Robustness. structures and maritime systems

Transcription

1 Konstruksjoonsdagen 2017 Petroleumstilsynet Robustness of structures and maritime systems by Torgeir Moan, Department of Marine Technology AMOS, NTNU

2 Outline Introduction (terms, definitions, current practice) Development of robustness requirements Accident experiences Approaches to achieve acceptable life cycle structural integrity Robustness of the hull Robustness to prevent development of hydrocarbon explosions and fires Examples of damage characteristics relating to accidental actions Accidental condition of ballast and other fluids Example of damage relating to abnormal strength Characteristic features of robust structures Robustness relating to fatigue and fracture Analysis to demonstrate robustness Robustness of other systems Robust evacuation and escape from platforms Limitation of prediction methods Concluding remarks 2

3 Introduction Introduction - terms Robustness is the property of being strong and healthy in constitution (i.e. have structural integrity) and tolerate perturbations that might affect the function of the structure. Fault tolerance is the property that enables a system to continue operating properly (i.e. maintain integrity) in the event of the failure of (or one or more faults within) some of its components. Fault tolerance is particularly sought after in high-availability or life critical systems (e.g. computers in airlines). Damage tolerance is a property of a structure relating to its ability to sustain defects safely (i.e. maintain structural integrity) until repair can be effected (fail-safe structure). Alternatively the structure might have a safe life (without the need for inspection) Resilience is the ability of a structure or infrastructure to absorb or avoid damage without suffering complete failure. 3

4 Introduction Definitions of robustness in design codes Eurocode (EN of the Accidental Actions): Robustness is the ability of a structure to withstand events like fire, explosions, impact or the consequences of human error, without being damaged to an extent disproportionate to the original cause. Ronan Point apartment building, 1968 Focus on accidental actions; buildings made of large concrete panels (not insitu concrete structures) and therefore the ties between the panels. Failure of column Robustness req. applied to high consequence class buildings 4

5 Introduction Definitions of robustness in offshore design codes ISO19900 (2013) defines robustness by the ability of a structure to withstand accidental and abnormal events without being damaged to an extent disproportionate to the original cause, Proposed revised (Moan, OSRC2016) version to accomodate maritime systems and IMMR: the ability of a structure to limit the escalation of accident scenarios (floating positions; or structural damages) - caused by accidental actions and abnormal strength due to fabrication or deteriorating phenomena - into accidental conditions with a magnitude disproportionate to the original cause 5

6 Introduction Design to achieve robustness Three alternative measures are used, sometimes jointly, to achieve structural robustness and reduce the risk of disproportionate collapse. These are: Reducing the possibility of occurrence of accidental loading or other hazards that can cause damage. (The effect of these efforts should be reflected in the actual ALS design check) Designing the structure to withstand accidental loading. Sometimes referred to as specific load resistance method. Preventing the propagation of a possible initial damage which includes the indirect method and the alternative load path method. 6

7 Introduction Current practice in design codes -qualitative: general requirements to structures -quantitative: limit state criteria Robustness is listed as a (qualitative) desireable property In most codes; e.g. PSA Regulations, ISO19900,, - without a procedure on how to establish robustness. For instance: Norsok N-001 include some specifications 7

8 Introduction Norsok N-001: 4.7 Robustness assessment General requirement Load bearing structures shall have sufficient robustness to prevent that local damage or failure gives unacceptable consequences. Maritime systems shall have sufficient robustness to prevent that local damage or single technical or operational failures gives unacceptable consequences. Checking robustness covers an evaluation of the vulnerability of a structure or a maritime system in addition to the ALS check for accidental loads as described in a risk analysis. It should include an evaluation of the vulnerability of the structure or the maritime system for local errors in design, fabrication and operation, damages or human errors in installation and operation. based on the ALS principle as stated in 6.2. All maritime systems shall be categorized with regards to safety criticality, redundancy and robustness. Proper maintenance- and spare part philosophy shall be demonstrated for all essential maritime systems. 8

