1

Oil & gas platforms

Aquaculture

Plant

Wind

turbines

Nuclear reactor

Spacecraft

Aircraft

BuildingsBridge

Design for Robustness or Damage Tolerance- an important aspect of Structural Integrity Management

Torgeir Moan, AMOS/CeSOS, NTNU, Trondheim, Norway

2

Outline➢ Introduction

- Definition of robustness and

Robustness in draft EN1990

- Historical notes on robustness

➢ Service experiences and

Causes of Structural Failures &

Risk Reduction Measures

➢ Recent R&D and Regulatory requirements

➢ Crack Control Measures

➢ High Reliability (and Robust) Organizations

➢ Development of Accidental Collapse Limit State

Criteria

- Norsok N-001; ISO 19900

➢ Comments on the draft of EN1990

➢ Wider aspects of robustness

➢ Handling uncertainties in SIM

➢ Concluding remarks

Critical

event

Ronan Point

appartment

building, 1968

Ranger I ,

GoM, 1979

3Definitions of Robustness

• EN 1990 , Sect. 5.4

• ISO19900 (2013) defines robustness by

“the ability of a structure to withstand accidental and abnormal events

without being damaged to an extent disproportionate to the original cause”,

• Other motherhood codes for structures: ISO 22111 (2007), ISO 2394 (2015),

EC1(2002) and ISO 19900 (2013):

- refer to resistance against accidental and abnormal events :

fire, explosions, impact ; or the consequences of human error

• Damage tolerance is also a crucial property for deteriorating structures to ensure a

reliable monitoring/ inspection and repair approach

• On this basis the following definition is suggested for consideration:

“the ability of a structure to limit the escalation of accident scenarios - caused by

accidental actions and abnormal strength due to fabrication or deterioration

phenomena - into accidental conditions with a magnitude disproportionate to the

original cause”

Related terms:- Damage -/fault tolerance

- Resilience

4

EN 1990 (16.11.2017)

Suggestion:

- the robustness criteria should be operationalized

- target level for the safety implied by the robustness criteria

should be defined

5Historical notes

Design against accidental actions• Ronan point apartment building, 1968

• British building codes, 1970

- Local strength to resist

34 kPa explosion pressure

- Strength to resist car impact at street level

• ECCS / model codes, 1978

- generally “suggesting “ design

for robustness

but without specifying

how it should be achieved

D

Failure of

column

Ronan Point

apartment building,

1968

Robustness req. applied to high consequence class buildings

Focus on accidental actions; buildings

made of large concrete panels

(not in-situ concrete structures)

and therefore the ties between the panels.

Security against terrorism?? • World Trade Centre

6

Ranger I, Gulf of Mexico, 1979

Also many other accidents before

1980:

Alexander L. Kielland accident, 1980

• Norwegian Petroleum Dir. (NPD)

Regulations for Risk Analysis, 1981

• NPD Regulations for Struct. Design,

1984 : Introduct. of PLS (ALS)

• Later introduced in the ISO19900 code

Historical notes on design criteria for offshore structures

Progressive (Accidental) Collapse Limit State

Ranger I

Alexander L. Kielland

C

D6

43

7 Recent R&D and regulatory assessments- FAA “Airworthiness requirements”. FAR 25b. US Federal Aviation Administration.

- Gallagher, J.P. (1985) USAF Damage Tolerant Design Handbook:

Guidelines for the Analysis and Design of Damage Tolerant Aircraft Structures”

Flight Dynamics Laboratory Air Force Wright, Wright-Patterson AFB, Ohio, USA.

- ISO 22111 (2007) “Bases for design of structures – General requirements”

Int. Standardization Organization, London.

- ISO 2394:2015, General principles on reliability for structures

- ISO 19900 (and the related offshore standards: ISO19902; ISO 19904; ISO 19906 )

- Moan, T. (2009) “ Development of accidental collapse limit state criteria for offshore

structures”. Structural Safety, 31( 2), 124-135. Fist presented in the Workshop on Risk

Acceptance and Risk Communication at Stanford University in 2007.

- CPNI (2011). Review of international research on structural robustness and

disproportionate collapse, the Centre for the Protection of National

Infrastructure (CPNI). HMSO, 2011

- Kӧhler, J., Narasimhan, H. and Faber, H. (2010) Proc. Joint Workshop of COST Actions

TU0601 and E55, Ljubljana, Slovenia 21-22 Sept. 2009, ETH, Zurich, Switzerland.

- EC1 Basis of structural design. European Standard EN1990.

- EC1-1-7 (2006) Actions on structures. Part 1-7: Accidental actions. EN1991-1-7.

- Caspeele, R. et al. WG6_T1 Final Deliverables from WG6.T1 Robustness.08.05.2017

- Andre, J. et al. Robustness in Eurocodes – Project Team WG6.T1.

