2. RELIABILITY OF STRUCTURES 9 - DNVresearch.dnv.com/skj/OffGuide/CH2.pdf · · 2001-03-08Some...

Guideline for Offshore Structural Reliability Analysis - General Page No._____________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________

DNV Report No. 95-2018 Chapter 2

Skjong,R, E.B.Gregersen, E.Cramer, A.Croker, Ø.Hagen, G.Korneliussen, S.Lacasse, I.Lotsberg, F.Nadim,K.O.Ronold (1995)“Guideline for Offshore Structural Reliability Analysis-General”, DNV:95-2018.

8

FEBRUARY 20, 1995

2. RELIABILITY OF STRUCTURES 9

2.1 Fundamental principles 92.1.1 Introduction 92.1.2 Safety Disciplines 92.1.3 Two Different Probability Concepts 102.1.4 Relation of QRA, SRA and ORA to the Probability Concept 132.1.5 Interfaces 13

2.2 Interpretation of safety 16

2.3 Safety Format of Design Codes 17

2.4 Code Calibration 182.4.1 Introduction 182.4.2 Calibration of Partial Safety Factors for a Specific Design 192.4.3 Code Calibration Procedure for a Class of Designs 21

2.5 Target Safety Level 242.5.1 General 242.5.2 Probabilistic Design Format 272.5.3 Calculation of Reliability Related to Established Design Practice 272.5.4 Reliability Analysis Compared with Risks Accepted by Society 282.5.5 Target Failure Probabilities Based on Historical Data 312.5.6 Target Failure Probabilities in Design Codes 322.5.7 Recommended Method 32

2.6 Common Mistakes in the Use of SRA 34

2.7 Standard Problems, Reasons and Remedies Relating to Codes 35

2.8 Competence Requirements 35

2.9 General Requirements to an SRA 36

2.10 Standard List of Content for an SRA Analysis Report 37

REFERENCES 38

FURTHER READING 39




9

2. Reliability of Structures

2.1 Fundamental principles

2.1.1 Introduction

Within the safety, risk and reliability disciplines a number of methods are used. Within differentindustries the disciplines are named differently, e.g., Quantitative Risk Analysis, ProbabilisticRisk Analysis, Probabilistic Safety Assessment, Formal Safety Assessment are different namesfor essentially the same methods. Within the offshore area, the most important disciplines areusually referred to as:

• Quantitative Risk Analysis (QRA)• Structural Reliability Analysis (SRA)• Organisational Reliability Analysis (ORA), including organisation, procedures, software and

human reliability

In understanding the use of SRA it is important to be aware of the basic assumptions behind anSRA and the interfaces to other disciplines.

2.1.2 Safety Disciplines

Structural Reliability Analysis (SRA): SRA is concerned with the estimation or calculation ofthe reliability or probability of failure of a structure, a structural member, or a structural element.The methods are described in some detail in Chapter 3. The analysis should be based on state-of-the-art physical models. SRA also constitutes the formal theory behind calibration of designcodes, and SRA together with state-of-the-art physical models may be used to calibrate designcodes where other state-of-practice models are used together with the appropriate codeformulation to achieve the targeted reliability level.

Quantitative Risk Analysis (QRA): QRA is concerned with the estimation and calculation ofoverall risk to human health and safety, the environment and assets represented by theinstallations. The analysis consists of the following main steps:

• Hazard Identification• Assessment of probabilities /frequencies of initiating events• Accident Development (how an initiating event can develop into different accidental events)• Consequence Assessment (calculation of consequences of different accidents)• Calculation of risks

The analysis is as a tool for modifying the design and/or operation such that the risk satisfies thetargeted safety level.

Organisational Reliability Analysis (ORA): This discipline is concerned with howorganisations, their internal procedures and humans, influence reliability of processes and qualityof products. ORA thus includes the field of Human Reliability (HR), see Swain and Guttman(1983).




10

2.1.3 Two Different Probability Concepts

Within the SRA, QRA and ORA disciplines two different probability concepts exists. By mostengineers this difference is not observed, even though the distinction can be very important inmany cases. We may define the two different concepts as Frequentistic probability and Bayesianprobability. The two different concepts have been in use since Bayes (1763).

Frequentistic Probability: The probability is interpreted as the frequency of occurrences ofoutcomes of stochastic experiments. The frequentistic probability is sometimes referred to asbeing objective, since the probability may be known to whatever precision we want if theexperiment is repeated a sufficient number of times.

Bayesian Probability; Bayes (1763): The probability is an expression of “degree of belief”,Keynes (1921), Lindley (1985), De Groot (1988), Finetti (1974), and “betting odds”, Savage(1954). The probability is therefore often referred to as being subjective, since two differentdecision makers may have different knowledge and therefore their respective, assessedprobabilities are different. This interpretation of probability is not based on relative frequenciesand does not require many identical trials.

It should be noted that both probability concepts or interpretations satisfy the standard axioms ofthe mathematical theory of probability. In practice, this may also explain that the existence oftwo different probability concepts is seldom observed by engineers.

Some authors, see Kaplan and Garrick (1981), think of the two probability concepts asfundamentally different and use the words frequency for frequentistic probability and probabilityfor Bayesian probability. In this guideline we use the word probability in the Bayesian tradition.

SRA belongs to the Bayesian tradition. One good reason is that two identical structures, situatedin the same environment and constructed by the same materials, are almost never built andprobably never will be. A number of the uncertainties that have to be accounted for in thedecision process are thus impossible to base on a frequentistic interpretation of uncertainties.Therefore each ‘experiment’ is only carried out once. For the aleatory uncertainties, however,there is no difference between their modelling in an SRA and in a frequentistic probabilityinterpretation. The epistemic uncertainties, on the other hand, are not properties of the structureand its environment. Therefore the probabilities and reliabilities that result from an SRA are notstructural properties. They are rather properties of our assessment and level of knowledge.

A simple example will illustrate this: If a response parameter is monitored during the service life,this may lead to a reduced uncertainty in this response parameter. If we model this in the SRA,and the mean value is unchanged, the result will be an increase in the reliability. However, thestructure is the same. It is our knowledge about the structure and its environment that haschanged. This knowledge has changed the reliability, our “degree of belief” that the structure issafe, or “the betting odds” that the structure is safe.

Arguments for QRA and ORA to change from the frequentistic to the Bayesian tradition may befound in Apostolakis (1990). This paper gives good reasons why the frequentistic interpretationof probability should be adopted also within QRA. In the communication between the QRA,ORA and SRA specialists it may be very important to be aware of the distinction between thesetwo different probability concepts. In particular this relates to questions regarding whichuncertainties are actually included in the different analyses. This, in turn, is of particularrelevance to statistical and model uncertainties and other epistemic uncertainties. Whichuncertainties are included and which are disregarded should have implications for the targetreliability level, see Section 2.5.




11

Within the frequentistic approach the calculated probabilities may be associated directly withuncertainties. However, within the Bayesian approach the probabilities are a consequence of theuncertainties and, e.g., to ask for uncertainty in a calculated probability is not relevant. In SRAthe relevant question will relate to the sensitivities of the results with respect to, e.g., assumptionsand models of the uncertainties. In the Bayesian tradition, probabilities are “subjective”, they arenot a property of the structure or component, but of our knowledge about the structure and itsenvironment. In the frequentistic approach, the probabilities are “objective”, in the sense thatthey supposedly come from observed data. However, this frequentistic interpretation is incontradiction with all experience in practical use of reliability analysis. For new structures,materials and environmental conditions failure data do generally not exist, decisions must bebased on models with inherent uncertainties, etc.

The difference between a reliability index β A , calculated by including only the aleatoryuncertainties, and the reliability index β , with all uncertainties included as is advocated in thisguideline for SRA, may be calculated by the omission sensitivity factors, see Section 3.5.10. Forexample, if all epistemic uncertainty variables are mutually independent and represented by theirmedian values the relation is

β β

αA

ii

I=

−=�1 2

1

(2.1)

where α i2 denotes the uncertainty importance factor of the ith epistemic stochastic variable

[ ]x i Ii , ,⊂ 1 . This relation would then represent the difference between the frequentisticprobability and the Bayesian probability. In an attempt to compare historically observedfrequencies with probabilities calculated by SRA, the comparison should be made withPA A= −Φ( )β , and only data representing what is actually checked by the SRA should beincluded in the data base.

This guideline advocates the view that we should build state-of-the-art models with state-of-knowledge representations of epistemic uncertainties, such that these are included in the resultingprobabilities. It is thus meaningless to ask an SRA analysts to say something about theuncertainty in the resulting probabilities. The uncertainties are included in the analysis. An SRAanalyst should, however, be prepared to document the sensitivity of the probability with respectto all assumptions. This task is made easy with the available tools used in SRA.

The alternative would be to represent only the aleatory uncertainties as stochastic variables in themodel, and then perform sensitivity studies for changes in the fixed-valued epistemicuncertainties. If, however, the epistemic uncertainties were quantified by distributions we couldpropagate the epistemic uncertainties through the model. This would lead to a distributionfunction for the probabilities.

Relating to Bayes theorem we should note that it is the epistemic uncertainties that are updated asempirical evidence is gathered. The aleatory uncertainties cannot be removed.