9 Development of robustness requirements recognise that such criteria represent one element in the risk management and are based on - a system model and relevant failure modes - accident experiences make the criteria operational (possible to check compliance with) The main challenge: determine the initial damage that the structure should survive relating to its - location - magnitude - probability 9

10 Development of robustness requirements Offshore Facility System System components (1) the structure (provides support for facilities and operations), (2) the industrial plant (facilities, risers, (safety) control systems, maritime systems (ballast, station-keeping, corrosionprotection system..); evacuation-escape system (3) the procedures (formal, informal, written, computer software), (4) the environments (external, internal, social), (5) the operators (those that interface directly with the system), (6) the organisations (institutional frameworks in which operations are conducted), and (7) the interfaces among the foregoing. System life cycle: - concept development, design, construction, operation, maintenance and decommissioning. 10

11 Development of robustness requirements Global failure modes Capsizing/sinking Structural or mooring system failure With respect to Fatalities/injury Environmental damage Property damage Unavailability of Escapeways and Evacuation means (life boats.) Regulatory issues - Goal-setting (performance-based) vs. Prescriptive: Identify all hazards and control the risk - Probabilistic vs. deterministic - First principles vs. purely experiential 11

12 Accident experiences: We learn more from our failures than successes Fault tree Critical event Event tree - Fatalities - Environmental damage - Property damage - obs. of accidents (damages) - root causes of accidents, Technical-physical point of view - Damages - Capsizing or total structural failure commonly develops in a sequence of events Human and organizational point of view - All decisions and actions made or not made during the life cycle are the responsibility of individuals and organizations 12

13 Accident experiences Example: Severe Damage due to natural hazards? Technical-physical causes: Wave forces exceeded the structural resistance Human organizational factors: - Wave conditions or load calculation are inadequate (special wave phenomena) - Inadequate strength fomulation - Safety factors not sufficient to cover inherent uncertainties Severe damage caused by hurricane Lilli in the Gulf of Mexico Should the platforms possibly have been stengthened after possible code improvement? For either of these possible causes, two alternatives need to be considered: - The state of art in offshore engineering was inadequate at the time of design - Errors and omission were made during design or fabrication! 13

14 Accident Experiences Lessons learnt from total losses Alexander L. Kielland, Norway, 1980 Ocean Ranger, Canada, Piper Alpha, UK,1988 P - 36, Brazil l, 2001 Deepwater Horizon, GoM, USA,

15 Accident experiences The causes of the ALK accident Hydrophone support Plate of Hydrophone support the brace Technical cause fatigue failure of one brace ultimate failure of braces progressive flooding Human and organizational factors fabrication gross defect due to - bad welding - inadequate inspection no fatigue design check carried out codes did not require robustness (damage - tolerance) damage stability rules did not account for this multicompartment loss of buoyancy (buoyancy loss of 2000 t ) failure to shut doors, ventilators etc. contributed to the rapid flooding and capsizing 15

16 Accident experiences The Ocean Ranger accident 1982 Technical - physical events water in control room Human and organizational factors bad design electrical malfunction malfunction of ballast valve lack of competence on ballast operations maloperation of ballast system inadequate ballast pumps inadequate design listing and flooding of chain lockers capsizing/sinking inadequate evacuation and escape inadequate rescue aircraft/boat inadequate life-saving equipment 16

17 Accident experiences The Piper Alpha accident 1988 Technical-physical events use of partly demounted pump leakage gas explosion damage to high pressure gas pipe Human and organizational factors the condition of the pump was not reported to the control room fire pumps/springler system were not automatically initiated - because they were put on manual operation inadequate arrangement of equipment escalating fire/explosion no evacuation the order to evacuate was not given rescue vessel was not alarmed 17

18 Accident experiences The Sleipner A accident Vertical section Finite element model Detail A Water pressure Fracture of the concrete wall Horizontal section through caisson Tricell Reinforcement of the concrete wall 18

