NPD for accidental loads; see e.g. Moan et al. (1993b). It was also advocated by Cornell (1995). In
general it is recommended to calibrate the target level to correspond to that inherent in
structures which are considered to have an acceptable safety.
3.5 Structural reliability analysis
General
Structural reliability methods for calculating the failure probability are readily available. If the uncertainty in the resistance R and load effect S are described by probability density functions. The failure probability can be calculated as P (R<S). It is important to recognize that there are different types of uncertainties used to determine the
resultant uncertainties associated with loads and resistances. One type of uncertainty
(Type 1) is natural or inherent; this type of uncertainty is information insensitive and
random. A second type of uncertainty (Type 2) is associated with modelling, parametric, and state uncertainties; this type of uncertainty is information sensitive and systematic. Type 2 model uncertainties may be defined as the ratio of the actual or true
value of the variable to the predicted or nominal (design) value of the variable. A variety of methods can be used to characterize the model uncertainty, including field test
data, laboratory test data, numerical data, and expert judgment. Often it is not possible to develop explicit separations of Type 1 and Type 2 uncertainties and it is important not to include them twice.
SRA is applied to determine the failure probability considering fundamental
variability, as well as uncertainties due to the lack of knowledge in loads, load effects
and resistance. The state of the art methods for calculating the failure probability are
the numerical First Order and Second Order Reliability as well as Monte Carlo
simulation methods (e.g. Melchers, 1999). However, analytical solutions exists for a
few cases, for instance, when failure is expressed by g( ) =R S 0 and both the
resistance R and the load effect S are lognormal random variables.
The failure probability is expressed by:
Pf = P( g () 0) = ( ) or = 1 ( Pf )
(1)
where (-) is the standard cumulative normal distribution, with numerical values as
shown in Table 5, and the reliability index, = LN can be exactly written as follows,
see e.g. Melchers (1999):
1 + V 2S
ln R
S 1 + V 2R
ln ( R /S )
= ' LN
LN =
2
2
ln[(1 + V R )(1 + V S )]
V 2R + V 2S
(2)
This simple expression has turned out to be useful and was applied in the API reliability based code calibration (Moses, 1987). The analytical formulation can also conveniently be used to express the relationship between Pf and safety factors.
16
1.0
1.4
1.8
Pf 0.16 0.081
2.2
0.036
0.014
3.0
2.6
0.47 10
-2
0.14 10
3.4
-2
0.34 10
3.8
-3
0.72 10
4.2
-4
0.13 10
4.6
-4
0.21 105
Reliability estimates are found to be sensitive to the distributions used for R and S.
The failure probability should refer to a time interval, e.g. a year or the service life. This
can be achieved by considering a load effect S that refers to an annual or service life
time maximum value. We note that the results of code calibration depend upon the
choice of reference period.
Reliability based code calibration
Reliability methods are increasingly used to make optimal decisions regarding safety
and the life cycle costs of offshore structures (see e.g. ISSC, 1988-1994; Moan, 1994).
In particular the efforts by Fjeld (1977); Lloyd and Karsan (1988), Moan (1988), Jordan and Maes (1991) to calibrate their codes to a certain reliability. An evaluation of
previous efforts on calibration of offshore codes was provided by Moan (1995) in
conjunction with the ISO effort to harmonize the safety level in codes for offshore
structures across the variety of structural types (ISO, 1994). However, safety factors
on loads are not properly varied to reflect the differences in uncertainty in load predictions for different types of structures.
To illustrate the relationship between partial safety factors, the uncertainty in resistance and loads as well as Pf , consider the simplest design format, often used in code
calibration,
R c / R SSc
(3)
where Rc and Sc are characteristic resistance and load effect, respectively. Let the (true)
random load effect, S and resistance, R be defined by their mean value () and the
coefficient of variation (V):
S = BSSC ,BS 1; VS = 0.15 0.30
R = BR R C ,BR 1; VR = 0.1
The BS reflects the ratio of the mean load (which refers to an annual maximum if the
annual failure probability is to be calculated,) and the characteristic load effect (typically the 100 year value) as well as a possible bias in predicting wave load effects,
e.g. due to model uncertainty.
By inserting the design equation Eq.(3) into the approximate expression of Eq.(2)
LN
ln ( R /S )
VR2 + VS2
ln(BR R S /BS )
VR2 + VS2
(4)
With R S = 1.5; a typical BS = 0.8 for wave-induced load effects; BR = 1.1 and VR =
0.1, it is found that LN is about 3.2 for a VS of 0.20. This reliability index corresponds to a Pf of 6 10-4. By decreasing BR/BS by 10 % reduces LN by 15%. It is
noted that the Similarly, by increasing Vs by 10 % reduces LN by 8%. At the same
time it is noted that the uncertainty in R has minimal influence on the safety level. Yet
it is important to estimate the mean bias of the resistance, BR accurately. It is also possible to approximately express R and S by (BR, VR) and (BS, VS), respectively, and
17
hence to express partial factors by the relevant uncertainties. (e.g. Melchers, 1999).
It is important to recognize that variables used in designing offshore structures are
often conservative. Thus, there exists sources of bias that must be recognized
quantitatively by the Bi's.
Goal: Implied Pf Pft
WSD:
RC/ > DC + LC + EC
Target
Pf or
R
resistance
D, L, E load effects due to
permanent
live
load
environmental
effects
LRFD:
RC/R > DDC + LLC + EEC
Load ratio, Ec/(Lc+Ec)
Fig. 11: Schematic illustration on how the implied safety level in a design code
for ultimate strength can be calibrated to be close to a given target level.
Fatigue Reliability Analysis
Structural reliability methods can also be used to calculate the probability of fatigue
failure. In Figure 12 the solid line with diamond symbol shows the fatigue failure
probability in the service life as a function of the design criterion the fatigue design
factor, FDF. It is shown that the cumulative failure probability in the service life varies from 10-1 to 10-4 when FDF varies from 1 to 10.
1.0E+00
1.0E-01
Failure probability
1.0E-02
1.0E-03
1.0E-04
1.0E-05
1.0E-06
1
10
Fig. 12: Fatigue failure probabilities in the 20 year service period, as a function of the
fatigue design factor and the uncertainty level. A is an equivalent constant stress
range that represents the long term stress level (Moan, 2004).
