E Zio

N Pedroni

An optimized Line Sampling method for the estimation of the failure probability of nuclear passive systems

Keywords: Functional failure probability, passive system, Line Sampling, important direction, variance minimization, Artificial Neural Network, Genetic Algorithm, long-running code, computational cost

The quantitative reliability assessment of a thermal-hydraulic (T-H) passive safety system of a nuclear power plant can be obtained by i) Monte Carlo (MC) sampling the uncertainties of the system model and parameters, ii) computing, for each sample, the system response by a mechanistic T-H code and iii) comparing the system response with pre-established safety thresholds, which define the success or failure of the safety function. The computational effort involved can be prohibitive because of the large number of (typically long) T-H code simulations that must be performed (one for each sample) for the statistical estimation of the probability of success or failure.

"important direction", based on the Genetic Algorithm (GA) minimization of the variance of the LS failure probability estimator.

In addition, this work addresses the second issue by assessing the performance of the LS method in estimating small failure probabilities with a reduced (e.g., lower than one hundred) number of samples.

.

In this work, Line Sampling (LS) is adopted for efficient MC sampling. In the LS method, an "important direction" pointing towards the failure domain of interest is determined and a number of conditional one-dimensional problems are solved along such direction; this allows for a significant reduction of the variance of the failure probability estimator, with respect, for example, to standard random sampling.

Two issues are still open with respect to LS: first, the method relies on the determination of the "important direction", which requires additional runs of the T-H code; second, although the method has been shown to improve the computational efficiency by reducing the variance of the failure probability estimator, no evidence has been given yet that accurate and precise failure probability estimates can be obtained with a number of samples reduced to below a few hundreds, which may be required in case of long-running models.

The work presented in this paper addresses the first issue by i) quantitatively comparing the efficiency of the methods proposed in the literature to determine the LS important direction; ii) employing Artificial Neural Network (ANN) regression models as fast-running surrogates of the original, long-running T-H code to reduce the computational cost associated to the determination of the LS "important direction" and iii) proposing a new technique for identifying the LS 1 Introduction

Modern nuclear reactor concepts make use of passive safety features [START_REF] Fong | Reliability analysis of a passive cooling system using a response surface with an application to the flexible conversion ratio reactor[END_REF], which do not need external input (especially energy) to operate [START_REF]Safety related terms for advanced nuclear plant[END_REF] and, thus, are expected to improve the safety of nuclear power plants because of simplicity and reduction of both human interactions and hardware failures [START_REF] Nayak | Passive system reliability analysis using the APSRA methodology[END_REF]- [START_REF] Nayak | Reliability assessment of passive isolation condenser system of AHWR using APSRA methodology[END_REF].

However, the uncertainties involved in the modelling and functioning of passive systems are usually larger than for active systems. This is due to: i) the random nature of several of the physical phenomena involved in the functioning of the system (aleatory uncertainty); ii) the incomplete knowledge on the physics of some of these phenomena (epistemic uncertainty) [START_REF] Apostolakis | The concept of probability in safety assessment of technological systems[END_REF].

Due to these uncertainties, the physical phenomena involved in the passive system functioning (e.g., natural circulation) might develop in such a way to lead the system to fail its function: actually, deviations in the natural forces and in the conditions of the underlying physical principles from the expected ones can impair the function of the system itself [START_REF] Burgazzi | Reliability evaluation of passive systems through functional reliability assessment[END_REF].

In this view, a passive system fails to perform its function when deviations from its expected behavior lead the load imposed on the system to exceed its capacity [START_REF] Burgazzi | Addressing the uncertainties related to passive system reliability[END_REF]. In the reliability analysis of such functional failure behavior, the passive system is modeled by a detailed, mechanistic T-H system code and the probability of failing to perform the required function is estimated based on a Monte Carlo (MC) sample of code runs which propagate the epistemic (state-of-knowledge) uncertainties in the model and numerical values of its parameters/variables [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF], [START_REF] Fong | Reliability analysis of a passive cooling system using a response surface with an application to the flexible conversion ratio reactor[END_REF], [START_REF] Bassi | Reliability assessment of 2400 MWth gas-cooled fast reactor natural circulation decay heat removal in pressurized situations[END_REF]- [START_REF] Zio | Functional failure analysis of a thermal-hydraulic passive system by means of Line Sampling[END_REF].

In practice, the probability of functional failure of a passive system is very small (e.g., of the order of 10 -4 or less), so that a large number of samples is necessary for acceptable estimation accuracy [START_REF] Schueller | On the treatment of uncertainties in structural mechanics and analysis[END_REF]. Given that the time required for each run of the detailed, mechanistic T-H system model code can be of the order of several hours [START_REF] Fong | Reliability analysis of a passive cooling system using a response surface with an application to the flexible conversion ratio reactor[END_REF], the MC simulation-based procedure typically requires considerable computational efforts.

To reduce the computational burden of MC simulation-based approaches to reliability and risk analysis, efficient sampling techniques like Importance Sampling (IS) [START_REF] Au | Importance sampling in high dimensions[END_REF], Stratified Sampling [START_REF] Cacuci | A comparative review of sensitivity and uncertainty analysis of large scale systems -II: Statistical methods[END_REF] and Latin Hypercube Sampling (LHS) [START_REF] Helton | Latin hypercube sampling and the propagation of uncertainty in analyses of complex systems[END_REF] have been widely used [START_REF] Helton | Computational implementation of sampling-based approaches to the calculation of expected dose in performance assessments for the proposed high-level radioactive waste repository at Yucca Mountain, Nevada[END_REF].

In this paper, we consider an advanced simulation method called Line Sampling (LS), which has been recently introduced in structural reliability analysis [START_REF] Koutsourelakis | Reliability of structures in high dimensions, Part I: algorithms and application[END_REF]. Lines, instead of random points, are used to probe the failure domain [START_REF] Pradlwarter | Realistic and efficient reliability estimation for aerospace structures[END_REF]; an "important direction" pointing towards the failure domain of interest is first determined and a number of conditional, one-dimensional problems are then solved along such direction [START_REF] Pradlwarter | Realistic and efficient reliability estimation for aerospace structures[END_REF]. The approach has been shown capable of substantially improving computational efficiency in a wide range of reliability applications [START_REF] Lu | Reliability sensitivity method by Line Sampling[END_REF], [START_REF] Zio | Functional failure analysis of a thermal-hydraulic passive system by means of Line Sampling[END_REF], [START_REF] Koutsourelakis | Reliability of structures in high dimensions, Part I: algorithms and application[END_REF]- [START_REF] Schueller | Benchmark study on reliability estimation in higher dimensions of structural systems -An overview[END_REF]. If the boundary profile of the failure domain of interest is not too irregular and the "important direction" is almost perpendicular to it, the variance of the failure probability estimator could ideally be reduced to zero [START_REF] Koutsourelakis | Reliability of structures in high dimensions, Part I: algorithms and application[END_REF].

Two main issues of the LS method are still under study for its practical application in reliability and risk analysis:

1. LS relies on the determination of the important direction, which requires additional runs of the T-H model, with an increase of the computational cost.

2. LS has been shown to significantly reduce the variance of the failure probability estimator, but this must be achieved with a small number of samples (and, thus, of T-H model evaluations; say, few tens or hundreds depending on the application), for practical cases in which the computer codes require several hours to run a single simulation [START_REF] Fong | Reliability analysis of a passive cooling system using a response surface with an application to the flexible conversion ratio reactor[END_REF].

