E Zio

N Pedroni

Monte Carlo Simulation-based Sensitivity Analysis of the Model of a Thermal-Hydraulic Passive System

Keywords: nuclear passive system, functional failure probability, reliability sensitivity analysis, Subset Simulation, Line Sampling, Sobol indices

Thermal-Hydraulic (T-H) passive safety systems are potentially more reliable than active systems, and for this reason are expected to improve the safety of nuclear power plants.

However, uncertainties are present in the operation and modeling of a T-H passive system and the system may find itself unable to accomplish its function. For the analysis of the system functional failures, a mechanistic code is used and the probability of failure is estimated based on a Monte Carlo (MC) sample of code runs which propagate the uncertainties in the model and numerical values of its parameters/variables. Within this framework, sensitivity analysis aims at determining the contribution of the individual uncertain parameters (i.e., the inputs to the mechanistic code) to i) the uncertainty in the outputs of the T-H model code and ii) the probability of functional failure of the passive system. The analysis requires multiple (e.g., many hundreds or thousands) evaluations of the code for different combinations of system inputs: this makes the associated computational effort prohibitive in those practical cases in which the computer code requires several hours to run a single simulation.

.

Introduction

Modern nuclear reactor concepts make use of passive safety features, which do not need external input (especially energy) to operate [START_REF]Safety related terms for advanced nuclear plant[END_REF] and, thus, are expected to improve the safety of nuclear power plants because of simplicity and reduction of both human interactions and hardware failures [START_REF] Nayak | Passive system reliability analysis using the APSRA methodology[END_REF]- [START_REF] Nayak | Reliability assessment of passive isolation condenser system of AHWR using APSRA methodology[END_REF].

However, the aleatory and epistemic uncertainties involved in the operation and modeling of passive systems are usually larger than for active systems [START_REF] Apostolakis | The concept of probability in safety assessment of technological systems[END_REF], [START_REF] Helton | Alternative representations of epistemic uncertainties[END_REF]. Due to these uncertainties, the physical phenomena involved in the passive system functioning (e.g., natural circulation) might develop in such a way to lead the system to fail its function (e.g., decay heat removal): actually, deviations in the natural forces and in the conditions of the underlying physical principles from the expected ones can impair the function of the system itself [START_REF] Burgazzi | Passive system reliability analysis: a study on the isolation condenser[END_REF]- [START_REF] Han | A quantitative evaluation of reliability of passive systems within probabilistic safety assessment framework for VHTR[END_REF]. In the analysis of such functional failure behavior [START_REF] Burgazzi | Reliability evaluation of passive systems through functional reliability assessment[END_REF], the passive system is modeled by a mechanistic Thermal-Hydraulic (T-H) code and the probability of failing to perform the required function is estimated based on a Monte Carlo (MC) sample of code runs which propagate the uncertainties in the model and numerical values of its parameters/variables [START_REF] Jafari | Reliability evaluation of a natural circulation system[END_REF]- [START_REF] Zio | Quantitative functional failure analysis of a thermal-hydraulic passive system by means of bootstrapped Artificial Neural Networks[END_REF].

Within this framework, the objective of sensitivity analysis is twofold: i) the determination of the contribution of the individual uncertain parameters/variables (i.e., the inputs to the T-H code) to the uncertainty in the outputs of the T-H model code; ii) the quantification of the importance of the individual uncertain parameters/variables in affecting the performance (i.e., in practice, the functional failure probability) of the passive system [START_REF] Saltelli | Global sensitivity analysis[END_REF]- [START_REF] Marrel | Calculations of Sobol indices for the Gaussian process metamodel[END_REF]. In this view, the sensitivity analysis outcomes provide two important insights. On the one side, the analyst can identify those parameters/variables that are not important and may be excluded from the modeling and analysis; on the opposite side, the analyst is able to identify those parameters/variables whose epistemic uncertainty plays a major role in determining the functional failure of the T-H passive system: consequently, his/her efforts can be focused on increasing the state-of-knowledge on these important parameters/variables and the related physical phenomena (for example, by the collection of experimental data one may achieve an improvement in the state-of-knowledge on the correlations used to model the heat transfer process in natural convection, and a corresponding reduction in the uncertainty) [START_REF] Arul | Adjoint operator approach to functional reliability analysis of passive fluid dynamical systems[END_REF], [START_REF] Zio | Quantitative functional failure analysis of a thermal-hydraulic passive system by means of bootstrapped Artificial Neural Networks[END_REF]. In the present context of passive system functional failure probability assessment the attention will be mainly focused on this latter aspect, i.e., the identification of those uncertain variables playing a key role in the determination of the passive system performance.

In all generality, approaches to sensitivity analysis can be either local or global. As the name suggests, local methods consider the variation in the system model output that results from a local perturbation about some nominal input value. In the limit view, the sensitivity measure of the contribution of a generic uncertain input parameter to the uncertainty of the output is the partial derivative of the output with respect to the input parameter itself calculated around the nominal values of the input parameters. Such measure identifies the critical parameters as those whose variation leads to the most variation in the output [START_REF] Saltelli | Global sensitivity analysis[END_REF], [START_REF] Saltelli | Sensitivity analysis for chemical models[END_REF]. On the contrary, global techniques aim at determining which of the uncertain input parameters influence the output the most when the uncertainty in the input parameters is propagated through the system model [START_REF] Borgonovo | A new uncertainty importance measure[END_REF]. In this view, the term "global" has two meanings: the first one is that, for one input parameter whose uncertainty importance is evaluated, the effect of the entire uncertainty distribution of this parameter is considered; the second one is that the importance of this input parameter should be evaluated with all other input parameters varying as well [START_REF] Saltelli | Making best use of model evaluations to compute sensitivity indices[END_REF]. Examples of methods for global sensitivity analysis include the so-called variance-based techniques (such as those relying on the computation of Sobol indices [START_REF] Homma | Importance measures in global sensitivity analysis of model output[END_REF], [START_REF] Saltelli | Global sensitivity analysis[END_REF], [START_REF] Saltelli | Making best use of model evaluations to compute sensitivity indices[END_REF]- [START_REF] Saltelli | Sensitivity analysis for importance assessment[END_REF] or the Fourier Amplitude Sensitivity Test (FAST) [START_REF] Saltelli | A quantitative model-independent for global sensitivity analysis of model output[END_REF]) and the more recent moment independent techniques [START_REF] Borgonovo | A new uncertainty importance measure[END_REF], [START_REF] Chun | An uncertainty importance measure using a distance metric for the change in a cumulative distribution function[END_REF]- [START_REF] Borgonovo | Moment Independent Importance Measures: New Results and Analytical Test Cases[END_REF]. The interested reader may refer to [START_REF] Saltelli | Global sensitivity analysis[END_REF], [START_REF] Saltelli | Sensitivity analysis for chemical models[END_REF], [START_REF] Saltelli | Sensitivity analysis. Probability and statistics series[END_REF]- [START_REF] Campolongo | Simplifying a large chemical reaction model via an effective screening design[END_REF] for detailed and updated surveys on sensitivity analysis methods.

Regardless of the technique employed, sensitivity analysis relies on multiple (e.g., many hundreds or thousands) evaluations of the system model (code) for different combinations of system inputs. This makes the associated computational effort very high and at times prohibitive in practical cases in which the computer codes require several hours (or even days) to run a single simulation [START_REF] Fong | Reliability analysis of a passive cooling system using a response surface with an application to the flexible conversion ratio reactor[END_REF], [START_REF] Pourgol-Mohamad | Methodology for the use of experimental data to enhance model output uncertainty assessment in thermal hydraulics codes[END_REF] 1 . Further, in the present context of nuclear passive systems, the computational issue is even more dramatic because the estimation of the functional failure probability is also of interest besides the sensitivity analysis of the passive system performance: as a consequence, the (typically, hundreds of thousands) simulations performed for estimating the functional failure probability have to be added to those carried out for the sensitivity analysis.

In light of the computational problem, the main objective of the present study is to show the possibility of efficiently embedding the sensitivity analysis of the performance of a nuclear passive system within the estimation of its functional failure probability, while resorting to a reasonably limited number of system model code evaluations. To this aim, the use of two advanced Monte Carlo Simulation (MCS) methods, namely Subset Simulation (SS) [START_REF] Au | Estimation of small failure probabilities in high dimensions by subset simulation[END_REF], [START_REF] Au | Subset Simulation and its application to seismic risk based on dynamic analysis[END_REF] and Line Sampling (LS) [START_REF] Koutsourelakis | Reliability of structures in high dimensions, Part I: algorithms and application[END_REF], [START_REF] Pradlwarter | Realistic and efficient reliability estimation for aerospace structures[END_REF] is investigated.

In the SS approach, the functional failure probability is expressed as a product of conditional probabilities of some chosen intermediate events. Then, the problem of evaluating the probability of functional failure is tackled by performing a sequence of simulations of these intermediate events in their conditional probability spaces; the necessary conditional samples are generated through successive Markov Chain Monte Carlo (MCMC) simulations [START_REF] Metropolis | Equations of state calculations by fast computing machines[END_REF], in a way to gradually populate the intermediate conditional regions until the final functional failure region is reached. Two approaches of literature are here considered for performing the sensitivity analysis of the passive system performance by SS: the first one is local and embraces the so-called concept of reliability sensitivity, in which the sensitivity of the performance of the passive system to a given uncertain input variable is quantified as the partial derivative of the system failure probability with respect to the parameters (e.g., the mean, the variance, …) of the probability distribution of the input variable itself [START_REF] Song | Subset simulation for structural reliability sensitivity analysis[END_REF]; the second one is global and employs the conditional samples generated by MCMC simulation to obtain the entire distribution of the system failure probability conditional on the values of the individual uncertain input parameters/variables [START_REF] Au | Reliability-based design sensitivity by efficient simulation[END_REF], [START_REF] Au | Compartment fire risk analysis by advanced Monte Carlo simulation[END_REF].

