OTC 2001

20012001Authored Papers

ABS & Affiliated Companies

Offshore Technology

Conference

Offshore Technology

Conference

Integrated Risk Based Design of FPSO Topsides, Structural and Marine Systems

Risk Based Optimum Inspection for FPSO Hulls

Reliability Methods for Deepwater Position-Mooring Design and Analysis

FPSO Standards and Recommended Practices

A Comparitive Risk Analysis of FPSOs with Other Deepwater Production Systems in the Gulf of Mexico

Authored PapersABS & Affiliated Companies

Copyright 2001, Offshore Technology Conference

This paper was prepared for presentation at the 2001 Offshore Technology Conference held inHouston, Texas, 30 April3 May 2001.

This paper was selected for presentation by the OTC Program Committee following review ofinformation contained in an abstract submitted by the author(s). Contents of the paper, aspresented, have not been reviewed by the Offshore Technology Conference and are subject tocorrection by the author(s). The material, as presented, does not necessarily reflect anyposition of the Offshore Technology Conference or its officers. Electronic reproduction,distribution, or storage of any part of this paper for commercial purposes without the writtenconsent of the Offshore Technology Conference is prohibited. Permission to reproduce in printis restricted to an abstract of not more than 300 words; illustrations may not be copied. Theabstract must contain conspicuous acknowledgment of where and by whom the paper waspresented.

AbstractFPSOs and other floating offshore facilities typically followprescriptive based classification rules for design of the hull,mooring and marine systems. In some cases the processfacilities are also classified. An alternative approach is to usea more open framework, risk based design approach thatallows variation from prescriptive rules provided system risksare maintained at acceptable levels. The various classificationsocieties currently allow such risk-based alternatives [2, 3].Although numerous component risk studies for FPSOs havebeen conducted and published, this is one of the first thataccounts for the integration and linking of risks and risktradeoffs among the hull, mooring system, marine systems,topside process plant and the utility, power and controlsystems that support them. The model and basis are firstdescribed, followed by application to a prototype deepwater,turret moored FPSO with gas handling. Example cases areshown to demonstrate use of the model to make designdecisions to the various FPSO components.

Introduction

Classification rules are established based on engineeringprinciples, experience, testing & expert judgement. They areintended to ensure probabilities of accidents are low, but thisis not explicit. Changes to developing and implementing ABSrules are being explored through risk based approaches. Analternative, risk-based approach to classification of FloatingProduction, Storage and Offloading systems is beinginvestigated by ABS as part of a major internal technologydevelopment project. The project is comprised of model,database and methodology development and training atmultiple levels throughout the organization. The prototypemodel was completed early in 2001 and is the focus of this

paper. The model represents systems failures morecomprehensively than any other offshore risk assessmentknown to the authors. This level of detail was sought in orderto achieve specific goals: 1) Develop explicit risk measures ofclass rules to facilitate prioritization and optimization, thusallowing one to focus resources on the greatest riskcontributors, 2) Develop a consistent means for performingrisk tradeoffs (i.e. demonstration of equivalent level of safety),and 3) Provide a vehicle for expansion of Class or Groupservices to risk significant systems, components, structures, orhuman actions not currently included in Class scope.

Model DevelopmentThe overall model is comprised of a collection of initiatingevents, facility response model and consequence calculations.These are categorized into discrete damage states (see Figure1). Also illustrated in Figure 1, the facility response model iscomprised of support event trees, frontline event trees and endstates. The support event trees represent the failed/operationalstate of support systems (e.g. utilities, instrumentation andcontrol, emergency) required for successful operation of thefrontline (main system) event trees. The end states are simplya discrete categorization of the various failed configurations ofthe facility. Frontline systems were segregated into threecategories for convenience: process, marine and structuralsystems. Each of these model partitions are described insummary in Table 1, and the development activities aredescribed in the following sections.

Process SystemsThe process model follows a conventional offshore QRAapproach [1,4]: Development of isolatable sections, Summarize the loss of containment frequency by using a

parts count approach Identifying spatial interactions that could lead to

escalationThese steps were completed for 54 isolatable sections, usingthe event tree structure of Figure 2. Three hole sizes wereselected to represent the hole size distribution of variousprocess equipment. Multi-phase releases (oil / gas / water)were treated where applicable. Leak frequencies were derivedprimarily from generic databases (e.g. E&P Forum, OREDA,Offshore Hydrocarbon Release Statistics). The model

OTC 12948

Integrated Risk Based Design of FPSO Topsides, Structural and Marine SystemsAndrew J. Wolford, James C. Lin, James K. Liming, Andrew Lidstone, & Robert E. Sheppard, EQE International, Inc.

2 WOLFORD ET AL. OTC 12948

explicitly accounts for emergency detection as well as processcontrol response to a loss of containment event, so that riskimportance measures can be associated with rule and standard-required I&C.

Marine SystemsThe marine modeling followed a broadly similar approach tothe process modeling, except the scope of marine events wasbroader than loss of containment of hydrocarbons. Themajority of the marine event trees addressed fires (fueled,electrical, other). Marine event scenarios were representedwith 89 unique initiating events, 12 frontline system eventtrees, one support tree and 141 marine fault trees of which 89developed specific initiating events and 52 modeled systemresponse functions (see Table 1). Over 2 billion unique eventsequences were evaluated. Fire initiating event frequencieswere developed for 70 individual hazard zones combined withan assessment of initiator density. An explicit parts countapproach was not utilized for marine fire initiation based onunavailability of component-specific fire initiator frequencydata.

StructuresThe modeling of structural failures also followed a broadlysimilar approach, but deviated from developing a component-wise model and relied substantially upon subject matterexperts to identify, prioritize and structure the eventsequences. The approach is illustrated in Figure 3. As shownin that figure, structure subsystems were broken down intomooring, turret, topside structures and hull. Team meetingswere held to construct event sequence diagrams whichillustrate the sequential (hardware and human) event sequenceof events resulting in a system failure. The event sequencediagram has proven to be a superior tool to portray and elicitnecessary expert input. An example is shown for mooring inFigure 4. From this intermediate step, system event trees weredeveloped analogous to those for the process and marinefrontline event trees. The mooring event tree is shown inFigure 5. Structural event scenarios were represented with 46unique initiating events, 13 frontline system event trees andone support tree.

Consequence ModelingRisk metrics were defined to measure health, safety,environmental and financial impacts from the FPSO. Theendpoint metrics selected were: fatalities, oil spill, capital lossand business interruption (the latter two only if associated witha scenario with potential for fatality or spill, i.e. the entirescope of financial impacts ere not included in this phase of themodel, only a subset).

The physical phenomena represented in this modeldrew upon de facto standards used in offshore QRA [1]. Release modeling, multi-phase, near field flow regime,

internal pressure-time history Thermal radiation effects to humans and equipment from

jet fires and pool fires

Explosion overpressure impacts to humans and equipment Simple evacuation of personnel on board.

Example ApplicationsTwo applications are used to highlight the utility of the modeldescribed in this paper: Comparison of loss of containment frequency for a

production separator among material failure mechanismsvs. transient induced leaks

Comparison of the design of mooring line redundancyrequirements

Leak InitiatorsVarious codes and rules [2,3] specify the use of processinstrumentation to protect against accidental overpressure ofhydrocarbon containing equipment. These prescriptive rulesare effective in minimizing overpressure transients that canpotentially lead to significant loss of containment. As such,these measures provide non-explicit risk mitigation of offshoreproduction facilities. A comparative exercise was performedto determine the extent to which individual instrumentationand control component should be represented in the riskmodel. The exercise formulated a fault tree model of aprototypical production separator, and quantified the transientinduced leak frequency, for major leaks, and compared to thehistorical, inherent leak frequency. The fault tree is shownin Figure 6. The results, using point estimates only, show:

Inherent Leak Frequency All Leaks: 0.42/yrMajor Leaks 0.04/yr

Transient Induced Leak Frequency Major Leaks: ~1E-8/yr

The result of the above exercise shows that the transientinduced leak frequency is substantially lower than the inherentleak frequency, hence the need to treat the individualequipment failures explicitly is unwarranted, unless a processsystem departs radically from existing codes and standards.

Mooring Line RedundancyAn 8-leg, external turret mooring system was evaluated withthree hypothetical design criteria No redundancy Single line failure (per ABS Rules) 2 Line failureParameters were modified in the FPSO risk model toincorporate modifications in failure rates and consequences.The mooring event tree is shown in Figure 5. Frequencieswere tabulated for the four risk metrics. Figure 7 shows thatsubstantial risk reduction can be achieved using a dual linefailure criterion.

SummaryA comprehensive risk model has been constructed to assist inFPSO design risk tradeoffs. This model is envisioned to beuseful in supporting risk based classification activities.

OTC 12948 INTEGRATED RISK BASED DESIGN OF FPSO TOPSIDES, STRUCTURAL AND MARINE SYSTEMS 3

References

1. A Guide to Risk Assessment for Offshore InstallationsPart I, John Sponge and Edward Smith, DNV Technica,Revision 1, An MTD Multi-Sponsored Project, January1995.

