Sunteți pe pagina 1din 46
SAFETY OF OFFSHORE STRUCTURES by TORGEIR MOAN Professor Norwegian University of Science and Technology and
SAFETY OF OFFSHORE STRUCTURES by TORGEIR MOAN Professor Norwegian University of Science and Technology and

SAFETY OF OFFSHORE STRUCTURES

by

TORGEIR MOAN

Professor Norwegian University of Science and Technology

and

Keppel Professor National University of Singapore

Centre for Offshore Research & Engineering

National University of Singapore

Professor National University of Singapore Centre for Offshore Research & Engineering National University of Singapore
Keppel Offshore and Marine Lecture November 26. 2004 Safety of Offshore Structures By Professor Torgeir
Keppel Offshore and Marine Lecture
November 26. 2004
Safety of Offshore Structures
By
Professor Torgeir Moan
Director, Centre for Ships and Ocean Structures,
Norwegian University of Science and Technology
Keppel Professor, National University of Singapore
and Ocean Structures, Norwegian University of Science and Technology Keppel Professor, National University of Singapore
and Ocean Structures, Norwegian University of Science and Technology Keppel Professor, National University of Singapore

Foreword

The Second Keppel Offshore & Marine Lecture was delivered by Professor Torgeir Moan at the National University of Singapore (NUS) on 26 November 2004. This report is the written version of the lecture. The Lecture was supported by many professional societies, including American Society of Mechanical Engineers (Singapore Section), The Institution of Engineers Singapore, The Institute of Structural Engineers, The Joint Branch of Royal Institution of Naval Architects and Institute of Marine Engineering Science & Technology, Society of Naval Architects and Marine Engineers Singapore, Singapore Shipping Association and Singapore Structural Steel Society.

The Keppel Professorship in Ocean, Offshore and Marine Technology in NUS was launched officially by His Excellency, President S.R. Nathan of Singapore and Chancellor of NUS on 19 September 2002. The Professorship has been established under the Department of Civil Engineering, and is part of the bigger umbrella of the Centre for Offshore Research & Engineering (CORE) in NUS. CORE has received seed funding from Keppel Offshore & Marine Ltd and Economic Development Board (Singapore). The Centre aims to be a focal point for industry participation and activities in Singapore, and promotes multi-disciplinary research by drawing on the expertise of various universities, research institutes, and centres for integrated R&D.

Professor Moan, the first Keppel Professor, is an academic of international stature through his 30 years of close involvement in the international offshore oil and gas and marine fraternity. He brings a global perspective to promote R&D in Singapore, with a particular emphasis on the technological interests of Keppel Offshore & Marine. He will serve as the beacon of guidance and inspiration for academics as well as industry.

CORE acknowledges the significant support of everyone in Keppel Offshore & Marine, especially Mr Choo Chiau Beng, Mr Tong Chong Heong and Mr Charles Foo, for their immense contributions. CORE is working closely in partnership with Keppel on R&D, Education and Training to draw young talents into the offshore and marine industry.

Safety of Offshore Structures

Torgeir Moan Centre for Ships and Ocean Structures Norwegian University of Science and Technology

Summary

An overview of important developments regarding safety management of offshore structures is given. Based on relevant experiences with accidents, the hazards and the means to control the associated risk are categorized from a technical-physical as well as human and organizational point of view. This includes considerations of the risk associated with fatigue, corrosion and other degrading phenomena. The risk can be controlled by use of adequate design criteria, inspection, repair and maintenance of the structures as well as quality assurance and control of the engineering processes. Such measures are briefly outlined, while the emphasis is placed upon a quantitative design approach for dealing with structural robustness. In this connection the inherent differences in the robustness of various structural concepts are pointed out. The appli- cation of reliability methodology to obtain quantitative measures of structural safety relating to ultimate failure as well as handle the combined effect of design, inspec- tion and repair strategy on fatigue failure is highlighted. The application of risk analysis to establish robustness criteria corresponding to a certain risk acceptance level is briefly mentioned. The challenges of Quality Assurance and Control to new structures are briefly outlined, with particular reference to recent examples of new loading phenomena such as ringing and springing of platforms.

i

1. Introduction

Oil and gas are the dominant sources of energy in our society. Twenty percent of these hydrocarbons are recovered from reservoirs beneath the seabed. Various kinds of platforms are used to support exploratory drilling equipment, and the chemical (production) plants required to process the hydrocarbons. Large production platforms, such as some of those in the North Sea, represent investment of billions of U.S. dol- lars and significant operational costs. Pipelines or tankers are used to transport the

hydrocarbons to shore. This paper is limited to deal with offshore structures, see Fig.

1.

is limited to deal with offshore structures, see Fig. 1. a) Offshore oil and gas exploitation
is limited to deal with offshore structures, see Fig. 1. a) Offshore oil and gas exploitation

a) Offshore oil and gas exploitation

b) Platform for exploratory drilling operation

Fig. 1 Subsea oil and gas exploitation

c) Platform for oil and gas production (chemical processing)

The continuous innovations to deal with new serviceability requirements and demand- ing environments as well the inherent potential of risk of fires and explosions have lead to an industry which has been in the forefront of development of design and analysis methodology. Fig. 2 shows phases in the life cycle of offshore structures. The life cycle of marine systems is similar to that of other systems. In view of the ecologi- cal issue removal or clean-up need to be considered. In this aspect the recycling of the material is an important issue. In the life cycle phases of structures the design phase is particularly important. Offshore structures need to fulfil serviceability and safety re- quirements. Serviceability requirements depend upon the function of the structure, which is to provide a platform and support of equipment for drilling or for the produc- tion of hydrocarbons. Drilling units need to be mobile while production platforms are generally permanent. Production platforms are commonly designed to carry large chemical factories together with large hydrocarbon inventories (Fig. 1c). Safety re-

1

quirements are introduced to limit fatalities as well as environmental and property damages.

The focus here is on the structural safety during the life cycle of the platforms. A ra- tional safety approach should be based on:

- Goal-setting; not prescriptive

- Probabilistic; not deterministic

- First principles; not purely experimental

- Integrated total; not separately

- Balance of safety elements; not hardware

not separately - Balance of safety elements; not hardware Design for - serviceability & - producability
not separately - Balance of safety elements; not hardware Design for - serviceability & - producability
not separately - Balance of safety elements; not hardware Design for - serviceability & - producability
Design for - serviceability & - producability - safety Fabrication - Fabrication plan - -
Design
for
- serviceability &
- producability
- safety
Fabrication
-
Fabrication plan -
- Inspection/repair
Operation
-
Operation plan
Inspection/
monitoring/
repair /
maintenance

Reassessment

Removal and reuse

Data, methods,

criteria

Layout/

Scantlings

Fabrication &

Operation

data

Fig. 2: Life cycle phases of offshore structures

The safety management of structures is different for different industries depending on the organisation as well as regulatory contents. For instance the safety management of offshore structures differs from that for trading ships. One reason for this difference is the fact that safety management of trading vessels emerged for centuries through em- piricism while off-shore structures have primarily come about in the last 50 years when first principles of engineering science had been adequately developed to serve as basis for design. Similarly the regulatory regime differs between ships and offshore structures in that offshore operation take place on continental shelves under the juris- diction of the local government. Typically authorities in the continental shelf states have to issue regulations. Examples of these are MMS/API in USA, HSE in UK and NPD in Norway. However the provisions for stability and other maritime issues are based on those of IMO and their corresponding national organizations. Classification societies primarily provide rules for drilling units and services for production facili- ties, which primarily are handled by national authorities. Since early 1990s ISO has been developing a harmonized set of codes for offshore structures with contribution from all countries with major offshore operations.

Over the time safety management of offshore structures has been developed, in paral- lel with the evolvement of the technology and the competence to deal with it. Initially civil engineering was the driving force for structural safety management. Later the

2

aeronautical and nuclear industries also played an important role. However in the last 20-30 years the developments in the offshore industry has had a significant impact on the development of safety approaches. This is partly because the offshore industry plays a key role in the “world’s economy”. Moreover the oil and gas represent energy with large potential accident consequences. Companies involved in structures and/or facilities that experience accidents may suffer loss of reputation and this may damage the public’s trust on the companies.

The rationalisation of safety management of offshore structures began in early 70’s. Among the milestones is the introduction of Risk Analysis in 1981 and Accidental Collapse Design criterion in 1984 by the Norwegian Petroleum Directorate and the HSE Safety case approach in 1992, when the ALARP principle - as large as reasona- bly practicable – was introduced for determining the target safety level.

To limit the likelihood of fatalities and environmental and property damages, offshore structures should be designed, fabricated and operated in such a manner that the prob- ability of the following failure modes is adequately small:

- overall, rigid body instability (capsizing) under permanent, variable and envi- ronmental loads

- failure of (parts of) the structure foundation or mooring systems, considering permanent, variable, and environmental as well as accidental loads

Stability requirements for floating platforms affect the layout and the internal struc- ture – subdivision in compartments. Criteria to prevent progressive structural failure after fatigue failure or accidental damage would have implications on overall layout of all types of platforms. Otherwise a structural strength criterion affects the scant- lings of the stiffened, flat, and cylindrical panels that typically constitute floating off- shore structures.

If the location is far off shore then evacuation and rescue will be difficult. On the other hand, this implies that accidents on offshore facilities affect the general public to a lesser extent than accidents on similar facilities on land.

In the following sections accident experiences on offshore structures will be briefly explained. Then, an outline of various measures to manage the safety or ensure that the risk is within acceptable limits, is given. This includes: Design and inspection criteria as well as reliability methodology to calibrate the partial safety factors to cor- respond to a defined acceptable safety level. In particular it is explained how fatigue failures can be avoided by design as well as inspections and regular monitoring of the structure. Emphasis is placed on how structural robustness can be ensured by using so-called Accidental Collapse Limit State (ALS) criteria. Such criteria are exempli- fied in relation to fires, explosions and other accidental loads. Finally, Quality Assur- ance and/or Quality Control of the engineering process will be described with particu- lar reference to dealing with unknown wave loading and response phenomena.

2. Accident Experiences

2.1 Accident experiences at large

Safety may be regarded as the absence of accidents or failures. Hence the insight about safety features can be gained from detailed information about accidents and failures. To learn about the intrinsic nature of accidents, it is mandatory to study the detailed accounts provided from investigations of catastrophic accidents since the

3

necessary resources are then spent to investigate such accidents. Such studies include those of the platforms Alexander Kielland in 1980 (ALK, 1981, Moan and Holand, 1981b), Ocean Ranger in 1982 (OR, 1984), Piper Alpha in 1988 (PA, 1990), and P-36 in 2001 (P-36, 2003). See also Bea (2000a, 2000b). In addition, the statistics about offshore accidents, such as ones given in WOAD (1996), provide an overview.