In the LS method, lines, instead of random points, are used to probe the failure domain of the multidimensional problem under analysis. An "important vector" is optimally determined to point towards the failure domain of interest and a number of conditional, one-dimensional problems are solved along such direction, in place of the multi-dimensional problem [START_REF] Koutsourelakis | Reliability of structures in high dimensions, Part I: algorithms and application[END_REF], [START_REF] Pradlwarter | Realistic and efficient reliability estimation for aerospace structures[END_REF]. In this approach, the sensitivity of the passive system performance to the uncertain system input parameters/variables can be studied through the examination of the elements of the LS important vector pointing to the failure region: a local informative measure of the relevance of a given uncertain variable in affecting the performance (i.e., in practice, the functional failure probability) of the passive system is the magnitude of the corresponding element in the LS important vector [START_REF] Song | Improved line sampling method for structural reliability with high dimensionality and small failure probability[END_REF]- [START_REF] Song | Reliability and Sensitivity Analysis of Transonic Flutter Using Improved Line Sampling Technique[END_REF].

The SS-and LS-based approaches to sensitivity analysis are tested on two case studies: the first one is based on the highly nonlinear and non-monotonous Ishigami function [START_REF] Homma | Importance measures in global sensitivity analysis of model output[END_REF], [START_REF] Saltelli | Global sensitivity analysis[END_REF]; the second one involves the natural convection cooling in a Gas-cooled Fast Reactor (GFR) after a Loss of Coolant Accident (LOCA) [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]. The results obtained by the SS-and LS-based sensitivity analysis techniques are compared to those produced by global first-and total-order Sobol indices [START_REF] Saltelli | Global sensitivity analysis[END_REF], [START_REF] Sobol | Sensitivity analysis for nonlinear mathematical model[END_REF].

In synthesis, the main contributions of the present paper are the following: applying the SS and LS methods to embed the sensitivity analysis of the performance of a nuclear passive system within the estimation of its failure probability, while resorting to a reasonably limited number of system model code evaluations: to the best of the authors' knowledge, this is the first time that SS-and LS-based sensitivity analysis methods are applied to nuclear passive systems; comparing the results obtained by the following approaches to sensitivity analysis: i) SSbased local and global (reliability) sensitivity analyses, ii) LS-based local (reliability) sensitivity analysis and iii) "classical" variance-based global sensitivity analysis relying on the computation of Sobol indices; challenging approaches i)-iii) mentioned above in problems where the failure region of the passive system is composed by multiple, disconnected parts.

The reminder of the paper is organized as follows. In Section 2, a snapshot on the functional failure analysis of T-H passive systems is given. In Section 3, the SS and LS methods here employed for efficiently embedding the sensitivity analysis of the performance of a nuclear passive system within the estimation of its functional failure probability are presented. In Sections 4 and 5, the case studies concerning the Ishigami function and the passive cooling of a GFR are presented, together with the corresponding results. Finally, conclusions are provided in the last Section.

Functional failure analysis of T-H passive systems

The basic steps of a functional failure analysis of a T-H passive system are [START_REF] Marquès | Methodology for the reliability evaluation of a passive system and its integration into a probabilistic safety assessment[END_REF]:

1. Detailed modeling of the system response by means of a deterministic, best-estimate (typically long-running) T-H code.

Identification of the vector

x = {x 1 , x 2 , …, x j , …,
( ) Y x Y g α - = x x) ( , failure occurs if 0 ) ( > x x g
. The probability P(F) of system functional failure can then be expressed by the multidimensional integral:

( ) ( ) ∫∫ ∫ = x x x d q I F P F ) ( ... (1)
where ( ) ⋅ q is the joint Probability Density Function (PDF) representing the uncertainty in the parameters x , F is the failure region (where g x (•) > 0) and I F (·) is an indicator function such that I F (x) = 1, if x ∈ F and I F (x) = 0, otherwise. Notice that the evaluation of integral (1) above entails multiple (e.g., many thousands) evaluations of the T-H code for different sampled combinations of system inputs. The computational burden posed by the uncertainty propagation and sensitivity analysis of steps 3. and 4. above is addressed by resorting to the Subset Simulation (SS) [START_REF] Au | Estimation of small failure probabilities in high dimensions by subset simulation[END_REF], [START_REF] Au | Subset Simulation and its application to seismic risk based on dynamic analysis[END_REF] and Line Sampling (LS) [START_REF] Koutsourelakis | Reliability of structures in high dimensions, Part I: algorithms and application[END_REF], [START_REF] Pradlwarter | Realistic and efficient reliability estimation for aerospace structures[END_REF] techniques, whose main concepts are given in the following Section.

Computational methods employed in this study

In this Section, the SS (Sections 3.1) and LS (Sections 3.2) methods employed in this study for embedding an efficient sensitivity analysis of the performance of a nuclear passive system within the estimation of its functional failure probability are presented.

Subset Simulation

The Subset Simulation (SS) algorithm and its use for sensitivity analysis are briefly illustrated in Sections 3.1.1 and 3.1.2, respectively.

The algorithm

The idea underlying the Subset Simulation (SS) method is to convert the simulation of an event (e.g., the rare failure event) into a sequence of simulations of intermediate conditional events corresponding to subsets (or subregions) of the uncertain input parameter space: in this way, a rare event simulation is converted into a sequence of simulations of more frequent events.

During simulation, the conditional samples (lying in the intermediate subsets or subregions) are generated by means of Markov chains; by so doing, the conditional samples gradually populate the successive intermediate subsets (or subregions) up to the target (failure) region [START_REF] Au | Estimation of small failure probabilities in high dimensions by subset simulation[END_REF], [START_REF] Au | Subset Simulation and its application to seismic risk based on dynamic analysis[END_REF].

In extreme synthesis, the SS algorithm proceeds as follows [START_REF] Au | Estimation of small failure probabilities in high dimensions by subset simulation[END_REF], [START_REF] Au | Subset Simulation and its application to seismic risk based on dynamic analysis[END_REF], [START_REF] Au | Reliability-based design sensitivity by efficient simulation[END_REF], [START_REF] Au | Compartment fire risk analysis by advanced Monte Carlo simulation[END_REF] ). By so doing, the sample estimate of P(F 2 |F 1 ) is still equal to p 0 . This procedure is repeated until the samples lying in the . Finally, the failure probability P(F) is computed as follows:

( ) ( ) ( ) ( )

N N p F P F F P F P F P m m m i i i ⋅ = ≈ = - = - ∏ 1 0 2 1 1 | (2)
The superior efficiency of SS with respect to standard MCS in the estimation of small failure probabilities has been widely demonstrated in the open literature: the interested reader may refer to [START_REF] Au | Estimation of small failure probabilities in high dimensions by subset simulation[END_REF], [START_REF] Au | Subset Simulation and its application to seismic risk based on dynamic analysis[END_REF] for mathematical details, to [START_REF] Au | Compartment fire risk analysis by advanced Monte Carlo simulation[END_REF], [START_REF] Ching | Hybrid subset simulation method for reliability estimation of dynamical systems subject to stochastic excitation[END_REF]- [START_REF] Pradlwarter | Application of line sampling simulation method to reliability benchmark problems[END_REF] for illustrative applications to highdimensional (i.e., n ≥ 100) structural reliability problems and to [START_REF] Zio | Functional failure analysis of a thermal-hydraulic passive system by means of Line Sampling[END_REF] for an application to the functional failure analysis of a T-H passive system.

Sensitivity analysis by SS

Two approaches of literature are here considered for performing sensitivity analyses by SS within the framework of failure probability assessment: the first one is local and embraces the concept of reliability sensitivity (Section 3.1.2.1); the second one is global and employs the conditional samples generated by MCMC simulation to obtain the entire distribution of the system failure probability conditional on the values of the individual uncertain input parameters (Section 3.1.2.2).

Local reliability sensitivity analysis

In the framework of reliability sensitivity, the sensitivity to a given uncertain input variable is defined as the partial derivative of the system failure probability with respect to the parameters (e.g., the mean, the standard deviation, …) of the probability distribution of the input variable itself [START_REF] Song | Subset simulation for structural reliability sensitivity analysis[END_REF], [START_REF] Lu | Reliability sensitivity method by Line Sampling[END_REF], [START_REF] Liu | Probabilistic sensitivity analysis methods for design under uncertainty[END_REF]- [START_REF] Wu | Variable screening and ranking using sampling-based sensitivity measures[END_REF].