2. Guide for Building and Classing Facilities on OffshoreInstallations, American Bureau of Shipping, June 2000.

3. Guide for Building and Classing Floating ProductionInstallations, American Bureau of Shipping, June 2000.

4. Guidance Notes on Risk Assessment Application for theMarine and Offshore Oil and Gas Industries, AmericanBureau of Shipping, June 2000.

5. Hydrocarbon Leak and Ignition Database, Report11.4/180, DNV Technica, prepared for E&P Forum, June1992.

6. Hydrocarbon Release Statistics Review, DavidMansfield, AEA Technology, A report produced forUKOOA, January 1998.

7. Offshore Reliability Data, OREDA Participants,distributed by DNV Technica, 1993.


Table 1 Description of Model Partitions

SystemCategory

Initiating Events Event Trees

Process 171 Loss of

Containment Fault Tree

modeling each ofthe 171 initiatingevents (PartsCount)

57 EscalationEvents

Comprised of 54 process section Each of the 2 phases in 3 separators is

modeled as a separate initiating event 3 Hole sizes (small, medium, large) Model Functions Ignition/Explosion Isolation Blowdown Fire Suppression

Marine 89 (70 fires by

zone) Failure of cargo management Ballast control failure Flooding from seawater system Flooding from cargo oil system Rupture of marine pressure vessels Energetic Release turbine breakup Marine fire Crude oil spill Diesel fuel oil spill Pump/engine room explosion Inadvertent discharge of oily waste due to

bilge system failure Inadvertent discharge of oily waste due to

surface runoff

Structural

46 StructuralDamage

Single mooring line failure Corrosion holes or fatigue crack in turret

shell Vessel impact with turret Hull damage following vessel impact or

helicopter crash Reduced weather vaning Turret superstructure or foundation damage Turret superstructure underdeck damage Process support damage Process support underdeck damage Transverse bulkhead damage Longitudinal bulkhead damage Ship hull damage during extreme weather Turret events following fire and explosion

Total 363 InitiatingEvents

17 Billion individual event sequences


Table 2 Top Events for Mooring Trees

TOPEVENT DESCRIPTION

IE Initiating EventMOORL Single mooring line failsOFST Vessel drift exceeds design limitsMOORS Mooring system fails (Loss of 2 or more lines)STATN Loss of stationRSSTR Production risers experience stresses greater

than ultimate limitsRSLOC Riser cracking occurs breaching containmentTUG Tug not available for recovery operatorGRND Vessel runs agroundVSSL Vessel impacts passing vesselFIXD Vessel impacts fixed installation

Table 3 Top Events for Process Tree

TOPEVENT DESCRIPTION

IE Initiating eventIGNE Immediate ignitionPSL Failure of PSL for isolationLSL Failure of LSL for isolationPISO Failure of isolation by Process PSL/LSLGDET Gas detection systemIGNL Late ignitionFDET Fire detectionESDO Manual actuation of ESD and blowdownISOL Failure of isolationBLDN Blowdown valvesFWSP Water spray deluge suppressionFOAM Foam/water fire suppression

Figure 1. Overall FPSO Risk Model Structure

S1 S2 F1 F2

E1E2

Em

SupportEvent Tree

FrontlineEvent Tree

EndStates

ConsequenceAnalysis

I.E.1

I.E.2

I.E.n

X1

X2

Xl

InitiatingEvent

Facility Response Model ConsequenceModel

S1

Generic IntoPopulation DataFacility-Specific Data

System

Component

Failure Mode

Damage

Figure 2 Process Loss of Containment Event Tree

Figure 3 Structural Failure Modeling Approach

SystemFamiliariza-

tion

SystemBreakdown

MooringSystem

Turret System

TopsideStructuralSystem

Hull System

Build EventSequenceDiagrams

Build EventTree

Diagrams

Quantification

Fre-quencyInput

End StateAssign-

ment

ModeratedMeetings

SubjectMatterExpert

SubjectMatterExpert

SubjectMatterExpert

SubjectMatterExpert


Figure 4a Mooring Event Sequence Diagram

MooringSystem Failure

Single MooringLine Failure

No adverseeffect

Design OffsetExceeded

No

Yes

Shut-inProduction

No

Yes

Yes

InitiateRepairs

InititaiteRepairs

Yes

No

No

Loss ofStation

Over-stressRisers

Release wellfluids

Yes

Shut-inProduction

InitiateRepairs

InititaiteRepairs

Yes

No

Shut-inProduction

InitiateRepairs

InititaiteRepairs

Yes

No

Shut-inProduction

InitiateRepairs

InititaiteRepairs

Yes

No

No

Yes

Over-stressRisers

No


Figure 4b Mooring Event Sequence Diagram

InitiateRepairs

Risers Severed

Boat Impact

Grounding

Loss of Asset

Polution

VesselRecovery

VesselRecovery

InitiateRepairs

Loss ofStation

Yes

No

Over-stressRisers

No

Over-stressRisers

Release wellfluids

Shut-inProduction

Vessel DriftControlled

(not available for extreme weater events)

Loss of Asset

Polution

Impact withother offshore

installation

Loss of Asset

Polution

Uncontrolled


Figure 5 Mooring Event Tree

1 1

2 2

3 3

4 4

5 5

8

9 9

6 6

7 7

10 10

IE MOORS STATN RSSTR RSLOC TUG S#

8

B#GRND VSSL FIXD


Figure 6a Transient Induced Leak Frequency Fault Tree


Figure 6b Transient Induced Leak Frequency Fault Tree


Figure 7 Mooring Redundancy Risk Results

NoneSingle Line (ABS

Rules) Two Lines (BPProposal)

1E-10

1E-09

1E-08

1E-07

1E-06

1E-05

1E-04

1E-03

1E-02

1E-01

1E+00

Fre

qu

ency

Mooring Line Redundancy

Minimum ConsequencesFatalities = None

Oil Release = 0 barrels

Repair Cost = $10-100 Thousand

Downtime = None

NoneSingle Line(ABS Rules) Two Lines (BP

Proposal)

1E-10

1E-09

1E-08

1E-07

1E-06

1E-05

1E-04

1E-03

1E-02

1E-01

1E+00

Fre

qu

ency

Mooring Line Redundancy

Maximum ConsequencesFatalities = 1

Oil Release = 30 - 40,000 barrels

Repair Cost = $3-10 Million

Downtime = 1 - 3 months

Low Value Facility(well protecter)

Typical OffshoreFacility (fixed platform)

High Value Facili ty

ANDY WOLFORDDr. Wolford has worked in industrialrisk assessment for 16 years. He hasdirected risk applications on adiverse range of engineered systems,including offshore and onshore oiland gas installations, mobile offshoredrilling units, and marine trans-portation systems in the U.S.,Central and South America, theNorth Sea, and offshore Malaysia

and Australia. With a focus on risk analysis and reliabilityengineering, Dr. Wolford has worked with numerousorganizations and companies to develop quantitative riskassessments, which could be utilized to make more informedbusiness decisions. Dr. Wolford earned his Sc.D. from theMassachusetts Institute of Technology.

JAMES C. LIN James Lin is a Senior Consultant atEQE International with over 17 yearsof experience in system engineering,reliability and availability analysis,and probabilistic safety assessment.Mr. Lin has a wide range ofexperience that includes acting as aproject manager, performing humanreliability analysis, and analyzingseismic risk. He has lectured PSA

courses and has responded to NRC review comments onIPEs/PRA. Mr. Lin earned his B.S. in Nuclear Engineeringfrom National Tsing Hua University, Taiwan and his M.S. inNuclear Engineering from University of California, LosAngeles. He is a Registered Nuclear Engineer, Californiaand a Certified Reliability Engineer, American Society ofQuality Control.

ROBERT E. SHEPPARD(picture unavailable)Robert Sheppard, a Principal Engineer with EQEInternational, has over twelve years of experience instructural engineering and reliability analysis. Mr. Sheppardhas been involved in projects across many industriesincluding offshore oil, onshore petrochemical, nuclearpower generation and other commercial and industrialfacilities. He has specialized in the assessment of natural andman-made hazards including wind, hurricane, blast andearthquake risks, and their effects on structures and systems.Mr. Sheppard earned a B.S. in Civil Engineering from RiceUniversity and an M.S. in Structural Engineering from theUniversity of California Berkeley and he is a registered CivilEngineer in California.

