## Abstract

Based on relevant accident experiences with oil and gas platforms, structural integrity management of offshore structures is briefly outlined, including adequate design criteria, fabrication and operational procedures, as well as life cycle quality assurance and control. The focus is on developing an operational design standard for accidental collapse limit states to ensure robustness or damage tolerance. The focus is to ensure an acceptable safety level against progressive failure leading to total loss in view of initial damage caused by accidental actions due to operational errors and abnormal structural damage due to fabrication errors and abnormal deterioration during operation as well as the actions on the damaged structure and inherent uncertainties. Moreover, the damage tolerance required for achieving safety by inspection, monitoring and repair strategies, is briefly addressed. While the basic damage tolerance requirement refers to the survival of the structure in certain damage conditions, wider aspects of robustness in terms of the structure’s sensitivity to the deviation of action effects and resistances from normal conditions are also briefly addressed. In particular, it is suggested to provide robustness in cases where the structural performance is sensitive to uncertain parameters, by choosing conservative values of these parameters.

## Introduction

The oil and gas industry provides about 50% of the energy in the world, with about one-third from offshore reservoirs. The continuous technology development in this industry to deal with new serviceability requirements and the challenging environmental and industrial fire and explosion hazards have made this industry a leader in the development of design and analysis methodology for structural integrity assessment.

Current industry practice for the structural integrity management is inspired by motherhood codes [1,2] and is implemented in offshore codes, e.g., see Refs. [35], as well as in standards and guidelines by classification societies.

Structural design criteria refer to serviceability and safety. The latter criteria commonly include ultimate and fatigue limit states (ULS, FLSs). However, service experiences show that accidental actions and abnormal strength due to gross errors or omissions made during design, fabrication, or operation contribute significantly to the risk of failure. Such features are not covered by the ultimate and fatigue limit state criteria. The control of the risk associated with those kinds of events needs a broad safety management approach during the life cycle, including design for damage tolerance [6]. Motherhood design codes [1,2,7,8] have for decades included a statement such as “structures should be designed to be robust.” However, many codes do not specify how such a requirement should be implemented, and others mention that robustness should be achieved by

• designing against accidental actions—through an ultimate strength check

• designing for alternate load paths

• providing ductility

Such formulations, however, are not sufficiently operationalized for the designer to use. Moreover, the existing criteria commonly refer to land-based structures and hence do not cover all failure modes of floating structures. The Norwegian Petroleum Directorate (NPD) introduced the so-called progressive limit state (later denoted as accidental collapse limit state (ALS)) criteria in 1984 [9], with the background explained in Ref. [10]. An important issue is that the structural integrity management takes place under uncertainties. This fact was earlier recognized by the offshore oil and gas industry by adopting risk and reliability methods to aid decision-making. In addition to the uncertainties affecting the predicted behavior under extreme and cyclic load conditions, the inspection is subjected to uncertainty. Structural reliability methods (SRMs) are, hence, crucial to support decisions about safety and economy of degrading structures. Significant developments of structural reliability methodology, including Bayesian updating techniques, have taken place since the 1980s, as outlined in Refs. [1114]. However, SRMs do not include the effect of human errors on structural loads and resistance. Hence, risk assessment methods are needed to deal with probabilities of undesirable events and their consequences in general [15].

The focus of this paper is the design for robustness or damage tolerance to ensure structural integrity during the service life (Fig. 1). A simple definition of robustness is “the ability of a structure to limit the escalation of accident scenarios into accidental conditions with a magnitude disproportionate to the original cause.” Robustness requirements apply to the different failure modes that ultimately can lead to fatalities, pollution, or property loss. Structures supported on the seafloor can experience failure of the structure, foundation, or soil, while buoyant structures can experience capsizing or sinking, hull, or mooring system failure.

Fig. 1
Fig. 1
Close modal

As discussed in the Comments on Robustness, Vulnerability, Redundancy, and Damage Tolerance section, various definitions and measures of these features of structural systems have been proposed. The basis for this paper, however, is to establish a procedure to ensure an acceptable safety level against progressive failure leading to total loss in view of initial damage caused by accidental actions due to operational errors and abnormal structural damage due to fabrication errors and abnormal deterioration during operation as well as the actions on the damaged structure and inherent uncertainties. The focus is on an explicit risk-informed limit state.

As a background for the structural integrity management in general and damage tolerance (robustness) in particular, characteristic safety features based on service experiences of offshore oil and gas structures are first briefly described. Then, the development of a quantitative ultimate limit state for design to ensure structural robustness and hence to reduce the likelihood of progressive failure is outlined. It is based on the consideration of all system failure modes, including the strength of the hull structure and station-keeping system and overall stability, by the use of mechanical systems models and a probabilistic approach to account for inherent uncertainties, indirectly including the effect of human errors. Moreover, damage tolerance relating to design and inspection planning with respect to fatigue failure, simplified probabilistic measure of total loss and target safety levels, as well as the practical application of the ALS approach are briefly addressed.

While the basic robustness requirement refers to the survival of the structure in certain damage conditions, wider aspects of robustness in terms of the structure’s sensitivity to the deviation of action effects and resistances from normal conditions are also briefly addressed.

## Characteristic Features of Offshore Structures

The main features of offshore structures, such as the overall size and layout, are primarily determined by their intended function and safety in their natural and industrial environment, including consideration of met-ocean and hydrocarbon fire and explosion hazards. An overview of design procedures and engineering analyses of different types of offshore structures, such as jackets, semi-submersibles, tension-leg, and spar platforms, is given in Ref. [16].

Safety requirements are specified to avoid fatalities and environmental and property damage and are related to the following failure modes:

• overall, rigid body instability (capsizing) or global collapse of the structure under permanent and variable functional actions as well as environmental and accidental actions.

• failure of (parts of) the structure, foundation, or mooring systems, considering external hazards due to permanent, variable, and environmental and accidental actions and internal hazards due to design and fabrication errors causing abnormal strength.

The fact that structures are located far offshore makes evacuation and rescue difficult, but on the other hand, accidents relating to offshore facilities do not affect the public in general as accidents on land often do.

In principle, the risk-based design could be carried out by achieving a total system (structural layout, scantlings and equipment, procedures, and personnel) that complies with a certain acceptable risk level. Such an approach is, however, not feasible in practice. In practice, different subsystems of oil and gas facilities, such as

• loads-carrying structure and mooring system,

• process equipment, and

• evacuation and escape system

are commonly designed according to risk-based criteria for each subsystem. The acceptance criteria for consequences such as fatalities, environmental damage, or property damage relating to the different subsystems vary between regulatory regimes.

## In-Service Failure Experiences

Safety is the condition of being protected from hazards or other nondesirable outcomes. Safety can also refer to the control of recognized hazards to achieve an acceptable level of risk. Hence, useful insight about safety features can be obtained from investigations of accidents. Examples of accidents with offshore structures are described in Refs. [6,10,15,17,18]. In addition, accident statistics, regularly compiled in WOAD [19], provide an overview of offshore “accident rates.” Unfortunately, only the technical–physical causes of accidents, and not the influence of human and organizational factors (HOFs), are displayed in such accident statistics. Detailed investigations carried out for accidents with significant consequences [2025] are particularly useful in revealing the features of HOFs in accidents.

Catastrophic events like loss of stability or floating ability and global structural failures normally develop in a sequence of technical and physical events (TFE). Structural damage can lead to progressive structural collapse or flooding, which might result in capsizing of buoyant structures. However, to fully explain accident event sequences, it is necessary to interpret them in view of the influence of HOFs in the life cycle of the facility.

To illustrate the interplay between TFE and HOF, consider the basic fact that structural failure occurs when the action effect S exceeds the resistance R. From an HOF point of view, this can occur if too small safety factors or margins are allocated in the design standards to account for the normal uncertainty and variability in S and R for the ULS and FLS criteria. Current safety factors seem to make the failure probability sufficiently small to make the contribution of such uncertainties to actual failures, “negligible.” The main cause of structural failures is abnormal resistance or accidental or abnormal actions due to human errors or omissions (Table 1). Design errors materialize as a deficient (or excessive) resistance, which cannot be derived from the parameters affecting the “normal” variability of resistance. The significant damage to the jacket in Fig. 2(a) was caused during the hurricane Lilli in the Gulf of Mexico by waves hitting platform deck due to too small deck clearance. Several platforms were damaged in Lilli and other hurricanes. Rather attributing the root cause to errors made by the designers in those cases, the accidents arguably were due to deficient specification of wave conditions for design, that is, “an omission” made by the “engineering community at large” that did not recognize available information in the formulation of design standards.

Fig. 2
Fig. 2
Close modal
Table 1

Causes of structural failures and risk reduction measures

CauseRisk reduction measure
Less than adequate safety margin to cover “quantifiable normal inherent uncertainties”
• Increase safety factors or margins in ULS and FLS

• Improve inspection of the structure (FLS)a

Gross errors or omissions during:
• design (d)

• fabrication (f)

• operation (o)

(in principle known to occur but difficult to quantify probability of occurrence)
• Improve skills, competence, self-checking (for d, f, and o)

• QA/QC of engineering process (for d)

• Direct design for damage tolerance (ALS)—and provide adequate damage condition (for f and o)

• Inspection/repair of the structure (for f and o)b

Unknown phenomena
• Research and development

CauseRisk reduction measure
Less than adequate safety margin to cover “quantifiable normal inherent uncertainties”
• Increase safety factors or margins in ULS and FLS

• Improve inspection of the structure (FLS)a

Gross errors or omissions during:
• design (d)

• fabrication (f)

• operation (o)

(in principle known to occur but difficult to quantify probability of occurrence)
• Improve skills, competence, self-checking (for d, f, and o)

• QA/QC of engineering process (for d)

• Direct design for damage tolerance (ALS)—and provide adequate damage condition (for f and o)

• Inspection/repair of the structure (for f and o)b

Unknown phenomena
• Research and development

a

Measure by structural reliability analysis.

b

Measure by risk assessment.

During fabrication processes, the geometrical and material properties, which affect the resistance, are subjected to variability and uncertainty. The “normal” variability in material properties and fabricators performance, environmental conditions, and so on lead to a “normal” variability in the geometry (such as crack defect size and plate misalignment), characterized by a smooth variation of relevant imperfections, which comply with fabrication tolerances. However, occasionally an abnormal deviation from the intended quality occurs, e.g., caused by using a wet electrode, or another gross human fabrication error. For instance, the initial fatigue failure of a brace in the Alexander L. Kielland platform was due to the lack of fatigue design checks, abnormal crack type fabrication defects, as well as inadequate inspection [26]. Even though the fatigue failures that had occurred in semi-submersibles in the period 1965–1970 resulted in fatigue requirements, these requirements were not properly implemented in the engineering design of platforms built in the early 1970s. Hence, many platforms built in the 1970s, including the Alexander L. Kielland platform [21], had joints with design fatigue lives as low as 2–5 years when operating in extratropical regions.