A consistent fatigue safety level can be achieved, by varying the FDF versus the effect of an inspection program as well as the consequences of failure.
18
(5)
where af and aN are the crack size at failure and after N cycles, respectively.
The outcomes of inspections are assumed to be no crack detection (ND) or crack detection (D) at time t after N cycles, which are described by:
I ND ( t ) : a N -a d 0
(6a)
I D ( t ):a N -a d 0
(6b)
In general, it is difficult to determine the distribution of the crack size (A) explicitly
when taking into account all uncertainties that affect the distribution as well as the
effect of inspections. Based on the Paris crack propagation law, Eqs. (5-6) can be
recasted into a convenient form for analysis as shown e.g. by Madsen and Srensen
(1990).
The effect of inspection may be viewed in two different ways depending upon
whether it is assessed before inspections are done, e. g. during the design phase, or
afterwards during operation. If the effect of inspections is estimated before they are
carried out, two outcomes: D and ND are possible. The exact outcome is not known
but the probability of the outcomes can be estimated based on the reliability method.
At the design stage, the outcomes (e.g., crack detection or no detection) are not
known. When a single inspection is assumed to be made at time tI and possible cracks
detected are repaired, the failure probability in the period t tI can be determined by:
Pf (t) = P [ F(0, t I )] + P [S(0, t I ) and F(t I , t) | ID (t I )] P [ ID (t I )] + P [S(0, t I )and F(t1 , t) | I ND (t I )] P [ I ND (t I )]
(7)
where F(t1,t2) and S(t1,t2) are, respectively, mean failure and survival in time period
(t1,t2). Equation (7) can be generalised to cover cases with several inspections with
two alternative outcomes. Moan et al. (1993a) showed, based on reliability analysis,
how the allowable cumulative damage (D) at the design stage can be relaxed when
inspections are carried out. Such analyses served as basis for Table 4.
On the other hand if no failure has occurred before time tI and it is known that no
crack is detected at time tI, then the failure probability in the period t tI is
Pf (t) = P [ F(t I , t) | I ND (t I )]
(8)
The knowledge of survival up to time tI and no crack detection at time tI reduces the
uncertainty and makes the failure probability drop. The reliability index increases at
the time of inspection as illustrated by the example shown in Fig. 13.
19
Inspection
during
operation with
No crack detection
Reliability Index
10-3
310-3
No inspection
Effect of Inspection
predicted at design stage
3.510-2
Pf
1
0
10
15
20
Time (years)
Fig. 13: Reliability index as a function of time and inspection strategy. Inspection
Event Tree analysis is based on predictions at the design stage. The other
curves are based on inspections with known outcome during the service
life (Ayala-Uraga and Moan, 2002)
The updating methodology is useful in connection with extension of service life for
structures with joints governed by the fatigue criterion (Vrdal et al, 2000). In such
cases, the design fatigue life is in principle exhausted at the end of the planned service
life. Nevertheless, if no cracks have been detected during inspections, then a remaining fatigue life can be demonstrated. However, it is not possible to bring the structure
back to its initial condition by inspection only. This is because the mean detectable
crack depth by NDE methods typically is 1.0 2.0 mm, while the initial crack depth
is 0.1 0.4 mm.
The calculation of the system failure probability after inspection may be approximated by independent system failure modes (Moan et al., 1999, 2002, 2004)
n
(9)
This formulation is based on modeling the ultimate failure of the system by a single
mode. Moreover, the formulation is limited to failure modes initiated by a single fatigue failure and followed by ultimate global failure. The failure probability in Eq. (9)
is applicable when the inspection event I aims at detecting cracks before the failure of
individual members, (i.e. before they have caused rupture of the member). Another
inspection strategy would be to apply visual inspection to detect members failure and
repair failed members after the winter season in which those particular members
failed. In this case the Eq. (9) will have to be modified as follows: the individual fatigue failures of components (Fj ) does not depend on the inspection event, and, rather
such an inspection and repair strategy will have implication on the time period, for
which the failure probability P[FSYS(U)|Fj] should be calculated.
A further simplification is to update the failure probability of each joint based on the
inspection result for that joint. This is conservative if no cracks are detected, but nonconservative if cracks are detected.
Inspections may be prioritized by using Eq. (9) for each joint separately by allowing a
20
certain target probability level, PfSYS(T) to each term in the sum of Eq. (9). The target
fatigue failure probability for joint i, PFfT(i) is then obtained from
(10)
Reliability level,
where the system failure probability, PfSYS(i) is associated with a fatigue failure of
member (i) followed by an ultimate system failure. PfSYS(T) is obtained by generalizing
the acceptance criteria implied by Table 4. This approach has been implemented for
template-space frame structures (Moan et al., 1999).
Given the target level for a given joint, inspections and repairs by grinding or other
modifications are scheduled to maintain the reliability level at the target level as
shown in Fig. 14.
No
inspection
Target level
for a given joint
12
1st inspection
16
20
Time (years)
2nd inspection
3.6 Safety implications of Ultimate and Fatigue Limit State criteria and Inspection,
Monitoring, Maintenace and Repair
The failure probability estimated by structural reliability analysis (SRA) normally
does not represent the experienced Pf for structures. This is because the safety factors
or margins normally applied to ensure safety are so large that Pf calculated by SRA
becomes much smaller than that related to other causes. For instance when proper
fatigue design checks and inspections have not been carried out, the likelihood of fatigue failures (through-thickness cracks) for platforms (e.g. in the North Sea), is large
and cracks have occurred. However, with the exception of the Ranger I (1979) and
Alexander Kielland failure (1980) such cracks have been detected before they caused
total losses. As discussed above, errors and omissions in design, fabrication and operation represent the main causes of the accidents experienced.
On the other hand, frequent occurrences of cracks provide a basis for correlating actual crack occurrences with state of art predictions for various offshore structures.