ABS BIOGRAPHIES

JAMES K. LIMINGJames K. Liming is a SeniorReliability and Risk ManagementConsultant and Corporate Associatewith over 17 years of experience inmanaging and performing complexengineered facility reliabilityengineering, risk analysis, andoperations and maintenance support.He has a diverse, wellbalancedbackground including handson

power plant operating and maintenance experience as wellas extensive analytical expertise. He has served as projectmanager or project engineer on several major industry andgovernment risk management projects worldwide, and isnoted as a leading practitioner of probabilistic riskassessment (PRA) and risk-informed asset management. Inaddition to providing direct analytical support for clients, hehas also developed and presented many training workshopsand technical papers on risk and reliability analysisapplications tools and techniques. He has authored or co-authored over 70 publications on risk and reliability analysismethods and applications. He is a former fully qualified U.S. Navy nuclear submarine officer, and he is currently aCaptain (O-6) and Naval Sea Systems Command unitCommanding Officer in the U. S. Naval Reserve. He holds aB. S. degree from the U. S. Naval Academy and an S. M.degree in nuclear engineering from the MassachusettsInstitute of Technology (MIT).

ANDY LIDSTONE (picture unavailable)Andy Lidstone is a Senior Engineer with EQE Internationalwith over fifteen years of industry experience for offshoreand onshore oil and gas facilities and chemical plants. Mr.Lidstones areas of expertise include the preparation ofhazard assessment reports, HSE Cases and probabilisticsafety assessments and reliability analysis. Mr. Lidstone isequally comfortable as a teacher / lecturer of Safety Casematerials or as a project manager for the development ofFailure Modes and Effects Analyses (FMEAs) for a fullrange of drilling structures. Mr. Lidstone earned a B.Sc.(Hons) in Physics from the University of Salford, Englandand is a Chartered Physicist and member of the Institute ofPhysics.


This paper was prepared for presentation at the 2001 Offshore Technology Conference heldin Houston, Texas, April 30May 3, 2001

This paper was selected for presentation by the OTC Program Committee following reviewof information contained in an abstract submitted by the author(s). Contents of the paper, aspresented, have not been reviewed by the Offshore Technology Conference and are subjectto correction by the author(s). The material, as presented, does not necessarily reflect anyposition of the Offshore Technology Conference or its officers. Electronic reproduction,distribution, or storage of any part of this paper for commercial purposes without the writtenconsent of the Offshore Technology Conference is prohibited. Permission to reproduce inprint is restricted to an abstract of not more than 300 words; illustrations may not be copied.The abstract must contain conspicuous acknowledgment of where and by whom the paperwas presented.

ABSTRACT

The increase in deepwater exploration activity has generatedincreased use of the Floating Production/Storage OffloadingSystems (FPSOs). Converting existing tankers is, in manycases, more economically feasible and faster than buildingnew FPSOs for the same purpose. For conversion of tankersto FPSOs, inspection and subsequent fitness for purposeassessment are crucially important.

The objective of this paper is to present the principles andstrategies of in-service inspection programs for FPSOs. Thepaper summarizes the technical basis for three levels ofinspection strategies: 1) probability-based inspectionmethod, 2) risk-based inspection method, and 3) optimuminspection method.

INTRODUCTION

FPSOs has many attractive features including relative lowcost, large working area, large water surface area, and goodstability and floatability.

FPSOs in many cases, are converted from existing tankers.It is therefore important to have a rational and reliableinspection method to provide information and knowledgeconcerning the proposed, present, and future integrity ofFPSOs.

FPSO inspections should be focused on:

Determination of condition of structural elements andstructural system,

Disclosure of defects (design, construction, operation,and maintenance),

Assurance of conformance with plans, specifications,guidelines, rules, and quality requirements,

Disclosure of damage, and Development of information to improve design,

construction, operation, and maintenance procedures.FPSO inspections have several levels of intensity:

General (global conditions), Specific (basic aspects of defects and damage), and Detailed (precise descriptions of flaws and other items

of operation and maintenance concern).FPSO inspections should be life-cycle oriented and includequality assurance and control measures in:

Design, Construction, Operation, Maintenance, and Accidents / casualties.FPSO inspections should be full-scope and include qualityassurance and control measures of the structure, equipment,facilities, and personnel.Research in inspection has been conducted in regulatoryorganizations, universities, and other leading organizations[1, 2, 3, 4]. Some important guidelines have been developedfor offshore inspection practices.The objective of this paper is to present the principles ofdevelopment of in-service inspection strategies for FPSOs.

PROBABILITY BASED INSPECTION

A number of limitations of in-service inspections have beenidentified [3, 4, 5], especially the significant uncertainties indesign, fabrication and damage detection, as well as theadequacy of examining only a limited amount of thestructural elements. The usefulness of probabilistic models to

OTC 12949

Risk Based Optimum Inspection for FPSO HullsT. Xu, Tao Xu & Associates, Yong Bai, American Bureau of Shipping, Mark Wang, Aker Engineering, R. G. Bea,University of California at Berkeley

IMS

IMS

IMS

2 T. XU, Y. BAI, M. WANG, R. BEA OTC 12949

deal with uncertainties, as well as Bayesian models has beenrecognized. The probability-based inspection method is thusdeveloped to include Bayesian analysis, and probability-based inspection planning.

Bayesian Analysis

The bulk of research on Bayesian analysis in engineeringapplication was first conducted in early 1970s. Thisapproach, defined as the probability of detection (POD)updating method, was widely applied in aeronauticalengineering systems, such as airframes, gas turbine engines[6]. In the late 1980s, an alternative Bayesian approach wasdeveloped as event updating using First Order ReliabilityMethod (FOSM) in the offshore industry[7]. Itagaki et al [8]developed Bayesian estimation approach in ship structuresbased on Bayesian point estimation method.

Event Updating

This approach is to update the probability of events, such asfatigue failure directly. Bayes theorem is applied here toupdate the failure probability conditioned on additionalevents, such as inspection event. It is expressed as

)|()|(

)|(HpPHqP

pHqP rr = (1)

where, qr|H - The original safety event , qr|pH - The fatiguesafety event after inspections, p|H - inspection eventThe original safety event qr|H can be formulated by using thecritical size (e.g., critical crack size for fatigue or criticalthickness reduction for corrosion) as the failure criteria

0aaH|q cr -= (2)The critical size is selected, perhaps based on serviceabilityconsideration. Other safety event such as brittle fracture orcorrosion threshold can be formulated.The inspection event p|H is formulated to describe theadditional information from inspections. Two types of eventmargins are classified based on inspection results.

0A)N(aH|p di -= (3)and

0A)N(aH|p i =-= (4)Equation (3) is the event that a defect size a(Ni) is notdetected by an in-service inspection with the crackdelectability limit Ad at the inspection time Ni. Ad isdescribed by the probability of detection (POD).Equation (4) is the event that a particular defect size A isdetected and measured at the inspection time Ni.

POD Updating

The POD updating is based on Bayesian approach to updateof the multi-variant probability distributions, see Fig. 1. Theupdated multi-variant probability distribution is used torecalculate the failure probability. Assuming that the defectsize distribution is FA(a) and that the probability of detectionof a is PD(a). By means of Bayes' theorem (Bayes form):

P[qr| pH] = P[p | q rH] P[q r | H]

P[q i | H] P[p | q i H]i=1

n

(5)

The updated probability density can be determined asfollows: Let H|q r : daaAa + , i.e.

da)a(f]H|q[P Ar = , and Hq|p r : inspection resulting inno crack detection:

)a(P1]Hq|p[P Dr -= (6)and the updated probability density is:

fA ,up(a) =[1 - PD(a)] fA(a)(1- PD(a)) fA (a)

0

(7)

The same methodology can be applied in the crack detectioninspection where the updated probability density is :

fA ,up(a) =fA (a) PD(a)fA(a) PD(a)da

0

(8)

Bayesian Estimation

This approach applies Bayesian approach in statisticalparameter (mean, standard deviation) estimation, see Fig. 2.The statistical parameter to describe the distribution of arandom variable X in the fatigue problem is defined as therandom variable m . The Bayesian estimation of m is to usethe extended Bayes theorem in probability density as:

)(f)(cL)(f '" mm=m (9)

Where )(f ' m = the prior distribution, )(L m = the likelihoodfunction of the observed data (objective information), c= anormalizing factor, and )(f " m = the posterior distributionincorporating the objective data.For a sample of observations xi , i=1,2,..., of X frominspections, the likelihood of the sample is proportional tothe product of the probability densities of X at x1, ...., xn :

OTC 12949 RISK BASED 'OPTIMUM' INSPECTION FOR FPSO HULLS 3

f " (m ) fx(x i | m)

i=1

n

f ' (m)

(10)

The updated probability distribution of X is thus expressedas:

f x (x) = fx|m (x |m )f " (m)dm (11)The updated probability of failure is computed using the

updated probability density )x(f x .

Probability-based Inspection Planning

With the development of Bayesian analysis, research onprobability-based inspection planning was developed.Itagaki, et. al [8] and Frli [9] discussed probability basedinspection planning for ship and offshore structures. Inprobability-based inspection planning, the failureprobabilities are generally expressed in terms of intersectionsof the events of inspection and failure. Information gatheredby inspection is accounted for by updating the probabilitiesusing Bayesian analysis. Three approaches have beendeveloped to extend the Bayesian analysis procedure toinspection planning: (1) target safety margins [4,8], (2)optimum life cycle cost [4,12], and (3) combination of (1)and (2) [4,10].

