Life cycle structural integrity management of offshore structures

Abstract

An overview of structural integrity management of offshore structures in the oil and gas energy sector is presented in this article. Based on relevant experiences with the hazards, accidents and means to control the associated risks are categorised from a technical and physical as well as human and organisational point of view. Structural risk relates to extreme environmental and accidental events, as well as structural degradation and can be controlled by use of adequate design criteria, inspection, repair and maintenance as well as quality assurance and control of the engineering processes. Such measures are briefly outlined, with an emphasis placed upon a quantitative design approach for dealing with a life cycle approach especially relating to crack degradation phenomena. The current status of risk and reliability methodologies to aid decisions in the safety management of novel and mature offshore structures is briefly reviewed.

Keywords:

• Offshore structures
• structural integrity
• deterioration
• in-service experiences
• fatigue
• robustness
• quality management

Introduction

The continuous innovations in the oil and gas industry to deal with new serviceability requirements and demanding environments as well as the inherent potential of risk of fires and explosions have led to an industry which has been in the forefront of development of design and analysis methodology for structural integrity assessment. The focus in this paper is on structural integrity management during the life cycle – design, fabrication, installation and operation (Figure 1). The various types of marine structures experience different failure modes which ultimately can lead to fatalities, pollution or property loss. Structures supported on the seafloor can experience failure of the structure, foundation or soil, while buoyant structures can experience capsizing or sinking, hull or mooring system failure.

Figure 1. Life cycle phases of offshore structures.

Current industry practice is implemented in offshore codes, e.g. by API (1993–1997), ISO (19900, 2013) and NORSOK N-001 (2012), N-003 (2016) and N-004 (2013) as well as by many classification societies, and the most advanced codes are characterised by:

•	design criteria formulated in terms of serviceability and safety limit states, considering payloads, environmental and accidental loads,
•	semi-probabilistic methods for ultimate strength design which have been calibrated by reliability or risk analysis methodology,
•	fatigue design checks depending upon consequences of failure (damage-tolerance) and access for inspection,
•	explicit accidental collapse design criteria to achieve damage-tolerance for the system,
•	life cycle feature, with strong link between design, and inspection, monitoring, maintenance and repair (IMMR),
•	global and local structural analysis by finite element methods for ultimate strength and fatigue design checks,
•	non-linear analyses to demonstrate damage tolerance in view of inspection planning and progressive failure due to accidental damage,
•	state of the art methods for linear and non-linear structural analysis.

Moreover, reassessment of design is required during operation, for instance, because of planned change of platform function, updated knowledge about environmental loads, damages as well as in connection with extension of service life (ISO 19900, 2013). Basically, the reassessment involves the same assessments as carried out during initial design. However, depending upon the inherent damage tolerance ensured by the initial design, the measures that have to be implemented to improve the strength of an existing structure may be much more expensive than for a new structure. This fact commonly justifies use of more advanced methods than applied in the initial design (Moan, 2000).

The offshore industry early recognised that design took place under uncertainty and adopted risk and reliability methods to make more rational decisions. In addition to the uncertainties affecting the predicted behaviour under extreme and fatiguing conditions, inspection is subject to uncertainty. Reliability methods are, hence, crucial to support decisions about safety and economy of degrading structures. Significant developments of structural reliability methodology, including Bayesian updating techniques, have taken place since the 1980s, as outlined, e.g. by Madsen, Krenk, and Lind (1986) and reviewed by Yang (1994), Moan (1994), Lotsberg and Sigurdsson (2013) and Lotsberg (2016).

While current design and inspection procedures have been established on a reliability basis of the generic information available at the design stage, it is important that information obtained during operation of individual structures, e.g. by inspections during operation, is used to update the inspection plan. This fact implies dedicated IMMR efforts to each individual structure, in contrast to ULS criteria that are based on a generic code calibration. However, service experiences from other structures with similar geometry, loading and site of operation could obviously also be utilised to update IMMR plans for a given structure, e.g. Moan (2005).

Moreover, service experiences show that accidental loads and abnormal strength due to gross errors or omissions made during design, fabrication or operation, contribute significantly to the risk. Clearly, control of the risk associated with those kinds of events needs a broad safety management approach during the life cycle, including a proper measure of the risk; with considerations of the expenditure to achieve the desired safety level, e.g. Moan (2009).

In the following sections, characteristic safety features and an account of service experiences of offshore structures are briefly described, as a basis for formulating the structural integrity management approach. This includes a quantitative limit state for robustness to limit the likelihood of progressive failure, as well as QA/QC of the engineering process, fabrication and operation. Use of probabilistic methods to aid the design and decision process during operation is addressed; considering the fact that human errors play an important role on the safety. The focus will be on safety relating to deterioration processes.

Characteristic features

The principal features of offshore structures, such as size and layout, are primarily determined by their intended function and safety in their natural and industrial environment – including metocean and hydrocarbon fire and explosion hazards. A description of design and engineering analyses of different offshore structures, such as jackets, semi-submersibles, tension-leg, spar platforms may be found in Chakrabarti (2005) (Figure 2).

Figure 2. Example production facilities, including jacket, articulated tower, tension-leg and semi-submersible platforms.

The metocean, seismic and hydrocarbon hazards make safety an important issue for offshore platforms. Safety requirements are specified to avoid fatalities, environmental damage and property, and are related to the following failure modes:

•	overall, rigid body instability (capsizing) under permanent, variable and environmental loads,
•	failure of (parts of) the structure, foundation or mooring systems, considering permanent, variable, and environmental as well as accidental loads.

The complexity of offshore structures (Figure 3), their location far from shore and in a harsh environment, makes evacuation and rescue difficult, but on the other hand accidents on offshore facilities do not affect the general public in the same manner as accidents on land often do.

Figure 3. Large North Sea production platform with a petro-chemical process plant. (Courtesy Statoil).

In-service failure experiences

General

Safety may be defined as the absence of accidents or failures. Hence, useful insight about the safety features can be gained from the detailed investigations of catastrophic accidents, as described, e.g. by Moan (2005, 2007, 2009) and Vinnem (2014) for offshore structures. In addition, statistics about offshore accidents, regularly compiled in WOAD (n.d.), which provides an overview of offshore ‘accident rates’. Detailed investigations have been carried out for accidents with significant consequences; e.g. namely the three-legged jack-up Ranger (RI, 1981), semi-submersibles Alexander Kielland platform (ALK, 1981) and Ocean Ranger (OR, 1984), Piper Alpha (PA, 1990), P-36 (2001), Deepwater Horizon (DH, 2012).

Capsizing/sinking and global structural failures normally develop in a sequence of technical and physical events. Structural damage can cause progressive structural failure or flooding, which may result in capsizing of buoyant structures. However, to fully explain accident event sequences, it is necessary to interpret them in view of the human and organisational factors (HOF) of influence.

Basically structural failure occurs when the resistance, R is less than the load effect, S. From an HOF point of view this can be due to too small safety factors to account for the normal uncertainty and variability in R and S relating to ultimate limit state (ULS) and fatigue limit state (FLS) criteria. But the main cause of actual structural failures is abnormal resistance or accidental or abnormal loads due to human errors and omissions. Design errors materialise as a deficient (or excessive) resistance, which cannot be derived from the parameters affecting the ‘normal’ variability of resistance. Fabrication imperfections (such as cracks, plate misalignment, etc.), which also affect the resistance, are influenced by human actions. The ‘normal’ variability of welders performance, environmental conditions, etc., lead to a ‘normal’ variability in the imperfection size, characterised by a smooth variation of the relevant imperfection parameter. Sometimes an abnormal deviation from this behaviour occurs, e.g. caused by using a wet electrode, or another gross fabrication error.