There are a few technical problems involved with treating the epistemic uncertainties differentthan the aleatory uncertainties. Some authors have proposed to do this, and then to treat thealeatory uncertainties as frequentistic, and the epistemic uncertainties as Bayesian, see Kaplanand Garrick (1981), Parry (1988). This distinction, from a conceptual point of view, is reallyunnecessary and may lead to theoretical problems (Apostolakis, 1990). Treating epistemic and




12

aleatory uncertainties differently should reflect a different risk aversion against these two typesof uncertainties. If, at all, such a case of different risk aversion could be presented, it would be analternative to split the stochastic variables x representing the uncertainties into an aleatory setxA and an epistemic set xE , i..e., x (x , xA E= ) and calculate the expected value of the aleatoryprobability PA

[ ]E P f f d dA ER

A Eg

A E

EE

=�

��

�

��∈ <

� �( ) ( )( )

x x | x x xx x |xA E 0

(2.2)

in which f E( )x is the joint probability density function for xE , and f A E( | )x x is the jointprobability density function for xA conditioned on xE . Higher order moments of PA may becalculated accordingly. This allows for the possibility to deal with two different utility functionsor risk aversions, one for aleatory uncertainties and one for epistemic uncertainties. Thedistribution of PA could also be presented, see Kaplan and Garrick (1981). However, thesemethods are not recommended, and may lead both to theoretical problems (Apostolakis, 1990,1993) and to communication problems, as decision makers may find uncertainties in probabilitiesdifficult do deal with.

The distinction between aleatory and epistemic uncertainties may in many cases seem unclear. An example mayillustrate this. When we perform fatigue crack growth experiments in the laboratory and assume a linear elastic fracturemechanics model

dadN

C K m= ( )∆ (2.3)

the regression analysis lead to establishment of a joint distribution of ( , )C m , and due to small sample sizes there will

also be some epistemic uncertainty, while the joint distribution of ( , )C m represent the aleatory uncertainty. Whenwe perform more experiments we may remove the epistemic uncertainty while the aleatory uncertainty remains. Thesedata may later be used in the prediction of the failure probability of a structure by the limit state function

g x daaY a

C Sm

a

a

im

i

Ic

( )( ( ))

= −� �=π

0 1

(2.4)

where the crack of depth a grows from the initial depth a0 to the critical aC within I stress cycles, the ith of which

having stress range Si . Y a( ) is a geometry function modifying the stress intensity factor ∆K as the crack grows.The inspection event, in case a crack is not found, may be formulated as

h x daaY a

C S h xma

a

im

i

JD

( )( ( ))

, ( )= − >� �=π

0 1

0 (2.5)

where aD is the distribution of the smallest detectable crack size, the POD, see Section 7.6 after J stress cycles. Inthe Bayesian updating, the failure probability after this inspection may be calculated by

P g h P g hP h

( ( ) | ( ) ) ( ( ) ( ) )( ( ) )

x x x xx

< > = < ∩ >>

0 0 0 00

(2.6)

Is this an updating of aleatory uncertainty? No, the uncertainty is epistemic, since we take the joint distribution of(C,m) to represent our knowledge of the material parameters. We have no knowledge of which outcomes of (C,m)should be expected at a specific location in the real structure.

This unclear distinction between aleatory and epistemic uncertainties has also been noted inQRA applications. It has become quite common in QRA to use the variability or aleatoryuncertainty of a parameter value from plant to plant to characterize the epistemic uncertainty




13

about the parameter value for a plant not in the original population. Thus, in this case and manysimilar cases, a variability or an aleatory uncertainty in one context becomes an epistemicuncertainty in another context. Such consideration would therefore be very important in modelswhere the two types of uncertainties are treated differently.

2.1.4 Relation of QRA, SRA and ORA to the Probability Concept

• In SRA, probabilities are calculated from analysis models and a detailed knowledge of theenvironment, the loads, the response, the detailed design, the material performance etc. TheBayesian probability concept is used.

• In QRA, component failure probabilities are usually not calculated. Component failureprobabilities are based on collected data, usually organised in data bases. Hundreds of suchdata bases exist for different types of components in various industries. System failureprobabilities may be calculated from component probabilities, or may be found in data bases.The data represent historic averages, and new components will usually not be represented inthe data base to the extent they are represented in a new design. When analysing olderinstallations, the historical component failure probabilities are sometimes modified based on

-Experience data from the plant -A review of the technical standard (wear, corrosion etc.) and the

maintenance programs that have taken place over the operational life. The probability concept used is frequentistic in most applications. However, this seems to be

changing.• In ORA, probabilities may to some extent be estimated on the basis of statistics (e.g.,

WOAD). However, no generally applicable accepted method for calculation of probabilitiesexists. The probabilility concept used is frequentistic.

2.1.5 Interfaces

• In design there is no input from ORA to SRA: This is called The Fundamental Principle ofSRA, see Ditlevsen (1981). SRA does not consider the effect of human mistakes. It isexpected that Quality Assurance systems work and Gross Errors (which form the commonclassification of organisational, procedural, software and human errors in SRA context) areexcluded from the analysis. The reason for this exclusion is that SRA is primarily concernedwith optimisation of design solution. A change in a structural dimension might be costly andnot be an adequate safety measure to safeguard against gross errors. Redundancy orrobustness are, however, used as such a safety measure and SRA are used to calculate theeffect of such redundancies. Some variations in the quality of products from organisations,procedures and humans are accounted for in SRA, such as variations in properties that may beanalysed by testing (e.g., material data, geometrical data). In operations, ORA may be used inconnection with inspections. A Probability Of Detection (POD, see Section 7.6) curve is aquantitative measure of human, organisational, procedural and sometimes also softwareperformance.

• Input from ORA to QRA: QRA attempts to include ORA. However, no generally acceptedmethods exist. Within the offshore industry this is observed as a lack of adequate technology,since QRA is used extensively to estimate risks.




14

• Input from QRA to SRA: The accidental loads that exceed certain criteria (probabilitiesand/or severity) are estimated by QRA, and SRA is used to design the structure in such a waythat the structural reliability is maintained under such conditions. QRA today does not providethis information in terms of probability distributions, which is the format required by SRA.The only known exception is when probabilistic tools are used, see PROEXP (1993).

• Input from QRA to ORA: In risk estimation there is none. However, QRA gives quantitativemeasures of importance of components. This may be used to focus quality assurance efforts tosuch important components.

• Input from SRA to ORA: SRA gives quantitative measures of importance of components orparameters. This may be used to focus quality assurance efforts to such important componentsor parameters. Otherwise there is no interface.

• Input from SRA to QRA: Calculated failure probabilities from SRA are sometimes used in

QRA. However, in such cases SRA can only provide data for hazards initiated by structuralfailures. Therefore, probabilities calculated by SRA cannot be used without including theprobabilities from 'gross errors' or ORA. In some few cases there is agreement between PSRA

and PQRA . In general, the relation may be complicated. However; in many situations therelation is simply P P PQRA SRA ORA= +

QRA

SRA ORA

•••• Dotted: No communication•••• Dashed: Some communication•••• Hairline: Communication

Figure 2.1 Interfaces between QRA, SRA, and ORA




15

Responsibility of QRA Responsibility of SRA

Identify and Characterize

Accidental Events

Identify Strucural Failure

Modes

Determine Structural

Redundancy and Consequences

Determine Acceptable

Structural Risks

Determine Acceptable Determine Structural Failure Mechanisms and Determine

Governing Load Effect

Determine Design Accidental

Event

Determine Design Requiermentsand

Load Specifications

Validation

Validation

Structural

Design Specification

CriteriaConcept Risk < Acceptance

Structural Failure Frequency

Figure 2. 2 Structural Reliability Regarding Accidental Events; Interface QRA-SRA




16

2.2 Interpretation of safety

Structural reliability analysis (SRA) is one part of a total safety concept, and safety factors usedfor design of structures is only one item governing the overall safety. This is so because alsoaccidents and gross errors are major failure causes. Thus, in order to achieve a high safety levelof a structure, it is not sufficient to prescribe high safety factors that give the nominal safety levelaimed for, but in addition one has to control the possibilities of accidental events and reduce thepossibilities for gross errors during design, construction and installation.

Accidental events are controlled through use of risk analysis (QRA). Gross errors are attemptedcontrolled by requirements to organisation of the work, verification of design, and qualityassurance during fabrication and construction.

In-service inspection is another measure for control of the safety of the structure. For example,the requirements to fatigue design is closely linked to the extent of in-service inspection andpossibilities for repair during service life.

Some items are difficult to include in a reliability analysis. Data may not always be available tosupport such an inclusion, or relevant theories or solutions of the problems may not always be athand. Examples of such items which still have an impact on the total safety are:• Material selection and documentation, Charpy V-requirements and fracture toughness.• Welding procedure specifications and qualifications including testing requirements.• Requirements to non-destructive examination during fabrication.• Corrosion protection systems.

All items of significance for the total safety of the structure should be considered. For a selectedtarget safety level, it should therefore, in principle, be possible to derive a balanced set of safetymeasures including those indicated here in addition to the safety factors used in design. Thus,engineering judgement will be required for evaluation of the results from reliability analysis inrelation to the problem to be solved.

The calculated value of the reliability index is a function of analysis methods and distributionsassumed for the analyses, see also Section 2.5.3. This means that it is difficult to calculate theabsolute value of the inherent safety of design codes by reliability analyses. For this reason, useof reliability analyses does not necessarily imply abrupt changes in a design code although theresults from reliability analyses may justify such a modification. However, such use may enableinconsistencies within a particular specification to become eliminated and allow more uniformreliabilities to be attained over a range of situations.