Hence, the current predictions for jackets are found to be conservative (Vrdal and
Moan, 1997), while for semi-submersibles and ships, the predictions seem to be reasonable, as summarized by Moan (2004). This agreement is achieved when the SN
approach (or a calibrated fracture mechanics approach) is applied to predict the occurrence of fatigue failure (e.g. through thickness crack). Yet, if ULS and FLS design
checks are properly carried out, Pf will be negligible within the current safety regime. This reserve capacity, implied by ULS and FLS requirements, provides some
21
resistance against other hazards like fires, explosions etc. However providing safety
for the mentioned hazards in this indirect manner is not an optimal risk-based design.
If more efforts were directed towards risk reduction actions by implementing ALS
criteria, then current safety factors for ULS and FLS could be reduced without increasing the failure rate noticeably.
As explained above, SRA does not provide a measure of the actual total risk level
associated with offshore facilities. Yet, it is useful in ensuring that the ultimate
strength and fatigue design criteria are consistent by calibrating safety factors. Moreover, SRA provides a measure of the influence of various parameters on the reliability
and, hence, the effect of reducing the uncertainty on the failure probability.
Finally, it is noted that the random uncertainties in the ultimate strength commonly
have limited effect on the reliability compared to that inherent in load effects. On the
other hand, the systematic uncertainty (bias) in strength and load effects has the same
effect on the reliability measure.
3.7 Risk assessment
Risk assessment (Qualitative Risk assessment or Formal Safety Analysis etc.) is a tool
to support decision making regarding the safety of systems. The application of risk
assessment has evolved over 25 years in the offshore industry (Moan and Holand,
1981b, NPD (1981)). The Piper Alpha disaster (PA, 1990), was the direct reason for
introducing PRA, (or QRA), in the UK in 1992 (HSE, 1992). In the last 5 years such
methods have been applied in the maritime industry, albeit in different directions
(Moore et al. 2003). The offshore industry has focused on the application of risk assessment to evaluate the safety of individual offshore facilities. The maritime industry
has primarily focused on the application of risk assessment to further enhance and
bring greater clarity to the process of making new ship rules or regulations.
The risk assessment methods is used because they provide a reliable direct determination of events probabilities e.g. probabilities as low as 10-4 per year. Up to now the
accumulated number of platform years world wide is about 120 000, 15 000 and 1 200
for fixed, mobile structures and FPSOs, respectively. However, to determine probabilities as low as 10-4 per year requires about 23000 years of experiences to have a
90% chance of one occurrence. A further complexity is that the available data refer to
various types of platforms and, not least, different technologies over the years. Application of a systems risk assessment is therefore attractive. The basis for this approach
is the facts that : a)almost every major accidental events have originated from a small
fault and gradually developed through long sequences or several parallel sequences
of increasingly more serious events, and culminates in the final event b) it is often
reasonably well known how a system responds to a certain event.
By combining the knowledge about system build-up with the knowledge about failure
rates for the elements of the system, it is possible to achieve an indication of the risks
in the system (Vinnem, 1999; Moan, 2000b).
The risk analysis process normally consists in the following steps (Fig 15):
-
Risk
Risk
Acceptance
Acceptance
Criteria
Criteria
Risk
Risk
Reducing
Reducing
Measures
Measures
Hazard
HazardIdentification
Identification
Frequency
Analysis
Consequence
Analysis
RISK
RISKESTIMATION
ESTIMATION
Risk
RiskPicture
Picture
RISK
RISKANALYSIS
ANALYSIS
Risk
RiskEvaluation
Evaluation
Unacceptable
Tolerable
Acceptable
Acceptable
In most cases an Event-Fault Tree technique (Figure 16) is the most appropriate tool
for systematizing and documenting the analyses made. Although the Event-Fault tree
methodology is straightforward, there are many problems. An important challenge is
to determine the dominant of the (infinitely) many sequences. Events are not uniquely
defined in a single sequence but appear in many combinations. Moreover, human factors are difficult to account for in the risk assessment. However, operational errors
that result in accidental loads are implicitly dealt with by using data on experienced
releases of hydrocarbons, probability of ignition etc. Explicit prediction of design and
fabrication errors and omissions for a given structure is impossible. However, it is
possible to rate the likelihood of accidents as compared to gross errors (Bea, 2000a-b,
Lotsberg et al., to appear).
The risk analysis methodology currently applied in offshore engineering is reviewed
in detail by Vinnem (1999). In connection with accidental loads, the purpose of the
risk analysis is to determine the accidental events which annually are exceeded by a
probability of 10-4.
End
event
Critical
event
Fault tree
Event tree
Consequences
23
Design the structure to withstand environmental and operational loading throughout its lifecycle.
Tolerate at least one failure or operational error without resulting in a major hazard or damage to structure
Provide measures to detect, control, and mitigate hazards at an early time accidental escalation.
Accidental Collapse Limit State criteria can be viewed as a means to reduce the consequences of accidental events (Fig. 17). The NORSOK N-001 code specifies quantitative ALS criteria based on an estimated damage condition and a survival check. The
robustness criteria in most other codes, however, do not refer to any specific hazard
but rather require that progressive failure of the structure with one element removed at
a time, is prevented. Hence, no performance objective for a real threat is created.
24
The weakness with such a criterion is that it does not distinguish between the differences in vulnerability
In a risk analysis perspective the ALS check of offshore structures is aimed at preventing progressive failure and hence reduce the consequences due to accidental
loads, as indicated in Figure 17. Beside progressive structural failure, such events
may induce progressive flooding and hence the capsizing of floating structures.
P, F
Reduce probability
Reduce consequences
"known
events"
Reduce
errors &
omissions
Event
Control
"unknown
events"
Critical
event
Indirect design
- robustness
- redundancy
- ductility
Fault
tree
P, F
Event tree
End events:
Accidental loads
Survival check of the damaged structure as a whole,
considering P, F and
environmental loads ( E ) at a probability of 10 -2
The relevant accidental loads and abnormal conditions of structural strength are
drawn from the risk analysis, see e.g. Vinnem (1999) and Moan (2000b), where the
relevant factors that affect the accidental loads are accounted for. In particular, the
risk reduction can be achieved by minimizing the probability of initiating events:
leakage and ignition (that can cause fire or explosion), ship impact, etc. or by minimizing the consequences of hazards. The passive or active measures can be used to
control the magnitude of an accidental event and, thereby, its consequences. For instance, fire loads are partly controlled by sprinkler/inert gas system or firewalls.