Man-made live actions, including ballast in floating platforms, represent a “normal” variable action, but could also have an abnormal component, while some actions, notably fires and explosions, do not have a normal counterpart. They are simply caused by operational errors or technical faults. Ship impacts might be accidental collisions or intended contacts during supply vessel approach. Examples of well-documented accidents caused by accidental or abnormal actions are those of Ocean Ranger, Piper Alpha (Fig. 2(b)), and P-36 [2224]. Other accidents and structural failures are discussed in Ref. [15].

The strength of steel structures primarily deteriorates due to corrosion and cracks. Corrosion contributes to the ultimate and fatigue failure. However, since it normally develops slowly, it can be controlled by coating, monitoring of the impressed current, and even plate replacement, if adequate resources are allocated. The challenge with fatigue cracks, say, in plated structures is that they grow slowly when they are small—in most of their life, but have an accelerated growth in the final stage toward failure. Therefore, fatigue cracks have resulted in catastrophic fractures when the time to make inspection, monitoring, maintenance and repair (IMMR) effective has been insufficient, for instance, by a lack of sufficient damage tolerance (robustness) in the Ranger I (Fig. 3) [20] and Alexander L. Kielland [21] platforms (Fig. 4).

Fig. 3
Fig. 3
Close modal

The stages of crack growth depend on the layout of the structure. For a frame or truss structure consisting of slender members, it is natural to consider crack growth in the following stages: visible crack, through-thickness crack, and failure (rupture) of member. In monocoque structures like ships, the situation is different in that cracks in the main hull girder can grow continuously until global rupture of the hull [27]. Accidents associated with cracks appear to have been caused by [17]:

• inadequate fatigue design checks and inspections and possible repairs, e.g., see Ref. [21],

• error in action (stress) analysis (environmental conditions, method, stress concentration factor) and particular phenomena like VIV,

• abnormal initial weld defect size, e.g., due to wet electrodes or improper pre-heating and post-weld cooling/heating,

• abnormal local geometry due to deviation between as-built structure deviating and design or bad design; hence, the assessment of existing structures should always refer to the as-built condition, as revealed through inspections of the as-built structure, and

• abnormal crack propagation, e.g., due to improper corrosion protection or cathodic overprotection and hence the increased crack propagation rate and in the worst case plate thinning as well.

Significant information about cracks in North Sea jacket platforms and semi-submersible drilling platforms have been gathered, and observations have been compared with predictions [17,28,29].

The most important lesson learnt about cracks in tubular joints in jackets is that 2–3% of the 600 cracks detected in about 3300 inspections were not predicted [29]. The latter fact indicates that gross fabrication defects do occur. Similar observations have been made for semi-submersibles. It should be noted that limited experiences are available for novel concepts like TLPs and Spar platforms.

Deviations from the normal local geometry and defect sizes, which in an absolute sense are small, can clearly have a significant effect on the fatigue life due to the very local character of the fatigue phenomenon [29].

Sometimes, lack of knowledge in the engineering profession, and hence regulations and standards, at large, have caused accidents, as indicated earlier. They often occur in times with the introduction of novel technology, significant industrial activity, and pressure on time, e.g., see Refs. [30,31]. A particularly representative example of this kind of accident is the brittle fractures of several Liberty ships [32]. They occurred in World War II using new welding techniques to rapidly produce a large number of ships. The steel that had worked well in riveted construction exhibited a brittle behavior when welded. In particular, crack nucleated at the square corner of a hatch, which coincided with a welded seam, fractured. It is noted that these fractures occurred about 20 years after the launching of the Griffith theory to deal with brittle fracture.

Wöhler discovered the fatigue of railway axles in 1860–1870. The engineering community “rediscovered” the fatigue phenomenon in connection with Comet aircrafts around 1950, see, e.g., [30,31], welded bridges [33], and offshore platforms in the 1960–70, e.g., see Refs. [34,35].

The causes of accidents or failures may be classified according to the relevant risk reduction measures, which include design criteria, quality assurance and control (QA/QC) relating to the engineering process, as well as fabrication and operational procedures and inspection, monitoring, maintenance, repair, and replacement of components. Three types of accident causes and the corresponding risk reduction measures are given in Table 1. The first category relates to the known phenomena that are quantifiable, however, with a certain uncertainty. The second category relates to human errors and omissions that, in principle, are known but are difficult to quantify by analysis and their treatment in the structural integrity management and therefore depends very much on the empirical data. The third category refers to phenomena unknown to the relevant engineering community at large and hence not properly reflected in standards. The remedy to deal with unknown phenomena is to carry out R&D and implement the results in regulations and standards. Sometimes information known in other engineering fields could provide the necessary knowhow to handle the phenomena.

It is noted that the first category of failure causes listed in Table 1 is rarely observed in practice. The dominant cause is the second one.

## Structural Integrity Management

Offshore structures need to be planned, designed, constructed, operated, and assessed in such a way that, for all phases of their life, they meet all functional requirements and structural integrity to ensure safety of life, prevent damage to the environment, and protect against financial or societal loss.

The requirements to structural integrity shall as much as possible be described with a specified set of limit states. Structural integrity for the specified service life is delivered by

• – conformance to the basis of design;

• – quality management during design and construction;

• – structural integrity management in service.

The structure should withstand actions arising from hazardous events and other sources of actions during their construction and service in-place (ULS) and not fail under repeated actions (FLS) or deterioration mechanisms (e.g., corrosion, wear). ULS and FLS criteria are well established, and the inherent normal uncertainties and variability are accounted for by partial action and resistance factors or safety margins (Table 1). Structural reliability analysis (SRA) has been applied in calibrating ULS design requirements based on partial safety factors [36,37] to a certain target reliability level. A review of previous efforts on the calibration of offshore design codes was provided in Ref. [38] in conjunction with the development of harmonized ISO codes for offshore structures. By combining simplified systems SRA with Bayesian reliability methods, it is possible to establish fatigue design criteria as a function of the planned inspection and failure consequences and to update inspection plans during operation (through reliability based inspection planning—RBI) [14,39].

However, since the SRA does not account for human errors, it is important that RBI analyses are based on information from inspections during fabrication and operation to refer to an as realistic (as-is) model of the structure as possible [29]. This includes information about crack type defects with excessive size, yet small in an absolute sense. Therefore, abnormal strength associated with crack type defects needs to be considered in the context of robustness or ALS criteria, as discussed subsequently.

An important aspect of structural integrity management is to provide an appropriate level of robustness, taking due account of relevant causes and modes of damage or failure. The introduction of a quantitative ALS criterion by NPD [9] was a significant step toward the generally agreed concept of making structures damage tolerant (robust). The role of ALS criteria in the risk control of accidental events is illustrated in Fig. 4.

Fig. 4
Fig. 4
Close modal

The background for the ALS criteria is the hazards caused by human errors and omissions by those involved in the life cycle efforts to ensure serviceability and safety (Table 1). However, primarily human errors and their effects should be avoided by adequate competence, skills, attitude and self-checking of those who do the design, fabrication, or operation in the first place and by exercising “self-checking” of their work. In addition, QA/QC should be implemented in all stages of design, fabrication, and operation. Such structural integrity features have been documented in aeronautical engineering [30,31], in civil engineering [40,41] and for offshore structures [6,10,18,42]. In connection with ongoing work with Eurocodes [43], hazards are categorized as identifiable or unidentifiable, referring to explosions and fires and “consequences of human errors,” respectively.

The quality assurance and control of the engineering process have to address two different situations, which require different types of attention, namely:

• Detect, control, and mitigate errors and omissions made in connection with technology that is known in the engineering community as such. With the increasing use of computers in the design, construction, and operation of oil and gas structures, software errors are of particular concern,

• Identify possible unknown phenomena, e.g., associated with actions, action effects, and resistance, including deterioration, and clarify the basis for accounting for such phenomena in design.

Still, design errors appear and materialize as an abnormally low (or high) resistance. As discussed later, the debate on whether robustness should be provided in terms of ALS criteria, to limit the consequences of design errors, is ongoing.

As mentioned earlier, operational errors typically result in fires or explosions or other accidental actions. Such events may also be controlled by appropriate measures such as detecting the gas/oil leakage and activating valve shut in and extinguishing of a fire by a deluge system activated automatically. These actions are often denoted “Event Control.”

Table 2 shows qualitatively which role that different safety measures play regarding crack control for different types of structures. Fatigue design requirements, that is especially the fatigue design factor (FDF), are made dependent on the effect of inspection and failure consequences. The residual fatigue life is the difference between “fatigue failure” (actually a visible crack or a crack through the plate thickness) and final member or joint rupture. The ultimate reserve capacity is the reserve against system failure given a component failure. This reserve can be provided by ALS criteria.

Table 2

Crack control measures

Type of structureType of jointFDFResidual fatigue lifeUltimate reserve strengthInspection method
JacketTubular joint2–10Some—significanceNormallyNDE, U
Semi-submersiblesPlated brace1–3SomeBy ALSLBB
NDE
Plated column-pontoon1–3SomeLimitedLBB
NDE
TLPTether10SmallBy ALSIM
Plated column-pontoon1–3SomeLimitedLBB
NDE
ShipPlated longitudinal1–3SignificanceNoneClose visual
Type of structureType of jointFDFResidual fatigue lifeUltimate reserve strengthInspection method
JacketTubular joint2–10Some—significanceNormallyNDE, U
Semi-submersiblesPlated brace1–3SomeBy ALSLBB
NDE
Plated column-pontoon1–3SomeLimitedLBB
NDE
TLPTether10SmallBy ALSIM
Plated column-pontoon1–3SomeLimitedLBB
NDE
ShipPlated longitudinal1–3SignificanceNoneClose visual

Note: FDF: fatigue design factor—by which the service life is to be multiplied with to achieve the design fatigue life; NDE: nondestructive examination method; U: underwater; LBB: leak before break monitoring; ALS: accidental collapse limit state; and IM: instrumental monitoring (by “an intelligent rat”).

Thus, errors resulting in accidental actions and to some extent fabrication errors causing an abnormal strength belong to the first category, while design errors belong to the second category. The first category can be indirectly assessed, considering relevant mitigation actions and considered in the ALS design check. Normally it is assumed that the second category is handled by competent execution of the work and QA/QC.

However, in addition to providing robustness in relation to such hazards, it might be argued that robustness in terms of reduced vulnerability should be provided when the behavior is sensitive to uncertain parameters, exemplified with resonant dynamic response that is sensitive to damping and fatigue strength that is sensitive to the local geometry.

## Development of Structural Robustness Criteria

Despite the efforts that are made to avoid error-induced accidental actions or abnormal resistance, they cannot be completely eliminated. For this reason, the trend is to base regulations on the following general safety principles [13,5,44]:

• Structural integrity to withstand extreme and repetitive environmental and operational actions throughout its lifetime.

