A MONTE CARLO SIMULATION APPROACH TO THE PRODUCTION AVAILABILITY EVALUATION OF AN OFFSHORE INSTALLATION WITH OPERATIONAL LOOPS

Transcription

1 A MONTE CARLO SIMULATION APPROACH TO THE PRODUCTION AVAILABILITY EVALUATION OF AN OFFSHORE INSTALLATION WITH OPERATIONAL LOOPS ENRICO ZIO, PIERO BARALDI, AND EDOARDO PATELLI Dipartimento Ingegneria Nucleare - Politecnico di Milano via Ponzio 34/ Milan - Italy enrico.zio@polimi.it Abstract. The need of realistic models to evaluate the availability of multi-state, multi-output plants is felt in many advanced industries such as the nuclear, aerospace, oil and chemical ones. Indeed, often the complexity of the plant and of its maintenance and reconguration policies is such to render unfeasible its reliability/availibility evaluation by analytical models. In this paper we consider the problem of determining the production availability of an oshore installation in which three dierent kinds of production processes are carried out, under realistic operation and maintenance conditions which create operational loops in the system. A new systematic procedure for following, in a computationally convenient way, the time evolution of the multi-output plant production is proposed. 1. Acronyms and Abbreviations EC: Electro Compressor MCS: Maximum Cut-Sets mcs: Minimal Cut-Sets MC: Monte Carlo TEG: Try-Ethylene Glycol unit TC: Turbo Compressor TG: Turbo Generator 2. Introduction In this paper we present a Monte Carlo simulation model for the evaluation of the availability of a multi-state, multi-output oshore installation (Aven, 1993; Lisnianski and Levitin, 2003). The plant considered refers to a case study proposed as test case within the EU-sponsored Thematic Network SAFERELNET, under project number GTC A stochastic model of the plant evolution is developed from the standpoint of its production availability of three dierent outcomes and taking into account the components' reliability parameters, process capacities and operational dependencies as well as the corrective and preventive maintenance policies. The model is evaluated by Monte Carlo simulation in terms of the production level of the oshore installation considered. Date: 19th March

2 2 E.Zio, P.Baraldi and E.Patelli The reason for resorting to Monte Carlo simulation is that it provides the necessary exibility to describe the realistic aspects of system behavior, such as components degradation, corrective and preventive maintenance with stochastic or deterministic durations, limited number of repair teams and associated component repair priorities, which determine the system stochastic evolution and which are not easily captured by analytical models (Dubi, 1998; Marseguerra and Zio, 2002). 3. System description We consider the problem of determining the production availability of an oshore installation in which dierent kinds of production processes are carried out as shown in Figure 1. The oshore installation is designed for the extraction of ow from a well and the successive separation of the incoming ow in three dierent ows: gas, oil and water. The basic scheme of the oshore production processing is shown in Figure 2. Figure 1. Scheme of the oshore production plant Gas production. The gas, separated by the separation unit from the water and oil coming from the well, is rst compressed by two Turbo- Compressors (TCs), then dehydrated through a TEG (Tri-Ethylene Glycol) unit and nally exported. The maximum capacity of the separation unit for the gas is Sm 3 /d. Each TC can process a maximum of Sm 3 /d and the TEG unit is able to process Sm 3 /d at its maximum. The nominal capacity of the gas exported is Sm 3 /d at the pressure of 60 bar. The gas capacity for the components are shown in Table 1. A are is used for safety purposes and to burn the gas when it cannot be exported (i.e., the gas not compressed).

3 SAFERELNET task 7.5, Simulation for maintenance optimisation 3 Figure 2. The basic functioning scheme of the oshore plant. Component Maximum capacity [Sm 3 /d] TEG TC Separation unit Well Table 1. Maximum capacities of the components of the gas production process Oil production. The oil coming from the production well is separated by the separation unit and, after treatment, is exported through a pumping unit. The well can produce at its maximum m 3 /d of oil whereas the separation unit can process m 3 /d. The pumping unit and the oil treatment system can process all the oil coming from the separation unit: hence, in the perfect case of all units operating at their maximum capacity, m 3 /d of oil are exported. The capacities of the components for the oil production are summarized in Table 2. Component Maximum production [m 3 /d] Oil treatment Pumping unit Separation unit Well Table 2. Maximum capacities of the components of the oil production process.