Global failure modes of concern are

- capsizing/sinking

- structural failure

- positioning system failure

the former two modes represent catastrophic events while the latter one is only critical for Tension-leg platforms. Global failures normally develop in a sequence of technical and physical events. However, to fully understand accidents it is necessary to interpret them in the view of human and organizational factors (HOF). This includes possible deficiencies in relevant codes, possible unknown phenomena that have materialized as well as possible errors and omissions made in engineering processes, fabrication processes or in the operation itself.

cesses, fabrication processes or in th e operation itself. a) Alexander L. Kielland before and after
cesses, fabrication processes or in th e operation itself. a) Alexander L. Kielland before and after

a) Alexander L. Kielland before and after capsizing in 1980

Alexander L. Kielland before and after capsizing in 1980 b) Model of Ocean Ranger, which capsized

b) Model of Ocean Ranger, which capsized in 1982, during survival testing

c) Piper Alpha fire and explosion in 1988

survival testing c) Piper Alpha fire and explosion in 1988 d) P - 36 accident in

d) P - 36 accident in 2001

Fig. 3: Examples of accidents which resulted in a total loss.

Let us consider an example: The platform shown in Figure 4a in the Gulf of Mexico. This is one of many platforms that were damaged during the passage of the hurricane Lilli. Physically there is no doubt that this accident was due to extreme wave forces. To explain from a human and organizational point of view why the platform was not strong enough to resist the wave forces, we have to look at the decisions that were made during the design phase regarding loads, load effects, resistance and safety fac- tors. The explanation might be that design was based on an inadequate wave condi- tions or load calculation. The damage could also be due to the occurrence of a particu- lar a wave phenomenon, such as an abnormal wave crest (see Fig. 4b) or another “un- known” wave phenomenon. In the case of the exceptional wave in Fig. 4b, the ques- tion is whether the extreme crest height of 18.5 m should be considered as the so- called “freak” wave or simply a rare wave. Alternatively, the reason could be inade- quate air-gap provided in the design. Yet another explanation might be that an im- proper strength formulation was used (as was the case in design of early generation platforms). Finally, the safety factors might not have been sufficient to cover the in- herent uncertainties. For each of these possible causes, two explanations need to be

4

considered, namely 1) The state of art in offshore engineering was inadequate at the time of design ; 2) Errors and omission were made during design or fabrication! Ob- viously, these two explanations have different implications on the risk reducing ac- tions.

In this connection it is noted that several types of environmental load phenomena, such as green water on deck and slamming (Fig. 4 c-d) are subjected to large uncer- tainties. In general, if the phenomenon is known but subject to significant uncertain- ties, the design approach taken is normally conservative.

ties, the design approach taken is normally conservative. a)Severe damage caused on a jacket platform in

a)Severe damage caused on a jacket platform in the Gulf of Mexico by Hurricane Lilli

a jacket platform in the Gulf of Mexico by Hurricane Lilli 18 5 b) Wave record

18

5

b) Wave record from a platform site in the North Sea on January 1. 1995.

from a platform site in the North Sea on January 1. 1995. c ) Green water

c) Green water and deck slamming on FPSO

January 1. 1995. c ) Green water and deck slamming on FPSO d) Deck slamming on

d) Deck slamming on semi- submersible platform

Fig. 4 Structural damage due to environmental loads

The technical-physical sequence of events for the Alexander Kielland platform was:

fatigue failure of one brace, overload failure of 5 other braces, loss of column, flood- ing into deck, and capsizing. For Ocean Ranger the accident sequence was: flooding through broken window in ballast control room, closed electrical circuit, disabled bal- last pumps, erroneous ballast operation, flooding through chain lockers and capsizing. Piper Alpha suffered total loss after: a sequence of accidental release of hydrocarbons, as well as escalating explosion and fire events. P-36 was lost after: an accidental re- lease of explosive gas, burst of emergency tank, accidental explosion in a column, progressive flooding, capsizing and sinking after 6 days.

Table 1 shows accident rates for mobile (drilling) and fixed (production) platforms according to the initiating event of the accident WOAD (1996). Table 1 is primarily based upon technical-physical causes. Severe weather conditions would normally af- fect capsizing/ foundering as well as structural damage. In most cases there existed human errors or omissions by designers, fabricators or operators of the given installa- tion was a major contributor to the accident. The most notable in this connection is, of course accidents caused by loads such as ship impacts, fires and explosions which should not occur but do so because of errors and omissions during operation.

In general, accidents take place in sequences. For floating platforms, the loss of buoy- ancy and stability is commonly an important aspect of total loss scenarios. Structural damage can cause progressive structural failure or flooding. Progressive flooding at-

5

tributes to a greater probability of total loss of floating structures than progressive structural failure.

Degradation due to corrosion and fatigue crack growth are gradual phenomena. How- ever, if the fatigue life is insufficient to make Inspection, Monitoring, Maintenance and Repair (IMMR) effective or if there is lack of robustness, fatigue can cause catas- trophic accidents, see Fig. 5. Both cases shown in Fig.5 occurred for statically deter- minate platforms. In other situations through-the-thickness cracks were detected by inspections before they caused catastrophic failures (Moan, 2004). Corrosion is not known to have caused accidents with floating offshore structures of significance. On the other hand, maintenance related events for floating structures is limited. We need to be aware of this problem, especially for structures with a low fatigue life.

Table 1: Number of accidents per 1000 platform-years. Adapted after WOAD

(1996).

 

World wide

Gulf of Mexico

North Sea

Type of

Mobile

Fixed

Fixed

Fixed

accident

1970-79 /80-95

1970-79 /80-95

1970-79 /80-95

1970-79 /80-95

Blowout

18.8/ 11.4

2.5/0.9

2.2/1.0

2.6/1.6

Capsizing/

24.0/ 19.5

0.5/0.8

0.3/1.1

2.6/0.5

foundering

Collision / contact

24.6/ 14.6

1.6/1.0

1.3/0.7

5.1/6.3

Dropped object

4.2/ 6.1

0.5/0.8

0.1/0.4

10.3/10.6

Explosion

7.4/3.3

0.7/1.6

0.3/0.4

2.6/8.3

Fire

12.3/

2.0/7.5

1.0/7.8

18.0/42.5

11.9

Grounding

6.1/3.3

-

-

-

Spill/release

4.9/5.9

1.8/8.7

1.0/5.8

23.1/98.3

Structural damage

25.6/ 18.4

0.5/0.6

0.4/0.5

10.3/6.0

damage 25.6/ 18.4 0.5/0.6 0.4/0.5 10.3/6.0 Ranger I, 1979 Ranger I, 1979 Column D Column D
Ranger I, 1979 Ranger I, 1979
Ranger I, 1979
Ranger I, 1979
Column D Column D Column D ”Missing braces” ”Missing braces” ”Missing braces” – – –
Column D
Column D
Column D
”Missing braces”
”Missing braces”
”Missing braces”
– –
that cause no
that cause no
that cause no
redundancy
redundancy
redundancy
Alexander Kielland, 1980 Alexander Kielland, 1980
Alexander Kielland, 1980
Alexander Kielland, 1980

Fig. 5: The total losses of Ranger I in 1979 and Alexander Kielland in 1981 were initiated by fatigue failure

6

Annual frquency of an event

Annual frquency of an event

Annual frquency of an event

with N or more fatalities

with N or more fatalities

with N or more fatalities

An overall picture of the accident rate in an industry may be displayed by the so- called Frequency-Consequence diagram as shown in Figure 6. The horizontal axis is plotted the consequence, in this case in terms of fatalities, N. The vertical axis is shown the frequency of N or more fatalities per accident. We see that the accident rate for mobile drilling units is much higher than for fixed production platforms. Fixed platforms are mainly used as production facilities. Moan and Holand (1981b) ex- plained the main reasons for the differences in safety levels between mobile and fixed platforms. Floating production platforms are not included because of the limited ex- perience with such platforms. The risk is similar that that of passenger vessels and tankers.

10

10

10

10

10

10

10

10

10

10

10

10

10

10

10

10

10

10

0

0

0

-1

-1

-1

-2

-2

-2

-3

-3

-3

-4

-4

-4

-5

-5

-5

Marginally acceptable Marginally acceptable Acceptable Acceptable Oil platforms Oil platforms Mobile Mobile Fixed
Marginally acceptable
Marginally acceptable
Acceptable
Acceptable
Oil platforms
Oil platforms
Mobile
Mobile
Fixed
Fixed
Passenger
Passenger
ferries
ferries
(not ro-ro)
(not ro-ro)
Tankers
Tankers
Merchant
Merchant
vessels
vessels
1 1
10
10
100
100
1000
1000
10000
10000

Number of lives lost, N

Number of lives lost, N

Fig. 6: Comparison of experienced overall accident rates with respect to fatalities in the offshore and shipping industries

2.2 Human and organizational factors

Basically, structural failure occurs when the resistance, R is less than the load effect, S as indicated in Fig. 7. From a Human and Organizational Factor (HOF) point of view this can be due to too small safety factors to account for the normal uncertainty and variability in R and S relating to design criteria. But the main causes of actual structural failures are the abnormal resistance and accidental loads due to human er- rors and omissions.

Design errors materialise as a deficient (or excessive) resistance, which cannot be derived from the parameters affecting the “normal” variability of resistance. Fabrica- tion imperfections (such as cracks, plate misalignment, etc.), which also affect the resistance, are influenced by human actions. The “normal” variability of welders per- formance, environmental conditions, and soon lead to a “normal” variability in the imperfection size. This is characterised by a smooth variation of the relevant imper- fection parameter. Occasionally a deviation from “normal practice” does occur, for instance as an abnormality caused by using a wet electrode, or another gross fabrica- tion error. The Alexander L. accident in 1980 was caused by a fatigue failure of a brace and design checks had not been carried out. The implied fatigue life was further reduced – to 3.5 years - by a fabrication error (70 mm weld defect) as well as inade- quate inspections (ALK, 1981). Although the fatigue failures that had been experi- enced in semi-submersibles in the period 1965-70 resulted in fatigue standards, these

7

standards were not properly implemented even for platforms built in the 1970’s. Many platforms built in the 1970’s had joints with design fatigue lives as low as 2-5 years. This fact was evidenced in the extraordinary surveys undertaken after Alexan- der Kielland accident. The same happened to the first purpose built FPSO and shuttle tankers put into service in the mid-1980’s. However, ships are obviously more robust or damage-tolerant than mobile semi-submersible platforms.