The present paper addresses the first issue above by:

• comparing the efficiency of a number of methods proposed in the literature to identify the important direction; • employing Artificial Neural Network (ANN) regression models [START_REF] Bishop | Neural Networks for pattern recognition[END_REF] as fast-running surrogates of the long-running T-H code, to reduce the computational cost associated to the identification of the LS important direction;

• proposing a new technique to determine the LS important direction, based on the minimization of the variance of the LS failure probability estimator.

With respect to the second issue above, this paper aims at:

• assessing the performance of the LS method in the estimation of small failure probabilities (e.g., of the order of 10 -4 ) with a reduced number of samples (e.g., below 100).

The novelties with respect to previous work performed by the authors on these issues [START_REF] Zio | Nuclear passive system reliability assessment by an optimized Line Sampling method[END_REF] are the following:

• Genetic Algorithms (GAs) are employed as optimization algorithms, whereas in the previous work an algorithm based on Sequential Quadratic Programming-SQP was used; • the ANN regression models are here trained according to a sequential, two-step algorithm (based on error back-propagation) in order to increase the accuracy of the ANN model estimates in proximity of the failure domain of interest; on the contrary, in the previous work a simple one-step algorithm was used;

• the performance of the LS method in the estimation of small failure probabilities (e.g., of the order of 10 -4 ) is assessed with a very small number of samples drawn (of the order of 5-50); instead, in the previous work the performance of the LS method was assessed with a number of samples of the order of one-two hundreds;

• the following probabilistic simulation methods are compared in the estimation of small failure probabilities on the basis of a very small number of samples drawn: i) the optimized LS method proposed in this paper, ii) a combination of the optimized LS method and Latin Hypercube Sampling (LHS), also developed in this paper, iii) Importance Sampling (IS) [START_REF] Au | Importance sampling in high dimensions[END_REF] and iv) a combination of IS and LHS [START_REF] Olsson | On Latin hypercube sampling for structural reliability analysis[END_REF]; in the previous work, no comparison with other simulation methods was performed.

The investigations are carried out with regards to two case studies. The first one (not considered in the previous paper [START_REF] Zio | Nuclear passive system reliability assessment by an optimized Line Sampling method[END_REF]) deals with the estimation of the failure probability of a nonlinear structural system subject to creep and fatigue damages [START_REF] Mao | Reliability analysis of creep-fatigue failure[END_REF], [START_REF] Lu | Reliability sensitivity method by Line Sampling[END_REF]: thanks to its simplicity, it is here used as a toyproblem to extensively test the proposed methods, with respect to both issues 1. and 2. above. The second one (considered also in the previous paper [START_REF] Zio | Nuclear passive system reliability assessment by an optimized Line Sampling method[END_REF]) deals with the reliability analysis of a passive, natural convection-based decay heat removal system of a Gas-cooled Fast Reactor (GFR) [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]: on the basis of the investigations performed in the first case study, only issue 2. above is tackled in the second case study.

The remainder of the paper is organized as follows. In Section 2, the reliability analysis of T-H passive systems is framed in terms of the concepts of functional failure analysis. In Section 3, a general presentation of the LS procedure is provided. In Section 4, a detailed description of the techniques employed in this work to estimate the important direction for LS is given. In Sections 5 and 6, the structural case study of literature and the case study concerning the passive cooling of a GFR are respectively presented, together with the corresponding results. Finally, a critical discussion of the results obtained is proposed in Section 7 and some conclusions are drawn in the last Section.

Functional failure analysis of T-H passive systems

The basic steps of a functional failure analysis of a T-H passive system are [START_REF] Marquès | Methodology for the reliability evaluation of a passive system and its integration into a probabilistic safety assessment[END_REF]:

1. Detailed modeling of the system response by means of a deterministic, best-estimate (typically long-running) T-H code.

2. Identification of the parameters/variables, models and correlations (i.e., the inputs to the T-H code) which contribute to the uncertainty in the results (i.e., the outputs) of the best-estimate T-H calculations.

3. Propagation of the uncertainties through the deterministic, long-running T-H code in order to estimate the functional failure probability P(F) of the passive system. Formally, let x = {x 1 , x 2 , …, x j , …, x n } be the vector of the relevant system uncertain parameters, Y( x ) be a scalar function indicating the performance of the T-H passive system (e.g., the fuel peak cladding temperature during an accidental transient) and α Y a threshold value (imposed e.g. by the regulatory authorities) defining the criterion of loss of system functionality. For illustrating purposes, let us assume that the passive system fails if Y( x ) > α Y ; equivalently, introducing a variable called Performance Function (PF) as

( ) Y x Y g α - = x x) ( , failure occurs if 0 ) ( > x x g
. The probability P(F) of system functional failure can then be expressed by the multidimensional integral:

( ) ( ) ∫∫ ∫ = x x x d q I F P F ) ( ... (1)
where ( ) ⋅ q is the joint Probability Density Function (PDF) representing the uncertainty in the parameters x , F is the failure region (where g x (•) > 0) and I F (·) is an indicator function

such that I F (x) = 1, if x ∈ F and I F (x) = 0, otherwise.
The evaluation of integral (1) above entails multiple (e.g., many thousands) evaluations of the T-H code for different sampled combinations of system inputs; if the running time for each T-H code simulation takes several hours (which is often the case for T-H nuclear passive systems), the associated computing cost is prohibitive. In this paper, the computational issue is addressed by resorting to the Line Sampling (LS) technique [START_REF] Koutsourelakis | Reliability of structures in high dimensions, Part I: algorithms and application[END_REF], whose main concepts are given in the following Section.

A synthetic illustration of the Line Sampling technique

Line Sampling (LS) is a simulation method for efficiently computing small failure probabilities.

The underlying idea is to employ lines instead of random points in order to probe the failure domain of the system analyzed [START_REF] Koutsourelakis | Reliability of structures in high dimensions, Part I: algorithms and application[END_REF], [START_REF] Pradlwarter | Realistic and efficient reliability estimation for aerospace structures[END_REF].

In extreme synthesis, the computational steps of the algorithm are [START_REF] Pradlwarter | Realistic and efficient reliability estimation for aerospace structures[END_REF], [START_REF] Pradlwarter | Application of line sampling simulation method to reliability benchmark problems[END_REF]:

1. From the original multidimensional joint probability density function ( ) (see [START_REF] Pradlwarter | Realistic and efficient reliability estimation for aerospace structures[END_REF] and [START_REF] Pradlwarter | Application of line sampling simulation method to reliability benchmark problems[END_REF] for details).

) , 0 [ : ∞ → ℜ ⋅ n q , sample N T vectors { } T k N k ..., , 2 , 1 : = x , with { } k n k j k k k x x x x ..
∑ = ⋅ = T T N k k T N F P N F P 1 , 1 1 ˆD , (2) ( )
[ ]

T N F P 2 σ = ( ) ( ) ( ) ( ) ∑ = - ⋅ - T T N k N k D T T F P F P N N 1 2 , 1 1 1 . (3)
The LS method here outlined can significantly reduce the variance (3) of the estimator (2) of the failure probability integral (1) [START_REF] Koutsourelakis | Reliability of structures in high dimensions, Part I: algorithms and application[END_REF]; however, its efficiency depends on the determination of the important direction α (step 3. above): the following Section delves further into this issue.

Methods for the determination of the important direction α

In what follows, the methods used in this work to determine the LS important direction α are presented in detail: in Section 4.