• Prevent or reduce the probability of occurrence of and protect against accidental events (actions and abnormal strength).

• Provide measures to detect, control, and mitigate hazards at an early time to avoid accident escalation (event control).

• Design structures to tolerate (local) damage without resulting in major damage to the structure.

In particular, the structure should be designed to be damage tolerant or robust, i.e., “to have the ability to limit the escalation of accident scenarios—relating to a possible abnormal floating position or structural damages—caused by accidental actions or abnormal strength due to fabrication or excessive deteriorating phenomena—into accidental conditions with a magnitude disproportionate to the original cause.” The hazards considered should be determined by a risk assessment with account of the effect of all other efforts to mitigate the hazards and their effects before they materialize into an effect on the structure.

This definition of robustness implies in a more general sense that the system performance should be insensitive to deviations from the normal condition, including normal uncertainties and human errors and omissions.

Requirements to ensure damage tolerance with respect to instability and sinking of ships were initiated several decades ago by requiring adequate stability after the occurrence of damage. Catastrophic accidents like the Titanic accident on January 20, 1914, contributed to these considerations. Damage stability criteria, which are ALS-type criteria, gradually emerged, first qualitatively and later quantitatively for sinking/instability of ships, in the 1948 SOLAS Convention [45]. A reason for the late acceptance of damage stability criteria is said to be the complexity of the analysis to demonstrate compliance, but the possibly implied increased costs by such criteria might also have been an issue. Damage stability criteria were introduced in the early mobile platform rules (e.g., Refs. [46,47]). The damage stability check has typically been specified with deterministic damage in terms of one or two compartments flooded, relating to ship impacts.

It was not until much later that damage tolerance strength requirements were introduced for ship hulls, notably by the International Association of Classification Societies (IACS) requirements for bulk carriers [48].

Explicit design against accidental actions was introduced for buildings in the UK in 1970 after the Ronan Point accident in 1968 [8].

The current version of Eurocodes [2,43,49] presents strategies for ensuring robustness for instance by eliminating or limiting the hazards and reducing the sensitivity to hazards by surviving the removal of a structural part, with emphasis on buildings. EN1991-1-7 [49] provides strategies for separately dealing with defined accidental actions (fires, explosions) and unidentified hazards (“consequences of human errors”). In the latter case, it is recommended to design buildings for a uniformly distributed loading of 34 kN/m2, to ensure global load carrying capacity after member failure, and to provide ductility in joints and between components in RC structures based on prefabricated components.

For offshore structures on the Norwegian Continental Shelf, ALS criteria, initially called the Progressive Collapse Limit State criteria, were formally introduced for all failure modes of offshore structures in 1984 [9,10]. Previous accident experiences had clearly shown the need for this approach. Moreover, ALS criteria had long since been introduced for the stability of floating structures. But it was not until the Alexander L. Kielland accident that the regulators got the momentum to introduce such criteria with respect to all global failure modes, e.g., including the hull and mooring system failure [10,21]. Moreover, the introduction of the quantitative ALS criteria in the 1980s was made possible also because nonlinear finite element analysis (NLFEM) had become available to estimate the structural damage and the strength of the damaged structure to demonstrate compliance with the requirements. The background and practicing of the ALS criteria are described in Ref. [6].

Contrary to the initial UK building codes that specified explosion and car impact actions for the structural strength check, and the initial damage stability requirements that specified the extent of damage, the NPD requirements were more functional based on damage scenarios that had to be assessed by risk analysis. In this risk-informed framework, it was also possible to demonstrate that the specific damage stability requirements in terms of flooding of two compartments for floating steel structures was not necessary for the Heidrun TLP reinforced concrete hull with, e.g., a significant resistance against ship impacts and dropped objects and a documentation of adequate control of faults in ballast operation for the TLP production platform [50].

When the ALS criteria were introduced by referring to accidental actions/damage with an annual probability of 10−4 in Refs. [9,10], it was also found relevant to include consideration of damage due to abnormal environmental actions, i.e., corresponding to an annual probability of exceedance of 10−4, with safety factors equal to 1.0 for offshore steel structures, to achieve a consistent safety level. This criterion can be more restrictive than the ULS criteria, e.g., for jackets with predominant hydrodynamic drag actions and limited air gap.

It is noted that an inspection, monitoring, maintenance, and repair strategy can contribute to safety only when there is a certain structural damage tolerance, as recognized earlier in the aeronautical industry [51,52]. This implies that there is an interrelation between design criteria (fatigue life, damage tolerance) and the inspection and repair criteria, e.g., see Ref. [34].

## The Accidental Collapse Limit State

Damage tolerance criteria or resistance against progressive failure need to cover different scenarios, such as:

• Structural hull failure initiated by damage due to accidental actions or abnormal strength due to fabrication errors

• Overturning of a structure supported on the seabed due to accidental actions or abnormal foundation strength due to fabrication/ installation errors

• Capsizing/sinking of a floating structure due to abnormal environmental or accidental actions, especially due to flooding or technical or operational faults in the ballast system

• Failure of station-keeping systems for floating structures due to technical faults in structural components or possibly the power supply and thruster system or operational errors.

The relevant damage needs to be assessed by risk assessment. However, with the significant experiences with risk analysis relating to accidental actions, it is also possible to use specified characteristic accidental actions for typical structures and industrial climate.

Accidental collapse limit state criteria are introduced to prevent progressive collapse. The basic principle relates to the fact that accidents develop in a fault sequence of events and it becomes important to establish a barrier to stop the escalation of the accident. This goal could be achieved by (e.g., see Ref. [1]) by either of the following approaches:

• Designing the structure locally to sustain accidental actions and other relevant simultaneously occurring actions; analogous with the ULS component design check.

Notes: An analogous extension of FLS criteria might also be applied, i.e., by applying a large FDF, the robustness relating to fatigue failure is increased since it implies more time to identify and possibly repair cracks.

• Designing the structure by a systems approach, by accepting local damage to components but requiring that the damaged structure survives relevant actions (alternate path design). The relevant damage due to accidental actions and abnormal resistance due to fabrication errors as well as abnormal deterioration and fatigue, to be considered in the ALS check, is further commented on below.

• Designing the structure to meet robustness requirements through (prescribed) minimum levels of ductility and continuity.

In practice, the first two methods are implemented for failure modes associated with structural strength. The third method relating to ductility and continuity is an indirect, “qualitative” method for ensuring robustness, especially by making the second method applicable.

The first method is only applicable for structural strength in relation to accidental actions and does not cover “damage” in terms of deficient resistance due to fabrication faults or deterioration. Moreover, it does not apply for station-keeping systems nor for damage tolerance checks relating to (rigid body) instability, where the damage does not necessarily stem from accidental actions, but rather fabrication and operational aspects.

It is noted that the Eurocode [2] primarily refers to the direct design against accidental actions, i.e., an ULS check with a set of action combination scenarios involving accidental events. This method will normally imply higher structural costs than the systems approach outlined later since all parts of the structure that can be subjected to accidental actions need to be designed for such actions, without using the benefit of redistribution of forces for a more efficient load carrying. However, the Eurocodes [2,49] also give general recommendations regarding strategies for ensuring robustness by eliminating or limiting the hazards and by reducing the sensitivity to hazards by surviving the removal of a structural part.

The second alternate path design method was initially mentioned as a regulatory requirement in Ref. [9] and also currently specified in NORSOK N-001 [5] for the strength of the structure, possible station-keeping, or foundation, as well as for instability, see Fig. 5.

Fig. 5
Fig. 5
Close modal

## The NORSOK N-001 Accidental Collapse Limit State Approach

### General.

The ALS approach in NORSOK N-001 [5] applies to different failure modes and is illustrated in Fig. 6 and consists of two steps (Fig. 7). The first step is to estimate the initial damage due to accidental actions or other damage conditions as discussed earlier with an annual exceedance probability of 10−4. This exceedance probability refers to accidental events on the whole platform and needs interpretation [6].

Fig. 6
Fig. 6
Close modal
Fig. 7
Fig. 7
Close modal

The second step is to demonstrate that the damaged structure resists relevant functional and environmental loads with an annual exceedance probability of 10−2 or 10−1 depending on the correlation between the accidental event and the environmental condition—without global failure. The characteristic resistance value used for steel is defined as a value exceeded with a probability of 95%. Action and resistance factors for steel structures are taken to be 1.0 in these design checks.

It is noted that this approach implies that “local” damage is accepted. The possible consequences of this approach need to be assessed, especially if injuries or fatalities might result, or the economic consequences if critical equipment is damaged.

The NPD/NORSOK approach is applicable to the other failure modes, like rigid body instability (damage stability) or station-keeping system failure.

If the two-step criterion is not satisfied, the mitigation action could either be additional operational measures and quality control or assurance or be possibly local strengthening or improving the system performance. When the ALS procedure is used in other regulatory regimes than that of Norway, the same principles can be applied, while other characteristic values of accidental and environmental events could be applied [3].

### Damage Conditions of Hull Structures.

The relevant damage conditions to be applied in ALS criteria for structures depend on the accidental actions and possible abnormal resistance. Accidental actions include the effects of fires, explosions, ship collisions, dropped objects, as well as abnormal distribution of payload or ballast. The characteristic accidental actions corresponding to an annual probability of 10−4 are to be determined by risk analysis, see, e.g., Ref. [15], accounting for relevant factors that affect accidental actions. In particular, risk mitigation can be assumed to take place by reducing the probability or consequences of the hazards. However, it should be noted that extensive experiences with accidental actions for typical platforms have led to the use of specific actions for well-defined conditions [6].

In general, a risk assessment is needed to estimate characteristic accidental actions or abnormal damage. At the same time, it is reasonable to specify minimum values, e.g., relating to frequent impacts of supply vessels on offshore structures [53]. The assessment should account for relevant factors of influence. Hence, when determining accidental actions, possible risk reduction measures should be accounted for. Regarding fires and explosion events, detection and control of hydrocarbon leaks and ignition would have a significant effect on the corresponding accidental actions. Moreover, fires are also normally controlled by the sprinkler/inert gas system or by fire walls. The risk of ship impacts to some extent will be controlled by operational regulations and surveillance of the ship traffic and by the use of fenders to reduce the damage due to collisions.

For each physical phenomenon (fire, explosions, collisions, etc.), a continuous spectrum of accidental events is envisaged. The corresponding fire action (heat flux) is then determined. Next, the design action is determined by sorting the relevant accidental events in order of decreasing overpressure and by determining their cumulative probability. Since the 10−4 annual exceedance probability refers to accidental action on the whole platform, the exceedance probability level to use to determine the characteristic actions at different locations needs to be modified.

A simple way to determine characteristic accidental actions on different components of a given facility can be made as follows:

• establish an exceedance diagram for the action on each component based on a risk assessment;

• allocate a certain portion of the reference exceedance probability (minimum 10−4 for ALS case and 10−2 for ULS case) to each component; and

• determine the characteristic action for each component from the relevant action exceedance diagram and reference probability.