Based on (2), the partial derivative ( )

j x F P ϕ ∂ ∂ of
( ) ( ) ( ) ( ) ( ) ( ) ( ) ∑ = - - ∂ ∂ + ∂ ∂ = ∂ ∂ m i x i i i i x x j j j F F P F F P F P F P F P F P F P 2 1 1 1 1 | | ϕ ϕ ϕ , j = 1, 2, …, n i . ( 3
)
It can be demonstrated (through lengthy mathematical operations here not reported for brevity sake) that the SS estimators ( )

j x F P ϕ ∂ ∂ 1 ˆ, j = 1, 2, …, n i , and (
)

j x i i F F P ϕ ∂ ∂ -1 | ˆ, j = 1, 2, …, n i , i = 1, 2, …, m, for ( ) j x F P ϕ ∂ ∂ 1 and
( )

j x i i F F P ϕ ∂ ∂ -1

|

, respectively, are [START_REF] Song | Subset simulation for structural reliability sensitivity analysis[END_REF]:

( ) ( ) ( ) ( ) ∑ =         ∂ ∂ = ∂ ∂ N k x k k k F x j j q q I N F P 1 0 0 0 1 1 1 ˆϕ ϕ x x x (4) ( ) ( ) ( ) ( ) ( ) ( ) ∑ ∑ = - = - - - - - -                   ∂ ∂ - ∂ ∂ = ∂ ∂ N k i l x l l l l x k i k i k i F x i i j j i j F F P F F P q q I N F F P 1 1 1 1 1 1 1 1 1 | | ˆ1 1 1 | ˆϕ ϕ ϕ x x x . ( 5
)
where k 0 x and k i 1 -

x are defined in Section 3.1.1. Substituting (4) and ( 5) into (3), the estimator ( )

j x F P ϕ ∂ ∂ ˆ for ( ) j x F P ϕ ∂ ∂
is readily obtained. For further mathematical details, the interested reader may refer to [START_REF] Song | Subset simulation for structural reliability sensitivity analysis[END_REF], from which equations (3)-( 5) are taken.

Global sensitivity analysis based on conditional samples

The Markov chain samples generated by SS can be used to draw information about the most probable configurations of uncertain input parameters/variables that will occur in the case of system failure [START_REF] Au | Reliability-based design sensitivity by efficient simulation[END_REF], [START_REF] Au | Compartment fire risk analysis by advanced Monte Carlo simulation[END_REF]. In particular, comparing the probability density function ) | ( F x q j of the uncertain parameter x j , j = 1, 2, …, n i , conditional to the occurrence of system failure F, with the unconditional probability density function q(x j ), the importance of parameter x j in determining system failure can be inferred. Formally, for any given value of x j the Bayes' theorem reads

) ( ) ( ) | ( ) | ( F P x q F x q x F P j j j = , j = 1, 2, …, n i (6) so that ) | ( j x F P is insensitive to x j when ) | ( F x q j ~ ) ( j x q
, i.e. when the conditional probability

density function ) | ( F x q j
is similar in shape to the PDF q(x j ) [START_REF] Au | Estimation of small failure probabilities in high dimensions by subset simulation[END_REF], [START_REF] Au | Subset Simulation and its application to seismic risk based on dynamic analysis[END_REF], [START_REF] Au | Reliability-based design sensitivity by efficient simulation[END_REF], [START_REF] Au | Compartment fire risk analysis by advanced Monte Carlo simulation[END_REF]. Intuitively, the sensitivity of the failure probability of the system to its uncertain input parameters/variables can thus be studied by examining the change of the sample distributions q(x j |F i ), j = 1, 2, …, n i , i = 1, 2, …, m, at different conditional levels F i , i = 1, 2, …, m: in particular, the more significant the change (or, in other words, the more significant the difference between the shapes of the sample distributions q(x j |F i ) and the shape of the original distribution

) ( j x q
), the larger the sensitivity of the system performance (and of the failure probability) to the corresponding uncertain parameter/variable x j , j = 1, 2, …, n i . See [START_REF] Zio | Estimation of the functional failure probability of a thermalhydraulic passive systems by means of Subset Simulation[END_REF], [START_REF] Au | Subset Simulation and its application to seismic risk based on dynamic analysis[END_REF], [START_REF] Au | Reliability-based design sensitivity by efficient simulation[END_REF] and [START_REF] Au | Compartment fire risk analysis by advanced Monte Carlo simulation[END_REF] for illustrative applications of this intuitive approach.

The information contained in the empirical conditional distributions q(

x j |F i ), j = 1, 2, …, n i , i = 1, 2,
…, m, generated by MCMC simulation can then be used to refine the intuitive sensitivity information described above by obtaining the entire distribution of the system failure probability conditional on the values of the individual uncertain input parameters, i.e. P(F|x j ), according to (10):

this information is relevant because it quantifies how the failure probability P(F) of the system would change if the value of the uncertain parameter x j were set to a given value (e.g., if its epistemic uncertainty were reduced).

This approach can be considered global in the sense of [START_REF] Saltelli | Sensitivity analysis for importance assessment[END_REF] (see the Introduction) because during the SS procedure i) the whole range of variability of each uncertain input variable x j , j = 1, 2, …, n i , is "searched" through subsequent MCMC simulations to produce the entire distribution of the system failure probability conditional on the values of each individual uncertain input variable, i.e.

P(F|x j ), j = 1, 2, …, n i ; ii) the conditional samples of each uncertain input variable x j , j = 1, 2, …, n i , distributed as q(x j |F i ), j = 1, 2, …, n i , i = 1, 2, …
, m, are generated by MCMC while all other uncertain input parameters are "varying" (i.e., are being sampled) as well.

Line Sampling

Line Sampling (LS) is a probabilistic simulation method for efficiently computing small failure probabilities. It was originally developed for the reliability analysis of complex structural systems [START_REF] Koutsourelakis | Reliability of structures in high dimensions, Part I: algorithms and application[END_REF]. The underlying idea is to employ lines instead of random points in order to probe the failure domain of the high-dimensional system under analysis [START_REF] Pradlwarter | Realistic and efficient reliability estimation for aerospace structures[END_REF]. The Line Sampling (LS) algorithm and its use for sensitivity analysis are briefly illustrated in Sections 3.2.1 and 3.2.2, respectively.

The algorithm

In extreme synthesis, the computational steps of the LS algorithm are [START_REF] Pradlwarter | Realistic and efficient reliability estimation for aerospace structures[END_REF], [START_REF] Pradlwarter | Application of line sampling simulation method to reliability benchmark problems[END_REF]:

1. From the original multidimensional joint probability density function ( ) 3. In the standard normal space, determine the unit important direction

) , 0 [ : ∞ → ℜ ⋅ n q , sample N T vectors { } T k N k ..., , 2 , 1 : = x , with { } k n k j k k k i x x x x ..., , ..., , , 2 1 = x . 2. Transform the N T sample vectors { } T k N k ..., , 2
{ } i n j α α α α ..., , ..., , , 2 1 = α
T (hereafter also called "important unit vector" or "important direction") pointing towards the failure domain F of interest.

4. Reduce the problem of computing the high-dimensional failure probability integral (1) to a number of conditional one-dimensional problems, solved along the "important direction" α in the standard normal space: in particular, estimate N T conditional "one-dimensional" failure probabilities

( ) { } T k N k F P ..., , 2 , 1 : ˆ, 1 = D , corresponding to each one of the standard normal samples { } T k N k ..., , 2 , 1 :
= θ obtained in step 2. above (see [START_REF] Pradlwarter | Realistic and efficient reliability estimation for aerospace structures[END_REF], [START_REF] Pradlwarter | Application of line sampling simulation method to reliability benchmark problems[END_REF] for details).

5. Compute the unbiased estimator ( )

F P ˆ
for the failure probability ( )

F P and its variance ( ) [ ] F P 2 σ as: ( ) ( ) ∑ = ⋅ = T N k k T F P N F P 1 , D 1 1 ˆ, (7) ( )
[ ]

F P 2 σ = ( ) ( ) ( ) ( ) ∑ = - ⋅ - T N k k D T T F P F P N N 1 2 , 1 1 1 . (8)
The LS method has been shown to significantly reduce the variance (8) of the estimator (7) of the failure probability integral (1) [START_REF] Zio | Functional failure analysis of a thermal-hydraulic passive system by means of Line Sampling[END_REF], [START_REF] Zio | An optimized Line Sampling method for the estimation of the failure probability of nuclear passive systems[END_REF], [START_REF] Koutsourelakis | Reliability of structures in high dimensions, Part I: algorithms and application[END_REF], [START_REF] Pradlwarter | Realistic and efficient reliability estimation for aerospace structures[END_REF], [START_REF] Song | Improved line sampling method for structural reliability with high dimensionality and small failure probability[END_REF]- [START_REF] Song | Reliability and Sensitivity Analysis of Transonic Flutter Using Improved Line Sampling Technique[END_REF], [START_REF] Pradlwarter | Application of line sampling simulation method to reliability benchmark problems[END_REF], [START_REF] Schueller | A critical appraisal of reliability estimation procedures for high dimensions[END_REF]- [START_REF] Valdebenito | The role of the design point for calculating failure probabilities in view of dimensionality and structural nonlinearities[END_REF].

It is worth noting that the LS technique outlined above can be applied also to systems with multiple failure regions

( ) { } ( ) { } 0 : 0 : > = > = θ θ x x l l x l g g F θ , l = 1, 2, …, N F . These multiple failure regions ( ) { } ( ) { } 0 : 0 : > = > = θ θ x x l l x l g g F θ , l = 1, 2, …, N F ,
can be identified by i) enumerating all (or, at least, the most likely and relevant) failure modes of the system 2 and ii) associating each failure mode with one failure region α : in such a case, the corresponding failure regions F 1 and F 2 can be identified as

( ) { } ( ) { } 0 : 0 : > = > = θ θ x x l l x l g g F θ , l = 1, 2, …, N F .
( ) { } 0 : 1 1 > = x x x g F = ( ) { } 0 : 1 1 > -Y Y α x x and ( ) { } 0 : 2 2 > = x x x g F = ( ) { } 0 : 2 2 > -Y Y α x x ,
respectively. When multiple failure regions are present, an "important direction" α l has to be identified for each failure region F l , l = 1, 2, …, N F . Then, each one of the standard normal samples

{ } T k N k ..., , 2 , 1 : = θ obtained in step 2.
of the LS algorithm has to be associated in a unique manner to one of the identified directions; the method proposed by Schueller et al. ( 2004) [START_REF] Schueller | A critical appraisal of reliability estimation procedures for high dimensions[END_REF] can be employed to this aim: the interested reader is referred to the original reference for details.