Fenders are commonly used to reduce the damage due to collisions.
ALS checks apply to all relevant failure modes as indicated in Table 6. An account of
accidental loads in conjunction with the design of the structure, equipment, and safety
systems is a crucial safety measure to prevent escalating accidents. Typical situations
where direct design may affect the layout and scantlings are indicated by Table 7 for
different subsystems:
- loads-carrying structure & mooring system
- process equipment
- evacuation and escape system
25
Failure mode
Fixed platforms
Structural failure
All
Structural failure
All
Instability
Floating
platforms
Tension-leg platforms
Collision on platform
Abnormal strength
Structural failure
All
Mooring - slack
system - strength
Structure
Columns /deck (if not protected)
Equipment
Passive protection
system
Fire barriers
Blast / Fire
barriers
Ship
impact
Possible fender
systems
Dropped
object
Impact
protection
Fire
If the accidental load is described by several parameters (e.g. heat flux and duration
for a fire; pressure peak and duration for an explosion) design values may be obtained
from the joint probability distribution by contour curves (NORSOK N-003, 1999).
26
27
leaks, the likelihood of ignition, as well as the combustion and temperature development (in a fire) and the pressure-time development (for an explosion) need to be estimated and followed by a structural assessment of the potential damage.
No damage
No Ignition
Damage to
Personnel and
Material
Immediate Ignition
Fire
Release of
Gas and/or
Liquid
Formation of
Combustible Fuel-Air
Cloud (Pre-mixed)
Fire
Ignition
(delayed)
Gas Explosion
Fire and
BLEVE
The fire thermal flux may be calculated on the basis of the type of hydrocarbons, its
release rate, combustion, time and location of ignition, ventilation and structural geometry, using simplified conservative semi-empirical formulae or analytical/numerical models of the combustion process. The heat flux may be determined by
empirical, phenomenological or numerical method (SCI, 1993; BEFETS, 1998).
Typical thermal loading in hydrocarbon fire scenarios may be 200- 300 kW/m2 for a
15 minutes up to a two hours period. The structural effect is primarily due to the reduced strength with increasing temperature. An A-60 fire protection wall may be applied for a heat load of 100kW/m2 and less, while H-rated protection walls are needed
for higher heat loading.
In the case of explosion scenarios, the analysis of leaks is followed by a gas dispersion and possible formation of gas clouds, ignition, combustion and the development
of overpressure. Tools such as FLACS, PROEXP, or AutoReGas are available for this
purpose (Moan, 2000b; Czujko, 2001, Walker et al., 2003). The variability of conditions is accounted for by using a probabilistic approach.
The results from the gas explosion simulations are the pressure time history. If the
pressure duration is short compared to the natural period, the pressure impulse governs the structural response. Figure 20 compares the predicted impulse by state of a
state of the art CFD method with measured values in large scale tests for deterministic
explosion scenarios. The vertical axis is a logarithmic plot of the ratio of the predicted
and measured value. The scattering is seen to be significant. The pressure peaks
would obviously be even more uncertain.
28
10.0
1.0
0.1
Experiment No
Fig. 20: Comparison of predicted and measured pressure impulse for deterministic
explosion scenarios, obtained by the computer code FLACS.
The typical overpressures for topsides of North Sea platforms are in the range 0.2-0.6
barg, with duration of 0.1-0.5s., while an explosion in open air at the drill floor typically implies 0.1 barg with duration of 0.2s. The explosion pressure in a totally enclosed compartment might be 4 barg.
The damage due to explosions may be determined by simple and conservative singledegree-of freedom models (NORSOK N-004). In several cases where simplified
methods have not been calibrated, nonlinear time domain analyses based on numerical
methods like the finite element method should be applied. A recent overview of such
methods may be found in Czujko (2001). Fig. 21 shows an explosion panel with deformations as determined by an experiment and finite element analysis. The calculated and measured deflections of the specimen are compared in Figure 21c.
Fire and explosion events that result from the same scenario of released combustibles
and ignition should be assumed to occur at the same time, i.e. to be fully dependent.
The fire and blast analyses should be performed by taking into account the effects of
one on the other. The damage done to the fire protection by an explosion preceding
the fire should be considered.
0.7
0.6
0.5
0.4
0.3
PRESSURE [N/
0.2
0
2]
a) Experiment
b) FE analysis
Experiment
0.1
20
Analysis
40
60
DISPLACEMENT [mm]
80
c) Loadresponse histories
29
100
Fig. 22: Survival analysis of a deck suffering explosion damage (Amdahl, 2003).
Deformations in the lower figure are not to scale.
Fig. 22 shows results from an analysis of a deck structure in a floating platform (Amdahl, 2003). The upper left figure in this slide illustrates the deck structure of a floating production platform. The design pressure on the East Wall is also indicated. In
this case it is assumed that the panels are badly damaged that they can be removed.
The lower figure shows the deformation pattern of the damaged deck.
Ship impacts
Significant efforts have been devoted to ship-ship collisions, as reviewed by the ISSC
Committee on Collision and Grounding (Paik et al., 2003). The analysis of ship impacts on offshore structures follows the same principles but the collision scenarios and
consequences are different; see e.g. NORSOK N-003 and -004 as well as Amdahl
(1999).
All ship traffic in the relevant area of the offshore installation should be mapped and
should account for possible future changes in the operational pattern of vessels. The
impact velocity can be determined based on the assumption of a drifting ship or on the
assumption of erroneous operation of the ship. Ship traffic may therefore for this purpose be divided into categories: trading vessels and other ships outside the offshore
activity, offshore tankers, and supply or other service vessels. Merchant vessels are
often found to be the greatest platform collision hazard which depends upon the location of the structure relative to shipping lanes. Fig. 23a indicates situations where offshore structures are operating in close proximity. For the scenario in Fig. 23b the stern
impact on the FPSO by the shuttle tanker is a challenge (Chen and Moan, 2004 )
30
Impact scenarios are established by considering bow, stern, and side impacts on the
structure as appropriate.
While historical data provides information about supply vessel impacts, risk analysis
models are necessary to predict other types of impacts, such as incidents caused by
trading vessels (see e.g. NORSOK N-003(1999) and Moan (2000b)). A minimum
accidental load corresponding to 14 MJ and 11 MJ sideways and head-on impact, respectively, is required to be considered.