∑ = ⋅ = s N u u u s N 1 2 1 θ θ α
(Figure 1, top, left). This direction provides a good "map" of the important regions of the failure domain (at least as the sample size N s is large); on the other hand, the procedure implies N s additional system analyses by the T-H model, which may substantially increase the computational cost associated to the simulation method.

Direction of the design point in the standard normal space

A plausible selection of α could be the direction of the "design point" in the standard normal space [START_REF] Schueller | A critical appraisal of reliability estimation procedures for high dimensions[END_REF], [START_REF] Valdebenito | The role of the design point for calculating failure probabilities in view of dimensionality and structural nonlinearities[END_REF]. According to a geometrical interpretation, the "design point" is defined as the point * θ on the limit state surface

( ) 0 g θ = θ
in the standard normal space, which is closest to the origin (Figure 1, top, right). It can be computed by solving the following constrained nonlinear minimization problem:

( ) { } * * 2 2 0
Find : min

g θ = = θ θ θ θ ( 4
)
where Then, the unit important vector α can be easily obtained by normalizing * θ , i.e., * * 2 = α θ θ .

In this work, Genetic Algorithms (GAs) [START_REF] Konak | Multi-objective optimization using genetic algorithms: A tutorial[END_REF], [START_REF] Marseguerra | Basics of genetic algorithms optimization for RAMS applications[END_REF] are used to solve the constrained nonlinear minimization problem (4). In extreme synthesis, the main properties of GAs are that the optimization search is conducted i) using a (possibly) large population of multiple solution points or candidates, ii) using operations inspired by the evolution of species, such as breeding and genetic mutation, iii) using probabilistic operations and iv) using information on the objective or search function and not on its derivatives. With regards to their performance, it is acknowledged that GAs take a more global view of the search space than many other optimization methods. The main advantages are i) fast convergence to near global optimum, ii) superior global searching capability in complicated search spaces and iii) applicability even when gradient information is not readily achievable [START_REF] Marseguerra | Basics of genetic algorithms optimization for RAMS applications[END_REF]. A thorough descriptions of the GA computational flow is not reported here for brevity sake: for further details, the interested reader may refer to the cited references and the copious literature in the field.

Notice that checking the feasibility of a candidate solution θ to (4) requires the evaluation of the PF ( ) g θ ⋅ at θ , which entails running the numerical T-H model code simulating the system. As a consequence, the computational cost associated with the calculation of the design point can be quite high, in particular if long-running numerical codes are used to simulate the response of the system to its uncertain input parameters [START_REF] Schueller | A critical appraisal of reliability estimation procedures for high dimensions[END_REF], as it is the case in the functional failure analysis of T-H passive systems.

Gradient of the performance function in the standard normal space

In [START_REF] Pradlwarter | Realistic and efficient reliability estimation for aerospace structures[END_REF], the direction of α is taken as the normalized gradient of the PF ( ) g θ ⋅ in the standard normal space. Since the unit vector α points towards the failure domain F, it can be used to draw information about the relative importance of the uncertain parameters { } n j j ..., , 2 , 1 : = θ with respect to the failure probability P(F): the more relevant an uncertain variable is in determining the failure of the system, the larger the corresponding component of the unit vector α will be [START_REF] Pradlwarter | Realistic and efficient reliability estimation for aerospace structures[END_REF]. Such quantitative information is obtained from the gradient of the performance function Once built, the model can be used for performing, in an acceptable computational time, the evaluations of the system PF g θ (•) needed for an accurate estimation of the LS important direction α.

( ) θ θ g in the standard normal space, ( )
θ θ g ∇ : ( ) ( ) ( ) ( ) ( ) T n j g g g g g         ∂ ∂ ∂ ∂ ∂ ∂ ∂ "impact" of
In this work, a three-layered feed-forward Artificial Neural Network (ANN) regression model is considered. In extreme synthesis, ANNs are computing devices inspired by the function of the nerve cells in the brain [START_REF] Bishop | Neural Networks for pattern recognition[END_REF]. They are composed of many parallel computing units (called neurons or nodes) interconnected by weighed connections (called synapses). Each of these computing units performs a few simple operations and communicates the results to its neighbouring units. From a mathematical viewpoint, ANNs consist of a set of nonlinear (e.g., sigmoidal) basis functions with adaptable parameters that are adjusted by a process of training (on different input/output data examples), i.e., an iterative process of regression error minimization [START_REF] Rumelhart | Learning internal representations by error backpropagation[END_REF]. The details about ANN regression models are not reported here for brevity: for further details, the interested reader may refer to the cited references and the copious literature in the field.

The particular type of ANN employed in this paper is the classical three-layered feed-forward ANN; in order to improve the accuracy in the approximation of the system PF g

Minimization of the variance of the LS failure probability estimator

The optimal important direction opt α for Line Sampling can be defined as the one minimizing the In mathematical terms, the optimal LS important direction opt α is obtained by solving the following nonlinear constrained minimization problem:

( ) [ ] ( ) [ ] { } ( ) (
). [START_REF] Nayak | Passive system reliability analysis using the APSRA methodology[END_REF] The conceptual steps of the procedure for solving (6) are (Figure 2):

1. An optimization algorithm proposes a candidate solution above; notice that 2•N T or 3•N T system performance analyses (i.e., runs of the system model code) have to be carried out in this phase (see steps 4. and 5. in Section 3).

3. The variance

( ) [ ] T N F P 2 θ θ α = is not feasible (i.e., if F ∉ θ
or, equivalently,

( ) 0 ≤ θ θ g
), it is penalized by increasing the value of the corresponding objective function σ for each proposed solution; as a consequence, the computational effort associated to this technique would be absolutely prohibitive with a system model code requiring hours or even minutes to run a single simulation. Hence, it is unavoidable, for practical applicability, to resort to a regression model (ANN-based, in this work) as a fast-running approximator of the original system model for performing the calculations in steps 2. and 4. above, to make the computational cost acceptable.

Figure 2 here

The characteristics of the methods described in Sections 4.1 and 4.2 are summarized in Table 1, with the specification of the computational tools employed for their implementation.

Table 1 here 5 Case study 1: structural system of literature

The first case study deals with a probabilistic model for the reliability analysis of creep and fatigue failure phenomena in structural materials: the model was first proposed in [START_REF] Mao | Reliability analysis of creep-fatigue failure[END_REF] and then employed also in [START_REF] Lu | Reliability sensitivity method by Line Sampling[END_REF].

According to the above mentioned references, the nonlinear Performance Function (PF) g x (•) of a structural material subject to creep and fatigue damages can be expressed as

( ) ( ) ( ) ( ) f D D f c f c x x x D e e e e n n N N g x x x x x x g g c c - - - - + - = = = - - 1 1 2 2 , , , , , , , , , , 2 2 1

Experimental settings

The simulations performed are intended to compare the efficiency of the different methods considered for the determination of the LS important direction α (Section 4). In each LS simulation, Three different experimental settings, namely settings 1, 2 and 3, are considered in this application. These settings differ by: i) the method used for determining the important direction α (Section 4); ii) the model employed to evaluate the system performance function g θ (•) for the estimation of the important direction α;

iii) the number N α of system performance evaluations used to determine α; iv) the total number N code,α of actual runs of the original system model code required by the whole process of determination of the important direction α.

The characteristics of the three settings are summarized in Table 3.

Table 3 here

In setting 1, the MCMC (labeled A, Section 4.1.1), design point (labeled B, Section 4.1.2) and gradient (labeled C, Section 4.1.3) methods are considered. A large number N α of evaluations of the system performance function g θ (•) are carried out to determine α: in particular, N α = 10000 is chosen to provide an accurate and reliable estimate for the important direction α. In this setting, the system performance function is evaluated by running the original system model "code" (i.e., the original system performance function g θ (•)), so that N code,α = N α = 10000.