Thus, the initial fatigue failure of a brace in the Alexander L. Kielland platform was due to lack of fatigue design checks, fabrication defects as well as inadequate inspection (Moan, 1985). Even though the fatigue failures that had occurred in semi-submersibles in the period 1965–1970 resulted in fatigue requirements, the requirements were not properly implemented even for platforms built in the 1970s. Many platforms built in the 1970s had joints with design fatigue lives as low as 2–5 years when operating in extratropical regions. Fatigue failure has been rediscovered many times, even in marine technology, since Wöhler’s initial discovery more than 150 years ago.

Overload damages and failures of hull structures

Man-made live loads have a ‘normal’ and an abnormal component, while some loads, notably fires and explosions, ship collisions, etc. do not have a normal counterpart. They are simply caused by operational errors or technical faults. The mobile platform Ocean Ranger capsized offshore Newfoundland in 1982. The accident was initiated by a control room window breaking due to wave slamming. The water entering the control room led to short circuit of the ballast valve system, thereby leading to spurious operation of ballast valves. The resulting accidental ballast condition could not be controlled partly because of lack of crew training and partly because of inadequate ballast pumps, and open chain lockers (OR, 1984).

The significant damage to the jacket in Figure 4(a) was caused during the hurricane Lilli in the Gulf of Mexico by waves hitting platform deck due to apparently too small deck clearance. The catastrophic explosion and fire on the Piper Alpha platform (Figure 4(b)) in 1988 was initiated by a gas leak from a blind flange of a condensate pump that was under maintenance and not adequately shut (PA, 1990). The gas ignited and the initial explosion led to damage of an oil pipe and subsequent oil fire and explosion. In 2001 the platform P-36 in Brazil experienced a burst collapse of the emergency drainage tank, accidental explosion and subsequent flooding, capsizing and sinking. A series of operational errors were identified as the main cause of the first event and also the sinking (P-36, 2001). Other accidents and structural failures are discussed, e.g. by Vinnem (2014).

Figure 4. (a) Jacket in the Gulf of Mexico after the Lilli hurricane and (b) PiperAlpha after the explosion/fire PA (1990).

Fatigue and other degradation of hull structures

Degradation due to corrosion and fatigue crack growth would normally develop slowly to failure. However, fatigue can cause catastrophic accidents if the fatigue life is not sufficient to make IMMR effective or if there is lack of robustness, as for the Ranger I and Alexander Kielland platforms.

Crack is the most critical degradation phenomenon, because it could result in rupture. The stages of crack growth depend upon the layout of the structure. For a frame or truss structure consisting of slender members, it is natural to consider crack growth in the following stages: visible crack, through-thickness crack, and failure (rupture) of member. In monocoque structures like ships, the situation is different in that cracks in the main hull girder can grow continuously until global rupture of the hull Bach-Gansmo, Carlsen, and Moan (1987). Fatigue failure, as inferred from SN curves, is normally taken to be a crack through the plate thickness, while the true failure (rupture) occurs for a large crack. Cracks are for instance always present at welds. The development of cracks depends on their initial size (normally about 0.1 mm), uncertainties in the stresses driving the crack, fatigue resistance and the inspection method used to detect the crack.

Due to the very nature (small size) of initial (fabrication) defects, an abnormal size of such defects often has been the cause of fatigue cracks. Hence, cracks have been caused by (e.g. Moan, 2005, 2007):

•	not carrying out proper fatigue design checks and inspections and possible repairs (e.g. ALK, 1981),
•	error in load (stress) analysis (environmental conditions, method, stress concentration factor) and particular phenomena like VIV,
•	abnormal initial defect size, e.g. due to wet electrodes or improper pre-heating and post weld cooling/heating,
•	abnormal crack propagation, e.g. due to corrosion fatigue effects due to (increased crack propagation rate and plate thinning),
•	fatigue caused by cathodic overprotection or loss of protection relating to corrosion effects,
•	abnormal local geometry due to deviation between as-built structure deviating and design or bad design; hence, inspection engineering should always refer to the as-built condition.

Extensive experience regarding cracks in North Sea jacket platforms and semi-submersible drilling platforms have been reported by Vårdal and Moan (1997), Moan, Vårdal, and Johannesen (1999), Moan (2005, 2007) and Vårdal and Moan (2016) recently summarised data from inspections of jackets and semi-submersibles in Tables 1 and 2.

Table 1. Summary of the collected experience data from 40 jacket structures in the North Sea. A total of 3366 NDE inspections have been reported (Vårdal & Moan, 2016).

	Most likely fabrication defects	Potentially propagating cracks	Most likely propagating cracks	Total number of cracks
# of cracks	228	124	159	511
% of inspections	6.8%	3.7%	4.7%	15.2%

Table 2. Summary of the collected experience data from 12 semi-submersible with more than 20 years of operation time in the North Sea. A total of 22282 NDE inspections have been reported (Vårdal & Moan, 2016).

	Most likely fabrication defects	Potentially propagating cracks	Most likely propagating cracks	Total number of cracks
# of cracks	205	324	622	1164
% of inspections	0.9%	1.5%	2.8%	5.2%

The occurrence of cracks in jackets has been correlated with fatigue predictions. The most important lessons learnt are that the initial methods used in general were conservative, but 2–3% of the cracks detected were not predicted. The latter fact indicates that gross fabrication defects occur. The average crack depth of propagating cracks detected was 4.8 mm, with a small percentage of through-thickness cracks. Another lesson was the significant difference in relative crack occurrences in platforms installed before and after 1978. All data for semisubmersibles have not yet been correlated with predictions of fatigue performance. However, comparisons made show that deviation between observations and predictions are especially due to discrepancies between design drawings and specification and as-built structural geometry as well as excessive weld defects, as exemplified later. Even if the most fatigue-prone and critical areas of jackets and semi-submersibles are much more limited in extent than for ships, there might be several hundred hotspots to follow up. It should be noted that limited experiences are available for novel concepts like TLPs and Spar platforms.

Unknown phenomena

In some cases, lack of knowledge in the engineering profession at large has caused accidents. Such phenomena have then been unknown to the profession and have not been accounted for in regulations and standards. They often occur in times with novel technology, significant activity and pressure on time, e.g. Pugsley (1966, 1973), Randall (1973) and Chilver (1977). A particularly representative example of this kind of accident is the brittle fractures of several Liberty ships (e.g. Kobayashi, 2016). They occurred in the Second World War using new welding techniques to produce a large number of ships in great haste. The steel that had worked well in riveted construction exhibited a brittle behaviour when welded. In particular, crack nucleated at the square corner of a hatch which coincided with a welded seam, fractured. It is noted that these fractures occurred about 20 years after the launching of Griffith theory to deal with brittle fracture.

In the history of fatigue performance there are related examples. Wöhler discovered the fatigue of railway axles in 1860–1870, and others also contributed to the development of the understanding of fatigue phenomenon. The engineering community ‘rediscovered’ the phenomenon in connection with Comet aircrafts around 1950 (e.g. Pugsley 1966, 1973), welded bridges (e.g. Fisher, 1984) and offshore platforms in 1960–1970 (e.g. Lotsberg, 2016). The remedy to deal with unknown phenomena is to apply R&D and to implement the results in regulations and standards.