The impact damage can normally be determined by splitting the problem into two
uncoupled analyses. They are the external collision mechanics dealing with global
inertia forces and hydrodynamic effects and internal mechanics dealing with the energy dissipation and distribution of damage in the two structures (Fig. 24).
The external mechanics analysis is carried out by assuming a central impact and applying the principle of conservation of momentum and conservation of energy.
The next step is to estimate how the energy is shared among the offshore structure and
the ship. Methods for assessing the impact damage are described by Amdahl (1999),
based on simplified load-indentation curves or direct finite element analysis. For the
general case where both structures absorb energy, the analysis has to be carried out
incrementally on the basis of the current deformation field, contact area and force
distribution over the contact area.
External mechanics
External mechanics
Rs
Ri
Es,i
Es,s
dws
Ship
FPSO
dwi
Internal mechanics
Internal mechanics
Fig. 24: Simplified methods for calculating impact damage (NORSOK N- 004)
31
The recent advances in computer hardware and software have made nonlinear finite
element analysis (NLFEM) a viable tool for assessing collisions. A careful choice of
element type and mesh is required. It is found that a particularly fine mesh is required
in order to obtain accurate results for components deformed by axial crushing. A major challenge in NLFEM analysis is the prediction of ductile crack initiation and
propagation. This problem is yet to be solved. The crack initiation and propagation
should be based on fracture mechanics analysis using the J-integral or Crack Tip
Opening Displacement method rather than simple strain considerations.
While the main concern about ship impacts on fixed platforms is the reduction of
structural strength and possible progressive structural failure, the main effect for
buoyant structures is damage that can lead to flooding and, hence, loss of buoyancy.
The measure of such damages is the maximum indentation implying loss of water
tightness. However, in the case of large damage, reduction of structural strength, as
expressed by the indentation, is also a concern for floating structures.
A ship impact involving the minimum energy of 14 MJ will normally imply an indentation of 0.4 1.2 m in a semi-submersible column. A 75-100 MJ impact may be required to cause an indentation equal to the column radius (Moan and Amdahl, 1989).
The effect is highly dependent upon the location of impact contact area relative to
decks and bulkheads in the column.
Moan and Amdahl (2001) considered supply or merchant vessels with a displacement
of 2000- 5000 tons which caused bow impacts on a typical side structure of an FPSO
with displacement of about 100 000 t. For this case the limiting energy for rupture of
the outer ship side was found to be ~10 MJ (700mm bow displacement). The energy
at 1500mm bow indentation was estimated to be ~43 MJ while the limiting energy for
rupture of the inner side is ~230 MJ, at 3700 mm bow displacement. This corresponds
to a critical speed of 18.5 knots for a 5000 tons displacement vessel. We recall that
rupture of plate material is very uncertain such that the quoted energy level should be
used with cautiously. If the FPSO side structure is assumed to be sufficiently rigid to
ensure that all energy is absorbed by the bow, then the maximum collision force (peak
force) is 30 MN. However most of the time the force oscillates between 15-25 MN.
Another situation dealt with by Moan and Amdahl was stern impact on the FPSO
caused by a shuttle tanker, see Fig. 23b and 25. A 70 kdwt shuttle tanker was found
to penetrate the machine room of a 140 kdwt FPSO after an energy dissipation of 38
MJ. On the other hand, it was demonstrated that it was feasible to strengthen the stern
of the FPSO corresponding to ice-strengthening dimensions so that all dissipation
could occur in the shuttle tanker bow.
F o r ca s tle d ec k
Shuttle
U p p er d ec k
tanker
FPSO
Fig. 25: Shuttle tanker in ballast condition impacting FPSO stern (Moan and Amdahl,
2001).
32
Environmental events
The ALS criterion is supposed to be applicable to any abnormal wave loading as
well. Obviously, the two-step ALS procedure then becomes a survival check based on
a load event which annually is exceeded by a probability of 10-4. Consider a wave
loading, F, which for simplicity is characterised only by the wave height, H. Assume
that F is a smooth function of wave height. H i.e. F=cH and that the wave height
follows a Weibull distribution with a shape parameter B. If it is assumed that there are
5108 waves in 100 years, the ratio between the loads at a 10-4 and 10-2 annual probability level, respectively, becomes Fc(-4)/Fc(-2) = (H(-4)/H(-2)) = (1.23)/B. The ratio of
the required strength would then be Rc(-4)/Rc(-2) = Fc(-4)/ (T Fc(-2) ) = 1.23/B/T where T
is the total ULS safety factor while the safety factor for ALS is 1.0. This implies that
ULS will be governing for North Sea and other conditions (B=0.9-1.0) if < 1.8-2.0.
In benign conditions (e.g.with B=0.6) ULS will be governing if < 1.2.
Courtesy:
Statoil, Marintek
However, there are two issues that need to be observed in this connection. The first
issue is the occurrence of possible abnormal waves, with high crest or other unusual
shape which is not a simple extrapolation of the 10-2 event (Haver, 2000, Prevost
and Forristall, 2002). The second issue is the possible sudden change in force, F, at a
certain wave height. The most interesting case is when the wave reaches the platform
deck, implying that the wave force will increase very fast with the wave height. By
ensuring a deck clearance such that the 10-4 crest does not reach the deck, the ULS
criterion would normally be governing. Otherwise, the ALS criterion based on the 104
wave event may govern the dimensions.
Abnormal resistance
It is not possible to determine the abnormal resistance (e. g. due to fabrication defects), using risk analyses. Up to now, abnormal resistance has been explicitly specified by generic values for specific types of structures based on some considerations of
the vulnerability of the structural components. For instance, the ALS check is carried
out for platforms with slender braces by considering the damage in terms of severed
individual braces. This condition was established in the aftermath of the Alexander
Kielland accident and was initially aimed to cover the effects of frequently occurring
ship impacts relating to supply vessels as well as abnormal fatigue cracks. This damage condition is also applicable to the tether and other mooring systems.