19 Accident experiences The Sleipner A accident in 1991 Technical - physical events caisson wall fractured due to low strength Human - organizational factors too crude FEM model inadequate reinforcement inadequate internal and external control of design flooding and sinking in 18 minutes codes did not specify requirement to pumping capacity or watertight subdivision to limit flooding under such conditions 19

20 Accident Experiences Observations regarding deterioration damage Corrosion affects ultimate and fatigue strength - plate thinning effect - crack growth rate no or damaged coating or cathodic protection corrosion rate for general corrosion: mm/year; Fatigue: Fatigue cracks - are initiated - develop, and eventually become - unstable resulting in rupture Fatigue-induced total losses of platforms 20

21 Accident experiences Experience with fatigue cracks in the North Sea Data from 40 jacket structures. A total of 3366 NDE inspections: Cracks detected in 15 % of the inspections (Vårdal and Moan, 1997) Diver inspection Data from 12 semi-submersibles with more than 20 years of operation time. A total of NDE inspections: Cracks detected in 5 % of the inspections (Vårdal and Moan, 2016) Obs. of s crack inside semisub. brace by leak 21

22 Accident experiences Importance of assessing «as-fabricated» condition for fatigue assessment The crack surface. The weld surface is heading down and the dark areas are assumed to be hydrogen cracking from fabrication. The fatigue crack growth started from these hydrogen cracks. e ~ 1.2 t SCF= 1+3e/t - relative to membrane stress Misaligned bulkheads in semi-submersible brace (observed during reconstruction) 22

23 Accident Experiences Experiences with catenary mooring systems for MODU & permanent installations Catenary chain/wire mooring Failure rates MODU - before 1982: /line year now: 0.01/line year - Failure of the line break, (winch brake, anchor dragging) Causes of line failures inadequate criteria, design analysis, errors and omissions: design, fabrication defects, (shackles, links..) Smedley and Petruska, OSRC,2014 Failure rates -production platforms -drilling units 23

24 Number of accidents Per 1000 platform years Accident Experiences Overview of the rate of severe accidents for offshore platforms worldwide (WOAD, during ) 24

25 Approaches to achieve acceptable life cycle structural integrity Pro-active (activities implemented before malfunctions occur), Re-active (activities implemented after malfunctions occur) and Interactive or real-time (activities implemented during occurrence of malfunctions). In the context of these three approaches, there are three primary strategies to be employed: Reduce incidence of malfunctions, Increase detection and correction of malfunctions and Reduce effects of malfunctions. Note: increasing the ULS safety factors has not proven to be an effective approach. 25

26 Approaches to achieve acceptable life cycle structural integrity Pro-active Life Cycle Safety management of structures in terms of resistances and load (effects) Causes Risk Mitigation Measures Quantitative methods LTA safety margin to cover normal uncertainties. Inadequate design codes Gross errors or omissions during execution of: - design (d) - fabrication (f) - operation (o) Unknown phenomena; - Increase characteristic loads, safety factors or margins in ULS, FLS; - Improve inspection of the structure (FLS) - improve design codes (practice at large) - Improve skills, competence, selfchecking (for all life cycle phases: d, f, o) - QA/QC of engineering process (during d) - Direct ALS design (in d) with adequate damage conditions arising in f, o (NOT including design errors) - Inspection/repair of the structure (in f, o) - Accidental Event control - Research & Development to establish a basis for risk reduction actions. (cfr. e.g. tether springing; platform ringing; VIM; flexible riser corrosion fatigue) Structural reliability analysis Quantitative risk analysis None 26

27 Approaches to achieve acceptable life cycle structural integrity Re-active Approaches during operation The reactive approach is based on the analysis of the failure or near failures (incidents, near-misses) of a system; based on - technical causes including equipment and hardware as well as - human and organizational root causes (Ref. Johnson, MORT,1973). and use the information to put measures in place to prevent future failures of the system. This is important since there are - about 100+ incidents, and near-misses, to every accident [Hale, et al, The incidents and near-misses, if well understood and communicated, provide important clues (more than info. about successes) as to how the system operators are able to rescue their systems 27