A more refined approach based on the consideration of risk is given in Refs. [6,54].

More details about accidental actions, risk analysis to estimate their magnitude, and their effect on structures may be found in Refs. [55,56].

As mentioned earlier, the ALS criterion was initially supposed to include “abnormal” wave and other environmental actions as well. Rather than a two-step approach described above, this check will be a survival check based on an action corresponding to an exceedance probability of 10−4. In this connection the focus is on possible “abnormal” waves, with high crest or other unusual shape—which are not a simple “extrapolation” of the 10−2 event [54,57]. Since the relevant wave action in this criterion should refer to a 10−4 sea state, and not least crest height, it will especially affect air gap criteria or wave in deck actions, such as manifested in the Lilli platform accident, as shown in Fig. 2(a).

It is noted that the documentation of damage and survival is normally made by the use of nonlinear finite element methods, by accounting for large deflections and elastoplastic behavior. In view of the fact that the sea loading is cyclic, it is also necessary to demonstrate that low-cycle fatigue does not occur in the damaged structure.

While there seems to be a general agreement to consider accidental actions caused by operational errors, abnormal resistance due to fabrication errors might be considered “unidentifiable” and hence not considered in the ALS check. However, such damage (abnormal resistance) has been explicitly specified by generic values for specific types of structures based on some consideration of their occurrence rate and the vulnerability of the system to component failure. An important example is the specification of damage corresponding to the failure of one or two catenary mooring lines, as justified by the high failure rate of such mooring lines [58]. Moreover, failure of slender braces in mobile drilling platforms (semi-submersibles) and tethers in tension-leg platforms has been considered to be a relevant damage condition due to the vulnerability of these components.

In particular, it is suggested in Ref. [6] that abnormal damage in terms of cracks is considered. The basis for this suggestion is the fact that crack type defects, which are larger than the normal initial defects (which are of the order of 0.1–0.5 mm deep), could occur and escape detection during inspection, considering the fact that cracks that are about 1–2 mm and 15–20 mm deep can be reliably detected by nondestructive examination method and close visual inspections in air, respectively. With a FDF of 1 and an assumed initial abnormal defect size of 2.0 mm, the probability of failure—as referred to through-thickness-crack (TTC)—over a 5-year period (i.e., the time between inspections) will be of the order of 10% in a butt-welded plate.

This fact also indicates that defects that should be denoted abnormal are quite small defects that are hard to detect. Therefore, alternative mitigation actions to limit the risk of failure are envisaged as indicated in Table 2. Sufficient residual fracture strength associated with ‘‘long” through-thickness cracks is difficult to document. Since the residual fatigue life with a TTC in plated structures is small, the leak before break monitoring approach is not applicable either, and failure of a brace may be considered as a damage condition in the two-step ALS check under such circumstances.

It is noted that in addition to providing residual ultimate capacity after initial damage (the conventional ALS approach), robustness against fatigue failure can also be achieved by using a large FDF since it will reduce the stress level and hence the crack growth rate and give more time for detecting and repairing cracks.

An even more controversial question is whether design errors that cause an abnormal resistance should be considered in the ALS design check. This issue is discussed subsequently in the Wider Aspects of Structural Robustness section.

### Prediction of Damage and Survival of Hull Structures.

To demonstrate compliance with ALS requirements for the structure, calculation of the damage due to accidental actions as well as the global ultimate capacity of a damaged structural system is needed. To estimate damage, i.e., permanent deformation, rupture, etc., of parts of the structure, nonlinear material and geometrical structural behavior need to be accounted for. Dynamic effects may be important in the analysis of explosion and ship impact effects.

Advances in computer hardware and software over the last decades have made NLFEM a viable tool for assessing damage and system resistance for steel structures. Early contributions to the nonlinear FE analysis of jacket structures were presented in Refs. [5861].

While explosions cause pressure loads, the main effect of fires is the reduction of material strength (and to a very limited extent cause an action due to thermal expansion). Ship impact analysis normally includes two phases: (a) external mechanics analysis to assess how much of the impact energy dissipates in plastic work and hence damage to the ship or relevant structure hit and (b) assess energy absorption in ship and the structure. In the latter phase, the dissipated energy might be shared in different ways, Fig. 8. For instance, if the structure is rigid, all plastic energy will be absorbed by the ship. In such a case, the impact force on the structure and the resulting damage can be determined. In other cases, e.g., when energy absorption occurs in both the structure and the ship, an integrated analysis to determine the damage, i.e., permanent deformation, is necessary.

Fig. 8
Fig. 8
Close modal

Examples of general purpose computer codes, which have been used widely are ABAQUS, ANSYS, and LS_DYNA. Compliance with the global strength requirement of the damaged structure can in some cases be demonstrated by removing the damaged parts and then accomplishing a conventional ULS design check of the global structure based on a global linear structural analysis and ultimate strength checks of components. However, such methods might be very conservative. Software dedicated to progressive collapse analysis of frame offshore structures consisting of slender members has also been developed, e.g., usfos and sacs. Such methods are not applicable to large volume floating frame structures built up as shell or box girder structures based on stiffened panels, and various local failure modes prevail. In principle, full shell FE models or simplified elastoplastic methods [55] should be applied. Limited efforts have been devoted to such analyses, partly because global strength is not as critical as local damage causing flooding and instability (capsizing) of such structures. However, for structures with large volume elements (pontoons, columns) as well as slender braces, the failure mode is often governed by the slender members and the methods for framed structures with slender members, mentioned earlier, can serve the purpose.

The DNVGL has issued guidelines [55] for modeling and analysis of structures with nonlinear behavior. A major challenge in nonlinear finite element analysis is the prediction of behavior of joints, which might experience significant yielding in connection with redistribution of forces, to utilize the full ultimate capacity. Criteria for possible fracture then needs to be introduced. Moreover, it is also important not only to check the capacity in a monotonous loading mode but also to carry out analysis with a representative cyclic storm loading.

Among offshore structures, the ship type FPSO represents a special case where global still-water and wave loads are of similar magnitude and vary over time [62]. Moreover, ship impact and other accidental loads could reduce strength as well as increase the “still-water” loading by flooding. Hence, it becomes crucial to consider relevant load combinations for the accidental limit state as illustrated, e.g., in Ref. [63].

### Damage Conditions for the Stability Limit State of Freely Floating Structures.

The damage conditions relevant for damage stability assessment of floating structures are essentially flooding and loss of buoyancy and environmental actions on a structure with a changed floating position. The latter could be influenced by the failure of upwind mooring lines, followed by an overturning effect caused by wind and the remaining leeward lines.

Flooding can be caused by leaks due to the structural damage to the hull, pipes, and equipment resulting from ship impact, dropped objects, or other mechanical actions, as well as errors in ballast operations and distribution of payloads on the deck. Initially, damage stability requirements were based on the prescribed flooding of 1 or 2 compartments, while modern stability requirements are based on damage determined by risk assessment. The relevant damage will then depend on the relevant hazards causing flooding, including technical faults in the ballast system and its operation, abnormal deck loads that affect the vertical center of gravity, as well as the structural design (e.g., to create barriers against ship impacts and dropped objects). The Ocean Ranger accident [22] directed the attention to buoyancy loss, e.g., due to ballast error, which in principle could occur in any compartment with variable ballast.

The main hazard relating to damage stability is the loss of buoyancy due to flooding. Hence, an important design aspect is to provide compartmentation of the buoyant structure to limit the flooding. Traditionally, the main source of flooding has been penetration of the steel plating due to ship impacts, which has led to a prescriptive damage condition corresponding to flooding of one or two compartments. However, for reinforced concrete structures, this condition is not necessarily relevant. For instance, by a risk-based approach, it was possible to demonstrate that the conventional compartmentation of floating steel structures was not necessary for the Heidrun TLP concrete hull—in view of ship impacts, dropped objects, and ballast faults [50].

Moreover, it is noted that damage to the “submerged” parts of a floating structure leads to a change of the floating position, which will hence influence the wave and current actions on the structure (see also Refs. [64,65]).

The Alexander L. Kielland platform capsized in 1980 [21]. The sequence of events leading to the capsizing was (1) the loss of one of its five columns due to a structural failure of the connected braces and (2) heeling of the platform, flooding of the deck structure, and capsizing in about ½ hour. This accident made the Norwegian Maritime Directorate (now: Norwegian Maritime Authority) propose that semi-submersible platforms should be required to survive such a large loss of buoyancy. However, by applying proper structural design criteria, including ALS, the probability of loss of a major buoyancy component will be limited, as documented by risk analysis. For this reason, this large buoyancy loss condition was abandoned, and modified damage stability criteria were introduced for mobile units [66].

It should be noted that the regulatory regimes for mobile units differ from those of floating production platforms. For instance, on the Norwegian continental shelf, functional risk-based criteria are practiced for floating production systems, while the criteria for mobile units are more prescriptive.

### Prediction of the Damage Stability of Freely Floating Structures.

Current stability criteria for catenary moored floating platforms primarily refer to the initial metacentric height, GMO, the overturning moment due to wind, and the stabilizing moment due to hydrostatics. The effect of wave and current forces is not explicitly taken into account [65]. The stability criteria essentially refer to heeling, which may cause flooding and eventually capsizing. The relevant parameters are the wind-induced moment, MH, acting on the floating structure and the corresponding angle of heel. The stabilizing (righting) moment, MR =Δ · GZ, where Δ and GZ are the displacement and “righting arm”, respectively. Simplified dynamic stability considerations are made by considering the energy associated with MH and MR in terms of the area under the MH and MR curves. Reference is made to heeling angles that define “instability” (capsizing) and downflooding.

It has been clearly expressed that the stability requirements are simplistic and need to be revised. In the aftermath of the Alexander Kielland and Ocean Ranger accidents, a comprehensive joint industry research program on the stability of mobile offshore units (the Mobile Platform Stability (MOPS) project) was conducted [67,68]. It was, for instance, found that it was impossible to capsize the semi-submersibles used even if the stability requirement were far from satisfied, i.e., with an area ration less than 1.0 and environmental conditions beyond 100 years conditions. This research program was not found comprehensive enough to come up with recommended revisions of the stability requirements.

The fact that the stability criteria refer to quasi-static models, and still-water conditions have initiated efforts with the aim to improve the criteria, e.g., by including wave actions and allowing dynamic analysis to be applied in the intact stability check [65], but such approaches are not widely used yet.