Man-made live loads also have a “normal” and an “abnormal” component. While some loads, notably fires and explosions, ship collisions, etc. do not have a normal counterpart, they are simply caused by operational errors or technical faults. The mo- bile platform Ocean Ranger capsized in the offshore of Newfoundland in 1982. The accident was initiated by control room window breaking due to wave slamming. The water entering the control room lead to the short circuit of the ballast valve system, thereby leading to a spurious operation of ballast valves. The resulting accidental bal- last condition could not be controlled partly because of lack of crew training and partly because of inadequate ballast pumps, and open chain lockers (OR, 1984).

The catastrophic explosion and fire on the Piper Alpha platform in 1988 was initiated by a gas leak from a blind flange of a condensation pump that was under maintenance but not adequately shut down (PA, 1990). The main issue that caused the initiation of this accident was the lack of communication between the maintenance team and the control room operators. The gas ignited and the initial explosion lead to damage of an oil pipe and subsequent oil fires and explosions.

In 2001 the platform P-36 in Brazil experienced a collapse of the emergency drainage tank, accidental explosion and subsequent flooding capsizing and sinking. A series of operational errors were identified as the main cause of the first event and also the sinking (P-36, 2001).

It is a well known fact that the gross errors dominate as the cause of accidents, and therefore appropriate control measures should be implemented. It is found that the gross errors cause 80-90% of the failure of buildings and bridges and other civil engi- neering structures (Matousek and Schneider, 1976). The same applies to offshore structures.

R R & D & D Risk Risk reduction reduction Unknown material or Unknown material
R R
& D
& D
Risk
Risk
reduction
reduction
Unknown material or
Unknown material or
Do the job
Do the job
Do the job
Do the job
load phenomenon
load phenomenon
properly in
properly in
properly in
properly in
the first place
the first place
the first place
the first place
Causes
Causes
QA/QC
QA/QC
QA/QC of
QA/QC of
Design
Design
Abnormally
Abnormally
Design error
Design error
design
design
of design
of design
error
error
Failure
Failure
- -
oversight of load
oversight of load
low
low
QA/QC of
QA/QC of
Fabrication
Fabrication
R R
< S
< S
… …
QA/QC
QA/QC
resistance
resistance
operation
operation
error
error
Operational error
Operational error
of the as-
of the as-
Event
Event
- -
accidental load
accidental load
fabricated
fabricated
control
control
structure
structure
(leak, etc)
(leak, etc)
ULS: R C /γ
> γ
S
+ γ
S
ULS: R C /γ R > γ S1 S C1 + γ S2 S C2
R
S1
C1
S2
C2
FLS: D=Σn i /N i ≤ D allowable
FLS: D=Σn /N
≤ D
ALS
ALS
i
i
allowable
Inadequate safety factors for
Inadequate safety factors for
design
design
normal variability of R and S
normal variability of R and S
check
check
Apply adequate safety factors
Apply adequate safety factors
in ULS/FLS design check
in ULS/FLS design check

Fig. 7 Interpretation of causes of structural failure and risk reduction measures.

8

It has been observed that errors and omissions occur especially in dealing with novel materials and concepts as well as during periods with economic and time pressures.

In some cases, accidents have been caused by inadequate engineering practice such as the lack of knowledge regarding new phenomena. Recently new phenomena such as ringing and spinning of TLPs, degradation failure mechanism of flexible risers, have been discovered. Nevertheless they were observed in time before any catastrophic accident could occur.

3. Safety Management

3.1 General

Offshore drilling, production or transport facilities are systems consisting of struc- tures, equipments and other hardware’s, as well as specified operational procedures and operational personnel. Ideally these systems should be designed and operated to comply with a certain acceptable risk levels as specified for example by the probabil- ity of undesirable consequences and their implications. The safety management needs to be synchronised with the life cycle of the structure. Structural failures are mainly attributed to errors and omissions in design, fabrication and, especially, during opera- tion. Therefore, Quality Assurance and Control (QA/QC) of procedures and the struc- ture during fabrication and use (operation) is crucial.

To do a truly risk based design, by carrying out the design iteration on the basis of a risk acceptance criterion, and to achieve a design that satisfies the acceptable safety level, is not feasible. In reality, different subsystems, like:

- loads-carrying structure & mooring system

- process equipment

- evacuation and escape system

are designed according to criteria given for that particular subsystems. For instance, to achieve a certain target level, which implies a certain residual risk level, safety criteria for structural design are given in terms of Ultimate Limit State (ULS) and Fatigue Limit State (FLS) criteria. Using appropriate probabilistic definitions of loads and resistance together with safety factors, the desired safety level is achieved. The im- plicit risk associated with these common structural design criteria is generally small! The philosophy behind the Accidental Collapse Limit (ALS) criteria is discussed be- low.

The nature of human errors differs from that of natural phenomena and “normal” man-made variability and uncertainty. Different safety measures are required to con- trol error-induced risks. A number of people maintain that gross errors are “Acts of God” and cannot be dealt with.

However,

- weld defects and fatigue failures due to gross errors had occurred before the Kiel- land accident

- ballast errors had occurred before the Ocean Ranger accident

- fires and explosions had occurred before the Piper Alpha accident

and so on

9

The occurrence of gross errors have been avoided by adequate competence, skills, attitude and self-checking of those who do the design, fabrication or operation in the first place; and by exercising “self-checking” in their work.

In addition, quality assurance and control should be implemented in all stages of de- sign, fabrication and operation. While the QA/QC in the design phase is concerned with scrutinizing the analysis, design checks and the final scantlings arrived at, the QA/QC during fabrication and operation phases refers to inspection of the structure itself.

As mentioned above, operational errors typically result in fires or explosions or other accidental loads. Such events may be controlled by appropriate measures such as de- tecting the gas/oil leakage and activating shut down valve; extinguishing of a fire by an automatically-activated deluge system. These actions are often denoted as “Event Control”.

Finally, Accidental Collapse Limit State criteria are implemented to achieve robust offshore structures, that is to prevent that the “structural damage” occurring as fabri- cation defects or due to accidental loads, escalate into total losses (Moan 1994).

Table 2 summarises the causes of structural failure from a risk management point of view, and how the associated risk may be ameliorated.

Adequate evacuation and escape systems and associated procedures are crucial for controlling failure consequences in terms of fatalities.

Table 2: Causes of structural failures and risk reduction measures

Cause

Risk Reduction Measure

Less than adequate safety margin to cover “normal” inherent uncertain- ties.

- Increased safety factor or margin in ULS, FLS;

- Improve inspection of the structure(FLS)

Gross error or omission during

- Improve skills, competence, self- checking (for d, f, o)

- design (d)

- QA/QC of engineering process (for d)

- fabrication (f)

- Direct design for damage tolerance (ALS) – and provide adequate damage condition (for f, o)

- operation (o)

- Inspection/repair of the structure (for f, o)

Unknown phenomena

- Research & Development

3.2 Design and inspection criteria

Adequate performance of offshore structures is ensured by designing them to comply with serviceability and safety requirements for a service life of 20 years or more, as well as carrying out load or response monitoring, or inspection and taking the neces- sary actions to reduce loads directly or indirectly, by, e.g., removal of marine growth, or to repair, when necessary.

Serviceability criteria are introduced to make the structure comply with the functions required. These criteria are commonly specified by the owner. Production platforms are usually made to be site- specific, while drilling units are commonly intended for operation in specific regions or world wide.

10

Safety requirements are imposed to avoid ultimate consequences such as fatalities and environmental or property damages. Depending upon the regulatory regime, separate acceptance criteria for these consequences are established. Property damage is meas- ured in economic terms. Fatalities and pollution obviously also have economic impli- cations. In particular, the increasing concern about environmental well-being can cause small damages to have severe economic implications. While fatalities caused by structural failures would be related to global failure, i.e. capsizing or total failure of deck support, smaller structural damages may result in pollution; or property damage which is costly to repair such as the damages of an underwater structure. The current practice which is implemented in new offshore codes, issued e.g. by API (1993/97), ISO 19900 (1994-) and NORSOK (1998a, 1998b, 1999, 2002) as well as by many classification societies, and the most advanced codes are characterized by

- design criteria formulated in terms of limit states (ISO 19900, 1994) – see Table 3

- semi-probabilistic methods for ultimate strength design which have been cali- brated by reliability or risk analysis methodology

- fatigue design checks depending upon consequences of failure (damage- tolerance) and access for inspection

- explicit accidental collapse design criteria to achieve damage-tolerance for the system

- considerations of loads that include payload; wave, current and wind loads, ice (for arctic structures), earthquake loads (for bottom supported structures), as well as accidental loads such as e.g. fires, explosions and ship impacts

- global and local structural analysis by finite element methods for ultimate strength and fatigue design checks

- nonlinear analyses to demonstrate damage tolerance in view of inspection plan- ning and progressive failure due to accidental damage

Fatigue crack growth is primarily a local phenomenon. It requires stresses to be calcu- lated with due account of the long-term wave conditions, global behaviour as well as the geometric stress concentrations at all potential hot spot locations, and suitable fatigue criteria (e.g. Miner’s rule). Fatigue strength is commonly described by SN- curves, which have been obtained by laboratory experiments. Fracture mechanics analysis of fatigue strength have been adopted to assess more accurately the different stages of crack growth including calculation of residual fatigue life beyond through- thickness crack, which is normally defined as fatigue failure. Detailed information about crack propagation is also required to plan inspections and repair.

11

Table 3 Limit State Criteria for safety – with focus on structural integrity

L L im it states im it states P P h ysical ap pearance h
L
L
im it states
im it states
P
P
h ysical ap pearance
h ysical ap pearance
Rem arks
Rem arks
of failure m ode
of failure m ode
U
U
ltim
ltim
ate
ate
(ULS )
(ULS )
D
D
iffe rent fo r bo ttom
iffe rent fo r bo ttom
-O verall “rigid
-O verall “rigid
bod y”
bod y”
supported, or buoyant
supported, or buoyant
stability
stability
C o llap sed
structures.
structures.
-
-
U ltim a te
U ltim a te
streng th
streng th
of
of
C
C
om p onent design
om p onent design
check
check
cylin d er
structu re, m oo ring
structu re, m oo ring
or
or
p
p
o ssib le
o ssib le
fo u n d a tio n
fo u n d a tio n
F
F
atigue
atigue
(FLS )
(FLS )
C
C
om p onent design
om p onent design
check
check
-
-
-
F
F
ailu re
ailu re
of w e lded
of w e lded
jo ints
jo ints
F a tig ue
fracture
depe nding
depe nding
on residual
on residual
due to repe titive loads
due to repe titive loads
system
system
strength and
strength and
access
access
fo r inspe ction
fo r inspe ction
A
A
ccidental co llapse
ccidental co llapse
(ALS )
(ALS )
S
S
yste m
yste m
design
design
ch eck
ch eck
Jack-up
-
-
U ltim a te
U
ltim a te
cap acity 1 ) of
cap acity
1 )
of
co llap sed
dam ag ed structure w ith
dam ag ed structure w ith
“credible” da m a ge
“credible” da m a ge

An adequate safety against fatigue failure is ensured by design as well as by inspec- tions and repairs. Fatigue design requirements depends upon inspect ability and fail- ure consequences. Current requirements for fatigue design check in NORSOK are shown in Table 4. These values were established by the NPD code committee in 1984 by judgement.