28 Approaches to achieve acceptable life cycle structural integrity High reliability organisations (HRO) The HROs are those organisations that have operated nearly error-free over long periods of time. Studies (e.g. Weick, et al 1999) have shown that the reduction in error occurrence is accomplished by the following (1) command by exception or negation, (Decision-making responsibility is allowed to migrate to the persons with the most expertise to make the decision (employee empowerment)). (2) robustness by redundant personnel, procedures and hardware (3) procedures and rules. ( Procedures should be accurate, complete, simple, well organised, and well documented. Rules should be adhered to).. (4) selection and training, (5) appropriate rewards and punishment and (6) ability of management (key decision-makers) to see the big picture. 28

29 Approaches to achieve acceptable life cycle structural integrity Robustness of the hull by fulfilling accidental collapse limit state criteria Damage stability -Inspired by Titanic accident in Introduced for ships through SOLAS in first codes for MODUs in 1970s Damage tolerance for - the struture by NPD 1984 (after Alexander Kielland, but inspired by the Ronan Point building collapse) Damage tolerance for - the mooring - DP systems 29

30 Robustness of the hull NPD (PSA) ALS criterion after ALK, 1984) (Committee: S.Fjeld, DNV; I.Holand, N.Janbu, T.Moan, NTNU; K. Aas-Jakobsen; A.Kvitrud (NPD) (e.g. Moan, 1983) 30

31 Robustness of the hull Accidental collapse limit state (for structural integrity) (ALS is denoted PLS before) local strength or system check P,F P,F Procedure (NPD/Norsok): Step 1 check capacity to resist abnormal or accidental loads with annual exceedance probability of 10-4 (allowed to cause local damage only) If ULS requirements for the accidental load condition are satisfied, Step 2 is omitted E Step 2 check structure in damage condition (step1 or specified damage) for loads with annual exceedance probability of 10-2 (total collapse should not take place) 31

32 Robustness of the hull The ALS procedure is a rational approach to ensure robustness - because it reflects survivability of relevant damage conditions by their location, magnitude and probability in the structure; while the concept of redundancy does not Ranger I, GoM (1979) Robust Not robust - in view of relevant hazards Non-redundant structures Alexander L. Kielland, (1980) Redundant, but not robust structure C D 32

33 Robustness of the hull Damage due to Accidental and Abnormal (functional, environmental) Actions 1 Explosions (pressure, duration - impulse) scenarios explosion mechanics probabilistic issues characteristic loads for design 2 Fires (thermal action, duration, size) 3 Ship impacts (impact energy, -geometry) 4 Dropped objects 5 Accidental ballast (for floaters) and other abnormal functional actions 6 Unintended pressure 7 Abnormal Environmental actions 8 Environmental actions on platform in abnormal position (for floaters) 33

34 Robustness of the hull Robustness to prevent development of Hydrocarbon Explosions & Fires Explosion and fire are rapid and slow combustion processes, respectively Robustness of the system to prevent development and escalation of fire/explosion scenaria Reduce prob. Release of Gas and/or Liquid No Ignition Immediate Ignition Formation of Combustible Fuel-Air Cloud (Pre-mixed) Limit fire action by extinguision Fire (Action) Ignition (delayed) Prevent fire escalation by compartmentation Gas Explosion (Action) Fire and explosion actions depend on the design and operation of the industrial plant Reduce explosion pressure by venting Implication of simultanous occurence of explosion and fire: Explosion can occur first and damage the fire protection before the fire occurs 34

35 Robustness of the hull Example of damage characteristics relating to accidental actions Fire/explosions Quantification of the magnitude of damage/fault and survivability of the damage? Collision between jacket and floatel after DP failure Submarine impact Locations of hit by dropped objects Damage scenarios: - location - intensity - probability Increase of the safety factors in ULS design check is not a favourable approach to reduce the risk 35

