ARTICLE IN PRESS

Marine Structures 17 (2004) 551–573

www.elsevier.com/locate/marstruc

Risk assessment of loss of structural integrity of a

floating production platform due to gross errors
Inge Lotsberga,, Odd Olufsena, Gunnar Sollanda,
Jan Inge Dalaneb, Sverre Haverb
a
Det Norske Veritas AS, Veritasveien 1, N-1322 Hovik, Norway
b
Statoil
Received 15 August 2003; received in revised form 10 March 2005; accepted 16 March 2005

Abstract

During the last years The Norwegian Petroleum Directorate, as well as Statoil, has put
increased focus on how gross errors related to structural integrity are influencing the safety of
offshore installations. Also, the loss of the P36, a floating platform outside Brazil in 2001,
emphasised the importance to control gross errors in large projects. On this basis, a work to
assess the risk of loss of the structural integrity of the Kristin platform, during operation, due
to failure from gross errors was initiated.
The Kristin platform is a permanently moored ring-pontoon semi-submersible production
unit planned to be placed in the south-west part of Haltenbanken area in the North Sea in
2005. The water depth at the site is approximately 315 m.
The objective of this work was to quantify the risk contribution from gross errors related to
structural integrity and to pinpoint the most critical items that may govern the probability of
gross error for the Kristin platform. Some of the main findings from this work are presented in
this paper.
r 2005 Elsevier Ltd. All rights reserved.

Corresponding author. Tel.: +47 67 57 73 58; fax: +47 67 57 74 74.

E-mail address: [email protected] (I. Lotsberg).

0951-8339/$ - see front matter r 2005 Elsevier Ltd. All rights reserved.
doi:10.1016/j.marstruc.2005.03.002
 ARTICLE IN PRESS
552 I. Lotsberg et al. / Marine Structures 17 (2004) 551–573

1. Introduction

1.1. General

The objective of this work is to perform a risk assessment considering the potential
risk from failures of the structural integrity of the Kristin platform during operation
caused by gross errors during design, fabrication, installation and operation of the
platform. This risk assessment is performed with respect to possible loss of human
lives and loss of assets. The objective is also to pinpoint the most critical items that
may govern the probability of gross error for the Kristin platform. This information
may be used to reduce the probability of gross errors if appropriate remedial actions
are introduced at an early stage.
Gross errors are understood to be human mistakes during design, fabrication,
installation and operation of the platform.
By structural integrity is meant the main structure such as the hull and deck,
buoyancy elements and anchoring system.

1.2. Description of the Kristin platform

The Kristin platform is a permanently moored ring-pontoon semi-submersible

production unit planned to be placed in the south-west part of Haltenbanken area in
the North Sea. The water depth at the site is approximately 315 m. Four columns
support the topside structure, see Fig. 1. The deck structure is integrated. The living
quarters are planned to host 104 persons and is built as a separate module and

Fig. 1. Schematic view of the Kristin platform.

 ARTICLE IN PRESS
I. Lotsberg et al. / Marine Structures 17 (2004) 551–573 553

supported on the west end of the deck structure. The platform draught is 21.0 m, and
the platform is planned to be operated permanently at this draught. The platform is
kept in position by 4 anchoring lines at each column. Twenty-four risers are hung at
the deck level. The risers are supported horizontally at the pontoon below as shown
in Fig. 1.
A daily production capacity of 126,000 barrels of condensate and 18 million cubic
metres of rich gas is planned. The platform is planned to operate from 2005.

1.3. Design criteria for the Kristin platform

The design basis for the Kristin platform is based on the regulations given by the
Norwegian Petroleum Directorate (NPD) [1] for design of offshore installations. The
structural design of the platform is based on Norsok documents N-001 [2] for
general design considerations including requirements to verification and quality
assurance, N-003 [3] for analysis of action effects and N-004 [4] for design of the hull
and deck structure. NPD refers to requirements from the Norwegian Maritime
Directorate (NMD) with respect to hydrostatic stability and floatability and for the
capacity of the anchoring system.

2. General considerations on risk of failure from gross errors

2.1. Different sources of risk of failure

When considering risk of failure of structures it is found practical to group the

risks as follows:

Risk for failure of the structure resulting from statistical variations in loads and
structural load bearing capacities.

Risk for failure due to accidents.

Risk for failure due to a gross error during design, fabrication, installation and
operation of the structure.

The first one is controlled by appropriate design standards with specified load and
resistance coefficients. A low probability of failure is aimed for when design
standards are developed. For welded offshore structures a target failure probability
less than 104–105 is aimed for when load and material coefficients are calibrated
for design codes for welded structures [5]. Thus, normally this probability of failure
becomes small compared with the other risks for structural failure.
The risk for failure due to accidents is accounted for by appropriate risk
assessment studies denoted: Quantified Risk Analysis (QRA). If the risk from an
accidental event is high (typically higher than 104 on an annual basis), the event will
be designed for.
The risk for failure due to a gross error is the most difficult to handle as this risk
cannot be removed by additional safety coefficients. Normally, a detailed plan for
 ARTICLE IN PRESS
554 I. Lotsberg et al. / Marine Structures 17 (2004) 551–573

verification and quality assurance of important items in the design, fabrication and
installation process is required in order to keep the probability of gross errors in a
project at an acceptable level. However, it is difficult to assess the risk for gross error
due to its nature.
Gross errors are understood to be

lack of human understanding of the methodology used for design,

negligence of information,

mistakes such as calculation errors (this can be input errors to the analysis
programs used and also errors in computer software that are used for design),

lack of self-check and verification,

lack of follow-up of material data testing, welding procedures, inspection during
fabrication, etc.,

mistakes resulting from lack of communication or misunderstanding in commu-
nication,

lack of training of personnel onboard the platform that may lead to maloperation
of ballasting systems,

errors in systems used for operation of the platform.

Thus, gross errors are understood to be human mistakes. Different people are
involved in each project and it becomes very difficult to predict the probability of a
gross error in a project. However, from the past history, gross errors have been a
significant contributor to the failure of structures, and a focus on these issues is
considered to be important in order to ensure project success.