RISK BASED INSPECTION

Probability based inspection can be used to establish thecomponent/element in-service inspection schedules on thebasis of reliability requirement of the individual criticalcomponents (elements). However, FPSOs usually contain alarge number of components/elements. A rational inspectionprogram should be developed based on systemconsiderations.The development of a system-level, risk-based inspectionprocess includes the prioritization of systems, subsystems,and components/elements using risk measures, and definitionof an inspection strategy (i.e., the frequency, method, andscope/sample size) for performing the actual inspections.The process also includes decisions about the maintenanceand repair strategies. Finally, there is a strategy for updatingthe inspection program for a given system, subsystem, orcomponent/element, using the results of the inspections thathave been performed.

Methodology

The methodology for risk-based inspection may besummarized as:

The use of a multidisciplinary, top-down approach thatstarts at the system level before focusing the inspectionat the component/element level.

The use of a living process that is flexible, strives forcompleteness, and can be easily implemented andupdated.

The use of qualitative and quantitative risk measures The use of effective and efficient qualitative and

quantitative methods that provide results familiar toinspection personnel.

Figure 3 illustrates the overall risk-based inspection process.The process is composed of the following steps:

Definition of the system for inspection Use of a qualitative risk assessment that utilizes expert

judgment and experience in identifying failure modes,causes, and consequences for initial ranking of systemsand components/elements in inspection.

Application of quantitative risk analysis methods,primarily using an enhanced Failure Modes, Effects, andCritically Analysis (FEMCA) and treating uncertainties,as necessary, to focus the inspection efforts on systemsand components/elements associated with the highestcalculated safety, economic, or environmental risk.

Development of the inspection program for thecomponents, using decision analysis to include cost-benefit considerations.

The inspection strategy are being updated andimplemented, based on the findings and experience fromthe previous inspections.

Several feedback loops are shown in Figure 3 to represent aliving process for the definition of the system, the ranking ofcomponents/elements, and the inspection strategy for eachcomponent/element.

System Definition

A key step in defining a system for inspection, as shown inthe first box of Figure 3, is the assembly of information thatis needed for the risk-based inspection approach. Inparticular, the interviewing of key personnel, who areknowledgeable for degradation mechanisms or errors thatmay not be documented, is vital to the process.

Inspection Prioritization

The qualitative risk assessment, as included in the secondbox of Figure 3, utilizes expert judgment and experience inprioritizing systems, and components/elements forinspection. A key element for this assessment is to identifypotential failure modes and causes, including design,operational, and maintenance errors and potentialdegradation mechanisms.Figure 4 shows an example result of a qualitative riskassessment in which each box is representative of a givencomponent, and a box is used to show the range of estimatedconsequence and failure probability. Once numbers are


placed on the axes, the risk assessment become quantitative,with uncertainty being represented by the size of boxes.The risk is defined as:Risk = (likelihood of failure)x(failure consequence) (12)Consequences of failure can be measured in a variety ofways, such as injuries/deaths, economic loss, environmentaldamages, dollars. In Figure 4, region A is high risk, regionB is intermediate risk, and region C is low risk.Components/elements are grouped according to the region inwhich they fall.The FMECA (Failure Modes, Effects, and CriticalityAnalysis) in the third box of Figure 3 is an element of thesubjective probabilistic ranking. It provides an efficientmeans of integrating the information required for a risk-based prioritization. Information on systems orcomponents/elements is gathered from

design information, operating experience (including prior inspection

results), structural reliability and risk analysis (SRRA)

results, and expert opinion to define failure modes, failure

causes, and (perhaps) failure probability.

In this way, the key information is integrated to provide thesafety, economic, or environmental risk associated with thesystems, subsystems, and elements to develop the inspectionrankings for different systems/components.The probability-based inspection method developed based onprobabilistic structural mechanics is perhaps the essentialpart of the FMECA since it provides a rational framework toestimate failure probabilities for components/elements.

Inspection Program Development

Once the FMECA is completed, and thecomponents/elements are ranked or categorized, the nextstep is to develop an inspection program for each group ofcomponents. This is the bottom box in Figure 3 that isschematically shown in Figure 5. It can also be used toestablish an inspection program for an individualcomponent/element or a system, as necessary. Therecommended process is divided into three basic steps:

Choose potential inspection strategies that define thefrequency, method, scope, and sampling procedure forinspection: The method of inspection includes theprocedure, equipment, and level of personnelqualification to perform the inspection. The inspectionstrategy can also take advantage of monitoring systemsand maintenance test program.

Choose an inspection strategy and perform inspection:From the potential inspection strategies, defined in theabove step, the effect of each of these strategies on the

failure probability of the component/element isestimated.

Choose appropriate action and update state ofknowledge and information: Following the performanceof the inspection, a critical decision is faced. That is,should the component/element be repaired or replaced ifsignificant findings occur, or should nothing be doneexcept to redefine the inspection program (going back topart 1 of the overall process shown in Figure 3)? Shouldthe existing inspection, maintenance, repair system bechanged? This depends on the fitness for purposeevaluation to determine the inspection findings andpotential actions on the failure probabilities. In anycase, all of the results related to inspection should beused to update the FMECA information on a periodicbasis to re-rank the components/elements on the basis ofrisk and to redefine the inspection program.

RISK BASED OPTIMUM INSPECTION

Experience with in-service inspections of ship and offshorestructures has adequately demonstrated that there are twodistinct categories of defects and damage that are found:

Those due to intrinsic causes - those that could havebeen or were anticipated (natural, predictable), and

Those due to extrinsic causes - those that could nothave been anticipated (human caused, unpredictable).

Experience with fatigue and corrosion damage found in shipand offshore structures clearly indicates that a substantialamount (if not a majority) of damage falls in the secondcategory - unpredictable and due to the erroneous actionsand inactions of people.Quantitative inspection analyses (e.g. probability or riskbased inspection methods and programs) can help addressthe first category of defects by providing insights into when,where, and how to inspect and repair. However, such ananalysis cannot be relied upon to provide information thataddresses the second category of defects. Expert observationand deduction (diagnostic) techniques must be used toaddress the second category of defects.Such recognizations lead to the development of theoptimum inspection method for FPSOs. The overallobjective of the optimum inspection method is to developan effective and efficient safety and quality control system inthe life cycle management of the FPSOs.

Inspection Performance

Inspection performance is influenced by the vessel, theinspector, and the environment (Figure 6).The vessel factor can be divided into two categories: designfactors and condition/maintenance factors. Design factors,including structural layout, size, and coating, are fixed at theinitial design or through the redesign that may accompany


repair. Condition/maintenance factors reflect the change in avessel as it ages, including the operation history andcharacteristics of individual damages/defects (crack,corrosion, bucking), its size, and its location.The person (inspector) carries out an inspection can greatlyinfluence the inspection performance. Performance variesnot only from inspector to inspector, but also from inspectionto inspection with the same inspector based on mental andphysical condition. Factors associated with the inspectorinclude experience, training, fatigue and motivation.The environment in which the inspection is carried out has amajor influence on performance. The environment factorscan be divided into two categories: external factors whichcannot be modified by inspection procedures and procedurefactors that can be modified. External factors includeweather and location of the vessel, that is, whether theinspection is performed while underway, while in port, orwhile in dry-dock. Procedural factors reflect the conditionduring the inspection (lighting, cleanliness, temperature,ventilation), the way in which the inspection is conducted(access method, inspection method, crew support, timeavailable) and the overall specification for inspection(inspection type).

Inspection Strategies

Inspections, data recording, data archiving (storage), anddata analysis should all be a part of a comprehensive andoptimum inspection system. Records and thoroughunderstanding of the information contained in these recordsare a key aspect of inspection programs.Inspection is one part of a system that is intended to helpdisclose the presence of anticipated and unanticipateddefects and damage. Development of inspection programsshould address:

Elements to be inspected (where and how many?), Defects, degradation, and damaged to be detected

(what?), Methods to be used to inspect, record, archive, and

report results (how?), Timing and scheduling (when?), Organization, selection, training, verification, conflict

resolution, and responsibilities (who?), and Objectives (why?). Where and How Many?

Definition of the elements to be inspected is based on twoprincipal aspects:

Consequences of defects and damage, and Likelihood of defects and damage.

The consequence evaluation essentially focuses on definingthose elements, and components that have a major influenceon the quality and safety of a FPSO. Evaluation of thepotential consequences should be based on historical data

(experience) and analysis to define the elements that arecritical to maintaining the integrity of a FPSO. Thelikelihood evaluation focuses on defining those elements thathave high Likelihoods of being damaged and defective.Experience and analyses are complementary means ofidentifying these elements.

What?