4 4 E.Zio, P.Baraldi and E.Patelli 3.3. Water production. As for the oil production, the water coming from the well is separated by the separation unit and, after treatment, is reinjected in the eld in addition with sea water. The capacities of the components involved in the water production process are shown in Table 3. Component Maximum production [m 3 /d] Water treatment 7000 Pumping unit 7000 Separation unit 7000 Well 8000 Table 3. Maximum capacities of the components of the water production process Gas lift. To achieve the nominal level of production of the well, compressed gas is injected at the bottom. The scheme of this so-called gas lift is shown in Figure 3: a fraction of the export gas at the output of the TEG, is diverted and compressed by an electro-compressor (EC) and nally injected, at a pressure of 100 bar, in the well. Alternatively, the gas lift can be injected directly in the well at a lower pressure (60 bar), but in this case the production level is reduced to 80% of its maximum. When gas is not available for the gas lift, the production of the well is reduced to 60% of its maximum. The gas lift creates a rst operational loop in the plant because the input to the plant (i.e. the incoming ow of the well) depends on the output (i.e. the export gas) of the plant itself. The production levels of the well are summarized in Table 4 as a function of the gas lift pressure. Figure 3. Scheme of the gas lift. Gas lift pressure Gas [Sm 3 /d] Oil [m 3 /d] Water [m 3 /d] 100 bar bar bar Table 4. Production of the well for dierent gas lift pressures

5 SAFERELNET task 7.5, Simulation for maintenance optimisation Fuel gas generation and distribution. A certain amount of gas needs also to be distributed to the two TCs and the two turbo-generators (TGs) used for the electricity production (Figure 4). Each individual TG and TC consumes Sm 3 /d. Such amount of fuel gas is taken from the export gas at the output of the TEG unit. This establishes a second loop in the gas process scheme because the gas compressed by the two turbocompressors is needed to run the turbo-compressors themselves. Figure 4. Generation and distribution of the fuel gas Electricity power production and distribution. The electricity produced by the two TGs is used to power the TEG unit, the EC, the oil export pumping unit and the water injection pumping unit. The scheme of the electricity power production and distribution system is shown in Figure 5. Each TG is capable of producing 13M W of electricity, the pumping unit consumes 7 MW and the EC and TEG consume 6 MW each. In Table 5 the electric capacities of the components are summarized. Also here there is a loop in the system because the gas produced by the TEG unit is used to produce, through the connection with the two TGs, the electricity consumed by the TEG unit itself. Component Electricity Electricity production [MW ] consumption [MW ] TG 13 - EC - 6 Export oil pumping unit - 7 Water injection pumping unit - 7 TEG - 6 Table 5. Electricity production and consumption of the components of the system.

6 6 E.Zio, P.Baraldi and E.Patelli Figure 5. Electricity power production and distribution. 4. Component failures and repairs events In the proposed test case, only the failures of the TCs, TGs, EC and TEG are taken into account. All the other components of the system are assumed to be always in their perfect state of functioning. The TGs and the TCs can be in three dierent states (Figure 6): 0: As good as new 1: Degraded 2: Failed The EC and the TEG can be in two states (Figure 7): 0: As good as new 2: Failed Figure 6. Markovian diagram of the stochastic transitions of TCs and TGs components. λ ij (µ ij ) = failure (repair) rate for the transition from the state i to state j.