Table 4 Fatigue design factor, FDF to multiply with the planned service life to obtain the required design fatigue life (NORSOK N-001, 2002).

 

Access for inspection and repair

 

No access or in the splash zone

Accessible (inspection according to generic scheme is carried out)

Below splash zone

Above splash zone or internal

Substantial

     

consequences

10

3

2

Without substantial consequences

3

2

1

1) The consequences are substantial if the Accidental Collapse Limit State (ALS) criterion is not satisfied in case of a failure of the relevant welded joint considered in the fatigue check.

Traditionally we design for dead-loads, payloads as well as environmental loads. But, loads can also be induced by human errors or omissions during operation – and cause accidental loads. They commonly develop though a complex chain of events. For instance hydrocarbon fires and explosions result as a consequence of an acciden- tal leak, spreading, ignition and combustion process. Accidental Collapse Limit State (ALS) requirements are motivated by the design philosophy that “small damages, which inevitably occur, e.g. due to ship impacts, explosions and other accidental loads, should not cause disproportionate consequences”.

12

The first explicit requirements were established in Britain following the Ronan Point apartment building progressive failure in 1968. In 1984 such criteria were extended by NPD, to include such robustness criteria for the structure and mooring system. While robustness requirements to the mooring are generally applied today, explicit ALS criteria are not yet widespread. The World Trade Centre and other recent catas- trophes have lead to further developments of robustness criteria for civil engineering structures. See Figure 8.

ALS checks should apply to all relevant failure modes as shown in Figure 9. It is in- teresting in this connection to note that ALS-type criteria were introduced for sinking/ instability of ships long before such criteria were established for structural integrity as such. Thus, ALS were introduced in the first mobile platform rules (as described e.g. by Beckwith and Skillman, 1976). The damage stability check has typically been specified with damage limited to be one or two compartments flooded. According to NPD this damage should be estimated by risk analysis, as discussed subsequently. The criterion was formally introduced for all failure modes of offshore structures in Norway in 1984 (NPD, 1984).

of o ffshore structures in Norway in 1984 (NPD, 1984). • Ronan point appartment building accident,

Ronan point

appartment building

accident, 1968

• Flixborough explosion,

1974

• ECCS model codes,

1978

• Alexander L. Kielland accident, 1980

• NPD Regulations for Risk analysis, 1981

NPD’s ALS criterion,

1984

• HSE Safety Case, 1992

WTC, September 11., 2001

Motivation: Motivation: ”small damages, ”small damages, which inevitably occur, which inevitably occur, should
Motivation:
Motivation:
”small damages,
”small damages,
which inevitably occur,
which inevitably occur,
should not cause
should not cause
disproportionate
disproportionate
consequences!”
consequences!”

a) a)

Flooded Flooded Flooded volume volume volume
Flooded
Flooded
Flooded
volume
volume
volume

Applied

Applied

since

since

early

early

codes

codes

Capsizing/sinking due to (progressive) flooding

Capsizing/sinking due to (progressive) flooding

ExplosionExplosion damagedamage Explosion damage
ExplosionExplosion damagedamage
Explosion damage

Gaining

Gaining

acceptance

acceptance

b) Structural failure e.g. due to impact damage,

b) Structural failure e.g. due to impact damage,

Failure of Dynamic

Failure of Dynamic

Positioning System

Positioning System

is handled in a similar

is handled in a similar

manner

manner

One One One One One One Generally Generally tether tether tether mooring mooring mooring applied
One
One
One
One
One
One
Generally
Generally
tether
tether
tether
mooring
mooring
mooring
applied
applied
failed
failed
failed
line failed
line failed
line failed

c) c)

Failure of mooring system due to "premature" failure

Failure of mooring system due to "premature" failure

Fig. 8: Historical development of ALS assessment of structures

Fig. 9: Accidental Collapse Limit State (ALS) requirements

The assessment of structures during operation is necessary in connection with a planned change of platform function, extension of service life, occurrence of overload damage due to hurricanes (Dunlap and Ibbs, 1994), subsidence of North Sea jackets (Broughton, 1997), explosions, fires and ship impact, updating of inspection plans etc (ISO 19900). Basically, the reassessment involves the same analyses and design checks as carried out during initial design. However, depending upon the inherent damage tolerance ensured by the initial design, the measures that have to be imple- mented to improve the strength of an existing structure may be much more expensive than ones for a new structure. This fact commonly justifies more advanced analyses of loads, responses, resistances as well as use of reliability analysis and risk-based ap- proaches than in the initial design (Moan, 2000a).

13

3.3 Inspection, Monitoring, Maintenance and Repair

Inspection, Monitoring, Maintenance and Repair (IMMR) are important measures for maintaining safety, especially with respect to fatigue, corrosion and other deteriora- tion phenomena. To ensure structural integrity within the offshore sector in the North Sea, the regulatory body defines the general framework while the audit of the oil companies or rig owners defines: inspection and maintenance needs, reports planned activity, findings and evaluates conditions annually and every fourth or fifth year. Hence, the inspection history of a given structure is actively incorporated in the plan- ning of future activities. The inspection and repair history is important for a rational condition assessment procedure of the relevant structure and other, especially for “sis- ter” structures.

The objective of inspections is to detect cracks, buckling, corrosion and other dam- ages. Overload phenomena are often associated with a warning for which the inspec- tion can be targeted, while degradation needs continuous surveillance. However, nor- mally ample time for repair will be available in the latter cases.

An inspection plan involves:

- prioritizing which locations are to be inspected

- selecting inspection method (visual inspection, Magnet Particle Inspection, Eddy Current) depending upon the damage of concern

- scheduling inspections

- establishing a repair strategy (size of damage to be repaired, repair method and time aspects of repair)

Whether the inspection should be chosen to aim at detecting cracks by non-destructive examination (NDE), close visual inspection, detect through-thickness cracks e.g. by leak detection, or member failures would depend on how much resources are spent to make the structure damage tolerant. The choice again would have implication on the inspection method. The main inspection methods being the NDE methods consist of detection of through-thickness crack by e.g. leak detection, and visual inspection by failed members. The quality of visual inspection of NDE methods depends very much upon the conditions during inspection. A large volume offshore structure is normally accessible from the inside, while members with a small diameter such as TLP tethers and joints in jacket braces, are not.

Permanent repairs are made by cutting out the old component and butt welding a new component, re-welding, adding or removing scantlings, brackets, stiffeners, lugs or collar plates.

Typically major inspections of offshore structures (special surveys, renewal surveys) are carried every 4 - 5 th year, while intermediate and annual inspections are normally less extensive. Further refinement of the inspection planning has been made by intro- ducing probabilistic methods as described below.

Inspection, monitoring and repair measures can contribute to the safety only when there is a certain damage tolerance. This implies that there is an interrelation between design criteria (fatigue life, damage tolerance) and the inspection and the repair crite- ria. Fatigue design criteria, hence, depend upon inspection and failure consequences as shown e.g. by Table 4.

However, during the operation, the situation is different. The strengthening of the structure by increased scantlings is very expensive. The most relevant measure to in- fluence safety relating to fatigue and other degradation phenomena is by using an im-

14

proved inspection method or increased frequency of inspections. The following sec- tion briefly describes how fatigue design and inspection plans (based on an assumed inspection method) can be established by reliability analysis to ensure an acceptable safety level.

3.4 Quantitative Measures of Safety

Ideally the structural safety should be measured in a quantitative manner. Structural reliability methods are applied to determine the failure probability, P f which is asso- ciated with normal uncertainties and variability in loads and resistance. Quantitative risk assessment can be used to deal with the probability of undesirable events and their consequences in general terms. This includes events induced by errors and omis- sions, see Fig. 10.

Structural reliability analysis

Load effect Load effect f f S (s) (s) S Resistance f Resistance f R
Load effect
Load effect
f f S (s)
(s)
S
Resistance f
Resistance f R (r)
(r)
R
r,s
r,s
Prob. density function
Prob. density function
Deck Deck Deck Column Column Column R,S R,S Wave Wave Wave pressure pressure pressure P
Deck
Deck
Deck
Column
Column
Column
R,S
R,S
Wave
Wave
Wave
pressure
pressure
pressure
P F =P[R≤S]

Uncertainty in R and S can be modelled by probability density

Quantitative risk analysis End End events events CriticalCritical CriticalCritical CriticalCritical eventevent
Quantitative risk analysis
End
End
events
events
CriticalCritical
CriticalCritical
CriticalCritical
eventevent
eventevent
eventevent
Fault
Fault
Fault
Event
Event
Event
tree
tree
tree
tree
tree
tree
Consequences

Fig. 10: Methods for quantifying the risk or safety level

The quantitative safety approach is based on estimating the implied failure probability

and comparing it with an acceptance level.

upon the following factors (e.g. Moan, 1998):

- type of initiating events (hazards) such as environmental loads, various accidental

This target safety level should depend

loads,

which may lead to different consequences

- type of SRA method or structural risk analysis, especially which uncertainties are included

- failure cause and mode

- the possible consequences of failure in terms of risk to life, injury, economic losses and the level of social inconvenience.

- the expense and effort required to reduce the risk.

In principle a target level which reflects all hazards (e.g. loads) and failure modes

) as well as the different phases (in-place operation and tempo-

rary phases associated with fabrication, installation and repair) is defined with respect to each of the three categories of ultimate consequences. The most severe of them governs the decisions to be made. If all consequences are measured in economic terms, then a single target safety level could be established. However, in practice it is convenient to treat different hazards, failure modes, and phases separately, with sepa- rate target levels. This may be reasonable because it is rare that all hazard scenarios

(collapse, fatigue,

15

and failure modes contribute equally to the total failure probability. The principle of establishing target levels for each hazard separately was adopted by NPD for acciden- tal loads; see e.g. Moan et al. (1993b). It was also advocated by Cornell (1995). In general it is recommended to calibrate the target level to correspond to that inherent in structures which are considered to have an acceptable safety.