In setting 2, N α = 10000 evaluations of the system performance function g θ (•) are carried out to determine α, like in the previous setting 1. However, in this setting the system performance function N code,α of runs of the original system model) is N code,α = (N train ' + N val ' + N train '' + N val '' + N test ) = 50 + 10 + 100 + 20 + 10 = 190. Notice that in this setting, method D, based on the minimization of the variance of the LS failure probability estimator, is not employed for determining α because the actual number of "allowed" code runs (i.e., N code,α = 190) is too small to provide meaningful results for this method.

Performance indicators

The experimental settings described in the previous Section 5. 8) and ( 9), respectively: Obviously, the lower is the value of ε, the higher is the accuracy of the failure probability estimate ( ) T N F P ˆ; instead, the lower is the value of w CI , the higher the precision of the estimate.

( ) ( ) ( ) 100 ˆ⋅ - = F P F P F P T N ε , (8) ( ) ( ) ( ) 100 ,
, ⋅ - = F P L U w T N T N F P CI F P CI CI , (9) where (

Results

As previously mentioned, the example application has been set with the purpose of comparing different methods for determining the LS important direction α (Section 4). Further, the proposed method D (Section 4.2) achieves more accurate and precise estimates than those of methods A, B and C in both settings 1 and 2: indeed, the percentage error ε and 95% CI width w CI are 0.070 and 2.204, respectively; these improved results are due to the fact that the proposed technique is based on the definition of the ideal (i.e., optimal) important direction α for LS (i.e., the one minimizing the variance of the LS failure probability estimator).

Figure 3 here

Finally, an important remark is in order with respect to the comparison between settings 1 and 2; the results produced in setting 2 are at least comparable, if not better, than those of setting 1; yet, they are obtained at a much lower computational effort thanks to the fast-running ANN approximation of the system performance function g θ (•).

A comparison can also be made between settings 2 and 3: actually, the number N code,α of runs of the original system model code (and thus the associated overall computational effort) is the same for both settings (i.e., N code,α = 190). However, in setting 2 the few system model code runs are directly These findings bear an important practical implication: when a low number N code,α of system model evaluations is a priori imposed due to computational time limitations (which is the case for longrunning codes), superior results are obtained if the outcomes of the evaluations are employed to build a surrogate ANN regression model for determining the important direction α instead of directly using them for estimating α.

used
Finally, let us compare settings 1 and 3. In both settings, the original system model is directly employed for estimating α: however, in setting 1 a large number of system model evaluations (i.e., N code,α = N α = 10000) are performed, whereas in setting 2 only a small number is used (i.e., N code,α = N α = 190). As expected, the precisions provided by methods A, B and C in setting 1 are significantly better than those produced by the same methods in setting 3: the percentage 95% CI widths w CI are 2.222, 2.282, and 7.323 for methods A, B and C in setting 1, respectively, whereas they are 6.697, 5.345 and 7.502 for methods A, B, and C in setting 3.

In addition, it seems interesting to note that the difference between the performances of methods A, B and C is lower when N α (= N code,α ) is small (e.g., equal to 190) than when it is large (e.g., equal to 10000). This is due to the fact that the efficiency of methods A (based on MCMC simulation) and B (based on design point identification through optimization algorithms) strongly relies on the possibility of deeply exploring the uncertain parameter space within the failure region F of interest:

if only a small number N α (= N code,α ) of system performance evaluations is available, such a deep search cannot be carried out, thus resulting in poor estimates of the important direction α. In such cases, even a simple procedure like method C (i.e., gradient estimation by straightforward numerical differentiation) may provide comparable results.

The conclusions on the accuracy and precision in the estimates provided by the important direction α determined by method D (i.e., the one proposed in this paper, based on the minimization of the variance of the LS failure probability estimator) justify its adoption in the subsequent applications.

Application 2: failure probability estimation using an optimized Line

Sampling method with small sample sizes

The objective of this application is verifying the possibility of obtaining accurate and precise estimates ( ) T N F P ˆ of small failure probabilities P(F) (e.g., of the order of 10 -4 ) even reducing the number of system model evaluations to below one hundred, which may be mandatory in practical applications of computer codes requiring several hours to run a single simulation. Thus, in the present analysis the system performance function g θ (•) is evaluated by means of the original system model; however, the number N T of samples drawn for the estimation of the system failure probability is much lower than in Application 1: indeed, sample sizes N T ranging from 5 to 50 are employed (more precisely, N T = 5, 10, 20, 30, 40 and 50).

In addition, the benefits coming from the use of an optimized Line Sampling method with very small sample sizes N T is shown by means of a comparison between the estimation accuracies and precisions of the following simulation methods: i) optimized Line Sampling (LS) (Sections 3 and 4.2);

ii) an original combination of optimized Line Sampling (LS) and Latin Hypercube Sampling (LHS) (hereafter referred to as LS + LHS);

iii) standard Importance Sampling (IS) [START_REF] Au | Importance sampling in high dimensions[END_REF]; iv) a combination of standard Importance Sampling (IS) and Latin Hypercube Sampling (LHS) (hereafter referred to as IS + LHS) [START_REF] Olsson | On Latin hypercube sampling for structural reliability analysis[END_REF].

Thorough descriptions of methods ii) -iv) above (i.e., LS + LHS, IS and IS + LHS) are not reported here for brevity: the interested reader may refer to the cited references for details.

In Section 5.2.1, the quantitative indicators used to compare methods i) -iv) above are presented;

then, the results produced by all the methods considered are investigated in Section 5.2.2.

Performance indicators

In order to properly represent the randomness of the probabilistic simulation methods adopted and provide a statistically meaningful comparison between their performances in the estimation of the system failure probability P(F), S = 2000 independent runs of each method have been carried out for each sample size N T : this is required by the fact that in this application the sample sizes N T are very small, such that they would produce poor statistics over a single simulation run. In each simulation s = 1, 2, …, S, the percentage relative absolute error ε s between the true (reference) value of the system failure probability P(F) and the corresponding estimate

T N s F P ) ( ˆ is computed as follows: 100 ) ( ) ( ) ( ⋅ - = F P F P F P T N s s ε , s = 1, 2, …, S (10)
The accuracies of the simulation method of interest in the estimation of P(F) are then compared in terms of the mean percentage relative absolute error ε over S = 2000 runs:

∑ = ⋅ = S s s S 1 1 ε ε (11)
The quantity [START_REF] Burgazzi | Addressing the uncertainties related to passive system reliability[END_REF] provides a measure of the percentage relative absolute error in the estimation of the failure probability P(F) made on average in a single run by the simulation method with N T samples.

The failure probability estimates

T N T N F P CI F P CI U L , , , (12)
where • the use of LHS in combination with the optimized LS method does not affect significantly the accuracy of the failure probability estimates in this application: for example with N T = 5, the mean percentage errors ε are 16.305 and 16.198 for the LS and LS + LHS methods respectively; conversely, the combination of LS and LHS increases the precision of the failure probability estimates: for example with N T = 5, the percentage 95% CI widths CI w are 98.535 and 92.477 for the LS and LS + LHS methods, respectively (a 6% increase in the precision of the estimate); • the use of LHS in combination with the IS method significantly increases both the accuracy and the precision of the failure probability estimates: for example with N T = 5, the mean percentage errors ε are 75.041 and 65.771, whereas the percentage 95% CI widths CI w are 390.881 and 319.972 for the IS and IS + LHS methods, respectively.

