A 10% load increase on an offshore platform stops being an internal decision of the design team. Under the US federal rule 30 CFR 250.910 , that change counts as a major modification, and the structure goes back for independent assessment. High risk in projects like these is defined by regulation, and the category sets its own requirements: how complete the verification has to be, how reproducible, and how often it gets rerun after a design change.
Who rechecks the calculation and under what authority
For platforms falling under the Platform Verification Program, the US regulator requires a certified verification agent. The rule sets three conditions:
- §250.916(a): the CVA performs an independent assessment of the design of the platform, major modification, or repair;
- §250.915(b): the agent must not function in any capacity that would create a conflict of interest, or the appearance of one;
- §250.912(a): the design verification plan includes abstracts of the computer programs used in the design process.
That last item reaches the analysis tools directly. The software belongs in the submission alongside geometry, loads, and boundary conditions.
Shipbuilding and offshore work run the same mechanism through classification societies. Independent review there begins at FEED and includes the reviewer’s own check analysis alongside an appraisal of the submitted documents.
One requirement holds across all of these regimes. An outside party has to arrive at the same numbers from the same input data. A calculation nobody can reproduce carries no evidentiary weight.
Where failures actually originate
The assumption that risk sits in the accuracy of the numerical solution does not survive contact with the statistics. David Brosnan, writing in Civil Engineering Practice, cites a long-standing estimate from the structural failure literature: 78% of failures trace back to human error in some form. The same paper breaks that distribution down further. Nearly four cases in ten come from errors of detailing. The share attributable to errors of computation runs lower.
A recent study by the TU Delft safety research group, published in the American Journal of Industrial Medicine , points at one specific design stage. The dominant error type involves load definition and accounts for 61% . The authors list other primary categories alongside it:
- ignoring individual loads;
- ignoring actual structural behavior;
- mistakes in calculations and drawings;
- inadequate instructions to the people carrying out the work.
Both findings converge on the same weak point: which loads were defined, and which joints made it into the scope of checking.
The detail left out of the checking scope
On 27 March 1980, the semi-submersible platform Alexander L. Kielland capsized in the North Sea at the Ekofisk field. Of the 212 people aboard, 123 died.
The investigation traced the collapse to a fatigue crack in bracing D-6. The crack started at a 6 mm fillet weld, the one attaching a flange plate for a hydroacoustic device to the primary bracing. The plate itself carried no load. Weld profile quality was poor, cold cracks were present in the groove, and ordinary cyclical North Sea wave loading was enough to drive the defect through.
An element outside the primary structure cut the fatigue life of the whole platform. The rigor applied to the main bracings never reached that joint.
On a model with tens of thousands of finite elements, no engineer holds the full list of details requiring fatigue assessment in their head, and the outcome depends on how complete the sweep is.
Coverage becomes a technical problem
Working by hand, the engineer sets the checking scope personally. They pick the elements judged critical and the load combinations judged governing. An error in that selection does not look like an error: the report simply has no line for it, and a missing line is invisible on a quick read.
Data transfer between analysis and checking stays manual as well. A peer-reviewed 2026 paper in Buildings records that finite element results sit outside the project information environment, that moving them into the checking stage is done by hand, and that the authors characterize this transfer as inefficient and error-prone. Their validation case, a bridge with prestressed girders, involved 1,800 data entries across four element types. That is a single span. A platform or a ship hull sits at another order of magnitude.
Automatic recognition reduces the amount of manual selection required. SDC Verifier automatically recognizes verification-relevant structural details such as welds, stiffened panels, beam members, joints and connections, then applies the selected verification checks across the defined load sets. Work that runs to several days by hand fits into minutes.
Completeness is the property that matters here. A full sweep returns a result for every recognized joint, including the ones a selective approach would have filed away as secondary.
Analysis of the damaged structure
High-risk projects get checked in a damaged state too. NORSOK N-004, 2022 edition with amendment AC:2024, carries detailed accidental limit state provisions: explosion, fire, ship collision, dropped object. The structure has to retain load-bearing capacity after local failure.
In analysis terms, this means repeating the full check cycle across a set of damaged model configurations, each differing from the intact model by the removal or weakening of specific members. The number of runs multiplies by the count of accidental scenarios under consideration.
Progressive collapse assessment done by hand usually compresses down to a handful of obvious scenarios because the rest do not fit the schedule. What drops out tends to be whatever looks less probable, though accidental analysis is precisely the discipline that deals with improbable events.
Lifting operations and failure history
An offshore lift is verified before work starts, and no second attempt is assumed. Requirements for these operations sit in DNV-ST-N001, extended in February 2024 to cover offshore wind. For crane supporting structures, a new edition of EN 1993-6 has been applied since March 2026, replacing the 2007 edition with its 2009 amendment.
Lifting equipment safety also depends on whether failure history is tracked across the service life. An IMCA safety flash , reproducing a UK regulator finding, describes the fatigue failure of 24 slew ring bolts on a tower crane. The turret and jib came down, killing the crane operator and a member of the public. The same bolts on the same crane had failed once before and were replaced without any investigation into the cause.
The fatigue mechanism repeated because nobody connected the first failure to the second.
What stays outside automation
The required reliability level does not shift with the degree of automation. Selection of the analysis scheme, assignment of boundary conditions, the makeup of base load cases, and judgment on whether a given code clause applies to a given joint all come down to the analyst’s competence.
Automation moves two other quantities: how many checks physically fit into the project schedule, and how completely they end up documented.
Construction Industry Institute data puts mean field rework above 3% of construction-phase cost on heavy industrial projects, with the roots of that rework traced back to the design and project definition stages. A missed check surfaces during erection, where the cost of correction is already fixed by the construction schedule.
In a regime where an independent agent has to reproduce the result, and where a 10% load increase legally triggers reassessment, coverage, and traceability are what determine whether the project survives outside review.
Photo: Gildo Cancelli via Pexels
CLICK HERE TO DONATE IN SUPPORT OF DCREPORT’S NONPROFIT MISSION
