486 PDF

Workshop proceedings
Reliability of offshore structures—

Current design and potential
inconsistencies
OGP Report No. 486
March 2014
International Association of Oil and Gas Producers

Publications
Global experience
The International Association of Oil and gas Producers has access to a wealth of technical knowledge and
experience with its members operating around the world in many different terrains. We collate and distil
this valuable knowledge for the industry to use as guidelines for good practice by individual members.
Consistent high quality database and guidelines
Our overall aim is to ensure a consistent approach to training, management and best practice
throughout the world. The oil and gas exploration and production industry recognises the need to
develop consistent databases and records in certain fields. The OGP’s members are encouraged to
use the guidelines as a starting point for their operations or to supplement their own policies and
regulations which may apply locally.
Internationally recognised source of industry information
Many of our guidelines have been recognised and used by international authorities and safety and
environmental bodies. Requests come from governments and non-government organisations around the
world as well as from non-member companies.
Disclaimer
Whilst every effort has been made to ensure the accuracy of the information contained in this publication, neither the
OGP nor any of its members past present or future warrants its accuracy or will, regardless of its or their negligence, assume
liability for any foreseeable or unforeseeable use made thereof, which liability is hereby excluded. Consequently, such use
is at the recipient’s own risk on the basis that any use by the recipient constitutes agreement to the terms of this disclaimer.
The recipient is obliged to inform any subsequent recipient of such terms.
Copyright notice
The contents of these pages are © The International Association of Oil and Gas Producers. Permission is given to
reproduce this report in whole or in part provided (i) that the copyright of OGP and (ii) the source are acknowledged.
All other rights are reserved. Any other use requires the prior written permission of the OGP.
These Terms and Conditions shall be governed by and construed in accordance with the laws of England and Wales.
Disputes arising here from shall be exclusively subject to the jurisdiction of the courts of England and Wales.
Workshop proceedings
Reliability of offshore structures—

Current design and potential
inconsistencies
OGP Report No. 486
March 2014
Revision history
Version Date Amendments
1 March 2014 First issued
Acknowledgements
This document was produced by the OGP Standards Committee (Offshore Structures Sub-committee).
Note to the user
This report summarises the proceedings of a conference organised by OGP and held in December
2012. The views expressed in the paper were drafted to provoke debate at the event. They are the view
of individuals and are neither those of OGP nor of its member companies.”
Images
Images in this report are reproduced directly from presentations given at the workshop, they remain
copyright of their authors. Resolutions are un-avoidably lower than print standards.
ii © OGP
Reliability of offshore structures
Contents
Acknowledgements ii
1. Summary 1
2. Overview of structural reliability 8
2.1 Presentations 8
2.2 Corporate risk management 8
2.3 Hazard curves 10
2.4 Global design Standards for offshore structures 11
2.5 Previous industry initiative on structural reliability 15
3. Fixed steel jacket structures 16
3.1 Presentations 16
3.2 Reliability of fixed structures 16
3.3 Critique of hazard curves for fixed steel jacket platforms 20
3.4 Application of design Standards in Azerbaijan 22
3.5 Specific issues for fixed steel platforms 23
4. Arctic Structures 29
4.2 Reliability of arctic structures 29
4-3 Issues in current Standards for arctic structures 30
5. Metocean 32
5.2 Metocean standards 32
5.3 Directional criteria 33
6. Seismic 36
6.2 Seismic standards 36
6.3 Application of seismic criteria 37
7. Foundations 39
7.2 Platform and foundation behaviour in cyclone events 39
© OGP iii
8. Drilling structures including jack-up and MOU 43
8.2 Jack-up and mobile offshore unit (MOU) Standards 43
8.3 Reliability of drilling units 43
9. Floating structures and marine operations 48
9.2 Floating structures standards 48
9.3 Metocean criteria for floating structures 49
9.4 Marine operations 50
9.5 The role and responsibilities of class societies 50
10. Moorings and risers 52
10.2 Mooring standards 52
10.3 Reliability of mooring systems 53
10.4 Standards and reliability of riser systems 55
11. List of referenced codes and standards 58
Appendix A: List of conference attendees 60
Appendix B: 1995 Structural reliability conference—summary notes 61
iv © OGP
1. Summary
This report summarises the presentations and discussions of the first OGP Offshore Structural
Reliability Conference held in London in December 2012. Copies of the agenda and presentation
material are held on the OGP website at: http://info.ogp.org.uk/standards/1212London/index.html.
In December 2012 around 100 industry experts attended the three-day BP sponsored OGP Offshore
Structural Reliability Conference at Twickenham Stadium, London (see Appendix A). The last similar
international gathering of the offshore structures community in 1995 set the agenda for the further
development and publication of global structural standards for the oil and gas industries (see Appendix B).
The objective of this 2012 conference was to review the current reliability achieved by the industry and
assess knowledge gaps for a wide range of offshore structure types, including:
• fixed steel jackets, from large manned platforms to small unmanned wellhead platforms
• floating production units such as FPSOs, semi-submersibles, spars, TLPs
• drilling and other temporary units such as jack-ups, MOUs, floatels.
• arctic platforms
Short presentations were used to initiate discussion within each of the ten sessions. One of the
reported success factors for the conference was to include experts from disciplines interfacing with
structural engineers, such as metocean, seismic, foundations, drilling, marine, moorings and risers;
and to attract attendees with their respective perspectives from five continents.
In general, the published factors of safety in standards and their associated implicit probabilities of
failure are based on industry expertise iterated over many decades of experience and supplemented by
a range of tools including risk and reliability analyses. Only for some highly focussed applications have
safety factors been directly calibrated to specific target probabilities, with their inherent modelling
uncertainties. These are considered to be reasonably in-balance with other society accepted risks and also
to be in-balance with non-structural design and operational risks in the offshore oil and gas industry.
It was recognised that increasing deep discipline specialism, a generational change in the offshore
structures workforce, and the use of high-capability single source software brings challenges at
interfaces between disciplines, in knowledge transfer, and in assuring analysis results.
Philip Smedley of BP summed-up the conference by recognising that structural failures can be
very high consequence events, as sadly seen in the loss of life associated with four floating platform
failures in the 1980s. The strong cross-industry response to these events and close working relationship
between structural standards committees was highlighted as an important contributing factor to the
good safety record currently associated with modern offshore structures.
The Conference concluded with Ward Turner of ExxonMobil and Richard Snell, retired BP
engineer, drawing together the main findings from the three days of discussions.
The following collations of notional minimal and/or ‘typical’ structural reliability are generally based
on design criteria alone and were gathered in the final close-out session of the conference. It should
be cautioned that these estimates are based on the opinions of the experts in this conference close-out
session, where available supplemented by specific standards or reliability-based studies, for a limited
range of platform types, in a limited number of regions, primarily US Gulf of Mexico (GOM/GoM)
and European North Sea.
Opinions differed as to how much the offshore structural industry should reflect notional target
reliabilities, although it was generally agreed that where such reliabilities are used they should be for
calibration of safety factors in standards rather than allow stakeholders to ‘prove’ in a bespoke manner
that their specific asset has a calculated minimum probability of failure.
© OGP 1
These values should not be quoted as minimal or typical probabilities of failure without reference to
the context of their derivation and the respective assumptions and uncertainties therein.
NOTIONAL ESTIMATED FOR PER ANNUM PROBABILITY OF FAILURE

EXPOSURE LEVEL L1 - OTHER PLATFORM TYPES (AS CURRENTLY DEFINED IN ISO)
Non-cyclonic region— Cyclonic region—evacuated— Other regions/comments

Permanently manned US Gulf of Mexico
Ultimate Limit State—ULS

First component ~1 × 10 -4 First component ~4 × 10 -4 ISO member & joint checks
[for context consult proceedings of [for context consult section 3.2 and typically 10–20% higher than API.
1995 conference (Annex B of this related presentations as well as Other regions likely to lie between
report)] Annex B] 1 × 10 -4 and 4 × 10 -4 depending
upon which Standard applied.
[for context consult section 2.4 and
related presentations]
n.b. Appurtenances in wave action zone including caissons, boat impact
framing, etc are liable to fail at higher probability levels.
Collapse ~3 × 10 -5 Collapse <1 × 10 -4
[For context consult section 3.2 and [for context consult Annex B]
Accidental/Abnormal Limit State—ALS (non-ice)
Collapse* <3 × 10 -5
Collapse* ~5 × 10 -4 *Provided no wave on deck due to
Hazard curve low slope so ULS 2000 year return period old/poor air gap design or platform
dominated subsidence
Non-robust design, e.g. K braced
[For context consult section 3.2 and Other regions: Collapse* <1/ALS
[For context consult section 3.2 and
related presentations] return period.
ALS design check based on safety
Collapse* ~1 × 10 -4
factors of 1.0 applied to some
Robust design, e.g. X braced characteristic variables.
[for context consult Annex B]
Hazard curve high slope so ALS
dominated
[For context consult section 3.5.3
and related presentations]
Accidental/Abnormal Limit State—ALS (Arctic Ice)
Collapse ~1 × 10 -5
Not applicable in cyclonic regions Factors of safety in ISO 19906
Collapse <1 × 10 -4 specifically derived to achieve these
specified probability of failure
[For context consult section 4.2 and
levels.
Foundations
Modest lower probability of failure in foundation than jacket is predicted, Site specific means boring data
provided site specific soil data has been employed in design obtained at a location in close
[For context consult section 7.2 and related presentations] proximity to the installation. In
addition, access to pile driving
records can reduce uncertainty in
foundation probability of failure.
2 © OGP

Seismic
Seismic Region 4: Collapse <4 × 10 -4
ALE=2,500yr return period event,
Collapse ~1.9 × 10 -4 to 2.5 × 10 -4 but typically this relates to
(e.g. Pacific rim, Indonesia) probability of around 1/4000 yr to
1/5300 yr
[For context consult section 6 and related presentations]
Seismic Region 3: Collapse ~1.5 × 10-4
(e.g. West Indies, Turkey)
[by interpolation]
Seismic Region 0 to 2: Collapse <1 × 10 -4
(e.g. GoM, North Sea, Brazil, West Africa, Australia)
[For context consult section 6 and related presentations]
Fatigue Limit State—FLS
Despite good intention there was little data presented on component or Normative and informative tables
system degradation leading to failure (except for mooring systems). Fatigue with fatigue safety factors in the
cracks can generally be managed, while more severe loss of connectivity is range 2.0 to 10.0 are creeping into
perceived to be relatively rare. Standards. It was perceived that
The exceptions being in the wave action zone, i.e. conductor guide frame, these were probably derived in a
appurtenances, caissons, clamps, boat impact framing, etc, failure of which manner consistent with other
was perceived as not uncommon. structural risks. However, applying
these factors to generally very
conservative fatigue calculation
methodologies may lead to
probabilities of failure for primary
members and joints well below
other limit states.
Fixed concrete structures Comments
First Component: Concrete structures were not
Rebar ~10 -4 to 10 -5 discussed at this conference and
Concrete ~10 -5 to 10 -6 therefore the notional reliability
values from 1995 have been
Foundation ~1 × 10 -4
reproduced unchanged.
System failure is perceived as being two orders of magnitude lower,
i.e. System collapse ~1 × 10 -6
[For context consult Annex B]
Jack-ups Comments
Foundation Collapse <1 × 10 -3
Structural Collapse similar magnitude to that for non-robust
configuration fixed steel jacket structure.
[For context consult section 8.2 and related presentations]
Floating Production Units and MOU—Vessel Comments
Offshore structure based on Class Rules. Need Classification Society Does seismic risk for production
advice on perceived reliability if vessel designed and operated to Class. platforms need to be considered too?
A notional component strength 10-3 was quoted in the absence of any new data.
n.b. component failure rates in range 10-3 to 10-4 were estimated for
production semis and TLPs in 1995 conference (Annex B).
Hull girder perceived as low probability of failure.
Fatigue and corrosion are significant issues that need to be appropriately managed.
© OGP 3

Floating Production Units and MOU—moorings Comments

MOU mobile moorings—strength: Too many MOU mooring failures
10yr criteria: One line failure ~7 × 10 System failure ~4 × 10
-2 -2 are perceived to be occurring.
However increasing the design safety
25yr criteria: One line failure ~1 × 10 -2 System failure ~7 × 10 -3
factors and/or return period design
50yr criteria: One line failure ~4 × 10 -3 System failure ~2 × 10 -3 criteria in isolation may not improve
100yr criteria: One line failure ~ 2 × 10 -4 System failure ~9 × 10 -5 reliability to the level predicted.
(GoM API RP 2SK study)
[For context consult section 8.2 and related presentations]
MOU mobile moorings—fatigue and anchoring:
No data presented.
Production permanent moorings—strength: Further work is required to establish
DNV Posmoor: Failure ~10 -4 if this value relates to first failure or
system failure, and also to locate
For context consult section 10.2 and associated presentations]
similar probabilities in
API RP 2SK/ISO 19901-7
Production permanent moorings—fatigue: The SN fatigue approach is based on
SN DNV & ISO inf.: One line failure ~10 -3 DNV Deepmoor calibration in
1998, while the TN fatigue
System failure ~ 10 -5
approach was verified by API RP
TN API & ISO norm.: One line failure ~1 × 10 -4 2SK Work Group in March 2003.
Actual failure rate data reported (over last decade): ISO 19901-7 recommends the TN
approach in its normative text but
One line failure ~2 × 10 -2
alternatively permits the SN
System failure ~3 × 10 -3 approach in the informative annex.
(n.b. majority of mooring line failures are non-design, i.e. poor construction, In some cases, higher factors of
damage during installation, or inappropriate operation). safety have been perceived to add
[For context consult section 10.2 and associated presentations] complexity and risk to fabrication
and handling.
Production permanent moorings—anchoring
Few, if any, failures of anchoring systems reported. Perceived to be low
probability of failure but not sufficiently quantified to warrant reduction in
safety factors.
[For context consult section 10.2 and associated presentations]
TLP tendons:
Not specifically addressed, but 1995 conference considered a component
failure probability of 10 -4 to 10 -5
This reliability level is now perceived to be possibly optimistic.
[For context please consult Annex B]
Floating Production Units and MOU—risers Comments
Very limited data around riser reliability. A desire to integrate the riser
Leak failure rates in the range 5 × 10 -3 to 1 × 10 -4 per riser per year are community into the offshore
suggested to initiate further discussion and studies structure community’s risk and
reliability assessments was
[For context consult section 10.4 and associated presentations]
encouraged.
4 © OGP
The following studies are on-going or have been suggested for collaborative investigation:
Standards Bodies
1) API and ISO to seek to maintain the one-to-one relationship and equivalent scopes between
their respective structural standards.
2) Standards bodies to continue to subdivide the larger standards into smaller sub-standards where
considered appropriate.
3) Standards bodies to review their requirements and challenge whether these should be
requirements or recommendations, particularly when applied to smaller unmanned structures.
4) Standards bodies to give consideration to improving the management of change process
around updating their Standards so negative unintended consequences are avoided. Can a set
of structural models be maintained and the effect of changes in Standard quantified before
updated editions of Standards are published?
5) Standards bodies’ expert drafting committees to further consider usability and simplify
language where possible.
6) ISO 19900 committee to review ISO 2394 (1998) and any on-going update to confirm whether
ISO 19900 is in conformance with the principles specified therein and the standing of any
quantified probabilities of failure quoted.
7) Standards bodies to continue to work in parallel for a set of common exposure level definitions,
or agree to remove or simplify this philosophy. This should include specific consideration of
structures unmanned during cyclone events.
8) 8API RP 2GEN Taskforce to continue to seek greater clarity and consistency in performance
level definitions between structural components and systems. When appropriate the API
Taskforce to seek international expert input into their work.
9) Standards bodies to consider improving the guidance around robustness and potential cost-
benefit of designing and building robustness into offshore structures.
10) Standards bodies to continue to develop design and assessment criteria for temporary structures,
in particular those that are in operation for a prolonged period but only at one specific site for a
relatively short period.
11) Standards bodies to increase awareness of the potentially high business risk associated with
major topside appurtenances and recommend guidance documents that may improve structural
reliability of such appurtenances.
12) API to continue comparison analyses between API RP 2A LRFD and ISO 19902 Standards and
share the conclusions of this work with the international community at an appropriate time.
13) API to consider revising the calibration studies performed by Fred Moses given the substantial
changes in load and resistance modelling that has taken place since the original work was published.
14) Fixed steel structure committees to address the joint check requirements concerning brace
strength and amend or clarify the design requirement.
15) Fixed steel structure standards bodies to consider the learnings from recent monopole failures
in their requirements for grouted connections, particularly differences between multi-leg jacket
pile grouted connections and larger diameter monopile caisson structure grouted connections.
16) Metocean standards bodies to consider seeking representative regional criteria with return
periods greater than 100 years to help quantify regional hazard curve.
© OGP 5
17) ISO to clarify the interface between TC 67/SC 7 Arctic structures and the new ISO committee
TC 67/SC 8 Arctic operations.
18) Arctic standards bodies to embrace the recommendations of the Barents 2020 project.
19) Arctic and Seismic standards bodies to clarify whether ice and seismic actions can be considered
independent and the potential inclusion of ice mass in determining platform response in a
seismic event.
20) Seismic standards bodies to capture some of the informative background to justify the specified
seismic event return periods and what these may imply in terms of the relationship between
return period and probability of structural collapse if applied to offshore structures.
21) Foundation standards bodies to consider whether the resistance factors should differentiate soil
types (sand and clay) and account for whether site specific soil samples were applied.
22) Foundations standards bodies to consider whether further informative guidance should be
provided for assisting with the best estimate assessment of foundation strength in structural
reliability assessments.
23) Stationkeeping standards bodies to seek improved reliability in mooring systems and thruster
assisted moorings by sharing lessons from failures and reliability based assessment studies from
both MOU and production platform communities.
24) Stationkeeping standards bodies, Classification Societies and operators to seek to converge their
respective requirements for stationkeeping systems.
25) Stationkeeping standards bodies to revisit their required minimum return periods for MOUs.
OGP or other industry representative organisations

26) OGP or other organisation to investigate whether the offshore industry considers it feasible
and desirable to develop and publish tables of recommended bias and coefficients of variation
(COVs) for use in structural reliability analyses.
27) OGP or other organisation to investigate whether it is feasible to draw rational conclusions
from global offshore structural data about typical probabilities of failure for structural
components and systems.
28) OGP or other organisation to develop and publish regional hazard curves for environmental
and seismic criteria for the main structural types with clear specification of the underlying
assumptions, limitations and learnings from these curves. Guidance on the derivation of
platform specific hazard curves to be included in the study.
29) OGP or other organisation to collate and perform industry review of published fatigue factors
of safety and associated probabilities of failure on component and system bases.
30) OGP or other organisations to gather and publish data on inspection probability of
detection ranges.
31) OGP Structures and Metocean committees to form a joint task group to review the recent
work on directional criteria and publish a recommended approach for applying direction
environmental criteria in structural design and assessment.
32) Classification Societies to communicate with the oil and gas industry possibly via OGP over the
basis for their Class Rules for floating offshore installations so operators can determine rational
reliability levels in their marine risk matrices.
33) OGP or other organisation to host similar structural reliability conferences and in particular
ensure representatives from outside the core structural discipline are invited to give their latest
thinking and understanding of data they receive and supply from/to structural engineers.
6 © OGP
Industry in general or specific organisations

34) Industry to be more proactive in providing feedback from general use of standards and from
in-depth assessments of structural reliability to standards committees.
35) Industry, through OGP or other organisations, to promote and share the findings from large
testing and/or analysis JIPs once outside confidentiality restrictions, and collate priorities for
possible future JIPs.
36) Industry to seek ways to consistently verify design and assessment computational tools and user
competence.
37) Operators and designers to note that competence in arctic environments cannot be easily
extrapolated from expertise in non-arctic environments.
38) Stationkeeping community to continue the OGP initiative to share information on mooring
incidents and associated reliability of stationkeeping systems.
39) Riser community to seek ways to share information on riser incidents and associated reliability
of riser systems, possibly via OGP Structures Subcommittee which now includes riser systems
in its Terms of Reference.
40) Shell to publicise their proposed JIP for testing retrieved North Sea jacket components.
41) DNV to publicise their proposed JIP for wellhead fatigue and raise awareness of the operational
consequences of increased BOP weight on fatigue requirements for drilling.
© OGP 7
2. Overview of structural reliability
2.1 Presentations
The initial sessions that set the scene for the conference were co-chaired by Philip Smedley, BP
and Ward Turner, ExxonMobil.
PRESENTATION PRESENTER
Welcome and introduction Philip Smedley, BP
Keynote speech: Integration of structural reliability into corporate risk Ward Turner, ExxonMobil
ISO base requirements Tom Brown, University of Calgary
API ubcommittee 2 (SC2) offshore structure standards Andrea Mangiavacchi, Experia
Comparison of API, ISO and NORSOK offshore structural standards Gunnar Solland, DNV
Reflections from 1995 structural reliability workshop Richard Snell, Consultant
API SC2 latest thinking on structural reliability David Knoll, Shell
2.2 Corporate risk management
Structural reliability is an integral part of the corporate risk management process.