7 SAFERELNET task 7.5, Simulation for maintenance optimisation 7 Figure 7. Markovian diagram of the stochastic transitions of EC and TEG components. λ ij (µ ij ) = failure (repair) rate for the transition from the state i to state j. The Failed state is such that the function of the component is lost. The Degraded state is such that the function of the component is maintained but in this state the component has higher probability of going into the Failed state: therefore, also when in this state the component needs to be repaired. For simplicity, the times at which the degradation and failure transitions occur and the duration of the corrective maintenances (repairs) are assumed to be exponentially distributed, with values of the rates reported in Table 6. The failure rates are indicated with the greek letter λ whereas the transitions of repair are indicated with the greek letter µ. The policy of corrective maintenance to state 0 is based on a single maintenance team as specied in the next Section 5.1. Rate [1/h] Component number 1, 2 3, Transition TC TG TEG EC Table 6. Failure and repair rates of the components. 5. Maintenance policy 5.1. Corrective maintenance. Only a single maintenance team is available to perform repairs to the components of the system. This implies that only one component at a time can be repaired and when two or more components are failed at the same time, the maintenance team starts to repair the component which is most important with respect to system production.

8 8 E.Zio, P.Baraldi and E.Patelli However, once a repair is started, it is brought to completion even if another component with higher repair priority were to fail. The following priority of repair is introduced to handle the corrective maintenance dynamics: Level 1: utmost priority level. It pertains to components whose failures lead immediately to a total loss of the production process. Level 2: medium priority level. It applies to failures leading only to a partial loss of the export oil. Level 3: lower priority level. It pertains to failures which result in no loss of export oil. With these rules, one can assign a priority of repair to each component of the system. The priority of a component is dependent on the system state, as shown in Table 7. Priority Component System conditions 1 TEG - 1 TG other TG failed 1 TC other TC failed 2 EC - 2 TC other TC not failed 3 TG other TG not failed Table 7. Components repair priority level Preventive maintenance. The TGs, TCs and EC are subject to periodic preventive maintenance performed by a single team which is not the same team for the corrective maintenance. In order to maintain the production at a level as high as possible, preventive maintenance action cannot be started if the system is not in a perfect state of operation, i.e. while some repair or other preventive maintenance action is taking place which limits the system production. While a preventive maintenance action is performed on a component, the other operating components can obviously fail and corresponding corrective maintenance actions are immediately undertaken. These failure and repair occurrences do not cause any disturbance on the preventive maintenance action which goes on unaected. Four dierent types of preventive maintenance actions are considered for the test case, each one characterized by a dierent frequency and dierent mean duration (Table 8). For simplicity, the durations of the preventive maintenance are also assumed to be exponentially distributed variables with means as reported in Table Production re-configuration strategies When a failure occurs, the system is recongured in order to minimise, rst of all, the impact on the export oil and then the impact on the exported gas. The impact on the water injection is considered as to not matter.

9 SAFERELNET task 7.5, Simulation for maintenance optimisation 9 Type of maintenance Component Period [hours] Mean duration [hours] 1 TC,TG EC TC,TG TC,TG Table 8. Preventive maintenance strategy, in order of increasing period and mean duration. Depending on these strategies of production re-conguration, the dierent component failures have dierent eects on the three types of system production: TGs failures. When only one TG fails, the export oil, fuel gas and gas lift are still served but the EC and the water injection are stopped due to the lower level of electricity production. Indeed, the TG left running is unable to produce the electricity needed by the whole system and this requires that the EC and the pumping unit for the water injection be stopped. As a consequence, the export gas and the export oil decrease due to an overall lower production of the well caused by the unavailability of the gas lift high pressure. When both TGs are lost, all productions are stopped because the TEG unit is not powered and it is not possible to use gas which has not been dehydrated. TCs failures. When one TC is lost, export oil, export gas, fuel gas and gas lift are maintained. The non-compressed part of the gas is ared and therefore the quantity of export gas is reduced. When both TCs are lost, all productions are stopped because without compressed gas it is not possible to produce fuel gas and, consequently, electricity to power the components. TEG failures. When the TEG fails, the entire system is shutdown because it is not possible to use not dehydrated gas. EC failures. When the EC fails, the gas lift pressure decreases and so do the well productions of export oil and export gas. 7. The Monte Carlo simulation model As illustrated in Section 3, the system is composed by 4 components (2 TCs and 2 TGs) that may be in 3 dierent states and 2 components (EC and TEG) that may be in 2 states. The number of possible plant congurations is then = 324. However, from a functional analysis of the system it turns out that the congurations listed in Table 9 are not physically reachable. Looking at the rst conguration in Table 9, for example, it is not possible to have at the same time the TEG and both TGs failed because a TEG failure or the failure of both TGs would stop the production alone. Furthermore, since the two TCs and the two TGs are assumed to be identical, all the system states characterized by one TC failure or one TG failure are physically indistinguishable from the corresponding state with the other component failed. This would imply a further reduction of the number of plant congurations. On the other side, the problem is complicated by the