3.5 Structural reliability analysis

General

Structural reliability methods for calculating the failure probability are readily avail- able. If the uncertainty in the resistance R and load effect S are described by probabil- ity density functions. The failure probability can be calculated as P (R<S). It is impor- tant to recognize that there are different types of uncertainties used to determine the resultant uncertainties associated with loads and resistances. One type of uncertainty (Type 1) is natural or inherent; this type of uncertainty is ‘information insensitive’ and random. A second type of uncertainty (Type 2) is associated with modelling, paramet- ric, and state uncertainties; this type of uncertainty is ‘information sensitive’ and sys- tematic. Type 2 model uncertainties may be defined as the ratio of the actual or true value of the variable to the predicted or nominal (design) value of the variable. A va- riety of methods can be used to characterize the model uncertainty, including field test data, laboratory test data, numerical data, and ‘expert’ judgment. Often it is not possi- ble to develop explicit separations of Type 1 and Type 2 uncertainties and it is impor- tant not to include them twice.

SRA is applied to determine the failure probability considering fundamental variability, as well as uncertainties due to the lack of knowledge in loads, load effects and resistance. The state of the art methods for calculating the failure probability are the numerical First Order and Second Order Reliability as well as Monte Carlo simulation methods (e.g. Melchers, 1999). However, analytical solutions exists for a few cases, for instance, when failure is expressed by g( ) =R – S 0 and both the resistance R and the load effect S are lognormal random variables.

The failure probability is expressed by:

P

f

=

P

(

g

()

≤ = Φ −β

0)

(

)

or

β = −Φ

1

(

P

f

)

(1)

where Φ(-β) is the standard cumulative normal distribution, with numerical values as shown in Table 5, and the reliability index, β = β LN can be exactly written as follows, see e.g. Melchers (1999):

β

=

LN

⎡ 2 ⎤ µ 1+ V R S ln ⎢ ⎥ 2 ⎢ µ 1+
2
µ
1+
V
R
S
ln ⎢
2
µ
1+
V
S
R
⎦ ⎥
2
2
ln[(1+
V
R )(1+
V
S )]

ln ( µ /µ ) R S 22 VV + R S
ln
(
µ
)
R
S
22
VV +
R
S

= β

'

LN

(2)

This simple expression has turned out to be useful and was applied in the API reliabil- ity based code calibration (Moses, 1987). The analytical formulation can also conven- iently be used to express the relationship between P f and safety factors.

16

Table 5 Relation between β

and P f .

β

1.0

1.4

1.8

2.2

2.6

3.0

3.4

3.8

4.2

4.6

P

f

0.16

0.081

0.036

0.014

0.47 10 -2

0.14 10 -2

0.34 10 -3

0.72 10 -4

0.13 10 -4

0.21 10 5

Reliability estimates are found to be sensitive to the distributions used for R and S.

The failure probability should refer to a time interval, e.g. a year or the service life. This can be achieved by considering a load effect S that refers to an annual or service life time maximum value. We note that the results of code calibration depend upon the choice of reference period.

Reliability based code calibration

Reliability methods are increasingly used to make optimal decisions regarding safety and the life cycle costs of offshore structures (see e.g. ISSC, 1988-1994; Moan, 1994). In particular the efforts by Fjeld (1977); Lloyd and Karsan (1988), Moan (1988), Jor- dan and Maes (1991) to calibrate their codes to a certain reliability. An evaluation of previous efforts on calibration of offshore codes was provided by Moan (1995) in conjunction with the ISO effort to harmonize the safety level in codes for offshore structures across the variety of structural types (ISO, 1994). However, safety factors on loads are not properly varied to reflect the differences in uncertainty in load predic- tions for different types of structures.

To illustrate the relationship between partial safety factors, the uncertainty in resis- tance and loads as well as P f , consider the simplest design format, often used in code calibration,

(3)

where R c and S c are characteristic resistance and load effect, respectively. Let the (true) random load effect, S and resistance, R be defined by their mean value (µ) and the coefficient of variation (V):

R /γ

c

R

γ S

Sc

µ=

S

µ=

R

B S

SC

,B

S

B

R

RC

,B

R

1;

1;

V

S

=

0.15

V

R

=

0.1

0.30

The B S reflects the ratio of the mean load (which refers to an annual maximum if the annual failure probability is to be calculated,) and the characteristic load effect (typi- cally the 100 year value) as well as a possible bias in predicting wave load effects, e.g. due to model uncertainty.

By inserting the design equation Eq.(3) into the approximate expression of Eq.(2)

β

LN

′ ln ( µ /µ ) ln (B γ γ /B ) R S RRS
′ ln
(
µ
)
ln
(B γ
γ
/B
)
R
S
RRS
S
=
22
22
VV +
VV +
RS
RS

or

γ R

γ

= (B /B

SSR

)

exp

(β

'

LN

22 V +V R S
22
V
+V
R
S

)

(4)

With γ R γ S = 1.5; a typical B S = 0.8 for wave-induced load effects; B R = 1.1 and V R = 0.1, it is found that βLN is about 3.2 for a V S of 0.20. This reliability index corre- sponds to a P f of 6 10 -4 . By decreasing B R /B S by 10 % reduces βLN by 15%. It is noted that the Similarly, by increasing V s by 10 % reduces βLN by 8%. At the same time it is noted that the uncertainty in R has minimal influence on the safety level. Yet it is important to estimate the mean bias of the resistance, B R accurately. It is also pos- sible to approximately express R and S by (B R , V R ) and (B S , V S ), respectively, and

17

hence to express partial factors by the relevant uncertainties. (e.g. Melchers, 1999).

It is important to recognize that variables used in designing offshore structures are

often ‘conservative.’ Thus, there exists sources of ‘bias’ that must be recognized quantitatively by the B i 's.

Target

Target

P

P f or β

or β

f

Goal: Implied P f ≅ P ft Goal: Implied P ≅ P WSD: WSD: WSD:
Goal: Implied P f ≅ P ft
Goal: Implied P ≅ P
WSD:
WSD:
WSD:
f
ft
R C /γ > D C + L C + E C
R
/γ > D
+ L
+ E
C
C
C
C
R
R
— resistance
— resistance
D, L, E — load effects due to
D, L, E — load effects due to
permanent
permanent
LRFD:
LRFD:
LRFD:
live
live
load
load
R C /γ R > γ D D C + γ L L C + γ E E C
R
> γ
D
+ γ L
+ γ
E
C
R
D
C
L
C
E
C
environmental
environmental
effects
effects
Load ratio, E c /(L +E )
Load ratio, E c /(L c +E c )
c
c

Fig. 11: Schematic illustration on how the implied safety level in a design code for ultimate strength can be calibrated to be close to a given target level.

Fatigue Reliability Analysis

Structural reliability methods can also be used to calculate the probability of fatigue failure. In Figure 12 the solid line with diamond symbol shows the fatigue failure probability in the service life as a function of the design criterion – the fatigue design factor, FDF. It is shown that the cumulative failure probability in the service life var- ies from 10 -1 to 10 -4 when FDF varies from 1 to 10.

1.0E+00 Cumulative failure probability Cumulative, stdv(lnA)=0.15 1.0E-01 Cumulative, stdv(lnA)=0.3 A nnual failure
1.0E+00
Cumulative failure probability
Cumulative, stdv(lnA)=0.15
1.0E-01
Cumulative, stdv(lnA)=0.3
A nnual failure probability
A nnual, stdv(lnA )=0.15
1.0E-02
A nnual, stdv(lnA )=0.3
1.0E-03
1.0E-04
1.0E-05
1.0E-06
1
2
3
4
5
6
7
8
9
10
Failure probability

Fatigue de s ign factor

Fig. 12: Fatigue failure probabilities in the 20 year service period, as a function of the fatigue design factor and the uncertainty level. A is an equivalent constant stress range that represents the long term stress level (Moan, 2004).

A consistent fatigue safety level can be achieved, by varying the FDF versus the ef-

fect of an inspection program as well as the consequences of failure.

18

Reliability estimates by account of inspection

The effect of the inspection on the reliability level can be illustrated by representing the crack depth using a random variable, A(t) which is a function of time t. The qual- ity of the inspection in terms of the detectable crack size is also represented by a ran- dom variable, A d . The distribution of A d corresponds to the Probability of Detection (POD) curve for the inspection method in question.

The failure probability at the time, t (N-cycles) can be formulated

P

f

()

t

= P(a

- a

fN

0) = P

[( )]

F

0, t

(5)

where a f and a N are the crack size at failure and after N cycles, respectively.

The outcomes of inspections are assumed to be no crack detection (ND) or crack de- tection (D) at time t after N cycles, which are described by:

I

I

ND

()

t

D

()

t

:a

:a

N

-a

Nd

-a

d

0

0

(6a)

(6b)

In general, it is difficult to determine the distribution of the crack size (A) explicitly when taking into account all uncertainties that affect the distribution as well as the effect of inspections. Based on the Paris’ crack propagation law, Eqs. (5-6) can be recasted into a convenient form for analysis as shown e.g. by Madsen and Sørensen

(1990).

The effect of inspection may be viewed in two different ways depending upon whether it is assessed before inspections are done, e. g. during the design phase, or afterwards during operation. If the effect of inspections is estimated before they are carried out, two outcomes: D and ND are possible. The exact outcome is not known but the probability of the outcomes can be estimated based on the reliability method.

At the design stage, the outcomes (e.g., crack detection or no detection) are not known. When a single inspection is assumed to be made at time t I and possible cracks detected are repaired, the failure probability in the period t t I can be determined by:

P (t)= P F(0,t ) +P S(0,t ) and F(t ,t) | I (t ) ⋅+P I (t )

f

I

I

I

D

I

D

I

[

]

[

]

[

]

[

P S(0,t )and F(t ,t) | I

I

1

ND

]

(t ) P

I

[

I

ND

(t )

I

]

(7)

where F(t 1 ,t 2 ) and S(t 1 ,t 2 ) are, respectively, mean failure and survival in time period (t 1 ,t 2 ). Equation (7) can be generalised to cover cases with several inspections with two alternative outcomes. Moan et al. (1993a) showed, based on reliability analysis, how the allowable cumulative damage (D) at the design stage can be relaxed when inspections are carried out. Such analyses served as basis for Table 4.

On the other hand if no failure has occurred before time t I and it is known that no crack is detected at time t I , then the failure probability in the period t t I is

P (t) = P

f

[

F(t ,t) | I

I

ND

(t )

I

]

(8)

The knowledge of survival up to time t I and no crack detection at time t I reduces the uncertainty and makes the failure probability drop. The reliability index β increases at the time of inspection as illustrated by the example shown in Fig. 13.