Within his keynote presentation, Ward Turner introduced the widely used risk matrix that is
employed by many operators to quantify and mitigate the hazards to which facilities could be exposed
during their lifetime. An example risk matrix is presented in Figure 2.1.
The axes of these risk matrices are based on:
1) a measure of the likelihood or probability of an event occurring (e.g. structural collapse)
2) a measure of the consequence of such an event occurring, which may be separated into
consequences and hence risks classified in terms of life-safety, environmental impact and
business impact (financial and public perception)
The risk level then being ranked ‘high’ for high likelihood and high consequence events and ranked
‘low’ for low likelihood and low consequence events.
Catastrophic structural failure tends to be perceived as relatively low likelihood but potentially
high consequence risk (especially on large manned platforms), but is just one of the multitude
of risks that the operatorwill consider and seek to quantify throughout the full life-cycle of the
facility. It is therefore considered essential that structural engineers are able to communicate risk
associated with their discipline, in particular when engaging with engineers and managers from
outside their discipline.
Over the last few decades there have been few instances of major structural failure in the offshore oil
and gas industry. Consequently, data to quantify the risk of structural failure is sparse, particularly
for low likelihood catastrophic system failures and therefore, to a large degree, risk assessment relies
on analytical reliability assessments and engineering expert judgement. Furthermore, published
data tends to be more extensive for MODU (mobile offshore drilling units) type facilities or for
production units design to now out-of-date design criteria, which represent only a fraction of the
assets currently in operation.
In terms of likelihood of failure, risk matrices tend to classify the risk by order of magnitude (i.e. 10−1,
10−2 , 10−3,..., per annum or per operating life, etc). Ward Turner recommended that the uncertainty
in estimating likelihood of a specific defined event occurring should be considered in terms of at least
one order of magnitude either side of the best estimate of likelihood.
8 © OGP
Figure 2.1: Example Risk Matrix with arrow indicating desire to reduce risk from high level to lower level
(Ward Turner presentation slide 3)
Due to established industry design processes, different reliability values exist for different types of
structural systems and locales. While being a fact, this is not necessarily a bad thing provided mini-
mum reliability expectations are met. The operatormay then seek to further reduce risk on a cost-
benefit or ALARP (As Low As Reasonably Practicable) basis.
Ward Turner considered that adjusting well established industry design recipes to meet nominal
target reliability expectations would likely set bad precedents for the industry.
Estimates of probability of failure are a result of the implicit and explicit design requirements (i.e.
the design recipe), although Philip Smedley reminded delegates that structural reliability is more
than just a design safety factor. Specifications, recommendations, or lack of clarify in the design
codes can impact analysis philosophies, assumptions, methodologies and also impact buildability,
maintainability and operability. The design probability of failure and consequence of failure can
also be shifted positively or negatively by behaviours in construction, installation, operation and
decommissioning phases.
Richard Bamford of BP initiated a discussion around the benefit of a target risk given the concerns
around specifying a target reliability, however, Ward Turner noted that some of the same concerns
around inadequate estimation of probability of failure remain.
Ward Turner suggested that it is generally accepted that in the US meeting company standards and
industry standards meets the intent of the ALARP principle.
Richard Potter, UK HSE and Gerhard Ersdal, Norwegian Petroleum Safety Authority (PSA)
introduced themselves. Gerhard Ersdal reported that Norwegian regulations require an ALARP
approach to be adopted and that in Norway it may not be sufficient to purely design to minimum
code requirements. Richard Potter echoed that statement. Richard Potter emphasised the UK HSE
focuses on life-safety and the need for robust barriers given the significant potential for loss of life
should a platform failure occur. He also emphasised the importance of standards as the starting point.
John Stiff, ABS Consulting, reminded delegated that as structural engineers discussing standards we
need to expand our thinking beyond the direct risk to the structural components and system and in
particular consider how operational risk may be affected, for example higher air gap reduces risk of
very rare event wave load on deck, but adds risk to everyday crane operations.
© OGP 9
2.3 Hazard curves
The hazard curve is a simple tool that is typically used in structural assessment to visually contrast
variations between regions based on their inherent characteristics. The environmental hazard curve,
illustrated in Figure 2.2, gives design force as function of return period (blue sloped lines in Fig. 2.2).
Ward Turner explained that most global standards have converged towards a reference design level
ultimate limit state (ULS) calculation based on a 100-year return period (10–2 p.a.) environmental
event. This loading or action will create a design force on the structure that will subsequently be
factored to an appropriate level. It has been found by collapse analysis modelling that the unfactored
reference design force can be increased by a factor of at least 1.8 (and in some dead load dominated
situations by a factor of over 3.0) before the structure collapses (red band in the Fig. 2.2).
The return period environmental event associated with the collapse load is not a constant, but depends
very much on the regional characteristics. Thus, in fetch limited conditions (e.g. the Caspian Sea) there
is little relative increase in the forces associated with the reference 100-year and for example 10000-
year return period events, while at the other extreme, in cyclone or ice regions the relative increase
in force between the same return period events is far larger. Thus, if a design code simply specifies
a simple return period for the rare abnormal or accidental type events, this may lead to substantial
differences in the facilities designed or, alternatively, if the same facility is located in different regions,
its likelihood of collapse will be very different. This variation can become more complex if different
consequences can arise from collapse (e.g. identical manned and unmanned facilities).
One way the hazard curve is used is to give an indication as to whether a facility is likely to be more
dependent on the ULS or ALS (accidental/abnormal limit state) design calculation, fatigue limit state
(FLS) being out with this tool.
Figure 2.2: Example hazard curve contrasting cyclonic and non-cyclonic regions
(Ward Turner presentation, slide 5)
Hugh Howells, 2H, questioned the common basis of 100-year ULS environmental conditions for
structures that may have been designed for 10 years’ operation but now have life extension to say 40
years. Tom Brown and Ward Turner replied, while agreeing that 100-year conditions have become
an accepted basis for ULS design, the risk approach is based on annualised probability of failure so
will capture changes in knowledge throughout the platform’s operational life.
10 © OGP
Jim Brekke of ABS commented that while the environmental hazard curve may be well understood
for US and European waters, other parts of the world may be less well quantified. Markku Santala
of Chevron concurred that regions with rare severe cyclones have a particularly large uncertainty that
needs to be addressed in the risk estimate, such as Gulf of Thailand, Trinidad, Brazil. He added that
globally, current measurements were also prone to high uncertainty.
Terry Rhodes of Shell noted the importance of fatigue in northern European waters, but that this
failure mode is not captured in the hazard curve tool. Dave Knoll replied that most platforms are
globally designed to ULS/ALS criteria and that fatigue is more of a local serviceability condition to be
met in association with other long term durability requirements.
2.4 Global design Standards for offshore structures
In his introduction, Philip Smedley reminded delegates that structural design and assessment
comprises a recipe consisting of many ‘ingredients’. With increasingly specialist deep discipline
knowledge there can be a tendency to focus one element in isolation without regard to the complete
system. In standards, whether global standards or corporate standards, there are risks in changing
the recipe in one clause without regard to the full suite of system requirements. Unfortunately, there
has rarely been the opportunity to benchmark proposed changes in design standards against existing
offshore structures before adoption of a new or updated standard. This can lead to unintended
consequences. He questioned whether a better management of change process should be sought in
line with most company procedures?
Tom Brown introduced ISO Standard: ISO 19900, which describes the basis for design within the
ISO series of standards for offshore structures, see Figure 2.3.
Figure 2.3: ISO 19900 suite of offshore structures Standards (n.b. similar standards exist in API SC2)
(Tom Brown presentation, slide 3)
© OGP 11
ISO 19900 and its companion structural standards are reported to have a basis in ISO 2394 (1998)
General principles on reliability for structures. ISO 2394 does not explicitly specify target levels of
reliability but does give an informative example where, if the consequences of failure are severe, the lifetime
probability of failure should vary between 10-3 and 10-5, depending on the costs of safety measures.
Paul Frieze subsequently queried the probability of failure figure in ISO 2394, and recalled that
the maximum probability of structural failure leading to a fatality is quoted as 1 × 10-6 p.a. Such a
probability being well below that within global standards for offshore structures.
It was concluded that ISO 2394, or parts thereof, should only be referenced where they are in
accordance with the intent of the ISO 19900 series of offshore structural standards. Normative target
reliability levels would be inappropriate irrespective of the value, while examples of typical structural
reliability levels achieved by other civil engineering facilities may be informative if presented as such.
The committee behind the ISO suite of offshore structural standards (ISO TC 67/SC 7) explicitly
agreed that target probabilities of failure should not be presented in normative text. The main
concern being that asset-specific sub-standard reliability analyses could be used to justify an otherwise
inadequate design. However, some informative text around the reliability of structures designed to
well-established codes and standards could be used to inform benchmarking/calibration exercises that
provide the basis for the published factors of safety in new standards. The maturity of the calibration
studies supporting the design standards varies significantly between the different types of offshore
structures and the predominant loading condition.
It was also remembered that the ISO 19900 suite of standards present minimum requirements, but
the owner/operatorcan choose more stringent criteria provided these lead to a reduction in risk.
The appropriate level of reliability and associated factors of safety depend on the exposure level
identified for the specific platform which is itself based on an assessment of life-safety consequence
and environmental/business consequence, see Figure 2.4. Three exposure level categories have been
specified: L1, L2, L3 although, to date, only the highest consequence category L1 has been explicitly
quantified in the platform-type specific ISO standards (19902 to 19906).
Figure 2.4: Exposure levels specified in ISO 19900

(Tom Brown presentation, slide 6)
Return periods for environmental events are specified to be typically of the order of 10-2 for ULS
design checks and in the range 10-3 to 10-4 for ALS design checks. The associated reliability is better
than the numbers associated with the hazard return periods due to the inclusion of design factors of
safety (typically 1.0 for ALS checks) and other conservative specifications in the design calculation,
e.g. use of minimum specified catalogue strength for steel.
The ISO standards prefer the use of partial action (load) factors and resistance factors, where the
design objective is that the sum of the effects of factored actions must remain less than the factored
resistance. In some instances a working (allowable) stress design (WSD) approach is still used.
12 © OGP
Andrea Mangiavacchi presented the API approach to offshore structures standards on behalf of
the API SC2 committee. The API standards, especially those relating to fixed steel jacket structures
(API RP2A) have a long and successful heritage based on considerable onshore and offshore expert
input, offshore experience in the Gulf of Mexico in particular, and from global incidents where
reliability has fallen short of industry and regulator expectations.
The evolution of the API suite of offshore structural standards has to some extent by iteration led to
design approaches that initially were considered appropriate for the USA and, with increasing global
use of the API standards, subsequently to other offshore oil and gas regions around the world.
While in many instances the API standards predate the equivalent ISO standards, API SC2 took a
major strategic decision in 2005 to “align and merge” API SC2 offshore structures documents with
corresponding ISO TC 67/SC 7 documents, with many US-based engineers supporting the technical
work of both API and ISO committees. Both API and ISO structures committees have sought to
have a one-to-one correspondence between specific Standards so that their scopes are very similar,
if not identical, and the design outcome will be similar, even if some detailed design aspects of the
respective standards differ.
The overarching design basis is contained in API RP 2GEN and has similar intent to ISO 19900.
There is a gradual move from WSD to partial load and resistance factor design in API but, again, the
long history and familiarity of users with traditional design formats means that any new format needs
to be introduced in a sensitive manner.
Dave Knoll presented some on-going thinking and discussion that is taking place within a specialist
task force behind the API RP 2GEN Standard. This task began in December 2010 and 10 meetings
have been held up to September 2012. While API RP 2GEN and ISO 19900 standards are similar in
intent there are differences in application (nomenclature) and these need to be better understood. In
addition, feedback to the use of these General Requirements Standards has identified some anomalies
and inconsistencies in application which need to be resolved.
Specific API taskforce objectives are to:
1) Create consistency among all ‘daughter’ standards residing below API RP 2GEN.
2) Clarify categorisation and design criteria of facilities, e.g. manned vs unmanned, operational
versus shut-in, restricted versus unrestricted operational criteria, based on economic cost-
benefit analysis.
3) Ensure consistency between floating and fixed structures.
Four performance levels are being considered based on design levels specified in the current API
standards, see Figure 2.5.
© OGP 13
Figure 2-5: API RP 2GEN Task Force on-going work on consistent performance levels
(Dave Knoll presentation, slide 6)
A matrix of design checks is being developed referencing one of these four performance levels. The
intent is to have a draft API taskforce report for industry review around the end of 1Q13.
The advantages of differing load factors for differing regions within the LRFD approach as opposed
to the WSD approach were highlighted by Nils Hellevig of Aker.
Don Smith, Eni, considered that standards failed to deliver a clear vision of intended level of safety.
Does the industry know what it is trying to deliver? Maybe for fixed steel structures where the load:
response behaviour is relatively linear, to some extent for jack-ups, but he considered that for floating
structures we remain a long way from a published understanding of safety and risk levels. Should we be
aiming for common levels of risk or reliability across structural types, and if so what sort of numbers
are we aiming for?
Richard Snell replied that standards always lag behind state of the art thinking due to the time taken
to develop, and the need for industry and sometimes global consensus. There remains a need to deliver
offshore structures that will work to acceptable performance standards, and associated design and
assessment requirements that are easy to understand and construct by engineers from a wide range of
expertise and cultures. Richard Snell reminded delegates that collating estimates of reliability levels
based on current design practices is one of the deliverables sought from this conference, see Section 1.
Philip Smedley added that usability of standards is an issue that should be addressed, the language in
ISO standards aims to be translatable into other languages without ambiguity, but a downside of this
ambition is that the underlying English text often uses terminology that is not in common usage. This
could lead to increased rather than reduced risk through user misinterpretation.
Hugh Howells presented the example of risers where the move to limit state design appeared to result
in an order of magnitude increase in the complexity in the design requirements.
Gunnar Solland presented a very brief summary of an extensive study carried out for Bureau of Ocean
Energy Management, Regulation, and Enforcement (BOEMRE) by DNV Houston comparing API,
ISO and NORSOK offshore structural standards.
www.bsee.gov/uploadedFiles/BSEE/Research_and_Training/Technology_Assessment_and_Research/AA%20
%20TAR%20677%20Code%20Comparison.pdf
14 © OGP
The objective of the study was to produce a comparison report identifying differences and
recommendations for application of structural design standards for typical platform types in the US
Gulf of Mexico and the US West Coast.
The study comprises two parts:
1) a review of the standards involved (15 main standards) presenting a qualitative comparison,; and
2) two case studies, one fixed steel platform and one floating spar platform in US waters.
The main findings were thate there is reasonably close correlation between API, ISO and Norsok
standards but that:
• Some jacket members and joint utilisations are lower in API than ISO and Norsok (by 10–20%).
• API gives significantly higher capacity for conical transitions than ISO and Norsok.
• Air gap requirements (Norsok) and ISO (recommendations) are more strict than in API.
• Requirements to existing structures are more relaxed in API than Norsok and less specific in ISO.
Philip Smedley concluded that while one common global standard has advantages, the current
parallel development of API, ISO, NORSOK and other specialist regional standards also has
advantages in terms of getting both deep local expertise and global perspectives and issues into
standards. ISO TC 67/SC 7 welcome the API SC2 initiative on improving terminology and
addressing anomalies, and while some on-going issues at the top management level in API and
ISO are currently limiting joint working groups, informal interface between engineers in the
respective committees remains strong. The intent to gradually converge the scope, safety margins,
and language in structural standards remained strong.
2.5 Previous industry initiative on structural reliability
Richard Snell, former chairman of ISO TC 67/SC 7, reflected that in 1995 the SC7 committee’s remit
was, and still is, to develop limit-state standards, based on current best practice, in an environment
where the state of the art did not include limit state formulations for some key structural forms.
Twenty five key industry experts gathered in 1995 to gain a quantified appreciation of the reliability
of the principal types of structure, given that the design heritage of the differing structural types was
itself very different, for example:
• Fixed steel jackets are generally oil industry specific structures.
• Concrete structure sare based on a mixture of oil industry and civil engineering.
• FPSO type floaters are primarily based on class rules for tankers developed over many years.
• Production semi-submersibles and jack-ups are based on smaller but similar drilling rigs.
• Moorings systems are based on a mixture of shipping and drilling experience, both involving
dry docking.
The main output from this 1995 conference was a collection of agreed notional (not actuarial)
probabilities of failure, with weighting towards components rather than systems, bottom founded
steel and concrete structures, drilling jack-ups rather than production floaters, and ULS rather than
ALS/FLS design situations. This allowed gaps and anomalies to be identified and worked upon over
the following years. A copy of the 1995 conference report is attached to this report as Appendix B.
It was a key overall conclusion that analysis procedures, methods and data have greater potential
to cause variability in reliability than differences between structural forms. The ability to express
language in a design guide in a manner that can be understood by a diverse range of engineers from
international counties and cultures was also considered to be highly important.
Richard Snell expressed the desire for similar output to be achieved from this 2012 conference.
© OGP 15
3. Fixed steel jacket structures
3.1 Presentations
The session covering fixed steel structures was co-chaired by Michel Birades, Total and Terry Rhodes, Shell.
Design requirements for jackets and topsides in ISO and API Moises Abraham, Chevron
Reliability and (re)assessment of fixed steel structures Mike Efthymiou, Shell
Environmental hazard curves— regional variations—ULS & ALS criteria Paul Frieze, PAFA Consulting
Use of ISO structural standards in Azerbaijan Chris Morris, BP
Contractor feedback on design standards:
–Jackets/topsides Mike Drabble, KBR
–Grouted connections Colin Billington, HELACOL
FLS and structural integrity management Pat O’Connor, BP
Assessment and life extension Ersdal Gerhard, PSA
3.2 Reliability of fixed structures
Moises Abraham reported that API RP 2A LRFD 1st Edition (1993) has now been withdrawn
and a modified version of ISO 19902 (2007) will be adopted for API RP 2A LRFD 2nd Edition.
An associated API Task Group started the work in 2009 and has now completed the review of 25
sections of ISO 19902. A code check comparison has been performed between API RP 2A LRFD and
ISO 19902, and API will fund analytical studies (platform utilisation check comparisons) starting
in early 2013 and lasting for two years. These studies will be performed by three contractors analysing
three platforms and, in addition, Chevron will run one additional platform analysis.
Results of a McDermott study on a 4-leg jacket in 274 ft (84 m) water depth between ISO 19902 and
API RP 2A WSD 21st edition was summarised:
1) Pile checks above mudline and member checks with no hydrostatic pressure—API very similar
ISO, with ISO utilisation ratios slightly higher utilisation.
2) Member checks with hydrostatic pressures ISO higher utilisation ratios at top of jacket and
API higher utilisation ratios at base of jacket possible due to different treatment of capped-end
forces. Hydrostatic pressure will dominate deep water jackets and compliant towers in LRFD
based code.
3) Joint checks— ISO higher utilisation ratios (10–20%)
4) ISO Section 14.3-13 controls the design of critical joints. The intent of the equation is to make
critical joints stronger than braces, but the effect may be too severe.
5) Fatigue design factors based on ISO inspectability and criticality.
Moises Abraham illustrated the work performed in the late 1980s by Fred Moses on component
reliability calibration to API RP 2A WSD 12th edition that formed the basis for the load and
resistance factors in API RP 2A LRFD 1st edition. This work was focussed on the structural forms
and environmental conditions in US Gulf of Mexico at the time.
The objective of Moses work was to derive load and resistance factors that provide a level of safety close
to current practice (WSD 12th edition) for each component design check.
16 © OGP
By carefully selecting load and resistance factors it was possible to achieve:

1) an averaged LRFD safety index similar to the average WSD safety index; and
2) a narrower spread of safety index in LRFD, see OTC paper #5699.
The outcome of this work is illustrated in Figure 3.1 by boxes representing the range of probabilities
of component failure likely by following API 2A WSD (12th Ed.) and by following API 2A LRFD
(1st Ed.).
It is important to note that these are lifetime (20 year) probabilities and not annual probabilities.
Figure 3.1: 20 year estimates of typical component failure, from Moses API LRFD calibration
(Moises Abraham presentation, slide 20)
Moses’ calibration work was extensively reviewed and discussed at the 1995 conference (Annex B).
While this 1995 review was not re-presented in 2012, it is important to note the range of safety index
values and associated probabilities of failure that were considered ‘typical’ in the 1995 study. These
were based on annualised probabilities from: Moses API LRFD work, New Wave work from the
North Sea, Changes in load criteria in API WSD in 19th and 20th editions, and the Draft load and
resistance factors in ISO 19902. All the aforementioned work was based on ULS environmental cases.
The 1995 headline ‘typical’ notional component reliability for joints and members was quoted to be
around 4 × 10-4 p.a. with a system jacket notional reliability around 1 × 10-4 p.a. based on a simple
model of system failure ≈component failure load × 20%. Refer to Appendix B for more detailed
discussion and the ranges around these headline reliability values.
Moises Abraham raised the following points for discussion:
1) Code check equations have evolved in recent years (i.e. tubular joint checks). Has this evolution
changed the validity of the load and resistance factors developed by Fred Moses et al. in the
1980s? Do we need to recalibrate? Richard Snell, consultant, noted the many changes in the
design recipe since this work was published and he felt that revisiting the calibration was a high
priority topic.
© OGP 17
2) Have the wind and wave probability distributions changed (mean and COV)? Should partial
action factors be revised to achieve the same performance levels? Paul Frieze reported that in
his experience, changing environmental parameters (means and COVs) will have negligible
effect on reliability index values.
3) Are code check comparisons between codes enough to validate and harmonise the standards?
4) How do we reconcile the tubular joint check differences between ISO and API?
5) Research work is now in progress to incorporate strength provisions of the new AISC
specification into offshore design practices. How do we reconcile the deck design approach in
API RP 2TOP and ISO 19901-3?
6) Target reliabilities for GoM offshore installations that are evacuated or unmanned during the
extreme cyclone (hurricane) events have negligible potential loss of life, and have been developed
by cost-benefit analysis. Do we need to revisit the API analyses and reassess target reliabilities?
Terry Rhodes reminded delegates of the recent relatively high loss of life and injury around
helicopter operations in the North Sea and the need to be aware that evacuation before a cyclone
event is not zero risk.
Philip Smedley considered the many publications considering the reliability of fixed steel structures
and how often the underlying probability distributions representing the key parameters were derived
independently by the authors. He asked whether it may be possible for expert consensus to lead to a
set of published recommended parametric probability distributions, so most studies could be based on
similar assumptions.
Mike Efthymiou presented work by Shell on structural reliability. He emphasised the good history of
minimal failures based on some 7,000 fixed steel platforms worldwide and possibly 160,000 platform-
years operation. Structural collapse had been limited to unmanned platforms, particularly in GoM
during cyclonic events (i.e. Hurricanes Katrina, Rita and Ike), generally due to underestimation in
long term extreme loads, and most collapsed platforms being built to long outdated design standards.
Assuming no manned platform collapse to date could suggest over 70,000 platform-years without
failure (Pf <1.5 × 10-5).
Jesper Tychsen of Maersk Oil was concerned that this assumption was too simplistic as the very rare
abnormal load storm event (say >1000-yr return period load) had not yet occurred. When such an
event does occur it could lead to the collapse of many platforms in the same event. He recommended
seeking a better way of capturing offshore experience than using ‘historic failure probability’, the
problem being that the historic failure probability as applied inherently assumes that events are
uncorrelated. In fact extreme wave loading will be highly correlated between platforms within the
same geographical area. From this it follows that the true failure probability likely will be (much?)
higher than the ‘historic failure probability’, provided these platforms have not experienced the rare
worst case storm events within the historic reference period.
Mike Efthymiou considered that the wave load design recipe, associated reliability, and push-over
analysis modelling techniques have been tested through GoM structural failures and non-failures, and
also through full scale platform monitoring. He considered that the outcome of the benchmarking to
recent cyclone failures indicated an API conservative design approach bias factor of around 6% to 9%,
i.e. platforms systems were around 6-9% stronger than best estimate from API design code.
In terms of system reliability, Mike Efthymiou reminded delegates of the exposure level classification
in ISO and API. The ISO exposure levels are reproduced in Figure 3.2. The most common structure
type are S3 Unmanned: over 4000 wellhead platforms worldwide, along with over 1500 simple
single caisson type platforms (mostly in GoM). The large normally manned drilling and production
18 © OGP
platforms (S1 & S2) are relatively few in number (maybe 1000) but in terms of asset value are very
important.
To date, the focus of global standards has tended to reflect the life-safety critical manned platforms
(S1) and therefore exposure level L1 platforms.
Mike Efthymiou argued that permanently manned L1 platforms need to be aligned with other risks to
offshore workers and also workers on other non-offshore oil and gas industrial facilities. Using North
Sea permanently manned platforms as an example, dovetailed risk with regulatory requirements for
storm risk and overall risk to personnel (e.g. Pf(storm) <10-4/yr, IRPA <10-3/yr, TRIF <10-3/yr). This
led to an estimated L1 (manned) extreme storm Pf ≈ 3 × 10-5 p.a. (Return period around 33,000 years).
This value is quoted in ISO 19902 (1st ed.), but as noted by Tom Brown, only in an indicative manner.
Figure 3-2: Fixed structure types for specific ISO exposure levels
(Mike Efthymiou presentation, slide 7)
For evacuated and unmanned platforms typical of the Gulf of Mexico, the cost-risk trade off can be
considered acceptable as collapse risk in this instance is not reflected in life-safety. However, such
risk is still politically sensitive and therefore it is still important that the model used to determine
reliability and associated factors of safety remain robust and calibrated from models and/or associated
notional estimates against real data. Mike Efthymiou argued that, depending upon the slope of
hazard curve, the design point for evacuated and unmanned platforms tends to be around 2000 years
return period (5 × 10-4 p.a.).
The values above along with other quoted notional reliability numbers in API and ISO are plotted on
Figure 3.3 based on shallow hazard curve slope representing North Sea environment and steep hazard
curve representing GoM environment.
© OGP 19
Figure 3.3: Efthymiou suggested reliabilities for manned (L1) and evacuated/unmanned platforms in
GoM (L2) plotted on hazard curve format (Mike Efthymiou presentation, slide 12)
Mike Efthymiou recommended that the current L1 categorisation for C1 high (environmental and
commercial) consequence, for both S2 evacuated and S3 unmanned (life-safety), should be reclassified
as “L1 (GOM)” or possibly downgrade to L2, thus recognising the cost-benefit basis for design
optimisation and risk mitigation in these instances.
Don Smith, Eni, noted that wellhead structures classified as unmanned, can have jack-ups working
over them for periods in excess of one year. Mike Efthymiou replied that such wellhead platforms
would be classified with exposure level L1.
Ramsey Frazer asked if Shell had also looked at wider range of risks than structural risks, e.g. the FM
risk. Mike Efthymiou replied that Shall have considered FN risks (cumulative frequency per annum
vs number of fatalities) based on an event with a large number of fatalities but not the full sliding scale
of possible FN events.
3.3 Critique of hazard curves for fixed steel jacket platforms
Paul Frieze presented hazard curves for fixed steel structures and insights he has gained during the
recent updates to ISO 19900.
Historically, hazard curves have usually been drawn as a linear straight line relationship between a
linear axis illustrating the hazard action and a logarithmic axis of the return period in years (Fig. 2.2).
More recently, the relationship was being presented as a curve with slope reducing over time (Fig. 3.3).
In Paul Frieze’s opinion the important parameter is the slope of the curve which gives a relative
measure of the difficulty of reducing a given risk, i.e. the greater the slope, the more challenging is the
hazard to mitigate. He sought explanation of the change from straight to curved slope, and felt that
in such a case it would seem more logical at least for North Sea cases to illustrate the curve increasing
with return period.
Paul Frieze considered that the hazard curves would be more representative if the accidental load was
included in the curve, i.e. wave in deck is roughly proportional to the cube of wave height. He added
that floating structures should be added to the hazard curves for fixed structures for comparison but
this rarely happens.
20 © OGP
Paul Frieze presented environmental hazard curves for fixed steel structures in the US Gulf of
Mexico (based on latest API RP 2MET criteria) and European Northern North Sea (NNS). NNS
seemed relatively linear from the limited data available (no published data in ISO 19901-1 greater
than 100 years), while GoM appeared non-linear curving down at long return periods with two
differing relationships at short and long return periods. For tubular column buckling, the hazard
curve for NNS and GoM become critical beyond approximately 10,000-year and 2,000-year return
periods, respectively. However, based on a reserve strength ratio (RSR) of 1.85 and taking real yield
strength approximately 10% greater than nominal and an 8% increase in code strength formulations
gives nominal RSR = 1.85 / (1.10 × 1.08) = 1.56 and lower return periods than the 10,000-yr and
2,000 -yr mentioned previously. Consequently, should the RSR be determined using nominal material
and component strengths than characteristic values?
Ward Turner, ExxonMobil, noted that return periods for most seismic events are well below some
of the aspirational periods quoted in standards. Paul Frieze recognised this with reference to Mike
Efthymiou’s Figure 3.3, but while considering the API/ISO seismic standards to be good, he felt that
energy absorption through plastic mechanisms needs to be better addressed.
Ramsey Frazer considered that there was confusion between mean RSRs and characteristic
RSRs as by sticking to mean values with appropriate COVs the appropriate reliability values will
automatically be derived, to which Paul Frieze concurred but noted that consistency and clarity
in methodology and reported reliabilities is required. Gunnar Solland, DNV, considered using
mean and COV was acceptable in reliability analysis but added that by using one RSR for all failure
modes then different probabilities of failure will be derived for each failure mode, so standards
should use lower fractiles on the resistance side of the calculation for each component so consistent
probabilities of failure are achieved.
Richard McKenna, consultant, reported that from his arctic experience of icebergs and sea
ice the associated hazard curve slope could cover the full range from severe seismic and moderate
environmental hazard curve slopes. Mike Efthymiou added that from Shell’s experience of severe
seismic events, icebergs may be more about ice management or disconnectable platforms, than design
to resist such high hazard slope events.
Mike Efthymiou commented on the change from linear to curved hazard curves, reminding delegates
that those presented are representative curves for a region—not a specific installation. The danger of
illustrating the hazard curve as a straight line is that extrapolation beyond knowledge is more likely. In
addition in fetch limited regions the hazard curves have been shown to flatten at long return periods.
Andre van der Stap, Shell, expected there to be a substantial step change increase in force when the
wave impacts the deck (force ∝ Hs3). Paul Frieze agreed but noted that there will be a change of
slope rather than step change as the amount of deck area impacted gradually increases. This differs
to greenwater on floaters where there is a step change from no greenwater to a mass of water on deck.
John Waegter of Ramboll expressed concern over limitations in hazard curve. In particular, he noted
that they typically focus on base shear failure and ignore overturning moment, and can only capture
global response. He added that there must be a significant change in slope when the wave hits deck but
this is rarely captured, for example for a monotower, the hazard curve represents the slender column
but not the relatively massive upper part of the structure that can also be subject to environmental
loading. As the shape of the wave changes with return period, he prefers discussing ULS and ALS
design points and comparing rather than interpolating/extrapolating a hazard ‘curve’ beyond these
two points of knowledge.
© OGP 21
Michel Birades provided an example of hazard curves for some 20 Total platforms in the Gulf
of Guinea, which gave differing hazard curve and differing safety margins. Importantly the
correspondence between wave height and base shear ranged from Hmax1.0 to Hmax1.2 to Hmax2.5.
Mike Efthymiou agreed that it was better for a specific platform or specific stick model to iterate the
wave height and take the force on the platform directly from analysis or model testing. John Waegter
agreed that the regional hazard curves can convey an idea but for specific platforms they are inadequate
without following the proposal of Mike Efthymiou to obtain real rather than notional probabilities
of failure. Jesper Tychsen of Maersk Oil reminded delegates that from the platform’s perspective we
are interested in the load on the platform rather than the wave height.
Paul Frieze added that the hazard curve for floaters in the North Sea is very flat in terms of the
10,000 year wave, so why should we bother to check this ALS case? However the 10-4 p.a. floater
response event may be very different. It can depend very much on whether the wave hits the deck as for
fixed platforms—maybe all that matters is whether the wave hits the deck which will be represented
on platform specific hazard curves accounting for all response characteristic, e.g. energy absorption.
Mike Efthymiou concluded that the floater hull is an inertia dominated structure so very flat
response (as long as no wave on deck) whereas the moorings are nonlinear so the ALS check should be
performed as this loadcase can become critical especially in cyclonic regions.
3.4 Application of design Standards in Azerbaijan
Chris Morris presented a summary of BP’s application of standards to the Caspian Sea offshore
Azerbaijan. He noted that this region as an inland sea with limited fetch has a relatively benign
environment but comprises a series of platforms in seismic environment Zone 3. Therefore there
could be over 1000 people offshore in close locality should a significant seismic event occur, not far
offshore from where emergency and engineering support is also based and equally vulnerable to the
same seismic event.
A standardised approach had been used for jacket platform design over the last 10–15 years based on
API RP 2A LRFD but once this became withdrawn this presented a problem as ISO 19902 lacked
industry validation. Working with the design contractor, KBR, highlighted some weight increases
using 19902 that were particularly important in the Caspian since launch weight is a highly critical
design parameter. Moving to a new unfamiliar design standard led to some new requirements
that in some instances lacked clarity—particularly short duration load-out, transportation and
installation phases.
The Shah Deniz platform is a TPG500 life of field jack-up that was successfully designed to a
combination of API RP 2A LRFD and SNAME 5-5A. It was being validated against ISO 19905-1.
Chris Morris confirmed that the large size of the ISO 19902 Standard was a deterrent to non-native
English speakers, in particular and, consequently, he recommended that the Structural Integrity
Management section should be moved to separate standards. Terry Rhodes concurred that many of
the standards were not particularly user-friendly.
He also requested greater clarity around the design and operation of temporary structures in seismic
events, for example, does a wireline mast that will be in use for two weeks need a seismic assessment?
Initial expectation may be no, but the same equipment will be moved between platforms and therefore
could be in use 6 months every year.
Paul Frieze asked what national standard would be used in association with the topside design
standard, ISO 19901 3. Chris Morris replied that it would be desirable in the long term to develop an
Azerbaijan regional annex to ISO 19901-3 but currently the AISC standard is used.
22 © OGP
3.5 Specific issues for fixed steel platforms
3.5.1 Joint checks
Following on from the Azerbaijan case study presented by Chris Morris, Mike Drabble noted that
KBR had identified a number of issues in need of clarification in the design standards that he had
submitted to the appropriate technical committee.
In his short presentation he specifically wanted to highlight the issue of joint capacity where
ISO 19902 differed to the previously applied API RP 2A LRFD Standard (see Moises Abraham’s
presentation), and asked if he had been correctly interpreting the minimum joint strength
requirements.
API had a minimum joint strength rule that equates to 50% of the brace capacity, but for structures
subject to seismic load this is increased to 100%. ISO 19902 states that critical joints should not fail
before brace failure. In ISO 19902, critical joints are defined as those that either:
• influence the reserve strength of the structure,
• influence the response of a structure when subjected to accidental events, or
• cause significant safety or environmental consequences if they fail.
Mike Drabble considered it reasonable to infer from the above there are no critical joints for non-
operational cases (e.g. loadout, transportation, lift/launch and on-bottom stability), because load
levels are relatively low and joint failure will not result in pollution or loss of life. The latest edition of
API RP 2A WSD commentary now has a similar statement.
The resulting modification factor on brace utilisation can become very large especially at low brace
utilisations. ‘Non-critical joints’ can still pass the utilisation check, but when termed ‘critical joints’
they fail with large utilisation ratios because the critical loadcases change. If checked with same
loadcase as for the non-critical joint check, then utilisation ratios become smaller but the standards do
not state that option is acceptable.
Mike Drabble suggested applying a cut-off in the brace utilisation where the brace is under relatively
low load as it seemed illogical to be adding considerable steel weight into the jacket by thickening these
joints when there is a large reserve capacity anyway.
Michel Birades wondered if this was a mistake in ISO, but was not comfortable with the alternative
cut-off as it was not completely logical. Mike Drabble preferred an alternative DNV approach, but
recognised that it is not necessarily best approach. The issue needs to be thought about.
Moises Abraham noted that the API RP 2A WSD 19th Edition was based on simple joint geometry.
Subsequent versions of API RP 2A WSD have been based on joint capacity. He agreed that the
required assessment methodology was open to some interpretation but cautioned that as experience
does not suggest any joint failures we should not change to an alternative formula unless it can be
shown to be a better requirement. Mike Drabble stated that he was running a 10,000-step time series
for seismic configurations each requiring a code check. In this case, he cannot rigorously follow ISO
requirements as they are written as such an approach would be unworkable. Andrea Mangiavacchi,
consultant, added that API wording was different to ISO, but ended up with similar problem to
ISO. Every attempt for wording that would prevent brace failure before joint failure has led to a new
problem. Consequently, some more in-depth thinking is required to achieve a robust outcome that
covers all possible situations.
© OGP 23
3.5.2 Grouted connections
Colin Billington addressed failures of large diameter grouted connections in monopile supported
offshore wind farms and the implications for Section 15 of ISO 19902 concerning grouted joints.
Wind turbine monopiles are large diameter, typically 5 m, have a relatively thin pile and grouted annulus
giving a high diameter to thickness (D/t) ratio, low radial stiffness, low bending stiffness giving cross
sectional distortion, and relatively high strength grout, typically 120–170MPa. Importantly, wind
monopiles have low axial load but high cyclic reversed bending fatigue. There is also a size effect with
significantly reduced strength for connections without shear keys due to the non-scaling of surface
roughness which is the primary source of strength of such connections.
Many of these characteristics are outside ISO 19902 range of applicability, but ISO 19902 is still being
applied, as is DNV OS J101 which may give sufficient axial strength without the need for steel-grout
interface shear keys, in fact there is a warning that shear keys could cause fatigue problems. ISO 19902
places a limit on D/t but not on size (D) so it is possible to design a large diameter connection within
the stated ranges of application of ISO 19902 which would fail under axial load. This needs to be
addressed urgently.
In service, many large diameter monopile grouted connections without shear keys have exhibited
downwards slipping due to inadequate axial capacity to carry self-weight. Colin Billington highlighted
a danger of the more complex DNV approach becoming adopted in future revisions of ISO 19902,
particularly if it is supported by JIPs underway which focus on jacket pile-sleeve grouted connections.
The potential issue for the oil and gas industry is not with these grouted connections but rather with
the generally unmanned large diameter (~2.5 m) monopile ‘caisson structures’.
Colin Billington closed by adding that there were significant cost implications in a late-added
restriction in ISO 19902 prohibiting the use of seawater mixing in grout. This is being addressed in an
amendment but will be issued some 8 years after publication of ISO 19902.
Terry Rhodes asked if there were also quality control issues with wind monopile structures. Colin
Billington replied that there have been some issues, primarily around sealing, but there are not
fundamental to the issues presented at this conference.
Terry Rhodes noted that the wind industry has many monopiles with shear keys and asked if such
configurations have had issues around the connections? Colin Billington stated that reported failures
in wind industry have been associated with plain pipe not with shear key connections. He added that
grouted connections are susceptible to high stress: low cycle fatigue, so representation of the storm
cases is very important.
Mike Drabble reported experience in KBR where they typically used a few shear connections in wind
turbines. These are located in the centre of the connection. The ISO standard resulted in 25–30%
shorter connections that earlier UK Department of Energy guidance, and ISO led to a big increase in
strength in the abnormal event resulting in the expectation that the pile will fail before the grouted
connection—this seemed counter-intuitive and maybe there was a need for a factor of safety >1.0 for
the grouted connection in ALS design situation.
Colin Billington responded that he considered the ISO standard to contain far better formulations
that better represent test data and reduce uncertainty and, as a by-product, have resulted in shorter
lengths. However, he expressed concern that the seismic effect on grouted connections may not be so
well understood, so Standards need to give guidance in these cases.
24 © OGP
Simon Moxnes of Statoil reported that extensive testing of grouted connections with high strength
grout was being performed. It was noted that this was a JIP being led by RWE and it would be good
to both oil and gas and wind industries to have representatives bringing expertise to the JIP findings.
Gunnar Solland, DNV, responded to the concerns around the Norwegian standard with a brief slide
presentation. He highlighted the importance of bending moment in larger diameter connections
and expressed concern over newer jacket design which can experience relatively higher overturning
moments and higher dynamic loading. Development of guidelines in Norsok N-004 Annex K is
on-going. Colin Billington agreed that the issue of higher overturning moments causing high axial
load reversal in the grouted connections and piles needs to be investigated and resolved.
3.5.3 Robustness, degradation, integrity management and life extension
Pat O’Connor reported that, in addition to strength in ULS and ALS events, robustness is
fundamental to achieving a reduced risk profile throughout platform operating life. Low-redundancy
structural systems can meet code checks requirements possibly at slightly lower capital cost than a high-
redundancy system. However, the probability of failure of a non-redundant system will be little lower
than the component probability of failure, while the high-redundancy system can exhibit multiple
member and/or joint failures under overload or degradation before the onset of system failure. He
illustrated this in Figure 3.4 with reference to four jacket bracing configurations that all meet code
requirements, yet the system behaviour of the X or XH-braced jacket configurations far exceeds those
of the K- or Diamond-braced jacket configurations.
Figure 3.4: Robustness in four different jacket bracing mechanisms that all meet minimum code requirements
(Pat O’Connor presentation, slide 17)
The challenge in Standards, that tend to be based on specifying minimum design requirements, is
to communicate the potential benefits in terms of increased reliability and reduced risk that can be
achieved through life-cycle cost-benefit risk assessment.
© OGP 25
Yoo Sang Choo, University of Singapore, concurred that it is very important to teach students
about the structure’s ability to redistribute load. He recalled valuable work that had been performed
to benchmark system analysis within the Frames JIP in the 1990s and expressed support for such
expert global collaborations.
Jesper Tychsen of Maersk Oil noted that there was a wide range of attitudes to managing risk and
Standards lack clarity on redundancy. He expressed concern that the way the standards are written
seem to be too much about a few committee members’ opinions than codifying broad industry
practice, for example requirement that only spectral analysis can be used or that the drag coefficient
shall be 2.0 seem excessive. More guidance and less requirement should be allowed especially for the
simpler monotower type platforms. In addition, the uncertainties in local joint flexibility are probably
of the order of the factor of safety applied in fatigue. Pat O’Connor replied that best practice thinks
beyond component behaviour to how the system will work. In terms of fatigue, while it is true that
there are substantial uncertainties in estimated life, it should be remembered that in addition to the
factors of safety there are usually large conservative biases in the methodology.
Mike Efthymiou considered that the text around robustness was too vague in ISO and that API has
more specific wording concerning survival under ALS events. Pat O’Connor agrees that this is the
case, but he is not just talking about system behaviour extreme load events strength but, specifically in
this presentation, under degradation cases.
Pat O’Connor summarised the structural integrity management (SIM) system process as applied
to offshore structures. He noted that it is important for the operatorto have a management process
in place which employs actual site specific data, and for the integrity engineers to understand how
their structures behave.
In his experience, however, it can be a problem sustaining a SIM system through the life cycle of the
structure in terms of continuity of both people and process, e.g. frequent movement of responsible staff
reducing competency in operator, contractors, and that obtaining long-term (through-life) operations
integrity team funding seems a never ending task.
Pat O’Connor concluded that an effective SIM system is becoming more important as platform lives
are extended beyond the original design life. However, structural life extension is not a unique issue
that arises periodically, but rather part of the on-going broad risk management process.
Nigel Barltrop of University of Stathclyde commented that the engineer needs to be confident in the
quality and availability of data. Our industry does not have a good track record for collecting data.
There have been excellent examples of enormous benefit arising from historic test programmes, but
relatively little has been done on fixed steel jackets over the last decade. Maybe it would be beneficial
to consider some new structural test programmes and include consideration of ways to better share
information between operators concerning bias and spread in estimates.
Pat O’Connor observed that fatigue factor of safety tables are creeping into widespread use in Standards
with factors in the range 2–10 depending upon inspectability and criticality. He reiterated that for well-
designed and well-built jackets it is the jacket system that is important rather than specific joint(s). There
is a need to understand inspection data and build an understanding of the platform system. Such data
gives engineers the capability to make informed decisions provided they understand and confirm for
their specific asset that individual joints are not critical due to overdesign and robust systems.
Specifically in fatigue design and assessment, orders of magnitude changes in life can arise due
to conservative representation of actual joint stress in the analysis recipe. Nominal stresses are
generally not correctly applied as joint flexibility is an important parameter that is rarely accounted
26 © OGP
for. Frame modelling is very important, but computers assume rigid joints by default. In reality
such joints have flexibility. The MSL flexibility equations are available in many computer code
check packages. Where flexibility is built into the system it reduces stress, but simplistic wording in
Standards and large fatigue factors of safety lead towards very large, thick, difficult to fabricate, and
stiff joint cans. Fatigue safety factors of 2.0 should be fine based on common analysis methods for
jackets with good robustness.
Philip Smedley, BP, presented a single slide to illustrate the difference between best estimate and
design fatigue lives, primarily based on the uncertainty in fatigue SN curves. In his example for a
component with best estimate failure of 1.0 × 106 cycles, the design life could easily be around
1.8 × 104 cycles—a reduction factor of 55 on life. This is based on the use of a mean minus two standard
deviation SN curve, a fatigue safety factor of 10, and a modest 20% conservatism in estimated hot-
spot stress. He added that when the estimated fatigue life is in the tail of the probability distribution,
a relatively modest reduction in life can substantially reduce the probability of failure, which can be
beneficial in terms of risk but could be detrimental if the fatigue recipe is overly conservative leading
to manufacturing issues around high strength/large scale components. He concluded that he would
like to see more justification for the proposed fatigue factors of safety and sensitivity studies around
conservatism in the design method and its effect on estimated design reliability.
Terry Rhodes commented that fatigue design factors were based on calibrated results but were
now being questioned against the lack of fatigue failures observed. It is probably a good time to
independently review the calibration methodology assumed and contrast this to industry practice.
Gerhard Ersdal presented some of the issues concerning reliability analysis and life extension, which
are becoming increasingly important in the European North Sea to extend operation beyond existing
design life. He noted that the changes that have occurred since a platforms original design and
installation include changes in: best practice standards, our understanding of condition, estimated site-
specific metocean (or other) loads, sizes of support vessels operating in the vicinity, and understanding
how structure may be degrading.
He regards the risk (hazard) assessment process output as an important input into the agreed barrier
strategy and performance standards. In his experience risk analyses can give the same results when
rerun, but are seldom the same when rerun by different organisation, and almost never the same when
a different organisation is allowed to use its own method and data.
The determination of total environmental load is based on fewer parameters than the total structural
resistance. Engineers should have an increased degree of scepticism for probabilities of structural
failure less than 10-4 p.a due to the increased uncertainty for such rare events. There is little offshore
data on structural reliability, some test data, but no common assessment methodologies and too many
people trust reliability numbers of 10-5 to 10-6 as statements of fact. Similarly for inspection data, there
is some historic data for most installations but again no consistently applied methodology, and too
many engineers trust reliability numbers in the range 10-3 to 10-5. It is important to remember that
probabilities are only notional (not true) values and do not cover the full spectrum of risks, including
biases and variability in the computer model and engineer.
In terms of inspection planning, he questioned the scientific basis for planning schedules—what is
the target probability and what is the basis for integrity index? Some inspection planning based on
probabilistic methods allows inspection intervals to be progressively increased if no degradation has
been observed to date, but this could lead to missing early life cracking and in the extreme would it
really be logical to allow 40 years to the next inspection just because nothing has been observed in
the first 40 years provided no rapid degradation mechanisms are predicted? Inspection probability
© OGP 27
of detection is important but must be realistic for the type of offshore inspection performed, and can
best be incorporated through a Bayesian updating process.
Gerhard Ersdal concluded by seeking more industry consensus around risk modelling and employing
a more common basis for the underlying variables and assumptions.
Terry Rhodes concurred with much of the discussion, but warned that to understand criticality of
specific components, the engineer must be curious about inspection results, as the headline finding
may not always describe the full situation, i.e. all inspection and modelling techniques have limitations.
Ward Turner added that there is more to inspection than just fatigue, i.e. corrosion, dropped object,
so industry should keep to fixed interval inspections rather than increasing inspection intervals on the
basis that no fatigue damage had been observed to date.
Terry Rhodes reported that Shell have components from a Southern North Sea (SNS) jacket platform
at TWI ready for JIP type testing. He added that in general there were few fatigue concerns around
old SNS structures but there are greater concerns for stiffer Northern North Sea jackets. Gerhard
Ersdal noted that in Norway some testing and sharing of data is required. Pat O’Connor reported that
considerable inspection data has been obtained, but maybe the industry is not so good at communicating
and sharing what already exists, especially in JIPs once the confidentiality period expires.
Nils Christian Hellevig of Aker commented that structural reliability analysis includes an
understanding of degradation mechanisms and should be used extensively in association with
redundancy analysis. Ramsey Frazer added that he had seen improved consistency in industry
modelling, including a case where a major K-brace was severed and repaired with no wider issues
arising. Thus, even failure of a supposedly major non-robust K-brace does not necessarily end jacket
life or cause platform collapse. Gerhard Ersdal replied that he had also seen some very poor quality
examples and bad practice and his main concern was preventing these mistakes and abuses.
Terry Rhodes concluded that in fatigue assessment the most critical parameters are the loads and hot
spot stress range. Experience in the North Sea of failures and degradation on conductor guide framing
under out-of-plane loading, suggests that as an industry we got it wrong in the past.
28 © OGP
4. Arctic Structures
4.1 Presentations
The session covering Arctic Structures was co-chaired by Guido Kuiper, Shell and Wenche Rettedal,
Statoil.
Safety and ice design criteria in the ISO 19906 standard for Richard McKenna,
Arctic offshore structures R.F. McKenna Associates
Barents 2020 study—floating structures in ice Pavel Liferov, Statoil
4.2 Reliability of arctic structures
Richard McKenna summarised the work leading to the 2010 publication of the first ISO Standard
for Arctic structures (ISO 19906). He emphasised that the standard was written to cover all structural
types that could operate in waters subjected to sea ice and/or icebergs; this can include both waters in
the Arctic circle and temperate latitudes such as the Caspian Sea. Civil engineering structures such as
man-made islands are also included.
ISO 19906 builds upon the provisions within the respective ISO standards for fixed, floating, MOU
structures, with 10-2 p.a. calibrated extreme level ice event, leading to factors of safety of 1.35 for L1
and 1.10 for L2 exposure level platforms.
For abnormal level ice events, a common notional reliability has been specified, as follows:
EXPOSURE AVERAGE TARGET MAXIMUM RELIABILITY