Structural integrity management

General

In Table 3, the causes of failures are categorised and the corresponding measures to control the accident potential are listed. In general, the measures include design criteria, quality assurance and control (QA/QC) relating to the engineering process as well as the hardware and operational procedures. Hence, different safety measures are required to control error-induced risks of overloading due to accidental events, as indicated in Figure 5.

Table 3. Cause of structural failures and risk reduction measures.

Cause	Risk reduction measure
Less than adequate safety margin to cover ‘normal’ inherent uncertainties	• Increase safety factors or margins in ULS, FLS • Improve inspection of the structure (FLS)^a
Gross error or omission during: • design (d) • fabrication (f) • operation (o)	• Improve skills, competence, self-checking (for d, f, o) • QA/QC of engineering process (for d) • Direct design for damage tolerance (ALS) – and provide adequate damage condition (for f, o) • Inspection/repair of the structure (for f, o)^b
Unknown phenomena	• Research & Development

^a Measure by Structural Reliability Analysis.

^b Measure by Risk Assessment.

Figure 5. Risk control of accidental overload events-and the role of ALS.

Primarily, gross errors and their effects should be avoided by adequate competence, skills, attitude and self-checking of those who do the design, fabrication or operation in the first place; and by exercising ‘self-checking’ of their work. In addition, quality assurance and control (QA/QC) should be implemented in all stages of design, fabrication and operation. These facts are documented for aeronautical engineering by Pugsley (1966, 1973), in civil engineering by Matousek and Schneider (1976), Ellingwood and Leyendecker (1978) and for offshore structures, e.g. by Bea (2000, 2005).

The quality assurance and control of the engineering process have to address two different situations, which require different type of attention, namely:

•	detect, control and mitigate errors and omissions made in connection with technology that is known in the engineering community as such. With the increasing use of computers in the design, construction, and operation of oil and gas structures, software errors are of particular concern,
•	identify possible unknown phenomena, e.g. associated with load, response and resistance, and clarify the basis for accounting for such phenomena in design.

As mentioned above, operational errors typically result in fires or explosions or other accidental actions. Such events may also be controlled by appropriate measures such as detecting the gas/oil leakage and activating valve shut in; extinguishing of a fire by a deluge system activated automatically, etc. These actions are often denoted ‘Event Control’. In the treatment of the effect of the gross errors in design one might separate between identifiable/quantifiable vs. unidentifiable/unquantifiable hazards. Thus, errors resulting in accidental loads belong to the first category while design errors belong to the second category.

Despite the efforts made to avoid error-induced accidental actions or abnormal resistance, they cannot be completely eliminated. For this reason the trend is to base regulations on the following general safety principles (ISO 19900, 2013; ISO 2394, 2015; NORSOK N-001, 2012; PSA, 2015):

•	structural integrity to withstand environmental and operational loading,
•	prevent occurrence of and protect against accidental events,
•	tolerate at least one failure or operational error without resulting in a major hazard or damage to structure,
•	provide measures to detect, control and mitigate hazards at an early time to avoid accident escalation.

Accidental Collapse Limit State (ALS) criteria are introduced to limit the corresponding residual risk, i.e. to prevent progressive failure (Moan, 2009). This goal could be achieved by designing the structure locally to sustain accidental actions and other relevant actions. Alternatively, local damage may be accepted and the ALS requirement should focus on survival of the damaged structure to relevant actions (Figure 6).

Figure 6. Schematic illustration of the two-step ALS check in NORSOK N-001 (2012): (a) assessment of damage caused by an accidental action (A) ship impact – considering relevant permanent (P) and functional (F) loads and possibly environmental loads, (b) a check of the survival of the damaged platform under environmental load, E as well as P and F loads.

While there seems to be international agreement to consider accidental actions caused by operational errors, abnormal resistance due to fabrication errors might be considered unidentifiable and hence not considered in the ALS check. However, such damage (abnormal resistance) has been explicitly specified by generic values for specific types of structures based on some consideration of the vulnerability of the structural components and experiences. For instance, failure of slender braces in mobile drilling platforms (semi-submersibles) and tethers in tension leg platforms has been considered to be a relevant damage condition due to the vulnerability of these components.

Moan (2009) suggests that abnormal strength due to cracks is considered. The basis for this suggestion is the fact that crack type defects which are larger than the normal initial defects (which are of the order of 0.1 mm) could occur and escape detection at the fabrication stage. Inspections in air can reliably detect cracks which are about 1–2 mm and 15–20 mm deep, by NDE and close visual inspections, respectively. The occurrence of abnormal defects which are not detected at the fabrication stage, suggest that various barriers indicated in Table 7 should be considered to control them before they result in fracture.

The implication of these facts for, e.g. slender braces in semi-submersible platforms, designed with a fatigue design factor (FDF) of 1 and by assuming an (abnormal) initial defect size of 2.0 mm, is a failure probability over a 5-year period (i.e. before the first inspection) of the order of 10%. Reliance on sufficient residual fatigue life/fracture strength associated with ‘long’ through-thickness cracks (TTCs) is often difficult to document. Since the residual life with a TTC is small, the LBB approach is not applicable either and failure of a brace may be considered as damage condition for ALS check under such circumstances.

Moreover, the potential influence of human errors on fatigue failure needs to be accounted for partly by ALS design check but also in the IMMR. In addition, a large FDF will be an efficient risk control measure since it will reduce the stress level and hence crack growth rate and give more time for detecting and repairing cracks.

Design for robustness: Accidental Collapse Limit State

Accidental Collapse Limit State (ALS), initially called the Progressive Collapse Limit State, requirements are motivated by the design philosophy that ‘small damages, which inevitably occur, e.g. due to ship impacts, fires and explosions, and other accidental loads, as well as environmental hazards, should not cause disproportionate consequences’. This criterion is, hence, a robustness or damage tolerance criterion. The ALS criterion was formally first introduced for all failure modes of offshore structures in Norway in 1984 (NPD, 1984). The background and practising of the ALS criterion is described by Moan (2009).

The introduction of the quantitative robustness check in terms of ALS, was possible because FEMs had been developed for accomplishing the necessary non-linear structural analysis to estimate the damage and the strength of the damaged structure. ALS checks apply to all relevant failure modes, like, structural failure as well as instability/capsizing (in terms of intact and damage stability requirements for floating platforms).

The structural integrity criterion in NORSOK N-001 (2012) is a two-step procedure as illustrated in Figure 6. First, the initial damage due to accidental actions with an annual exceedance probability of 10⁻⁴ is estimated by a non-linear analysis or the damage at this probability level is specified, e.g. in terms of a failure of a slender member, mooring line etc. Accidental actions include the effects of fires, explosions, ship collisions, dropped objects as well as abnormal distribution of payload or ballast. Abnormal sea loads also need to be considered in the ALS check and are also mentioned.