2.2. Contribution from gross errors to the total risk of failure

Matousek and Schneider [6] performed an investigation of 800 cases with damages
on onshore structures. In his work he found that the structural systems, temporary
structures, excavations and site installations cover the majority of the cases. Further,
Matousek shows that the following errors underlying the failures could have been
detected in time:

32% by a careful review of the documents by the next person in the process,

55% by additional checks, if one had adopted the right strategies.

In the first case the importance of good cooperation between all those involved in
the construction phase is recognised, and in the second the need for well-planned
quality assurance procedures. Finally, Matousek concluded that 13% of all errors
could not possibly have been detected in advance.
It should also be kept in mind that many errors are difficult to detect by self-
checks. Therefore many errors can only be discovered through independent review
by another person or through an independent analysis.
Discipline checking and verification are important for removal of human errors, but
it should be kept in mind that they reduce the risk only to a limited degree. Therefore
 ARTICLE IN PRESS
I. Lotsberg et al. / Marine Structures 17 (2004) 551–573 555

possible use of other barriers should also be considered where the consequence of a
human error is significant and where such an additional barrier is feasible.
Reliability analyses are used for calibration of load and resistance factors to be
used for design codes. As pointed out by Kvitrud et al. [7], reliability analysis
underestimates the risk for accidents of offshore structures, as gross errors are not
accounted for in the analysis. The experience from four of the largest accidents in
Norway shows that human error is the main contributor to the risk.
Schneider [8] estimated based on the data from Matousek that the risk modelled in
reliability analysis contributes to 10–25% of the total risk. It is likely based on these
results to assume that a large part of the discrepancies between the experienced frequency
and the calculated risk can be explained by human errors also for offshore structures.
Most accidents may appear to have arisen from a unique set of circumstances,
which are unlikely to ever be duplicated.
Also, it is often more that one error that leads to failure. Each error may be linked
to details [9]. Example: The loss of the Sleipner A concrete platform is an example of
this, where a human error in the performance of the numerical analysis was added to
that of construction with insufficient anchoring length of reinforcement bars [10].

2.3. Requirements in design rules to minimise the risk and consequence of gross errors

There are two disasters in addition to the loss of P36 that have been important to
the industry with respect to development of appropriate rule requirements. These are
the ‘‘Alexander Kielland’’ disaster in 1980 [11] and the loss of the platform ‘‘Ocean
Ranger’’ in 1984 [12]. The ‘‘Alexander Kielland’’-disaster in 1980 was caused by a
structural rupture (initiated by fatigue crack) of one of the five main supporting
columns which consequently lead to the capsizing of the unit. Following this
disaster, NMD introduced new rules that included the requirement that a unit
should remain stable and afloat even after a loss of buoyancy volume corresponding
to one column. The consequence was that the volumes above the main deck had to
be of a certain size and be watertight, separated from the columns. Later on, in 1991,
this requirement was replaced by a requirement to a certain level of the righting arm
to be obtained from watertight volumes above the main deck [13]. This requirement
is still in excess of the international requirements in the IMO MODU Code.
After the Alexander Kielland accident in 1980, the industry made a detailed review
of their rules for mobile offshore units and stricter requirements were introduced
with respect to consequence of fatigue cracks and accidental loads.
The main event leading to the disaster with ‘‘Ocean Ranger’’ was that water
entered into the ballast control room located in one of the centre columns through a
porthole that was damaged by the waves. As a consequence, the ballast control
console was set out of function and the crew did not understand how to operate the
ballast system manually and that ballast water could be transferred from one tank to
another by gravity. The fact that the chain locker pipes were open has also been
addressed as a reason for the loss of the platform. According to the NPD a failure of
a single component should not lead to unacceptable consequences. In some way it is
realised that it is difficult to build safety into structures by verification and quality
 ARTICLE IN PRESS
556 I. Lotsberg et al. / Marine Structures 17 (2004) 551–573

assurance only. In addition, robustness is required. By robustness in design is

understood more than redundancy (degree of indeterminacy and reserve strength). A
failsafe design is one aspect of this approach.
Robustness sounds as a nice risk reducing measure to most designers. However, it
should be kept in mind that there are examples where it is difficult to fully utilise.
One should also be reluctant to rely on robustness, which might be a false barrier e.g.
systematic error in construction of tightening rings around penetrating tubes. There
are other examples from the engineering history where safety barriers have been built
into the system. However, human errors have removed the independence in these
barriers due to negligence. An example of this is the accident in Øresund tunnel
during excavation. The tunnelling machine was equipped with several watertight
barriers. However, a cable went through the openings and the barriers could not be
closed when the water came flooding. Lives were not lost, but this accident implied a
severe postponement of the tunnel opening.
This accident has its parallel to mobile platforms where manholes or doors, that
should be closed, are standing open such as on the P36 platform in Brazil in 2001
[14,15].

2.4. Reduction of risk of gross errors in projects

In cases where the consequence of a failure is large, means of risk reducing

measures other than verification and quality assurance are employed. These can be
model testing, component testing and functional testing to arrive at reliable systems.
Also, even with use of independent systems, humans may introduce dependency
between them. Reference is made to a report on human-induced dependency
published by HSE [16]: Two independent systems fail due to a common human error.
An example might be an incorrect maintenance of ballast water pumps where the
same error is introduced in more than one pump.
The design documents for the Kristin platform put forward requirements to the
project organisation and the technical skill of the people involved in the design.
Qualified people in all positions in a complex project are required to achieve a
successful project [17]. This also put a significant requirement to a good project
organisation. It is important that this organisation is well aware of the pitfalls that
may result from gross error.