LEVEL RELIABILITY (P.A.) VALUE (P.A.)
L1 10 -5 10 -4
L2 10 -4 10 -3
L3 10 -3 10 -2
Note: For L1, the 1 in 10,000 year (10-4) event was actually calibrated at around 1 in 6,000 year
(1.6 × 10-4) event, but 10-4 was considered a more consistent representation.
Richard McKenna noted that the hazard curves for ice could be more severe than for cyclones
and seismic events (e.g. icebergs) or could be no worse than those in relatively benign environments
(e.g. rare, single season sea ice). Consequently, the safety factor calibration is highly dependent upon
region and ice-type. For some regions there might be zero load associated with a 10-2 ice event due to
their rarity but abnormal ice events could still be significant.
Richard Simpson, BP, expressed concern over the implied level of accuracy with such uncertainties,
and Tom Brown concurred that he had witnessed first year ice force estimates that were clearly very
wrong. Pavel Liferov of Statoil felt that there were too many engineers with expertise in open water
claiming to be ‘experts’ in ice regions where the skills and knowledge were very different.
Doug Stock of Digital Structures questioned the application of seismic loads including the mass of the
ice. Richard McKenna considered that seismic load would be treated as an independent load effect
that would be estimated in accordance with ISO 19901-2/API RP 2EQ but that it was important to
account for ice attached to the structural mass when deriving structural response to a seismic event.
Guido Kuiper noted that ISO 19906 provides LRFD environmental action factors, however, the ISO
stationkeeping code for floating structures (ISO 19901-7) is based on a WSD approach. Paul Frieze
© OGP 29
of PAFA Consulting Engineers reported that as a single resistance factor for moorings it was simple to
convert this to separate load and resistance factors, if desired.
A recommended strategy for structural design in ice environments was to design to the L1 exposure
level and then build risk mitigation measures and an operational strategy around the resulting design.
Pavel Liferov noted that ice management and/or disconnection are important factors in reducing the
magnitude and frequency of ice actions. Ice management can only reduce design action if it can be
documented that the ice management system is able to reliably detect and handle ice features causing
the design action. However, there is no standard practice on documenting ice management efficiency
and reliability.
Richard McKenna emphasised the importance of the linkage between structural design and
operational management in arctic regions. This was illustrated with a range of examples such as that
pictured in Figure 4.1 in the Caspian Sea where spray ice was used to improve structural stability
against sliding, barges were used as ice barriers to keep rubble away, and issues around support vessel
approach and operation can also be visualised.
Figure 4.1: Arctic platform operation and ice management