Structural failures from inspection reports and accidents should be filed in a format that mightsupport long-term calibration of structural reliability models. Reliability analysis models shouldhave such objectivity properties that long-term revisions of underlying assumptions in principlecan be made based on empirical evidence. In other words, the sequence of failure probabilitiescomputed from the sequence of updated analysis models should, in principle, asymptoticallyreflect the relative frequency of failures in the corresponding sequence of analysed structuralproblems when failures owing to gross errors are excluded from the pertinent data base.

A gross error may be defined as a human mistake during the design, construction and installationprocess that may lead to a safety level far below that normally aimed for in design by use ofnormal load and resistance factors. This human mistake may be due to lack of understanding ofthe actual behaviour of the considered structure, ref., e.g., Takoma bridge, by employinginexperienced personnel for performing the design, or by failure of the control procedures duringdesign, construction or installation. It is generally accepted that gross errors cannot be controlled




17

by the load and resistance factors. However, the robustness of a structure may be a function ofthe safety factors used, and the consequences of a gross error may therefore be a function of thevalues of these load and resistance factors. This illustrates some of the problems of developingdesign rules that are optimal with respect to total cost, i.e., an optimal relation betweenrobustness of the structure, load and resistance factors, and control during the design,construction and installation to reduce possibilities for gross errors.

2.3 Safety Format of Design Codes

The design format most frequently used for development of new design codes is that based onpartial safety factors. This form of a safety format results from requirements to an easy andeconomic design.

A safety format based on partial safety factors can be expressed as

E Rd d

< (2.7)

whereEd = design load effectRd = design resistance

The design load effect is calculated by the equation

E Ed f k=γ (2.8)

whereγ f = load factorEk = characteristic load effect

The design resistance is calculated by the equation

RR

d

k

m

=γ

(2.9)

γ m = material factorRk = characteristic resistance

Normally, a number of different load effects have to be combined into a resulting load effect.The different load coefficients should be determined such that the probability of exceeding thedesign load effect corresponds to the same level of reliability as that otherwise achieved by thedesign code.

Whereas several load effects have to be combined into one design load effect, it may be efficientwith respect to a uniform reliability level (and structural weight) to consider a number ofcombinations where the largest value will be governing for the design. Thus more than onecombination of load effects may be required for design. A calibration of one combination shouldbe performed within its region of validity. An example of this is the DNV rules (1977) and the




18

NPD regulations (1994) where two sets of equations are used to determine the design load effectfor the ultimate limit state:

E P L E Dd P k L k E k D k

= + + +γ γ γ γ

(2.10)

where the load coefficients are given in Table 2.1.

P = permanent loadsL = variable functional loadsE = environmental loadsD = deformation loads.

Table 2.1 Load Factors for the Ultimate Limit State in the DNV Rules

Load combination γ P γ L γ E γ D

ab

1.31.0

1.31.0

0.71.3

1.01.0

The following considerations related to an efficient design format can be listed:• For common structures the design values for load effects should be independent of the design

values of the resistance.• There should only be a small set of load factors and load combinations.• One material factor should be sufficient for each material property. An efficient use of

characteristic values may reduce the need for different material factors for the resistance fordifferent failure modes.

• Use of characteristic values can be considered as an efficient means to achieve a uniformsafety level as function of a design parameter with the use of a constant material factor, evenif different scatter in test data as function of this design parameter occurs. This can beillustrated by test data for buckling strength of columns: Test data show different scatter asfunction of slenderness, but by defining a characteristic value close to the design point valuefor the material variable, as achieved from a probabilistic analysis, a rather uniform safetylevel as function of slenderness can be achieved even if the same material factor is used forthe whole range of slendernesses.

2.4 Code Calibration

2.4.1 Introduction

The purpose of a code calibration is to determine a vector of partial safety factors for use in thecode checks that are executed during structural design in order to verify that the design rules asset forth by a structural design code are fulfilled. An example of such a design rule is the simpleinequality




19

R LD D

≥ (2.11)

in which R RD c m

= / γ is the design resistance and L LD c f

= γ is the design load. The code

specifies how to arrive at the characteristic resistance RC and the characteristic load LC and alsospecifies values of the partial safety factors γm and γ f to be used. The design equation is aspecial case of the design rule obtained by turning the inequality into an equality, i.e., R LD D=in the example.

Structural reliability analysis results, obtained as outlined in Chapter 3, play an important role incodified practice and design. Their application to calibration of partial safety factors for use instructural design codes is of particular interest. With the first-order reliability method available, itis possible to determine sets of equivalent partial safety factors which, when applied with designrules in structural design codes, will lead to designs with a prescribed reliability.

A design case is formed by a specific combination of type of structure, geographical location,material, and limit state. For a particular design case, which can be analyzed by a structuralreliability method, a set of partial safety factors can thus be determined that will lead to a designwhich exactly meets the specified reliability. Different sets of partial safety factors may result fordifferent design cases. Calibration of partial safety factors for a specific design case is dealt within Section 2.4.2.

A structural design code usually has a scope that covers an entire class of design cases, formedby combinations among several types of structures, multiple geographical locations withindividual environmental loading regimes and soil conditions, different structural materials, andpossibly a series of potential limit states or failure modes. The design code will usually specifyone common set of partial safety factors to be applied regardless of which design case is at stage.This practical simplification implies that the prescribed reliability will usually not be met exactly,but only approximately, when designs are carried out according to the code. Calibration of partialsafety factors for a class of design cases is dealt with in Section 2.4.3.

2.4.2 Calibration of Partial Safety Factors for a Specific Design

A specific design case is considered in the following. The safety of the associated structure isgoverned by N stochastic variables which are denoted by the vector X. A design parameter θwhich is characteristic for the structure is chosen. This is a quantity that can be controlled duringthe design, e.g., a geometrical quantity such as a length, a wall thickness, or a cross-sectionalarea. In principle, there can be more than one design parameter, but one is sufficient, and this isassumed in the following. By standard deterministic design methods, the structure is designed bychoosing an appropriate value of the design parameter such that the structure fulfills the designrule that pertains to the limit state or failure mode in question.

A relevant limit state function for the failure mode is established in compliance withrequirements specified in Section 3.1. Structural reliability analyses of the structure are thencarried out for a series of trial values of the design parameter θ, each resulting in a reliabilityindex β, a set of importance factors α 2 , and a design point x D

* which is the most likelyrealisation of X at failure. From these analyses, the particular value of θ is found that yields areliability index β equal to the prescribed target reliability index βt .




20

A vector of characteristic values xC for the stochastic variables X is chosen as quantiles of therespective distribution functions, e.g., a high quantile for a load variable and a low quantile for aresistance variable. A set of partial safety factors γγγγ is introduced. In principle, γγγγ contains onefactor γ i per stochastic variable Xi . However, one may wish to prescribe some of the safetyfactors in γγγγ , e.g., to a value of 1.0, in order to limit the total number of safety factors of thecode. If fewer partial safety factors are introduced than the number of stochastic variablesindicate, then these factors should be introduced as factors on those of the stochastic variablesthat are most important as determined by the reliability analysis. Depending on the set-up of thedesign rule, one may also prefer to apply a safety factor on a function of the characteristic valuesof one or more of the stochastic variables rather than on the characteristic values of the variablesthemselves. For example, in fatigue (Section 2.1.3), the material factor would be applied on theintercept loga rather than on a itself. A total of only two partial safety factors may suffice in theminimum case, e.g., one for load and one for resistance.

By a design value format, the design values xD of the stochastic variables are derived from thecharacteristic values xC by multiplication of these values by the pertinent partial safety factors,x xD i i C i, ,= γ , i=1,...N. Substitution of these design value expressions into the design equation,together with the value of θ that is found to yield the target reliability index βt , leads to anequation in the partial safety factors γγγγ . The solution of this equation can be interpreted as therequirement to the partial safety factors γγγγ in order to achieve a design with the prescribed targetreliability. However, when γγγγ contains more than one element, which is usually the case, therewill be an infinite number of such solutions and thus an arbitrariness in selecting a particularsolution to form a unique requirement to the set of partial safety factors. This arbitrariness can beremedied by taking into account the importance information from the reliability analysis, e.g., byrequiring that the design values xD shall be equal to the design point xD

* as determined from thereliability analysis. This will eliminate possible ambiguities and reduce the number of solutionsfor γγγγ to one particular set. The design point is the most likely outcome of the stochasticvariables X at failure.

Example 2.1: Axially Loaded Steel Truss

The example given here is of a simple calibration of partial safety factors for an axially loaded steel truss. In thisexample the design of the axially loaded steel truss is governed by the extreme axial force Q in its lifetime where Qfollows a Gumbel distribution

F q a q bQ ( ) exp( exp( ( )))= − − − (2.12)

in which a=0.641 and b=79.1 correspond to a mean value E[Q]=80 MN and a standard deviation D[Q]=2 MN. Theyield strength of steel σF follows a lognormal distribution with mean value E[σF ]=400 MPa and standard deviationD[σF ]=24 MPa. The cross-sectional area of the steel truss is A. For design of the truss, the load Q shall not exceedthe capacity σF A , so the design rule is σF D DA q, ≥ and the design equation becomes σF D DA q, = . The subscriptD denotes design value. The limit state function is correspondingly chosen as

G A QF= −σ (2.13)

and the area A is chosen as the design parameter.