Background document 05.12.2016

8

Obervations of accidents

(damages) :

➢Technical-physical point of view

- Loss of equilibrium or total

structural failure commonly

develops in a sequence of events

Identifying the root causes of

accidents:➢Human and organizational

point of view

- All decisions and actions

made – or not made during

the life cycle are the

responsibility of

individuals and organizations

Critical

event

Fault

tree

Event tree

- Fatalities

- Environmental

damage

- Property

damage

Service experiences:

- We learn more from incidents and accidents than successes

9

Causes of structural failures and

risk reduction measures Cause Structural Integrity Management

Measures

Quantitative

measure of “risk”

Less than

adequate safety

margin to cover

“normal” inherent

uncertainties.

- Improve Design Criteria

(Increase characteristic load,

safety factors in ULS, FLS;

- Improve inspection of the

structure (FLS)

Structural reliability

analysis

Gross error or

omission

during life cycle

phase:

- design (d)

- fabrication (f)

- operation (o)

Or, deficiency in

design standard

- Improve skills, competence, self-

checking (for life cycle phase: d, f, o)

- QA/QC of engineering process (during d)

- Direct ALS design (in d)– with

adequate damage conditions arising

in f, o (NOT d)

- Event control relating to accidental

fires, explosions and ship impacts

- Inspection/repair of the structure

(during f, o)

Quantitative risk

analysis

Unknown

phenomena

- Research & Development None

SIM

Strategy

10

Type

of

structure

Type

of

joint

FDF1) Residual

fatigue

life

Ultimate

reserve

strength

Inspection

method

Jacket Tubular

joints

2-10 Some-

Sign.

Normally NDE,U3

Semi-

subm.

Plated brace

Plated column

-pontoon

1-3

1-3

Some

Some

By ALS2)

Limited

LBB,4) NDE

LBB,NDE

TLP Tether

Plated

col.-p.

10

1-3

Small

Some

By ALS

Limited

IM5)

LBB

NDE

Ship Plated

longt. 1-3 Sign. -

Close

Visual

1) FDF - Fatigue Design Factor – by which the service life

is to be multiplied with to achieve the design fatigue life

2) ALS - Accidental Collapse Limit State

3) NDE - Non Destructive Examination Method; U-underwater

4) LBB - Leak before break monitoring

5) IM - Instrumental monitoring (by “an intelligent rat”)

Crack control measures.

; 1/ 0.1 1.0ic allowable allowable

ic

nD D D FDF to

N

SIM

Strategy

11

High reliability organisations (HRO)

The HROs are those organisations that have operated

nearly error-free over long periods of time.

Studies (e.g. Weick, et al 1999) have shown that the reduction

in error occurrence is accomplished by the following

(1) command by exception or negation,

(Decision-making responsibility is allowed to migrate to the persons with the

most expertise to make the decision (employee empowerment)).

(2) robustness by redundant personnel, procedures and hardware

(3) procedures and rules. ( Procedures should be accurate, complete,

simple, well organised, and well documented. Rules should be adhered to). .

(4) selection and training,

(5) appropriate rewards and punishment and

(6) ability of management (key decision-makers) to

“see the big picture”.

Approaches to achieve acceptable life cycle structural integrity

12

Development of structural

robustness requirements

➢ recognise that ALS/PLS criteria

represent one element in

the structural integrity management

and are based on

- a system model and

relevant failure modes

- accident experiences

➢ make the criteria operational

(possible to check compliance with)

➢ The main challenge:

determine the initial damage that

the structure should survive relating to its

- location

- magnitude

- probability

(reduce the probability

and intensity of e.g.

accidental actions,

structural flaws), as

discussed in N0145:

by involving competent

personnel, executing

QA/QC in the life cycle

phases, prevent fires

and other accidental

events from escalating )

13

Step 1

• check capacity to resist abnormal or

accidental loads with annual exceedance

probability of 10-4 (allowed to cause

local damage only)

Step 2

• check that the structure in damaged

condition (step1 or specified damage)

does nor experience total collapse for

actions with annual exceedance

probability of 10-2 or 10-1 (when initial

damage is not correlated with the

environmental actions)

Action and resistance factors are 1.0

Example Procedure (NPD, 1984/Norsok):

Accidental collapse limit state (for equilibrium and

structural strength) - ALS, also denoted PLS

- local strength or system check

A

E

14

➢ The ALS criterion was intended to ensure an annual probability of total

collapse of less than 10-5

➢ It turned out that the ULS criterion for environmental actions using 10-2

actions with an annual prob. of 10-2 and partial safety factors, did not

provide a similar safety level.

➢ Hence, including an “abnormal” environmental actions with a probability

of 10-4 was introduced. (This scenario of environmental condition should not be a simple extrapolation

of the 10-2 event, but represent e.g. a wave condition with a possible

“abnormal” condition, e.g. with steep wave with a large crest).