A substantial amount (if not the majority) of the damage isunpredictable and due to the unanticipated erroneousactions and inactions of people [13].Current experience also indicates that the majority ofdamage that is associated with accidents (collisions, droppedobjects) is discovered after the incident occurs [13]. About60% of fatigue and corrosion damage is detected duringroutine inspections. However, the balance of 40% isdiscovered accidentally or during non-routine inspections.

How ?

The methods to be used in FPSO inspections are basicallyvisual. In one form or another, these methods are primarilyfocused on getting an inspector close enough to the surfaceto be inspected so that he can visually determine if there aresignificant defects or damages. However, ultrasonic gauging,magnetic particle, radiographic and other nondestructivemethods sometimes are necessary for FPSO.

When?

There are no general answers to the timing of inspections.The timing of inspections is dependent on:

The initial and long-term durability characteristics of theFPSO structure;

The margins that the operator wants in place overminimums so that there is sufficient time to plan andimplement effective repairs;

The quality of the inspections and repairs; and The basis for maintenance on demand (repair when it

breaks or leaks or programmed (repair or replace onstandard time basis).

Who?

Experience has adequately demonstrated that the single mostimportant part of the inspection system is the inspector. Theskills, knowledge, motivation, integrity of the inspector arecritically important. Equally important are theorganizational influences exerted on the inspector, theprocedures and processes that he is required to follow, theenvironments in which he must work, and the supporthardware and systems that are provided for him to performhis work. Thus, the inspector is significantly influenced by


1) organizations, 2) procedures, 3) hardware (facilities), and4) environments.

Much has been learned about how to improve theeffectiveness and efficiency of the inspector [12]. As onedesigns new inspection systems, it is important that theinspector be recognized as a part of this system [4].

Why?

Inspection should have objectives of several levels: first, itprovides the general information and knowledge for thequality of the in-service structures for fitness for purposeevaluation (general condition), second, it is to detect thedamage/defects as many as possible so that effective andefficient maintenance and repair program can beimplemented to correct these damages/defects (qualitycontrol and assurance), third, it is a safety control tool toprevent the failure or loss of the in-service structures duringthe inspection interval (safety control and assurance).The inspection strategies (when, where, how, who) fordifferent level objectives should be different. The first levelinspection should select typical elements/components toprovide general information about the in-service structuresfor fitness for purpose evaluation. It is more frequent lessdetail inspection associated with long-term maintenance andrepair program. The second level (quality control)inspection should focus on the critical components/elementsto detect damage/defects as many as possible. It isassociated with the short-term maintenance and repairprogram. The third level inspection (safety control) is toprevent the most critical damage/defects or errors to ensurethe safe operation during the inspection interval. It is themost detailed and difficult inspection to identify the safety-related predictable or unpredictable damages/defects anderrors. Every inspection practice for a specific fleet shouldbe a combination of these three different inspectionstrategies.The value of the inspection for objectives of different levelsshould also be different. The value of the first levelinspection is about the decision on whether or not theexisting structure can fulfill the purpose for extended service.The value of the second level inspection is about the decisionwhether or not we should change the maintenance and repairprogram. The value of the third level inspection is about thedecision whether or not we should take any intermediateactions. Value analysis (value of information) can helpmake these decisions.

Optimum Inspection Method

The optimum inspection method can be proactive (focusedon prevention) or it can be reactive (focused on correction).It should have four functions:

Assess the general conditions of the in-service offshorestructures,

To confirm what is thought: to address the intrinsicdamages/defects that can be predicted based results fromtechnical analyses,

To disclose what is not known before inspection; toaddress damage/defects that can not be predicted basedon technical analyses, and

To control the predictable and unpredictable damages; todevelop high quality maintenance and repair program.

The optimum inspection program should be started withthe design of the structure (conception), proceed through thelife of the structure, and conclude with its scrapping (life-cycle). The optimum inspection program should include notonly the hull structure, but as well, its equipment and itspersonnel (full scope). The optimum inspections shouldbecome the means to assess the general conditions of thewhole structure. The optimum inspections are also the meansto detect unpredictable flaws and damages of the structuralelements, and permit appropriate measures to be taken topreserve the safety and integrity of the structure. Theoptimum inspections are also the means to assure that all isgoing as expected, that the structural elements areperforming as expected, and that corrosion protection andmitigation (e.g. patching pits, renewing locally excessivelycorroded plate) is maintained.The optimum inspection method starts from the survey forthe intrinsic damage that is common for the class ofstructures. Based on the experience, the inspection for theintrinsic damage can be conducted in the rational way. Theexisting risk-based inspection method discussed early thispaper is the framework for the intrinsic damages/defects forthe structural system. The probability-based inspectionmethod can be applied for the specific elements/componentsbased on the results of risk-based inspection. For theextrinsic damage for each individual structure, theknowledge-based diagnosis method should be developed.The step-by-step knowledge-based diagnosis process is thepotential means to identify the extrinsic damages.Knowledge systems now routinely do diagnosis reasoningusing three methods: model-based diagnosis, heuristicclassification, and case-based reasoning. Our system uses acombination of each of these methods: Model-BasedDiagnosis (MBD) to identify the details of a large class ofpossible problems, heuristic classification to identify thepresence a set of idiosyncratic problems, and Case-BasedReasoning (CBR) to compare observation with previouslyidentified cases.An optimum inspection method could include:

Developing standard task checklists to ensure thatrelevant data and tasks are not lost because ofdistractions or workload,

Performing global surveys to develop situationawareness for potential expected and unexpecteddamage and defects,


Inspecting high likelihood of damage or defect partsand high consequence parts; if something suspicious isfound, the inspection is intensified by model-baseddiagnosis, heuristic classification, and case-basedreasoning until root causes (not symptoms) aredetermined,

Inspecting periodically decreasing the time betweeninspections as the rate of degradation or likelihood ofdefects and damage increase,

Inspecting after accidents or early warning signals aresensed,

Implement the long-term and short-term maintenanceand repair strategies based on the inspection results,

Update the IMMR (Inspection, Maintenance,Monitoring and Repair) plan based on the survey resultsand the results from maintenance and repair,

Performing inspections that are independent from thecircumstances that cause potential defects and damage,and

Using qualified and experienced inspectors that havesufficient resources and incentives to perform qualityinspections.

For each FPSO, standard checklist and procedures should beestablished from the FPSO Structural Life-Cycle InformationManagement System, in order to carry out an effectiveevaluation of the general condition, prior to thecommencement of any general survey and include:

Structural drawing, Operating history and conditions, Previous damage/defects inspection results, Condition and extent of protective coatings, Classification status, including any outstanding

conditions of class, Previous repair and maintenance work, Previous information on unpredictable damage or

defects, Experts judgment and comments, Relevant information from its sister structures.

With this information and previous inspection guidelinesregarding critical elements/subsystems in the FPSOstructural systems considered to be sites of potentialdamage/defects based on historical data, analyses results, andexperts judgment, it is possible to target the appropriateinspection strategies for the potential areas within thestructure for general survey and the initial scope of theinspection. After the initial inspection to determine thegeneral condition of the system, the inspector can developsituation awareness to identify some potential unpredictablecritical damage/defect sites. Further knowledge-baseddiagnosis should be conducted for these suspicious areas.The knowledge-based diagnosis is conducted together withdetailed or specific inspections.

Inspection Data System

The single weakest component that has been found in presentinspection systems for FPSOs regards the data andinformation that is developed during and from inspections.Little thought has been given to the efficient gathering ofdata and information, even less thought to what is done withthis data and information when it is obtained, and far lessthought given to the archiving, analysis, and reporting of thedata. The interfaces in the data gathering, archiving,analysis, and reporting activities also have received a littlesystematic thought. Current work has not been able toidentify a single coherent and optimum inspection datasystem for FPSO.Advances in information technology have resulted in betterways to use information for the management of safe andefficient ship and offshore structures. The integration ofstand-alone systems combined with improved informationrecording, organization and communication offerssubstantial benefits for the life-cycle management of shipand offshore structures. A life cycle Structural InformationManagement System (SMIS) is intended to facilitate the life-cycle management of FPSO. This includes areas from designand construction as well as operations including Inspection,Maintenance, Monitoring and Repair (IMMR). Theinspection data system is a component of the IMMR modulein SMIS.The general objectives of an inspection data systemdevelopment are:

Collect inspection data, Store the data, Provide means for logic inspection data management, Allow for the organization of the inspection data in a

form suitable for fitness or purpose analyses, and failureanalyses,

Analyze the data, Show trends of the information such as damage/defects

associated with structural integrity, Communicate and report the data.

Once a FPSO is ready for service, a series of inspections arescheduled according to inspection program. The objectiveand scope of the internal tank inspections are defined. Theaccess methods and data recording methods are chosen, andthen the inspections are performed. The inspection resultsincluding corrosion gauging, cracking, status of coating andcorrosion protection systems and other structure/equipmentdefects are updated into the corresponding database. Usingthe inspectional data, maintenance and repair strategies canbe developed and the repair are finally carried out.