Analysis by a first-order reliability method leads to determination of A = 0 257. m2 in order to meet a targetreliability index β=3.719. This corresponds to a failure probability PF = −10 4. The characteristic value of the extreme




21

axial force is taken as the mean extreme value, q E QC = = 80 MN. The characteristic value of the yield strength

is taken as the 5% quantile, σ σF C F, , % .= =5 361 8 MPa. One partial safety factor γ1 is introduced on the

characteristic force, and another γ2 on the characteristic capacity. Substitution of the expressions for the design forceand the design capacity in the design equation yields

γ σ γ γ γ2 1 2 1361 8 0 257 80 0F C CA q, . .− = ⋅ ⋅ − ⋅ = (2.14)

which gives a requirement to the ratio of the partial safety factors γ γ2 1 0 86/ .= . The reliability analysis gave the

design point values qD*=86.3 MN for the force and σF D,

* =335.9 MPa for the strength. The partial safety factors aretherefore selected as

γ1 1 079= =qq

D

C

*

. and γσσ2 0 928= =F D

F C

,*

,

. (2.15)

According to current design practice, a load coefficient γ f is used as a factor on the characteristic load to give the

design load, and a material coefficient γm is used as a divisor on the characteristic strength to give the design strength.Hence, these coefficients become

γ γf = =1 1 079. and γγm = =1 1 077

2

. (2.16)

2.4.3 Code Calibration Procedure for a Class of Designs

In the following, the various terms and steps involved in carrying out a reliability-based codecalibration for a class of designs are defined and presented. The procedure for such a calibrationcapitalises much on the procedure for calibration of partial safety factors for a specific singledesign.

The scope of code is selected. As described above, the scope of the structural design codeconsists of a class of design cases formed by the possible combinations of- structures- materials- geographical locations, including their individual environmental loading regimes and soil conditions- failure modes or limit statesthat the code is meant to cover. The scope of code is also referred to as the data space, and issometimes characterised by substitute quantities such as live-to-dead load ratio, slenderness ratio,axial vs. bending ratio, etc., or combinations thereof.

The code objective is specified. The code objective is the target reliability index βt

corresponding to the safety level aimed at in the design, see Section 2.5. For simplicity in thefollowing, the same βt is assumed for all limit states covered by the scope of code. In practice,however, βt may vary from one limit state to another, if the consequences of the associatedfailures are different.

The demand function expresses the frequency of occurrence of a particular point in data space,i.e., of a certain combination of structure, material, geographical location, and limit state. Thedemand function is used to define weighting factors w for the various combinations of structures,




22

materials, geographical locations, and limit states within the scope of code. The weighting factorsthus represent the relative frequency of the various design cases within the scope, and their sumis 1.0. The weighting factors are taken as those that are representative for the expected futuredemand. For this purpose it is common to assume that the demand seen in the past isrepresentative for the demand in the future.

Because the code cannot be calibrated so as to always lead to designs which exactly meet thetarget reliability, a closeness measure needs to be defined. This can be expressed in terms of apenalty function for deviations from the target reliability. Several possible choices for the penaltyfunction exist. One that penalizes over- and underdesign equally on the β scale may be

M wi j k llkji

i j k l t= −�� , , , , , ,( )

(structures)(materials)(locations)(limit states)

β β 2 (2.17)

in which M denotes the penalty, wi j k l, , , is the weighting factor for the design case identified bythe index set (i,j,k,l), and βi j k l, , , is the reliability index that is obtained for this design case bydesign according to the code. This expression for the penalty function M may be interpreted asthe expected squared deviation from the target reliability over the scope of design cases. Otherchoices for M, e.g., some that penalise underdesign more than overdesign, may be preferred insome cases. Reference is made to Lind (1973) for suggested choices for penalty functions.

Consider in the following one particular design case within the scope of code. As in Section2.4.2, the safety of the associated structure is governed by N stochastic variables X, and a designparameter θ is chosen to characterize the structure. A relevant limit state function for the failuremode in question is established. Structural reliability analyses of the structure are then carried outfor a series of trial values of the design parameter θ, each resulting in a reliability index β, a setof importance factors α 2 , and a design point xD

* which is the most likely realisation of X atfailure. This gives the reliability index β as a function of the design parameter θ, β β θ= ( ).

Characteristic values xC for the stochastic variables X are chosen as outlined in Section 2.4.2.The characteristic values are an integral part of the design code and must be specified in the codeto ensure proper results by use of the code. A set of partial safety factors γγγγ is introduced andapplied to the characteristic values xC to give design values xD as described before.

For the same series of trial values of θ that was used for the reliability analyses, deterministicstructural analyses are carried out by means of the design equation with x xD i i C i, ,= γ , i=1,...N,substituted for the design values of X. This gives the partial safety factors γγγγ as a function of thedesign parameter θ, γγγγ =γγγγ (θ), when possible ambiguities in the design equation solutions for γγγγhave been eliminated. This function thus gives the requirement to γγγγ in order to achieve astructural design with the reliability index β that has been found by the reliability analysis for thecurrent value of θ.

The result of the structural reliability analyses, β β θ= ( ), and the result of the deterministicstructural analyses, γγγγ =γγγγ (θ), are combined by elimination of the design parameter θ to give thereliability index β as a function of the set of calibrated partial safety factors γγγγ , β=β(γγγγ ).

This procedure is repeated for all design cases within the scope of code, such that one function β=β(γγγγ ) results for each design case, or rather βijkl =βijkl (γγγγ ) in which the indices i, j, k, and l refer




23

to limit state, location, material, and type of structure, respectively. With these usually differentfunctions available, the calibration of one common set of partial safety factors γγγγ to be used forthe entire scope of code is ready to commence. Because of the differences between the functionsβijkl =βijkl (γγγγ ) for different design cases, use of a common set of partial safety factors will lead todesigns with a higher reliability than target in some cases, and a lower reliability than target inothers. A prime requirement to the calibration of a common set of safety factors for the entirescope of code is then that, over the scope of code, the calibrated set of safety factors shall lead todesigns with safety levels as close as possible to the target. The common set of safety factors istherefore determined as the set γγγγ that minimizes the penalty function

M wi j k llkji

i j k l= �� , , , , , ,( (

(structures)(materials)(locations)(limit states)

β γγγγ ) )−βt2 (2.18)

over the scope of code, if desirable with a constraint β βijkl ≥ min , in which βmin is some minimumacceptable reliability index. This can be achieved by means of an optimisation technique, andthis applies also if another choice of penalty function is made, such as one that is more heavilybiased against underdesign than against overdesign. For an example of reliability-based optimalcode calibration, reference is made to Hauge et al. (1992). Figure 2.3 demonstrates how such acode calibration leads to designs with achieved safety levels of improved uniformity as comparedto the situation prior to the calibration.

CODE CALIBRATION

DIFFERENT DESIGNS

BEFORE RULESCALIBRATION

AFTER RULESCALIBRATION

0.00000001 UNNECESSARILYSAFE AND COSTLY

DESIRABLELEVELTARGET

RELIABILITY

0.1 UNACCEPTABLE,UNSAFE

UNIFORM

LEVEL

NON

UNIFORM

LEVEL

FAILURE

PROBABILITY

MINIMUMACCEPTABLELEVEL

Figure 2.3 Achieved safety levels by design before and after an optimal code calibration




24

2.5 Target Safety Level

2.5.1 General

The target safety level is a function of some fundamental items which are defined and explainedin the following:

Notional Failure Probability: The calculated reliability is not a property of the structure. It is aproperty of our knowledge of the structural reliability of a structure, e.g., new information aboutthe uncertainty of a parameter will change the calculated reliability. This implies that there is nocontradiction when two analysts calculate two different reliabilities for the same structure, sincethey may have different information. However, two analysts with the same information shouldarrive at the same reliabilities. Since uncertainties related to knowledge is modelled and sincethey contribute to the calculated probabilities of failure, reliability analysis will tend tooverpredict the failure probabilities from failure/accidental data when gross errors are removedfrom the data base.

Reference period: The structural reliability is calculated for a certain reference period, usuallyone year or a design lifetime. It is recommended to use a one-year reference period in all cases.This is most relevant for personnel safety evaluations, for inspection and maintenance planning,and for requalification. For all these applications the annual reliability in year no. i may beconditional on the survival up to year no. i. This conditional failure probability is then identicalto the annual hazard rate.

Scale effects: It is important to clearly define what a limit state function represents. In most casesit defines the failure of a structural part in one particular failure mode. There may be other failuremodes for the same structural part. The size of the part, represented by the limit state, may beimplicitly defined by the size of test specimens used to generate the capacity data from tests. Thefailure of a real structural element may be a function of the failure of any one or all of a numberof such parts, represented by a series or a parallel systems of such parts. This implies that thecorrelation between the limit states representing the failure of such small parts may dominate thereliability of the element. Examples of structures and limit states where the effect may beimportant are:• Fatigue limit state in a tension leg. (The load process would tend to 'pick' the worst capacity.)• Fatigue limit state in a wire, rope, or anchor line. (The load process would tend to 'pick' the

worst capacity.)• Ultimate load capacity in a foundation. (Here the capacity would tend to be an average over a

large area and a mean value may be used.)In most situations, correlation data are missing since this information would require more testing.However, in many situations judgement on approximations of these parameters in the limit statesrepresenting such a part have to be performed, such as considerations of either fully correlatedfrom part to part or fully independent from part to part. A conservative model would be toassume independent strength and fully dependent loads. An example of scale effects and theirimportance is included towards the end of the current Section 2.5.1.

Mechanical models: It is always assumed that state-of-the-art mechanical models are used inSRA. However, simpler models may be used if they have been verified by use of more accurateor advanced models. This would in most cases lead to simpler models that have largeruncertainties and also possible bias. The bias and the uncertainty may then be represented by thestatistical model with a bias factor with given uncertainty and expected value different from one.If mechanical models with different accuracy are used for developing design codes, the result istherefore different sets of partial safety factors, if, e.g. the same fractiles in the modeldistributions are used to define the characteristic values.