The accidental loads are to be determined by risk analysis, see e.g. Vinnem (2014), accounting for relevant factors that affect the accidental loads. In particular, risk mitigation can be assumed to take place by reducing the probability or consequences of the hazards. The second step in the NORSOK ALS procedure is to demonstrate that the damaged structure resists relevant functional and environmental loads an annual exceedance probability of 10⁻² or a lower probability depending on the correlation between the accidental event and the environmental condition – without global failure. More details about accidental loads, risk analysis to estimate their magnitude, and their effect on structures may be found in, e.g. NORSOK N-003 and -004, Storheim and Amdahl (2014), Vinnem (2014), Czjuko et al. (2015) and OREDA (2014). The ALS criterion is supposed to include ‘abnormal’ wave and other environmental actions as well. Rather than a two-step approach described above, this check is a survival check based on an action corresponding to an exceedance probability of 10⁻⁴. In this connection the focus is on possible ‘abnormal’ waves, with high crest or other unusual shape, which is not a simple ‘extrapolation’ of the 10⁻² event (Haver, 2016; Tromans, 2014). The ALS procedure described above is that in NORSOK N-001. When it is used in other regulatory regimes other characteristic values of accidental and environmental events could apply.

Inspection, monitoring, maintenance and repair

Inspection, Monitoring, Maintenance and Repair (IMMR) should address all kinds of damages as well as conditions that could lead to damages. The occurrence of accidental damage due to fires/explosions and ship impacts should on one hand be controlled by surveillance of hydrocarbon leaks and ship traffic. Moreover, once the damage has occurred, it is easy to identify and initiate repairs.

Corrosion and crack growth need continuous surveillance. Corrosion damage is indirectly monitored by the quality of the coating or cathodic protection system; and eventually by thickness reduction. Moreover, there is normally ample time for repair in case of corrosion damage. The challenge is cracks. It is important that the IMMR reflects the fact that fabrication errors do occur and cause abnormal initial cracks. In view of the fact that a normal initial crack depth is about 0.1 mm, an abnormal crack is not that large. In general, therefore, it becomes important to ensure that there is ample time between visible (detectable) crack and fracture. A general remedy to ensure this feature is to limit the stress level by designing for fatigue by a large FDF or to ensure ultimate strength after member failure.

Reliability based design and inspection approach

General

Depending upon the regulatory regime, separate acceptance criteria for consequences such as fatalities, environmental damage or property damage are established. While fatalities caused by structural failures would be related to global failure, i.e. capsizing or total failure of deck support, smaller damages may result in pollution; or property damage which is expensive to repair, especially for the underwater part of a permanent structure.

In principle risk-based design could be carried out, by achieving a total system (structural layout, scantlings and equipment, procedures and personnel) that complies with a certain acceptable risk level. This is, however, not feasible in practice. In reality, different subsystems, like:

•	load-carrying structure & mooring system,
•	process equipment,
•	evacuation and escape system,

are designed according to criteria given for the particular subsystems. Safety criteria for the structural design of offshore structures may be classified as shown in Table 4. While ULS and FLS criteria are generally applied, the introduction of a quantitative ALS criterion by NPD (1984) was a significant step towards the generally agreed concept of making structures damage-tolerant (robust). The design criteria (Table 4) are specified to ensure that the failure probability will be sufficiently low. However, shortcomings in the design process and structural analyses require in-service assessments.

Table 4. Safety criteria for structural design.

Limit states	Description	Remarks
Ultimate (ULS)	• Overall ‘rigid body’ instability • Ultimate strength of structure, mooring or possible foundation	Different for bottom – supported, or buoyant structures
		Component design check of strength
Fatigue (FLS)	• Failure of welded joints	Component design check depending on residual system strength (see Table 6)
Accidental collapse (ALS)	• Ultimate capacity^a of damaged structure with ‘credible’ damage	System design check

^a Capacity to resist ‘rigid body’ instability or total structural failure.

The in-service measurements of, say, nominal stress levels may be used for validation of the global structural analysis and design assumptions. Laboratory experiments are used to validate local (hot spot) stresses as well as both ultimate and fatigue strength. Fatigue strength in design is normally based on SN curves, but crack initiation and propagation features would be required in a high fidelity analysis, e.g. for inspection planning.

Structural reliability methods (SRMs) have been developed as a tool to assess failure probability, based on normal variability and uncertainties. However, the SRM does not account for human errors. Hence, the probabilities should be considered notional and not ‘real’. Anyway the probabilities of overload failures are small and it is not meaningful to compare predicted and observed failure probabilities. However, the rate of fatigue failures (in terms of detected cracks, cracks through thickness, etc.) has sometimes been high, especially in old designs, with inadequate design practice. In such situations comparisons between predicted and observed frequency of fatigue cracks could in principle be made and have been made. Even if the SRM gives a notional probability, it is an indicator of the capability of the analyses to describe the actual failure potential. The failure detection frequency is also a trigger for extended assessment and inspection. This approach has been extensively used for jackets and semisubmersibles (Vårdal and Moan, 2016).

The fabrication quality is one of the main design assumptions. Deviations in the fabrication quality are one of the reasons for reduced correlation between observed failures and the probability for failure given by the analyses. The planned use of information from the inspection, repair, operation and modification history will determine the requirement for the process securing the data for the inspection, repair and modification history. However, this report describes how the inspection and repair history is applied as part of the assessment of structural integrity and define requirement for the inspection and modifications scope. Bayesian updating plays an important role in the analysis of information and data from inspections carried out.

Ultimate limit state criteria for structural design

General

Ultimate Limit State (ULS) criteria for overall stability of bottom-supported and floating structures as well as strength formulations are given e.g. by Chakrabarti (2005). Extreme loads with an annual exceedance probability of 10⁻² are normally required for ULS check, while for FLS check the local stress range history is needed for welded connections while the joint variation in stress range and mean stress is required, e.g. for base material.

Action effects for ULS design checks, are typically obtained by considering all or a carefully selected sea states and applying relevant hydrodynamic and structural models (NORSOK N-003, 2016): the challenges in predicting extreme wave action effects for ULS design of offshore structures relate to the complex wind-sea and swell conditions in certain areas like West Africa and modelling freak or rogue wave or crest and their occurrence rate as well as well as dealing with severe non-linear hydrodynamic effects. The latter effects include wave-in-deck loading, slamming, column run-up, green water on deck and excitation by steep, high waves, e.g. causing dynamic ringing effects, e.g. Haver (2016). Figure 4(a) illustrates a damaged platform due to wave actions on the deck structure. Methods for predicting the corresponding hydrodynamic actions are still quite uncertain, and experiments are necessary (e.g. NORSOK N-003). The structural analysis is normally hierarchical, starting with a global and obtaining the local stresses in principle by using substructures in the global analysis or zooming/submodelling techniques.

Ultimate strength formulations used in design are traditionally based on strength of material formulations and substantiated by extensive test results. However, design based on direct ultimate strength analysis, by using finite element methods and by accounting for non-linear geometric and material effects, is emerging.

Reliability measure

Structural reliability methods (SRMs) have been used to ensure that ULS requirements are consistent with the desired target safety level (as briefly described below and in HSE (2002), especially by the efforts by Fjeld (1978), Moses (1987), Lloyd and Karsan (1988), Moan (1988), and Jordan and Maes (1991), to calibrate the safety in design codes to a certain reliability level. An evaluation of previous efforts on calibration of offshore codes was provided by Moan (1995) in conjunction with the ISO effort to harmonise codes for offshore structures. Assessment of uncertainties in load effects and resistances was a crucial issue in these studies.