10 10 E.Zio, P.Baraldi and E.Patelli Faulty components Number of corresponding unreachable system states 2TGs+TEG 1 2TGs+TEG+EC 1 2TGs+TEG+1TC 2 2TGs+TEG+1TC+EC 2 2TGs+TEG+2TCs 1 2TGs+TEG+2TCs+EC 1 2TGs+2TCs 1 2TGs+2TCs+TEG 1 2TCs+TEG 1 2TCs+TEG+EC 1 2TCs+TEG+TC 2 2TCs+TEG+TC+EC 2 Table 9. Plant states that are not reachable. presence of only one repair team, thus requiring the strategy of repair priority illustrated in Section 5.1, and by the periodic preventive maintenance policies of Section 5.2. The presence of only one repair team increases the number of states because we have to know, for each plant state characterized by multiple failures, which component is under repair. For example, a system state characterized by the failures of the TEG, one TG and one TC must be splitted in three states with respect to the repair team which can act on any one of the three elements. In this view, the number of functionally dierent congurations becomes: ( ) ( ) ( ) ( ) ( ) = Also, since the periodic preventive maintenance policies based on a single maintenance team of Section 5.2 schedule dierent maintenance periods for identical components, the indistinguishable system states related to failures of one TG or one TC are lost. Finally, a further complication is given by the fact that a periodic maintenance action is actually performed only if the system is in a perfect state, otherwise it is postponed. This implies that the maintenance periods are conditioned by the state of the plant. All above reasons render impractical an analytic approach to the system unavailability evaluation. A Monte Carlo approach, instead, may easily take into account such realistic aspects of system operation. 8. The Monte Carlo approach In the following we detail how in practice an estimate of the solution may be pursued by Monte Carlo simulation approach which follows the individual fates of a large number of like-systems, one at the time, from the beginning and their operation to the end of their mission, i.e. to the mission time T miss (Dubi, 1998; Marseguerra and Zio, 2002).

11 SAFERELNET task 7.5, Simulation for maintenance optimisation 11 At a given time t, the system state, i.e. the conguration of its N c components, is represented by a point (k; t) in the system phase space, where k Z is the integer index that identies the system conguration (j 1, j 2,..., j Nc ) with j i being an integer which codes the state of the i-th component: for example, in our case for two-state components, the integer characterizing the component state might be 0 for the nominal state and 2 for the failed state and for three-state components the integer might be 0 for the nominal state, 1 for degraded state and 2 for the failed state (according to state denitions of the components done in Section 4). To each stochastic transition of a component from one state to another in the system phase space so that each MC trial, which simulates the system history during the mission time, generates a random walk of the system across several points. The set of trials of a standard analog MC calculation then provides as ensemble of realisations of the system stochastic life process from which ensemble averages of the quantities of interest are performed to obtain the relevant estimates. Each trial of a standard analog Monte Carlo simulation consists in generating a random walk which guides the system from one conguration to another, at dierent times (Marseguerra and Zio, 2002). During a trial, starting from a given system conguration k at time t, we need to determine when the next transition occurs and which is the new conguration reached by the system as a consequence of the transition. This can be done using the indirect approach that consists in sampling rst the time t of a system transition from the corresponding conditional probability density T (t t, k ) of the system performing one of its possible transitions at time t given that the previous transition occurred at time t and that the system, as a consequence of that transition, entered in state k. Then, the transition to the new conguration k actually occurring is sampled from the conditional probability C(k t, k ) that the system enters the new state k given that a transition has occurred at t when the system was in state k. The procedure then repeats from k at time t to the next transition until the time t reaches the mission time T miss. The time is suitably discretized in intervals t and l counters are introduced which accumulate the contributions to availability. We accumulate a unitary weight in the counters that correspond to the production level of the conguration k for all the time channels within [t, t]. After performing all the MC histories, the content of each counter divided by the time interval t and by the number of histories gives an estimate of the mean availability of the production level in that counter time. This procedure corresponds to performing an ensemble average of the realisations of the stochastic process governing the system life. 9. Production level identification In Section 7 we have seen that the plant may be in more than 400 different system states. From a physical analysis of the plant (Section 3), we have observed that the system can produce only 3 dierent amounts of oil and water and 6 dierent amounts of gas. From the combination of these productions, it turns out that the system can be in 7 dierent production levels of gas, oil and water. Obviously, to each plant state corresponds a given level of production, but for complex multi-state systems, like the one