( ) T N F P CI U , and
( ) T N F P CI L , are the

Results

Table 5 reports the values of

Summing up, the results obtained confirm the possibility of achieving accurate and precise estimates of small failure probabilities by an optimized LS with a very low number N T of samples drawn in a nonlinear (but monotonous) case study.

Case study 2: thermal-hydraulic passive system

This case study concerns the natural convection cooling in a Gas-cooled Fast Reactor (GFR) under a post-Loss Of Coolant Accident (LOCA) condition; the reactor is a 600-MW GFR cooled by helium flowing through separate channels in a silicon carbide matrix core [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF].

A GFR decay heat removal configuration is shown schematically in Figure 4; in the case of a LOCA, the long-term heat removal is ensured by natural circulation in a given number N loops of identical and parallel loops; only one of the N loops loops is reported for clarity of the picture: the flow path of the cooling helium gas is indicated by the black arrows. The loop has been divided into N sections = 18 sections for numerical calculation; technical details about the geometrical and structural properties of these sections are not reported here for brevity: the interested reader may refer to [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF].

In the present analysis, the average core power to be removed is assumed to be 18.7 MW, equivalent to about 3% of full reactor power (600 MW): to guarantee natural circulation cooling at this power level, a pressure of 1650 kPa in the loops is required in nominal conditions. Finally, the secondary side of the heat exchanger (i.e., item 12 in Figure 4) is assumed to have a nominal wall temperature of 90 °C [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF].

Uncertainties

Uncertainties affect the modeling of passive systems. There are unexpected events, e.g. the failure of a component or the variation of the geometrical dimensions and material properties, which are random in nature. This kind of uncertainty, often termed aleatory [START_REF]Severe accident risk: an assessment for five US nuclear power plants[END_REF]- [START_REF] Usnrc | An approach for using probabilistic risk assessment in risk-informed decisions on plant-specific changes to the licensing basis[END_REF], is not considered in this work. Additionally, there is incomplete knowledge on the properties of the system and the conditions in which the passive phenomena develop (i.e., natural circulation). This kind of uncertainty, often termed epistemic, affects the model representation of the passive system behaviour, in terms of both (model) uncertainty in the hypotheses assumed and (parameter)

uncertainty in the values of the parameters of the model [START_REF] Patalano | Risk-informed design changes in a passive decay heat removal system[END_REF], [START_REF] Cacuci | A comparative review of sensitivity and uncertainty analysis of large scale systems -II: Statistical methods[END_REF], [START_REF] Helton | Survey on sampling-based methods for uncertainty and sensitivity analysis[END_REF].

Only epistemic uncertainties are considered in this work. Epistemic parameter uncertainties are associated to the reactor power level, the pressure in the loops after the LOCA and the cooler wall temperature; epistemic model uncertainties are associated to the correlations used to calculate the Nusselt numbers and friction factors in the forced, mixed and free convection regimes. The consideration of these uncertainties leads to the definition of a vector x = { } 9 ..., , 2 , 1 : = j x j of nine uncertain model inputs, assumed described by normal distributions of known means and standard deviations (Table 6, [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]).

Failure criteria of the T-H passive system

The passive decay heat removal system of Figure 4 fails to provide its safety function when the temperature of the coolant helium leaving the core (item 4 in Figure 4) exceeds either 1200 °C in the hot channel or 850 °C in the average channel: these values are expected to limit the fuel temperature to levels which prevent excessive release of fission gases and high thermal stresses in the cooler (item 12 in Figure 4) and in the stainless steel cross ducts connecting the reactor vessel and the cooler (items from 6 to 11 in Figure 4) [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]. Denoting by ( )

x hot core out T , and
( )

x avg core out
T , the coolant outlet temperatures in the hot and average channels, respectively, the system failure event F can be written as follows:

( ) { } ( ) { } 850 : 1200 : , , > ∪ > = x x x x avg core out hot core out T T F . ( 14
)
The probability P(F) of this event is 3.332•10 -4 , obtained by standard MCS with N T = 500000 samples drawn.

Application

The objective of the application is the estimation of the small functional failure probability P(F) (i.e., P(F) = 3.332•10 -4 ) of the T-H passive system described in Section 6 by means of LS with a very small number N T of samples; more precisely, values of N T = 5, 10, 20, 30, 40 and 50 are considered.

Justified by the results obtained in the previous case study, method D of Section 4.2 (i.e., the one based on the minimization of the variance of the LS failure probability estimator) is employed to estimate the important direction α for LS. The ANN regression model used to this purpose is the classical three-layered feed-forward ANN: the number of inputs to the ANN regression model is equal to 9 (i.e., the number of uncertain inputs in Table 6 of Section 6.1), whereas the number of outputs is equal to 2 (i.e., the number of system variables of interest, the hot-and average-channel coolant outlet temperatures, as reported in Section 6.2). The number of nodes in the hidden layer with N T = 100 is [0, 0.0296] and the corresponding percentage 95% CI width w CI is 8793.8: this value is about two orders of magnitude larger (and conversely the precision is about two orders of magnitude lower) than that produced by LS with N T = 5 samples: in other words, the precision of the optimized LS method is two order of magnitude larger than that of standard MCS even using a number of samples 20 times lower.

In summary, the results obtained confirm the previous finding regarding the possibility of achieving accurate and precise estimates of small failure probabilities by an optimized LS method with a very low number N T of samples drawn; however, a much stronger conclusion can be drawn from this case study, regarding the actual feasibility of application of the method to the realistic, nonlinear and non-monotonous cases of practical interest in the reliability analysis of passive systems.

Discussion

In this paper, the Line Sampling (LS) method has been considered for improving the efficiency of Monte Carlo sampling in the estimation of the functional failure probability of a T-H passive system. A system designed to provide the safety function of natural convection cooling in a Gascooled Fast Reactor (GFR) after a Loss of Coolant Accident (LOCA) has been taken as reference case study.

Two relevant issues for the practical application of the LS method have been addressed:

1. the determination of the important direction for LS; 2. the reduction of the overall computational cost associated to the LS method in the estimation of the small functional failure probabilities characteristic of passive systems.

Concerning the first issue, the main contributions of the work presented and its related findings are (Case study 1):

• from a critical comparison of the methods currently available in the literature for the estimation of the LS important direction, it turns out that: the accuracy and precision of the estimates provided by the ANN-based method have been shown to be comparable to those produced by running the original system code: however, they have been obtained at a much lower computational effort; conversely, when a low number of system model code simulations needs to be a priori imposed due to computational time limitations (which is the case of the long-running system model codes, typical of nuclear safety), the accuracy and precision of the failure probability estimates provided by the ANN-based method have been shown to be consistently higher than those produced by running the original system model code.

• a new technique has been proposed based on the minimization of the variance of the LS failure probability estimator; since the proposed method relies on the definition of the optimal LS important direction, it produces more accurate and precise failure probability estimates than those provided by all the techniques of literature, as clearly shown by the numerical results obtained.

Concerning the second issue, the main contributions of the work presented and the related findings are (Case studies 1 and 2):

• the performance of the LS method has been assessed in the estimation of a small failure probability (i.e., of the order of 10 -4 ) with a reduced number of samples drawn (i.e., ranging from 5 to 50). The results have demonstrated that accurate and precise estimates can be obtained even reducing the number of samples to below one hundred and even in realistic, nonlinear and non-monotonous case studies; • the optimized Line Sampling method (i.e., both LS and the combination of LS and LHS) provide more accurate and precise failure probability estimates than both the IS and the combination of IS and LHS methods;

• the use of LHS in combination with the optimized LS method slightly increases the accuracy of the failure probability estimates and strongly increases the precision of the failure probability estimates;

• the use of LHS in combination with the IS method significantly increases both the accuracy and the precision of the failure probability estimates.