SRM is applied to determine the failure probability considering fundamental variability, as well as normal uncertainties due to lack of knowledge in loads, load effects and resistance. The state of art methods for calculating the failure probability are numerical First Order and Second Order Reliability Methods (FORM/SORM) as well as Monte Carlo simulation methods (e.g. Melchers, 1999). However, analytical solutions exists for a few cases, for instance, when failure is expressed by g() = R−S ≤ 0 and both the resistance R and the load effect S are normal or lognormal random variables. The failure probability is then expressed by:(1)

where Φ(−β) is the standard cumulative normal distribution and β is the reliability index. Numerical values of this relationship are shown in Table 5. The reliability index β = β_LN can be exactly expressed as follows when R and S have lognormal distributions, see e.g. Melchers (1999):(2)

Table 5. Relation between β and P_f.

β	1.0	1.4	1.8	2.2	2.6
Pf	0.16	0.081	0.036	0.014	0.47·10^−2
β	3.0	3.4	3.8	4.2	4.6
Pf	0.14·10^−2	0.34·10^−3	0.72·10^−4	0.13·10^−4	0.21·10^−5

This simple expression has turned out to be useful and was applied in the API reliability based code calibration (Moses, 1987). The analytical formulation can also conveniently used to express the relationship between P_f and safety factors. Simplified approximate reliability formats, like the Design Format Method (ISO2394, 2015, Appendix E.6), can be established based on the FORM approach. On the other hand, using the lognormal format to estimate the failure probability for cases where e.g. the distribution of S is not lognormal, may result in significant discrepancy in the P_f. Figure 7 compares the reliability indices, β as obtained by using two different assumptions of S as a function of the coefficient of variation V_R and V_S. This fact shows that the target level needs to be intimately associated with the reliability model applied to make decisions about reliability based code calibration.

Figure 7. Comparison of reliability indices corresponding to different distributions for resistance R and load effect S. β_LN = lognormal R and S; β_M = lognormal R and normal S. (a) CoV(R) = 0.1, CoV(S) – variable; (b) CoV(R) = 0.2, CoV(S) – variable.

Structural reliability methods provide notional estimates of failure probabilities. These probabilities are small (current ULS requirements for offshore structures imply notional failure probabilities of the order of 10⁻³–10⁻⁵ (Moan, 1995)). Similar or even lower values are targeted for civil engineering structures (e.g. EN 1990, 2008). These values are so low that accidents due to too low partial safety factors do not materialise for offshore structures (Moan, 1995).

Another matter is that gross errors that often cause failures (Table 3), is not recognised in the SRM. For this reason the structural reliability method (SRM) does not provide a measure of the real total risk level associated with offshore facilities. Yet, SRM is useful in ensuring that the ultimate strength and fatigue design criteria are consistent by calibrating safety factors for ULS and FLS criteria (Moan, 2014; Wisch, 2014). However, to achieve a true measure of safety, a risk assessment methodology is needed.

Since offshore structures are subjected to time variant loads, the failure probability should refer to a time interval, e.g. a year or the service life. This can be achieved by considering S as a random variable, referring to an annual or service life time maximum value. However, this approach is, however, not straightforward when the failure event is described by multiple load effect variables. Then more advanced methods are needed (Naess & Moan, 2012; Videiro & Moan, 1999).

Fatigue limit state criteria

General

Fatigue is an important consideration for structures in areas with more or less continuous storm loading (such as the North Sea) and especially for dynamically sensitive structures. Current fatigue design and analysis procedures for offshore structures especially matured in the last decades have been applied since the 1980s and 1990s (e.g. Lotsberg, 2016). Herein, a brief overview will be presented.

Fatigue crack growth is primarily a local phenomenon. Fatigue strength is commonly described by SN-curves, i.e. the number of cycles to failure, e.g. a through thickness crack, as a function of the stress (range) level, that have been obtained by laboratory experiments. Fracture mechanics analysis has been adopted to assess more accurately the different stages of crack growth including calculation of residual fatigue life beyond what is defined as fatigue failure in conjunction with SN-curves. Such detailed information about crack propagation is also required to plan inspections and repair (e.g. Almar-Naess, 1985). However, it is important to ensure that the fracture mechanics model is consistent with the SN-approach with respect to fatigue failure. This is because the initial crack size that needs to be modelled in the fracture mechanics is very uncertain while it is implicitly represented in the experimental data that serve as basis for the SN-approach (e.g. Ayala-Uraga & Moan, 2007).

A simple expression for the cumulative fatigue damage can be obtained by assuming that the SN-curve is defined by NS^m = K and the number, n(s) of stress ranges is given by the Weibull distribution:(3)

where A and B are the scale and shape parameters of the distribution, respectively. The corresponding uncertainty is modelled by the parameters A and B, which then depend upon uncertainties associated with environmental conditions, wave load model and structural modelling. These parameters might be expressed as: A = s₀/(ln N₀)^1/B; with s₀ corresponding to P[S ≥ s₀] = 1/N₀, where N₀ is the number of cycles in a reference period for s₀. The cumulative damage, D in a period, t with N_T cycles, is then:(4)

where is the Gamma function. The assumption of Weibull distribution of stress ranges is relevant for platforms operating in extratropical regions. The expression in Equation (4(4) ) can be refined by considering other models for the load effects (stress ranges) and SN curves (e.g. Almar-Naess, 1985).

Reliability measure

The elementary reliability format (2) may also be used to obtain an estimate for the fatigue reliability based on the SN formulation. By expressing fatigue failure by:(5)

Equation (2(2) ) can be used with R = Δ (cumulative damage at failure) and S = D. Moreover, if only the dominant variables s₀ and K are taken as random variables with lognormal distribution as advocated by Wirsching (1983) a lognomal reliability format can be formulated (see further discussion by Moan (2004)). For a fatigue design with allowable damage Δ_all = 1.0 and 0.1; the implied P_f’s are about 0.1 and 2∙10⁻³–3∙10⁻⁵, depending on uncertainty measures, respectively, in the service life. With a notional probability of fatigue failure in the service life of the order of 0.1 when the fatigue design factor is taken to be 1.0, inspection and repair are clearly required to ensure adequate lifetime safety (Moan, 2005). In addition, gross errors could occur.

Reliability estimates by account of inspection

The failure probability, P_f, of a specific structural component can be updated through additional information obtained by response measurement or observed damages and a fracture mechanics model of the crack growth, such as the Paris-Erdogan formulation, namely:(6)

where a is crack depth, N is number of cycles, C is crack growth parameter, m is the inverse slope of the SN curve, and ΔK_th is a threshold of the stress intensity factor range ΔK given as a function of a.

For instance, when inspections are made, say with no detection of cracks in joint i after a time, t in-service, the failure probability of joint j may be updated as follows:(7)

where the failure event is:(7a)

and the inspection event is:(7b)

for the j’th joint. a_c and a_d are the critical and detectable crack size, respectively. See e.g. Madsen et al. (1986, 1987) and the overview by Moan (2008). The updated P_f of joint i based on the inspection of joint j depends on the correlation between the g_j(a) and IE_j events. Equations (7a(7a) –7b(7b) ) can be recasted in a convenient form for analysis as shown by Madsen et al. (1986).