19

7 7 Event tree analysis Event tree analysis Basic case, No inspection Basic case, No
7
7
Event tree analysis
Event tree analysis
Basic case, No inspection
Basic case, No inspection
6
6
Upd, full inspection history
Upd, full inspection history
Upd, ONLY last inspection
Upd, ONLY last inspection
Inspection
Inspection
5
5
during
during
operation with
operation with
No
No
crack detection
crack detection
4
4
3
3
No inspection
No inspection
2
2
Effect of Inspection
Effect of Inspection
predicted at design stage
predicted at design stage
1 1
0 0
5
5
10
10
15
15
20
20
Time (years)
Time (years)
Reliability Index
Reliability Index

10

10

3×10

3×10

-3

-3

-3

-3

3.5×10

3.5×10

P P

f f

-2

-2

Fig. 13: Reliability index as a function of time and inspection strategy. Inspection Event Tree analysis is based on predictions at the design stage. The other curves are based on inspections with known outcome during the service life (Ayala-Uraga and Moan, 2002)

The updating methodology is useful in connection with extension of service life for structures with joints governed by the fatigue criterion (Vårdal et al, 2000). In such

cases, the design fatigue life is in principle exhausted at the end of the planned service life. Nevertheless, if no cracks have been detected during inspections, then a remain- ing fatigue life can be demonstrated. However, it is not possible to bring the structure back to its initial condition by inspection only. This is because the mean detectable crack depth by NDE methods typically is 1.0 – 2.0 mm, while the initial crack depth

is 0.1 – 0.4 mm.

The calculation of the system failure probability after inspection may be approxi- mated by independent system failure modes (Moan et al., 1999, 2002, 2004)

P

FSYS|up

= P

.

[

FSYS | I

][

P FSYS(U) +

]

n

j=1

P

⎣ ⎡

F | I

j

⎤⎡⋅

⎦⎣

P FSYS(U) | F

j

⎦ ⎤

+

(9)

This formulation is based on modeling the ultimate failure of the system by a single mode. Moreover, the formulation is limited to failure modes initiated by a single fa-

tigue failure and followed by ultimate global failure. The failure probability in Eq. (9)

is applicable when the inspection event I aims at detecting cracks before the failure of

individual members, (i.e. before they have caused rupture of the member). Another inspection strategy would be to apply visual inspection to detect members failure and repair failed members after the winter season in which those particular members failed. In this case the Eq. (9) will have to be modified as follows: the individual fa- tigue failures of components (F j ) does not depend on the inspection event, and, rather such an inspection and repair strategy will have implication on the time period, for which the failure probability P[FSYS(U)|Fj] should be calculated.

A further simplification is to update the failure probability of each joint based on the

inspection result for that joint. This is conservative if no cracks are detected, but non-

conservative if cracks are detected.

Inspections may be prioritized by using Eq. (9) for each joint separately by allowing a

20

certain target probability level, P fSYS(T) to each term in the sum of Eq. (9). The target fatigue failure probability for joint i, P FfT(i) is then obtained from

P

fSYS(i)

= P[FSYS | F ] P

i

FfT(i)

P

fSYS(T)

(10)

where the system failure probability, P fSYS(i) is associated with a fatigue failure of member (i) followed by an ultimate system failure. P fSYS(T) is obtained by generalizing the acceptance criteria implied by Table 4. This approach has been implemented for template-space frame structures (Moan et al., 1999). Given the target level for a given joint, inspections and repairs by grinding or other modifications are scheduled to maintain the reliability level at the target level as shown in Fig. 14.

No inspection Inspection at time t=8 with no crack detection Target level for a given
No
inspection
Inspection at time t=8
with no crack detection
Target level
for a given joint
0
4
8
12
16
20
Time (years)
1st inspection
2nd inspection
level, βReliability

Fig. 14: Scheduling of inspections to achieve a target safety level of P FfT(i) .

This methodology is used to calibrate fatigue design requirements. It is then found that the criteria in Table 4 are slightly “non-conservative”.

3.6 Safety implications of Ultimate and Fatigue Limit State criteria and Inspection, Monitoring, Maintenace and Repair

The failure probability estimated by structural reliability analysis (SRA) normally does not represent the experienced P f for structures. This is because the safety factors or margins normally applied to ensure safety are so large that P f calculated by SRA becomes much smaller than that related to other causes. For instance when proper fatigue design checks and inspections have not been carried out, the likelihood of fa- tigue failures (through-thickness cracks) for platforms (e.g. in the North Sea), is large and cracks have occurred. However, with the exception of the Ranger I (1979) and Alexander Kielland failure (1980) such cracks have been detected before they caused total losses. As discussed above, errors and omissions in design, fabrication and op- eration represent the main causes of the accidents experienced.

On the other hand, frequent occurrences of cracks provide a basis for correlating ac- tual crack occurrences with state of art predictions for various offshore structures. Hence, the current predictions for jackets are found to be conservative (Vårdal and Moan, 1997), while for semi-submersibles and ships, the predictions seem to be rea- sonable, as summarized by Moan (2004). This agreement is achieved when the SN approach (or a calibrated fracture mechanics approach) is applied to predict the occur- rence of fatigue failure (e.g. through thickness crack). Yet, if ULS and FLS design checks are properly carried out, P f will be “negligible” within the current safety re- gime. This reserve capacity, implied by ULS and FLS requirements, provides some

21

resistance against other hazards like fires, explosions etc. However providing safety for the mentioned hazards in this indirect manner is not an optimal risk-based design. If more efforts were directed towards risk reduction actions by implementing ALS criteria, then current safety factors for ULS and FLS could be reduced without in- creasing the failure rate noticeably.

As explained above, SRA does not provide a measure of the actual total risk level associated with offshore facilities. Yet, it is useful in ensuring that the ultimate strength and fatigue design criteria are consistent by calibrating safety factors. More- over, SRA provides a measure of the influence of various parameters on the reliability and, hence, the effect of reducing the uncertainty on the failure probability.

Finally, it is noted that the random uncertainties in the ultimate strength commonly have limited effect on the reliability compared to that inherent in load effects. On the other hand, the systematic uncertainty (bias) in strength and load effects has the same effect on the reliability measure.

3.7 Risk assessment

Risk assessment (Qualitative Risk assessment or Formal Safety Analysis etc.) is a tool to support decision making regarding the safety of systems. The application of risk assessment has evolved over 25 years in the offshore industry (Moan and Holand, 1981b, NPD (1981)). The Piper Alpha disaster (PA, 1990), was the direct reason for introducing PRA, (or QRA), in the UK in 1992 (HSE, 1992). In the last 5 years such methods have been applied in the maritime industry, albeit in different directions (Moore et al. 2003). The offshore industry has focused on the application of risk as- sessment to evaluate the safety of individual offshore facilities. The maritime industry has primarily focused on the application of risk assessment to further enhance and bring greater clarity to the process of making new ship rules or regulations.

The risk assessment methods is used because they provide a reliable direct determina- tion of events probabilities e.g. probabilities as low as 10 -4 per year. Up to now the accumulated number of platform years world wide is about 120 000, 15 000 and 1 200 for fixed, mobile structures and FPSOs, respectively. However, to determine prob- abilities as low as 10 -4 per year requires about 23000 years of experiences to have a 90% chance of one occurrence. A further complexity is that the available data refer to various types of platforms and, not least, different technologies over the years. Appli- cation of a systems risk assessment is therefore attractive. The basis for this approach is the facts that : a)almost every major accidental events have originated from a small fault and gradually developed through long sequences or several parallel sequences of increasingly more serious events, and culminates in the final event b) it is often reasonably well known how a system responds to a certain event.

By combining the knowledge about system build-up with the knowledge about failure rates for the elements of the system, it is possible to achieve an indication of the risks in the system (Vinnem, 1999; Moan, 2000b).

The risk analysis process normally consists in the following steps (Fig 15):

- definition and description of the system

- identification of hazards

- analysis of possible causal event of hazards

- determination of the influence of the environmental conditions

- determination of the influence of active/passive safety systems (capacity; reliabil- ity, accident action integrity, maintenance system … )

22

- estimation of event probabilities/event magnitudes

- estimation of risk Risk Analysis Planning Risk Analysis Planning Risk Analysis Planning Risk Analysis
- estimation of risk
Risk Analysis Planning
Risk Analysis Planning
Risk Analysis Planning
Risk Analysis Planning
System Definition
System Definition
System Definition
System Definition
Risk
Risk
Risk
Risk
Acceptance
Acceptance
Acceptance
Acceptance
Risk
Risk
Risk
Risk
Criteria
Criteria
Hazard Identification
Hazard Identification
Criteria
Criteria
Hazard Identification
Hazard Identification
Reducing
Reducing
Reducing
Reducing
Measures
Measures
Measures
Measures
Frequency
Frequency
Consequence
Consequence
Analysis
Analysis
Analysis
Analysis
RISKRISK ESTIMATIONESTIMATION
RISKRISK ESTIMATIONESTIMATION
RISK ESTIMATION
RISK ESTIMATION
Risk Picture
Risk Picture
Risk Picture
Risk Picture
RISKRISK ANALYSISANALYSIS
RISKRISK ANALYSISANALYSIS
RISK ANALYSIS
RISK ANALYSIS
Risk Evaluation
Risk Evaluation
Risk Evaluation
Risk Evaluation
Unacceptable
Unacceptable
Tolerable
Tolerable
Acceptable
Acceptable
Acceptable
Acceptable

Fig. 15: General approach for risk based decision making

In most cases an Event-Fault Tree technique (Figure 16) is the most appropriate tool for systematizing and documenting the analyses made. Although the Event-Fault tree methodology is straightforward, there are many problems. An important challenge is to determine the dominant of the (infinitely) many sequences. Events are not uniquely defined in a single sequence but appear in many combinations. Moreover, human fac- tors are difficult to account for in the risk assessment. However, operational errors that result in accidental loads are implicitly dealt with by using data on experienced releases of hydrocarbons, probability of ignition etc. Explicit prediction of design and fabrication errors and omissions for a given structure is impossible. However, it is possible to rate the likelihood of accidents as compared to gross errors (Bea, 2000a-b, Lotsberg et al., to appear).

The risk analysis methodology currently applied in offshore engineering is reviewed in detail by Vinnem (1999). In connection with accidental loads, the purpose of the risk analysis is to determine the accidental events which annually are exceeded by a probability of 10 -4 .

End event Critical event Fault tree Event tree Consequences
End
event
Critical
event
Fault tree
Event tree
Consequences

Fig.16

Schematic sketch of the event – fault tree method.