12 12 E.Zio, P.Baraldi and E.Patelli under analysis, the a priori hand-specication of the level of production of each system state becomes excessively time-consuming and error prone. The problem of identifying the association between a given plant conguration and its production level can be approached similarly to what is done for the reliability analysis of systems with two production levels (full production and no production) and N c components with two states (working and failed). These systems are characterized by 2 Nc system congurations and each conguration, X, is associated to its level of production through the structure function, Φ( X): { Φ( X) = 0 if X is a working conguration of full production { Φ( X) = 1 if X is a (faulty) conguration of no production The usual procedure then requires that the fault tree of the system be constructed and the minimal cut sets (mcs) M i, i = 1,..., n mcs identied, such that Φ( X) can be written as (Barlow and Proschan, 1975): Φ( X) = 1 (1 M 1 )(1 M 2 )(... )(1 M nmcs ) By so doing, the problem of associating to each of the 2 Nc system congurations the corresponding level of (full or no) production is translated into the problem of identifying the mcs of the system. To extend this approach to the case of our interest of systems with p > 2 production levels (multi-state systems), the denition of structure function, Φ, is extended as: { Φm ( X) = l if X is a state of the system which provides a level l of production where a subscript m has been added to explicit the characteristic of multistates and the production level l may be equal to 0, 1,..., p 1, with the convention of considering the full production level as level 0. The dierent production levels, except the full production one, can then be treated as dierent plant faults. For the generic production level l = 1,..., p 1, one can construct a specic fault tree to evaluate the l-th production level structure function Φ l ( X) (= 0 if X is not a conguration of the production level l and to 1 viceversa) and identify the corresponding mcs l minimal cut sets. In our test case, the plant has 1 full production and 6 lower levels so that, correspondingly, 6 fault trees have been constructed and the minimal cut sets found (Table 10). To avoid the diculty of establishing an explicit relationship between the multi-state system structure function Φ m and the p individual production levels structure functions Φ l, we resort to a systematic procedure to associate a plant conguration X to a production level l = 0, 1,..., 6. For a given plant state X, we rst verify which of the p 1 structure functions Φ l is equal to 1, i.e., we look for the production levels for which X is a minimal cut set. However, a system conguration X may be a mcs for two or more fault trees