25

Stochastic Models: In SRA it is expected that all relevant uncertainties and variabilities arerepresented in the stochastic models. Such uncertainties may be epistemic as well as aleatory.

Example 2.2: Scale Effects in Fracture Mechanics Model by Series System Approach

The influence of scale effects in fracture mechanical models is important and is illustrated here through a simple example,based on a series system approach. It is assumed that the Paris Equation is valid for describing the crack growth from aninitial crack size a0 to a critical crack size aC.

where C and m are material parameters. The stress intensity factor ∆K is described by the far field stress range ∆σ and thegeometry function Y(a) accounting for the local geometrical effects

In this simple case the limit state function may be described as:

where N is the number of stress cycles.

The random variables in this reliability problem are in a typical case: C, m, ∆σ, Y(a), a0 and aC. For simplicity we deal witha weld where each point is subjected to the same axial load. Furthermore we assume that material test data exists forvolumes of dimension v, of the same material under the same axial loading, and that the volume of the weld is V. Areliability model for this full scale problem would then be a series system of dimension M=v/V. Under the describedassumptions, the random variables ∆σ, Y(a) and aC could be assumed to be fully correlated between volumes vi , and C ,mand a0. would be independent or uncorrelated from one such volume to the next. Since the marginal distributions of each ofthese parameters are identical from one volume to the next, we may assume with no loss of generality that the definedproblem represents a system of equi-correlated components i of size M. The equi-correlation would have to be estimatedfrom data and models. The reliability of each volume element vi would be identical βi=β. The probability of failure of sucha system can be determined as:

and for βi=β:

The parameters governing the problem is thus the scale parameter M, the equi-correlation ρ and the reliability index β foreach of the M volume element vi. The equi-correlation ρ will be dominated by the uncertainty in the fully correlated and

dadN

= C( K )m∆ (2. 19)

∆ ∆K = aY(a)π σ (2. 20)

g(x)= da( aY(a) )

- CNE[( ) ]0

C

a

a

mm

� πσ∆ (2. 21)

F- i

MiP = (u)[1 (+ u1-

)]du∞

∞

=� ∏−φ β ρ

ρΦ

1

(2. 22)

F-

MP = (u)[1- (+ u1-

) ]du∞

∞

� φ β ρρ

Φ (2. 23)




26

uncorrelated random variables in each volume vi. The most important factor is most likely a0 amongst the "uncorrelated"variables and ∆σ amongst the fully correlated variables. The correlation in thus low in case the uncertainty in a0 dominates,and the equi-correlation high in cases where ∆σ is the dominating uncertainty. The effect is illustrated for different β's andρ's as a function of M in the figures below.

Assume that the correlation is ρ=0.50, the scale difference is M=20 and the reliability index disregarding scale effects isβ=3.0 corresponding to a failure probability Pf=1.3⋅10-3. Corrected for scale effects, Figure 2. 5 gives β=2.07corresponding to Pf=1.9⋅10-2, an increase in failure probability by more than a factor of 10.

-1,5

-1

-0,5

0

0,5

1

1,5

2

0 20 40 60 80 100

M

BET

A

1,00

0,95

0,90

0,80

0,70

0,60

0,50

0,40

0,30

0,20

0,10

0,00

Figure 2. 4 Series system, dimension M, ββββ=2

1

1,2

1,4

1,6

1,8

2

2,2

2,4

2,6

2,8

3

0 20 40 60 80 100

M

BET

A

1,00

0,95

0,90

0,80

0,70

0,60

0,50

0,40

0,30

0,20

0,10

0,00





27

2,5

2,7

2,9

3,1

3,3

3,5

3,7

3,9

4,1

0 20 40 60 80 100

M

BET

A1,00

0,95

0,90

0,80

0,70

0,60

0,50

0,40

0,30

0,20

0,10

0,00


2.5.2 Probabilistic Design Format

A probabilistic design can be performed by using the following design format

β βcalculated or P Ptarget f calculated f target≥ < (2.24)

where βcalculated is the reliability index calculated by reliability analysis and β target is a targetvalue that should be fulfilled for the design to be found acceptable.

Different procedures may be used to determine the target reliability level:

• Calculation of reliability related to established design practice• Reliability analysis compared with risks accepted by the society• Economic considerations

Economic considerations may be used to determine optimal safety levels for a structure includingthe different costs involved in construction, possibility for repair and the consequence cost of apossible failure.

2.5.3 Calculation of Reliability Related to Established Design Practice




28

The calculated value of the reliability index is a function of analysis methods used anddistributions assumed in the analysis. Therefore, one should not directly compare reliabilityindices as obtained from different models and sources.

A calculation of βcalculated and β target should be based on the similar assumptions aboutdistributions, statistical and model uncertainties. It is thus understood that Eq. (2.24) is not con-sidered to be unique when using different distribution assumptions and computationalprocedures. The value of the target reliability level may be dependent on how the reliability iscalculated.

It should be noted that the industry is in a transition period from pure experience based toreliability based design codes. As the physical models describing the failure mechanisms areimproved and more calibration studies are carried out, the knowledge of target reliabilities inexcising codes will be improved. Today the inherent target level is not precisely known or itshould hardly be presented without a number of assumptions used for its calculation due to lackof precise knowledge of physical models and lack of data. Furthermore, the use of reliabilityanalysis is new to the industry and the reliability models are updated from time to time. If anauthor claim that the target reliability in a specific code is β target this will relate to the modelsused. Another model refined during the years would give a different claimed β target .

Owing to dependence on assumptions and analysis models used for reliability analysis the word"reliabilities" in a frequency interpretation of observed structural failures cannot be used in anarrow sense. And due to the unknown deviations from ideal predictions the computed failureprobabilities are often referred to as nominal failure probabilities. This is due to the recognitionthat it is difficult to determine the absolute value of the inherent safety in e.g. design codes byreliability analyses. The requirements to absolute reliability levels may be avoided by performinganalysis on a relative basis. I.e., a similar model and distributions are used for calculation ofβ target as for βcalculated . By relating the reliability analysis to relative values it may be possible touse probabilistic analysis for design without a specific requirement to an absolute targetreliability level. Such considerations are included in the NPD regulations accepting probabilisticanalysis by stating: "The design may be based on a more complete probabilistic analysis,provided it can be documented that the method is theoretically suitable, and that itprovides adequate safety in typical, familiar cases." Reference is made to NPD (1994).

2.5.4 Reliability Analysis Compared with Risks Accepted by Society

Probabilities of failure from structural reliability analysis may be compared with risks associatedwith other activities in the society. These risks are, in some way, experienced to be acceptable bythe society. For a comparison between the risk levels obtained from statistics on the one handand probabilities of failures obtained from reliability analyses on the other, the followingdifferences should be kept in mind: • Reliability analyses do not normally account for gross errors which are the most frequent

reason for structural failures as reported by statistics. • Statistical and model uncertainties are normally included in the reliability analyses. These

uncertainties may lead to larger failure probabilities than those due to the physical uncertaintyalone.




29

• The results from the reliability analysis depend on the modelling and the description of thetails of the distributions, which are difficult to assess in most cases.

Table 2.2 Statistics for Canada in 1985

Cause or activity Annual risk/10,000 personsAll causes

All causes by age20-2440-4460-64

Heart diseaseCancerLung cancer

All accidentsMotor vehiclesAirplane (crew)

71.5

9.019.3133.4

23.018.34.5

5.31.71-2

According to Jordaan (1988), the annual risk in accidents involving a motor vehicle is 1.7x10-4per annum in Canada, whereas the risk for airplan accidents for a crew member is in the range 1-2x10-4 per year, see Table 2.2. The present level of air safety is generally perceived asacceptable and air travel has been a well regulated industry. The risk associated with motorvehicles is seen in society as high, but it is in some way accepted. For more details on riskconsiderations see, e.g., Lotsberg (1990b).

In Norway, mortality statistics are issued annually by the Central Bureau of Statistics (1991).Causes in 48 categories are listed, given by age groups. Some key figures are extracted and givenin Table 2.3.

Table 2.3 Death by age and cause in Norway 1990

Causes \ Age Of100,000

<1 1-6 7-14 15-24 25-34 35-44 45-54 55-64 65-74 75-

All Causes 1086 428 111 92 383 537 957 1525 3864 10187 27966

Car accidents 7.9 2 7 7 106 47 38 26 34 30 37

Deaths by accidents are given in Table 2.4, from Gaarder (1992).

A common logical way of defining an acceptance criterion based on individual safety would be:From Table 2.3 it is noted that the mortality rate in Norway is lowest for the age group 7-14years, corresponding to 0 92 10 3. ⋅ − . The causes are dominated by natural and accidents related toleisure activities. An acceptance criterion of an industrial activity could be to state that anactivity contributing 1% to 10% to this individual risk is acceptable to the workers, thus givingannual target reliabilities 10 104 5− −− .

Arguments like this may seem acceptable. However, for large accidents the public does not ingeneral accept this way of "individual safety thinking".