(Richard McKenna, slide 4)
A range of different strategies may be appropriate for platforms in the same or similar environments.
These may be highly dependent upon operational requirements rather than design limitations or
optimisation. Consequently, operations experience and documented experience are very important.
In ISO, a new sub-committee had been formed for Arctic operations (SC8). Interfaces between ISO
TC 67/SC 7 Arctic Structures and ISO TC 67/SC 8 Arctic Operations will need to be addressed.
4-3 Issues in current Standards for arctic structures
Historic site-specific data is particularly important to make informed decisions and reliability
estimates in arctic regions. Richard Simpson, BP, was curious about data availability in the Canadian
Beaufort Sea, suggesting very little data existed. Richard McKenna concurred but pointed to a long
history of onshore/near-shore sea ice measurements that could be correlated to offshore ice, and iceberg
size measurements by observations of associated glaciers. He added that arctic structures are far more
sensitive to variation in ice size than they are to frequency of occurrence.
30 © OGP
Richard McKenna added that ice is an extremely complex material, variable both specially and
temporally. Ice can: be a continuously acting process yet highly seasonal in nature, induce structural
vibration, affect deck elevation with ice run up, and have highly localised action effects far in excess of
global actions effects.
Flare profiles at the waterline have been found to be effective in reducing ice induced vibration.
Pavel Liferov of Statoil presented work reported in 2010 and 2011, respectively, for Phases 3 and 4
of the Barents 2020 project. This included an assessment of the standards applicable for oil and gas
exploration and production in the Barents Sea (Phase 3), and a detailed gap analysis of ISO 19906
with particular consideration to the provisions for floating structures in the Barents Sea (Phase 4).
Pavel Liferov noted that:
• The size of ISO 19906 may be detrimental to its use.
• Language remains an important consideration, for example ‘stationary’ means ‘fixed’ in Russian.
• Terms such as ELIE (extreme level ice event), ALIE (abnormal level ice event) and ice event are
not used consistently throughout.
• Interpretation can be ambiguous, so use the terms defined in ISO 19900.
For floating platforms, Pavel Liferov considered that the current partial environmental action factor
does not account for:
• flexibility of mooring systems;
• floating structure movement;
• non-linear interaction between a moored structure and ice;
• changes in direction of incoming ice for a turret-moored ship-shaped unit;
• relevant operational procedures (physical ice management and disconnection);
• action factors for local and global actions may be different from the L1 = 1.35 value which was
calibrated for bottom-founded structures.
Pavel Liferov noted that the focus in terms of ice loading had been heavily towards level ice acting on
vertical piles, but there was very little around ice effects on floaters.
Mike Efthymiou of Shell considered that ISO 19906 is not very clear on how the disconnection
philosophy for floating structures in ice influences the extreme and abnormal level ice action.
Richard McKenna added that while there is some experience for disconnectable floating platforms
in iceberg waters and for drilling rigs in sea ice, there is very little information around production
floaters in sea ice. Some parties may consider that designing vessels to ice class may be sufficient, but in
his opinion this is not the case. He concluded that while the industry needs more guidance for floaters
it is important that we don’t overprescribe requirements due to the high uncertainties that remain.
© OGP 31
5. Metocean
5.1 Presentations
The session covering Metocean actions was co-chaired by Don Smith, Eni and Colin Grant, BP.
Design criteria for drilling and production platforms in ISO 19901-1 and Markku Santala, Chevron
API RP 2MET
Directional environmental extremes Graham Feld, Shell
Recent metocean application to BP Andrew jacket Ramsey Frazer, Atkins
5.2 Metocean standards
Markku Santala presented the state of API RP 2MET and ISO 19901-1 metocean standards,
which give general requirements for the determination and use of meteorological and oceanographic
(metocean) conditions. These standards do not specify reliability levels and only in exceptional
circumstances provide specific metocean criteria. These standards have heritage in API RP
2A but, following the extensive platform damage from the severe GoM cyclones over the last
decade, emphasis in USA was placed on reviewing and refreshing metocean criteria in standards.
Consequently, the historic fixed steel jacket bias is being balanced by consideration of metocean
conditions affecting other structural types.
The API and ISO metocean standards are now very closely aligned. Regional annexes include some
representative values usually for return periods up to 100 years, so there is insufficient information
to construct hazard curves. While site specific metocean information would normally be required at
detailed design, representative values allow simple comparisons between global locations and highlight
dominant criteria (e.g. wind, waves, currents).
Richard Bamford, BP, questioned whether we should focus resources on the loading variables as
the reliability model estimates will likely be more sensitive to loading rather than resistance. Do we
consider that we currently have good data to put into the metocean models?
Colin Grant noted that there is a good history of data sharing between operators and via other non oil
and gas organisations (e.g. shipping, defence, environmental agencies), but in some regions metocean
data is very sparse.
Markku Santala agreed the reliability calculation was likely to be more sensitive to the loads modelled.
He then presented the example of the Gulf of Mexico where the industry had some of the best data—
maybe 100 years of metocean data from 1900, and yet a series of extreme cyclones in the early 2000s
forced the metocean community to revisit this data and revise some of the environmental criteria.
Markku Santala further questioned whether the applied models should be based on best estimates or
have a modest conservative bias specifically in complex multidimensional models? For fixed platforms
it is usually clear what is expected in terms of conservative estimate of structural response, but for a
floating platform it is not always clear what will lead to a conservative estimate of vessel response.
32 © OGP
5.3 Directional criteria
Graham Feld presented the so-called 800-year return period based on recently published work by
consultant George Forristall, which can apply to any directional metocean parameter, although most
structures are dominated by most-probable maximum individual wave height. In most standards the
ULS return period is specified to be 100 years or 10-2 annual probability of exceedance.
ISO and API have minimal reference to directional criteria but ISO 19901-1 and ISO 19902 specify
that the overall reliability cannot be compromised by using lower directional conditions (19901-1),
scaling should be used so that the combined event from all sectors has the same probability of
exceedance as the target return period (19901-1), and scaling up such that the most severe sector is no
less severe than the omni-directional 100-year condition (19902).
Traditional approach of scaling up the directional extremes by the ratio of the omnidirectional criteria
to the maximum directional criteria is consistent with 19902 but has no statistical basis.
Proposed approach ensures that combined event from all sectors has the same probability of exceedance
as the target return period. This means that by splitting the environmental data into two sectors, this
approach is satisfied by having return periods of 200 years in each sector, four sectors = 400 year
return periods, 8 sectors = 800 year return periods. The predominantly unidirectional example in
Figure 5.1 shows that there are an infinite number of solutions that can result in a sum of probabilities
= 1/100, which seem to equally meet the design intent. In this example the 800-year plot reflects
the relative sector maxima, while other alternatives spread the maxima between sectors but still give
the same overall probability of exceedance. The ‘optimal’ solution is structure-dependent, the more
directional the environment, the more likely the optimal solution will differ from the simple 800-year
solution. For new builds it may be best to design for omni-directional case.
Figure 5.1: Comparison of traditional and alternative approaches to directional wave criteria
(Graham Feld, slide 18)
Ramsey Frazer presented an example application of reliability-based thinking including directional

environmental criteria for the BP North Sea Andrew fixed steel jacket platform brownfield
modifications, which will add both topside dead load and lateral wave load to the existing structure.
This highlighted the benefit of, and in this case the probable need for, specialist metocean expertise,
experienced structural engineering contractor and active operator input.
© OGP 33
Much of the thinking was illustrated via hazard curves which Ramsey Frazer considered a very helpful
tool in this example. He recommended that both a normalised and an absolute base shear hazard curve
should be employed to help differentiate the respective environmental and seismic load contributions.
Basecase hazard curves from the default metocean information were supplemented by two hazard
curves including uncertainty in the metocean parameters and ductility in the failure mechanism
(one curve for platform system failure and one curve for single member failure). The default
information was contrasted to ‘bootstrapping’ solutions (monte-carlo analyses) which gave a high
degree of correlation for the jacket loads, but significant differences in hazard slope once wave in
deck is accounted for (although reasonable correlation was found around the 10,000-year return
period environmental event).
While both probabilities of failure corresponding to 1 × 10-4 and 3 × 10-5 were considered, the reserve
strength ratio (RSR) was ultimately correlated to the 10-4 likelihood, leading to a required RSR ≥ 2.15
(on overturning moment [OTM]). The output of the analyses being very sensitive to the actual deck
elevation but relatively insensitive to topside dead load.
The environmental conditions at Andrew are highly directional (NW dominated) but OTM
capacity is fairly independent of direction, leading to failure probabilities dominated by the NW
direction. Hazard curves were presented for all directions as well as the omni-directional hazard
curve, but since directional hazard curves lower the arrival rate from the given direction, the
hazard curves appear steeper, which can initially seem counter intuitive. Furthermore, the initial
directional combination selected gave results that felt overly onerous in terms of probability of
failure, which led to the selection of an alternative more balanced distribution between segments
(a concept illustrated in above Figure 5.1).
John Waegter of Ramboll, welcomed this in-depth example of using hazard curves but felt that
the more representative probability of failure = 3 × 10 -5 should have been the basis for the work.
Richard Potter of HSE concurred that the starting point for such detailed assessments should be
the explicit or implicit reliability levels in the published standards. Ramsey Frazer considered that
such a failure probability would be more appropriate for a new build platform while brownfield
modifications were more of an ALARP risk assessment and in this instance the higher Pf = 10 -4 was
considered appropriate.
John Waegter also recommended that in such an analysis it is more representative to take the
load distribution based on the ALS distribution rather than scale up the ULS distribution. Mark
Manzocchi of Atkins confirmed that this was indeed the approach employed in this example. He
added that the use of directional criteria was further complicated from the issues previously mentioned
by Graham Feld as the steepness of the various directional hazard curves are different, which give
differing factors of safety and differing reliabilities than the omni-directional factor of safety.
Hugh Westlake of BP expressed some concern over the complexity of this new approach, particularly
for assessment of existing structures and asked whether simple methods in API/ISO were still
conservative and therefore a valid alternative. Markku Santala considered that API RP 2MET values
remained appropriate where such values are quoted (e.g. GOM excluding Mississippi delta). Gunnar
Solland of DNV reported that a consistent and pragmatic method for applying directional criteria
was already specified in Norsok, which reflected the simplification in the assessment methodology
that structural engineers have historically worked in accordance with.
Philip Smedley of BP considered that the metocean community were giving the structural engineers
the appropriate directional criteria answer to the wording in the current standards, however, it is
34 © OGP
unlikely all the implications of the proposed criteria are yet fully appreciated by those that wrote these
standards. He encouraged a collective debate between metocean and structural engineers over the
desired application of such directional criteria given that platforms are generally not optimised for
all directions and so he would feel nervous about taking credit for a member over designed to a lesser
environmental direction against the critical member utilisation. John Waegter concurred that this
approach was different to the historic simplification that was assumed and accepted that such a step
change in thinking needed to be well understood and communicated.
Philip Smedley questioned the approach as the number of segments increased from 4, to 8, to 16, to
ultimately 360 or infinity for continuous data. Graham Feld clarified that there comes a point where
a single storm would cover several segments and thus the segments would no longer be independent.
Therefore 360 segments with 36,000-year return period would be inappropriate. He reminded the
audience that the omni-directional criteria always remains an option.
Ward Turner of ExxonMobil stated that from his experience most assessments were still based
on omni-directional criteria but noted the increased use of directional criteria for some mooring
systems and jack-up drilling units. Philip Smedley added that the industry needed to be cautious
of unintended consequences, would most Operators revert to omnidirectional analyses as it is more
understandable and therefore have access to less directional information that may affect operations
and/or integrity management strategies?
Colin Grant concluded the session by reiterating the importance of the interface between the
metocean and structural communities, sharing their respective understanding of the assumptions and
uncertainties behind metocean data, and improving clarity in standards for directional criteria or any
other related issue where metocean data will be applied by engineers from other disciplines.
© OGP 35
6. Seismic
6.1 Presentations
The session covering Seismic actions was co-chaired by Pat O’Connor, BP and Gail Baxter, Marathon.
Requirements for seismic loading in standards ISO 19901-2 and API RP 2EQ Doug Stock, Digital Structures
Seismic design reliability—Sakhalin experiences Mike Efthymiou, Shell
6.2 Seismic standards
Doug Stock presented the state of API RP 2EQ and ISO 19901-2 seismic standards which give
general requirements for the determination of design seismic accelerations. Typically seismic events
are short duration dynamic events with motions in the range 10s to 60s.
The first edition of ISO 19901-2 was published in 2004 and an update is currently on-going. It is a
relatively concise document with several regional maps. API RP 2EQ was based on ISO 19901-2 and
first published in 2009 with a revision in 2011 to eliminate the possible L2 exposure level for manned-
evacuated condition. This is not considered appropriate for seismic events but its elimination also
removes the possibility for an unmanned platform : medium consequence L2 event, which may not be
an appropriate deletion. Target probabilities of failure for the three levels of exposure level are quoted
in ISO 19901-2:
EXPOSURE PROBABILITY OF
LEVEL FAILURE
L1 4.0 × 10−4 = 1/2500
L2 1.0 × 10−3 = 1/1000
L3 2.5 × 10−3 = 1/400
Two levels of seismic design check are required:

1) Extreme Level Earthquake (ELE) to Ultimate Limit State (ULS)
2) Abnormal Level Earthquake (ALE) to Accidental Limit State (ALS)
Spectral accelerations are provided by regional maps and link to seismic risk categories 1 (least severe)
to 4 (most severe), each having specific design requirements in terms of procedure, evaluation and
need for non-linear analysis. Simplified and detailed procedures are defined, the use of which depends
upon the seismic risk category. Correction factors are applied based on the hazard slope curve which
are return period dependent so cannot be applied to non-specified return periods without expert
modification.
The seismic design values are then taken into the standard for the specific type of platform
(e.g. ISO 19902 through 19906) where appropriate action and resistance combinations and safety
factors are quoted. However, it should be recognised that the seismic standards have a historic bias
towards fixed steel and concrete structures, with less basis for floating and jack-up type structures.
Doug Stock noted that some debate has been occurring around the target probability of failure
1/2500 yrs. He emphasised that the 4 × 10-4 p.a. value is an upper bound value that structures will
survive. In high seismic areas such as Japan and California typical structural failures designed on
this basis occur with an equivalent return period of 4000 to 5300 years, while in lesser seismic areas
such as GoM, North Sea, and Caspian, these seismic events do not control the design and there is
consequently no cost penalty for designing to meet a 10,000-year return period seismic event.
36 © OGP
6.3 Application of seismic criteria
Mike Efthymiou described an example of Shell Sakhalin seismic design reliability experience. The
Sakhalin field comprises three major concrete and steel installations exposed to high seismicity and
seasonal sea ice. The design was initially based on ELE of 200 years return period based on worst case
upper/lower bound assumptions with elastic response, little damage and no loss of life; and ALE of
3,000 years based on best estimate variables with no collapse and the means of control and escape
remaining intact.
The integrated deck sits on friction seismic isolation bearings to reduce the accelerations on the topside
in a seismic event.
At the end of the FEED stage, it was estimated that the seismic risk comprised almost 50% of the total
risk which was challenged in an ALARP process. This led to resizing the friction pendulum bearings
which reduced the seismic risk to 26% of all risks and an associated ALE seismic return period of
6,000 years (1.7 × 10-4).
Mike Efthymiou referenced Figure 3.3 to illustrate why, for high slope hazards such as severe seismic
events, a lower target reliability can be appropriate compared to a lower hazard slope wave loading.
In conclusion, Mike Efthymiou recognised that in the few areas of very high seismicity, the 2,500-
year return period would mean that seismic risk would be the dominant risk. A step change increase
in ALE return period to 10,000 years would create significant problems in the design of platforms in
these areas while having no impact on regions of low or moderate seismicity. A modest increase in ALE
from 1/2500 years to say 1/4000 years return periods could be managed with negligible detrimental
consequence, but it may be better to recognise the limitations in accuracy of rare seismic events and
mitigate these in an ALARP manner on a case by case basis.
Participants debated the implied seismic risk and contrasted it with the environmental risk for manned
fixed steel platforms previously discussed in Section 3.
Ward Turner of ExxonMobil noted the inconsistency of collecting loading data across differing
return periods in offshore standards. Doug Stock and Frank Puskar, KBR-Energo and Chairman of
API RP2EQ, replied that this had been extensively debated by the expert committee in 2010 and the
consensus view was that the offshore seismic criteria corresponded closely (Structural Eurocodes) or
exactly (California building regulations) with onshore design requirements.
John Waegter of Ramboll suggested that the starting point for seismic design should be a probability
of failure nearer the 3 × 10-5 p.a. value previously suggested by Shell for manned platforms in the North
Sea, but Doug Stock considered that at such probability of failure no structures could be economically
viable (either offshore oil and gas or onshore construction).
Frank Puskar and Richard Snell, consultant, added that beyond 2,500-year return periods
seismic data is sparse and unlike environmental data may not follow an extreme distribution due
to physical limitations in the maximum seismic event that any specific tectonic region can achieve.
Consequently, the uncertainty in very rare seismic estimates become far larger and best estimates
increasingly unjustifiable.
Doug Stock noted that with the correction factor in the ALE calculation, a 10-4 probability of failure
may be derived from a smaller, say 5,000-year return period event, so there is not a direct correlation
between the ALE seismic event assessed and the associated probability of structural failure. He also
warned that increasing the ALE return period would have a direct effect on the ELE level seismic
event potentially increasing this from 200 years to 1,000 years return periods, thus requiring increased
strength against the ‘minimal damage’ condition.
© OGP 37
Richard McKenna, consultant, questioned whether the matter of inconsistency between seismic and
environmental actions should be addressed by changing the environmental return periods rather that
the seismic return periods. Don Smith, Eni, suggested that relative risk could be based on the relative
populations of platforms at risk from ALS/ALE type events, however, it was acknowledged that at
present there were extremely few platforms in very high seismic regions. Mike Efthymiou concluded
the discussion around return periods be referencing the slope of the hazard curve for the region and
underlying life-safety risk for the specific installation, and highlighting its value in assessing risk and
potential mitigation measures.
Gunnar Solland, DNV, liked the format of the seismic standards but felt that the terms ELS
(extreme limit state—equivalent to a ULS type check) and ALE (equivalent to an ALS type check)
were inconsistent and confusing. He sought clarification on the difference between return period and
probability of failure on the basis that he would expect a structure designed to a 2,500-year seismic
event to more than survive such an event. Mike Efthymiou stated that seven time histories are modelled
with ‘mean’ material strength and the structure needs to survive four of these seven histories. Gunnar
Solland, suggested that using characteristic rather than mean variables may be preferable. Tom Brown,
University of Calgary, warned that modelling the structural system in a conservative manner could lead
to unrealistic behaviour, although Gunnar Solland noted that even modelling to mean values may not
always be representative of reality, for example where the contractor over-specifies material strength.
Frank Puskar encouraged the tightening of exposure level definitions as some contractors had sought
to define areas on manned platforms such as helidecks, etc. as ‘not normally manned’. How often does
a platform need to be manned to be so categorised? Equipment on wellhead platforms need servicing.
Pat O’Connor provided the example of a modest level seismic event on a normally unmanned
platform and the fear of those servicing the platform at the time.
John Stiff, ABS Consulting, presented an example of ship in deepwater off Sumatra that was affected
by a seismic event. While there were no injuries, the ship stopped, electronics failed, the crankshaft
was broken and some $10 m damage was incurred. The effect was likely due to a compression wave
leading to high frequency vibrations. He questioned the potential damage to a production floater in
such an event and whether such potential should be considered in standards. Doug Stock stated that
there was very little documented evidence of seismic action on ships. Some generic guidance could be
included, but at present it would be considered a very low likelihood event.
Pat O’Connor, while acknowledging the limitations in data, encouraged operators to go beyond the
minimum code requirements and consider seismic time histories up to 10,000-year return periods,
particularly given that most offshore platforms are in moderate or low seismic regions. With expert
input the operator gains a better understanding of the structure’s behaviour in abnormal events and
can help create a more robust design for minimal cost.
Frank Puskar concluded the session by reminding delegates that the top consideration in seismic
design is robustness based on a combination of ductile materials, structural redundancy, and good
framing design (for fixed steel jacket structures). He was aware of some designers short cutting ductility
requirements and the use of over specified materials, e.g. higher strength steels that necessary, reducing
ductility and adding brittleness into the structural system. He noted that older platform designs were
more favourable to 6- and 8-leg jackets while less robust 4-leg platforms were now the norm.
38 © OGP
7. Foundations
7.1 Presentations
The session covering Foundations was co-chaired by Moises Abraham, Chevron and Chris Bowley, BG.
Performance of foundations in hurricanes —Historical perspective and Frank Puskar, KBR-Energo
recent hurricanes
Results from API/MMS study on perceived conservatism in foundation design Bob Gilbert,
University of Texas Austin
7.2 Platform and foundation behaviour in cyclone events
Frank Puskar provided a historic perspective of structural collapse and foundation performance in
cyclone events in the Gulf of Mexico and the associated development of API RP 2A for foundations
design and assessment.
As illustrated in Figure 7.1, Hurricane Andrew 1992 destroyed 57 platforms and damaged more than
100 platforms. Post-incident assessed strength was benchmarked to around ±20%. In 2004 , Hurricane
Ivan destroyed 7 platforms, while in 2005, Hurricanes Katrina and Rita destroyed a further 44 and 71
platforms respectively. In 2008, Hurricanes Gustav and Ike destroyed 1 and 59 platforms respectively,
even though Ike tracked a similar path to Rita. In Ike a 2004 exposure level L1 tripod platform was
one of those lost. In almost all cases the damage was clearly in the deck and jacket, with relatively few,
in any, relating to foundation failure. The observed jacket and topside failure mode being reasonable
well predicted and represented by structural analysis based on loads representative of the cyclone
event, although in several cases the structural push over analysis predicted some foundation failure
should have occurred.
Figure 7.1: Paths of six hurricanes leading to loss of Gulf of Mexico platforms
(Gilbert & Puskar presentation, slide 9)
© OGP 39
Bob Gilbert continued the presentation with reference to an API/MMS funded study into foundation
behaviour and the perceived conservatism in foundation design. Thirteen damaged (jacket intact)
structures were investigated with a bias to structures where the foundation capacities were considered
to highly- or over-utilised.
The field performance of the selected 13 platforms was consistent with the design:
1) For eight of the platforms, no foundation failure was predicted or observed. The importance of
modelling the conductors on the base shear capacity, in particular, was highlighted.
2) For two platforms no failure was predicted as long as realistic assumptions were made, i.e. use
of static lateral capacity p-y curves, leg stub penetration into top soil, and best estimate of yield
stress (+15% on MSYS) in pushover analysis.
3) One platform where foundation was (just) predicted to fail and evidence suggested it did fail in
the foundation leading to platform tilt but no collapse.
4) Two bridge-linked platforms where failure was predicted (load around 60% greater than
estimated failure) but there was no evidence of foundation failure. In these cases the soil
structure was complex in nature and there was no site specific bore result - the soil data being
based on 1970s data from 3 miles away from these installations.
Structural factors can be more important than geotechnical factors:
1) Lateral pile capacity tends to dominate the pile system capacity, but it is relatively insensitive to
changes in the soil strength, e.g. a 50% increase in soil strength is equivalent to 15% increase in
steel yield strength for the piles.
2) Pile flexibility is an important parameter. Pile design in practice has typically assumed the pile
is a rigid body since the wall thicknesses are not yet known when the geotechnical report is
produced. However, pile flexibility with strain-softening soil springs along the pile wall and at
the pile tip is incorporated in the structural modelling to determine loads in platform design
and to determine the ultimate pushover capacity in platform assessment.
3) Pile system effects can provide different levels of redundancy since the pile design is checked
on a member-by-member basis rather than a system check. For example, system overturning
capacity is proportional to the axial capacity of a single pile in a tripod, while it is proportional
to about one-third the axial capacity for a single pile in a 6-pile system. On the other hand, shear
capacity is relatively insensitive to system effects.
Variability in geotechnical properties can play a significant role in foundation performance:
1) In the example of the two platforms predicted to fail, the tips of the piles were recorded to be
7 foot (2.1 m) above a medium dense sand layer that would increase the end bearing capacity
by 70% (remembering that these soil profiles were taken 3 miles from the installations). It is
possible that this additional strength was realised in the driving operation.
2) A reclassification of the soil around the pile tip from medium- to very-dense (which may be
reasonable based on best data from the region) would also account for the 60% difference
between load and failure estimates.
Bob Gilbert concluded that while geotechnical foundation design can be conservative, there is no
evidence of systematic over-conservatism in foundation design, with generally good correlation
for the selected example cases once geotechnical expertise is engaged, conductors are realistically
modelled, mean steel strength is represented, static p-y curves are used in the push over analyses, and
representative pile driving records are employed and site specific soil profiles used. He warned against
an arbitrary increase in soil shear strength to balance the perceived conservatism in foundation design.
40 © OGP
Bob Gilbert closed by questioning whether:

1) We are being too pessimistic in terms of how well we understand the extreme storm loading,
with relatively modest bias between predicted and observed loads in these cyclone events (on
average 9% overestimate), while a hindcast model of the extreme pile load shows very large range
of uncertainty—hindcast model uncertainty similar to 20-year forecast future uncertainty,
which feels overly pessimistic for a historic hindcast model.
2) Our models could better represent (or truncate) the reliability-critical lower end capacity based
on physical limitations, e.g. example of factored pile tensile capacity was less than the weight of
the pile!
3) Societal risk for New Orleans levees both pre- and post-Katrina are several orders of magnitude
above the accepted dam tolerable risk profile. High spend yet minimal gain—in fact most gain
was achieved by reducing exposed population. Are we getting balance right between different
onshore/offshore installations/facilities?
Paul Frieze, consultant, question why it had not been standard practice in the past to use the mean
value of yield strength in geotechnical assessment. Frank Puskar replied that while some operators
request this, at present the US regulator does not accept mean strength, meaning that two sets of
analyses are required. Studies like the ones presented have shown how important the estimated stress
is for the pile in addition to the jacket, which is a relatively recent appreciation.
Terry Rhodes of Shell questioned the inclusion of conductors in all analyses. In the North Sea there
are examples of severely degraded conductors and lack of driving records. Frank Puskar concurred
that the model should be based on the best as-is condition of the entire structure, not just the
conductors. If there is severe degradation then this should be represented and similarly if there are
missing or poor quality driving records the uncertainty should be represented accordingly. He added
that US Regulators have questioned whether conductors should be included in the model, but studies
such as the one funded by API/MMS are helping to justify their inclusion.
Chris Bowley asked whether any account had been taken for mud mats. Bob Gilbert replied
that mud mats would make only minimal contribution to capacity, and then only after significant
movement had been achieved. He added that for the examples studies with mud mats, there had been
some 10 feet (3 m) of subsidence so the mud mat as-is conditions was no longer on the seafloor.
Ward Turner, ExxonMobil, asked about soil aging effects given the load test is made relatively
soon after pile driving. Bob Gilbert reported that the current API method derives the ultimate
strength after pile driving set-up (i.e. driving-induced pore water pressures have dissipated, which
typically takes several weeks to several months). There may be additional long-term increases in pile
capacity after set-up, although the axial pile capacity for the tripod that failed in Hurricane Ike was
apparently about equal to the capacity predicted by the API method more than five years after the
piles were installed. There are uncertainties around cyclic loading and strain rate effects but the
predicted capacity reported in the analyses seems to correlate well to the long term in-situ capacity
prediction. It has been suggested that strain rate and cyclic load effects cancel each other, and maybe
that is indeed the case.
Bruno Stuyts, Cathie Associates, questioned whether the single resistance factor should be broken
down into more specific components to represent the uncertainties highlighted in the presentations.
Bob Gilbert reported that he was currently trying to merge the API WSD and LRFD provisions
in this regard. While he could see some benefit in differentiating resistance for piles in sand and
clay, adding complexity in the resistance factor was probably not beneficial. However, recognising
the significantly greater uncertainty where no site specific soil sample exists could be included by an
additional resistance factor in these instances.
© OGP 41
Yoo Sang Choo of the University of Singapore congratulated the presenters on their findings for
foundations, but wondered whether the examples of platform failures in cyclones could give any
indication over the ability to accurately model wave in deck loading. Frank Puskar reported that
it normally took wave in deck loading to fail a platform. In around 30% to 50% of instances with
evidence of wave in deck loading the platform collapsed, in the remainder of cases the platform
survived with local damage. In his opinion, following the API recommended procedure for wave in
deck loading gave reasonably consistent estimates of the damage seen offshore post-cyclone events.
Richard McKenna, consultant, questioned the use of annual or lifetime risks. Bob Gilbert suggested
that to get a full understanding both methods should be modelled. Nigel Barltrop of University
of Strathclyde added that from his experience, considering the risk on an annual basis can lead to
sampling the structural strength every year instead of the correct sampling once in its lifetime.
Therefore, the correct approach should be based on the lifetime and then converted to an annual
probability of failure.
42 © OGP
8. Drilling structures including jack-up

and MOU
8.1 Presentations
The session covering mobile drilling units was co-chaired by Richard Simpson, BP and Jim Brekke, ABS.
Requirements in standards for jack-ups: IMO, SNAME and ISO 19905-1 Mike Hoyle, GL Noble Denton
Benchmarking jack-up rigs and reliability of MOUs John Stiff, ABS Consulting
Reliability analysis for the foundation design of an elevated rig platform Zenon Medina-Cetina,
for the Arctic Texas A&M University
8.2 Jack-up and mobile offshore unit (MOU) Standards
Mike Hoyle described the jack-up specific design and operating conditions. Most drilling jack-ups
move location and as such are rarely designed for a specific location or region. A key evaluation at each
site is the foundation condition and the effect of foundation fixity on the structure.
High level requirements are contained in the IMO MODU code but these can be somewhat unclear
in the extent of the assessment required. SNAME 5-5A and the new ISO standard ISO 19905-1 are
based on Class Rules to ensure hull strength, and focus on foundation, overturning and leg strength,
and leg to hull interface, rather than the hull structure itself. SNAME and ISO are more specific in
the assessment to be performed than IMO and in ISO 19905-2 will provide an example calculation to
aid consistency and clarity in design and assessment.
He noted that ISO 19905-1 evolved from SNAME 5-5A and as such provides more rigor and guidance
for: hull height above wave crest, kinematics reduction factor, foundation stiffness and capacity
modelling and checks, plus screening for seismic events. Overall, ISO 19905-1 is considered to be
a little less conservative than SNAME 5 5A. Load and resistance factors were based on iteration of
historic existing practice along with industry funded reliability based calibration studies.
Trevor Evans, BP, asked whether the standards gave requirements or recommendations for jack-ups
working alongside other structures. Mike Hoyle replied that there were few detailed specifications,
rather the limited text in this area tended to advise the designer over items that should be considered,
including geohazards and deflections.
Mike Hoyle added that it is the intent of ISO to develop a brief standard (ISO 19905-3) to cover site
specific assessment of floating mobile offshore units (primarily drilling semi-submersibles). This will
be based on the existing suite of ISO 19900 documents, in particular the standards for production
floating units (19904-1) and their mooring systems (19901-7).
8.3 Reliability of drilling units
Mike Hoyle considering total economic risk for jack-up platforms, arising from various possible
failure modes, in a range of periods between 1956 and 2000. While the highest economic risk varied
between the selected periods, generally, blowout, foundation punch through, and flooding/structural
damage were the most prevalent risks.
Pushover analyses indicated RSR values in excess of 2.0 provided the foundation was stable. An earlier
investigation into sliding failure indicated that when SNAME (Rev 1) factors are met, sliding would
initiate in 10,000-year independent extremes in the central North Sea.
© OGP 43
Don Smith, Eni, remembered Richard Snell’s reflections from 1995 conference concerning jack-ups
that suggested probabilities of collapse in the range 10-2 to 10-3. Load factors have decreased since that
time, so where do we think the industry is in terms of jack-up reliability? Mike Hoyle responded that
the 1995 estimates were notional crude estimates that were certainly not exceeded as we have not
witnessed operational failures and may have been somewhat pessimistic. To balance the reduced load
factors, the rigour in the assessment method would enhance reliability. Richard Snell added that
back in 1995 some of the pessimism was associated with a wide range of design practice and possible
loopholes in the assessment methodology that some contractors might have sought to exploit for cost
gain. He considered that the rigor in the new standards would lead to more consistent reliability levels
for jack-ups.
John Stiff presented two pieces of work, the first relating to the benchmarking exercise for the new
ISO 19905-1 Standard and the second relating to reliability of MODU mooring systems.
John Stiff reported that the benchmarking exercise against ISO was required as there were some very
significant differences to the previously benchmarked SNAME 5-5A document as previously noted
by Mike Hoyle, e.g. geotechnical unity checks are subject to major changes in assessment method.
While these differences were significant, the style and format of ISO 19905-1 and SNAME 5-5A were
similar. One of the most important findings of the exercise was that some contractors were reading
and applying what they thought the standard required rather that what it actually stated, because ISO
19905-1 looked like SNAME 5-5A they assumed it was the same as SNAME 5-5A.
Jim Brekke, ABS, pointed delegates to the OTC paper by Jack Templeton for more information on
jack-up studies in cyclone events and the subsequent failure or non-failure of respective jack-up platforms.
In terms of MODU mooring reliability, John Stiff related some of the key findings from a recent
JIP based on 6 Gulf of Mexico MODUs whose mooring systems failed and 1 MODU that survived
a cyclone event; all 7 MODUs were expected to survive based on code. The advantage of the MODU
mooring failures over the collapsed platforms (discussed in Section 7) being exact knowledge of when
the mooring failed due to ‘rig trackers’.
The four conclusions based on design of a range of MODUs to API RP 2SK/2SM code were:
1) Increasing the design return period event from 10 years to 50 years leads to roughly a factor of
10 reduction in probability of failure while increasing the design return period from 10 years to
100 years leads to roughly a factor of 100 reduction in probability of failure.
2) If failure is defined as exceeding 80% CBS (catalogue break strength) as opposed to 100% CBS
(possibly due to corrosion, wear, or bending over the fairlead) then the probability of failure
will increase, as would be expected. However, the rate of increase is far higher for the 100-year
return period (10×) than for the 10-year return period (2×). This is because the 100-year design
is starting from a far lower probability so the move towards a more onerous failure criteria tends
to reduce the beneficial effect reported in 1. above, see Figure 8.1.
3) For the case studies considered, for 10-year return period environmental criteria, a system
designed with 8 lines was considered notionally less likely to fail than a system designed with 16
lines. This counter-intuitive finding is due to the respective factors of safety in the API Standard
for intact and one line missing moorings. Since the 8 line system was more sensitive to the loss
of one line its configuration was dependent upon the one line missing design criteria, while the
16-line condition was specified by the intact condition. Because of the relative factors of safety
this resulted in an apparently stronger mooring system for the 8-line case in this instance.
4) The annual one line missing probability of failure could be reduced to obtain an equivalent
system failure by 25% for 8-line system, 40% for 12-line system and 45% for 16-line system.
44 © OGP
Figure 8.1: Probability of mooring line failure vs design return period, for mooring lines based on
100% and 80% break strength (John Stiff presentation, slide 19)
Mike Efthymiou of Shell noted that the baseline system annual probabilities of failure for 8- to
16-mooring lines MODUs was reported to be around 3.0 × 10-2 to 4.5 × 0-2 (3.0–4.5%) which seemed
very high. John Stiff replied that these were indeed the calculated design probabilities of a mooring
system failing based on the MODU rigs designed to 10-year normalised return period criteria and
assessed against GoM environmental conditions. Therefore, it is very important for the MODU
owner/operatorto consider the risks associated with the mooring systems. These probabilities took no
account of other potential failure mechanisms, such as substandard material and incorrect operation.
Paul Frieze, consultant, asked about the MODU mooring systems considered in the study and modes
of failure. John Stiff replied that a range of chain, wire and polyester rope in catenary through taut
configurations were considered. In most cases (around 70%), failure occurred in the cyclone event in
the wire rope at or near the fairlead.
Simen Moxnes of Statoil noted recent MODU mooring line failures occurring at the fairlead and
questioned whether any reduction in strength had been included to account for the bending at this
location. He considered that it was important to ensure that such strength reduction was recognised
and specified in standards. John Stiff replied that no reduction in strength for rope under bending
had been accounted for in design.
John Stiff concluded by emphasising that this was a design focussed study which made a number of
assumptions to give indicative results that were enlightening but notional. For example, he would
have liked to engage more chain and rope manufacturers as the findings were based on CBS rather
than actual component strength. Hearsay evidence suggested that the relatively large overstrength
(10–20%) that may have been inherent in the past has reduced to 1% or 2% as manufacturers tighten
quality and cost control.
Following a request by Jim Brekke to provide more perspective to the failure probabilities for different
numbers of mooring lines, John Stiff warned against misunderstanding the finding that fewer lines
gave better reliability, as this was a specific anomaly in the design factors of safety and should, for
example, a line be understrength or degraded in an 8-line system, the likelihood of a second, third and
complete system failure was far greater than for a system with more redundancy.
© OGP 45
Finally, he noted that after cyclone Katrina there was a move by the US Regulator to increase the
design return period from 10 years to 100 years in GoM, although the final outcome was a modified
10-year criteria. While on paper the 100-year criteria appears more reliable, it raises other risks in
terms of lack of available MODUs at this capability, continually working these systems at their limits,
handling massive (oversized?) mooring equipment.
Richard Simpson closed the debate by reminding delegates of Ward Turner’s keynote presentation
and that there was a need to consider the entire set of life cycle risks, rather than focus only on risks
associated with one aspect in isolation, since modifications in one area may increase risk in other areas.
Zenon Medina-Cetina described an example of an elevated platform onshore drilling rig in an arctic
region. The challenge being to make drilling more environmentally friendly by making the platform
as compact as possible, to reduce the footprint of the facility and also by elevating the platform off
the ground. Many different cases of pile design were investigated and by use of reliability analysis and
sensitivity studies to identify the most critical parameters, the system could be optimised. He concluded
by encouraging the industry to move towards next generation monte-carlo probabilistic analysis and
building Bayesian networks to better represent causation and correlation into the model code.
Andrea Mangiavacchi, consultant, asked whether a single optimum solution and an accurate
assessment of the most sensitive parameter could be obtained from such a complex multivariable
system of interdependent influences. Zenon Medina-Cetina replied that this was the advantage of
the monte-carlo full reliability method, although agreed that robust solutions would only be obtained
if the input probability distributions were themselves sufficiently representative.
Don Smith, Eni, further enquired if the results of the analysis should be considered as notional or
absolute risk levels. Zenon Medina-Cetina responded again with reference to the accuracy of the
input distributions and modelled interdependencies. All models start as notional representations but
by using Bayesian updating as field data is measured they can begin to move from notional to actual
representations of failure probabilities.
Ward Turner of ExxonMobil provided a brief presentation considering the interdependence of
system and component risk. The loss of major components such as drilling derricks, masts, cranes and
flares, can have a very significant business risk to production, but may not always be subject to equally
rigorous assessment, see Figure 8.2.
For example, it was found that the API 4F document was deficient for a 1996 mast failure in
Australian waters, including lack of requirement for site-specific environmental criteria. This was
addressed in an update to API 4F in 2008. Other relevant appurtenance design documents are API
Spec 2C (2012) guidance for cranes, API Bull 2TD (2006) guidance for tiedowns of appurtenances,
and API RP 2L (1996) guidance for heliports.
Ward Turner warned over structural components that may be subject to high opposing loads but the
critical design load being the differential load. In this case, the differential load can change substantially
due to relatively modest changes in one or other of the fundamental loads. He concluded that it is
important to remember that significant functional hazards can also arise from relatively simple topside
appurtenances in addition to the more complex subsea structural components and sub-systems.
46 © OGP
Figure 8.2: Failure of derrick on GOM TLP in Hurricane Katrina (2005)