Inspection quality

The quality of NDE methods for detection of cracks in metal structures is expressed by a probability of detection (POD) curve, which corresponds to the distribution function of detectable crack size a_d. Various sources of POD data are presented by Moan (2005) and in (DNVGL, 2015). In practice it is important to define the quality of NDE inspections in classes in the range of a mean POD from 0.4 to 1.6 mm (Vårdal & Moan, 2016), depending upon the competence of the inspection crew and environmental conditions; e.g. air vs. underwater. The reliability of assessing corrosion damage relates to the accuracy of estimating the change of thickness due to corrosion.

Uncertainties

The failure probability is crucially dependent upon the uncertainty measures of load and resistance parameters. It is important that authoritative values of the stochastic variables are used. Relevant uncertainty measures are given, e.g. by Lotsberg et al. (2016), and in DNVGL (2015).

Calculation of reliability

It is noted that the FORM/SORM methodology is approximate and should be validated by using ‘converged’ Monte Carlo simulation (e.g. Ayala-Uraga & Moan, 2002). This is particularly important for calculating the probability of intersections of events.

Guidelines on inspection planning with respect to fatigue cracks

Recently DNVGL (2015) issued a comprehensive guidance for use of probabilistic methods for inspection planning with respect to fatigue cracks in jacket structures, semisubmersibles and floating production vessels. The approach is rather general and may also be used for inspection planning of other structures subjected to significant dynamic loading such as jackups.

Validation

The various models that constitute the reliability analysis method may be validated by: using model tests or full scale measurements to validate wave induced nominal stress; model tests to validate hot spot stress and fatigue strength and the reliability model at large by direct comparison of predicted and observed crack occurrences (e.g. Moan, 2005). The comparison by Vårdal and Moan (1997) showed that the number of predicted propagating cracks identified in 3411 inspections of tubular joints in jackets, was typically 3–10 times larger than the number observed. This discrepancy can be traced back to uncertainties (conservatism) in the prediction of the (nominal) stress. On the other hand 2–3% of the cracks were not predicted, since they occurred due to gross fabrication errors and were not predicted, as mentioned above.

The effect of inspection on the fatigue reliability

The effect of inspection may be estimated in two different ways: (a) at the design stage, before inspections are done, or (b) after the actual inspection has been made. If the effect of inspections is estimated at the design stage, the two possible outcomes: detection: D and no detection: ND need to be their probability of occurrence based on the reliability method. After conducting an inspection the outcome (D or ND) is known. Moreover, during the service-life, there may be several inspections. Equations (7(7) ) can be generalised to cover cases with several inspections, with two alternative outcomes. Moan et al. (1993) show how the allowable fatigue damage, Δ_all at the design stage can be relaxed when inspections and necessary repairs are carried out; i.e. as a basis for Table 6. It is emphasised that this information is useful at the design stage.

Table 6. Fatigue design factor, FDF to multiply with the planned service life to obtain the design fatigue life: NPD-NORSOK/API and (reliability analysis).

Classification of structural components based on damage consequence^a	Access for inspection and repair
	No access or in the splash zone	Accessible (inspection according to generic scheme is carried out)
		Below splash zone	Above splash zone or internal
Substantial consequences^b	10/10 (10)	3/5 (4)	2/5 (3)
Without substantial consequences (i.e. satisfaction of ALS req.)	3/5 (4)	2/2 (2)	1/2 (1)

^a NPD (1984), NORSOK N-001 (2012) – general requirements while; API (Karsan, 2005); and reliability estimates Moan et al. (1993, 1999) and Ayala-Uraga and Moan (2002).

^b The consequences are substantial if the Accidental Collapse Limit State (ALS) criterion is not satisfied in case of a failure of the relevant welded joint considered in the fatigue check.

Figure 8 shows the reliability index β as a function of time based on prediction of the effect of inspections every 5th year with no crack detection using an NDE inspection method with mean detectable crack size of 1.5 mm – at the design stage and based on the outcome of actual inspections. The latter obviously is more efficient in increasing the reliability index β.

Figure 8. Reliability index as a function of time and inspection strategy. Inspection Event Tree analysis is based on prediction at the design stage. The other curves are based on inspections with known outcome during the service life (Ayala-Uraga & Moan, 2002).

The updating methodology is useful in connection with extension of service life for structures with joints governed by the fatigue criterion (Vårdal et al., 2000). In such cases, the design fatigue life is in principle exhausted at the end of the planned service life. However, if no cracks have been detected during inspections, a remaining fatigue life can be demonstrated. Nevertheless, it is not possible to bring the structure back to its initial condition by inspection only. This is because the mean detectable crack depth typically is 1.0–2.0 mm, while the initial crack depth is 0.1–0.4 mm.

For a given inspection (with normal quality) with no crack detection in a joint with an abnormally large defect, the updating of P_f will be conservative. However, the inspection itself can be subjected to gross errors. Thus, if abnormal defects are present in joints which are not inspected, the estimate of the failure probability will obviously be non-conservative. This fact should be accounted for in the estimate of the risk of system failure in view of the coverage of the inspection programme.

Structural system reliability

Systems reliability approaches are attractive because the most significant platform failure consequences, and especially fatalities, are associated with system failure and hence are useful for making decisions which affect safety and the significant costs of replacing or modifying the structure. System failure can be expressed mathematically by load- and resistance parameters relating to all failure modes for all structural components (members, joints, piles) and the probabilistic properties of these parameters. Broadly speaking, this may be achieved by a failure mode (or survival mode) analysis or direct-simulation methods, considering a sequence of fatigue and overload failures, see e.g. Dalane (1993), De, Karamchandani, and Cornell (1989), Karamchandani et al. (1991), Shetty (1992), Melchers (1999) and an overview by Moan (1994).

A significant challenge is to describe the failure modes, the probabilistic features of the random variables, and especially the correlation between them. However, De et al. (1989) and Wu and Moan (1989) demonstrated for jackets that accurate estimates of the systems failure probability under extreme sea loading can be achieved by considering a single system failure mode, i.e. by referring both the load (S) and resistance (R) to a given load pattern and using the (overall) base shear as variable.

A first approximation to the failure probability, P_fSYS, of a jacket system consisting of discrete elements, considering both overload as well as fatigue failure followed by overload failure modes, may be expressed as:(8)

where FSYS(U) and FSYS(U)|F_j are treated as pure overload system failures readily calculated by efficient methods for framed structures (Skallerud & Amdahl, 2002); and F_j the fatigue failure of component j. The approximations made in establishing Equation (8(8) ) and its use is discussed by Moan (2005). The formulation expressed by Equation (8(8) ) is particularly applicable for structures with clearly defined components such as members and joints on jackets, jack-ups, drilling semi-submersibles (with braces) (Moan, 2004) while cracks in monocoque structures like ship hulls are more challenging to deal with.

In NORSOK N-001 (2012) the fatigue requirements are linked to the effect of inspection and the ALS design criteria, by the fact that the acceptable fatigue failure probability should depend on the consequences, i.e. potential for progressive failure, see Table 6.

Target reliability or risk level for design codes

The target safety level should depend upon the following factors (e.g. HSE, 2002; Moan, 1998):

•	initiating events (hazards) such as environmental loads vs. accidental loads (which are caused by human errors or omissions),
•	method of SRM or structural risk analysis, especially which uncertainties are included,
•	failure cause and mode,
•	the possible consequences of failure in terms of risk to life, injury, economic losses and the level of social inconvenience,
•	the expense and effort required to reduce the risk of failure.