36 Robustness of the hull ccidental condition of ballast and other fluids Ballast and other fluids in tanks influence - the floating position and stabilizing moment (in normal operations distribution of ballast is used to get the floater on even keel) - loads in braces ; especially on all braced semisubmersibles (includes some damage flooding conditions specified for design) Accidental distribution of ballast and other fluids (exceeding operational limits) are due to - Technical faults (valves, pumps, operational/technical faults causing ship impacts or dropped objects, puncturing walls - Ballast operational errors Escalation of the accident depends on the condition of closing devices etc 36

37 Robustness of the hull Example of damage relating to abnormal strength (due to excessive fabrication defects, deficient maintenance, inspection and repair) Applied in connection with - damage stability of hulls (flooding of compartments) - failure of mooring lines/thrusters in a DP system - pre-defined hull damage due to fatigue failure/inspection fault, vulnerability to ship impacts Fatigue cracks: «gross error» 1-2 mm initial weld defect - high fatigue utilization - complex fabrication Alternative: provide robustness where vulnerability is significant Implicitly focus on root cause: errors in fabrication and operation 37

38 Robustness of the hull Characteristic features of a robust structures It takes the combination of four attributes to create a robust structural system: configuration and component strength, ductility, excess capacity and appropriate correlation In view of relevant hazards Qplane Qplane Remarks on excess capacity Q=0.5 A Q=0.5 B C D ULS design for a Q to the right: braces AD and BC are in compr./tension, respectively, and AD is designed with larger dimensions than BC. ULS design for Q to the left: the situation is opposite If both load conditions apply, the braces will be designed for the same compressive load. Hence, for a given load (in one direction), the truss will possess a reserve capacity Plane K- and X-truss with one brace removed 3-D K-trusswork K- vs. X- braced system 38

39 Robustness of the hull Robustness relating to fatigue and fracture Difficult to decide on how much margin to provide The methods for fatigue analysis are partly conservative and we do not find predicted cracks; but on the other hand they do not account for fabrication errors (deficiencies) and we find cracks where we do not expect them. Reduced the stress level (by the acceptable fatigue damage used in the FLS design criterion) - increases time to failure and hence the possibility to detect the crack before rupure Detect and repair crack o o Predictions in the design phase is based on generic information; with account of normal uncertainties Inspections of the as-built structure provide about - cracks.. that need to be repaired - general info. about the quality Provide residual ultimate strength («after member failure») 39

40 Robustness of the hull Analysis to demonstrate robustness - Simple analytical methods or - Nonlinear FEM to determine damage caused by accidental loads - Nonlinear FEM to determine global collapse, considering local failure modes - Crack propagation and rupture Industrial and Operational Conditions (Czjuko, 2001) System analysis tools for large volume floaters are limited 40

41 Robustness of other systems (by e.g. fulfilling ALS criteria): - the station-keeping system to avoid drift-off and riser failure - the industrial plant, risers to reduce fire/explosion effects on the hull, - the ballast system relating to damage stability of the hull and strength of braced semi-submersibles 41

42 Robust evacuation and escape system relating to the industry plant (topside) Escape, evacuation and rescue means (life boats.) Scenarios: -heeling due to loss of buoyancy of a floater -fire/explosion Alternative evacuation/escape paths! 42

43 Limitation of prediction methods It is desireable to have quantitative risk acceptance criteria; e.g. to apply the ALARP principle. However, one can only analyse what one does know. Human and organizational (gross) errors are known to occur, but especially very low probability - high consequence events Causes Risk Mitigation Measures Methods 1) Inadequate design codes Gross errors or omissions during execution of: - design (d) - fabrication (f) - operation (o) - improve design codes (practice at large) - Improve skills, competence, selfchecking (for all life cycle phases: d, f, o) - QA/QC of engineering process (during d) - Direct ALS design (in d) with adequate damage conditions arising in f, o (NOT including design errors) - Inspection/repair of the structure (during f, o) - Accidental Event control 1) Quantitative methods to achieve a measure of the risk (or, safety) Quantitative risk analysis Among the challenges is to account for the probability of human errors depending on the quality of the organisation doing the engineering, fabrication, Operation and the organisation doing the 3 rd party QA/QC. 43