3. Methodology for the risk assessment

3.1. Approach

The risk assessment of the Kristin platform with respect to gross errors has been
performed along two different paths as indicated in Fig. 2:

(1) Statistics: Evaluate the database for relevant structural failures in relation
to the Kristin platform from the World Offshore Accidents Databank
 ARTICLE IN PRESS
I. Lotsberg et al. / Marine Structures 17 (2004) 551–573 557

Statistics Scenarios

Search the Review historic accidents,

WOAD review of the Kristin platform,
Database assess failure scenarios

Establish risk influencing

parameters for Kristin
Establish
probability of
Grade the parameters relative to
failure of
world-wide operating MODUs(1)
MODUs(1)

Calculate a weighted grade for Kristin

Establish a modified probability of failure for Kristin

(1) MODUs: Mobile Offshore Drilling Units

Fig. 2. Approach for assessing probability of failure due to gross errors.

(WOAD, [18]). Establish probability of failure of Mobile Offshore Units

(MODUs).
(2) Scenarios: Review the data base with respect to historic accidents. Perform an
engineering assessment of possible gross errors that might lead to loss of the
Kristin platform. Assess risk influencing parameters (RIPs) that contributes to
these errors. Perform a grading of these RIPs relative to those considered to be
representative for worldwide operating MODUs.

Then, at the end of the two paths a modified probability of failure for the Kristin
platform due to gross errors is made based on the statistics of MODUs that are
scaled in a relative sense to correspond with the actual design of the Kristin platform.
For assessment it has been found convenient to link the failures of structural
integrity due to human mistakes into the following groups:

Failures related to stability and floatability.

Failures related to the hull and deck structure.

Failures related to the anchoring system.

From the database a probability of failure has been established for each of these
groups.
It is recognised that the derived probabilities of failure correspond to a worldwide
database. It is also recognised that the requirements to design and operation of
floating platforms are stricter in Norway than that of average worldwide requirements.
In order to assess this difference a number of RIPs have been established. These
parameters are considered to describe the risk of a gross error for the Kristin platform
 ARTICLE IN PRESS
558 I. Lotsberg et al. / Marine Structures 17 (2004) 551–573

relative to the worldwide accident database for Mobile Offshore Drilling Units
(MODUs). A team of experts from the designer GVA Consultants in Gothenburg
(GVAC) and Aker Kværner Engineering (AKE), the operator (Statoil) and Det
Norske Veritas (DNV) discussed the grading of each of these parameters in a one-day
meeting. A grading system going from 1 as lowest to 5 as highest was defined as
follows. The grading was given in a relative sense in that a grade of 3 corresponds to
that of the mean of the worldwide MODUs. A grade equal to 5 is the highest grade
and corresponds to the best of fixed structures in the Norwegian part of the North Sea.
Having obtained the probability of failure from the worldwide database and assuming
that the best grade of 5 corresponds to that of fixed structures, an interpolation of
the grade was made to assess the probability of failure for the Kristin platform.

3.2. Calculation of probability of failure

The weighted combined grade is calculated as

Pn
i¼1 wi G i
G¼ P n (1)
i¼1 wi

where Gi is the grade for RIP i and wi the weight of RIP i

It is assumed that the failure probability from the worldwide accident database for
mobile platforms is derived as PfWW : Then the resulting failure probability for
Kristin is derived by linear interpolation of the exponent in the failure probability
(Grade 5 corresponds to Pf ¼ 105 and Grade 3 corresponds to PfWW by definition):
PGK ¼ 10ððG3Þðð5þlog PfWW Þ=2Þlog PfWW Þ (2)
The risk values thus calculated are based upon the history of MODUs and our
understanding of how the Kristin Development Project is accomplished and how the
platform will be operated.
Grade 5 is the highest possible grade that can be achieved during an assessment of
RIPs. A Grade 5 for all RIPs should thus result in a platform that is close to that of
‘‘perfect’’ in terms of probability of gross errors. For the best of a fixed platform a
value of 105 has been proposed (due to favourable statistics for in service life of
these platforms). Hence this value is selected to correspond to Grade 5.
The same order of magnitude for probability of failure might be considered as an
asymptotic value also for other types of platform when all relevant efforts are made
to reduce the risk for gross errors.

4. Failure frequency due to gross errors based on statistics

4.1. General

Information from reported accidents are used in this study as follows:

to compare accident statistics for fixed and floating (mobile) units,

to compare accident statistics for North Sea and worldwide operations,
 ARTICLE IN PRESS
I. Lotsberg et al. / Marine Structures 17 (2004) 551–573 559

to determine frequency for different type of accidents,

to assess failure frequency for mobile offshore units in world wide operations and

to propose RIPs from studies of accidents.

4.2. The WOAD database

The World Offshore Accidents Databank (WOAD) is used as basis for the
study of historical accidents. WOAD is maintained by DNV. Events described
in public reports, papers and magazines all around the world are included
in WOAD. An agreement with NPD was made in 1990 that all accident-related
correspondence between NPD and the operators, should be sent to DNV as well,
to ensure that all relevant accidents on the Norwegian Continental Shelf are
included in WOAD. Today WOAD includes details of some 4000 offshore events
of different types. The accidents in the database are categorised and the distri-
bution on the different categories of accidents recorded from 1980 to 1997 is shown
in Fig. 3.
As the information in WOAD is found from public sources it is reasonable to
assume that the data are biased due to under reporting. This is believed to be
especially true with respect to events happening outside the North Sea region, but
also accidents in the North Sea are found to be more frequent than recorded in
WOAD when WOAD data are compared for UK waters with Health and Safety
Executive databank Orion [23]. However, it is believed that the most serious
accidents resulting in loss of structure or loss of lives are included. The sum of the
two most severe damage grades: ‘‘severe damage’’ and ‘‘total loss’’ are shown relative
to the total number of events in Fig. 4. The percentage for serious accidents to the
total are much larger for worldwide operations than for the North Sea indicating
that less serious accidents are under reported for units world wide. Hence only
serious accidents are used as basis for establishing frequencies in this study.
(Serious is defined as: severe damage+total loss). Fig. 4 also shows that the ratio of
serious damage to the total number of accidents is larger for mobile units than for
units in general.