Those samples among { }

T k N k ..., , 2 , 1 : = θ that belong to the l th failure region F l , l = 1, 2, …, N F ,
∑ = = F N l l F P F P 1 ˆ. ( 9
)
On the contrary, if the failure regions F l , l = 1, 2, …, N F , are overlapping, some modifications to the procedure here outlined are required to ensure that the estimates ( )

l F P ˆ, l = 1, 2, …, N F , do not
contain contributions from other failure domains. However, since the analysis of this situation goes beyond the scopes of the present paper, mathematical details are not reported here for brevity: the interested reader is referred to [START_REF] Lu | Reliability sensitivity method by Line Sampling[END_REF], [START_REF] Schueller | A critical appraisal of reliability estimation procedures for high dimensions[END_REF].

As a final remark, notice that the efficiency of the LS method depends on the accurate determination of the important direction α (step 3. of the algorithm above) [START_REF] Zio | An optimized Line Sampling method for the estimation of the failure probability of nuclear passive systems[END_REF], [START_REF] Koutsourelakis | Reliability of structures in high dimensions, Part I: algorithms and application[END_REF], [START_REF] Pradlwarter | Realistic and efficient reliability estimation for aerospace structures[END_REF], [START_REF] Valdebenito | The role of the design point for calculating failure probabilities in view of dimensionality and structural nonlinearities[END_REF]. In this work, the method based on the normalized "center of mass" of the failure domain F has been employed [START_REF] Koutsourelakis | Reliability of structures in high dimensions, Part I: algorithms and application[END_REF]. In particular, A point 0 θ is taken in the failure domain F. Subsequently, 0 θ is used as the initial point of a Markov chain which lies entirely in the failure domain F. For that purpose, a [START_REF] Burgazzi | Evaluation of uncertainties related to passive systems performance[END_REF], [START_REF] Burgazzi | Addressing the uncertainties related to passive system reliability[END_REF]; when possible, the qualitative information provided by the hazard identification methods mentioned above may be completed by numerical results produced by quantitative techniques, such as the optimum criterion method [START_REF] Zhao | System reliability assessment by method of moments[END_REF] and stochastic limit analysis [START_REF] Lu | Reliability sensitivity method by Line Sampling[END_REF] originally developed within the field of structural reliability.

∑ = ⋅ = s N u u u s N 1 2 1 θ θ α
. This direction provides a good "map" of the failure domain and thus it provides in principle a realistic indication of the actual location of the failure domain and, thus, a reliable estimate for the LS important direction α.

Local reliability sensitivity analysis by LS

The important unit vector For example, in the situation depicted in Figure 1, left, the system would be driven to failure much more effectively by an increase in Parameter 2 rather than by an increase in Parameter 1; on the contrary, in the situation represented in Figure 1, right, an increase in Parameter 1 would be much more important in determining system failure than an increase in Parameter 2. In this view, the sensitivity of the passive system performance to the individual uncertain inputs can be studied by comparing the magnitudes of the components of α: see [START_REF] Zio | Functional failure analysis of a thermal-hydraulic passive system by means of Line Sampling[END_REF] for a preliminary application of this concept to the model of a nuclear passive system.

{ } i n j α α α α ..., , ..., , , 2 1

Figure 1

This intuitive concept was put in a formal framework in [START_REF] Song | Improved line sampling method for structural reliability with high dimensionality and small failure probability[END_REF]- [START_REF] Song | Reliability and Sensitivity Analysis of Transonic Flutter Using Improved Line Sampling Technique[END_REF]: in particular, embracing the concept of reliability sensitivity, the authors derived formal expressions for the LS estimators

j j F P α µ θ ∝ ∂ ∂ ˆ and ( ) ( ) 2 ˆj j F P α σ θ ∝ ∂ ∂
[68]- [START_REF] Song | Reliability and Sensitivity Analysis of Transonic Flutter Using Improved Line Sampling Technique[END_REF], which confirms the intuition that the sensitivity of the system failure probability P(F) to a given uncertain input variable θ j is proportional to the magnitude of the corresponding component α j of the important vector α.

Finally, based on [START_REF] Burgazzi | Thermal-hydraulic passive system reliability-based design approach[END_REF], it is straightforward to show that in the case of multiple, non-overlapping failure regions F l , l = 1, 2, …, N F , ( )

j F P θ µ ∂ ∂ ˆ = ( ) ∑ = ∂ ∂ F j N l l F P 1 ˆθ µ and ( ) j F P θ σ ∂ ∂ ˆ = ( ) ∑ = ∂ ∂ F j N l l F P 1 ˆθ σ , with ( ) l j l j F P α µ θ ∝ ∂ ∂ ˆ and ( ) ( ) 2 ˆl j l j F P α σ θ ∝ ∂ ∂ [68]-[71].

Case study 1: Ishigami function

In this Section, the case study involving the well-known Ishigami function [START_REF] Homma | Importance measures in global sensitivity analysis of model output[END_REF] is illustrated: in particular, in Section 4.1, few details about the model are provided; in Section 4.2, the results of the application of the SS and LS methods for the sensitivity analysis of the model of Section 4.1 are illustrated.

The model

The Ishigami function ( 20) [START_REF] Homma | Importance measures in global sensitivity analysis of model output[END_REF] is frequently adopted as a benchmark in sensitivity studies due to its challenging properties, i.e., nonlinearity, non-monotonicity and presence of interactions between the uncertain input variables [START_REF] Saltelli | Global sensitivity analysis[END_REF], [START_REF] Marrel | Calculations of Sobol indices for the Gaussian process metamodel[END_REF], [START_REF] Saltelli | Sensitivity analysis. Probability and statistics series[END_REF], [START_REF] Storlie | Implementation and evaluation of nonparametric regression procedures for sensitivity analysis of computationally demanding models[END_REF]:

( ) ( ) ( ) ( ) ( ) 1 4 3 2 2 1 3 2 1 sin 1 . 0 sin 7 sin , , x x x x x x x Y Y + + = = x ( 10
)
where x 1 , x 2 and x 3 are uncertain input variables following a uniform distribution on [-π, +π].

Since the main objective of the present paper is to perform the sensitivity analysis of the performance (or, in other word, the functional failure probability) of a nuclear passive system, the Ishigami function Y(x) [START_REF] Woo | The statistical analysis of the passive system reliability in the Nuclear Power Plants (NPPs)[END_REF] is artificially modified to this aim. In particular, using the notation of Section 2, Y(x) [START_REF] Woo | The statistical analysis of the passive system reliability in the Nuclear Power Plants (NPPs)[END_REF] is taken as the indicator of the performance of a fictitious passive system and an hypothetical failure threshold α Y = 16.5 is correspondingly introduced: this leads to define the associated Performance Function (PF) or Limit State Function (LSF) g x (x) as

g x (x) = Y(x) -α Y = ( ) ( ) ( ) 5 . 16 sin 1 . 0 sin 7 sin 1 4 3 2 2 1 - + + x x x x . ( 11
)
Then, the fictitious passive system characterized by the LSF ( 21) is supposed to fail when its LSF becomes larger than or equal to 0, i.e., g x (x) ≥ 0. The true (i.e., reference) probability P(F) of the failure event F = {g x (x) ≥ 0} is 5.566•10 -4 , obtained by standard MCS with N T = 500000 samples drawn.

Figure 2 shows the failure region F = {x: g x (x) ≥ 0} (dark areas) associated to the LSF g x (x) [START_REF] Han | A quantitative evaluation of reliability of passive systems within probabilistic safety assessment framework for VHTR[END_REF] based on the Ishigami function Y(x) [START_REF] Woo | The statistical analysis of the passive system reliability in the Nuclear Power Plants (NPPs)[END_REF] in the space of the uncertain input variables {x j : j = 1, 2, 3}. It is interesting to note that the failure region F = {x: g x (x) ≥ 0} is composed by four disconnected (i.e., not overlapping) failure regions {F l : l = 1, 2, 3, 4}, i.e.,

F = F 1 ∪ F 2 ∪ F 3 ∪ F 4 .
3 2 1 4 ∈ - - ∈ ∈ = x x x F x ( 15
)
Notice that ( 22)-( 25) are characterized by important symmetry properties: in particular, in failure regions F 1 and F 4 parameter x 2 ranges between -1.9963 and -1.1514, whereas in failure regions F 2 and F3 it symmetrically ranges between 1.1514 and 1.9963; further, in failure regions F 1 and F 2 parameter x 3 ranges between -3.1414 and -3.0390, whereas in failure regions F 3 and F 4 it symmetrically ranges between 3.0390 and 3.1414 3 .

Figure 2 4.2 Application

In this Section, the SS and LS methods are applied for i) the estimation of the failure probability

Failure probability estimation

For completeness and only for illustration purposes, Table 1 reports the values of the estimates ( )

F P ˆ
of the failure probability P(F) obtained by SS with N T = 3700 samples (i.e., m = 4 simulation levels, each with N = 1000 samples) and LS with N T = 3700; for comparison purposes, the results obtained by standard MCS with the same number N T = 3700 of samples are also presented. In order to evaluate the accuracy of the estimates, a "true" value of the failure probability P(F) is also reported in Table 1 for reference (i.e., P(F) = 5.566•10 -4 ); as mentioned above, this has been obtained by standard MCS with a very large number N T (i.e., N T = 500000) of simulations. Finally, in order to evaluate the precision of the estimates, the standard deviation

( ) [ ] F P σ of ( ) F P ˆ is also computed.