### Damage Condition for Mooring and Other Station-Keeping Systems.

The failure rate in the 1980s was of the order of 10−1 per line-year, but was reduced toward the 1990s due to improved technology and design approaches [15,58]. The experienced failure rate of mooring lines is of the order of 10−2 per line-year [69]. Line failures are often caused by “abnormal strength”—such as local bending at fairleads, which is not accounted for in design, fabrication defects, wear, and so on—and inaccurate modeling of hydrodynamic loads, while failures of load-bearing hull structures are often caused by accidental loads due to operational errors. The experienced failure rate implies that the damage event corresponding to 10−4 in principle is failure of two mooring lines. Unless it can be shown by risk assessment that the failure rate could be reduced beyond the values given above, the damage in mooring systems should be specified in terms of failure of (one or) two lines. Experiences with DP systems are discussed in Refs. [15,58].

### Stability of Tension-Leg Platforms.

The stability of tension-leg platforms in place is ensured as long as the tethers are intact and in tension with an adequate margin. While the stability requirements for freely floating platforms refer to the overturning wind moment, all actions, including waves, current, and wind, need to be considered in checking loss of tension (“slack”) in tethers. Moreover, experience shows that the slack criterion often will be conservative since the duration of this “slack condition” is short and the large inertia forces activated in the system prevent the undesirable slack to occur before tension is recovered. The damage conditions that can cause loss of tension include those that can result in loss of buoyancy for freely floating structures, discussed earlier, as well as tether failure, e.g., due to fatigue. Moreover, the possible deviation of intended payloads and ballast could represent an accidental condition, which also means that it is important to monitor the weight condition to know the tether pre-tension.

### Comments on Robustness, Vulnerability, Redundancy, and Damage Tolerance.

Robustness is defined and measured in various ways—some advocate that it is a feature of the structure, while others include considerations of the physical environment—hazards, actions—and to various extent the uncertainties of influence—by the reliability and risk assessment approaches [7074]. In this paper, robustness (and its complementary notion: vulnerability) is used in a general meaning: damage tolerance (or sensitivity) of the physical system to damages or assumptions made regarding actions and resistances in the life cycle.

It is often suggested to ensure structural robustness by providing redundancy. A classical measure of redundancy is the degree of static indeterminacy. However, such an approach does not give a precise robustness measure and certainly not a good measure of the risk. This is because the probability of failure of different components varies depending on the hazards variation in space and time, the location of the component, and its strength. For instance, a thick-walled concrete cylinder and a thin-walled steel cylinder designed to carry payloads and environmental action will have different resistance to, e.g., a ship impact. Actually, some impacts might cause partial damage or damage to more than one component. These facts suggest the use of a rational approach based on risk assessment considering various hazards, their variation in time and space, probability of occurrence, and the corresponding damage.

More explicit measures can be established based on the ultimate strength of the intact and damaged structure, which obviously depends on the actions and location and magnitude of the damage. For trusswork (jackets) [60], the residual resistance factor is defined as RIF = Rr/Ru, where Rr and Ru are resistance in damaged and intact condition, respectively. In addition, they introduced the reserve resistance factor as REF = Ru/Rd, where Ru and Rd are the ultimate and design value of the resistance for the intact structure. REF is often (much) larger than 1.0 for jackets because the various components are designed based on the linear global analysis, and different action conditions govern the design for various components [61]. Similar measures are proposed for civil engineering structures [70] and introduced strength redundant factor r = Ru/(RuRr) by introducing the structural reliability measures instead of the resistances. André et al. [72] presented new indices for structural robustness and its “antagonistic” property, i.e., vulnerability.

To illustrate the reserve and residual strength, consider the eight-legged jacket shown in Fig. 9 typical for a water depth of 70 m in the North Sea [61]. Four damage cases are considered, namely, DC2-dented leg at the sea surface, while the others are broken × braces at different locations (Table 3); i.e., DC1 and DC3-4 at the sea surface and seabed, respectively. The damage at sea level is assumed to be caused by ship impact, while damages at the seabed are due to dropped objects. The jacket was designed according to ULS requirements in the API RP 2A code using linear global analysis and component strength check. Table 3 lists tremendous reserve capacity and significant damage tolerance (REF·RIF) even if it was not explicitly designed for that.

Fig. 9
Fig. 9
Close modal
Table 3

Characteristics of loading and damage conditions in a damage tolerance study of an eight-legged North Sea jacket (Fig. 9)

CaseLoad caseDamage caseMax actionREFRIF
1LC1- diag. wavesIntact4.394.39
2LC1- diag. wavesDC1-×-brace4.100.93
3LC1- diag. wavesDC2-dented leg4.250.97
4LC1- diag. wavesDC3-×-brace3.150.72
5LC2-long. wavesIntact3.713.71
6LC2-long. wavesDC4-×-brace3.380.91
7LC3-transv. wavesIntact4.324.32
8LC3-transv. wavesDC3-×-brace3.390.78
CaseLoad caseDamage caseMax actionREFRIF
1LC1- diag. wavesIntact4.394.39
2LC1- diag. wavesDC1-×-brace4.100.93
3LC1- diag. wavesDC2-dented leg4.250.97
4LC1- diag. wavesDC3-×-brace3.150.72
5LC2-long. wavesIntact3.713.71
6LC2-long. wavesDC4-×-brace3.380.91
7LC3-transv. wavesIntact4.324.32
8LC3-transv. wavesDC3-×-brace3.390.78

While simple robustness measures as given above is relevant for jackets which are simple towers, for which global failure mode and action pattern with monotonous action are easily defined, it is more difficult to apply such approaches for large volume floating structures subjected to dynamic behavior. However, the ALS limit state approach is generally applicable.

To illustrate the features of robustness, three platform designs are discussed in the following, with a focus on the sub-structure, not including the topside facility. The relevant hazards are ship impacts in the sea surface (and possibly submarine impacts), dropped objects, and possible fires on the sea surface. In addition, damage in terms of abnormal resistance due to fabrication errors should be considered.

Figure 3(a) shows the Ranger I jack-up in the Gulf of Mexico. One leg failed due to fatigue and the deck collapsed [20]. The Alexander Kielland platform shown in Fig. 3(b) is the second example. The brace D-6 failed due to fatigue and the other five braces connecting the column D to the platform failed in a condition with 6–10 m high waves [21]. In these two accidents, failure of a member leads to catastrophic events. While Alexander Kielland could have been made more robust by introducing some additional braces, Ranger I could in principle have been a four-legged structure, however, with limited increase of the robustness with respect to failure of a leg. For the jack-up, probably the most efficient measure to improve the overall reliability would have been to improve the reliability of each leg, through design, inspection, maintenance, and repair. As a third example consider the statically determinate (nonredundant) reinforced concrete column platform in Fig. 10, which has a reinforced, large diameter, thick-walled column. Clearly, this structure does not score highly in terms of simple redundancy consideration. However, it is robust for damage scenarios like ship impacts and dropped objects, because the damage will be limited, and it will possess reserve capacity after damage. This fact then shows that robustness is not necessarily synonymous with classical “redundancy”.

Fig. 10
Fig. 10
Close modal

The ALS check is directed not only toward avoiding global collapse but also toward the failure of safety systems like escape ways and life-saving equipment, which are crucial to limit the failure consequences in terms of fatalities.

## Wider Aspects of Structural Robustness

An important feature of the NORSOK N-001 ALS robustness criterion [5] is that designers can directly apply it to achieve robustness in the case of identifiable and quantifiable hazards. This is a step forward compared with the initial statements that were made in motherhood codes, i.e., “the structures should be designed to be robust.”

A particular challenge is associated with determining the accidental actions and abnormal resistance due to human errors when considering all measures to reduce their occurrence and consequences. In general, it is practically impossible to estimate the probability versus the intensity of such hazards. Hence, probability estimates depend on using service experiences, even from other, related systems to infer the likelihood of hazards. There is a particular challenge to assess the effect of design errors that could possibly result in abnormal resistance to be used in the ALS design check. This is partly because of the paradoxical situation that design should be made to reduce the effect of design errors and partly because other mitigation efforts such as QA/QC and event control should be taken into account when determining this abnormal resistance. Although there is information to identify areas that are exposed to fire, explosion, ship impact, and faulty ballast hazards, design errors could represent a hazard (abnormal resistance) anywhere. In the background report to the revision of the Eurocode EN 1990 [43], it is suggested to define some general equivalent minimum accidental action to provide some robustness. Another strategy could be to prioritize areas where a potential deficiency could lead to the largest consequences (vulnerability) or components where design is particularly difficult. Concerning the latter issue, however, QA/QC should also be focused on those components, making the chance of deficiency less. Moreover, it will be hard to implement such a vague requirement and hence use it in practice.

Another issue is that design standards should encourage designers to provide robustness in cases where there is a particular reason to do so, for instance, when the structural performance is sensitive to uncertain parameters. In line with the philosophy that small faults/errors should not lead to disproportionate consequences, conservative choices should be made under such circumstances. Examples of such cases are resonant dynamic response, which is sensitive to damping; the ultimate strength of cylindrical shells under axial compression, which is sensitive to imperfections; and fatigue life estimates, which are very sensitive to the local geometry and defects. Alternatively the necessary safety margin could be built in through modified partial safety factors. Hence, some design codes, e.g., [75] for steel cylinders specify a material (resistance) factor to vary between 1.15 and 1.45, depending on the slenderness and hence imperfection sensitivity.

In addition to providing robustness against fatigue failure by the conventional two-step ALS approach by requiring the ultimate capacity to survive a fatigue failure of a component, the use of a large FDF will also provide robustness since the implied lower stress level will lead to more time to identify and possibly repair cracks.

## Simplified Probability of System Failure Implied by the Accidental Collapse Limit State

Figure 4 illustrates how accidental actions can cause local damage that escalates into system loss. This escalation from local damage to total loss would normally take place progressively. A true risk-based design should account for the various sequences of the progressive development of accidents into total losses. However, in a design context, simplifications are necessary. One such approach is to prevent escalation of damage induced by accidental actions or abnormal strength, by requiring the structural system to resist relevant actions after it has been damaged.

The ALS criterion is focused on ensuring that the probability of the total system loss is within the acceptance level. The probability of system loss, relating to different accidental actions and “accidental damages” identified as abnormal resistance, may be written in a simplified manner as follows [6]:
$PFSYS=∑jkP[FSYS|D∩Ajk(i)∩PE]⋅P[D|Ajk(i)]⋅P[Ajk(i)]+∑lmP[FSYS|Dlm]⋅P[Dlm]$
(1)
where $Ajk(i)$ are mutually exclusive accidental actions (i) at location (j) and intensity (k) and Dlm are damage at location (l) with a magnitude (m). PE represents the payloads and environmental actions to consider for the damaged structure. The locations (j) need to be discretized partly to represent the spatial variability of the accidental action and partly to accommodate the behavior of the structure after damage. A minimum model of spatial variability is to consider the following three locations: deck, zone between deck and sea surface, and submerged parts of, e.g., the (platform) structure. D is assumed to be “uniquely” given by $Ajk(i)$, and the indices on D are omitted. In general, the damage D corresponds to a permanent deformation, fracture of a certain cross-section area, or failure of a member or joint. $P(Ajk(i))$ is the probability of $Ajk(i)$ and is determined by the risk analysis, while the other probabilities are determined by structural the reliability analysis. Event-fault tree techniques in most cases serve as the basis for determining $P(Ajk(i))$. The events are not uniquely defined in a single sequence but appear in many combinations, making the event sequences correlated, especially at the same location. Operational errors that result in accidental actions are implicitly dealt with by using observed releases of hydrocarbons, probability of ignition, etc. While explicit prediction of design and fabrication errors and omissions that result in Dlm for a given structure may be impossible, a rating of the likelihood based on indicators for gross errors could be possible [18,41].