4.3. Accidents related to the integrity of structures

From the WOAD database the accidents that may be related to the floatability
and stability of the structure, the load-bearing structure and the mooring system are
extracted. Other accidents in the literature that might be of relevance for this study
are also included. Totally, 831 accidents have been evaluated where the platform
stability or floatability, the load-bearing structure, or the mooring system have been
involved. The accidents are grouped according to the type of accident in order to
simplify the analysis of the statistics. The different groups of accidents are shown in
Table 1.
The distribution of the accidents on the different groups is shown in Fig. 5 for all
accidents and the distribution on the most serious accidents is shown in Fig. 6.
 ARTICLE IN PRESS
560 I. Lotsberg et al. / Marine Structures 17 (2004) 551–573

900

800

700

600

500

400

300

200

100

0
re

ap t
C ze

ac ct

pl t
llin ion

ad

re

un g
r a ng

ak t
e

re

ill/ ion

W cc e
ro nt
em

er
ou

Ex den

Le iden

s
io

rin

ag

as

a g
ne nta

Li

el ide
ilu

Fi

ilu

th
si

lo

di

a
lis

Fa os

Sp osit
ow

bl
le
de

am

O
fa

fa
ci
o

cc
g
ol

re
Bl

un
C

p
or

ro

ry

To l d

lp
ff
ne
ch

Fo

g
a
O
te

in
ur
An

hi
ra

op

w
ct
ac
C

ic

ru
M
el

St
H

Fig. 3. Different types of accidents for worldwide operations for the years 1980–1997.

20.0%
Severe damage
18.0%
Total loss
16.0%

14.0%

12.0%
10.0%

8.0%

6.0%

4.0%
2.0%

0.0%
All units All units North Mobile units Mobile units
worldwide 80-97 sea 80-97 worldwide 80-97 North sea 80-97

Fig. 4. Accidents classified as severe damage and total loss for units worldwide and in the North Sea for
the years 1980–1997.

The accidents that are found by the search in the database are to a large degree
related to temporary phases like fabrication, installation and transportation. These
three groups add to 42% of all accidents and 47% for the most serious accidents
(categories severe damage and total loss).
 ARTICLE IN PRESS
I. Lotsberg et al. / Marine Structures 17 (2004) 551–573 561

Table 1
Group of accidents

Group Description Comment

Stability Accidents where the main cause is loss of

floatability
Structural Accidents where the main cause is structural
failure leading to loss of load-bearing function
Anchoring Accidents where the main cause is failure in the
mooring system
Accidental loads Accidents where the main cause is related to
accidents like fire, explosions, collisions,
dropped objects, earthquakes, etc.
Weather Accidents where it is most likely that the Accidents for jack-ups caused
environmental loads are larger than design by weather is grouped under
loads Jack-up
Installation Accidents occurred during installation, Do also include accidents
mobilisation or demobilisation related to Jack-ups
Transportation Accidents occurred during tow or other form of
transportation
Non-structural Accidents involving structure but where the
elements failure is not affecting the structural load-
carrying capacity
Jack-up Accidents occurring to the structure for jack-up Accidents during tow are put
rigs other than temporary phases like under transportation.
transportation, jacking, etc. Accidents during jacking, etc.
are put under installation
Fabrication Accidents occurring at yard or in dock
Miscellaneous Other accidents found in the search but where
structure is not involved

The group denoted ‘‘Weather’’ comprises accidents where it is most likely that the
structure is loaded beyond the design values. These are cases where failure would be
expected. Typically, this yields satellite wells in the Gulf of Mexico that is damaged
during hurricanes. Older jacket-type platforms are also included as the design was
based on evacuation in case of hurricanes and it is evident that hurricanes like
Andrew in 1992 led to wind and waves that are giving forces that are much above the
capacities of these platforms. However, all cases of failure in the mooring system are
grouped under ‘‘Anchoring’’.
A large number of accidents are related to Jack-up platforms. A majority of the
accidents are related to foundation failure for these types of platforms. For this
reason, Jack-up platforms are given a separate group.
The group ‘‘accidental loads’’ covers accidents that are not related to failure in the
platform structure or its moorings, but for one or another reason has been selected in
the search in the WOAD database. Similarly, the group ‘‘non-structural elements’’
comprises failure that is selected by the search that is not related to the platforms
main structure, e.g. pipelines, antennas, burner booms, drilling rigs etc. The group
 ARTICLE IN PRESS
562 I. Lotsberg et al. / Marine Structures 17 (2004) 551–573

Weather Accidental loads

5% 11 %

Transportation Anchoring
11 %
26 %

Fabrication
5%

Structural
Installation
4%
11 %

Stability
2% Jack-up
14 %
Non-structural
elements
9% Miscellaneous
2%

Fig. 5. All accidents found from WOAD divided into groups based on type of accident.

Accidental loads
15 %
Weather
6%
Anchoring
1%

Transportation Fabrication
30 % 4%

Installation
13 %
Structural
2%

Stability Jack-up
4% 19 %

Miscellaneous
Non-structural 1%
elements
5%

Fig. 6. Accidents resulting in severe damage or total loss from WOAD grouped based on different types of
accidents.
 ARTICLE IN PRESS
I. Lotsberg et al. / Marine Structures 17 (2004) 551–573 563

‘‘Miscellaneous’’ covers cases that are not found to fit in the other groups, e.g.
artificial island.
The accidents related to structural integrity for the operational phase are found in
the three groups: ‘‘Stability’’, ‘‘Structure’’, and ‘‘Anchoring’’. For all accidents found
in the search these groups account for 2%, 4% and 11%, respectively, giving a total
of 17% of the accidents. For the most serious accidents these groups account for 4%,
2% and 1%, respectively, with a total of 7%. It is notable that failures in the
mooring system are quite frequent, but is seldom leading to massive losses. It is
reason to believe that the accidents in the operating phase for platforms are less than
in temporary phases due to the following factors:

The structure is pre-loaded through several temporary conditions that will reveal
weakness before the structure is used for operation.

The focus on safety in temporary phases is less than for the permanent condition.

A higher risk is normally accepted for temporary phases than for the installed
structure.

4.4. Relevant accidents from the database for risk assessment of Kristin

4.4.1. General
The most serious accidents for the three groups related to structural integrity are
summarised in the following tables for each group separately.