13 SAFERELNET task 7.5, Simulation for maintenance optimisation 13 Production Gas Oil Water mcs MCS Level [ksm 3 /d] [km 3 /d] [m 3 /d] 0 = full production X 5, X 6 X 5, X X 3, X 4 X 2 X 3, X 2 X X 3 X 5, X 3 X 6, X 4 X 5, X 4 X 6 X 2 X 3 X 5, X 2 X 3 X 6, X 2 X 4 X 5, X 2 X 4 X X 2 X X 2 X 5, X 2 X 5, X 2 X 6 X 2 X X 1, X 3 X 4, X 5 X 6 X 1 X 2 X 3 X 4 X 5 X 6 Table 10. Minimal cut sets and Maximum Cut Sets of the dierent production levels. X i = 1 if the component i is failed, i = 1,..., 6, following the number order of Table 6 of dierent production levels. For example, from Table 10 we see that if at a given time the plant is in a conguration characterized by components 3 and 5 failed (X 3 X 5 = 1), it could be associated to the 1-st production level (due to 5 being failed, i.e. X 5 = 1) as well as to the 2-nd or 3-rd production levels (due to 3 and 3 and 5 being failed, i.e. X 3 = 1 and X 3 X 5 = 1, respectively), but physically the plant can be producing at only one of the three levels. To overcome this conict in the association of a production level to a plant conguration, a procedure has been developed which assigns a priority to the production levels with respect to their mcs. The procedure is based on the introduction of the concept of Maximum Cut Sets (MCS). A MCS is dened as a set of failed components such that if any of the other components fails, the plant changes its level of production. For example X 2 is a MCS of the 4-th level of production because if any of the other components fail, the plant changes its level of production; on the contrary, X 3 X 5 is not a MCS for the 3-rd level of production because the additional failure of component 2 leaves the plant in the 3-rd production level (Table 10). The concept of MCS is needed to handle multi-state systems. Whereas a binary system in cut set (Φ( X) = 0), remains failed upon failure of another component, on the contrary, a multi-state system remains in its level of production only as long as any additional components transitions lead the system to a conguration which is comprised in the ensamble of its minimal cut sets and Maximum Cut Sets (the mcs can be interpreted as a sort of lower limits of a production level and the MCS as the higher limits). Thus, the ensemble of mcs and MCS of a production level denes the domain of operation of the plant at that production level: as long as the plant

14 14 E.Zio, P.Baraldi and E.Patelli conguration belongs to such ensemble, the plant continues to operate at this production level. To assign a priority to the dierent production levels and their mcs, they are ordered on the basis of the number of components which form the associated Maximal Cut Sets (i.e., the order of the MCS). The mcs of the production level with MCS of highest order are given priority 1 (in our case, those of production level 6). Then, priority 2 is assigned to the mcs of the production level with MCS of second highest order, and so on. Table 11 shows the priorities of the minimal cut sets for the case study. Note that a group of minimal cut sets of a given priority may contain minimal cut sets of dierent orders (i.e. formed by dierent numbers of components). For example, in our case, production level 6 is assigned highest priority and the corresponding group of minimal cut sets contains one cut set of rst order (X 1 ) and two of second order (X 3 X 4, X 5 X 6 ). Production level Priority X 1 X 3 X 4 X 5 X 6 2 X 3 X 5 X 3 X 6 X 4 X 5 X 4 X 6 3 X 2 X 3 X 2 X 4 X 2 X 5 X 2 X 6 4 X 5 X 6 X 2 Table 11. Priority of the minimal cut sets. When during the simulation the plant enters a given conguration X, the group of minimal cut sets associated to the production level of highest priority are veried, starting from the lowest order minimal cut set in the group, and if X satises any one of these minimal cut sets, it means that the plant is working at that level of production; otherwise, the group of minimal cut sets of the second highest priority production level are considered, and so on. If no mcs at any production levels are satised by the plant conguration, the system is in the full production level (level 0). Figure 8 summarizes the scheme of the systematic procedure developed to assign a level of production to a plant conguration. The procedure proposed allows solving the problem related to contradicting mcs. Indeed, considering again the example of components 3 and 5 being failed, the conict on whether the plant is operating at the 1st, 2nd or 3rd level of production is resolved because by proceeding orderly through the priorities one nds that at the second highest priority the minimal cut set X 3 X 5 is veried and thus the plant is working on production level 3.