Table 1

As expected, LS outperforms the other methods in terms of accuracy (i.e., the LS failure probability estimate ( )

F P ˆ
is closer to the true value P(F) than those of the other methods) and precision (i.e., the standard deviation

( ) [ ] F P σ of ( ) F P ˆ
is lower than those of the other methods) of the failure probability estimates.

Sensitivity analysis results

The same N T = 3700 samples used in the previous Section 4.2.1 to estimate the failure probability of the synthetic passive system of Section 4.1 are here employed for studying the sensitivity of its performance (i.e., of its failure probability) to the uncertain input variables. In Section 4.

Local reliability sensitivity results

Since the results produced by the LS method are obtained in the standard normal space by construction (see Sections 3.2.1 and 3.2.2 for details), for fair comparison with the other methods, the uncertain input variables {x j : j = 1, 2, 3} in [START_REF] Han | A quantitative evaluation of reliability of passive systems within probabilistic safety assessment framework for VHTR[END_REF] have been transformed into {θ j : j = 1, 2, 3} in the standard normal space and also the system LSF g x (x) [START_REF] Han | A quantitative evaluation of reliability of passive systems within probabilistic safety assessment framework for VHTR[END_REF] has been transformed into g θ (θ) in the standard normal space: thus, the partial derivatives of the system failure probability with respect to the parameters of the distributions of the uncertain input variables are calculated in the standard normal space for all the simulation methods considered.

Table 2

Considering, e.g., the (reference) results obtained by standard MCS with N T = 500000 samples, one would infer that:

moving the mean 1 θ µ of the probability distribution of θ 1 from its nominal value (i.e., 0) towards positive values increases the failure probability P(F) of the system (actually, the sign of ( )

1 ˆθ µ ∂ ∂ F P
is positive). This information is coherent with the "configuration" of the four failure regions {F l : l = 1, 2, 3, 4} ( 22)-( 25): actually, in case of system failure, parameter µ in increasing (decreasing) the failure probability P(F) of the system: actually, the magnitude of the absolute value of ( )

2 ˆθ µ ∂ ∂ F P ( ( ) 3 ˆθ µ ∂ ∂ F P
) is about one hundred times lower than that of ( )

1 ˆθ µ ∂ ∂ F P ;
in order to effectively drive the system to failure (or, in other words, to increase its failure probability P(F)) the mean

2 θ µ ( 3 θ
µ ) of the probability distribution of θ 2 (θ 3 ) have to be moved from its nominal value (i.e., 0) towards positive (negative) values: actually, the sign of ( )

2 ˆθ µ ∂ ∂ F P ( ( ) 3 ˆθ µ ∂ ∂ F P
) is positive (negative). However, this information is wrong or, at least, not complete if referred to the "configuration" of the four failure regions {F l : l = 1, 2, 3, 4} ( 22)-( 25): actually, in case of system failure parameter x 2 may range either between the values 1.1514 and 1.9963 (which are both larger than the nominal value of the mean of the probability distribution of x 2 , i.e., 0) or between the values -1.9963 and -1.1514 (which instead are both smaller than the nominal value of the mean of the probability distribution of x 2 , i.e., 0). Similar considerations hold for parameter θ 3 .

This latter consideration highlights the inadequacy of the local reliability sensitivity approach when applied to problems presenting multiple failure regions. Actually, the reason behind the inappropriateness or incompleteness of the information provided by the results in Table 2 is readily explained by the symmetry properties characterizing the four failure regions {F l : l = 1, 2, 3, 4} ( 22 Note that this ranking is the same as the one provided by the local reliability sensitivity approach based on LS with four different important directions (see Table 3 of Section 4.2.2.1).

Finally, for completeness the sensitivity insights provided by the SS-based global approach are also compared to those produced by first-and total-order (global) Sobol indices [START_REF] Sobol | Sensitivity analysis for nonlinear mathematical model[END_REF]: these indices are frequently used in the literature to identify the uncertain parameters (i.e., the uncertain inputs to a given system model) that contribute most to the variability of the model outputs 4 . Thus, first-and total-order Sobol indices are computed to identify those uncertain input parameters {x j : j = 1, 2, 3} which contribute most to the variability of the LSF g x (x) [START_REF] Han | A quantitative evaluation of reliability of passive systems within probabilistic safety assessment framework for VHTR[END_REF] based on the Ishigami function Y(x) [START_REF] Woo | The statistical analysis of the passive system reliability in the Nuclear Power Plants (NPPs)[END_REF].

In more detail, by definition the first-order Sobol sensitivity index S j g , j = 1, 2, 3, quantifies the proportion of the variance of the LSF g x (x) (21) (i.e., the output) that can be attributed to the variance of the uncertain input variable x j alone, i.e., without taking into account interactions with other input variables; on the contrary, the total-order Sobol sensitivity index S Tj g , j = 1, 2, 3, quantifies the proportion of the variance of the LSF g x (x) (21) (i.e., the output) that can be attributed to the variance of the uncertain input variable x j taking into account the interactions (of all the orders) with all the other input variables [START_REF] Saltelli | Global sensitivity analysis[END_REF], [START_REF] Saltelli | Making best use of model evaluations to compute sensitivity indices[END_REF], [START_REF] Saltelli | Sensitivity analysis for importance assessment[END_REF].

As pointed out in [START_REF] Saltelli | Sensitivity analysis for importance assessment[END_REF], the sensitivity indices S j g and S Tj g have the advantage of being global because i) the effect of the entire distribution of the parameter whose uncertainty importance is evaluated, is considered and ii) the importance of this input parameter is evaluated with all other input parameters varying as well; moreover, this sensitivity index is also "model free" because its computation is independent from assumptions about the model form, such as linearity, additivity and so on. The drawback of this approach relies in the computational burden associated to its calculation: actually, thousands or millions of system model evaluations are frequently required for the evaluation of Sobol indices through Monte Carlo-based techniques [START_REF] Saltelli | Global sensitivity analysis[END_REF], [START_REF] Saltelli | Sensitivity analysis for importance assessment[END_REF].

First-and total-order Sobol indices S j g and S Tj g , j = 1, 2, 3, are computed for the LSF g x (x) [START_REF] Han | A quantitative evaluation of reliability of passive systems within probabilistic safety assessment framework for VHTR[END_REF] based on the Ishigami function Y(x) [START_REF] Woo | The statistical analysis of the passive system reliability in the Nuclear Power Plants (NPPs)[END_REF], by resorting to the algorithm proposed by [START_REF] Saltelli | Making best use of model evaluations to compute sensitivity indices[END_REF]: these values obtained with N T = 550000 model evaluations are reported for reference in Table 4. The ranking of the uncertain input variables is also reported in parentheses.

Table 4

It is interesting to note that: the contribution of x 3 to the variability of the LSF g x (x) ( 21) is entirely due to interactions with other input variables (indeed, S 3 g = 0 and S T3 g = 0.2490): actually, in (21) variable x 3 does not appear alone, but only multiplied by the term sin(x 1 ); the contribution of x 2 to the variability of the LSF g x (x) ( 21) is entirely due to its variation alone and not to interactions with other input variables (indeed, S 2 g ≈ S T2 g = 0.4415):

actually, in (21) variable x 2 does appear only alone in the term 7 sin 2 (x 2 ); the contribution of x 1 to the variability of the LSF g x (x) ( 21) is due both to its variation alone and to interactions with other input variables (indeed, S 1 g = 0.3155 and S T1 g = 0.5596):

actually, in (21) variable x 1 appears both alone in the term sin(x 1 ) and multiplied by x 3 4 in the term 0.1 x 3 4 •sin(x 1 ); the ranking of the uncertain input variables provided by Sobol sensitivity indices is significantly different from those produced by the local reliability sensitivity approach (Table 3 of Section 4.2.2.1) and by the global SS-based approach (Figure 3): for example, according to Sobol indices, parameter x 3 is the least important in determining the variability of the LSF g x (x) [START_REF] Han | A quantitative evaluation of reliability of passive systems within probabilistic safety assessment framework for VHTR[END_REF], whereas, according to the SS-and LS-based approaches, it is the most important in affecting the system failure probability. This leads to the conclusion that the most important contributors to the variability of the system model output(s) are not necessarily the most important contributors to system failure.

This may be due to the fact that the four failure domains of interest {F l : l = 1, 2, 3, 4} are very small with respect to the entire uncertain input space and they lie far from the regions characterized by the most significant variability of the model output g x (x) (actually, they are located at the "boundaries" of the uncertain input space, as demonstrated by ( 22)-( 25) and, pictorially, by Figure 2): in this way, the failure domains {F l : l = 1, 2, 3, 4} do not "contribute" to the estimation of the Sobol indices S j g and S Tj g , whereas they obviously play a relevant role in the estimation of the quantities ( )

j F P θ µ ∂ ∂
and P(F|x j ), j = 1, 2, 3.

Case study 2: nuclear passive system

In this Section, the case study concerning a nuclear passive system of literature [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF] is illustrated: in Section 5.1, few details about the system model are provided; in Section 5.2, the results of the application of the SS and LS methods for the sensitivity analysis of the performance of the passive system of Section 5.1 are presented.

The model

This case study concerns the natural convection cooling in a Gas-cooled Fast Reactor (GFR) under a post-Loss Of Coolant Accident (LOCA) condition; the reactor is a 600-MW GFR cooled by helium flowing through separate channels in a silicon carbide matrix core [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF].

A GFR decay heat removal configuration is shown schematically in Figure 4; in the case of a LOCA, the long-term heat removal is ensured by natural circulation in a given number N loops of identical and parallel loops; only one of the N loops loops is reported for clarity of the picture: the flow path of the cooling helium gas is indicated by the black arrows. The loop has been divided into N sections = 18 sections for numerical calculation; technical details about the geometrical and structural properties of these sections are not reported here for brevity: the interested reader may refer to [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF].