4.4.2. Failure group ‘‘Stability’’

Twelve recordings are grouped under the label ‘‘Stability’’. Seven of these
recordings represent total loss with four involving loss of lives. (For P 36 the loss of
lives was due to explosion and not due to the sinking.) Of the five accidents
categorised as ‘‘Severe damage’’ one involves loss of lives.
Accidents found to be relevant for assessing failure frequency from gross errors
related to floatability or loss of stability are listed in Table 2.

4.4.3. Failure group ‘‘Structural’’

Accidents found to be relevant for assessing failure frequency from gross error
related to structural failure are listed in Table 3.
The cause for severe damage or total loss is dominated by waves hitting the deck.
The loads imposed on the deck structure are obviously larger than accounted for in
the design. However, no lives are lost in these accidents and no total loss is
registered.
There is one total loss related to structural failure. This is the Alexander Kielland
accident where 123 persons lost their lives.

4.4.4. Failure group ‘‘Anchoring failure’’

One recording is found to give total loss of platform due to failure in the anchor
lines: Neptun 6 from 1973. No loss of lives is registered to be due to anchor failure.
 ARTICLE IN PRESS
564 I. Lotsberg et al. / Marine Structures 17 (2004) 551–573

Table 2
Relevant accidents from gross error related to floatability or loss of stability

Type unit Name Type of failure Damage Fatalities Date

Drill Barge Loffland-V-104 Stability Total loss 0 750000

Drill Bargea Sea Crab Capsizing Severe damage 0 751124
Drill Bargea D.B. No.1 Oil City Capsizing Severe damage 0 760323
Drill Barge C-225 Capsizing Total loss 0 781015
Drill Bargea C-336 Stability Severe damage 0 790000
Drill Barge Loffland V 106 Stability Total loss 4 800000
Semi-submersible Ocean Ranger Capsizing Total loss 84 820215
Drillship Glomar Java Sea Capsizing Total loss 81 831025
Drill bargea Reina del Lago Capsizing Severe damage 0 890710
Drill ship Seacrest Capsizing Severe damage 91 891103
Drill barge C-201 Stability Total loss 0 920411
Semi Submersible Petrobras P-36 Capsizing Total loss 11 20010315
a
Not included for derivation of failure probability for the Kristin Platform.

Table 3
Relevant accidents from gross errors related to structural failure

Type unit Name Type of failure Damage Fatalities Date

Drill barge Raydrill No 1 Dented plating Severe Damage 0 731216

Drill ship Glomar Grand Isle Wave in deck Severe Damage 0 731220
Semi- Transworld D Rig 61 Wave in deck Severe Damage 0 731299
submersible
Semi- Transworld D Rig 58 Wave in deck Severe Damage 0 740000
submersible
Semi- Alexander Kielland Fatigue failure Total loss 123 800327
submersible
Jacket South Timbalier 188/ Deck blown off Severe Damage 0 920827
CA during Hurricane
Andrew due to faulty
connections

Accidents found to be relevant for assessing failure frequency from gross error
related to anchor failure are listed in Table 4.

4.5. Assessment of failure frequencies for mobile offshore drilling units

The number of mobile offshore platforms that are operating is given in WOAD.
From 1970 and up to 2000, about 14 500 platform years are experienced for Mobile
Offshore Platforms (MODUs). For comparison, the number of platform years for
fixed platforms are about 110 000 excluding Asia and Africa.
 ARTICLE IN PRESS
I. Lotsberg et al. / Marine Structures 17 (2004) 551–573 565

Table 4
Relevant accidents from gross error related to anchor failure

Type unit Name Type of failure Damage Fatalities Date

Drill barge Neptun 6 Anchor failure Total loss 0 731107

Drill ship Regional Endavour Anchor failure Severe Damage 0 800000
Semi-submersible Ocean Traveller Anchor failure Severe damage 0 830120
Semi-submersible Zane Barnes Anchor failure Severe damage 0 920827

In order to assess the failure frequency for MODUs in the operating phase it will
not be relevant to consider accidents in the temporary phases. Accidents that are
related to non-structural items or types of structures other than MODUs should also
be disregarded.
For this assessment it is decided to treat jack-ups differently from other types of
MODUs due to the many registered accidents related to the jack-ups foundation
which is unique to jack-ups and that is of less value when studying a semi-
submersible platform like Kristin. The group of failures related to jack-ups is
therefore also disregarded. The number of platform years for jack-ups in the actual
period is 8500 making the remaining MODUs to have experienced about 6000
platform years.
The relevant number of accidents in the period for failure group ‘‘Structural’’ was
6. But only one of these gave total loss. One is a fixed platform, which is disregarded
since we are only considering floating units. The present design requirements for
platforms like Alexander Kielland are stricter after the accident with Alexander
Kielland as explained in Section 2.3. It is therefore necessary to reduce the failure
frequency that may be calculated due to statistical numbers when we are assessing
the failure frequency due to structural failure for the MODUs of today. It is
therefore assessed that the failure frequency for the operating phase for MODUs of
today are less than 104 for world wide operation.
For accidents grouped under ‘‘Stability’’ there are 7 total losses and also one
severe damage with a large number of fatalities. The total number is 12. It is believed
that some of the older derrick barges are operated outside requirements for stability
of today. Therefore, it seems reasonable to reduce the number to 8 (7 total loss+1
severe damage) to obtain a number that is based on experienced accidents but are
representative for the practise of today. This makes the failure frequency for loss of
platform due to stability equal to 13104.
Four accidents in the database implied altogether 260 fatalities or 65 fatalities in
average. (The P36 accident is not included here as this accident is categorised under
explosion.)
The failure frequency involving loss of lives due to stability is 7104. For
accidents due to failure in the mooring system there is no total loss later than 1973
and no fatalities. Thus, the failure frequency (worldwide) for total loss of the
platform in the operating phase due to anchor failure is less than 104. There is no
loss of life reported to be associated with anchoring failure.
 ARTICLE IN PRESS
566 I. Lotsberg et al. / Marine Structures 17 (2004) 551–573