23

3.8

Failure probability implied by Accidental Collapse Limit State Criteria

The initial damage in the ALS criterion, (e.g. due to fires explosions, ship impacts, or, fabrication defects causing abnormal fatigue crack growth), corresponds to a charac- teristic event for each of the types of accidental loads which is exceeded by an annual probability of 10 -4 , as identified by risk analyses. The (local) damage, or permanent deformations or rupture of components need to be estimated by accounting for nonlinear effects.

The structure is required to survive in the various damage conditions without global failure when subjected to expected still-water and characteristic sea loads which are exceeded by an annual probability of 10 -2 . In some cases compliance with this re- quirement can be demonstrated by removing the damaged parts and then accomplish- ing a conventional ULS design check based on a global linear analysis and component design checks using truly ultimate strength formulations. However, such methods may be very conservative and more accurate nonlinear analysis methods should be applied, as described subsequently.

The conditional probability of failure in a year, for the damaged structure, can be es- timated by Eqs. (1-2), assuming that the system failure can be modelled by one failure mode and that the design criterion is fully utilized. The design checks in the ALS cri- terion is based on a characteristic value of the resistance corresponding to a 95% or 5% fractile, implying a B R = 1.1. The characteristic load effect due to functional and sea loads are 1.0-1.2 and 1.2-1.3 of the corresponding mean annual values, respec- tively. The safety (load and resistance) factors are generally equal to 1.0 for both checks. For environmental loads, this conditional failure probability will be of the order of 0.1.

The intended probability of total loss implied by the ALS criterion for each category of abnormal strength and accidental load would then be of the order of 10 -5 (Moan, 1983). Obviously, such estimates are not possible to substantiate by experiences.

3.9 Design for damage tolerance

Introduction

The current regulations for offshore structures in Norway are based on the following principles:

- Design the structure to withstand environmental and operational loading through- out its lifecycle.

- Prevent accidents and protect against their effects

- Tolerate at least one failure or operational error without resulting in a major haz- ard or damage to structure

- Provide measures to detect, control, and mitigate hazards at an early time acciden- tal escalation.

Accidental Collapse Limit State criteria can be viewed as a means to reduce the con- sequences of accidental events (Fig. 17). The NORSOK N-001 code specifies quanti- tative ALS criteria based on an estimated damage condition and a survival check. The robustness criteria in most other codes, however, do not refer to any specific hazard but rather require that progressive failure of the structure with one element removed at a time, is prevented. Hence, no performance objective for a “real threat” is created.

24

The weakness with such a criterion is that it does not distinguish between the differ- ences in vulnerability

In a risk analysis perspective the ALS check of offshore structures is aimed at pre- venting progressive failure and hence reduce the consequences due to accidental loads, as indicated in Figure 17. Beside progressive structural failure, such events may induce progressive flooding and hence the capsizing of floating structures.

Risk control of accidental events Reduce probability Reduce consequences "unknown "known events"
Risk control of accidental events
Reduce probability
Reduce consequences
"unknown
"known
events"
events"
Indirect design
Reduce
Direct ALS design
- robustness
errors &
- Abnormal resistance
Event
- redundancy
omissions
- Accidental loads
Control
- ductility
Risk Analysis, or,
Prescriptive code requirements

Fig. 17: The role of ALS in risk control

• • Estimate the damage due to accidental loads (A) Estimate the damage due to
• •
Estimate the damage due to accidental loads (A)
Estimate the damage due to accidental loads (A)
P, F
P, F
P, F
P, F
at
at an annual probability of 10
an
annual
probability
of
10 -4
-4
A
A
A A
- apply risk analysis to establish
- apply risk analysis to establish
A A
design accidental loads
design accidental loads
Critical
Critical
event
event
Fault
Fault
Event tree
Event tree
tree
tree
P,P, FF
P,P, FF
End events:
End events:
Accidental loads
Accidental loads
• •
Survival check of the damaged structure as a whole,
Survival check of the damaged structure as a whole,
considering P, F and
considering P, F and
environmental loads ( E ) at a probability of 10
environmental loads ( E ) at a probability of 10 -2
-2
Target annual probability of total loss:
Target annual probability of total loss:
10 -5 for
10
-5
for each type of hazard
each type of hazard
E E

Fig. 18: Accidental Collapse Limit State (NPD, 1984)

The relevant accidental loads and abnormal conditions of structural strength are drawn from the risk analysis, see e.g. Vinnem (1999) and Moan (2000b), where the relevant factors that affect the accidental loads are accounted for. In particular, the risk reduction can be achieved by minimizing the probability of initiating events:

leakage and ignition (that can cause fire or explosion), ship impact, etc. or by mini- mizing the consequences of hazards. The passive or active measures can be used to control the magnitude of an accidental event and, thereby, its consequences. For in- stance, fire loads are partly controlled by sprinkler/inert gas system or firewalls. Fenders are commonly used to reduce the damage due to collisions.

ALS checks apply to all relevant failure modes as indicated in Table 6. An account of accidental loads in conjunction with the design of the structure, equipment, and safety systems is a crucial safety measure to prevent escalating accidents. Typical situations where direct design may affect the layout and scantlings are indicated by Table 7 for different subsystems:

- loads-carrying structure & mooring system

- process equipment

- evacuation and escape system

25

Table 6 Examples of accidental loads for relevant failure modes of platforms.

Structural

Failure mode

Relevant accidental load or condition

concept

Fixed platforms

Structural failure

 

All

 

Structural failure

 

All

Floating

Instability

Collision, dropped object, unintended pressure…, unintended ballast that initiate flooding

platforms

Mooring system strength

Collision on platform

Abnormal strength

Tension-leg plat-

Structural failure

 

All

forms

Mooring - slack system - strength

Accidental actions that initiate flooding

Collision on platform

 

Dropped object on tether

(Abnormal strength)

Table 7 Design implications of accidental loads for hull structure

Load

Structure

Equipment

Passive protection system

Fire

Columns /deck (if not pro- tected)

Exposed equipment (if not protected)

Fire barriers

Explosion

Topside (if not protected)

Exposed equipment (if not protected)

Blast / Fire barriers

Ship

Waterline structure (subdivi- sion) (if not protected)

Possibly exposed risers, (if not protected)

Possible fender

impact

systems

Dropped

 

Equipment on deck, risers and subsea (if not pro- tected)

Impact

object

Deck Buoyancy elements

protection

Design accidental loads

The characteristic value of accidental loads is defined as the load which annually is exceeded by a probability of 10 -4 and should be determined by risk analysis. For each

physical phenomenon (fire, explosions, collisions,

) there is normally a continuous

spectrum of accidental events. A finite number of events have to be selected by judgement. These events represent different load intensity at different probabilities.

The characteristic accidental load on different components of a given installation can be determined as follows (Moan, 2000b):

- establish exceedance diagram for the load on each component

- allocate a certain portion of the reference exceedance probability (10 -4 ) to each component

- determine the characteristic load for each component from the relevant load exceedance diagram and reference probability.

If the accidental load is described by several parameters (e.g. heat flux and duration for a fire; pressure peak and duration for an explosion) design values may be obtained from the joint probability distribution by contour curves (NORSOK N-003, 1999).

26

However, in view of the uncertainties associated with the probabilistic analysis, a more pragmatic approach is sufficient. Yet significant analysis efforts are involved in identifying the relevant design scenarios for the different types of accidental loads.

For each design accident scenario, the damage imposed on the offshore installation needs to be estimated followed by an analysis of the residual ultimate strength of the damaged structure in order to demonstrate survival of the installation. To estimate damage, (permanent deformation, rupture etc of parts of the structure), the nonlinear material and the geometrical structural behaviour need to be accounted for. While in general the nonlinear finite element methods are applied, simplified methods (e.g. based on plastic mechanisms) are developed and calibrated using more refined meth- ods, to limit the computational effort required.

The risk analysis of novel structures and systems, is found to be useful, in that they provide insight which results in systems that have significant increase in safety at the same expense. This applies in particular to the topside system. However, for mature systems, the outcomes of risk analyses tend to confirm the results of previous analy- ses. This fact together with the desire to simplify design practice suggests using spe- cific, generic values for such cases. Examples of typical values for some accidental loads are given in subsequent sections.

Analysis tools for estimating the initial damage and survival

Current ultimate strength code checks of marine structures are commonly based on load effects (member and joint forces) that are obtained by a linear global analysis. Experiments or theory which accounts for plasticity and large deflections are used to obtain resistances of the members and joints. Hence, this methodology focuses on the first failure of a structural component and not the overall collapse of the structure, which is of main concern. The advent of computer technology and the finite element method have made it possible to develop analysis tools that account for nonlinear geometrical and material effects, and, therefore, make it possible to account for redis- tribution of the forces and subsequent component failures until the system’s collapse. By using such methods a more realistic measure of the overall strength of structures is achieved. Recently, Skallerud and Amdahl (2002) prepared a state-of-the-art review of methods for nonlinear analysis of space frame offshore structures. Paik and Tha- yamballi (2003) gave an overview of methods for ultimate strength analysis of steel- plated structures.

Simplified methods for calculating the hull girder strength are based on considerations of the intact longitudinal elements and beam theory, essentially based on Smith’s work (1977), and reviewed by e.g. Yao et al. (2000). Such an approach has also been extended to estimate the ultimate capacity of the damaged hull girder (Smith, 1977). However, it is necessary to further investigate the implication of an initial damage that involves rupture and, hence, represent an initial crack type damage which could cause rupture before reaching the ultimate capacity obtained by calculation models based upon ductile material behaviour.

Fires and explosions effects

The dominant fire and explosion events are associated with hydrocarbon leak from flanges, valves, equipment seals, nozzles etc. As indicated in Fig. 19 fire and explo- sion events are strongly correlated. Commonly the effect of 40 – 60 scenarios needs to be analyzed. This means that the location and magnitude of relevant hydrocarbon

27

leaks, the likelihood of ignition, as well as the combustion and temperature develop- ment (in a fire) and the pressure-time development (for an explosion) need to be esti- mated and followed by a structural assessment of the potential damage.

No damage No Ignition Damage to Personnel and Material Immediate Ignition Release of Gas and/or
No damage
No Ignition
Damage to
Personnel and
Material
Immediate Ignition
Release of
Gas and/or
Fire
Liquid
Fire
Formation of
Combustible Fuel-Air
Cloud (Pre-mixed)
Ignition
Gas Explosion
(delayed)
Fire and
BLEVE

Fig. 19: Fire and explosion scenarios.