Conclusions

The findings of the work presented (summarized in the previous Section 7) suggest the adoption of the following methodology for the accurate and precise estimation of the (typically small) functional failure probability of T-H passive systems (modelled by long-running, nonlinear and non-monotonous T-H codes):

1. build an Artificial Neural Network (ANN) regression model using a sequential, two-step training algorithm on a reduced (e.g., around one hundred) number of examples of the input/output nonlinear relationships underlying the original system model code; 2. use the ANN model as a fast-running surrogate of the original system model code in the determination of the LS important direction; for this purpose, the technique proposed in this paper (based on the minimization of the variance of the LS failure probability estimator by means of Genetic Algorithms) is strongly suggested: since it relies on the definition of the optimal LS important direction, it produces more accurate and precise failure probability estimates than those provided by all the techniques of literature; 3. estimate the functional failure probability of the T-H passive system by means of Line Sampling with a small number of samples (e.g., few tens); the accuracy and precision of the estimates can be enhanced by combining Line Sampling with Latin Hypercube Sampling.

The outstanding performance of the optimized Line Sampling method presented in this paper in the estimation of very small failure probabilities makes it a rather attractive tool for passive system functional failure analyses and possibly one worth considering for extended adoption in full scale PRA applications, provided that the numerous possible accident scenarios and outcomes can be handled computationally in an efficient way.

FIGURES

Figure 1. Methods for estimating the Line Sampling important unit vector α. Top, left: normalized "center of mass" of the failure domain F in the standard normal space [START_REF] Koutsourelakis | Reliability of structures in high dimensions, Part I: algorithms and application[END_REF]; top, right: direction of the design point of the problem in the standard normal space [START_REF] Schueller | A critical appraisal of reliability estimation procedures for high dimensions[END_REF], [START_REF] Valdebenito | The role of the design point for calculating failure probabilities in view of dimensionality and structural nonlinearities[END_REF]; bottom, left and right: normalized gradient of the PF g θ (•) evaluated at a selected point θ 0 (e.g., the nominal point) in the standard normal space [START_REF] Pradlwarter | Realistic and efficient reliability estimation for aerospace structures[END_REF] 7) for creep and fatigue in structural materials [START_REF] Lu | Reliability sensitivity method by Line Sampling[END_REF] Experimental settings considered for the determination of the important direction α

Model uncertainty

Nusselt number in forced convection, x 4 1 5%

Nusselt number in mixed convection, x 5 1 15%

Nusselt number in free convection, x 6 1 7.5%

Friction factor in forced convection, x 7 1 1%

Friction factor in mixed convection, x 8 1 10%

Friction factor in free convection, x 9 1 1.5% = 5, 10, 20, 30, 40 and

5 .

 5 Compute the unbiased estimator ( )

  the corresponding uncertain variable on the performance function ( )θ θ gin the standard normal space. Thus, it is reasonable to identify the LS important direction with the direction of the gradient (5) and compute the corresponding unit vector α as the normalized gradient of the performance function ( ) n system performance analyses are required to determine accurately the gradient (5) at a given point of the PF

Figure 1 here

 1 Figure 1 here

N

  θ (•) (needed for an accurate estimation of the LS important direction α), the employed ANN models are trained by a properly devised sequential, two-step algorithm based on error back-propagation. In extreme synthesis, a first-step ANN regression model is built using a set ' train D of input/output data examples of size ' train N ; further, a validation data set ' val D (different from the training set) of size N val ' is used to monitor the accuracy of the first-step ANN model during the training procedure in order to avoid overfitting of the training data [41]. The resulting ANN model is used (instead of the original, longrunning system model code) to provide an approximation to the design point of the problem (Section 4.1.2): this is meant to provide an approximate, rough indication of the real location of the failure domain F of interest. Subsequently, new training and validation data sets ' , respectively, are randomly generated centred on the approximate design point previously identified: a second-step (i.e., definitive) ANN model is then constructed on these newly generated training and validation data sets. This should result in an ANN regression model which is more accurate in proximity of the failure domain F of interest, thus providing reliable estimates of the system PF g θ (•) for the identification of the LS important direction α.

  of the LS failure probability estimator ( ) T N F P ˆ (2). Notice that opt α can be expressed as the normalized version of a proper vector opt θ in the standard normal space, i.e., in order to search for a physically meaningful important unit vector opt α (i.e., a vector that optimally points towards the failure domain F of interest), opt θ should belong to the failure domain F of interest, i.e. F opt ∈ θ or, equivalently, ( ) 0 > opt g θ θ .

  as previously mentioned, in this work Genetic Algorithms (GAs) are employed.2. The LS failure probability estimator ( ) as important direction in step 1.

5 .

 5 Steps 1. -4. are repeated until a predefined stopping criterion is met and the optimization algorithm identifies the optimal unit vector 2 that i) the optimization search requires the iterative evaluation of hundreds or thousands of possible solutions 2 θ θ α = to (6) and ii) 2•N T or 3•N T system performance analyses (i.e., runs of the system model code) have to be carried out to calculate the objective function

1

 1 where D c = n c /N c and D f = n f /N f are the creep and fatigue damages, respectively, N c and N f are the creep and fatigue lives, respectively, n c and n f are the numbers of the creep and fatigue load cycles, respectively, and θ 1 and θ 2 are characteristic parameters of the structural material obtained from experimental data. The structural material is supposed to fail when its PF[START_REF] Nayak | Reliability assessment of passive isolation condenser system using APSRA methodology[END_REF] becomes lower than or equal to 0, i.e., g x (x) ≤ 0. The shapes and parameters (i.e., mean µ and standard deviation σ) of the probability distribution functions associated to the uncertain variables {x j : j = 1, 2, ..., 6} of the probabilistic model[START_REF] Nayak | Reliability assessment of passive isolation condenser system using APSRA methodology[END_REF] for creep and fatigue in structural materials are summarized in Table 2[START_REF] Lu | Reliability sensitivity method by Line Sampling[END_REF].The true (i.e., reference) probability P(F) of the failure event F = {g x (x) ≤ 0} is 1.425•10 -4 , obtained as an average of S = 25000 failure probability estimates s = 1, 2, …, S, each one computed by standard MCS with N T = 500000 samples. Application 1: comparison of the methods proposed in Section 4 for determining the important direction α for Line Sampling LS is here applied to the probabilistic model[START_REF] Nayak | Reliability assessment of passive isolation condenser system using APSRA methodology[END_REF] described above for creep and fatigue in structural materials. In particular, in this Section a thorough comparison of the different methods proposed in Section 4 for determining the important direction α for Line Sampling is carried out: in Section 5.1.1, the different experimental settings considered are described in details, together with the methods and models used, and the objectives; in Section 5.1.2, the quantitative indicators introduced to compare the methods adopted are presented; finally, the results obtained in the different experimental settings of Section 5.1.1 are illustrated in Section 5.1.3.

  the system performance function g θ (•) is evaluated by running the original system model code and the LS point estimates ( ) T N F P ˆ of the failure probability P(F) are computed with a large number N T (i.e., N T = 10000) of samples (steps 4. and 5. of Section 3): this allows a reliable assessment of the effect of different important directions α on the accuracy and precision of the obtained estimates ( ) T N F P ˆ. In this case the use of a large number of samples N T (i.e., N T = 10000) is possible because the system performance function (7) is a simple analytical function which can be evaluated in a negligible computational time.