5. Evaluation of risk influencing parameters for the Kristin platform

5.1. Basis for selection and weighting of risk influencing parameters

The literature has been searched for a good system to evaluate the probability of
gross errors for the Kristin platform.
Bea [24,25] correlates probability of human errors to task, stress, distraction and
impairment. Detailed information about working conditions for the designer, the
fabricator and the operator of the platform would be required to follow this concept.
A required data basis for this would hardly be available before the project is finished.
Also, a number of reports presented by HSE for assessment of risks from gross
errors have been evaluated, see Refs. [26–29].
After a consideration of different alternatives it is found that an assessment of
probability of gross errors in a project may best be assessed in a relative sense. In
order to make such assessments it is necessary to establish a list of RIPs that are
considered to govern the probability of gross errors. Then each RIP is assessed
separately for the actual project relative to that of other projects.
Based on the review of accidents in the WOAD database for mobile platforms it is
found appropriate to investigate the following structural systems in detail:

Stability and floatability,

Hull and deck structure,

Anchoring system.

RIPs are established for each of these items based on an engineering evaluation of
each parameter’s importance for the integrity of the platform.
All the listed RIPs are considered to be important for the integrity of the Kristin
platform. In general, all these parameters are given a weight equal to 1.0.
Some of the parameters are subdivided for practical reasons (such as water
tightness and control of weight and mass of gravity). These are given a weight of 0.5
in order to get a balanced contribution based on engineering judgement according to
the distribution between verification and backup systems indicated above.

5.2. Significant items for the structural integrity

5.2.1. Stability
There are three thinkable main groups of initial events that could possibly lead to
the sinking or capsizing of the unit:

(a) The event that ballast water could be distributed or entered into the unit in such
a way that the unit would capsize.
(b) The event that water would enter into the unit either from damage to a
watertight barrier or from internal leakage through pipes, etc.
(c) The event that the unit is loaded in such a way that the vertical centre of gravity
is above the allowable limit.
 ARTICLE IN PRESS
I. Lotsberg et al. / Marine Structures 17 (2004) 551–573 567

The applicable rules are generally based on the approach that one single failure or
event should not lead to the loss of the unit. The above items could be regarded as
such single failures and the corresponding hazards that have been accounted for. For
each hazard that has been covered by the rules one or more pre-requisites have to be
fulfilled in order to assure that the unit will not be lost.
A scenario with water filling of compartments is considered: The unit has been
designed to stay afloat at an acceptable position when the damage involves two
compartments in collision areas (One compartment in other areas). The pre-
requisites will be factors such as:

The watertight integrity in way of damaged compartments is maintained.

The unit had an initial vertical centre of gravity at the time the collision occurred
below the limiting values.

The weather is not too severe.

Any corrective action such as to get the unit at even keel involves additional
hazards and the pre-requisites will be factors such as

The operators have the correct picture of the flooding scenario.

The operators have a clear understanding on what measures will be the best to
achieve a safe operation.

The RIPs which could affect the above-mentioned pre-requisites can be sorted into
three main groups:

(a) Risk parameters introduced during design. The basis for the design is factors
such as the applicable rules and the designers experience and knowledge.
(b) Risk parameters introduced during construction. These are follow up and quality
control during the construction.
(c) Risk parameters introduced during operation of the unit. These are typically the
quality of the documentation onboard, the qualification of the operating
personnel and the operational routines in general.

RIPs have been established for each of these groups. It was observed from Section
2.2 that experience from a similar project, verification and quality assurance are
important parameters in design as well as construction. The watertight integrity in
way of damaged compartments is essential for the unit’s ability to stay afloat and be
stable after damage. Among the different RIPs, attention should be paid to the
arrangement of the HVAC system.
Draft reading and sounding of tanks are included as RIPs that are important
measures for the operators to get a correct picture of the flooding scenario.
Control of weights and centre of gravity is important information with respect to
stability and are included as RIPs. This also includes the ballast system and its
operation.
 ARTICLE IN PRESS
568 I. Lotsberg et al. / Marine Structures 17 (2004) 551–573

It should be noted that the reference Grade 3 corresponds to the average mobile
offshore unit being built today. The standard of today’s MODUs will necessarily
reflect the upgrading of the rules that has taken place as a consequence of the
disasters that were mentioned initially and which are included in the statistics.

5.2.2. Hull structure

The basis for the design equations for capacity of hull structures goes back more
than 20 years. The resulting structural design using Norsok N-004 for design of the
hull structures will not be significantly different from that of using the DNV rules
from 1977/1982 (Refs. [22,21,30]. This means that the capacity equations have been
used for design of a number of structures. To the knowledge of DNV no accidents
are caused by the design procedures described in the rules.
Thus, the design methodology used today is based on a positive experience with
design of mobile offshore units for a long period.
The Alexander Kielland accident implied stricter rule requirements, but not with
respect to the basis for the Ultimate strength capacity. The rules were improved with
respect to the Accidental Limit States and the Fatigue Limit States.
The probability of failure of the hull structure due to ultimate loads is not
expected to be larger than for similar design of fixed offshore platforms. The design
analysis with respect to fatigue is significantly improved compared with the analyses
performed 10–20 years ago. Nevertheless, the design criteria are not stricter than that
fatigue cracks might occur during the service life of the platform. However, a fatigue
crack in the hull plating is not considered to be critical for the structural integrity
because

A high material fracture toughness is used such that a crack can grow through the
hull plate before it becomes so large that it is critical with respect to unstable
fracture.

When the crack is through the hull plating there will be some leakage that will
likely be detected provided that a proper detection system is planned.

Proper in-service inspection programme that accounts for crack growth rates.