A crucial issue in determining the probability $P[FSYS|D∩Ajk(i)∩PE]$ is which associated payloads (P) and environmental actions (E) should be considered. The main issue is then the correlation between the accidental action $Ajk(i)$ and the actions that occur in the time that elapses before the damage can be remedied or—if consequences in terms of fatalities are of concern—the time to evacuation of personnel. The time to repair is in principle a random variable. In extratropical regions, like the North Sea, it may be reasonable to assume a (maximum) time to repair be a year, since remedial actions may be difficult to carry out during the winter season. Fire and explosion events are obviously not correlated to sea actions.

## Target Reliability or Risk Level for Design Codes in General

Risk acceptance criteria serve as a basis for defining safety factors/margins used in ULS/FLS criteria and whether ALS criteria should be applied or not, and the extent and quality of QA/QC. The approach taken depends upon jurisdictions and the consequence/reliability class of the structure.

The ultimate consequences of concern are fatalities, environmental damage, and economic loss. While fatalities caused by structural failures would be related to global failure, i.e., capsizing or total failure of deck support, smaller damages may result in pollution or property damage that is expensive to repair, especially for the underwater part of a permanent structure.

Equation (1) is crucial for obtaining a risk measure (the probability of undesirable event times its consequences) relating to fatalities in offshore platform accidents because a total loss will imply severe consequences for the platform deck where personnel are located. Clearly economic consequences are also significant in such accidents. However, less significant damages can have large economic consequences directly and indirectly due to possible halt in operation (i.e., oil and gas production). To estimate the economic consequences, Eq. (1) needs to be extended to cover a spectrum of events.

Rather that setting a target level for the total risk level, it is more practical to establish target levels for each hazard separately, e.g., see Ref. [10]. This may be reasonable since all hazard scenarios and failure modes rarely contribute equally to the total failure probability for a given structure, e.g., Refs. [76,77].

Risk acceptance criteria depend on the nature of hazards (e.g., man-made accidental and abnormal resistance due to human errors or omissions versus environmental actions), failure modes (e.g., system versus components), method of risk estimate (SRM or risk analysis), failure consequences, and the expense and effort required to reduce the risk of failure [76,77].

Target reliability levels for ULS and FLS criteria should be based on the SRM accounting for normal variability and uncertainties in action effects and resistances, while ALS criteria need to be based on a broader risk assessment.

Current ULS requirements for offshore structures imply notional annual component failure probabilities of the order of 10−3 to 10−5 [38] depending on the type of structure, consequences, and partly the regulatory regime. A main issue is that target levels for notional failure probabilities relating to SRM should be clearly distinguished from the true failure probabilities estimated by risk assessment considering human factor effects also. Hence, it was argued in Ref. [78] that the target failure probability in the context of SRM should be a fraction of the true failure rate. Similar or even lower values are targeted for civil engineering structures [2]. These values are so low that accidents due to too low partial safety factors do not materialize in failures of offshore structures. The corresponding systems failure probability varies significantly depending on the system layout and governing load conditions. This is because there are no explicit ULS system requirements. However, the special global (ALS) design check in NORSOK N-001 considering environmental actions with an annual probability of 10−4 is noted in this connection. By using the corresponding environmental event rather than scaling 10−2 load by action factor, a consistent target reliability level can be achieved.

Current FLS requirements, based on an FDF (ratio of characteristic fatigue life and service life) varying between 1 and 10, implies “fatigue failure” (visible or through-thickness cracks) probabilities of the order 10−1 to 10−4 probabilities in the service life for structures in extratropical climates, e.g., Refs. [17,34]. By neglecting the conditional probability of member fracture given fatigue “failure” and combining the fatigue failure probability with the conditional probability of system failure (fracture) given fatigue failure (according to the fatigue design criteria), the implied target probability of total loss is of the order of 10−4 [34,75,76].

The target level for ALS criteria should in principle be inferred from

• acceptable fatality rates

• environmental damage limit

• cost benefit analysis

and the most critical value of the relevant criteria should be adopted.

The main consideration used in establishing the ALS criteria in NORSOK N-001 [5] is the experienced failure rates and especially the fatality rate. Often the consequences, e.g., fatalities, are plotted as a function of frequency—in the so-called frequency—fatality rate diagram. The experienced failure rates, e.g., shown in Ref. [76], show that the annual frequency of 50–100 fatalities—which could be considered as total losses—is of the order of 6 · 10−5 for fixed (production) platforms and 10−3 for mobile units. Based on these data, the annual target failure probability of the structural system collapse of production platforms due to each accidental action was chosen to be 10−5. To comply with this targetfailure probability, the characteristic accidental actions in NPD [9] (now NORSOK N-001 [5]) were referred to an annual exceedance probability of 10−4. It was then assumed, as mentioned earlier, that the contributions from different hazards rarely add up. Moreover, the survivability of the damaged structure referred to a period of a year after the occurrence of the damage. While a period of one year might be relevant for the survival of the structure (i.e., survival of a winter season), survival of personnel depends on the correlation between the hazardous event causing damage and the environmental condition in the period after the damaging event and when evacuation can be carried out.

However, the question might be raised about which consequences will be caused by an accidental action or (local) damage with probability slightly less than 10−4, i.e., α · 10−4, with an α between 0.1 and 1.0. If such an action will cause a total loss, the actual implied target level will correspond to α · 10−4.

Another related issue is the fact that, for instance, the impact action by supply vessels at the 10−2 and the 10−4 probability level does not differ much. Hence, the ULS with the 10−2 event and the use of ULS partial safety factors is governing to achieve a consistent safety level.

However, ALS target values might also be compared with those for ULS and FLS criteria, especially the latter since they are linked to ALS criteria. However, it should be noted that the probability of total loss aims at referring to actuarial values, while the target component failure probabilities relating to ULS and FLS criteria refer to notional values obtained by SRA, however, with some contribution to real probability from that on environmental phenomena.

## Applicability of Accidental Collapse Limit State Requirements

The conventional limit states relate to ultimate strength and fatigue of components; however, ultimate system limit states are under development and so far used for existing offshore platforms [5]. The scope of the ALS criterion is ultimate system strength or an overall stability check for damaged structures.

ALS requirements were not enforced before NPD introduced this limit state in 1984 [9]. They are still lacking in some regulatory regimes. Yet, for instance, the jacket shown in Fig. 8 was truly damage tolerant as described earlier. The explanation is that different components are designed based on the linear global analysis and component ULS strength check and no account of load redistribution between components. Moreover, the governing load scenario for different components varies. Similar built-in “conservativism” is experienced for other structures, hence providing damage tolerance and reducing the consequences of accidents.

However, if the ULS design check had been made based on the nonlinear systems analysis, the reserve capacity would have been much less.

Another issue is that if the design had been optimized based on component ULS and FLS criteria, the reserve capacity and hence the damage tolerance would have been reduced. This fact shows that optimization should account for all criteria (limit states) to ensure a proper safety level.

The challenge is to find the compromise between modeling fidelity (relating to environmental conditions, loads in a wide perspective (hazards), structural response relating to collapse, fatigue and fracture, and corresponding resistances—from both a mechanics and probabilistic reliability and risk perspective) and computational efficiency, as well as other aspects of structural integrity management, to benefit from the optimization. In general, it will be very demanding to carry out the iterative (detailed) design process to satisfy safety and serviceability in a truly goal-setting perspective with targets given by risk measures. Hence, simplified approaches are needed.

The ALS approach presented herein is a design-oriented risk-informed limit state check for use in the oil and gas industry to be used when there is a significant risk of fatalities, severe environmental damage, or economic losses that affect the national budget. In view of the As Low As Reasonably Practicable (ALARP) principle, it is not applied in case of low consequences [9]. Typical design implications of accidental actions on different parts of the platform structure are shown in Table 4. Since the explicit ALS criteria were introduced in Norway [9]. They have been now adapted in the international offshore standards [3] and are increasingly introduced for other types of structures.

Table 4

Design implications of accidental loads on hull structures

LoadStructureEquipmentPassive protection system
FireColumns/deck (if not protected)Exposed equipment (if not protected)Fire barriers
ExplosionTopside (if not protected)Exposed equipment (if not protected)Blast/fire barriers
Ship impactWaterline structure (subdivision) (if not protected)Possibly exposed risers, (if not protected)Possible fender systems
Dropped objectDeck Buoyancy elementsEquipment on deck, risers and subsea (if not protected)Impact protection
LoadStructureEquipmentPassive protection system
FireColumns/deck (if not protected)Exposed equipment (if not protected)Fire barriers
ExplosionTopside (if not protected)Exposed equipment (if not protected)Blast/fire barriers
Ship impactWaterline structure (subdivision) (if not protected)Possibly exposed risers, (if not protected)Possible fender systems
Dropped objectDeck Buoyancy elementsEquipment on deck, risers and subsea (if not protected)Impact protection

The applicability will also vary in different industry sectors, i.e., marine versus aeronautical, civil, nuclear sectors, and different marine sectors like shipping, wind energy, and fish-farming. The application of ALS requirements would, for instance, depend on the potential failure consequences and economic situation for structures in the relevant sector.

Normally hazards relating to warfare, terrorist attacks, and sabotage are excluded.

## Conclusions

Based on in-service experiences for oil and gas platforms, a framework for safety management of offshore structures is briefly outlined in terms of design criteria and QA/QC in all life cycle phases and especially inspection and monitoring during fabrication and operation. While the initial structural design and inspection and repair planning are based on generic information for a class of structures, the information gathered for the specific structure during fabrication and operation would serve as a basis for repair/modification of the structure and inspection/monitoring program. Some of the actual features observed during this follow-up are identified as “gross errors.” Sometimes undesirable events have led to accidents before they are identified and ameliorated. The motivation for introducing damage tolerance requirements is highlighted, and it is shown how limit states can be formulated in terms of ALS criteria. The focus herein is on formulating a limit state to achieve damage tolerance or robustness of the structural system with respect to the progressive development of damages into different global failure modes such as overall instability (loss of equilibrium) and global hull collapse and a possible station-keeping system failure. Damage due to accidental actions and abnormal resistance due to fabrication errors and abnormal deterioration and relevant actions on the damaged structure are considered. These ALS criteria implicitly account for the effect of human errors on internal and external actions and resistances. Despite many features to consider, it is crucial to make it simple enough for use in engineering design. The development of an approach for the Norwegian Continental Shelf is used as an example in this paper. The basic principle is that the risk-informed ALS check is a two-step procedure:

• – estimation of the damage corresponding to accidental events with an annual probability of exceedance of 10−4.