REENGINEERING THE IMMR PROCESS

FPSO in-service inspections and repairs are components inan Inspection, Maintenance, Monitoring and Repair (IMR)system that is intended to help disclose the presence ofanticipated and unanticipated defects and damage tocritical structural details [4,12].An IMMR system is a critical part of the maintenance of in-service quality of a FPSO. The IMMR process should be inplace, working, and being further developed during the entirelifetime of the structure. The IMMR process is responsiblefor maintaining the quality of the structure during the usefullifetime of the structure. A fundamental and essential part ofthe IMMR process is knowledge. The IMMR process can beno more effective or efficient than the knowledge, data, andexperience that form the basis for the process.Xu et al [4] indicates that organization of the FPSOinspection should be developed to:

Define inspection processes in which only thatinformation that is absolutely necessary to assureacceptable quality in the FPSO is gathered,

Determine how to minimize the people and man-hoursrequired in the entire IMMR process,

Define how to minimize the steps, interfaces, multipleprocessing, and paper required in the IMMR process,

Determine how to minimize the checks, controls,reporting, and reconciliation required in the IMMRprocess, and

Define how take full advantage of present computing,communications, and information technologies (CCIT).

CONCLUSIONS

This paper addresses the development of optimuminspection strategies for FPSOs. It details with the technicalbasis for 1) probability-based inspection method, 2) risk-based inspection method, and 3) optimum inspectionmethod. The probability based inspection methods arerecognized to be able to address only part of the potentialsfor damage in FPSOs. The risk-based inspection addressesthe component/elements damages/defects from the systemrisk point of view. The optimum inspection method is afull-scope, life-cycle development of inspection system forthe risk management. The optimum inspection method notonly includes use of expert observation and analysis(deductive) methods but also the use of structuralinformation system. It is demonstrated that application ofthis comprehensive and integrated approach will result inbetter allocation of the resources used to develop effectiveinspection strategies.

ACKNOWLEDGEMENT

The technical views expressed in this paper are those of theauthors and are not necessarily those of the institutions theyare affiliated with.

REFERENCES

1. Tanker Structural Co-operative Forum (1986) GuidanceManuals for the Inspection and Condition Assessment ofTanker Structures.

2. Tanker Structure Co-operate Forum, (1990) Inspection,Assessment and Experience of Old Tankers, WitherbyMarine Publication.

3. Marine Technology Directorate, (1989) "UnderwaterInspection of Steel Offshore Installations: Implementationof a New Approach", Report 89/104.

4. Xu, T., Bea, R. G., (1996) " Inspection of MarineStructures", Report for Joint Industry Research, MarineTechnology and Management Group, Dept. of CivilEngineering, University of California at Berkeley, Berkeley,CA 94720.

5. Demsetz, L.A., Cario, R., and Schulte-Strathaus, R., (1995)Inspection of Marine Structures, Report for MaritimeAdministration under Project Number DTMA91-93-G-00040.

6. Yang, J.N. and Chen, S., (1985) "Fatigue Reliability ofStructural Components Under Scheduled Inspection andRepair Maintenance," Probabilistic Methods in Mechanicsof Solids and Structures, edited by S. Eggwertz andN.C.Lind, Springer-Verlag, Berlin, pp. 103-110.

7. Moan, T., (1993) "Reliability and Risk Analysis for Designand Operations Planning of Offshore Structures", Proc ofthe 6st Intl Conf on Struct Safety and Reliability,ICOSSAR'93.

8. Itagaki, H., Akita, Y. and Nitta, A., (1983) "Application ofSubjective Reliability Analysis to the Evaluation ofInspection Procedures on Ship Structures", Proceedings ofthe International Symposium on the Role of Design,Inspection and Redundancy on Marine StructuralReliability, National Academy Press, Nov. 13-16.

9. Frli, O., (1990) "The Reliability and Cost-Effectiveness ofOffshore Inspections", Proc. Intl Conf on Monitoring,Surveillance and Predictive Maintenance of Plants andStructures, Sicily, Italy.

10. Shinozuka, M., (1990) "Relation of Inspection Findings toFatigue Reliability", Ship Structural Committee Report,SSC-355

11. Marine Technology Directorate, (1994) "Review of Repairsto Offshore Structures and Pipelines, Report 94/102.

12. Bea, R.G, (1993) Ship Structural Maintenance: RecentResearch Results and Experience, Transactions, TheInstitution of Marine Engineers, London

13. Jones, R. B. (1995). "Risk-Based Management - AReliability-Centered Approach", Gulf Publishing Co.,Houston, Texas.

14. Platten, J. L., (1984) Periodic (in-service) Inspection ofNuclear Station Piping Welds, for the Minimum overallRadiation Risk, Proceedings of the 5th InternationalMeeting on Thermal Nuclear Reactor Safety, Vol. 1.

15. Drury, C. G., Lock, M. W. B. (1996). Ergonomics in CivilAircraft Inspection, Human Error in Aircraft Inspectionand Maintenance, Paper Presented to Marine Board


Committee on Human Performance, organizational Systems,and Maritime Safety, National Academy of Engineering,National Research Council, Washington, D. C.

ac

fA(a)

Initial crack distribution

Mean Crack Size

Number of Cycles

N

Inspection

Original distribution

Updated distribution

Probability of Failure

Figure 1 Illustration of POD Updating

fa(a)

Prior

Experiment/Inspection

a a

fa(a)

Posterior

Experiment/Inspection

Figure 2 Illustration of Bayesian Estimation


System Definition

* Defines System, System Boundary, and fitness for purpose criteria

* Collect Information

Risk Analysis

* Define Failure Modes * Define Failure Criteria * Identify Consequence * Rank Subsystem e.g. stiffened panel * Rank Components/Elements

(1) Failure Modes, Effects, and Critically Analysis

* Redefine Failure Modes * Redefine Failure Causes * Redefine Failure Consequence * Assess Failure Probabilities for the Fitness for Purpose * Assess Conseuquences * Risk Evaluation * Risk Based Ranking

(2) Development of Risk Based Inspection Program

* Choose Potential Inspection Strategies (Frequence, Methods, Sampling Procedures) * Define Potential for Damage States * Define Potential Damage for Inspection Damage * Estimate Effect of Inspection on Failure Probabilities * Choose Inspection Stratey and Perform Inspection * Perform Sensitive Studies * Choose Appropriate Inspection, Maintenance, Repair (IMR) System

Risk Analysis

Figure 3 Risk-based Inspection Process


Consequences

A

B

C

Figure 4 Definition of Risk Index

0 0 . 20 . 40 . 60 . 81 1 . 2

F a t i g u e

C o l l i s i o n

Dropped Object

Fabrication fault

Installation fault

C o r r o s i o n

Design error

Operating error

FREQUENCY 0F PLATFORM DAMAGE (% / year)

CAUSE OF DAMAGE

Figure 5 Causes of Damage to North Sea Structures

1. Select Potential Inspection Strategies* Define Potential for Damage States * Define Potential for Inspection Damage * Define Reliability of Inspection Methods

2. Choose an Inspection Strategy and Perform Inspection * Estimate Effect of Inspection on Failure Probabilities * Estimate Effect on Potential Degradation Mechanism * Estimate Effect of Potential Loading Condition * Fitness for Purpose and Sensitivity Studies

3. Select Appropriate IMR System

4.

(1) Obtain More Information

(Sensitive Studies)

Update

Now

(2) Implement IMR System

LaterUpdate State Knowledge and Information

Figure 6 Development of In-Service Inspection Program


Inspection Performance

INSPECTOR

Experience

Training

Fatigue

Motivation

VESSEL

Design

- Structural Layout

- Size

-Coatings

Condition/Maintenance

-Cargo-Defects

type

size

age

location

Number

ENVIRONMENT

External

- Weather- Location of Vessel

Procedure

- Lighting

- Cleanliness

- Temperatures/Humidity

- Ventilation

- Access Method

- Inspection Method

- Inspection Strategy

- Area to be Inspected

- Crew Support

- Time Available

- Inspection Type

Figure 7 Factors that affect Inspection Performance

YONG BAI

Yong Bai is Manager of OffshoreTechnology in the ABS TechnologyGroup. He is leading and partici-pating in the preparation andupdating of offshore classificationguides on pipelines and risers,floating production installations andguidance notes on ultimate strength,fatigue/fracture and structural

analysis of jack-ups. He is also actively conducting researchon offshore structural reliability and FPSOs.

Yong has a MSc. degree and a Ph.D. degree in navalarchitecture. When he was a professor of offshore structures,he wrote books on Pipelines and Risers and MarineStructural Design. He has been actively involved withstructural design and analysis of pipelines, risers andoffshore platforms.

ABS BIOGRAPHIES


This paper was prepared for presentation at the 2001 Offshore Technology Conference held inHouston, Texas, 30 April3 May 2001.