5.2.3. Anchoring system

Failure of more than two–three anchor lines at one corner combined with bad
weather may lead to drift of the platform and rupture of one or more of the gas
risers. This is considered as a critical event for the integrity of the platform.
The available statistics for failure in chains used in station keeping systems for
mobile offshore units show an annual probability of failure of 102 per line for chain
produced after 1984, [31]. The annual probability of failure is 4  102 for chains
produced from 1976 to 1993, and the failures have taken place on drilling units
mainly.
Sogstad [32] has performed a study to investigate the annual probability of line
failure of long-term mooring systems. Long-term mooring systems are defined as
systems designed to be used at the same location for more than 5 years. Information
was collected from different sources. The annual probability of failure was found to
 ARTICLE IN PRESS
I. Lotsberg et al. / Marine Structures 17 (2004) 551–573 569

be 1  102. By excluding systems consisting of only six-strand wire ropes and failure
in Kenter shackles and pear links the annual probability of failure was 0.7  102.
There are several reasons which should indicate that line failure in long-term
mooring systems is less frequent than for mooring systems on drilling units:

Anchor handling and winching will normally be limited on a production unit

compared with a drilling unit.

Documentation of the fatigue life of the mooring systems is required for units,
which shall stay at location for more than 5 years.

Corrosion allowance is required for chains on units, which shall stay at location
for more than 5 years.

Kenter link-type of connection elements is not accepted.

The following factors are considered to be most important to achieve a reliable

anchoring system:

A good fatigue analysis of the anchoring system [20].

Quality assurance and follow up of fabrication of the chains [19].

Corrosion addition that is not included in the calculation of capacity for ULS and
ALS but included 50% in FLS.

A proof loading of the lines might reveal information of possible weak links in an
anchor line. It is also considered to improve the fatigue capacity because of
introduction of residual stress in the chain links (without studs as well as with studs)
[33]. Therefore this item was included as a RIP.

5.3. Risk of the Kristin platform relative to worldwide database for mobile offshore
platform

5.3.1. Risk assessment of stability and floatability

The annual probability of loss of platforms due to failure of stability systems and
floatability is evaluated to 13104 based on available statistics (Section 4.5). In
total, 33 RIPs have been assessed with respect to risk assessment of stability and
floatability (Table 5). (A commentary section was made for each of the parameters.
This is not included here as it goes too much into detail for a paper like this.) The
weighted grade for all RIPs for stability and floatability is 3.73. The annual
probability of a loss of platform due to gross errors related to failure of stability
systems or floatability for the Kristin platform is 2104. This number is derived
from Eq. (2). The assessed failure probability should be considered as a nominal
value in light of the basis and methodology used for its derivation. However, this
number is considered to be a relevant measure on order of magnitude of failure
probability. (The number may be considered to be associated with a similar
uncertainty as many probabilities of failure derived from QRA where the design
basis is uncertain.)
 ARTICLE IN PRESS
570 I. Lotsberg et al. / Marine Structures 17 (2004) 551–573

The annual probability of an accident that leads to loss of lives due to gross errors
related to failure of stability systems and floatability is evaluated to 7104 based on
available statistics from MODUs operating worldwide.

Table 5
Risk influencing parameters for stability and floatability

Risk influencing parameters Weight Grade

General
Degree of well-known technology in design and fabrication 1 3
Are lessons learned from failures incorporated in design and fabrication? 1 5
Design
Designers experience 1 5
Quality assurance 1 4
Verification methods/ effort 1 4
Environmental conditions 1 3
Determination of environmental forces (wind) 1 4
Intact stability requirements 1 3
Weather tight integrity (deck) 0.5 4
Damage stability—watertight subdivision 1 4
Ballast system 0.5 4
Damage stability control 1.0 3
Draft reading and sounding equipment 1.0 4
Operation of watertight/weather tight closing appliances 1.0 3
Watertight integrity, bulkhead penetrations, valves, 0.5 4
Watertight doors and openings 0.5 4
Minimised vulnerability during inspections 0.5 4
Remote sounding provided in all compartments to get the correct picture in an 0.5 5
emergency situation
Construction
Quality assurance 1.0 4
External watertight and weather tight integrity, correct installation and testing 0.5 3
carried out
Internal watertight integrity. Bulkhead and bulkhead penetrations. Correct 0.5 3
installation and testing carried out
Emergency equipment. Correct installation and testing carried out 0.5 4

Operation
Ballast system 1.0 3
Ballast operation in severe storm 1.0 4
Correct action when damage has occurred, what to do, training in use of ballast 1.0 4
system. Emergency operation of ballast valves
Follow up of weights brought onboard 0.5 4
Lightweight survey every 5 years 0.5 3
Daily stability calculations 0.5 4
Periodical testing of watertight doors, hatches and valves. (All valves accessible 0.5 4
for inspections?)
Periodical inspection of weather tight closing appl. 0.5 3
Inspection and testing of bulkhead penetrations 0.5 3
Inspection of watertight compartments 0.5 3
Inlet blinding 0.5 4
 ARTICLE IN PRESS
I. Lotsberg et al. / Marine Structures 17 (2004) 551–573 571

Then the annual probability of an accident that leads to loss of lives due to gross
errors related to failure of stability systems or floatability for the Kristin platform is
assessed to 1104.
The assessment is based on today’s operational practise by Statoil. It should be
pointed out that operation of the platform is a key parameter with respect to
floatability. It is therefore important to maintain the focus during project and
operation on:

The water- and weather-tight integrity of the unit.

To ensure that the unit at all times is operated within the approved limits.

Planning of a proper maintenance of all systems in the platform that is required to
function during critical and unforeseen situations.

Maintaining a good education programme for key personnel on board the
platform to properly operate these systems in critical situations that might occur
at all time during a 30-year service life.

It is also these items that are considered to be the most significant RIPs if a further
reduction of the risk is considered.

5.3.2. Risk assessment of the hull structure

The annual probability of loss of platforms due to failure from gross errors related
to the hull structure is evaluated to be less than 104 based on available statistics
(Section 4.5). In total, 24 RIPs have been assessed with respect to risk assessment of
the hull structure. The weighted grade for all RIPs for the hull structure for Kristin is
3.96. This means that the annual probability of a severe consequence due to gross
errors related to the hull structure for the Kristin platform is in the order of less than
0.3104. For the hull structure there is no basis to distinguish between loss of lives
and loss of structure from worldwide statistics of MODUs.