15 SAFERELNET task 7.5, Simulation for maintenance optimisation 15 Figure 8. Scheme for the identication of the production level corresponding to a given plant conguration X. As a result of the proposed procedure, the problem of associating to each of the numerous plant congurations the corresponding production level becomes that of identifying which of the 14 mcs, analyzed with the corresponding priorities, is veried by that conguration. 10. Numerical results The previously illustrated procedure of plant production level identication has been embedded in a Monte Carlo simulation model of the probabilistic dynamics governing the oshore plant operation. To investigate the eects of preventive maintenance two cases are comparated, without or with preventive maintenance. Furthermore, an additional case is considered for illustrative purposes, in which the components cannot fail but so that their unavailability can only be due to the periodic preventive maintenance. The number of MC trials used in all simulations is System without preventive maintenance. Firstly, we have considered the case in which the plant components can fail and are repaired following the rules of Section 5.1 but do not undergo preventive maintenance. The system evolution has been followed for a mission time T M of 10 3 hours, for a total computation time of 15 minutes on an Athlon@1400MHz. The average availability over the mission time of each production level is reported in Figure 9 (the associated error bars of one standard deviation are also reported, albeit little visible due to their small values).the plant is highly available (92,2%) at the full production level (level 0). Figure 10 shows the time evolution of the expected values of the production of gas, oil and water. After a short transient of about 140 hours, the productions, as expected, reach their asymptotic values.

16 16 E.Zio, P.Baraldi and E.Patelli Figure 9. Average plant availability over the mission time on the dierent production levels for the system without periodic preventive maintenance (error bars of one standard deviation are also reported, albeit little visible due to their small values). Figure 10. Expected values of the gas (top), oil (middle) and water (bottom) production as a function of time for the system without preventive maintenance.

17 SAFERELNET task 7.5, Simulation for maintenance optimisation Eects of preventive maintenance on the perfect system. In this Section we consider the unrealistic case in which the components cannot fail but undergo periodic preventive maintenance which render them unavailable at times. The mission time considered is now extended to 10 4 hours, so as to capture the eects of the dierent kinds of maintenance strategies discussed in Section 5.2. This situation, although clearly unrealistic, is instructive to understand the characteristics of the system. The maintenance periods and durations for the dierent components are those of Table 8. The computing time is of 12 minutes. Figure 11 shows that during the four dierent types of maintenance actions, the plant may reside only in congurations corresponding to the levels of production 1, 2 or 4 which are determined by the unavailability of only one single component. Figure 11. Average plant availability over the mission time at the dierent production levels for the system with components that cannot fail and periodic preventive maintenance (error bars of one standard deviation are also reported, albeit little visible due to their small values). Obviously, the overall eect of any kind of maintenance on non-failing components is that of reducing the plant productions due to the components unavailabilities during maintenance. However, the maintenance has dierent impacts on the oil, gas and water productions. For example, the maintenance of the TCs keeps constant the production of oil while it decreases signicantly the production of gas. Figure 12 shows the expected values of the plant productions as a function of time. Notice the typical evolution of the productions during a maintenance period: there is a sudden reduction in the productions at the time in which the maintenance is started

18 18 E.Zio, P.Baraldi and E.Patelli and then the productions go back to their maximum values following an exponential curve, due to the fact that the starting times of maintenance are deterministic while the maintenance durations are exponentially distributed stochastic variables (Section 5.2). Figure 12. Expected values of the gas (top), oil (middle) and water (bottom) production as a function of time for the perfect system with preventive maintenance. The decrease in the oil production occurring at about 9000 hours is due to the overlapping of the long maintenance on the TCs and TGs of kind 3 and the maintenance of EC of kind 2 which, in agreement with the single repair team rules of Section 5.2, is postponed until the maintenance of kind 3 is completed. For this reason, the decrease in expected production is not abrupt System with preventive maintenance. Finally, we analyze the behavior of the real system, with periodic preventive maintenance. The mission time T m is of hours, so as to capture the eects also of the maintenance action of kind 4 which has a very long period. The computing time increases to several hours. The results of the average availability over the mission time of each production level of the plant is reported in Figure 13. The plant production capacity appears reduced with respect to the case of no preventive maintenance of Figure 10, with the plant having higher probabilities of performing at lower production levels. This is due to the fact that while some components are under maintenance, the plant is in a more critical state with respect to possible failures. For example the probability of no production (level 6) increases from to , due to the fact that when a TC is under preventive maintenance if the other one fails the system fails to