This paper was selected for presentation by the OTC Program Committee following review ofinformation contained in an abstract submitted by the author(s). Contents of the paper, aspresented, have not been reviewed by the Offshore Technology Conference and are subject tocorrection by the author(s). The material, as presented, does not necessarily reflect anyposition of the Offshore Technology Conference or its officers. Electronic reproduction,distribution, or storage of any part of this paper for commercial purposes without the writtenconsent of the Offshore Technology Conference is prohibited. Permission to reproduce in printis restricted to an abstract of not more than 300 words; illustrations may not be copied. Theabstract must contain conspicuous acknowledgment of where and by whom the paper waspresented.

AbstractThis paper describes the reliability methods for positionmooring design and analysis with various degrees ofcomplexity and with a particular emphasis on deepwaterapplications. The limit state design and safety factor formatsfor position mooring systems of various floating platforms arefirst addressed. This paper addresses technical issues of bothpassive and active mooring systems including winch orthruster assisted and dynamic positioning systems. Themodeling uncertainties of numerical analysis, mooringcomponents, environmental conditions and reliability methodsare addressed. This paper presents a logical approach toreliability analysis for the calibration of partial safety factorsfor both passive and active mooring systems.

IntroductionAs the development of offshore oil and gas is moving intodeeper waters, floating platforms are used for drilling and/orproduction operations. For these operations, position mooringsystems are required in order to keep the floating platforms onstation under the design environmental criteria of wind,current and waves. Various types of floating platforms andmooring systems can be considered for offshore applications.For mooring strength limit states, partial safety factor formatshave been proposed recently in the offshore industry. It isimportant, however, to fully understand how to use thereliability methods to calibrate the partial safety factorsselected. The subject matter is significant to the offshoreindustry for enhancing the reliability of position mooringsystems with cost-effective designs. This is especiallyimportant for deepwater applications because theconsequences of position mooring system failure would bemuch more costly than in relatively shallow waters.

Limit States of Mooring DesignLimit state design methods are first described with particularreference to the design of position mooring systems forfloating installations. The limit state design philosophy maybe used to provide a rational framework for the design of safeand serviceable structures or structural components, byaccounting for uncertainties and variabilities in the basicvariables affecting the design, [1, 2]. This is achieved bydescribing these uncertainties and variabilities statistically,using data from offshore practice, and calibrating the limitstate formulation, including the deterministic and reliabilityanalysis methods used in evaluating the probability that thelimit state will be exceeded, to ensure that existing acceptedsafety levels are achieved.

The performance of a structural system, or a component ofthe structure, may be described by a set of limit states(limiting conditions) beyond which the structure, orcomponent, is no longer deemed to satisfy the designrequirements. Limit states can be regarded as a discreterepresentation of a more general continuous loss function. Ingeneral, the failure of a structural system or component tosatisfy the design requirements may be represented by aninequality of the form:

g X 1 ,K , X n , C( ) 0 (1)

Where, g is the limit state function, X1,, Xn are the basicvariables associated with the limit state, and C are constraintsdescribing the limits of acceptable accelerations, offsets,clearances, etc. The acceptable performance of positionmooring systems depends on system responses toenvironmental actions and the systems strength, in intact anddamaged conditions. Additionally, moored installations maydepend on the availability of active systems, such as thrustersand winches, to control or reduce critical system responses.

In general, the evaluation of mooring system limit states ismore complicated than the evaluation of component limitstates. In the analysis of position mooring systems, computerprograms, databases, model tests, statistical models, empiricalrules and assumptions are used in evaluating the complex non-linear coupled behavior of the vessel, mooring lines, andrisers. All of this is symbolized by the limit state function g ineqn. (1). For example, linear potential theory may be used tosynthesize approximate first and second order vessel forces

OTC 13269

Reliability Methods for Deepwater Position-Mooring Design and Analysis

Ken Huang and Yong Bai, American Bureau of Shipping, Houston

2 KEN HUANG AND YONG BAI OTC 13269

and motions in irregular seas. Wind and current forcecoefficients may be derived from databases for generic vesseltypes or from wind tunnel tests on scale models.Characteristic and extreme values of response parameters maybe calculated from statistical models and assumeddistributions and calculated output parameters from oneanalysis program are often used to define input variables orcoefficients in a second program.

The basic variables that determine the behavior andresponses of moored systems fall into one of the followingcategories.(1) Action or load variables - associated with intensity andspatial variations of actions or loads, such as; wind and waveintensities, spectra, and directions, current profile, velocity,and direction, mooring line pretensions, vessel draft/ballast,etc.(2) Component and material variables - associated withcomponent and material properties, such as; mooringcomponent break strength, fatigue endurance, density,elasticity, soil strength, etc.(3) Geometric variables - associated with the structural systemor component geometry, such as; vessel shapes/dimensions,mooring line diameter, line segment length, line angles, waterdepth, etc.(4) State variables - associated with combined properties ofthe system or component and the environment, such as; wind,wave drift, and current force and moment coefficients,response amplitude operators (RAOs), wave frequency naturalperiods and damping, mooring line and vessel drag and addedmass coefficients, low frequency damping, etc.(5) Active system variables - associated with the performanceand mean time to failure and repair of the mechanical andelectrical, distribution, monitoring, and control systems andthe experience and training (human factors) of the personneloperating the active systems.(6) Modeling uncertainty variables - associated with thephysical (hydrodynamic and structural theories) and statisticalmodels and the reliability methods, which are used incalculating system responses, component and systemstrengths, endurance, etc. and the notional reliability levels ofcomponents and systems.

For position mooring systems, strength limit states areusually associated with the maximum installation, survival,operational, disconnect, and reconnect criteria in their mostextreme design environments. Depending upon the inspectionand maintenance program, strength may also depend ondamage accumulation; that is on the fatigue, corrosion, andwear endurance limit states, generally in the long-termenvironment. While, operational performance is usuallyrelated to offset and motion limit states in the maximumoperational environment. These limit states are normallysubdivided further. For example, in the maximum designenvironment individual limit states will address extreme lineloads, total turret loads, anchor loads and line angles, vesseloffsets, motions, and clearances etc. for intact, damaged, andtransient cases.

Design requirements, criteria, and the safety factors

recommended in present codes developed and evolved toserve the needs of mobile offshore drilling units (MODUs). Inparticular, the methods of analysis and design criteriacontained in API codes were originally developed basedmainly on the operational experience of chain and wirecatenary spread moored semisubmersible drilling units, [3 7]. Over the past twenty years these methods of designingmooring systems for MODUs have been used worldwide andhave proved to provide adequate safety levels forconventionally moored semisubmersibles, [8]. More recently,spread moored semisubmersibles, spars, and turret mooredships, with or without thruster assistance, using taut orcatenary mooring systems, and synthetic mooring linecomponents as well as chain and wire, have been used aspermanent production installations. API and ISO havedeveloped codes that also address the design requirements ofthese types of installations, [9 12]. However, in these codesthe combined effects of variability in environments andsystem responses and strengths, for different types of vessel,mooring systems, and environments, have not been fullyaccounted for. Consequently, safety levels inherent in todayscodes are largely arbitrary and cannot ensure either anoptimum level of safety or economy in construction. Due tothe historical experience on which code development has beenbased, the analysis methods and safety factors recommendedby the present API and ISO codes, [10, 11], are mostapplicable to conventionally moored semisubmersibles.

Safety Factor FormatsWhen limit states are evaluated using deterministic

methods, the basic variables (X1,, Xn) are replaced by theircharacteristic design values (y1,, yn), and a set of safetyfactors (g1,, gm) or safety elements are introduced which arechosen to ensure a minimum level of safety, [2]. This allowsthe limit state checking equation used in deterministic designmethods to be represented by:

g y 1 ,K , y n , C , g 1 ,K , g m( ) 0 (2)For example in evaluating the mooring systems strength

limit state, the characteristic values of wind, wave, and currentare usually chosen as the most probable maximum valuesassociated with the design return period, and conservativeranges (safety elements) of peak periods and relative wind,wave, and current directions are considered. While themooring line break strength is represented by the catalog breakstrength of the component, including a reduction in diameter(safety element) to allow for corrosion losses. In thistraditional design method some safety elements are pre-applied (spectral peak period and wind, wave, and currentdirections) while intact, damaged, and transient line tensionsafety factors are post-applied.

API RP 2SK and the ISO station keeping standard, [10,11], both use a total safety factor that is applied to the mooringsystem responses, post-applied, and contain some referencesto pre-applied safety elements. Generally, line strength post-applied safety factor formats for intact, damaged, and transientcases may be expressed as:

OTC 13269 RELIABILITY METHODS FOR DEEPWATER POSITION-MOORING DESIGN AND ANALYSIS 3

BSg

m

g mTm y1 ,K ,y n( ) + g LF TLF y1 ,K , yn( )+ g WF TWF y1 ,K , yn( )

or

BS g m g mTm y1 ,K , yn( )+ g LF TLF y1 ,K ,yn( ) + g WF TWF y1 ,K , yn( )( )

(3)

Where,BS = catalog break strength of mooring componentTm = mean tension, nonlinearly dependent on (y1,, yn)TLF = low frequency tension, nonlinearly dependent on (y1,, yn)TWF = wave frequency tension, nonlinearly dependent on (y1,, yn)(y1,, yn) = characteristic design values of the basic variables

on which line tensions dependgm = mooring component partial safety factorgm = mean tension partial safety factorgLF = low frequency tension partial safety factorgWF = wave frequency tension partial safety factor

Design methods that are based on a safety factor format ofthis type, eqn. (3), are known as load and resistance factoreddesign (LRFD) methods. In the case of the API and ISOmooring codes only a single or total safety factor is specified.