• – demonstration of the “survival” of the damaged structure, under specified permanent and environmental actions (10−2 or 10−1 depending on correlation between the damage scenario and environmental conditions.

These principles for ALS are also applicable in other regulatory regimes; however, different characteristic values of actions and resistances may be adopted.

The ALS criteria are formulated to formally comply with a certain risk acceptance level, based on actuarial probabilities, while ULS and FLS criteria are primarily based on notional probabilities estimated by SRMs and accounting for the normal uncertainties in actions and resistances and inspection quality.

It is believed that the risk-based ALS approach yields a consistent damage tolerance measure with respect to total collapse by expressing the probability of total loss by a sum of products of the probability of the hazard and the corresponding damage and the conditional probability of overall failure. The conditional probability of global failure under payloads and environmental actions for damage with a given magnitude and location represents a vulnerability measure relating to the relevant damage (hazard).

It is noted that the NORSOK N-001 ALS criteria are not meant to account for design errors. However, this is an issue still subjected to discussion among code writers.

The basic ALS requirement refers to the survival of the structure in certain damage conditions, including possible component fatigue failures. However, it is noted that robustness with respect to fatigue failure also can be provided by using a high FDF.

The ALS criterion presented refers to total structural collapse and, hence, the collapse of the deck where personnel on manned platforms is located. Therefore, consequences in terms of fatalities are reflected in the ALS criterion. Economic consequences are only partly reflected in this criterion since moderate damages might also contribute to economic losses.

In a more broad interpretation of robustness, in terms of the structure’s sensitivity to the deviation of action effects and resistances from normal conditions, it is suggested that standards “encourage” designers to reduce the risk of failure associated with system behavior that is very sensitive to uncertain parameters by a conservative choice of parameters. Typical examples include the choosing damping in a conservative manner in connection with resonant dynamic response and assuming local imperfections conservatively in connection with the fatigue analysis unless such features are accounted for by safety factors or margins. However, there is limited tradition for differentiating partial factors depending on special features as mentioned earlier. It is envisaged that such issues, beyond what are covered in existing standards, are dealt with in establishing the specific design basis especially for novel “mega-structures,” considering the relevant circumstances.

## Acknowledgment

The experiences documented herein are based on excellent cooperation with many people in carrying out the research as well as developing especially NORSOK, ISO, and IEC standards. I gratefully acknowledge the cooperation with my colleagues.