In the revised ISO 19900 standard the ALS limit states will be denoted:

- ALS1 : considering accidental damage due to accidental actions or

structural flaws (abnormal) resistance

- ALS2 : considering abnormal environmental condition

Extension of the initial ALS to cover

abnormal environmental actions

15

Comment on the current draft of EN1990- EN1990 apparently focuses on direct design against accidental actions as

a conventional ULS strength check

- An alternative approach – using an alternate path approach –

is not spelled out – even if it is mentioned that design check

should be made during and after the accident.

The alternate path approach can more easily account for structural flaws

(abnormal strength) – e.g. relating to the effect of fabrication defects

or fatigue or other deterioration effect on the resistance) – which

is required to rely on an inspection/monitoring and repair strategy.

The redistribution of forces in an alternate path approach relies on

a ductile structure (esp. joints) and appropriate analysis tools.

Actual ALS (robustness) criteria should depend on the consequence class

(It is noted that robustness relating to fatigue can of course also be provided by using more

restrictive ULS/FLS criteria, but would depend on cost/benefit).

It is suggested to more explicitly include such an approach in terms of a

Limit State in EN1990 - Sect. “5.2” (See ALS criterion in ISO 19900/Norsok N-01)

16

Comments on the target safety level in EN 1990

➢ EN1990 «refers» to safety (reliability) target levels

in terms of Pf and .

- Such measures refer to structural reliability analysis

considering normal uncertainties – and is suitable to deal with

the conventional ULS.

- the true (actuarial) risk – probability times consequences

need in principle to be estimated by

Quantitative Risk Analysis (QRA) . Hence the given target levels

are nor relevant since EN1990 deal with the broader aspect of risk –

e.g. by accounting for accidental actions

➢ No explicit target safety/«reliability» level

is defined for the robustness.

17Comments on “redundancy” in view of robustness

or damage tolerance- Structural redundancy (i.e. load carrying capacity after removal of one or more

components) is sometimes considered to “imply” robustness. However,

- redundancy is not a quantitative measure of load

carrying capacity

- redundancy is a pure structural feature; robustness

depends on the structure as well as the actions

- some hazards (ship impacts, explosions…)

might cause partial damage or damage to or

failure of more than one component.

- the hazards and the corresponding damage might

occur in different locations

Even though this approach is based on risk analysis it is of course not needed for

“well known “ cases; i.e. it can be based on generic damage conditions

Car impact:

Failure of column

These facts suggest use of an approach based on risk

assessment, considering

- Various hazards, their probability in time and space

- Their implied damage and

- The residual strength of the structural system

after damage

18

Wider Aspect of Structural Robustness

- In addition to the ALS criterion which aims at damage tolerance relating to

conditions caused due to human errors during operation and fabrication, it is

important to encourage designers to

provide robustness in cases where the structural performance is

sensitive to uncertain parameters. This is because the normal characteristic

values and partial safety factors in ULS requirements do not properly account

for such situations.

- Examples of such cases are:

- resonant dynamic response which is sensitive to damping;

- the ultimate strength of cylindrical shells under axial compression,

which is sensitive to imperfections and

- fatigue life estimates that is very sensitive to the local geometry and defects.

In addition to provide robustness against fatigue failure by the conventional

two-step ALS approach, use of a large FDF will also

provide robustness since implied lower stress level will lead to more time

to identify and possibly repair cracks.

19Handling uncertainty in Structural Integrity

Management: Risk and Reliability Assessment➢ Normal uncertainties due to fundamental variability

and lack of data

➢ Including the effect of human errors

2 2

ln /( ) ( )

R S

R SV VP P R S

f

Probablity of failure (𝑃𝑓) in as special case:

- Random R and S with lognormal distribution

- denotes mean value ; s - denotes standard deviation

V = s/ – coefficient of variation(-) = standard cumulative normal distribution

The probability of system loss, relating to different accidental actions and

“accidental damages” identified as abnormal resistance, may be written in a

simplified manner,

( i ) ( i ) ( i )

FSYS jk jk jk lm lm

jk lm

P P FSYS | D A PE P D| A P A P FSYS | D P D

where Ajk(i) are – mutually exclusive - accidental actions (i) at location (j) and

intensity (k) and Dlm are damage at location (k) with a magnitude (l). PE

represents the payloads and environmental actions to consider for the damaged

structure.

Risk = pi ∙Ci

20

Structural Integrity Management should, among other measures,

include

➢ Design using an Accidental Collapse Limit State

to ensure robustness

- relevant damage conditions (due to accidental actions and

abnormal strength) should reflect other efforts

to ensure structural integrity (QA/QC of design and analysis

w.r.t to novel phenomena and gross errors ; Inspection and

monitoring of the structure during fabrication and operation)

- the criteria should be formulated as an explicit limit state

corresponding to a relevant safety target level and

harmonized with available tools for action and structural analysis

➢ A simplified approach should be used for low consequence class

structures

➢ Encourage providing robustness in design in view of uncertain

parameters affecting actions and action effects

- damping in case of resonant dynamic behaviour

- local geometry in connection with fatigue analysis

Concluding remarks

Direct ULS design

against accidental

actions should

also be permitted