In the present analysis, the average core power to be removed is assumed to be 18.7 MW, equivalent to about 3% of full reactor power (600 MW): to guarantee natural circulation cooling at this power level, a pressure of 1650 kPa in the loops is required in nominal conditions. Finally, the secondary side of the heat exchanger (i.e., item 12 in Figure 4) is assumed to have a nominal wall temperature of 90 °C [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF].

Figure 4

Uncertainties

Uncertainties affect the modeling of passive systems. There are unexpected events, e.g. the failure of a component or the variation of the geometrical dimensions and material properties, which are random in nature. This kind of uncertainty, often termed aleatory [START_REF]Severe accident risk: an assessment for five US nuclear power plants[END_REF]- [START_REF]EPRI/NRC-RES Fire PRA methodology for nuclear power facilities[END_REF], is not considered in this work. Additionally, there is incomplete knowledge on the properties of the system and the conditions in which the passive phenomena develop (i.e., natural circulation). This kind of uncertainty, often termed epistemic, affects the model representation of the passive system behaviour, in terms of both (model) uncertainty in the hypotheses assumed and (parameter)

uncertainty in the values of the parameters of the model [START_REF] Patalano | Risk-informed design changes in a passive decay heat removal system[END_REF], [START_REF] Cacuci | A comparative review of sensitivity and uncertainty analysis of large scale systems -II: Statistical methods[END_REF], [START_REF] Helton | Survey on sampling-based methods for uncertainty and sensitivity analysis[END_REF].

Only epistemic uncertainties are considered in this work. Epistemic parameter uncertainties are associated to the reactor power level, the pressure in the loops after the LOCA and the cooler wall temperature; epistemic model uncertainties are associated to the correlations used to calculate the Nusselt numbers and friction factors in the forced, mixed and free convection regimes. The consideration of these uncertainties leads to the definition of a vector x = { } 9 ..., , 2 , 1 : = j x j of nine uncertain model inputs, assumed described by normal distributions of known means and standard deviations (Table 5, [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]).

Table 5

Failure criteria of the T-H passive system

The passive decay heat removal system of Figure 4 fails to provide its safety function when the temperature of the coolant helium leaving the core (item 4 in Figure 4) exceeds either 1200 °C in the hot channel or 850 °C in the average channel: these values are expected to limit the fuel temperature to levels which prevent excessive release of fission gases and high thermal stresses in the cooler (item 12 in Figure 4) and in the stainless steel cross ducts connecting the reactor vessel and the cooler (items from 6 to 11 in Figure 4) [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]. Denoting by ( )

x hot core out T , and
( )

x avg core out
T , the coolant outlet temperatures in the hot and average channels, respectively, the system failure event F can be written as follows:

( ) { } ( ) { } 850 : 1200 : , , > ∪ > = x x x x avg core out hot core out T T F . ( 16
)
Notice that, in the notation of Section 2, ( ) [START_REF] Burgazzi | Evaluation of the dependencies related to passive system failure[END_REF] so that the failure region F becomes specified as:

x hot core out T , = y
( ) ( ) ( ) ( ) ( )       =       = 850 ,
( ) { } 1 : > = x x Y F . ( 18
)
In the notation of Section 2, the failure threshold α Y is then equal to one and the system LSF in [START_REF] Homma | Importance measures in global sensitivity analysis of model output[END_REF] is written as

( ) ( ) 1 ) ( - = - = x x x Y Y g Y x α . ( 19
)
The probability P(F) of this event is 3.541•10 -4 , obtained by standard MCS with N T = 500000 samples drawn.

Local reliability sensitivity results

Table 7 reports the values of the estimates

Table 7

It can be seen that: respectively, for variable θ 8 (i.e., the friction factor in mixed convection) and 0.1576 and 0.0257, respectively, for variable θ 1 (i.e., the reactor power): thus, θ 8 is much more important than θ 1 in affecting the functional failure probability of the passive system;

a
the sign of the estimates ( )

j F P θ µ ∂ ∂ ˆ, j = 1,
2, …, 9, indicates the direction towards which the corresponding uncertain inputs have to move in order to drive the system to failure: for instance, since the sign of ( )

2 ˆθ µ ∂ ∂ F P and ( ) 5 ˆθ µ ∂ ∂ F P
is negative, the failure probability 5 As before, since the results produced by LS are obtained in the standard normal space by construction (see Sections 3.2.1 and 3.2.2 for details), for comparison with the other methods, the uncertain input variables {x j : j = 1, 2, …, 9} of Table 5 have been transformed into {θ j : j = 1, 2, …, 9} in the standard normal space and the system performance indicator Y(x) (27) (together with the corresponding LSF g x (x) ( 29)) has been transformed into Y(θ) (and, correspondingly, g θ (θ)) in the standard normal space: thus, the partial derivatives of the system failure probability with respect to the parameters of the distributions of the uncertain input variables are estimated in the standard normal space for all the simulation methods considered.

P(F) of the passive system will be increased (resp., decreased) by decreasing (resp., increasing) the value of the means 2 θ µ and 5 θ µ of parameters θ 2 (i.e., pressure) and θ 5 (i.e., Nusselt number in mixed convection), respectively; in other words, the passive system will be effectively driven to failure by decreasing the value of parameters θ 2 and θ 5 , i.e., by moving them towards low values. On the contrary, since the sign of ( )

8 ˆθ µ ∂ ∂ F P is positive,
the failure probability P(F) of the passive system will be increased (resp., decreased) by increasing (resp., decreasing) the value of the mean 8 θ µ of parameter θ 8 (i.e., friction factor in mixed convection); in other words, failure of the passive system will be easily caused by increasing the value of parameter θ 8 , i.e., by moving it towards high values. It is worth noting that these results are quite reasonable from a physical viewpoint. In fact, the pressure of the system strongly affects the density of the coolant helium gas and thus the extent of the buoyancy force on which the effective functioning of the natural circulation system is based.

In particular, a decrease in the system pressure leads to a decrease in the buoyancy force which may not succeed in balancing the pressure losses around the natural circulation loop.

Nusselt numbers instead are directly (i.e., linearly) related to the heat transfer coefficients in both the heater (i.e., the core, item 4 in Figure 4) and the cooler (i.e., the heat exchanger, item 12 in Figure 4) and thus their variations directly impact the global heat removal capacity of the passive system. In particular, a decrease in the heat transfer coefficient in the heat exchanger (where the wall temperature is imposed) leads to a reduction in the heat flux and consequently to an increase in the coolant temperature. Further, a decrease in the heat transfer coefficient in the heater (where the heat flux is imposed as constant) causes an increase in the coolant wall temperature. Thus, both processes lead to a rapid attainment of the coolant temperature limits. Finally, the friction factors directly determine the extent of the pressure losses which oppose the coolant flow in natural circulation. In particular, an increase in the friction factors determines an increase in the pressure losses along the closed loop and consequently a reduction in the coolant flow rate. The smaller the flow rate in the decay heat removal loop, the higher the coolant temperature rise will be, leading to an earlier attainment of the coolant temperature limits, thus worsening the safety of the operation and of the reactor; the information provided by ( )

j F P θ σ ∂ ∂ ˆ, j = 1, 2, …, 9
, is useful in identifying the variables whose uncertainty (quantified in this case by the standard deviation j θ σ of the corresponding probability distribution) plays a major role in affecting P(F): based on this information, the analyst may focus his/her efforts on increasing the state-of-knowledge only on these variables and the related physical phenomena (for example, by the collection of experimental data one may achieve an improvement in the state-of-knowledge on the correlations used to model the heat transfer process in mixed convection: this could lead to a reduction in the uncertainty, e.g., of variable θ 5 , i.e., the Nusselt number in mixed convection); LS with N T = 1850 samples produces the same ranking of the uncertain variables as the reference one (i.e., the one produced by standard MCS with N T = 500000 samples): however, this result is obtained at a much lower (i.e., by a factor 270) computational effort; SS with N T = 1850 correctly ranks the first five uncertain variables, i.e., θ 2 , θ 8 , θ 3 , θ 5 and θ 1 , whereas standard MCS with the same number of samples is not even able to produce a ranking (in fact, ( )

j F P θ µ ∂ ∂ ˆ = ( ) j F P θ σ ∂ ∂ ˆ = 0 for j = 1, 2, …, 9
). This is explained as follows: in the SS procedure (due to successive conditional MCMC simulations) a large number of samples is generated in the intermediate conditional regions and in the failure region of interest, which are used to calculate ( )

j F P θ µ ∂ ∂ ˆ and ( ) j F P θ σ ∂ ∂ ˆ, j = 1, 2, …, 9,
according to ( 8) and ( 9); instead, in standard MCS with N T = 1850 samples, on average only N T ·P(F) = 1850·3.541·10 -4 ≈ 0.6 (i.e., in practice zero) failure samples are generated which can be used to calculate ( )

j F P θ µ ∂ ∂ ˆ and
( )

j F P θ σ ∂ ∂ ˆ, j = 1,
2, …, 9, using an estimator similar to [START_REF] Helton | Alternative representations of epistemic uncertainties[END_REF].

A final remark is in order with respect to the effectiveness of the SS-and LS-based local approaches to sensitivity analysis. They present the advantage over other standard techniques of sensitivity analysis of being directly "embedded" in the computation of the functional failure probability: in fact, the SS and LS algorithms produce the "ingredients" used for sensitivity analysis (i.e., the empirical conditional distributions in SS and the random lines parallel to the important vector α in LS) during the simulation that is performed to compute the functional failure probability of the passive system. In other words, while estimating the functional failure probability of the system, sensitivity analysis results are produced that can be readily visualized for identification and ranking of the most important variables. This is of particular interest in practical cases in which the computer codes require several hours (or even days) to run a single simulation.