A main issue is that target levels for notional failure probabilities relating to SRM should be clearly distinguished from the true failure probabilities relating to risk assessment considering human factor effects also. Hence, Jordaan and Maes (1991) argued that the target failure probability in the context of SRM should be a fraction of the true failure rate. Moreover, rather than setting an overall target level it is more practical to establish target levels for each hazard separately, see e.g. Moan (1983). Moreover, target reliability levels for ULS and FLS criteria should be based on SRM accounting for normal variability and uncertainties in load effects and resistances, while ALS criteria needs to be based on a broader risk assessment.

In general it is recommended to establish target levels in a consistent manner based on inferring the target level by using the same reliability or risk analysis methodology to estimate the inherent reliability level implied by a reference design code that is considered acceptable and the method used to demonstrate compliance with the target level (HSE, 2002). Herein, the focus is on fatigue target levels.

Table 6 presents the semi-probabilistic fatigue acceptance criteria established by NPD/NORSOK in Norway and API (Karsan, 2005) – essentially for jackets, respectively. A reference target failure probability level was first established based on that inherent in semi-probabilistic fatigue criteria for the cases of two consequence cases; namely where fatigue implied total loss and the structure surviving a 100 years storm after fatigue failure. By accounting for the effect of inspection (Moan et al., 1993) and using a simplified system approach by considering each term in the sum in Equation (8(8) ) for jacket structures (HSE, 2002; Moan et al., 1999), fatigue design criteria considering the effect of inspection, have been derived and compared with codified criteria in Table 6.

Inspection, monitoring, maintenance and repair during fabrication, installation and operation

General

As indicated above IMMR needs to address structural damage but also other operational and hardware aspects, especially event control relating to fires/explosions, ship impacts that can result in damages or failures. Herein, the focus is on crack control.

The main life cycle efforts to prevent that cracks develop into failures, include:

•	adequate design with respect to: ◦ fatigue design (Fatigue Design Factor), ◦ residual fatigue life, • ultimate reserve strength (to overload),
•	adequate inspection, or
•	adequate monitoring of leak, when relevant.

Table 7 shows qualitatively the role that the different safety measures play regarding crack control for different types of structures.

Table 7. Crack control measures.

Type of structure	Type of joint	FDF^a	Residual fatigue life	Ultimate reserve strength	Inspection method
Jacket	Tubular joint	2–10	Some-Sign.	Normally	NDE, U^b
Semi-Subm.	Plated brace	1–3	Some	By ALS^d	LBB^c
					NDE
	Plated col.-p.	1–3	Some	Limited	LBB
					NDE
TLP	Tether	10	Small	By ALS	IM^e
	Plated col.-p.	1–3	Some	Limited	LBB
					NDE
Ship	Plated longt.	1–3	Sign.	None	Close Visual

^a FDF – Fatigue Design Factor by which the service life is to be multiplied with to achieve the design fatigue life.

^b NDE – Non Destructive Examination Method; U-underwater.

^c LBB – Leak before break monitoring.

^d ALS – Accidental Collapse Limit State.

^e IM – Instrumental monitoring (by ‘an intelligent rat’).

Fatigue design requirements are made dependent upon inspectability and failure consequences are considered, e.g. as shown in Table 6. It is noted that the costs of the underwater inspections on jackets and the number of possible crack sites on FPSOs make it necessary to prioritise inspections. For semi-submersibles some welded joints will have a high priority because of high likelihood of crack occurrence and failure consequences.

Whether the inspection should be chosen to aim at detecting barely visible cracks, through-thickness cracks (e.g. by leak detection) or member failures would depend on how much resources are spent to make the structure damage tolerant. This choice again would have implication on the inspection method; the main inspection methods being non-destructive examination (NDE) methods, detection of through-thickness crack by, e.g. leak detection, or failed members by visual inspection. The quality of visual or NDE methods depends very much upon the conditions during inspection. Large volume offshore structures are normally accessible from the inside, while, e.g. small diameter tubular tethers in TLPs and maybe some joints in semi-submersibles are not. Permanent repairs are made by grinding to remove small cracks, cut out and by butt welding a new section, re-welding, adding or removing scantlings, brackets, stiffeners, lugs or collar plates.

The design criteria (Table 6) are based on criteria that account for normal variability and uncertainties. Moreover, these measures are generic values; i.e. with the same criteria for all kinds of offshore structures. The initial inspection plan is also based on generic information available at the design stage. Besides differences between the features of different structures, the fabrication process might induce additional uncertainties, especially regarding the local geometry that affect fatigue performance as described below. Hence, it is crucial to update the model used to predict crack growth based on the particular features of each structure, based on inspections during fabrication and operation.

During fabrication the QA/QC addresses control of material and geometry, especially tolerances relating to misalignment, possible crack type defects and other damages that could occur etc. It is noted that defects in welds are primarily controlled indirectly by the specification of welding procedure, environment, etc. This is because the normal defect depth, say of the order of 0.1 mm are not likely to be detected by NDE inspections with a mean detectable crack size which is significantly larger. Larger defects could be due to, e.g. wet electrodes or other deviations from normal welding procedures. The very dark zone at the lower edge of the plate in Figure 9 shows an example with a 2 mm deep initial defect. The implication is an 80–90% reduction in the fatigue life for this plate under membrane stresses. Based on underwater inspection results for tubular joints in jackets, Moan et al. (1997) back-calculated the initial crack depth to be 0.9 mm. The collected experience data (Vårdal & Moan, 2016) clearly illustrate the shortcomings in local design and fabrication quality than normally accounted for in fatigue management based on traditional fatigue analyses.

Figure 9. Crack surface of a steel plate, with a fillet weld on the lower side. The dark areas indicate a 2 mm deep hydrogen crack after fabrication, which was the initiation line of the fatigue crack.

The importance of updating the information of the (local) geometry based on the as-built geometry is crucial as a basis for the follow-up during operation. Figure 10 for instance shows an example of a misalignment between plates which is larger than the plate thickness, while the fabrication tolerances normally accounted for in the design and inspection planning normally is of the order of 30–50% of the plate thickness.

Figure 10. Illustration of misalignment in plates and a sample of measured misalignment in semi-submersible platforms.

During fabrication detected cracks are repaired. Post welding treatment might also be applied. However, while the effect of weld toe grinding after fabrication corresponds to approximately a factor of 2 in terms of fatigue (design) life, the effect is more significant if it is done at a late stage during operation because the crack has grown to an increased size and is ‘removed’.

Finally, it is noted that achieving robust offshore structures by applying ALS criteria is an important issue. Hence, in view of ‘gross’ welding errors and inspection quality a fabrication defect with a depth of 2.0 mm or more might represent a damage condition for an ALS check (Moan, 2009). In service inspections are carried out to detect cracks and deterioration. An inspection plan involves:

•	prioritising which locations are to be inspected,
•	selecting inspection method (visual inspection, Magnet Particle Inspection, Eddy Current) depending upon the damage of concern,
•	scheduling inspections,
•	establishing a repair strategy (size of damage to be repaired, repair method and time aspects of repair),
•	assessment methodology for crack detections.

Typically major inspections of offshore structures (special surveys, renewal surveys) are carried out every 4–5th year, while intermediate and annual inspections normally are less extensive. Further refinement of the inspection planning has been made by introducing probabilistic methods as described below. As mentioned above it is important then to account for the findings regarding the geometry and cracks etc. during inspections after fabrication and during operation. Moreover, repairs might involve structural modifications that need to be considered. Apart from making the necessary repairs of damages, it is important to make a record of the deviation of the as-built structure from the as-designed structure, cracks, corrosion, inspection history and repairs in order to obtain a more general assessment of the quality of the fabrication, for use in integrity management of the relevant structure as well as other structures.