30

Table 2.4 Occupational deaths/10,000 persons, Norway, 1986-1990

1986 1987 1988 1989 1990Land Transport 5.00 4.20 3.62 3.31 3.62Railway 3.42 0.85 0.86 0 0.28Sea Transport 4.11 4.34 3.09 3.53 1.87Fisheries 5.78 8.88 4.24 8.02 4.52Shipping 3.45 2.22 2.55 1.85 1.03Oil activities 0.56 1.12 0 1.08 1.10Aviation 4.04 10.28 6.67 10.28 12.96Agriculture & forestry 1.23 1.09 0.95 9.8 0.91Mining and quarry 0 1.44 1.52 0 1.59Industry 0.32 0.22 0.29 0.09 0.13Other 0.27 0.31 0.20 0.20 0.19Total 0.61 0.60 0.46 0.45 0.42

80-90 70-790

2

4

6

8

10

12

80-90 70-79

TotalIndustryAviationOilShippingFisheriesLandtrnsp

Figure 2.7 Deaths per 100 worklives of 40 years, 1970-1990, from Gaarder (1992)

If the target reliabilities are based on individual risk, the targets should be corrected for theexpected number of fatalities. Such societal risk criteria are given for a large number ofregulatory bodies as FN Curves, see Table 2.5. (F=Frequency=The accepted frequency of anaccident and N=Number of fatalities). The most used curves are linear in lnF and lnN orF N m= .

The slope in the FN curve between 1 and 2 may also be found in observed data from Litai et al.(1981). As a guide, it is therefore suggested to use such a risk aversion factor in acceptancecriteria with m = −1.

Table 2.5 Official societal risk criteria




31

FNCurveslope(m)

MaximumTolerable

intercept withN=1

Negligibleintercept

With N=1

Limit on N

VROM, The Netherlands(New Plants) -2

10 3− 10 5− -

Hong Kong Government(New Plants)

-1 10 3− 10 5− 1000

Health&SafetyCommision,UK(Existing ports)

-1 10 1− 10 4−-

2.5.5 Target Failure Probabilities Based on Historical Data

Target reliabilities may be decided on historic accidental statistics. The decision will involve thefollowing steps

Table 2.6 Degree of Damage vs. Type of Accidents with Offshore Units

Number of Accidents. All Units, Worldwide, 1980-93 (WOAD, 1994)

DEGREE OF DAMAGETYPE OF

ACCIDENTTotalLoss

SevereDamage

SignificantDamage

MinorDamage

Insignific.Damage

Total

Anchor failure - - 17 28 6 51Blowout - 4 12 24 76 116Capsize 49 60 1 1 1 112Collision 4 24 23 21 3 75Contact 1 10 60 70 8 149Crane accident - - 3 8 6 17Explosion - 3 16 19 25 63Falling load 1 2 28 18 28 77Fire 19 37 55 61 135 307Foundering 11 2 3 2 - 18Grounding 5 9 14 5 1 34Helicopter acc. - - - 14 2 16Leakage 2 3 9 6 2 22List 3 5 12 6 5 31MachineryFailure

- - - 5 6 11

Off position - - 1 1 7 9Spill/release - 6 27 120 116 269StructuralDamage

6 24 105 24 2 161

Towing accident - 2 1 - 36 39Well problem - - - 2 17 19Other - 1 5 14 24 44Total 101 192 392 449 506 1640

1. Find relevant data on the limit state in question2. Compare this to other causes




32

3. Decide on acceptability of present statistics. Is it acceptable that the offshore industry hashigher accident rates than onshore?

4. The calculated risk should not contribute significantly to this risk level. A reduction of 10%compared to the target from all causes could be based on accidental statistics, see Table 2.6.

Table 2.6 shows accidents in the offshore industry filed in the WOAD (1994) data base. It is seenthat approximately 6-8% (structural damage and leakage) of the total losses are due to reasonsaccounted for, or that could be accounted for, in SRA. Among the severe damages, 12-14% of thereasons may be accounted for in SRA. As a guideline, one might therefore say that, if theaccident statistics is judged to be acceptable, the target reliability in SRA should be such that thestructural failure probability does not exceed a probability which is a factor 10 1− times theoverall failure probability according to such statistics. Hence, this should lead to quantification ofthe target reliability of the complete offshore unit as resulting from all significant structuralfailure modes. The target reliabilities for the individual failure modes should then, accordingly,be even higher.

Some comments that should be made to the table we concluded on:

When thinking about the severity of the potential accident it is legitimate to think in societal riskterms. For example in cases where consequences would differ a factor of ten in potentialfatalities, the target reliability should also change a factor 1/10. If accidents are compared wherethe accidental development scenario indicates that most personnel would have high chances ofsuccessful evacuation the safety target may be decreased. The base line in the figure is thataccidents which may lead to fatalities should have a target reliability of 10 5− . Severe accidentswith small but non-negligible risks of fatalities should have target reliabilities of 10 4− .In cases of progressive collapse the target should be based on the risk concept, accounting for theprobability of the accidental event and the severity of the consequence of the accidental load.

PSRA TabulatedAccidentQRA

Target Target P P= / (2.25)

where

PSRATarget = target safety level for SRA

PTabulatedTarget = target safety level from Table 2.7

PAccidentQRA = probability of accident determined from QRA

2.5.6 Target Failure Probabilities in Design Codes

In the Norwegian part of the North Sea a limiting target value in risk analysis of 10 4− per annumhas been used the last decennium. According to Fjeld (1978), the theoretical annual probabilityof defined failures at the ultimate limit state of the NPD regulations is in the order of 10 4− to10 5− , somewhat lower for concrete structures than for steel structures. This was also the basis forthe DNV rules for construction of fixed offshore structures in 1977. Reference is made toAppendix B for the Eurocode, CSA and NKB.

2.5.7 Recommended Method




33

It is recommended to relate the target reliability to that of well-known cases, i.e., the procedureoutlined in Section 2.5.3 is recommended. In cases where it is difficult to follow thisrecommendation, Table 2.7 may be resorted to.

The target failure probabilities in Table 2.7 are frequently referred to. This table originally refersto NKB (1978). Although some adjustments of definitions of columns and rows in Table 2.7 havebeen performed, the target values are the same.

The target failure probabilities in Table 2.7 are given for a reference period of 1 year, and shouldbe treated as operational or notional probabilities and not as relative frequencies.

βcalculated should be derived from an analysis model considered to give results on the conservativeside when used together with target values from Table 2.7.

The failure consequences may be interpreted as follows:

Table 2.7 Target annual failure probabilities and corresponding reliability indices

Failure consequences

Failuredevelopment

Not serious Serious Very serious

Ductile failurewith reservestrength capacity

p = 10-3

β = 3.09

p = 10-4

β = 3.71

p = 10-5

β = 4.26Ductile failurewith no reservecapacity

p = 10-4

β = 3.71

p = 10-5

β = 4.26

p = 10-6

β = 4.75Brittle behaviourin terms offracture orinstability

p = 10-5

β = 4.26

p = 10-6

β = 4.75

p = 10-7

β = 5.20

Not serious:A failure implying small possibility for personal injuries. The possibility for a pollution is smalland the economic consequences are considered to be small. These failure consequences are notconsidered to be a safety or environmental threat, the target reliability may therefore be decidedbased on cost-benefit analysis.

Serious:A failure implying possibilities for personal injuries/fatalities or pollution or significanteconomic consequences.

Very serious:A failure implying large possibilities for several personal injuries/fatalities or significantpollution or very large economic consequences.




34

Note that for the serious and very serious failure consequences a cost-benefit analysis may resultin higher target reliabilities than those implied by the safety and environmental considerations.

The evolution of a failure should be considered in view of the actual failure mode. For example,the evolution of a fatigue failure may be classified different from that of a failure in the ultimatelimit state. An example is given by Lotsberg (1991), in which the redundancy of a tether group ofa Tension Leg Platform is considered to be less for the ultimate limit state than for the fatiguelimit state and the progressive collapse limit state.

2.6 Common Mistakes in the Use of SRA

Some errors in code calibration and probabilistic design relating to target reliability are knownand quite common.

• Safety factors are not updated when new models are used• Safety factors are changed by studying the effect of a change in one parameter, without

realising that the load model, the response model, the capacity function and the targetreliability are dependent

• Sometimes older codes do not state explicitly the purpose of the code check, e.g. the fatiguecheck is implicit in an ultimate limit states (The code writers were confident that if theultimate limit state code was fulfilled there would not be a fatigue problem). When such codesare calibrated such non-stated objectives is easy to forget.

• The reference period is not correct, e.g., lifetime vs. one year (Section 2.5.1)• The scale effects are not properly dealt with (Section 2.5.1)• The existence of multiple failure modes, using from the same target reliability budget is not

properly considered (Section 2.5.5)• Some of the uncertainties are not included in the analysis, e.g., statistical uncertainties or

model uncertainties.• Historical data are accepted as basis for target reliabilities without realising that some

historical records are unacceptable• Implicit target reliabilities from other previous codes are used without realising that the

reliabilities are unacceptable or conservative or relates to incomparable limit states orconsequence classes.

• Characteristic values are given an uncertainty, instead of a distribution for the variable thecharacteristic value represent

• The models are biased in competence, e.g., very detailed material models with no uncertaintyon the loads or vice versa

• The distribution representing a stochastic variable in a limit state is confused with a variabledescribing the populations in the definition of the scope. The following is a small example

Example: The long-term distribution of the 10-minute mean wind speed is often represented by aWeibull distribution

F u uaU

b10

1( ) exp( ( ) )= − − (2. 26)

Owing to spatial variation of the wind loading regime, the coefficients a and b may vary frompoint to point within a geographical area considered for the scope of a code. This variability in aand b is not to be represented as a probability distribution in the reliability analyses that are usedfor the code calibration. A structure to be designed by the code is supposed to be subject to a site-




35

specific design, such that local values of a and b are to be used in the wind speed distribution, andthe only uncertainty in a and b that possibly ought to be represented by a probability distributionin the reliability analyses is statistical uncertainty when available data for estimation of the local aand b values are limited. The point-to-point variability of a and b is only to be reflected throughthe selection of representative design cases in accordance with the demand function for the scopeof code.