Global sensitivity results

The results obtained in the previous Section 5.2.2.1 by the local reliability sensitivity approaches are compared here to those produced by the SS-based global approach of Section 3.1.2.2.

The sensitivity of the passive system performance to the individual uncertain input parameters of Table 5 is studied by examining the change of the sample distributions at different conditional levels. The histograms of the conditional samples of five uncertain parameters (i.e., x 1 , the reactor power; x 2 , the pressure level established in the guard containment after the LOCA; x 3 , the cooler wall temperature; x 5 , the Nusselt number in mixed convection; x 8 , the friction factor in mixed convection) at different conditional levels for a single SS run are shown in Figure 5, left. It can be seen that the performance of the passive system is strongly sensitive to the pressure level established in the guard containment after the LOCA, as indicated by the significant leftward shift of its empirical conditional distribution (histograms) from the unconditional one (solid lines). A sensitivity of the passive system performance is also visually observed with respect, e.g., to the cooler wall temperature (rightward shift) and to the correlation errors in both the Nusselt number (leftward shift) and the friction factor (rightward shift) in mixed convection.

The "pictorial" information contained in the empirical conditional distributions q(x j |F i ), j = 1, 2, …, n i , i = 1, 2, …, m, is used as before to refine the sensitivity information by obtaining the distribution of the system failure probability conditional on the values of the individual uncertain input parameters, i.e. P(F|x j ), according to (10) (Figure 5, right): for example, it can be seen that fixing x 2 to 1500 kPa would result in P(F) = 0, whereas fixing x 2 to 1200 kPa would result in P(F) ≈ 0.40.

Figure 5

The results shown in Figure 5, right, are used to rank the uncertain input variables {x j : j = 1, 2, …, 9} according to their effectiveness in driving the passive system to failure (or, in other words, to quantify the importance of the variability of the individual uncertain input variables in determining the failure probability of the system). As before, a ranking is established on the basis of the maximum value assumed by the distributions P(F|x j ), j = 1, 2, …, 9. For example, as x 2 varies in its range, P(F|x 2 ) takes values from 0 to 0.45, whereas as x 8 varies in its range, P(F|x 8 ) takes values from 0 to 0.012: thus, it can be concluded that x 2 is much more important than x 8 in affecting the functional failure probability of the passive system (or, in other words, in driving the system to failure). According to this criterion the uncertain input variables {x j : j = 1, 2, …, 9} are ranked fifth, first, third, ninth, fourth, sixth, eight, second and seventh, respectively; note that this ranking is in satisfactory agreement with those provided by the SS-and LS-based local reliability sensitivity approaches (see Table 7 of Section 5.2.2.1).

In addition, it is worth noting again that the global sensitivity analysis based on SS presents the advantage over the standard sensitivity analysis techniques (e.g., variance-based methods like Sobol indices), of being directly "embedded" in the computation of the failure probability: the SS algorithm produces the empirical conditional distributions of Figure 5 during the simulation that is performed to compute the functional failure probability of the passive system.

Table 8

It can be seen that: the ranking provided by Y Tj S is similar to that produced by the SS-based global approach (see Figure 5): for example, variables x 1 , x 2 , x 7 and x 8 are ranked fifth, first, eight and second, respectively, by both approaches. However, a difference is found in the ranking of variables x 3 and x 5 : in particular, variable x 3 is ranked fourth and third by the Sobol-and SS-based approaches, respectively; conversely, variable x 5 is ranked third and fourth by the Soboland SS-based approaches, respectively. This confirms that in general, the most important contributors to the variability of model output(s) do not necessarily coincide with the most important contributors to system failure.

Conclusions

The assessment of the functional failure probability of T-H passive systems can be performed by sampling the uncertainties in the system model and parameters, and simulating the corresponding passive system response with T-H computer codes. Within this framework, sensitivity analysis has two objectives: i) the quantification of the importance of the individual uncertain parameters in affecting the performance of the passive system (or, in other words, in determining the functional failure probability of the passive system); ii) the determination of the contribution of the individual uncertain parameters (i.e., the inputs to the T-H code) to the uncertainty in the outputs of the T-H code. However, since sensitivity analysis relies on multiple evaluations of the T-H code for different combinations of system inputs, the associated computational effort may be prohibitive due to the long-running times of the T-H codes.

Thus, in this paper the advanced SS and LS methods have been considered for performing an efficient sensitivity analysis of the performance of a T-H passive system while estimating its functional failure probability by means of a reasonably limited number of T-H code evaluations.

Different local and global approaches to sensitivity analysis have been considered and compared with reference to two case studies of literature: the first one involving the Ishigami function [START_REF] Homma | Importance measures in global sensitivity analysis of model output[END_REF]; the second one considering the natural convection cooling in a Gas-cooled Fast Reactor (GFR) after a Loss of Coolant Accident (LOCA) [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]. On the basis of the results obtained, the following guidelines and recommendations can be drawn:

• with reference to objective i) above, two options are suggested:

1. in those cases where the analyst is able to get information about the "structure" of the failure region (e.g., one/multiple overlapping/disconnected failure regions, …), the concept of local reliability sensitivity analysis based on LS can be embraced (Section 3.2.2). Actually, as demonstrated by Case study 1, the possibility of identifying multiple important directions allows to separate the contributions of (possibly) multiple failure regions to the reliability sensitivity indices (i.e., the partial derivatives of the system failure probability with respect to the moments of the distributions of the uncertain input parameters): this avoids averaging or (even worse) canceling the different contributions, which would provide erroneous and misleading indications.

In addition, as demonstrated by Case studies 1 and 2, LS provides much more accurate and precise failure probability estimates that the other simulation methods here considered for comparison (i.e., standard MCS and SS): this allows the analyst to reduce the number of samples (and, thus, of T-H model evaluations) necessary to obtain desired estimation accuracies and precisions (in particular, in those practical cases where the computer codes require several hours to run a single simulation).

2. in those (more realistic) cases where the analyst has no information about the "structure" of the failure region (or, alternatively, information can be obtained at impractical computational costs), the global approach based on SS may represent the optimal choice (Section 3. A final remark is in order with respect to the effectiveness of the SS-and LS-based approaches to sensitivity analysis. They present the advantage over other standard techniques of sensitivity analysis of being directly "embedded" in the computation of the system failure probability: the SS and LS algorithms produce the "ingredients" used in sensitivity analyses (i.e., the empirical conditional distributions in SS and the random lines parallel to the important vector in LS) during the simulation that is performed to compute the system failure probability. In other words, while estimating the failure probability of the system, sensitivity analysis results are produced that can be readily visualized for identification and ranking of the most important variables. This is of particular interest in practical cases in which the computer codes require several hours (or even days) to run a single simulation (like in the present case of passive system reliability assessment). • with reference to objective ii) above, the use of "classical" variance-based techniques (e.g., those relying on the computation of first-and total-order Sobol indices, like in the present paper) is suggested: actually, by construction these methods quantify the proportion of the variance of the system model outputs that can be attributed to the variance of the uncertain input variables. However, two issues must be taken into account for the practical use of these techniques in passive system reliability assessments:

1. the associated computational burden may be prohibitive because thousands or millions of system model evaluations are frequently required for the computation of variance-based (Sobol) indices through Monte Carlo-based techniques; in addition, these techniques cannot be embedded in the estimation of the failure probability of the passive system: thus, the T-H model evaluations necessary for performing the sensitivity analysis have to be added to those carried out for estimating the failure probability, further increasing the computational burden. To overcome this issue, the adoption of fast-running meta-models in substitution of the original (typically longrunning) system model codes is strongly advised; 2. care should be taken in the interpretation of the uncertain variable ranking provided by these methods: as demonstrated by Case study 1, the most important contributors to the variability (in practice, the variance) of the system model outputs are not necessarily the most important contributors to system failure (i.e., those parameters that influence most the passive system failure probability). Case study 2: nuclear passive system -Global sensitivity analysis by SS

FIGURE CAPTION PAGE

  parameters/variables, models and correlations (i.e., the inputs to the T-H code) which contribute to the uncertainty in the vector y = {y 1 , y 2 , ..., y l , ..., o n y } of the outputs of the best-estimate T-H calculations. 3. Propagation of the uncertainties associated to the identified relevant parameters, models and correlations x (step 2. above) through the deterministic, long-running T-H code in order to estimate the functional failure probability P(F) of the passive system. Formally, let Y( x ) be a scalar function indicating the performance of the T-H passive system (e.g., the fuel peak cladding temperature during an accidental transient) and α Y a threshold value (imposed e.g. by the regulatory authorities) defining the criterion of loss of system functionality. For illustrating purposes, let us assume that the passive system fails if Y( x ) > α Y ; equivalently, introducing a variable called Limit State Function (LSF) or Performance Function (PF) as

4 .