44 Concluding remarks To prevent human and organisational errors in design, fabrication and operation organisations doing the work and QA/QC need to have a high reliability, High Reliability; implying robust organisations To limit the consequences of human errors resulting in accidental and abnormal actions and abnormal strength, the structure, industrial plant, risers and maritime systems should be robust - by fulfilling ALS criteria and adequate crack propagation criteria. It is still a challenge to establish the accidental or abnormal functional/envir. actions and abnormal strength to apply. The facility should also be planned so that escalation of accidental events can be combatted when they occur. These measures to achieve a safe operatio need to be assessed as a total system, considering: - the interactions between them and - balancing the risk reduction measures according to acceptance criteria. 44

45 References Reports on accident investigations The Alexander L. Kielland Accident. (in Norwegian English translation available), NOU 1981:11, Oslo, Norway. Royal Commission on the Ocean Ranger Marine Disaster: Report One: The Loss of the Semi-submersible Drill Rig Ocean Ranger and its Crew. Edifice Fort William, St. Johns Newfoundland, Canada The Public Inquiry in the Pipe Alpha Disaster. Inquiry Commission HMSO, London, UK. Macondo Well: Deepwater Horizon Blowout. Marine Board. National Academy of Engineering and National Research Council. Washington D.C Johnson, W.G. The Management Oversight And Risk Tree MORT Including Systems Developed. Idaho Operations Office And Aerojet Nuclear Company 1973 Offshore standards ISO (1994) Petroleum and Natural Gas Industries Offshore Structures Part 1: General Requirements, (1994), Part 2: Fixed Steel Structures, (2001), Int. Standardization Organization, London. NORSOK N-001 (2012) Integrity of Offshore Structures, Norwegian Technology Standards, Oslo. 45

46 Bea, R. G. (2000). Achieving step change in risk assessment and management (RAM):Centre for Oil and Gas Engineering, http University of Western Australia, Nedlands, WA. Hale, A,, Wilpert, B., and Freitag, M. (1997). After the event, from accident to organisational learning, Pergamon Press, Elsevier Sciences Ltd., Oxford, UK. Moan, T.(1983) Safety of Offshore Structures, Proc. 4 th Firenze, Pitagora Editrice. ICASP Conference, Moan, T., Amdahl, J.; Ersdal, G. Assessment of ship impact risk to offshore structures - new NORSOK N-003 guidelines, The 3 rd Offshore Structural Reliability Conference OSRC September, Stavanger, Norway. Moan, T. Limit States and Systems Effects of Offshore Structures with Emphasis on Design for Robustness The 3 rd Offshore Structural Reliability Conference OSRC September, Stavanger, Norway. Smedley, P. and Petruska, D. (2014) Comparison of Global Design Requirements and Failure Rates for Industry Long Term Mooring Systems, Proc. Offshore Structural Reliability Conference, September 16-18, Houston, USA. 46

47 Vinnem, J.E. (2014) Offshore Risk Assessment, Springer, London. Vårdal, O.T. and Moan, T. (1997) "Predicted versus Observed Fatigue Crack Growth. Validation of Probabilistic Fracture Mechanics Analysis of Fatigue in North Sea Jackets", Paper No. 1334, Proc. 16 th OMAE Conference, Yokohama, Japan. Vårdal, O.T. and Moan, T. (2016) Lessons Learned from Predicted Versus Observed Fatigue of Offshore Steel Structures in the North Sea. The 3rd Offshore Structural Reliability Conference OSRC September, Stavanger, Norway. Weick, K. E. (1999). Organizing for high reliability: processes of collective mindfulness, Research in Organisational Behaviour, Vol. 21, JAI Press Inc. 47