2.7 Standard Problems, Reasons and Remedies Relating to Codes

When a design code is found to give unsafe designs and/or unneccesarily conservative and costlydesigns, some of the reasons may be described and remedied by use of SRA. Such cases arelisted in Table 2.8.

2.8 Competence Requirements

A practical application of SRA, for probabilistic design and reliability based code calibration,will generally require special competence that cannot be expected to be covered by one singlespecialist. A typical situation will be that competence on a high level is required both for the loadmodelling, the structural strength representation, as well as the reliability formulation.

It is therefore recommended that personnel responsible for a reliability analysis shall haverelevant training and competence to undertake or supervise the execution of such an analysis aswell as have relevant competence in the particular area of application. At least five years ofrelevant experience should be required.

Table 2.8 Reasons and remedies for unsafe or overly safe designs

Problem Reason RemedyIt has been found that the There is an error in the limit Correct limit state. The target




36

original code give unsafedesign solutions in a numberof cases

state formulation reliability cannot be reused in suchcases.

There is an error in thestochastic models/data.

Correct stochastic models or collectnew data. The target reliability cannot be reused in such cases

The models are correct, thetarget reliability is to low.

Recalibrate with the existing modeland with acceptable target reliability

The code has never beencalibrated

Calibrate the code as described in theguideline

Listed or other reasons Consider probabilistic designIt has been found that theoriginal code give unsafedesign solution in specialcases

The code may have beendeveloped for a scope notcovering this special case

Recalibrate the code with an extendedscope, e.g. other materials,environments, design concepts(different response characteristics).Make sure that the limit stateformulation and statisticalinformation is correct for the newscope. Target reliabilities may bereused.In this case: Consider for simplicityto do probabilistic design



Listed or other reasons Consider probabilistic designIt has been found that thecode gives conservative/costlydesign solutions in a numberof cases

There is an error or conservativeassumption in the formulation ofthe limit state

Remove error and/or conservativeassumption. Beware, the targetreliability may originally have beenselected to be on the safe side. Thetarget reliability should not be reused,without good documentation.

There is an error in thestochastic models/data.

Correct stochastic models or collectnew data. The target reliability cannot be reused in such cases

The models are correct, thetarget reliability is unnecessarilyhigh.

Recalibrate with the existing modeland with acceptable target reliability,Chapter 2.



Listed or other reasons Consider probabilistic designIt has been found that thecode gives conservative/costlydesign solutions in oneparticular case

The code may have beendeveloped for a scope notcovering this particular case

Recalibrate the code with an extendedscope, e.g. other materials,environments, design concepts(different response characteristics).Make sure that the limit stateformulation and statisticalinformation is correct for the newscope. Target reliabilities may bereduced. In this case: Consider forsimplicity to do probabilistic design.

2.9 General Requirements to an SRA




37

The results obtained from an SRA and the interpretation of these results should not relieve theengineer of his responsibility to exercise good engineering judgement. In any given SRA, thefollowing evaluation methodology is to be undertaken and satisfactorily documented:

1. Failure criteria are to be formulated in terms of limit state functions for each relevant failuremode. In order to verify that a limit state function is correctly defined, one deterministiccalculation by means of the defined limit state function shall normally be carried out for aparticular set of the governing input variables.

2. When more than one limit state govern the reliability of a structural component, or when morethan one component constitute a structure being analysed, the corresponding system reliabilityis to be evaluated, in addition to the individual component reliabilities.

3. Relevant stochastic parameters of each uncertain basic variable in the limit state function areto be identified. In cases where the asymptotic behaviour of a distribution is not well definedthe stochastic characteristics are to be selected based upon conservative considerations.

4. Considerations shall be given to time-dependent degradation of the resistance of the structureor component analysed, e.g. corrosion, creep, shrinkage, fatigue etc.

5. For all relevant failure modes the reliability is to be analysed and results presented.6. The type of reliability analysis undertaken is to be suitable for the limit state under

consideration. In this context, analytical reliability methods (FORM/SORM) are not to beapplied for probability figures greater than 0.05. Further, when simulation techniques are usedto estimate the probability of failure, the number of simulations required is to be appropriatefor the expected order of magnitude of the probability of failure. The choice of simulationmethod and number of simulations should always be documented.

7. The resulting reliability is to be evaluated for sufficiency. To the extent possible, targetreliabilities should be established according the principles set forth in Section 2.5.7.

8. The most probable realisation of the stochastic variables at failure, referred to as the designpoint in SRA, is to be evaluated to ensure that it has a sound physical interpretation.

9. The results of the reliability analysis are to be evaluated with respect to sensitivityconsiderations. Such sensitivity evaluations are to include relevant considerations ofparametric sensitivities for changes in design parameters. Uncertainty importance factorsshould always be documented for all stochastic variables.

2.10 Standard List of Content for an SRA Analysis Report

It is recommended that an SRA analysis, its assumptions and results are documented in a report.The contents of such a report should contain the following items:

• Introduction to problem of analysis with assumptions and provisions.• Probabilistic analysis method.• Theory of physical or mechanical model for representation of physical problem.• Limit state function formulation.• Probabilistic and deterministic modelling, i.e., input to analysis in terms of stochastic

variables and deterministic parameters, e.g., based on data.• Reliability analysis.• Results of reliability analysis, including reliability index, failure probability, uncertainty

importance factors, and parametric sensitivity factors.• Discussion and conclusions.




38

References

Apostolakis, G. (1990), "The Concept of Probability in Safety Assessment of TechnicalSystems", Science, Vol. 250, Article 1359, pp. 1360-1364.

Apostolakis, G. (1993), "Commentary on Model Uncertainty", Workshop on Model Uncertainty:Its Characterization and Quantification, Annapolis, Maryland, October 20-22, 1993.

Bayes, T. (1763), "An essay towards solving a problem in the doctrine of chance", PhilosophicalTransaction of the Royal Society, 53, pp. 370-418.

Central Bureau of Statistics in Norway (1991), Statistical Yearbook of Norway, Oslo, Norway.

De Groot, M.H. (1988), in Accelerated Life Testing and Expert Opinions in Reliability, C.A.Clarotti and D.V. Lindley, Eds. North Holland, Amsterdam, 1988, pp. 3-24.

Ditlevsen, O. (1981), "Fundamental Postulate in Structural Safety", Journal of EngineeringMechanics, ASCE, Vol. 109, No. 4, August 1983. pp 1096-1102.

DNV (1977), Rules for the Design, Construction and Inspection of Offshore Structures, DetNorske Veritas, Høvik, Norway.

DNV (1994), WOAD, World Offshore Accident Databank, Statistical Report 1994, DNVTechnica.

DNVR (1993), "PROEXP Probabilistic Explosion Modeling", DNV Research Report No. 93-2081.

Finetti, B.D., (1974), Theory of Probability, Wiley, New York, 1974, Vol. 1 and 2.

Fjeld, S. (1978), "Reliability of Offshore Structures", Journal of Petroleum Technology, pp.1486-1496. OTC Paper No. 3027, May 1978.

Gaarder, S. (1992), "Dødsrisiko i skipsfart og andre yrker 1970-1990", DNV Research Report.

Hauge, L.H., R. Løseth, and R. Skjong (1992), "Optimal Code Calibration and ProbabilisticDesign", Proceedings, 11th International Conference on Offshore Mechanics and ArcticEngineering, Vol. II, pp. 191-199, Calgary, Alberta, Canada.

Jordaan, I.J. (1988), "Safety levels implied in Offshore Structural Design Codes: Application toCSA Program for Offshore Structures." CSA Standard Division February 1988.

Kaplan, S. and B.J. Garrick (1981), On the Quantitative Definition of Risk, Risk Analysts, Vol 1.,pp. 11-27.

Keynes, J.M. (1921), A Treatise on Probability, St. Martin’s Press (1952), New York.

Kinchin, G.H. (1978), Assessment of Hazards in Engineering Work Proc. Instn. Civ. Engrs. 64:431-38.

Lind, N.C. (1973), "The Design of Structural Design Norms", Journal of Structural Mechanics,Vol. 1, No. 3, pp. 357-370.




39

Lindley, D.V. (1985), Making Decisions, Wiley-interscience, New York, ed. 2, 1985.

Litai, D., D.D. Lanning, and N. Rasmussen (1981), "The Public Perception of Risk", Society forRisk Analysis International, Workshop on the Perceived Risks, Washington, D.C., pp. 213-223.

Lotsberg, I. (1990), "Target Reliability Index. A Literature Survey." Veritas Research Report No.90-2023, April 1990.

Lotsberg, I. (1991), "Probabilistic Design of the Tethers of a Tension Leg Platform," OMAE,Houston, Texas, February 1990, Journal of Offshore Mechanics and Arctic Engineering, Vol.113, May 1991.

Murley (1994), "Perspectives on Reactor Safety", Lecture Note from Massachusetts Institute ofTechnology Nuclear Power Safety Course: Part 1. MIT July-18-22, 1994.

NKB (1987), "Guidelines for Loading and Safety Regulations for Structural Design", Report No.55E, June 1987.

NKB (1978), (NKB=The Nordic Committee on Building Regulations), Recommendations forLoading and Safety Regulations for Structural Design. NKB-Report No. 36, Copenhagen,Denmark, Nov. 1978.