  1.1 are compared in terms of two quantities: the percentage relative error ε between the LS failure probability estimate ( ) T N F P ˆ and the true (i.e., reference) value P(F) of the failure probability of the system, and the percentage relative width w CI of the 95% Confidence Interval (CI) of the LS failure probability estimator ( ) T N F P ˆ. These indicators are defined in (

  and lower bounds of the 95% CI of the failure probability estimator ( ) T N F P ˆ, respectively.

Figure 3

 3 Figure 3 shows the values of the LS point estimates ( ) T N F P ˆ (dots) of the failure probability P(F)obtained with N T = 10000 samples in settings 1, 2 and 3 (Table3); the corresponding 95% Confidence Intervals (CIs) are also reported (bars). Finally, the true (i.e., reference) value of the system failure probability P(F) (i.e., P(F) = 1.425•10 -4 ) is shown as a dashed line. Table4reports instead the values of the associated performance indicators ε and w CI (Section 5.1.2).

  s = 1, 2, …, S, are then used to build a bootstrapped 95% Confidence Interval (CI) for the failure probability estimator ( )

  2.5 th and 97.5 th percentiles, respectively, of the bootstrapped empirical distribution of the failure probability estimator ( ) T N F P ˆ. The percentage relative width CI w of the bootstrapped 95% Confidence Interval (CI) of the LS failure probability estimator

  the performance indicators ε (11) and CI w (13) obtained with N T = 5, 10, 20, 30, 40 and 50 samples by the LS, LS + LHS, IS and IS + LHS methods in Application 2 of Case study 1.

Figure 4

 4 Figure 4 here

has been set equal to 4

 4 by trial and error. The ANN model is built using the sequential, two-step training algorithm described in Section 4.1: training sets of sizes N train ' = 50 and N train '' = 70, validation sets of sizes N val ' = 10 and N val '' = 10 and a test set of size N test = 10 have been generated to train, validate and test the ANN model; thus, the total number of T-H code runs performed to generate the training, validation and test sets in this case is N code,α = (N train ' + N val ' + N train '' + N val '' + N test ) = 50 + 10 + 70 + 10 +10 = 150. The accuracies and precisions of the optimized LS, LS + LHS, IS and IS + LHS methods are also compared on the basis of the performance indicators ε (11) and CI w (13) computed on S = 10 runs with N T = 5, 10, 20, 30, 40 and 50 samples each.

  the technique based on Markov Chain Monte Carlo (MCMC) simulation produces more accurate and precise failure probability estimates than those provided by the design point and gradient methods; the technique based on the identification of the design point performs better than the one based on gradient estimation. • an Artificial Neural Network (ANN) regression model has been built using a sequential, two-step training algorithm on a reduced-size set of examples of the input/output nonlinear relationships underlying the original system model code; then, the ANN model has been used as a fast-running surrogate of the original system model code in the determination of the LS important direction:

Figure 2 .Case study 1 :Figure 3 .Figure 4 .

 2134 Figure 2. Proposed method for estimating the LS important direction α: minimization of the variance

3 ATable 3 . 2 Case study 1 :

 3321 train = 50; N val = 10; N train ''= 100; N val ''= 20; N test = 10) 10000 (N train + N val + N train '' + N val '' + N test ) = 190 B Design point ≤ 10000* (N train + N val + N train '' + N val '' + N test ) = 190 C Gradient 10000 (N train + N val + N train '' + N val '' + N test ) = 190 D Variance minimization Not available** (N train + N val + N train '' + N val '' + N test ) = 190 MCMC Original system model code (N train + N val + N train '' + N val '' + N test ) = 190 (N train + N val + N train '' + N val '' + N test ) = 190 B Design point ≤ (N train + N val + N train '' + N val '' + N test ) = 190* ≤ (N train + N val + N train '' + N val '' + N test ) = 190* C Gradient (N train + N val + N train '' + N val '' + N test ) = 190 (N train + N val + N train '' + N val '' + N test ) = 190 Different experimental settings 1, 2 and 3 considered for Application 1 of Case study 1. The three settings differ by i) the method for determining the important direction α; ii) the model for evaluating the system performance function g θ (•); iii) the number N α of system performance evaluations and iv) the total number N code,α of actual runs of the original system model code required by the whole process of determination of the LS important direction α * The number N α of system performance evaluations depends on the speed of convergence of the GA optimization algorithm ** The number N α of system performance evaluations depends on the speed of convergence of the GA optimization algorithm and on the number N T of samples drawn in step 2. of Section 4.Structural material subject to creep and fatigue -Application 1: N T = 10000

1 Literature methods 4.1.1 Normalized "center of mass" of the failure domain F

						1, the techniques proposed in the literature are critically reviewed;
	in Section 4.2, a new method based on the minimization of the variance of the LS failure probability
	estimator is proposed.
	4.The important unit vector α can be computed as the normalized "center of mass" of the failure
	domain F of interest [25]. A point 0 θ is taken in the failure domain F: this can be done by
	engineering judgment when possible. Subsequently, 0 θ is used as the initial point of a Markov
	chain which lies entirely in the failure domain F. For that purpose, a Metropolis-Hastings algorithm
	is employed to generate a sequence of N s points { θ	u	u : =	, 1	, 2	...,	N	s	}	lying in the failure domain F
	[35]. The unit vectors	θ	u θ	u	2	, u = 1, 2, …, N s , are then averaged in order to obtain the LS
	important unit vector as

Table 4 here

 4 The results obtained in setting 1 show that method A (i.e., MCMC simulation) provides more accurate (i.e., the estimates are closer to the true values) and precise (i.e., the confidence intervals are narrower) estimates than methods B (i.e., design point) and C (i.e., gradient): the percentage

	errors ε are 0.421, 0.702 and 1.965, whereas the percentage 95% CI widths w CI are 2.222, 2.282,
	and 7.323 for methods A, B and C, respectively. This can be explained by the fact that method A
	relies on a "map" approximating the failure domain F under analysis (given by the failure samples
	generated through a Markov chain) and thus it provides in principle the most realistic and reliable
	estimate for the LS important direction α.
	Moreover, it is evident that method B (i.e., design point) performs consistently better than method C
	(i.e., gradient). Actually, although design points do not always represent the most important regions

of the failure domain F, especially in high-dimensional spaces

[START_REF] Schueller | A critical appraisal of reliability estimation procedures for high dimensions[END_REF]

, they still provide an acceptable indication of the real location of the failure region F of interest. On the contrary, calculating α through the normalized gradient of the performance function g θ (•) makes the values of the components of α strongly dependent on the point where the first-order, local approximations of the performance function g θ (•) are carried out, and thus would relate inherently local (and possibly misleading) information: this effect is particularly critical for nonlinear systems like that of the case at hand.

In setting 2 the evaluation of the system performance function g θ (•) for the determination of α is performed by replacing the original system model with an ANN (with N train ' = 50, N val ' = 10, N train '' = 100, N val '' = 20, N test = 10 input/output examples employed in the first-and second-step training, first-and second-step validation and test phases, respectively). The number N α of system performance evaluations is the same as in setting 1 (i.e., N α = 10000); however, the number N code,α of actual runs of the original system model code is much lower: indeed, in setting 1 N code,α = 10000, whereas in setting 2 N code,α = 190: this means that the overall computational effort associated to setting 2 is much lower than that of setting 1. methods A, B and C, respectively, in setting 1, and 2.723, 2.516 and 7.199 for methods A, B and C, respectively, in setting 2.