Cracks in FPSOs may be repaired during operation, but operational procedures need to be changed to avoid hot work in tanks with combustible gases. However, more extensive repairs such as by introducing some thousands of additional brackets, grinding of cracks etc. need to be done in a yard. Semi-submersibles have to be dry-docked to carry out inspection and repair of the hull in North Sea operations. A major cost issue in connection with inspection of semi-submersibles, is the demobilisation offshore, transport to yard, yard set-up, transport to offshore site and offshore mobilisation. Production semis and TLPs, however, would normally have to be inspected and repaired on site.

Tethers are particularly critical components. Each tether is a series system with multiple potential crack sites. Inspection is carried by a remotely operated instrument and possibly detection of leak before break. Repair usually requires replacement of tether. For tether systems it is hence crucial to achieve safety by restrictive fatigue design criteria as well as an elaborate quality assurance at the fabrication stage. The inspection strategy would normally be to inspect pre-selected potential crack sites. If the detected damage exceeds the acceptable level, the inspection would have to be extended to cover more possible crack sites, in the same or other ‘sister’ platforms.

Inspection, monitoring and repair measures can contribute to the safety only when there is a certain damage tolerance. This implies that there is an interrelation between design criteria (fatigue life, damage tolerance) and the inspection and repair criteria, as shown by Table 6. However, during operation the situation is different. Modification of the design and hence the scantlings is very expensive, and the most relevant measure to influence safety is the inspection and repair. The following section briefly describes how fatigue design and inspection plans (based on an assumed inspection method) can be established by reliability analysis to ensure an acceptable safety level, however, using information about updated geometry and defects.

Reliability (or risk) based inspection (RBI)

The first step from empirical to more rational procures to plan inspections, was to use fatigue analyses based on SN-data. Moreover, as mentioned above, design and inspection criteria (Table 6) related to fatigue crack growth, are based on generic information. Inspections during operation of the specific structure yields more information – that can be used in planning future inspections. Reliability methods can serve as tools for the decision-making under uncertainty relating to fatigue crack growth – to maintain an acceptable safety level. However, it is crucial that such analyses are based on information from inspections during fabrication and operation in order to refer to an as realistic model of the structure and its behaviour as possible. This includes information about crack type defects with excessive size.

Moreover, any information about the environmental conditions and the global nominal stress level based on monitoring will be useful. All information collected during fabrication an operation is important to store in an easily retrievable way. In view of the many hot spots these efforts need to be organised. By assuming that the fatigue failure probability in Equation (8(8) ) is updated based on inspection of the relevant joint (member), – before its (rupture) failure. Moreover, the target reliability is assumed by allocating a certain target probability level, P_fSYS(T) to each term in the sum of Equation (8(8) ):(9)

where the system failure probability, P_fSYS(i) is associated with a fatigue failure of member (i) followed by an ultimate system failure. P_fSYS(T) is obtained by generalising the acceptance criteria implied by Table 4. P_FfT(i) the represents the target safety level for the fatigue failure of the individual joint. This approach has been implemented for template, space frame structures (Kirkemo, 1988; Moan et al., 1999). Given the target level for a given joint, inspections and repairs by grinding or other modifications are scheduled to maintain the reliability level at the target level as shown in Figure 11.

Figure 11. Scheduling of inspections to achieve a target safety level of P_FfT(i).

Further improvement of the inspection plan for offshore structures may be achieved by optimising, such as devised by Madsen et al. (1989), Faber et al. (1992), Straub and Faber (2005) and by methods applied for civil infrastructure (e.g. Frangopol & Liu, 2007).

Integrity management of structural deterioration

Traditionally inspections are done to detect any failure or degradation that are not in accordance with the assumption of the design analyses. Upon detection of cracks or other damage, the default activity is to re-establish the initial design and get it approved by a regulatory body. Subsequently, the inspection results are considered historical and not used in future assessments.

To collect experience data and look upon them as valuable source for assessment of technical condition, however, requires a new mind set; moving from ‘traditional maintenance management’ vs. ‘integrity management’. The traditional approach focused on maintaining the conditions established by design which the new approach of integrity management includes use of in-service observations. The integrity management process focuses on the potential need for structural improvement of a given design to fulfil its function. This activity needs to be based on the quality of the collected experience data. Various levels of refinement in the follow-up activity are shown in Table 8.

Table 8. The different follow-up regimes during fabrication and operation.

Level 0: Basic follow-up regime defined in the design phase: detect cracks and other damage and carry out repair. No further use of the experience

Level 1: Extension of level 0 by use of updated fatigue analyses

Level 2: Use of a probabilistic approach in which the results from previous inspections are used to estimate the fatigue crack growth potential

Level 3: An extension of Level 2 that also includes the process of verification of the quality in: • hydrodynamic and structural analyses, • construction work, • in-service inspection, • in-service integrity engineering, • validation of the method for estimation of the fatigue crack growth potential.

Levels 2 and 3 in the follow-up regime require experience data and are classified as true integrity management processes as opposed to Level 0 and 1 that may be classified as traditional maintenance management processes. The benefit and achievement using Levels 2 and 3, will strictly depend on the quality of the collected experience data and how case based uncertainty measures are used, also for the fabrication quality. For ageing units operated in harsh environments, there will be a significant extent of dents, local buckling and corrosion grooves that also needs to be taken into consideration. This approach is further outlined by Vårdal and Moan (2016).

Conclusions

In service experiences are presented to show that a main cause of structural damages and accidents are human and organisational errors and omissions. To achieve an acceptable safety level with respect to the occurrence and development of cracks into failures, therefore, requires an adequate design with respect to fatigue life (Fatigue Design Factor), residual fatigue life and ultimate reserve strength (with respect to overload (robustness through an Accidental Collapse Limit State) as well as QA and QC of the engineering process. Moreover, adequate inspection of the structure, possible monitoring of leak, and repair of the structure, is required.

This structural integrity management approach especially depends on a follow-up during fabrication and operation based on continuously establishing an inspection, modification and repair history. This is important because the initial structural design and inspection and repair planning is based on generic information for a class of structures and don’t reflect the particular features of a given structure with regard to design, fabrication and operational features. Some of the features are result of gross errors.

It is shown that structural reliability methods can provide an improved basis for ULS and FLS design and inspection and repair planning by accounting for the normal uncertainties in loads and resistances and inspection quality, to ensure that these criteria comply with an intended target failure probability. However, in service inspections show that the actual geometry might deviate from the planned geometry. This fact needs to be considered in the structural integrity management during operation. The advantage of reliability approaches can only be realised if the modelling is updated based on data gathered in connection with fabrication and operation.

Disclosure statement

No potential conflict of interest was reported by the author.

Acknowledgements

The experiences documented herein are based upon excellent cooperation with many people in carrying out the research as well as code developments, that are reported in this paper. They particularly include E. Ayala-Uraga, J. I. Dalane, G. Ersdal, I. Lotsberg, and O. T. Vårdal. The opinions expressed, however, are those of the author. The financial support rendered through the Centre for Autonomous Marine Operations and Systems project 223254 - NTNU AMOS is acknowledged with thanks.