33
Crack control
Most degradations of the structure are due to corrosion and crack growth. The effect
of corrosion is ameliorated by corrosion allowance or a protection system, which
makes the corrosion development gradual and, hence, be easy to control. The crack
growth is more critical because cracks can result is a sudden rupture. Moreover,
cracks are hard to detect because they are small for a significant part of the time service life.
Abnormal defects, i.e. defects much larger than those implicit in fatigue design curves,
are also of concern. As mentioned by Moan (2004), observations with jackets show
that 2-3 % of cracks found in inspections can be attributed to abnormal defects. This
also occurs in other offshore structures.
Therefore, the crack control strategy, in general needs to include a combination of the
following safety measures:
-
An adequate design fatigue life gives ample time to detect cracks. For instance, if the
fatigue life from the occurrence of a through thickness cracks to rupture is 25 % of the
fatigue life determined by SN-curves, a 20-year characteristic life implies a characteristic value of the time to failure of 5 years and a mean time to failure of 15 years after
a possible leak.
The implementation of the Accidental Collapse Limit State criteria obviously provides a safety barrier with respect to the system failure given the fatigue failure of a
member in a framed structure.
When inspections are prioritised, the potential of gross fabrication defects (e.g. because of difficult access), should also be considered. Since inspections after fabrication on shore can be carried at less costs and with higher reliability than during operation offshore, it is worthwhile to emphasise such inspections, at least for critical components.
Different strategies may be relevant for different types of offshore structures. This is
because the existing structures possess different robustness and because inspection,
repair and failure costs vary significantly.
As an example of structural components with particular safety focus, consider tethers
in TLPs. They are designed with a Fatigue Design Factor of 10 and the ALS criterion
is implemented by requiring survival of any tether failed. Moreover, the tethers in the
Heidrun platform in the North Sea, are tubular members which were joined by butt
welds ground flush and were inspected twice with respect to surface defects on the
outside and the inside of the tubular wall. Furthermore a 60-70 % X-ray examination
for internal defects after fabrication was carried out in the yard. The first service inspection is now taking place after 10 years in service.
The crack control in semi-submersibles with slender braces is based on a balanced
fatigue design criterion and ALS according to Table 4 as well as leak detection during
operation.
A major difference between a trading tanker and an FPSO is that the routing, the
speed reduction and the heading angle toward wave can be used for the tanker to re-
34
duce wave loads, but not for the FPSO. Also, a dry-docking for inspections is more
complicated for FPSOs because it needs to be stationary at the offshore site. The fatigue criteria for FPSOs were established before they became common practice for
tankers (Bach-Gansmo et al., 1987). Normally, the required cumulative damage is D
= 1.0 for a 20-year service life for production ships. The thousands of welded joints of
similar type and location encountered in the ships imply a high probability of fatigue
cracking which suggests application of a more restrictive fatigue criterion. On the
other hand, the significant residual strength of damaged ships makes it possible to
detect cracks using the leak-before-break detection and a close visual inspection.
However, it is desirable to clarify the crack propagation and critical crack length of
large cracks. The critical crack length estimated by current methods, (e.g. BS 7910,
1999) is found to be much smaller than crack lengths experienced in ship hulls. The
treatment of residual stresses and constraint seems to be important factors in this connection (Bjrheim et al., 2004). However, this issue is still open for debate.
However, for economical reasons, it may be advantageous to apply more restrictive
fatigue criteria when the consequences are high. This may be the case when the crack
causes a leak from the cargo tank into the ballast tank, leading to an explosion hazard.
For that matter, the number of potential crack sites in FPSOs and tankers emphasises
such a consideration.
Novel structures, for which there is no or limited service experiences, need a more
rigorous monitoring and inspection, until adequate confidence is gained. This is because new structures involve a high utilisation of static strength, new structural details, possibly with high stress concentration, as well as large uncertainty in the response.
3.10 Quality assurance and control of the design process
The quality assurance and control of the engineering process have to address two different situations, which require different type of attention, namely:
-
detect, control and mitigate errors made in connection with technology that is
known in the engineering community as such
identify possible unknown phenomena, e.g. associated with load, response and
resistance, and clarify the basis for accounting for such phenomena in design
Offshore structures are developed in several stages: conceptual, engineering and detailed engineering phases. QA/QC needs to be hierarchical, too, with an emphasis of
the latter QA/QC process in the conceptual and early design phases.
Errors can occur due to individual errors and omissions, inadequate procedures, software and lack of robustness of the organizations. Errors of omission and commission,
violations (circumventions), mistakes, rejection of information, and incorrect transmission of information (communication errors) have been the dominant causes of
failures. The lack of adequate training, time, and teamwork or back-up (insufficient
redundancy) have been responsible for not detecting and correcting many of these
errors (Bea, 2000b).
With the advent of computers and their integration into many aspects of the design,
construction, and operation of oil and gas structures, software errors are also a concern. Newly developed, advanced, and frequently very complex design technology
applied in the development of design procedures and the design of the offshore structures has not been sufficiently debugged and failures have resulted.
35
Software errors, in which incorrect and inaccurate algorithms were coded into computer programs, have been at the root-cause of several recent failures of offshore
structures. Guidelines have been developed to address the quality of the computer
software for the performance of finite element analyses. An extensive benchmark testing is required to assure that the software performs as it should and that the documentation is sufficient. One particular importance is the provision of independent checking procedures that can be used to validate the results from analyses.
It is found that errors are often made by individuals in organizations with a culture
that does not promote quality and reliability in the design process. The culture and the
organizations do not provide the incentives, values, standards, goals, resources, and
controls that are required to achieve adequate quality.
The loss of corporate memory in companies responsible for structural safety also has
been a factor contributing to many cases of structural failures. Knowledge of the painful lessons in the past was lost and the lessons were repeated with generally even
more painful results. Such loss of corporate memory is particularly probable in times
of down-sizing, outsourcing and mergers (Bea, 2000a-b).
QA/QC of the engineering process
QA is the proactive process in which the planning is developed to help preserve desirable quality. QC is the interactive element in which the planning is implemented and
carried out. QA/QC measures are focused both on error prevention and error detection
and correction (Harris and Chaney, 1969). There can be a real danger in excessively
formalized QA/QC processes. If not properly managed, they can lead to generation of
paperwork, a waste of scarce resources that can be devoted to QA/QC, and a minimum compliance mentality.