## References

1.
ISO 2394
,
2015
, “
General Principles on Reliability for Structures
,”
International Organization for Standardization
,
London, UK
.
2.
EN 1990
,
2010
, “
Eurocode—Basis for Structural Design
,”
Brussels
.
CEN/TC 250
3.
ISO 19900
,
2013
, “
Petroleum and Natural Gas Industries—Offshore Structures—Part 1: General Requirements, Part 2: Fixed Steel Structures
,”
International Organization for Standardization
,
London, UK
.
4.
API
,
1993–1997
, “
Recommended Practice for Planning, De-Signing and Constructing Fixed Offshore Platforms
,”
American Petroleum Institute
,
Dallas
,
API RP2A-WSD July 1993 with Supplement 1 with Sect., 17.0, Assessment of Existing Platform
,
February
1997.
5.
NORSOK N-001
,
2012
, “
Structural Design
,”
Norwegian Technology Standards
,
Oslo, Norway
.
6.
Moan
,
T.
,
2009
, “
Development of Accidental Collapse Limit State Criteria for Offshore Structures
,”
Struct. Saf.
,
31
(
2
), pp.
124
135
. 10.1016/j.strusafe.2008.06.004
7.
ISO 22111
,
2007
, “
Bases for Design of Structures—General Requirements
,”
International Organization for Standardization
,
London
.
8.
CPNI
,
2011
, “
Review of International Research on Structural Robustness and Disproportionate Collapse
,”
Centre for the Protection of National Infrastructure (CPNI), Queen’s Printer and Controller of Her Majesty’s Stationery Office
,
London, UK
.
9.
NPD
,
1984
, “
Regulations for Load-Carrying Structures for Extraction or Exploitation of Petroleum
,”
The Norwegian Petroleum Directorate
,
Stavanger
.
10.
Moan
,
T.
,
1983
, “
Safety of Offshore Structures
,”
Proceedings of 4th International Conference on Applications of Statistics and Probability in Soil and Structural Engineering (ICASP)
,
Firenze
,
June 13–17
,
Pitagora Editrice
, pp.
41
85
.
11.
Madsen
,
H. O.
,
Krenk
,
S.
, and
Lind
,
N.
,
1986
,
Methods for Structural Safety
,
Prentice-Hall, Englewood Cliffs
,
NJ
.
12.
Yang
,
Y. N.
,
1994
, “
Application of Reliability Methods to Fatigue, Quality Assurance and Maintenance
,”
The Freudenthal Lecture, Proceedings of 6th International Conference on Structural Safety and Reliability (ICOSSAR)
,
Innsbruck
,
Aug. 9–13
,
AA Balkema
,
Rotterdam-Brookfield
, Vol.
1
, pp.
3
18
.
13.
Moan
,
T.
,
1994
, “
Reliability and Risk Analysis for Design and Operations Planning of Offshore Structures
,”
Proceedings of 6th International Conference on Structural Safety and Reliability (ICOSSAR)
,
Innsbruck
,
Aug. 9–13
,
AA Balkema
,
Rotterdam-Brookfield
, Vol.
1
, pp.
21
43
.
14.
Lotsberg
,
I.
,
Sigurdsson
,
G.
,
Fjeldstad
,
A.
, and
Moan
,
T.
,
2016
, “
Probabilistic Methods for Planning of Inspection for Fatigue Cracks in Offshore Structures
,”
Mar. Struct.
,
46
, pp.
167
192
. 10.1016/j.marstruc.2016.02.002
15.
Vinnem
,
J. E.
,
2014
,
Offshore Risk Assessment
,
Springer
,
London, UK
.
16.
Chakrabarti
,
S.
,
2005
,
Handbook of Offshore Engineering
, Vols.
1, 2
,
Elsevier
,
Amsterdam, The Netherland
.
17.
Moan
,
T.
,
2005
, “
Reliability-Based Management of Inspection, Maintenance and Repair of Offshore Structures
,”
Struct. Infrastruct. Eng.
,
1
(
1
), pp.
33
62
. 10.1080/15732470412331289314
18.
Bea
,
R. G.
,
2000
,
Achieving Step Change in Risk Assessment & Management (RAM)
,
Centre for Oil & Gas Engineering, University of Western Australia
,
Nedlands, Western Australia
.
19.
WOAD, Worldwide Offshore Accident Database
.
DNVGL
,
Oslo
, Updated Continuously.
20.
RI
,
1981
, “
Collapse and Sinking of Mobile Offshore Drilling Unit Ranger I in the Gulf of Mexico on 10 May 1979 With Loss of Life
,”
Marine Casualty Report
.
U.S. Coast Guard
,
Washington, DC
.
21.
ALK
,
1981
, “
The Alexander L. Kielland Accident
(in Norwegian—English translation available)
,
NOU
1981:11,
Oslo, Norway
.
22.
OR
,
1984
, “
Royal Commission on the Ocean Ranger Marine Disaster
,”
Report 1: The Loss of the Semi-submersible Drill Rig Ocean Ranger and Its Crew, Edifice Fort William
,
St. Johns Newfoundland
,
Canada
.
23.
PA
,
1990
,
The Public Inquiry in the Pipe Alpha Disaster
,
Inquiry Commission HMSO
,
London, UK
.
24.
P-36
,
2001
, “
Workshop on the Accident With the P-36 Platform
,”
Petrobras
and
Coppe
, eds.,
Rio de Janeiro, Brazil
.
25.
DH
,
2012
,
Macondo Well: Deepwater Horizon Blowout
,
Marine Board, National Academy of Engineering and National Research Council
.
Washington, DC.
26.
Moan
,
T
.,
1985
, “The Progressive Structural Failure of the Alexander L. Kielland,”
Platform in Case Histories in Offshore Engineering
,
G.
Maier
, ed., CISM Courses and Lecture Series, No. 283,
Springer-Verlag
,
Berlin
, pp.
1
42
..
27.
Bach-Gansmo
,
O.
,
Carlsen
,
C. A.
, and
Moan
,
T.
,
1987
, “
Fatigue Assessment of Hull Girder for Ship Type Floating Production Vessels
,”
Proceedings of the International Conference on Mobile Offshore Units
,
Sept.
,
City, University of London
,
London
, pp.
1
24
.
28.
Vårdal
,
O. T.
, and
Moan
,
T.
,
1997
, “
Predicted Versus Observed Fatigue Crack Growth. Validation of Probabilistic Fracture Mechanics Analysis of Fatigue in North Sea Jackets
,”
Proceedings of 16th International Conference Offshore Mechanics & Arctic Engineering
,
Yokohama
,
Japan
,
Apr. 13–17
, vol.
2
, pp.
189
197
.
29.
Vårdal
,
O. T.
, and
Moan
,
T.
,
2016
, “
Lessons Learned From Predicted Versus Observed Fatigue of Offshore Steel Structures in the North Sea
,”
Proceedings of 3rd Offshore Structural Reliability Conference OSRC
,
Stavanger, Norway
,
Sept. 14–16
, pp.
251
270
.
30.
Pugsley
,
A. G.
,
1966
,
The Safety of Structures
,
Edward Arnold
,
London
.
31.
Pugsley
,
A. G.
,
1973
, “
The Prediction to Proneness to Structural Accidents
,”
Struct. Eng.
,
51
(
6
), pp.
195
196
.
32.
Kobayashi
,
H.
, “
Case Details: Brittle Fracture of Liberty Ships
,” Sozogaku.com, Accessed October 28, 2016.
33.
Fisher
,
J. W.
,
1984
,
Fracture and Fatigue in Steel Bridges
,
John Wiley & Sons
,
New York
.
34.
Moan
,
T.
,
2007
, “
Fatigue Reliability of Marine Structures, From the Alexander Kielland Accident to Life Cycle Assessment
,”
Int. J. Offshore Polar Eng.
,
17
(
1
), pp.
1
21
.
35.
Lotsberg
,
I.
,
2016
,
Fatigue Design of Marine Structures
,
Cambridge University Press
,
London, UK
.
36.
Fjeld
,
S.
,
1977
, “
Reliability of Offshore Structures
,”
Proceedings of 9th Offshore Technology Conference
,
Houston, TX
,
Paper No. OTC 3027
.
37.
Moses
,
F
.,
1987
, “
Load and Resistance Factor Design-Recalibration LFRD
,”
API
,
Dallas, TX
,
Report No. API PRAC 87-22
.
38.
Moan
,
T.
,
1995
, “
Safety Level Across Different Types of Structural Forms and Material—Implicit in Codes for Offshore Structures
,”
Trondheim, Norway
,
SINTEF Report STF70 A95210
.
39.
DNVGL
,
2015
, “
Probabilistic Methods for Planning of Inspection for Fatigue Cracks in Offshore Structures
,”
Recommended Practice DNVGL-RP-0001
.
40.
Matousek
,
M.
, and
Schneider
,
J.
,
1976
,
Untersuchungen Zur Struktur des Sicherheitproblems bei Bauwerken
,
Institut für Baustatik und Konstruktion der ETH
,
Zürich
.
41.
Ellingwood
,
B.
, and
Leyendecker
,
E. V.
,
1978
, “
Approaches for Design Against Progressive Collapse
,”
ASCE J. Strut. div.
,
104
(
3
), pp.
413
423
.
42.
Bea
,
R. G
.,
2005
, “Design for Reliability: Human and Organisational Factors”,
Handbook of Offshore Engineering
,
S.
Chakrabarti
, ed.,
Elsevier
,
Amsterdam
, Chap. 12.
43.
Faber
,
M. H.
, and
Andre
,
J.
,
2016
, “
WG6.T.1-Robustness in Eurocodes
,”
Brussels
,
Background Report to EN1990. CEN/TC 250
.
44.
PSA
,
2015
, “
Regulations Relating to Design and Outfitting of Facilities, etc. in the Petroleum Activities (the Facilities Regulations)
,”
Last amended December 18, 2015
, cf. p.
5
.
45.
Russo
,
V. L.
, and
Robertson
,
J. B.
,
1950
, “
Standards for Stability of Ships in Damaged Condition
,”
Paper 7 in SNAME-Meeting, New York, Nov. 9–10, Trans. SNAME
,
58
, pp.
478
566
.
46.
ABS
,
1973
,
Rules for Building and Classing Offshore Mobile Drilling Units
,
American Bureau of Shipping
,
New York
.
47.
Beckwith
,
I.
, and
Skillman
,
M.
,
1975
, “
Assessment of the Stability of Floating Platforms
,”,
Trans. North East Coast Eng. and Ship Building
,
91
(
5
), pp.
143
154
.
48.
IACS
,
1997
,
Longitudinal Strength of Hull Girder on Flooded Condition for Bulk Carriers, S17 (Revised July 6, 2004)
.
49.
CEN
,
2014
, “
Actions on Structures. Part 1–7: General Actions-Accidental Actions
,”
European Committee for Standardization
,
Brussels
,
European Standard EN1991-1-7
.
50.
Moan
,
T.
,
Karsan
,
D.
, and
Wilson
,
T.
,
1993
, “
Analytical Risk Assessment and Risk Control of Floating Platforms Subjected to Ship Collisions and Dropped Objects
,”
Proceedings of 25th Offshore Technology Conference
,
Houston, TX
, Vol.
1
, pp.
407
418
,
Paper No. OTC 7123
.
51.
Gallagher
,
J. P.
,
1985
, “
USAF Damage Tolerant Design Handbook: Guidelines for the Analysis and Design of Damage Tolerant Aircraft Structures
,”
Flight Dynamics Laboratory Air Force Wright, Wright-Patterson AFB
,
OH
.
52.
FAA
, “
Airworthiness Requirements
,”
US Federal Aviation Adninistration
,
FAR 25b
.
53.
Moan
,
T.
,
Amdahl
,
J.
, and
Ersdal
,
G.
,
2019
, “
Assessment of Ship Impact Risk to Offshore Structures—New NORSOK N-003 Guidelines
,”
Mar. Struct.
,
63
, pp.
480
494
. 10.1016/j.marstruc.2017.05.003
54.
NORSOK N-003
,
2017
,
Actions and Action Effects
,
Norwegian Technology Standards
,
Oslo, Norway
.
55.
DNVGL
,
2016
, “
Determination of Structural Capacity by Non-Linear FE Analysis Methods
,”
Oslo
,
DNV GL-RP-C208
.
56.
Skallerud
,
B.
, and
Amdahl
,
J.
,
2002
,
Nonlinear Analysis of Offshore Structures
,
Research Studies Press Ltd.
,
Baldock, Hertfordshire, UK
.
57.
Haver
,
S.
,
2016
, “
Airgap and Safety: Met-Ocean Induced Uncertainties Affecting Airgap Assessments
,”
Proceedings of 3rd Offshore Structural Reliability Conference OSRC
,
Stavanger, Norway
,
Sept. 14–16
,
NTNU
,
Trondheim
.
58.
Moan
,
T.
,
2009
, “
Safety Management of Deep Water Station-Keeping Systems
,”
J. Mar. Sci. Appl.
,
9
(
8
), pp.
83
92
. 10.1007/s11804-009-8101-5
59.
Zayas
,
V. A.
,
Mahin
,
S. A.
, and
Popov
,
E. P.
,
1982
, “
Ultimate Strength of Offshore Steel Structures
,”
Proceedings of 3rd Boss Conference
,
Boston, MA
,
Aug. 2–5
, pp.
34
58
.
60.
Lloyd
,
J.
, and
Clawson
,
W. C.
,
1983
, “
Reserve and Residual Strength of Pile Founded Offshore Platforms
,”
Proceedings of International Symposium on the Role of Design, Inspection, and Redundancy in Marine Structural Reliability
,
Williamsburg, VA
,
National Academic Press
, pp.
157
198
.
61.
Moan
,
T.
,
Amdahl
,
J.
,
Engseth
,
A. G.
, and
Granli
,
T.
,
1985
, “
Collapse Behaviour of Trusswork Steel Platforms
,”
Proceedings of 4th Boss Conference
,
Elsevier
,
Amsterdam
, vol.
2
, pp.
255
268
.
62.
Wang
,
X.
, and
Moan
,
T.
,
1996
, “
Stochastic and Deterministic Combinations of Still Water and Wave Bending Moments in Ships
,”
Mar. Struct.
,
9
(
8
), pp.
787
810
. 10.1016/0951-8339(95)00022-4
63.
Rodrigues
,
J. M.
,
Teixeira
,
A. P.
, and
Guedes Soares
,
C.
,
2015
, “
Probabilistic Analysis of the Hull-Girder Still Water Loads on a Shuttle Tanker in Full Load Condition, for Parametrically Distributed Collision Damage Spaces
,”
Mar. Struct.
,
44
, pp.
101
124
. 10.1016/j.marstruc.2015.08.002
64.
Yu
,
Q.
,
Guha
,
A.
, and
Wang
,
X.
,
2016
, “
Assessment of Intact and Damage Stability Regulations for Offshore Floating Structures—In Reliability and Risk Perspectives
,”
Proceedings of 3rd Offshore Structural Reliability Conference
,
Stavanger, Norway
,
Sept. 14–16
,
NTNU
,
Trondheim
.
65.
BMT
,
2006
, “
Review of Issues Associated With the Stability of Semi-Submersibles
,”
Prepared by BMT Fluid Mechanics Limited for the Health and Safety Executive, Research Report 473
.
66.
NMA
,
Regulations of 20. Dec. 1991. No. 878 on Stability, Satertight Subdivision and Watertight/Weathertight Means of Closure on Mobile Offshore Units”, with Amendments, the Last One on 19. Dec. 2017
.
Norwegian Maritime Authority
,
Haugesund, Norway
.
67.
Moan
,
T.
,
Brevig
,
P.
,
Soma
,
H.
, and
Dahle
,
L. A.
,
1984
, “
Experiences and Results Gained During the MOPS and Ocean Ranger Projects
,”
MOPS Report No. 23
,
Marintek
,
Trondheim
.
68.
Dahle
,
L. A.
,
1986
, “Mobile Platform Stability: The MOPS Project,”
Advances in Underwater Technology, Ocean Science and Offshore Engineering. Vol. 9 Stationing and Stability of Semi-Submersibles, Society for Underwater Technology
,
Graham & Trotman
,
London, UK
.
69.
Smedley
,
P.
, and
Petruska
,
D.
,
2014
, “
Comparison of Global Design Requirements and Failure Rates for Industry Long-Term Mooring Systems
,”
Proceedings of Offshore Structural Reliability Conference
,
Houston, TX
,
Sept. 16–18
, pp.
301
324
.
70.
Baker
,
J. W.
,
Schubert
,
M.
, and
Faber
,
M.
,
2008
, “
On the Assessment of Robustness
,”
Struct. Saf.
,
30
(
3
), pp.
253
267
. 10.1016/j.strusafe.2006.11.004
71.
Starossek
,
U.
, and
Haberland
,
M.
,
2008
, “
Measures of Structural Robustness–Requirements and Applications
,”
ASCE Conference on Crossing Borders
,
Vancouver, British Columbia, Canada
,
Apr. 24–26
.
72.
André
,
J.
,
Beale
,
B.
, and
Baptist
,
A. M.
,
2017
, “
Structural Risk Analysis Based on Robustness and Fragility Indices
,”
12th International Conference on Structural Safety & Reliability
,
Vienna, Austria
,
Aug. 6–10
, pp.
2541
2550
.
73.
Frangopol
,
D.
, and
Curley
,
J.
,
1987
, “
Effects of Damage and Redundancy on Structural Reliability
,”
J. Struct. Eng.
,
113
(
7
), pp.
1533
1549
. 10.1061/(ASCE)0733-9445(1987)113:7(1533)
74.
Okasha
,
N. M.
, and
Frangopol
,
D. M.
,
2009
, “
Lifetime Oriented Multiobjective Optimization of Structural Maintenance Considering System Reliability, Redundancy and Life-Cycle Costs Using GA
,”
Struct. Saf.
,
31
(
6
), pp.
460
474
. 10.1016/j.strusafe.2009.06.005
75.
NORSOK N-004
,
2013
,
Design of Steel Structures
,
Norwegian Technology Standards
,
Oslo, Norway
.
76.
Moan
,
T
.,
1998
, “Target Levels for Structural Reliability and Risk Analysis of Offshore Structures,”
Risk Reliability in Marine Technology
,
C.
Guedes Soares
, ed.,
CRC Press
,
Abington on Thames, Oxfordshire
, pp.
351
368
.
77.
HSE
,
2002
, “
Target Levels for Reliability-Based Assessment of Offshore Structures During Design and Operation
,”
Health & Safety Executive
,
UK
,
Offshore Technical Report No. OTO 1999/060, Prepared by Aker Offshore Partner A.S (through SINTEF project 700664/T. Moan)
.
78.
Jordaan
,
I. J.
, and
Maes
,
M. A.
,
1991
, “
Rational for Load Specifications and Load Factors in the New CSA Code for Fixed Offshore Structures
,”
Can. J. Civ. Eng.
,
18
(
3
), pp.
454
464
. 10.1139/l91-056