Norwegian Petroleum Directorate (1994), “Regulations Relating to Loadbearing Structures in thePetroleum Activities.”

NRC (1975), Nuclear Regulatory Commission, Reactor Safety Study, WASH-1400, Washington,D.C. , Government Printing Office (1975).

Otway, H.J. and J.J. Cohen (1975), "Revealed Preferences: Comments on the Starr Benefit-RiskRelationships", International Institute for Applied System Analysis. Vienna, Austria.

Parry, G.W., (1988), On the Meaning of Probability in Probabilistic Safety Assessment,Reliability of Probability on Probabilistic Safety Assessment, Reliability Engineering and SystemSafety, Vol 23, pp 309-314.

Rowe, W.D. (1977), An Anathomy of Risk, Wiley, New York

Savage, L.J. (1954), The Foundation of Statistics, J.Wiley, New York.

Starr, C. (1969), 'Social Benefits vs. Technological Risk', Science, 165: 1232-38.

Swain, A., and Guttmann (1983), Handbook of Human Reliability Analysis with Emphasis onNuclear Power Plant Applications, U.S. Nuclear Regulatory Commission, Technical ReportNUREG/CR-1278.

Further Reading




40

Major hazard aspects of the transport of dangerous substances (1991), HMSO, ISBN 0 11885699 5.

Risk assessment: a study group report (1983), The Royal Society, ISBN 0 85403 208 8.

Risk criteria for land use planning in the vicinity of major industrial hazards, HMSO, ISBN 0 11885491 7.

The development of risk acceptability criteria for the BP Group (1990), CSS Report No 04-90-0014.

The use and value of quantitative risk assessment (QRA) and its development within the BPGroup (1990), GSC Report No-04-90.0005.

Anderson, E.A. (1989), "Scientific trends in risk assessment research", Tox Ind Health, Vol. 5,pp. 777-790.

Chemical Industrial Associated (1987), A guide to hazard and operability studies.

Cooper, M.G. (ed.) (1985), Risk: man-made hazards to man, Oxford University Press, ISBN 0 19854155 4.

Dawson, J. (1987), Living with risk: the British Medical Association guide, John Wiley & Sons,ISBN 0 47191598 X.

Dept. of Energy (1991), Interpretation of major accidents to the environment for the purpose ofthe CIMAH Regulations.

Dept. of Environment (1990), Circular 20/90. (Welsh Office Circular 34/90). EC Directive onprotection of groundwater against pollution caused by certain dangerous substances (80/68/EEC)

Douglas, M. and A. Widawsky (1982), "How do we know the risk we face? Why risk selection isa social process", Risk Analysis, Vol. 2, No. 2, pp. 45-52.

Ecetox (1991), "Emergency exposure indices for industrial chemicals", Technical Report No. 43,European Chemical Ecology and Technology Center, Brussels, Belgium.

HSE (1991), A guide to the Control of Industrial Major Accident Hazards Regulations 1984,HS(R)21, (Rev) HMSO 1991, ISBN 0 11 885579 4.

Kleindorfer, P.R. and Kunreuther, H.C. (eds.) (1987), Insuring and managing hazardous risks.From Seveso to Phopal and beyond, Springer Verlag, Berlin, Germany, ISBN 3 5401 17732 9.

Lord Zukerman (1980), "The risks of a no-risk society", The Year Book of Word Affairs 1980,Vol. 34, Stevens & Sons, London, England, ISBN 0 420457305.

Lowrance, W.W. (1976), Of acceptable risk: science and determination of safety, WilliamKaufman, Los Altos, California, ISBN 0 913232 31 9.

Press, W.P. and A.M. Ehrlich (1990), The EPA’s risk assessment guidelines.




41

RCEP (1988), Twelfth report, Best practiable environmental option, HMSO, CM 310, ISBN 0101031 025.

RCEP (1991), Fourteenth report, GENHAZ. A system for the critical appraisal of geneticallymodified organisms to the environment, CM 1557, HMSO, ISBN 01 01155727

Rimington and Pape (1988), Nuclear power performance and safety, Volume 3; Safety andinternational cooperation, International Atomic Energy Agency, Vienna, Austria, IAEA-CN-48/35. Available from HMSO, ISBN 9 20050281.

Slovic, P. (1986), "Informing and educating the public about risk", Risk Analysis, Vol. 6, No. 4,pp. 403-415.

Star, C. (1985), "Risk management, assessment and acceptability", Risk Analysis, Vol. 5, No. 2,pp. 57-102.

Stringer, D.A. (1990), "Hazard assessment of chemical contaminants of soil", Ectox TechnicalReport No. 40, European Chemical Ecology and Technology Center, Brussels, Belgium.

Weinberg, A.M. (1985), "Science and its limits: the regulators dilemma", Issues in Science andTechnology, Vol. II, No. 1, pp. 59-72.

Wilson, R. and E.A.C. Crouch (1987), "Risk assessment and comparisons: an introduction",Science, Vol. 236, pp. 267-270.

—A—Accident statistics, 32Accidental load, 14, 32Aleatory uncertainty, 12

—B—Bayes theorem, 11Bias, 24Buckling, 18

—C—Characteristic load, 17, 19, 21Characteristic resistance, 17, 19Characteristic value, 18, 20, 22, 24, 34Code, 18, 19, 21

calibration, 18, 21, 23, 34, 35objective, 21scope, 21, 22, 23, 35

Crack growth, 12, 25Current, 21, 22, 24

—D—Damage, 32Data space, 21

Dead load, 21Demand function, 21, 35Design code, 9, 16, 17, 18, 19, 21, 22, 24, 28, 32, 35Design format, 17, 18, 27Design life, 24Design point, 18, 19, 20, 21, 22, 37Design value, 18, 20, 22

—E—Epistemic uncertainty, 11, 12Error

gross, 13, 14, 16, 24, 28human, 13

—F—Failure consequences, 33, 34Failure mode, 18, 19, 21, 22, 24, 32, 34, 37Failure probability, 12, 20, 24, 26, 32, 37

conditional, 24Fatigue, 12, 16, 20, 34, 37Fatigue crack growth, 12FORM (First-order reliability method), 37Fracture mechanics, 12Fracture toughness, 16




9

—G—Geometry function, 12, 25Gross error, 13, 14, 16, 24, 28

—H—Hazard identification, 9Human error, 13

gross, 13, 14, 16, 24, 28Human reliability, 9

—I—Importance factor, 11, 19, 22, 37Inspection, 12, 16, 24

—L—Limit state, 12, 18, 19, 20, 21, 22, 23, 24, 25, 31, 32,

34, 35, 36, 37function, 12, 19, 20, 22, 24, 25, 37ultimate, 18, 32, 34

Load, 14, 16, 17, 18, 19, 20, 21, 24, 25, 31, 32, 34, 35dead, 21factor, 17, 18permanent, 18wind, 34

Load combination, 18Load process (Excitation process), 24Lognormal distribution, 20

—M—Model, 10, 11, 12, 24, 25, 28, 33, 34, 36, 37

—O—Omission sensitivity factor, 11Organizational reliability analysis, 9, 10, 13, 14

—P—Parametric sensitivity factor, 37Partial safety factor, 17, 18, 19, 20, 21, 22, 23, 24Penalty function, 22, 23Potential, 19, 32Probability of failure, 9, 12, 20, 24, 25, 26, 32, 37

—Q—QRA (Quantitative risk analysis), 9, 10, 12, 13, 14, 15,

16, 32, 40Quality assurance, 14, 16Quantitative risk analysis, 9

—R—Redundancy, 34Regression analysis, 12

Reliability, 14, 16, 19, 22, 24, 28system, 37

Reliability analysis, 28Reliability index, 11, 16, 19, 20, 21, 22, 23, 25, 26,

27, 28, 37target, 19, 20, 21

Reliability method, 19, 20, 37first-order (FORM), 19, 20

Requalification, 24Resistance factor, 16Response, 10, 13, 34, 36

—S—Safety factor, 16, 17, 18, 19, 20, 21, 22, 23, 24

partial, 17, 18, 19, 20, 21, 22, 23, 24Safety format, 17Safety index (reliability index), 11, 16, 19, 20, 21, 22,

23, 25, 26, 27, 28, 37Scale effects, 24, 25, 26, 34Scope, 19, 21, 22, 23, 34, 36Scope of code, 21, 22, 23, 35Sensitivity factors, 11, 37

omission, 11parametric, 37

Simulation, 37Simulation methods, 37SORM (Second-order reliability method), 37SRA (Structural reliability analysis), 9, 10, 11, 13, 14,

15, 16, 24, 25, 32, 34, 35, 36, 37State, 9, 11, 12, 18, 19, 20, 21, 22, 23, 24, 25, 29, 31,

32, 34, 35, 36, 37Statistical uncertainty, 35Stress range, 12, 25Structural reliability analysis, 28System

parallel, 24series, 25

System reliability, 37

—T—Target reliability, 10, 19, 20, 21, 22, 27, 28, 32, 33,

34, 35, 36Target safety, 16, 24, 32

—U—Updating, 12

—W—Weibull distribution, 34Wind, 34Wind speed

mean, 34

—Y—Yield strength, 20, 21

2. RELIABILITY OF STRUCTURES 9 - DNVresearch.dnv.com/skj/OffGuide/CH2.pdf · · 2001-03-08Some...

Documents

Transcript of 2. RELIABILITY OF STRUCTURES 9 - DNVresearch.dnv.com/skj/OffGuide/CH2.pdf · · 2001-03-08Some...