It is important that the QA/QC is hierarchical, in other words it should be performed
by designers and others doing the work, their colleagues, and third parties. While selfchecking is very important, Matousek and Schneider (1976) found that 87% of the
errors causing accidents in the construction industry, could have been detected either
by the person next in line or by properly organized additional checks. Therefore, an
additional QA/QC is necessary. A good support in organization by experienced managers, who have daily responsibilities for the quality of the project organizations and
processes, is crucial. In the same way as the structure should be damage tolerant, the
design organizations also need to be robust. It is when the organization or the operating team encounters defects and damage and is under serious stress, that the benefits
of robustness become evident. Robust organizations have extensive auditing procedures to help spot safety problems and they have reward systems that encourage risk
mitigating behaviours.
Nevertheless, knowledgeable, trained, experienced, and sensitive third parties can
help, encourage, and assist the owners of the concept to improve. The third-party QA
and QC checking measures which are an integral part of the offshore structure design
process provide an independent review. This checking should start with the basic
tools (guidelines, codes, computer programs) of the structure design process to assure
that standardized errors have not been embedded in the design tools. The checking
should continue through the major phases of the design process, with a particular attention given to the loading analysis. Moreover the plans for fabrication and operation
(manuals) also constitute an important part of the QA and QC process. The provision
of adequate resources and motivations is also necessary, particularly the willingness
36
16.4m
267m
44.5m
30
Moment (kNm)
20
- partlyinnovative technologyemerging
(e.g. in relatingto floatingplatforms/
risers/offloadingof gas)
10
0
-10
-20
-30
Linear
analysis
Line
r beregning
Ikkeliner beregning
-40 Nonlinear analysis
1860 1865 1870 1875 1880 1885 1890 1895 1900
Time (s)
37
From a safety point of view, the most important issue is to identify a new phenomenon that represents a new or altered hazard. When it is identified, the uncertainties
associated with the hazard are commonly accounted for by conservative design approach. However, there is a strong incentive to reduce the uncertainties to limit the
design conservatism for economical reasons.
To a large extent the offshore industry has matured. Yet, the development of new offshore facilities are still expected in the future, for instance in connection with new
environmental conditions- i.e. involving new combinations of wind waves and swell
or ice or use of novel concepts in connection with production and transport of liquefied natural gas. Then sloshing in FPSOs with several slack tanks as well as possible interaction between fluid in tanks and rigid body motions of the vessels, need attention. In general, the aging of the existing offshore structures, especially due to
crack growth, needs attention in the years to come.
S afe ty issu es
C o m plex and com pact
p rocess facility
(fire/e xplosion hazards)
C o nsequence of LN G leakage
P rocess near sto rage facility
(m ight im ply e scalation of
fire..)
C a rgo transfe r in open sea s
S loshing of LN G in partly
filled tanks (m ight im pair
ta nk integrity)
O p e ration of vessels close
to p roduction/term inal
fa cilities (collision hazard)
O ffsho re off-loa ding term ina ls
(a w a y from den sly populate d a rea s and
busy ports)
Fig. 29: Safety assessment of transport system for Liquefied Natural Gas
4. Concluding remarks
Various measures to ensure an adequate safety in offshore structures have been reviewed based upon relevant accidents. A design criteria as well as load and structural
analysis methods have been briefly presented. It is demonstrated how structural reliability analysis can be used to establish consistent design criteria for ultimate resistance and fatigue, and especially how refinement of analysis methods and additional
information reduce uncertainty and hence the necessary safety factors. On the other
hand, it is shown that the failure probability implied by current ultimate and fatigue
limit state criteria is small and does not show up in the accident statistics. The main
cause of accidents is human and organizational errors and omissions. Therefore, to
achieve an acceptable safety level, QA and QC of the engineering process are required. This includes inspection, monitoring and repair of the structure, as well as
design for structural robustness. The QA and QC tasks, to possibly identify new phenomena, especially associated with the loading and dynamic response, are particularly
challenging in connection with novel concepts for new environmental conditions or
new functions. In this paper, a particular emphasis is placed on the Accidental Collapse Limit State design check related to accidental loads and abnormal strength. The
38
philosophy behind this robustness criterion is described and it is shown how information has been established for a proper implementation of the criterion. In the view of
the aging of offshore structures, crack growth and rupture are particularly addressed.
It is shown how fatigue and robustness design criteria, as well as inspection strategy
can be combined for different types of offshore structures, to yield an acceptable
safety level.
Acknowledgement
I would like to acknowledge the invitation to serve a Keppel Professor at the National
University of Singapore as well as the cooperation with its Department of Civil Engineering and the Centre for Offshore Research and Enginneering. I would also like to
thank the many people I have been working with in carrying out the research as well
as code development for the Norwegian Petroleum Directorate, ISO and other regulatory bodies that are reported in this paper. They particularly include J. Amdahl, S.
Fjeld, S. Haver, I. Holand (deceased), D. Karsan, J. Lloyd and J.E.Vinnem. The opinions expressed, however, are those of the author.
References
ALK (1981) The Alexander L. Kielland Accident, (in Norwegian English translation
available), NOU 1981:11, Oslo.
Almar-Nss, A. (ed.) (1985). Fatigue Handbook for Offshore Steel Structures, Tapir Publ.,
Trondheim.
Amdahl, J. (1999) Structural Response to Accidental Loads, Lecture Notes, Dept. of Marine
Technology, Norwegian University of Science and Technology, Trondheim.
Amdahl, J. (2003) FABIG
API (1993/1997) Recommended Practice for Planning, Designing and Constructing Fixed
Offshore Platforms, API RP2A-WSD July 1993 with Supplement 1 with Sect., 17.0, Assessment of Existing Platform, February 1997. American Petroleum Institute, Dallas.
Ayala-Uraga, E. and Moan, T. (2002) System Reliability issues of Offshore Structures considering Fatigue Failure and Updating based on Inspection, First Int. ASRANet Colloquium, Glasgow, Scottland.
Bach-Gansmo, O., Carlsen, C.A. and Moan, T. (1987) Fatigue Assessment of Hull Girder for
Ship Type Floating Production Vessels, Proc. Conf. on Mobile Offshore Units, London:
City University.