19 SAFERELNET task 7.5, Simulation for maintenance optimisation 19 Figure 13. Average plant availability over the mission time on the dierent production levels for the real system with periodic preventive maintenance(error bars of one standard deviation are also reported, albeit little visible due to their small values). Average availability Production Level Case A Case B Case C Table 12. Comparison of the availability of the production level between case A (real system without preventive maintenance), B (perfect system with preventive maintenance) and C (real system with preventive maintenance). no production. In Table 12 are summarized the average availabilities of the production levels in the three cases simulated. Figure 14 shows the time evolution of the expected values of the productions of gas, oil and water. Finally, Table 12 shows the eects of preventive maintenance by comparing the expected oil and gas productions per year in the two case, without and with preventive maintenance. Preventive maintenance appears to slightly

20 20 E.Zio, P.Baraldi and E.Patelli decrease the production, as expected from the fact that it operates on components which are assumed not to age (constant failure rates) and thus has the sole eects of rendering them unavailable during maintenance, without mitigating its failure behavior. Figure 14. Expected values of the gas (top), oil (middle) and water (bottom) production as a function of time for the real system with preventive periodic maintenance with a mission time T m of hours 11. Conclusions In this paper we have tackled the problem of the availability estimation of a multi-state, multi-output plant. The plant considered is an oshore installation and refers to a case study proposed as test case within the EUsponsored Thematic Network SAFERELNET, under project number GTC The complexity of the plant and the realistic conditions considered for the corrective and periodic preventive maintenance policies and production priorities of the plant, render unfeasible an analytical approach. Thus, a Monte Carlo simulation approach has been employed to capture the realistic aspects that determine the stochastic evolution of the plant. Further complications in the modelling of the system are due to the presence of operational loops and interconnections along the dierent kinds of productions of the plant. From a physical analysis of the system, it has turned out that the plant can be in 7 dierent levels of productions that correspond to more than 400 possible plant states, so that the a priori hand specication of the level of production associated to each system state becomes excessively time consuming and error prone, i.e. unfeasible. Hence, a

21 SAFERELNET task 7.5, Simulation for maintenance optimisation 21 systematic procedure for the assignment of the production level corresponding to a given system state has been introduce, based on the introduction of an enveloping set of congurations for each production level: as long as the system state is within a given envelope, the system works at the corresponding production level. The simulation model devised has allowed the availability assessment of the system at its dierent production levels and the investigation of eects the maintenance strategies on production. As expected, the periodic preventive maintenance is found to decrease production, albeit slightly, due to the fact that the components are assumed not to age. This assumption needs, obviously, to be relaxed for a fairer evaluation of the maintenance strategy considered and this can be done with no additional modelling eort in the Monte Carlo simulation scheme. As future research, it is of interest to theorically formalise the problem of the state identication in multi-output systems and it solution by means of the production levels conguration ensembles bounded by the minimal and maximal cut sets as dened in this paper. Acknowledgements The authors wish to thank Jean Pierre Signoret and Marie Boiteau for providing the details of the case study. References Aven, T., On performance measures for multistate monotone systems. Reliability Engineering and System Safety 41, Barlow, R. E., Proschan, F., Statistical Theory of Reliability and Life Testing Probability Models. International series in decision processes. Holt, Rinehart and Windston, Inc., isbn: Dubi, A., Monte Carlo applications in systems engineering. John Wiley and sons. Lisnianski, A., Levitin, G., Multi-state system reliability. Assessment, Optimization and Applications. World Scientic. Marseguerra, M., Zio, E., Basics of the Monte Carlo Method with Application to System Reliability. LiLoLe - Verlag GmbH (Publ. Co. Ltd.), Hagen, Germany, isbn Dipartimento Ingegneria Nucleare - Politecnico di Milano, via Ponzio 34/ Milan - Italy, enrico.zio@polimi.it