(Ward Turner presentation, slide 2)
Torfinn Horte of DNV made a brief presentation on wellhead fatigue due to wave induced loads
and workover operations. The issue is generally complicated by two separate analyses for riser loads
and local wellhead response—the two analyses often seeking to optimise the design in differing and
counter ways. A JIP on structural well integrity is planned for 2013. Initial thoughts for structural
reliability analysis for wellhead fatigue question include:
1) Do different fatigue safety factors need to be applied for different components in the system?
2) How measured data can be used and potentially justify a reduced fatigue safety factor?
3) What parameters and associated bias/uncertainty is most important in the assessment?
Jim Brekke asked how much difference there is between aged wellheads to the more recently designed
and installed wellheads, in particular relating to locked in housings and pipe in pipe stresses. Torfinn
Horte replied that a rigid load making the pipe a combined section thereby removing rocking that can
produce high stresses.
Don Smith, Eni, noted that a number of new practices have recently been published that require
DP rigs to have BOPs with additional rams, thereby substantially increasing the weight of the
BOPs. The associated reduction in the well head fatigue life meant that, in certain circumstances,
it was not possible to demonstrate that the BOP could meet the requirements for a typical 60 day
drilling operation.
Jim Brekke asked if fatigue cracks had been detected. Torfinn Horte recalled two examples but
agreed that there was little operational evidence but the procedures need to balance prevention of
failures against being overly conservative.
Jeroen van der Cammen, Bluewater, asked about the probability of failure given that fatigue life is
usually a cube relationship relative to stress. Torfinn Horte agreed that this was also the case with
changes in factors of safety from say 3 to 10 where substantial changes in estimated fatigue life can
result from modest changes in allowable stress and/or the applied safety factor. Hugh Howells, 2H,
added that increases in oil price and deeper water wells are driving the industry towards seeking
increasing drilling periods at a time of increased conservatism in fatigue practices.
© OGP 47
9. Floating structures and marine

operations
9.1 Presentations
The session covering floating structures and marine operations was co-chaired by David Knoll, Shell
and John Stiff, ABS Consulting.
Design requirements for floating structures in standards ISO 19904-1 and Paul Frieze, PAFA Consulting
API RP 2FPS/2T
Application of design criteria to harsh water FPSO Richard Gibson, BP
Reliability of offshore operations, recent issues and on-going studies Jos van Doorn, MARIN
Development of classification rules Jim Brekke, ABS
9.2 Floating structures standards
Paul Frieze presented the state of ISO 19904-1 and API RP 2FPS and 2T standards for floating
production units. ISO 19904-1 covering monohulls, semi-submersibles and spar platforms was published
as first edition in 2006, a second edition is scheduled to begin in 2013 and to be published in 2016.
API RP 2FPS has a similar scope and was first published in 2001, with a second edition published in 2011,
and a third edition schedule for around 2016. ISO 19904-1 built on the first edition of API RP 2FPS,
while the second edition of API RP 2FPS was very similar to ISO 19904-1, so the two documents are
converging but retain some specific differences, so for example API only requires WSD format to be
followed. Both standards currently only address exposure level L1 floating structures.
In ISO 19904-1, ULS conditions are based on a 100-year return period event with appropriate partial
action factors, with an ALS event based on 10,000-year return period followed by a post-ALS check
for ability to remain afloat and be evacuated based on a 1-year return period storm. ALS cases are
associated with an action factor of 1.0. Equivalent WSD action factors of 1.0 are recommended based
on published Class Society Rules in similar design format. In API RP 2FPS (2011), whilst the ULS
requirements coincide with those of ISO, those for robustness and air gap depart not insignificantly.
The partial action factors being identical as those for fixed steel jacket structures seems an anomaly given
the differing relationships between load and response for a fixed (Hs2) and floating structures (Hs).
Furthermore, for floating structures there is a more complex relationship between extreme wave height
and extreme response, depending upon the floater type and design situation under consideration, e.g.
longitudinal strength, prying action on semi, greenwater on deck. The published partial factors having
been recommended by experts rather than being based on formal calibration studies.
Paul Frieze considered applicability of hazard curves for floating structures. Based on limited metocean
data in draft ISO 19901-1 (only up to 100-year return periods for North Sea), it is considered that a
reasonably linear estimation of wave height extremes would be appropriate. However, looking at the
GoM metocean data published up to return periods of 2,000 years suggests a nonlinear relationship.
It was later suggested that this was due to combining the respective data from non-cyclonic and
cyclonic events. For ALS events, differing hazard curves should be considered for the differing critical
structural response events.
In conclusion, Paul Frieze questioned whether ULS partial action factors are too onerous as the ULS
case will always dominate the design compared to the 10,000-year ALS event. DNV-OS-C102 may
be more realistic.
48 © OGP
Markku Santala, Chevron, noted in API RP 2FSP that a 15% increase in crest is required to determine
local forces on affected structure and equipment. This is probably based on fixed structure pile area
effect, while for a floater the diffraction analysis takes area effects into account, so this requirement
is probably accounting for the effect twice (or maybe more). Dave Knoll replied that guidance was
required in API RP 2FPS for local damage rather than for global assessment which does not need the
15% crest increase suggested.
Richard Bamford, BP, stated that in addition to partial factors for environmental loads, the factors
for static loads also needed to be examined as studies of these often lead to the conclusion that factors
less than 1.0 would be appropriate for monohulls. He also observed that threshold effects can help
as well as penalise, e.g. buoyancy at the front of vessel reduces in bow greenwater events, so there
can be some offsetting against the severity of the ALS event. Finally, he noted that most underlying
documents for floaters have heritage in IMO maritime documents which are now associated with a
goal-based standard that should be examined when considering underlying reliability levels for oil and
gas industry floating structures.
Paul Frieze replied that the Marin led SAFEFLOW JIP gave good guidance on threshold greenwater
type events. In relation to IMO, he was concerned that their goal-based standards seemed to lack
an explicit goal.
Graham Stewart, LR, noted that care is needed in quoted uncertainty in reliability calculations as
part of the strength capacity may already have been used by dead load. For example a piled structure
half the capacity may have been used up by the dead load but the uncertainty remains the same, so
the COV has effectively doubled for estimating environmental loading. Therefore, simplistic hazard
curves need to quote the underlying assumptions and recognise the true uncertainties. Paul Frieze
responded that hazard curves are a good tool to visually illustrate trends and differences for setting a
framework, but cautioned about their application to more specific design problems.
9.3 Metocean criteria for floating structures
Richard Gibson presented a BP example application of design criteria for an FPSO in Atlantic Ocean
harsh environment, in particular associated criteria for the hull, moorings and riser systems. These can
be based on:
1) Simple combination of extreme wind, wave and current.
2) Environmental contours requiring joint distribution of parameters.
3) Extrapolation of response function.
The metocean application of environmental contours, FORM or SORM methods are used to identify
the maximum response points with equal probabilities of exceedance. This method can have the
advantage that the metocean contour surface is divorced from the application. Some of the challenges
of this method are that:
1) Assumed failure surface is then superimposed on nonlinear response, e.g. offset response, and
using FORM these may not match, while by using SORM better matching can be achieved but
the level of complexity rapidly increases.
2) Environmental directionality, joint probability of waves and currents each from eight directions
rapidly leads to large impractical data management (64 combinations). Simplification is desirable
and optimisation for the response of a specific component or system, e.g. riser response. The
solution can depend upon how the factors of safety have been calibrated which is not always clear.
© OGP 49
3) Short-term variability between individual (say 3-hour) sea states leads to scatter in the estimate of
extreme response, e.g. line tension. There are different ways to represent this scatter in the contour
plots, the importance of these depending on the degree of non-linearity in the response parameter.
4) For extrapolated steep sea-states to low probability return periods the data in the tail of the
probability distribution is applied, but as previously stated, this may be impacted by physical
thresholds that we believe cannot be exceeded—truncate the best estimate theoretical
distribution or use alternate distribution with lower bound (e.g. Pareto distribution)?
Hugh Westlake, BP questioned whether the structural community are challenging the metocean
engineers sufficiently to provide sufficient assurance of delivered environmental action data. Richard
Gibson replied that an on-going conversation is required between disciplines to understand each
other’s needs and applications. Graham Stewart, LR, agreed that good interfacing between disciplines
is essential to ensure that practical structural reliability is maintained and that more complex metocean
assessment adds value to the end design/assessment rather than being an academic led exercise.
9.4 Marine operations
Jos van Doorn gave a perspective about the reliability of offshore operations, including installation,
offloading and dependency upon vessel type. Reliability requires the right trained staff with the right
equipment. Offloading operations to FPSOs or FLNG can be improved by simulator training with
several pilots engaged simultaneously on the bridge of each vessel engaged in the operation. Such
simulations allow for a full range of typical and extreme or emergency situations. The accuracy of the
simulator, which will be a mathematical representation of offshore and near shore conditions, can be
calibrated via specific studies of specific conditions, e.g. shallow water: long waves, wind profiling and
effects of boundary layers and shielding, closing the learning loop from operational expertise, and
single and dual crane lift operations.
Dave Knoll asked if engineers are setting more challenges to operations crews than in the past. Jos van
Doorn felt that more operators are involving their offshore operations staff early in the project which
has advantages in terms of developing skills but, in some cases, the procedures are not sufficiently
developed and the process can be less about training staff as clarifying process.
Richard Snell, contractor, asked how reliability can be quantified in the marine operations context
which is more related to human behaviours than mathematical design formulations. Jos van Doorn
stated that he felt it was almost impossible to determine a level of risk based on a limited number of
simulations with a specific master. There is a need to mitigate operational risks by communicating
opinions and uncertainties in a formal HAZID/HAZOP or similar type study.
9.5 The role and responsibilities of class societies
Jim Brekke gave a consolidated presentation on behalf of four classification societies concerning
development of rules for floating offshore installations—originally presented to US regulator BSEE.
The main objective of classification is to verify structural strength and integrity, and reliability of
systems that maintain essential services on board, with different societies having specialism on specific
systems, platform types and regional challenges. IACS verify and audit for consistency between
societies. Rules tend to be based prescriptive requirements based on years of experience, expertise,
R&D, and industry feedback.
50 © OGP
Alf Reidar Johansen, OGP, asked about the make-up of IACS and how much IACS specify common
rules and how much it is left to the individual class societies. Jim Brekke replied that IACS now
comprises 13 members. Richard Bamford followed up by noting common structural rules exist for
bulk carriers and oil tankers and asked if common rules for floaters could/should follow. Class society
representatives present were reluctant to give specific response on these questions.
Don Smith, Eni, noted that from his UK experience, the class societies now appear to provide less
expertise than 20 years ago. He questioned why this may be the case and if changes in the regulations
have unwittingly led to this situation. Jim Brekke replied from his previous operator role that he felt
that the operator to class society relationship was extremely valuable in the US.
Richard Potter, UK HSE, clarified the differences between classification, certification and
verification. In UK waters the responsibility moved to the duty holder providing expert assurance
to the government that the asset and procedures were fit for purpose. In addition, assurance moved
away from following prescriptive code requirements towards a more holistic assessment of hazards,
consequences and barriers to prevent escalation of hazards. Design and assessment standards still
play an important role, but so too does mindfulness which can better address the operational and
organisational risks. Don Smith questioned whether this expectation was being met in reality.
Richard Potter responded that this must be down the duty holder to deliver.
Philip Smedley, BP, asked if the class societies would be prepared to share their opinions on the
level of structural reliability that could be achieved if a floating offshore installation was designed
to their respective rules, or at least provide delegates with a feel for the data they use to support the
specification of allowable stresses and associated factors of safety. Class society representatives present
were reluctant to give specific response on these questions.
Dave Knoll closed the session by referencing the Mars TLP platform extreme offset response. One
plot that ended with collapse of the drilling rig appeared relatively predictable based on hindcast
data, while a second plot within the cyclone event gave much more random offset patterns. Secondly,
the majority of the components in the structural system did not appear to be affected by cyclone-
induced dynamic behaviour (only some 250 of 18,000 elements were affected). Finally, examining
30% increase in Hs against dynamic stresses showed that in some of the largest Hs storms the stresses
can decrease, including in critical areas. Thus it is indeed important to look at the entire Hs:Tp space
rather than consider Hs in isolation.
© OGP 51
10. Moorings and risers
10.1 Presentations
The session covering moorings and risers was co-chaired by Andrew Newport, SBM & Jeroen van
der Cammen, Bluewater.
Design requirements for moorings in Standards ISO 19901-7 and Philip Smedley, BP
API RP 2SK/SM
Background and on-going work for reliability of mooring systems Torfinn Hørte, DNV
Squall issue in the design of floating offshore units Benjamin Lechaptois, Bureau Veritas
Reliability levels for risers in standards—North Sea perspective Steinar Kristoffersen, Statoil
10.2 Mooring standards
Philip Smedley presented the state of standards and specifications for stationkeeping systems.
The design standards for moorings primarily being those published by API RP 2SK, ISO 19901-7,
DNV Posmoor and BV NI 493. These are supplemented by specific requirements and specifications
for chain, wire rope, fibre rope and mooring connectors, predominantly published by the classification
societies. For thruster-assisted mooring systems, reference is made to IMO and IMCA requirements
and guidelines.
Stationkeeping systems for short term applications with intermittent dry-docking such as drilling
rigs, floatels (mobile systems), are differentiated from long-term applications on production units
(permanent systems).
Design checks are based on WSD format, with ULS intact line and damaged line systems for both line
strength and vessel offset, FLS of intact system, and an ALS check only for a disconnectable system
(although some operators are now requesting a ALS check of the intact system for survivability). The
factors of safety are applied to the ultimate strength of the mooring line as opposed to the yield strength
which is typically employed for other components. Credit is given for the type of analysis performed,
whether dynamic or quasi-static. API and ISO apply the same safety factors while DNV Posmoor
requires more onerous factors of safety for cases with risers connected or working in close proximity
to other installations. Thruster and mooring systems are assumed to be independent systems.
For mobile moorings the API/ISO standards currently specify a design storm return period of 5 years or
more provided the rig is not in close proximity to another installation, while DNV require 10 years or more.
Andrew Newport noted that most mooring designs used to be based on API requirements, but now
tend to be based on client specifications which aim to reduce risk. His perception is that almost every
project has a unique set of client requirements, which can add complexity for the design contractor,
and potentially indirectly add risk to the stationkeeping system. Consequently, Andrew Newport
encouraged the industry to seek to converge towards a common agreed design practice. Jeroen van der
Cammen concurred with this concern and desire to standardise design requirements.
Terry Rhodes of Shell provided an example of a North Sea failure where the ‘temporary’ one line
missing condition was caused many years after an unknown illegal welding operation probably on
the back of the anchor handler during installation, but could not be rapidly rectified due to the
installation winch in the turret being unserviceable when it was required. Fortunately this system had
good redundancy.
52 © OGP
Jan Flynn of Shell noted the modest 5-year design return period for MODUs which appeared
independent of operating period and asked if this was an area being addressed. Philip Smedley
replied that in ISO there was a strong desire in the next technical update of ISO 19901-7 to increase
this minimum return period but it was recognised that such an increase would need to be sensitive to
what could be achieved in the current fleet of MODUs without adding risk—as noted in John Stiff’s
earlier presentation on MODU moorings (Section 8.3).
10.3 Reliability of mooring systems
Philip Smedley reported that the underlying design reliability behind the mooring system factors of
safety are based on API Annex G, which references Deepstar CTR 4404 (1997) benchmarking line
strength to existing practice, and DNV Deepmoor (1998) which was based on probability of failure of
10 –4 for strength leading to the loss of a single line, see Figure 10.1.
For FLS the underlying design reliability is based on probability of failures of API = 10-4 for one line
failure, and DNV Deepmoor = 10-3 for one line failure and 10-5 for multiple line failures. The assumed
number of components (chain links) in the line is the most critical parameter as a line fails when the
weakest or most degraded component fails. The differing TN (API) and SN (DNV) curves provide
very similar fatigue lives for mid-size lines (around diameter = 120mm), but different interpretations
exist around the existence of a size effect. Bending fatigue is recognised as degrading fatigue life, but
only limited guidance is specified in the current Standards and expert assessment is expected to be
performed on a case-by-case basis.
Philip Smedley raised concerns around uncertainties in very high strength and/or very large
diameter chain links, thruster reliability, relative risk in different systems, e.g. mobile rigs, production
floaters, offloading buoys. He also reported that based on evidence from offshore failures associated
with permanent mooring systems, failure rates were around 2 × 10-2 p.a. for one line failure and
2.8 × 10-3 p.a. for multiple line failures. The majority of failures are not due to inadequate design but
rather to problems in manufacturing, installation and operations. Therefore, a concern has been raised
around increasing factors of safety that lead to very high grade and very large components than may
be less reliable in service.
He concluded with an example of an OPB fatigue calculation that in addition to the explicit fatigue
safety factor and use of design SN curve applied additional conservatism the in OPB calculation
methodology. This appeared to suggest a total design factor of safety over best estimate by a factor of
over 200 on design life.
Torfinn Hørte described background work in DNV on mooring system reliability since the late
1990s to on-going work. Deepmoor (1998) specifically investigated mooring reliability under both
strength and fatigue conditions and gave consideration to new fibre rope material. This study led to
a separation in DNV Posmoor (2001) of the single safety factor for line tension into static (mean)
tension and dynamic tension components, with lesser uncertainty in the static component. However,
this approach has not been widely adopted outside Norway and may be reversed in the future to
increase consistency.
© OGP 53
Figure 10.1: DNV estimated reliability level for range of mooring systems design to proposed two
component safety factor format (4 pink points at right represent polyester mooring lines)
(Mathisen & Horte presentation, slide 4)
Since 2011, DNV are revisiting the current design standards and, by using more computationally
extensive time domain analysis, quantifying the reliability of intact mooring systems under ULS design
conditions. The intent is for Norwegian and UK regulators to agree on common harsh water factors of
safety for manned floating structures. The work scope covers a MODU, FPSO and production semi-
submersible, Norwegian and GoM environments, 150 m, 350 m and 1500 m water depth, and chain-wire
and chain-polyester systems. To date, extensive work has been performed on the extreme environmental
conditions, which are being verified. Over the coming 12 months, data and probability distributions for
material strength, and FORM/SORM derived tension distributions will be investigated with associated
factors of safety and probabilities of mooring line failure under ULS conditions.
Richard Bamford, BP, asked what difference would be achieved if instead of basing the design on
100-year return period, say 1,000 years or more were used, would the scatter in the results be better
or worse? Torfinn Hørte replied that it was difficult to give an immediate response, but his feeling
would be to expect the scatter to reduce. The findings from the Normoor JIP would give important
information for the entire design recipe and should lead to more consistent design safety.
Philip Smedley commented on the excellent work being performed in Normoor but that the cost and
schedule was around $1.65 m over 3 years just to investigate the basecase intact mooring system ULS
reliability study. Therefore, while he agreed with the desire to unify mooring standards to acceptable
safety levels, this was likely to be a long and expensive process.
Benjamin Lechaptois addressed squall issues and their importance in the design of mooring systems
for floating offshore units in Western Africa where squalls can be the predominant mooring design
condition. Bureau Veritas Rules, NR493, is based on the following:
• Use the rescaled method on a limited number of squalls.
• Each squall considered as a governing element and so combined with wave(s) and current.
• Design response (tensions and offsets) is the maximum response obtained over all the squall cases.
This approach can be considered over-conservative, but the degree of conservatism has not been
quantified. Measurements and data interpretation of West African squall events were performed in
the WAG JIP (Phases 1 to 3). Spread 4×4 mooring systems in 800 m and 1300 m water depth, in both
Nigeria (146 events—most severe maximum squall events) and also Congo/Angola (474 events—less
severe maximum squall events).
54 © OGP
A direct simulation approach and a rescaling approach (currently used in BV Rules) were developed
and contrasted. It was reported that from initial results, the rescaling approach gives larger offsets, but
in some cases these can be only a little more conservative than the direct simulation method. Therefore,
it is not considered that at this time the rescaling approach is over-conservative. Work is on-going on:
reliability assessment of design wind speed extrapolations, extrapolation of tension values instead of
offset ones, evaluation of the overall reliability index, and application of the methodology to other
type of offshore units.
Markku Santala, Chevron, questioned that if you rely on the maximum squall event recorded, then
the more data that is collected, the more the worst outcome is going to represent a low probability
event. Benjamin Lechaptois replied that at present there are a small set of design squall events (17-
off) and so this issue was not yet critical. Olivier Cartier, Bureau Veritas, added that should the
database approach 100 design squalls then it may become appropriate to take a 85% value rather than
maximum, but this was not yet the case.
Markku Santala further asked about directionality in the two methods. Benjamin Lechaptois
replied that for the direct simulation approach only the time series of the squall was performed as
recorded, so the direction was limited to that observed in the specific recorded event.
Karthik Nookala, BP asked whether rescaling peak wind speeds in accordance with BV rules could
lead to a peak wind speed in excess of the 100-year wind speed. Olivier Cartier, Bureau Veritas,
replied that the response is broken into a quasi-static component and a dynamic component related
to the rising and decay parts of the squall time history. The dynamic components should account for
a modest increase in the dynamic amplitude factor, as well as accounting for damping and natural
period of the system.
10.4 Standards and reliability of riser systems
Steinar Kristoffersen noted that neither ISO nor API have target reliability values for flexible risers.
Norwegian regulations state that the safety level for flexible pipe or pipe from non-steel material shall
be no less than for steel pipelines and risers, with guidelines pointing to DNV-OS-F101 and F201
(API 17J is considered to give similar safety level requirements to these standards). For high safety class
pressure containment systems, DNV-OS-F101 quotes a nominal annual target failure probability in
the range 10 –6 to 10 –7.
Figure 10.2: Statoil Snorre B semi-submersible platform with riser porch