5.3.3. Risk assessment of the anchoring system

Failures of the anchoring system have only led to loss of one platform even if the
probability of failure of a single line is found to be high. The annual probability of
loss of platforms due to failure of the anchoring system is evaluated to be less than
104 based on available statistics (Section 4.5). In total, 22 RIPs have been assessed
with respect to risk assessment of the anchoring system. The weighted grade for the
anchoring system for Kristin is 3.79. This means that the annual probability of a
severe consequence due to the anchoring system for the Kristin platform is less than
0.4104 provided that

a reliable fatigue analysis is performed,

the production of chain is followed up by appropriate quality assurance.

For the anchoring system there is no basis to distinguish between loss of lives and
loss of structure from worldwide statistics of MODUs.
 ARTICLE IN PRESS
572 I. Lotsberg et al. / Marine Structures 17 (2004) 551–573

6. Conclusions

The risk for failure due to gross errors related to structural integrity of the Kristin
platform has been established.
Gross errors are understood to be human mistakes during design, fabrication,
installation and operation of the platform. By structural integrity is meant the main
structure such as the hull and deck, buoyancy elements and anchoring system. The
assessment process was made in the following steps:

First, the risk for gross errors for Mobile Offshore Drilling Units (MODUs)
operating worldwide today was derived based on available statistics from the
World Offshore Accidents Databank (WOAD).

Then, an engineering assessment of possible gross errors that might lead to loss of
the Kristin platform was performed. Risk influencing parameters (RIPs) that are
considered to be governing for these errors were established. A grading of these
RIPs for the actual design of the Kristin platform relative to those considered to
be representative for worldwide operating MODUs was performed.

Finally, the probability of failure for the Kristin platform due to gross errors was
derived by combining the results from the statistics of MODUs with the results
from grading of RIPs for the Kristin platform relative to that of MODUs.

The annual probability of a severe consequence due to gross errors related to

structural integrity for the Kristin platform was found to be significantly less for the
capacity of the hull structure and the anchoring system than for stability and
floatability.

Acknowledgements

The authors would like to tank Eldbjørg Holmås and Odd Fagerjord in DNV for
their review of the WOAD database and their contribution to the risk assessment.
The authors are also grateful to Statoil for accepting publication of this paper.

References

[1] Regulations relating to design and outfitting of facilities in the petroleum activities. The facility
regulations. The Norwegian Petroleum Directorate, 2001.
[2] N-001 Structural design. Rev 03, August 2000.
[3] N-003 Actions and action effects. Rev. 01, February 1999.
[4] N-004 Design of steel structures. Annex M special provisions for column stabilised units. Rev. 01,
December 1998.
[5] Fjeld S. Reliability of offshore structures. J Petrol Technol 1978:1486–96.
[6] Matousek M, Schneider J. Untersuchungen zur Structur des Ziucherheitsproblems bei Bauwerken,
Institut für Baustatik und Kostruktion der ETH Zürisch, Bericht No. 59, ETH Zürisch, 1976.
[7] Kvitrud A, Ersdal G, Leonhardsen RL. On the risk of structural failure on Norwegian offshore
installations. Stavanger: ISOPE; 2001.
 ARTICLE IN PRESS
I. Lotsberg et al. / Marine Structures 17 (2004) 551–573 573

[8] Schneider J. Introduction to safety and reliability analysis. Zürich: IABSE; 1997.
[9] Ross SS. Construction disasters. Design failures, causes and prevention. New York: McGraw-Hill
Book Company; 1984.
[10] Jakobsen B. Sleipner accident and its causes. Eng Failure Anal 1994;1(3):193–9.
[11] The Alexander Kielland accident. NOU, 1981, p. 11 [in Norwegian].
[12] Royal Commission on the Ocean Ranger Marine Disaster. Report one: the loss of the
semisubmersible drill rig ocean ranger and its crew. 1984.
[13] Regulations of 20 December no. 878 concerning stability, watertight subdivision and watertight/
weathertight closing means on mobile offshore units. The Norwegian Maritime Directorate, 1991.
[14] Filho PJB. The sinking of P-36. Oslo: OMAE; 2002.
[15] Videiro PM, et al. The accident of the P-36 platform. The rupture of the emergency drainage tank.
Oslo: OMAE; 2002.
[16] Preventing the propagation of error and misplaced reliance on faulty systems: a guide to human error
dependency. HSE report, 2001.
[17] Petroski H. Predicting disasters. Am Sci 1993;81:43–8.
[18] WOAD statistical report. DNV, 1999.
[19] DNV certification note no. 2.6. Certification of offshore mooring chain, 1995.
[20] DNV-OS-E301. Position mooring, 2001.
[21] DNV classification note no. 30.1 Buckling strength analysis of mobile offshore units, 1982.
[22] DNV. Rules for the design construction and inspection of offshore structures. Appendix C. 1977.
[23] Funnemark, E. Accident statistics for mobile offshore units on the UK continental shelf 1980–1998.
HSE report, 2001.
[24] Bea RB. Quality, reliability, human and organisation factors in design of marine structures.
Copenhagen: OMAE; 1995.
[25] Bea RB. Evaluation of human and organisation factors in design of marine structures: approaches
and applications. Copenhagen: OMAE; 1995.
[26] Hazard management in structural integrity, vol. 1. Main report—OTO 98 148. HSE, 1999.
[27] Human factors assessment of safety critical tasks. Offshore technology report—OTO 092. HSE, 1999.
[28] Improved reliability of mooring chain systems. Offshore technology report—OTO 96 018. HSE, 1997.
[29] Maintenance—reducing the risks. HSE report 2001/007.
[30] Odland J. Improvements in design methodology for stiffened and unstiffened cylindrical structures.
Proceedings of the international conference on behaviour of offshore structures, Trondheim, 1988.
[31] Andreassen R, Liasjø S, Lohne P. MATSU/8449/2904 reliability of anchor chains. DNV report no.
94-04-29, 1994.
[32] Sogstad B. Line failure statistics for long term mooring systems. DNV report no. 99-3361, 1999.
[33] Shoup GJ, Tipton SM, Sorem JR. The influence of proof loading on the fatigue life. OTC paper no.
6905, 1992.