Bea, RG (2000a) Achieving step change in Risk Assessment & Management (RAM), Centre
for Oil & Gas Engineering, http://www.oil-gas.uwa.edu.au, University of Western Australia, Nedlands, WA.
Bea RG (2000b) Performance Shaping Factors in Reliability Analysis of Design of Offshore
Structures, J. OMAE, Vol. 122, ASME, New York, NY.
Beckwith, I. and Skillman, M. (1975) Assessment of the Stability of Floating Platforms,
North East Coast Inst. of Naval Architects.
BEFETS (1998) Blast and Fire Engineering for Topside Systems, Phase 2, SCI Publication
No. 253, Ascot, UK.
Bjrheim, L., Berge, S. and Skaret, H. (2004) Damage Tolerance of FPSOs with Fatigue
Cracks, Proc. ISOPE Conference.
Broughton, P. (1997) "Engineering Challenges of Ekofisk, the First North Sea Oil Field,
Proc. 8th BOSS Conf., Pergamon Press, New York, Vol. I, pp 41-70.
BS 7910 (1999) Guidance on Methods for Assessing the Acceptability of Flaws in Fusion
Welded Structures, BS 7910:1999, British Standard, London, UK.
Chen, H. and Moan, T. (2004) Probabilistic Modeling and Evaluation of Collision between
39
Shuttle Tanker and FPSO in Tandem Offloading, J. Reliability Engineering and System
Safety, 84, 2, 169-186.
Cornell, C.A. (1995) Structural Reliability- Some contributions to Offshore Technology,
Paper No. OTC 7753, Proc. 27th Offshore Technology Conference, Houston.
Czujko, J., ed. (2001) Design of Offshore Facilities to Resist Gas Explosion Hazard', Engineering Handbook, Offshore Design, Oslo.
Dunlap, W.A., and Ibbs, C.W. (eds) (1994) Proc. Int. Workshop on Assessment and Requalification of Offshore Production Structures, New Orleans, Offshore Technology Research
Center, Texas A&M University and University of California, Berkeley, CA.
Fjeld, S. (1977) Reliability of Offshore Structures, Paper No. OTC 3027, Proc. 9th Offshore
Technology Conf., Houston, Vol. 4, 459-472.
Harris, D. and Chaney, F. (1969) Human Factors in Quality Assurance, John Wiley &
Sons, London, UK.
Haver, S., ( 2000) Evidences of the Existence of Freak Waves, Proc. Rogue Waves 2000,
Brest, France, 129-140.
HSE (1992) Safety Case Regulations, Health and Safety Executive, HMSO, London.
ISO 19900 (1994) Petroleum and Natural Gas Industries Offshore Structures Part 1:
General Requirements, (1994), Part 2: Fixed Steel Structures, (2001), Draft,. Int. Standardization Organization, London.
ISO 2394 (1998) General Principles on Reliability for Structures, International Standards
Organisation, London., Draft for approval.
ISSC (1988-1994) Proceedings of the International Ship and Offshore Structures Congress in
1988 (Lyngby, Denmark); 1991 (Wuxi, China); 1994 (St.Johns, Canada).
Jordaan, I.J. and Maes, M.A. (1991) Rational for Load Specifications and Load Factors in
the New CSA Code for Fixed Offshore Structures. C.J. Civil Engng. 18, 3, 454-464.
Lloyd, J.R. and Karsan, D.I. (1988) Development of a Reliability-based Alternative to API
RP2A, Paper No. OTC 5882, Proc. 20th . Offshore Technology Conf., Vol. 4, Houston,
593-600.
Lotsberg, I. et al. (to appear) Risk Assessment of Loss of Structural Integrity of a Floating
Production Platform due to Gross Errors, J. Marine Structures.
Madsen, H.O. & S.D. Srensen (1990). Probability-Based Optimization of Fatigue Design
Inspection
and Maintenance. Presented at Int. Symp. on Offshore Structures, University of Glasgow.
Matousek, M. and Schneider, J. (1976) Untersuchungen Zur Struktur des Zicherheitproblems
bei Bauwerken, Institut fr Baustatik und Konstruktion der ETH Zrich, Bericht No. 59,
ETH, Zrich.
Melchers, R.E. (1999) Structural Reliability Analysis and Prediction, John Wiley & Sons,
Chichester, UK.
Moan, T.(1983) Safety of Offshore Structures, Proc. 4th ICASP Conference, Firenze, Pitagora Editrice.
Moan, T. (1985) The Progressive Structural Failure of the Alexander L. Kielland Platform
in Case Histories in Offshore Engineering, G. Maier (ed.) Springer-Verlag: Berlin.
Moan, T. (1988) The Inherent Safety of Structures Designed According to the NPD Regulations. Report No. F88043 , SINTEF, Trondheim.
Moan, T. (1994) Reliability and Risk Analysis for Design and Operations Planning of Offshore Structures. Keynote lecture, Proc. 6th ICOSSAR, Structural Safety and Reliability,
Vol. I, Balkema, Rotterdam, 21-43.
Moan, T. (1995) Safety Level Across Different Types of Structural Forms and Material
Implicit in Codes for Offshore Structures, SINTEF Report STF70 A95210, Trondheim,
Prepared for ISO/TC250/SC7.
Moan, T. (1998) Target levels for structural reliability and risk analysis of offshore structures, in Risk
Reliability in Marine Technology, Guedes Soares, C. (ed), A.A. Balkema publishers, 351368.
Moan,T. (2000a) Recent Research and Development Relating to Platform Requalification J.
OMAE, ASME, Vol. 122, New York, 20-32.
40
41
Acronyms
ALS - Accidental Collapse Limit State
API - American Petroleum Institute
FDF Fatigue Design Factor
(to multiply with the service life to get desired characteristic value of fatigue
life)
FLS - Fatigue Limit State
HOF - Human and Organizational Factors
HSE - Health and Safety Executive, UK
IMO - International Maritime Organization
ISO - International Standardization Organization
MMS-Mineral Management Services, USA
NPD - Norwegian Petroleum Directorate (now: Petroleum Safety Authority, Norway)
TLP - Tension Leg Platform
WOAD World Accident Data Bank, issued by Det Norske Veritas
42