Where there is uncertainty or variability in the basic(input) variables, post-applied safety factor formats of theLRFD type will produce inconsistent safety levels for mooringsystems that have different nonlinear response characteristics.Additionally, inconsistent levels of safety may also resultwhere the variability in environmental conditions differs fromsite to site. For example, the coefficient of variationassociated with 100-year return period wind speeds for Gulf ofMexico hurricanes and North Sea winter storms areapproximately 13% and 5% respectively, and wind loads varyas the square of the wind speed. Consequently, mooringsystems designed to the same post-applied (LRFD) safetyfactors in the Gulf of Mexico and the North Sea will beassociated with different notional reliability or safety levels,this is true even for systems which display identical, linear ornonlinear, response characteristics.

It may be possible to achieve more consistent designs, interms of safety levels, by the use of more complicated safetyfactor formats. One possibility is to use a post-applied safetyfactor format, eqn. (3), with the values of the partial safetyfactors defined as functions of vessel/positioning system typeand environment. Alternatively, a pre-applied partial safetyfactor format, eqn. (2), could be developed, where the valuesof the partial factors are related to the uncertainty (coefficientof variation) in the basic variables. For example, thecharacteristic design value of environmental variables couldbe defined as the value associated with the mean plus n-standard deviations, instead of the most probable (modal)value that is currently used.

At present the industry has no experience with mooringcodes that use pre-applied safety factor formats, and suchdesign codes would represent a major departure from thedesign methods that have evolved with the offshore industry.Additionally, it has yet to be demonstrated that a reasonably

simple and practical pre-applied safety factor format that willreduce the variability in safety levels across the range of typesof positioning systems and environments can be devised.

Limit State DesignLimit states define the limiting conditions beyond which

the structural system or component is no longer deemed tosatisfy the design requirements, consequently, there is acorrespondence between limit states and traditional designcriteria. By calibrating individual limit states, the limit statedesign method may be used to achieve more consistentposition mooring designs than is presently possible by the useof the traditional (un-calibrated) design methods specified bytodays codes.

In some cases it is not practical, or possible, to expressdesign criteria in terms of a limit state function that allowsnumerical evaluation. For example, protection againstcorrosion and wear of mooring line components is normallyprovided for by increasing the component diameter, jacketingthe line, using blocking compounds, providing galvanicprotection etc. and specifying inspection and maintenanceprograms. Not all operational limit states depend upon theposition mooring system, for example processing operationsmay be limited by wave frequency vessel motions andaccelerations which in many cases are unaffected by themooring system.

In general, position mooring systems are redundant series-systems, in which system responses, including line-loads, arenonlinearly dependent on the environmental (wind, wave, andcurrent) actions. Redundancy is provided for in the number ofmooring lines (load paths), and recognized in mooring codesby specifying intact and broken line factors of safety. Singleanchor leg moorings (SALMs), and some portions of the loadpaths in single point moorings (SPMs) and catenary anchor legmoorings (CALMs) may not provide redundancy. Thesesystems may be susceptible to single point failure and detailsof their design require special consideration. For example, inthe design of SALMs API RP 2SK recommends that the levelof structural redundancy be recognized in selecting anappropriate safety factor.

Mooring codes, [10, 11], recognize redundancy in positionmooring systems by specifying design requirements and safetyfactors for intact, damaged, and transient cases. However,these codes do not allow for differences in nonlinear systemresponse characteristics, which depend upon the type ofvessel, type of mooring system, and water depth. Or fordifferences in mooring line (series-system) strength, whichdepends on the type of mooring component (chain, wire, orsynthetic rope) and the length of the line segment. Nor dothese codes allow for differences in the variability of theenvironmental actions, which depend upon geographic regionand season. In addition, position mooring systems may beentirely passive systems, or they may depend on activeintervention. Active station keeping systems make use ofthruster assistance or adjustment of mooring line lengths toreduce critical system responses. While some turret designsrequire power generation and functioning hydraulic equipment

4 KEN HUANG AND YONG BAI OTC 13269

to release brakes that hold the turret in its normally lockedcondition.

Thrusters may be used to assist the mooring system bycontrolling the vessels heading, reducing the meanenvironmental forces, damping low frequency motions, or acombination of these functions. In high current environmentsadjustment of mooring lines may be used to position the vesselup current. Mooring lines may be adjusted in preparation forstorm conditions. If the position mooring system dependsupon the use of thrusters or line length adjustments to satisfythe design requirements, then the capability of the thrustersystem or the ability to perform winching operations, in theassociated environmental conditions, must be assessed. Inevaluating the capability of active systems, it is necessary toconsider the equipment that support and control the thrustersor winches, their modes of failure, repair times, and thetraining and experience of the personnel operating thesystems. Even for the most advanced mechanical andelectrical systems there is a risk, albeit small, of a total loss ofall electrical power (blackout). Consequently, whereverpossible active systems should be designed to fail-safe andthe consequences of a power blackout should be known for allhigh-risk operations.

For passive mooring systems, structural reliability methodsuse models furnished by physics and probability theory tocalculate the notional probability that a limit state will beexceeded. Evaluation of notional probabilities of failure foractive position mooring limit states requires the evaluation ofthe probability, availability, that the active systems(mechanical and electrical, distribution, monitoring, control,operators, etc.) perform on demand in the relevantenvironmental conditions, in addition to the evaluation of themooring systems passive structural reliability. That is, theevaluation of notional safety levels for active position mooringsystems requires both availability and reliability analyses ofthe active and passive systems on which station keepingdepends.

If limit state design methods are to be used to arrive atoptimum designs for position mooring systems, throughreliability based calibration, then the calibration of the limitstates must allow for differences that exist in: System redundancy, which depends on type of mooring system System response characteristics, which depend on the type of vessel, type of mooring system and components, and water depth Mooring line segment strength, which depends on mooring component material and construction and length of the line segment Environmental variability, which depends on the geographic region and season Passive or active system reliability, which depends on structural reliability, mechanical and electrical system availability, operator training, and human factors

Reliability Analysis of Position-Mooring SystemsGuidance and suggestions are discussed next to assist in theapplication of reliability methods to the design of positionmooring systems.

Methods of probabilistic structural analysis, reliabilityanalysis, provide a rational means of dealing with theuncertainty and unpredictability in the basic variables onwhich the design of mooring systems depend, by means of theapplication of probability theory, statistics, and deterministicstructural theory. Reliability analysis methods are concernedwith quantifying the measured chance that a structure willsupport the loads to which it is subjected, [1]. In particular,reliability methods provide approximate means for evaluatingthe notional probability of failure of limit states under definedactions (loads). In principle, the notional probability that thestructure as whole will satisfy the design requirements over itsdesign life may be synthesized from individual limit statenotional probabilities of failure.

Some examples of position mooring systems andenvironmental distributions are illustrated on Figure 1 and ageneral discussion encompassing other vessel types andstation keeping systems is contained in API RP 2SK, [10].The vessel and mooring system are subject to wind, wave, andcurrent actions and mooring system responses are complex,coupled, and nonlinear. Mean, low, and wave frequencyvessel offsets, motions, and line tensions are system responsesthat are nonlinearly dependent on the environmental actionsand interactions (coupling) among the vessel, mooring systemand environments. The degree and type of systemnonlinearity is a function of vessel type, mooring system typeand water depth, and the wind, wave, and current intensitiesand directions. These system responses enter into the limitstate functions that define acceptable performance of theposition mooring system, thus, the design of position mooringsystems is concerned with the global analysis of nonlinearsystems. Additionally, the variability in environmentalactions depends upon the geographic region and season, whichdetermine the type of storm that the system is exposed to.

Absolute values of component or system probabilities offailure can only be calculated if the deterministic mooringanalysis method, and the data and statistical models used torepresent the vessel, mooring system, and the environment arecompletely known and the reliability analysis method isperfect. However, reliability methods provide a powerful toolfor comparing the safety implications of different designs.Target safety levels for new designs, may be established byperforming reliability calculations for old designs that have ahistory of satisfactory performance, in this way absolutevalues of failure probabilities are not required. For thesereasons, probabilities of failure calculated using reliabilitymethods are referred to as notional probabilities of failure, andtarget notional failure probabilities for limit states of newdesigns are established by calibrating to old designs for whichsatisfactory past experience exists.

The results of reliability computati

OTC 2001

Documents

Transcript of OTC 2001