(Steinar Kristoffersen presentation, slide 1)
© OGP 55
Statoil investigations for Western Europe suggest actual failures in risers from 1.2 × 10-4 per riser per
year for large diameter steel pipe to 4.5 × 10-3 per riser per year for dynamic flexible risers, with one
out of three incidents resulting in a hydrocarbon leak. In 2011 on the Norwegian Continental Shelf,
there were two leaks from flexible risers (none in previous 5 years), eight serious incidents with pipeline
systems (all flexible risers) inside 500 m safety zone, with eight of ten total incidents relating to one
operator. Norwegian PSA report that while crude leaks have been reducing in general (2001 to 2011),
flexible risers are considered an unsolved problem requiring industry attention. One fatal incident
occurred at Nkossa field in West Africa but minimal information has been published.
Other known or possible failure modes include:
1) Low stress high frequency ‘singing’ in a gas export system but there remains high uncertainty in
the vibration and stress amplitudes.
2) Carcass collapse in production and gas injection risers probably due to rapid depressurisation
during shut-in events.
3) Carcass tearing where creep in polymers and a riser under deadweight lead to failure in
unsupported area.
4) End fittings are proprietary designs so it can be difficult to perform independent risk assurance
and quantify safety margins as proof tests may not be taken to failure load levels.
5) New potential failure modes including new materials, complex proprietary designs, expansion
of operating envelopes.
The above hazards require improved integrity management systems with focus on safety critical
locations on the riser. Tools include: continuous monitoring, logging, inspection and testing, and
specialist investigation such as ultrasonic scanning, X-ray, video and configuration monitoring. All
these tools require skilled engineering support.
Steinar Kristoffersen asked for delegate discussion around:
1) How can proprietary information be accepted when the operators carries the risk?
2) Whether ISO 13628 (Parts 2 and 11) are robust enough?
3) Whether the industry spends enough resources for qualification testing?
4) Have we a sufficiently robust level of management integrity?
Terry Rhodes, Shell, noted that the Statoil strategy seemed consistent with industry practice, but that
none of the potential failure modes were likely to be mitigated in the near future. Consequently he
proposed an obsolescence strategy of periodic replacement and out-of-service inspection to help build
in-service knowledge and risk profiles. Steinar Kristoffersen reported that Statoil were replacing
higher risk risers in line with such a philosophy.
Andrea Mangiavacchi, consultant, asked about water depth of these failures and it was confirmed
that these were in the range 100 m to 350 m.
Alf Reidar Johansen of OGP noted the comment that ISO 13628-2 and 13628-11 may not be robust
enough, and questioned how can we know what is sufficiently robust, and how can we capture this
in these standards? Steinar Kristoffersen reported that these technical committees struggle with
this issue as the committee seek to get a consensus view which is often a compromise minimum set
of requirements that the operators may then add further requirements to. Alf Reidar Johansen
responded that you can always publish an ISO standard with one-third of the balloting countries
voting against. While delegates agreed this was true, in practice there was a desire to ensure all
stakeholders and not just country representatives were broadly in agreement with the contents of new
ISO standards.
56 © OGP
Jim Brekke, ABS, added some thoughts on drilling risers for floating rigs. The starting point for the
industry was API 2Q (2nd Edition, 1984) Recommended practice for design and operation of marine
drilling riser systems, which was updated in 1993 to API 16Q which itself formed the basis for ISO
13624-1 issued in 2008. The API 16Q committee has recently reconvened to cover issues such as top
tension, pressure effects from choke and kill lines, recoil during disconnect and considerations during
drift-off, vertical dynamics in soft and hard hang-offs, vortex induced vibration, and weak point
analysis to consider what will happen when the system reaches stretch limits on risers.
© OGP 57
11. List of referenced codes and standards
API Spec 16Q Specification for drill through equipment

API Spec 17J Specification for unbonded flexible pipe
API Spec 4F Specification for drilling and well servicing structures
API Bull 2TD Guidelines for tie-downs on offshore production facilities for hurricane season
API RP 2A LRFD Recommended practice for planning, designing and constructing fixed offshore
platforms—load and resistance factor design
API RP 2A WSD Planning, designing and constructing fixed offshore platforms—working stress design
API RP 2EQ Seismic design procedures and criteria for offshore structures
API RP 2FPS Planning designing and constructing floating production systems
API RP 2GEN General requirements for offshore structures
API RP 2L Planning, designing and constructing heliports for fixed offshore platforms
API RP 2MET Derivation of metocean design and operating condition
API RP 2SK Design and analysis of stationkeeping systems for floating structures
API RP 2SM Design, manufacture, installation, and maintenance of synthetic fiber ropes for
offshore mooring
API RP 2T Planning, designing and constructing tension leg platforms
API RP 2TOP Topside structures
API Spec 2C Offshore cranes
BV NR 493 Classification of mooring systems for permanent offshore units (misspelled NI493 once)
DNV-OS-E101 Position mooring systems (“Posmoor”)
DNV-OS-C102 Structural design of offshore ships
DNV-OS-F101 Submarine pipeline systems
DNV-OS-F201 Dynamic risers
DNV-OS-J101 Design of offshore wind turbine structures
ISO 13624-1 Petroleum and natural gas industries—Drilling and production equipment—Part 1: Design
and operation of marine drilling riser equipment
ISO 13628-2 Petroleum and natural gas industries—Design and operation of subsea production systems
—Part 2: Unbonded flexible pipe systems for subsea and marine applications
ISO 13628-11 Petroleum and natural gas industries—Design and operation of subsea production systems
—Part 11: Flexible pipe systems for subsea and marine applications
ISO 19900 Petroleum and natural gas industries—General requirements for offshore structures
ISO 19901-1 Petroleum and natural gas industries—Specific requirements for offshore structures —
Part 1: Metocean design and operating considerations
ISO 19901-2 Petroleum and natural gas industries—Specific requirements for offshore structures—
Part 2: Seismic design procedures and criteria
ISO 19901-3 Petroleum and natural gas industries—Specific requirements for offshore structures
—Part 3: Topsides structure
ISO 19901-7 Petroleum and natural gas industries—Specific requirements for offshore structures—
Part 7: Stationkeeping for floating offshore structures and mobile offshore units
ISO 19902 Petroleum and natural gas industries—Fixed steel offshore structures
ISO 19904-1 Petroleum and natural gas industries—Floating offshore structures—
Part 1: Monohulls, semi-submersibles and spars
58 © OGP
ISO 19905-1 Petroleum and natural gas industries—Site-specific assessment of mobile offshore units—
Part 1: Jack-ups
Part 2: Jack-ups commentary
Part 3: Floating units
ISO 19906 Petroleum and natural gas industries—Arctic offshore structures
ISO 2394 General principles on reliability for structures
MODU IMO mobile offshore drilling units code
Norsok N-004 Design of steel structures
SNAME 5-5A Guidelines for site specific assessment of mobile jack-up units
© OGP 59
Appendix A: List of conference attendees
COMPANY/ORGANISATION NUMBER OF ATTENDEES

2H Offshore 1
ABS 2
Aker 1
Atkins 1
BG Group 1
BlueWater 2
BP 22
BV 2
Cathie Associates SA/NV 1
Chevron 2
CNOOC 3
CNR International 1
Conoco Philips 4
Consultants 2
Digital Structures 1
DNV 3
DONG Energy 2
Eni 1
Eni-Tecnomare 2
Experia 1
ExxonMobil 1
HELACOL 1
HSE 1
KBR/ENERGO 1
KBR 2
LR 1
Maersk Oil 1
Marathon Oil 1
MARIN 1
National University of Singapore 1
GL Noble Denton 3
University of Strathclyde 1
OGP 2
PAFA Consulting Engineers 1
Petroleum Safety Authority 1
Petronas 1
Ramboll 1
SBM 1
Shell 7
Sigma Offshore 1
Statoil 4
R.F. McKenna Associates 1
Texas A&M Univeristy 1
Total 2
University of Calgary 1
University of Texas—Austin 1
WoodGroup 1
Woodside 1
TOTAL 97
60 © OGP
Appendix B: 1995 Structural reliability

conference—summary notes
© OGP 61
For further information and publications, please visit our website at:
www.ogp.org.uk
About us:
OGP is a global organisation that has been active for 209-215 Blackfriars Road
London SE1 8NL
nearly 40 years, facilitating continual improvement in United Kingdom
upstream (exploration and production) health safety Telephone: +44 (0)20 7633 0272
Fax: +44 (0)20 7633 2350
and environmental issues as well as improvements
in engineering and operations. OGP, with offices in 165 Bd du Souverain
London and Brussels, represents publically-traded 4th Floor
B-1160 Brussels, Belgium
private and state-owned oil and gas companies, field Telephone: +32 (0)2 566 9150
service companies and industry associations. Its members Fax: +32 (0)2 566 9159
produce more than half of the world’s oil and over Website: www.ogp.org.uk
one-third of its gas. More information about OGP e-mail: reception@ogp.org.uk
and the production of gas from shale can be found at:
http://www.ogp.org.uk

486 PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

486 PDF

Uploaded by

Copyright:

Available Formats

Workshop proceedings

Reliability of offshore structures—

International Association of Oil and Gas Producers

Consistent high quality database and guidelines

Internationally recognised source of industry information

Reliability of offshore structures—

Note to the user

2. Overview of structural reliability 8

2.2 Corporate risk management 8

2.3 Hazard curves 10

2.4 Global design Standards for offshore structures 11

2.5 Previous industry initiative on structural reliability 15

3. Fixed steel jacket structures 16

3.2 Reliability of fixed structures 16

3.3 Critique of hazard curves for fixed steel jacket platforms 20

3.4 Application of design Standards in Azerbaijan 22

3.5 Specific issues for fixed steel platforms 23

4.2 Reliability of arctic structures 29

4-3 Issues in current Standards for arctic structures 30

5.2 Metocean standards 32

5.3 Directional criteria 33

6.2 Seismic standards 36

6.3 Application of seismic criteria 37

7.2 Platform and foundation behaviour in cyclone events 39

8. Drilling structures including jack-up and MOU 43

8.2 Jack-up and mobile offshore unit (MOU) Standards 43

8.3 Reliability of drilling units 43

9. Floating structures and marine operations 48

9.2 Floating structures standards 48

9.3 Metocean criteria for floating structures 49

9.4 Marine operations 50

9.5 The role and responsibilities of class societies 50

10. Moorings and risers 52

10.2 Mooring standards 52

10.3 Reliability of mooring systems 53

10.4 Standards and reliability of riser systems 55

11. List of referenced codes and standards 58

Appendix A: List of conference attendees 60

Appendix B: 1995 Structural reliability conference—summary notes 61

NOTIONAL ESTIMATED FOR PER ANNUM PROBABILITY OF FAILURE

Non-cyclonic region— Cyclonic region—evacuated— Other regions/comments

Ultimate Limit State—ULS

NOTIONAL ESTIMATED FOR PER ANNUM PROBABILITY OF FAILURE

NOTIONAL ESTIMATED FOR PER ANNUM PROBABILITY OF FAILURE

Floating Production Units and MOU—moorings Comments

OGP or other industry representative organisations

Industry in general or specific organisations

2. Overview of structural reliability

2.2 Corporate risk management

Structural reliability is an integral part of the corporate risk management process.

2.3 Hazard curves

2.4 Global design Standards for offshore structures

Figure 2.4: Exposure levels specified in ISO 19900

2.5 Previous industry initiative on structural reliability

3. Fixed steel jacket structures

3.2 Reliability of fixed structures

By carefully selecting load and resistance factors it was possible to achieve:

3.3 Critique of hazard curves for fixed steel jacket platforms

3.4 Application of design Standards in Azerbaijan

3.5 Specific issues for fixed steel platforms

3.5.1 Joint checks

3.5.2 Grouted connections

3.5.3 Robustness, degradation, integrity management and life extension