The fire thermal flux may be calculated on the basis of the type of hydrocarbons, its release rate, combustion, time and location of ignition, ventilation and structural ge- ometry, using simplified conservative semi-empirical formulae or analyti- cal/numerical models of the combustion process. The heat flux may be determined by empirical, phenomenological or numerical method (SCI, 1993; BEFETS, 1998). Typical thermal loading in hydrocarbon fire scenarios may be 200- 300 kW/m 2 for a 15 minutes up to a two hours period. The structural effect is primarily due to the re- duced strength with increasing temperature. An A-60 fire protection wall may be ap- plied for a heat load of 100kW/m 2 and less, while H-rated protection walls are needed for higher heat loading.

In the case of explosion scenarios, the analysis of leaks is followed by a gas disper- sion and possible formation of gas clouds, ignition, combustion and the development of overpressure. Tools such as FLACS, PROEXP, or AutoReGas are available for this purpose (Moan, 2000b; Czujko, 2001, Walker et al., 2003). The variability of condi- tions is accounted for by using a probabilistic approach.

The results from the gas explosion simulations are the pressure – time history. If the pressure duration is short compared to the natural period, the pressure impulse gov- erns the structural response. Figure 20 compares the predicted impulse by state of a state of the art CFD method with measured values in large scale tests for deterministic explosion scenarios. The vertical axis is a logarithmic plot of the ratio of the predicted and measured value. The scattering is seen to be significant. The pressure peaks would obviously be even more uncertain.

28

Ratio of predicted and measured Impulse

Ratio of predicted and measured Impulse

Ratio of predicted and measured Impulse

Ratio of predicted and measured Impulse

10.0

10.0

10.0

10.0

1.0

1.0

1.0

1.0

0.1

0.1

0.1

0.1

Impulse 10.0 10.0 10.0 10.0 1.0 1.0 1.0 1.0 0.1 0.1 0.1 0.1 Experiment No Experiment

Experiment No

Experiment No

Fig. 20: Comparison of predicted and measured pressure impulse for “deterministic” explosion scenarios, obtained by the computer code FLACS.

The typical overpressures for topsides of North Sea platforms are in the range 0.2-0.6 barg, with duration of 0.1-0.5s., while an explosion in open air at the drill floor typi- cally implies 0.1 barg with duration of 0.2s. The explosion pressure in a totally en- closed compartment might be 4 barg.

The damage due to explosions may be determined by simple and conservative single- degree-of freedom models (NORSOK N-004). In several cases where simplified methods have not been calibrated, nonlinear time domain analyses based on numerical methods like the finite element method should be applied. A recent overview of such methods may be found in Czujko (2001). Fig. 21 shows an explosion panel with de- formations as determined by an experiment and finite element analysis. The calcu- lated and measured deflections of the specimen are compared in Figure 21c.

Fire and explosion events that result from the same scenario of released combustibles and ignition should be assumed to occur at the same time, i.e. to be fully dependent. The fire and blast analyses should be performed by taking into account the effects of one on the other. The damage done to the fire protection by an explosion preceding the fire should be considered.

by an explosion preceding the fire should be considered. a) Experiment b) FE analysis 0.7 0.6

a) Experiment

preceding the fire should be considered. a) Experiment b) FE analysis 0.7 0.6 0.5 0.4 0.3

b) FE analysis

0.7 0.6 0.5 0.4 0.3 0.2 0.1 Experiment Analysis 0 0 20 40 60 80
0.7
0.6
0.5
0.4
0.3
0.2
0.1
Experiment
Analysis
0
0
20
40
60
80
100

DISPLACEMENT [mm]

c) Load–response histories

Fig. 21: Explosion response of an explosion wall (Czujko, 2001).

29

P max > 5bar
P max > 5bar

Fig. 22: “Survival analysis” of a deck suffering explosion damage (Amdahl, 2003). Deformations in the lower figure are not to scale.

Fig. 22 shows results from an analysis of a deck structure in a floating platform (Am- dahl, 2003). The upper left figure in this slide illustrates the deck structure of a float- ing production platform. The design pressure on the East Wall is also indicated. In this case it is assumed that the panels are badly damaged that they can be removed. The lower figure shows the deformation pattern of the damaged deck.

Ship impacts

Significant efforts have been devoted to ship-ship collisions, as reviewed by the ISSC Committee on Collision and Grounding (Paik et al., 2003). The analysis of ship im- pacts on offshore structures follows the same principles but the collision scenarios and consequences are different; see e.g. NORSOK N-003 and -004 as well as Amdahl

(1999).

All ship traffic in the relevant area of the offshore installation should be mapped and should account for possible future changes in the operational pattern of vessels. The impact velocity can be determined based on the assumption of a drifting ship or on the assumption of erroneous operation of the ship. Ship traffic may therefore for this pur- pose be divided into categories: trading vessels and other ships outside the offshore activity, offshore tankers, and supply or other service vessels. Merchant vessels are often found to be the greatest platform collision hazard which depends upon the loca- tion of the structure relative to shipping lanes. Fig. 23a indicates situations where off- shore structures are operating in close proximity. For the scenario in Fig. 23b the stern impact on the FPSO by the shuttle tanker is a challenge (Chen and Moan, 2004 )

30

a) Semi- submersible and jacket b) FPSO and shuttle tanker Fig. 23: Special offshore collision
a) Semi- submersible and jacket b) FPSO and shuttle tanker Fig. 23: Special offshore collision

a) Semi- submersible and jacket b) FPSO and shuttle tanker

Fig. 23: Special offshore collision scenarios.

Impact scenarios are established by considering bow, stern, and side impacts on the structure as appropriate. While historical data provides information about supply vessel impacts, risk analysis models are necessary to predict other types of impacts, such as incidents caused by trading vessels (see e.g. NORSOK N-003(1999) and Moan (2000b)). A minimum accidental load corresponding to 14 MJ and 11 MJ sideways and head-on impact, re- spectively, is required to be considered. The impact damage can normally be determined by splitting the problem into two uncoupled analyses. They are the external collision mechanics dealing with global inertia forces and hydrodynamic effects and internal mechanics dealing with the en- ergy dissipation and distribution of damage in the two structures (Fig. 24). The external mechanics analysis is carried out by assuming a central impact and ap- plying the principle of conservation of momentum and conservation of energy. The next step is to estimate how the energy is shared among the offshore structure and the ship. Methods for assessing the impact damage are described by Amdahl (1999), based on simplified load-indentation curves or direct finite element analysis. For the general case where both structures absorb energy, the analysis has to be carried out incrementally on the basis of the current deformation field, contact area and force distribution over the contact area.

contact area and force distribution over the contact area. External mechanics External mechanics R R R
External mechanics External mechanics R R R R i s s i E E E
External mechanics
External mechanics
R R
R R i
s s
i
E E
E E s,i
s,i
s,s
s,s
dw s
dw s
Ship
Ship
FPSO
FPSO
dw i
dw
i
Internal mechanics
Internal mechanics

External mechanics

The fraction of the kinetic energy to be absorbed as deformation energy (structural damage) is

determined by means of:

Conservation of momentum

Conservation of energy

Internal mechanics

Energy dissipated by vessel and offshore structure

Equal force level

Area under force-def. curve

Fig. 24: Simplified methods for calculating impact damage (NORSOK N- 004)

31

The recent advances in computer hardware and software have made nonlinear finite element analysis (NLFEM) a viable tool for assessing collisions. A careful choice of element type and mesh is required. It is found that a particularly fine mesh is required

in order to obtain accurate results for components deformed by axial crushing. A ma-

jor challenge in NLFEM analysis is the prediction of ductile crack initiation and propagation. This problem is yet to be solved. The crack initiation and propagation

should be based on fracture mechanics analysis using the J-integral or Crack Tip Opening Displacement method rather than simple strain considerations.

While the main concern about ship impacts on fixed platforms is the reduction of structural strength and possible progressive structural failure, the main effect for buoyant structures is damage that can lead to flooding and, hence, loss of buoyancy. The measure of such damages is the maximum indentation implying loss of water tightness. However, in the case of large damage, reduction of structural strength, as expressed by the indentation, is also a concern for floating structures.

A ship impact involving the minimum energy of 14 MJ will normally imply an inden-

tation of 0.4 – 1.2 m in a semi-submersible column. A 75-100 MJ impact may be re- quired to cause an indentation equal to the column radius (Moan and Amdahl, 1989). The effect is highly dependent upon the location of impact contact area relative to decks and bulkheads in the column.

Moan and Amdahl (2001) considered supply or merchant vessels with a displacement

of 2000- 5000 tons which caused bow impacts on a typical side structure of an FPSO

with displacement of about 100 000 t. For this case the limiting energy for rupture of the outer ship side was found to be ~10 MJ (700mm bow displacement). The energy

at 1500mm bow indentation was estimated to be ~43 MJ while the limiting energy for

rupture of the inner side is ~230 MJ, at 3700 mm bow displacement. This corresponds

to a critical speed of 18.5 knots for a 5000 tons displacement vessel. We recall that

rupture of plate material is very uncertain such that the quoted energy level should be

used with cautiously. If the FPSO side structure is assumed to be sufficiently rigid to ensure that all energy is absorbed by the bow, then the maximum collision force (peak force) is 30 MN. However most of the time the force oscillates between 15-25 MN.

Another situation dealt with by Moan and Amdahl was stern impact on the FPSO

caused by a shuttle tanker, see Fig. 23b and 25. A 70 kdwt shuttle tanker was found

to penetrate the machine room of a 140 kdwt FPSO after an energy dissipation of 38

MJ. On the other hand, it was demonstrated that it was feasible to strengthen the stern of the FPSO corresponding to ice-strengthening dimensions so that all dissipation could occur in the shuttle tanker bow.

For ca stle dec k Shuttle Up per dec k tanker FPSO
For ca stle dec k
Shuttle
Up per dec k
tanker
FPSO

Fig. 25: Shuttle tanker in ballast condition impacting FPSO stern (Moan and Amdahl,

2001).

32

Environmental events

The ALS criterion is supposed to be applicable to any “abnormal” wave loading as

well. Obviously, the two-step ALS procedure then becomes a survival check based on

a load event which annually is exceeded by a probability of 10 -4 . Consider a wave

loading, F, which for simplicity is characterised only by the wave height, H. Assume that F is a smooth function of wave height. H i.e. F=cH α and that the wave height follows a Weibull distribution with a shape parameter B. If it is assumed that there are

5·10 8 waves in 100 years, the ratio between the loads at a 10 -4 and 10 -2 annual prob- ability level, respectively, becomes F c(-4) /F c(-2) = (H (-4) /H (-2) ) α = (1.23) α/B . The ratio of