Table 5 here

 5 It is seen that:• the optimized Line Sampling methods (i.e., both LS and LS + LHS) provide more accurate and precise failure probability estimates than the other methods (i.e., both IS and IS + LHS): for example with N T = 5, the mean percentage errors ε are 16.305, 16.198, 75.041 and 65.771, whereas the percentage 95% CI widths CI w are 98.535, 92.477, 390.881 and 319.972 for the LS, LS + LHS, IS and IS + LHS methods, respectively;

Table 6 here

 6

Table 7

 7

	reports the values obtained for the

Table 7 here

 7 It is seen that:• the optimized Line Sampling methods (i.e., both LS and LS + LHS) provide more accurate and precise functional failure probability estimates than the other methods considered (i.e., both IS and IS + LHS): for example with N T = 5, the mean percentage errors ε are 16.045, 15.156, 84.801 and 38.671, whereas the percentage 95% CI widths CI w are 84.175, 67.387, and 212.079 for the LS, LS + LHS, IS and IS + LHS methods, respectively.• the use of LHS in combination with the optimized LS method in this case slightly increases the accuracy of the functional failure probability estimates: for example with N T = 10, the mean percentage errors ε are 12.547 and 7.378 for the LS and LS + LHS methods, respectively; moreover, the combination of LS and LHS in this case strongly increases the precision of the failure probability estimates: for example with N T = 10, the percentage 95% CI widths CI w are 84.175 and 67.387 for the LS and LS + LHS methods, respectively (a 20% increase in the precision of the estimate). • the use of LHS in combination with the IS method significantly increases both the accuracy and the precision of the functional failure probability estimates: for example with N T = 5, the mean percentage errors ε are 84.801 and 38.671, whereas the percentage

	95% CI widths CI w are 386.026 and 212.079 for the IS and IS + LHS methods,
	respectively;
	• by way of example, the 95% CI associated to a standard MCS-based estimate of P(F)

Table 2 .

 2 Shapes and parameters (i.e., mean µ and standard deviation σ) of the probability distribution functions associated to the uncertain variables {x j : j = 1, 2, ..., 6} of the probabilistic model (

	Name	Shape	Mean, µ Standard deviation, σ (% of µ)
	N c , x 1 Log-Normal	5490	20%
	N f , x 2	Log-Normal	17100	20%
	n c , x 3	Log-Normal	549	20%
	n f , x 4	Log-Normal	4000	20%
	θ 1 , x 5	Normal	0.42	20%
	θ 2 , x 6	Normal	6	20%

Table 4 .

 4 Values of the performance indicators ε and w CI obtained with N T = 10000 samples in settings 1, 2 and 3 (Table3) of Application 1 of Case study 1

	Setting 1

Case study 1: Structural material subject to creep and fatigue -Application 2 LS Sample size, N T ε [%]

			CI w [%]
	5	16.305	98.535
	10	11.506	68.619
	20	8.663	52.973
	30	7.130	39.595
	40	6.373	34.321
	50	5.654	29.361
		LS + LHS
	Sample size, N T	ε [%]	CI w [%]
	5	16.198	92.477
	10	11.504	61.820
	20	8.349	48.107
	30	7.111	37.655
	40	6.084	32.094
	50	5.266	27.393
		IS
	Sample size, N T	ε [%]	CI w [%]
	5	75.041	390.88
	10	55.433	285.60
	20	39.523	201.56
	30	32.014	160.43
	40	27.349	140.39
	50	25.537	135.03
		IS + LHS
	Sample size, N T	ε [%]	CI w [%]
	5	65.771	319.97
	10	33.745	219.21
	20	25.321	161.70
	30	22.437	150.84
	40	19.826	105.93
	50	17.593	90.315

Table 5 .

 5 Values of the performance indicators ε (11) and CI w (13) obtained with N T = 5, 10, 20, 30, 40 and 50 samples by the LS, LS + LHS, IS and IS + LHS methods in Application 2 of Case

	study 1

µ Standard deviation, σ (% of µ) Parameter uncertainty

	Power (MW), x 1	18.7	1%
	Pressure (kPa), x 2	1650	7.5%
	Cooler wall temperature (°C), x 3	90	5%

Table 6 .

 6 Epistemic uncertainties considered for the 600-MW GFR passive decay heat removal system of Figure 4[START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]

Case study 2 -Thermal-hydraulic passive system LS Sample size, N T ε [%]

			CI w [%]
	5	16.045	84.175
	10	12.547	58.292
	20	8.313	39.095
	30	7.459	34.832
	40	5.466	27.728
	50	3.848	19.324
		LS + LHS
	Sample size, N T	ε [%]	CI w [%]
	5	15.156	67.387
	10	7.378	31.264
	20	6.179	26.682
	30	5.486	26.419
	40	3.092	16.345
	50	2.373	13.590
		IS
	Sample size, N T	ε [%]	CI w [%]
	5	84.801	386.026
	10	45.982	223.828
	20	36.499	154.531
	30	33.846	115.521
	40	21.790	93.308
	50	18.281	85.22
		IS + LHS
	Sample size, N T	ε [%]	CI w [%]
	5	38.671	212.079
	10	30.174	122.647
	20	22.943	106.231
	30	21.195	100.854
	40	18.461	73.522
	50	16.916	71.069

Table 7 .

 7 Values of the performance indicators ε and CI

w obtained with N T

⋅ denotes the usual Euclidean measure of a vector.

1[START_REF]Safety related terms for advanced nuclear plant[END_REF] The gradient[START_REF]Safety related terms for advanced nuclear plant[END_REF] measures the relative importance of a particular uncertain variable with respect to the failure probability P(F): the larger the (absolute) value of a component of (5), the greater the

g θ (•) is evaluated by resorting to a fast-running ANN regression model approximating the original system performance function. The objective is to verify the possibility of reducing the computational cost associated to the LS method by using ANN regression models in place of the original system model. In particular, the ANN regression model is constructed on the basis of a small set of data representing examples of the input/output nonlinear relationships underlying the original system model; once built, the regression model is used to evaluate (in a negligible computational time) the system performance function g θ (•) for the determination of the important direction α (steps 4. and 5. of Section 3).

A classical three-layered feed-forward ANN (trained by the sequential, two-step error backpropagation algorithm described at the end of Section 4.1) is here adopted: the number of inputs to the ANN regression model is 6 (i.e., the number of uncertain variables in Table 2 of Section 5), whereas the number of outputs is 1 (i.e., the value of the system performance function). The number of nodes in the hidden layer has been set equal to 5 by trial and error. The first-step ANN model is Correspondingly, the total computational cost associated to the estimation of α in setting 2 is much lower than that of setting 1, in spite of the same number N α of system performance evaluations.

Actually, when a single run of the system model code lasts several hours (which is often the case for passive safety systems) the total number N code,α of simulations is the critical parameter which determines the overall computational cost associated to the method. Further, in setting 2, the methods A, B and C are compared to the new one proposed in this paper, i.e., the one based on the minimization of the variance of the LS failure probability estimator (labeled D, Section 4.2).

The final setting 3 is similar to setting 1: methods A, B and C are used to determine α and the original system model is run to evaluate the system performance function g θ (•); however, like in the previous setting 2, the number N α of system performance evaluations (and, thus, the actual number

TABLES

Methods of literature

Concept

Evaluations to be performed Computational tools adopted