 4 Perform a sensitivity study to determine the contribution of the individual uncertain parameters x = {x 1 , x 2 , …, x j , …, i n x } (i.e., the inputs to the T-H code) to i) the uncertainty in the outputs y = {y 1 , y 2 , ..., y l , ..., o n y } of the T-H model code and ii) the functional failure probability of the T-H passive system. As is true for uncertainty propagation (step 3. above), sensitivity analysis relies on multiple evaluations of the code for different combinations of system inputs.

  intermediate subregion F m-1 = {x: Y(x) > y m-1 } are generated to yield y m > y as the (1 -p 0 )N th value in the ascending list of {Y(x m-1 k ): k = 1, 2, …, N}. Then, the conditional probability P m = P(F m |F m-1 ) failure region F = F m , i.e.,

1 Yα

 1 Only for illustration purposes, let us suppose that the system of interest has N F = 2 failure modes, e.g., it fails when either performance function Y 1 (x) exceeds threshold or performance function Y 2 (x) exceeds threshold 2 Y

  are then used to compute the estimate ( ) l F P ˆ of the l th failure probability ( ) l F P by performing steps 4. and 5. above of the LS algorithm.Finally, if the failure regions F l , l = 1, 2, …, N F , are disconnected (i.e., not overlapping), the estimate ( )F P ˆof the failure probability P(F) is simply given by the sum of the estimates ( )

  = αis determined to point towards the failure domain F of interest (Section 3.2.1). As such, the vector α tells which combinations of parameter variations contribute most to failure and thus gives an idea of the relative importance of the uncertain parameters { } the failure of the system under analysis[START_REF] Pradlwarter | Realistic and efficient reliability estimation for aerospace structures[END_REF].

  failure probability P(F) with respect to the parameters (i.e., the mean j θ µ and the standard deviation j θ σ ) of the normal probability distributions of the uncertain input variables normal space. Without going into mathematical details, it can be demonstrated that ( )

P

  (F) (Section 4.2.1) and ii) the sensitivity analysis of the performance (Section 4.2.2) of the synthetic passive system characterized by the LSF g x (x)[START_REF] Han | A quantitative evaluation of reliability of passive systems within probabilistic safety assessment framework for VHTR[END_REF] based on the Ishigami function Y(x)[START_REF] Woo | The statistical analysis of the passive system reliability in the Nuclear Power Plants (NPPs)[END_REF].

  distributions of the uncertain input parameters {θ j : j = 1, 2, 3}, computed by standard MCS, SS and LS with N T = 3700 samples. Notice that in the present implementation of the LS technique we suppose that the analyst does not recognize the presence of four disconnected failure regions and, consequently, he/she identifies one single important vector α by MCMC simulation (Section 3.2.1). In particular, a point θ 0 is chosen in the failure domain F; subsequently, a sequence of N s = 1000 points { } lying in the failure domain F is generated by MCMC; then, since by hypothesis the analyst does not realize that the points to four disconnected failure regions, he/she averages the unit vectors 2 u u θ θ , u = 1, 2, …, N s , to obtain the unique important vector α = [0.2456, 1.994·10 -3 , -2in Table2for reference: as before, these have been obtained by standard MCS with a very large number N T (i.e., N T = 500000) of simulations. The ranking of the uncertain input parameters {θ j : j = 1, 2, 3} based on the estimates

  x 1 is found to range between the values 1.1017 and 2.0250 (which are both larger than the nominal value of the mean of the probability distribution of x 1 , i.e., 0); the probability distribution of θ 2 (θ 3 ) from its nominal value (i.e., 0) is much less effective than moving 1 θ

)- ( 25 )

 25 : actually, as already explained in Section 4.1, in failure regions F 1 and F 4 parameter x 2 ranges between -1.9963 and -1.1514, whereas in failure regions F 2 and F 3 it symmetrically ranges between 1.1514 and 1.9963; further, in failure regions F 1 and F 2 parameter x 3 ranges between -3.1414 and -3.0390, whereas in failure regions F 3 and F 4 it symmetrically ranges between 3.0390 and 3.1414. As a consequence, in estimating contributions associated to the failure regions symmetric with respect to the origin of the input parameter space "cancel out": this produces estimates be overcome by employing the LS method with four different important directions {α l : l = 1, 2, 3, 4} pointing towards the four failure regions {F l , l = 1, 2, 3, 4} (22)-(25): in particular, α 1 = [0.2441, -0.2462, -0.9379], α 2 = [0.2465, 0.2460, -0.9374], α 3 = [0.2468, 0.2497, 0.9363] and α 4 = [0.2448, -0.2417, 0.9389] have been identified by MCMC simulation with N s = 2000 samples (see Section 3.2.1). This allows to quantify separately the contributions of the four different failure regions, i.e.,

  y 2 (x) are the n o = 2 outputs of the T-H model. The failure region F (26) is then condensed into a single performance indicator Y(x), leading to the definition of a single-output Limit State Function (LSF) or Performance Function (PF)

  failure probability P(F) with respect to the mean j θ µ and the standard deviation j θ σ of the distributions of the uncertain input parameters {θ j : j = 1, 2, …, 9}, computed by standard MCS, SS and LS with N T = 1850 samples. "True" values of in Table 7 for reference: as before, these have been obtained by standard MCS with a very large number N T (i.e., N T = 500000) of simulations of the original T-H code. The ranking of the uncertain input parameters {θ j : j = 1, 2, …, 9} based on the estimates

  ranking of the importance of the uncertain input variables {θ j : j = 1, 2, …, 9} in affecting the functional failure probability of the passive system can be established on the basis of the magnitude of the absolute values of the estimates the stronger the impact of the corresponding uncertain variable on the functional failure probability of the system. For example, referring to the results obtained by standard MCS with N T = 500000 samples, the absolute values of

Finally, for completenessSS

  the sensitivity insights provided by the SS-based global approach are also compared to those produced by (global) Sobol indices[START_REF] Sobol | Sensitivity analysis for nonlinear mathematical model[END_REF]: in particular, for brevity only the total-, j = 1, 2, …, 9, are calculated for the outputs of the T-H code, i.e., y 1 (x) = the performance function Y(x) (27) of the passive system, respectively. Table8reports the values of 1 , j = 1, 2, …, 9, obtained using the algorithm proposed by[START_REF] Saltelli | Making best use of model evaluations to compute sensitivity indices[END_REF] with N T = 550000 runs of the T-H model code. The ranking of the uncertain parameters is also shown in parentheses.

S

  not surprisingly, different indices provide different rankings: for example, variables x 3 , x 5 and x 8 are ranked fourth, third and second, respectively, by both 1 is the same as that produced by Y Tj S : this leads to conclude that the hot channel coolant outlet temperature y 2 (x) in determining the uncertain behavior of the passive system performance function Y(x)[START_REF] Mathews | Functional reliability analysis of safety grade decay heat removal system of Indian 500 MWe PFBR[END_REF];

Figure 1 .Figure 2 .Figure 3 . 1 Figure 4 . 2 ]Figure 5 .

 1231425 Figure 1. Examples of possible important unit vectors α 1 (left) and α 2 (right) pointing towards the corresponding failure domains F 1 (left) and F 2 (right) in a two-dimensional uncertain parameter space: in the situation on the left, the system would be driven to failure much more effectively by an increase in Parameter 2 rather than by an increase in Parameter 1; in the situation on the right, an increase in Parameter 1 would be much more important in determining system failure than an increase in Parameter 2

F P σ

  obtained by standard MCS, SS and LS with N T = 3700 samples for Case study 1 of Section 4.1. The "true" (i.e., reference) value (i.e., P(F) = 5.566·10 -4 ) obtained by standard MCS with N T = 500000 samples is also reported

σ

  of the distributions of the uncertain input parameters {θ j : j = 1, 2, 3}, computed in the standard normal space by standard MCS, SS and LS with N T = 3700 samples for Case study 1 of Section 4.1; the ranking of the uncertain input parameters is shown in parentheses Case study 2: nuclear passive system Functional failure probability estimation ("True" value, P(F) = 3.541•10 -4 )

Figure 1 Figure 2 1 Case study 1 : 2 x 3 F 1 F 2 F 3 F 4 Figure 3 3 )Case study 1 : 2 )

 12112312343312 FIGURES

  Metropolis-Hastings algorithm is employed to generate a sequence of N s points { }

						θ	u	u : =	, 1	, 2	...,	N	s
	lying in the failure domain F [64]. The unit vectors	θ	u θ	u	2	, u = 1, 2, …, N s , are then averaged in
	order to obtain the LS important unit vector as

  The four disconnected failure regions {F l : l = 1, 2, 3, 4} are defined as follows:

	F	1	=	{ x	:	1 x	∈	[ 1	.	1017	,	2	.	0250	] ,	x	2	∈	[ -	1	.	, 9963	-	1	.	1514	] ,	x	3	∈	[ -	3	.	, 1414	-	3	.	0390	] }	(12)
	F	2	=	{ x	:	1 x	∈	[ 1	.	1017	,	2	.	0250	] ,	x	2	∈	[ 1	.	, 1514	1	.	] , 9963	x	3	∈	[ -	3	.	, 1414	-	3	.	0390	] }	(13)
	F	3	=	{ x	:	1 x	∈	[ 1	.	1017	,	2	.	0250	] ,	x	2	∈	[ 1	.	, 1514	1	.	] , 9963	x	3	∈	[ 3	.	, 0390	3	.	1414	] }	(14)
				{	:			[ 1	.	1017	,	2	.	0250	] ,					[					1	.	, 9963	1	.	1514	] ,	[ 3	.	, 0390	3	.	1414	] }

  2.2.1, the results obtained by the SS-and LS-based local reliability sensitivity approaches of Sections 3.1.2.1 and 3.2.2, respectively, are shown. In Section 4.2.2.2, the results obtained by the SS-based global approach of Section 3.1.2.2 are presented; in addition, the sensitivity insights provided by the SSbased method are compared to those produced by Sobol indices.

Table 2

 2 reports the values of the estimates

  1.2.2): indeed, as demonstrated by Case study 1, SS is able to automatically identify multiple disconnected failure regions without any input from the analyst. In particular, SS generates a large amount of conditional samples by searching the whole uncertain input space by means of sequential Markov Chain Monte Carlo (MCMC) simulations; by so doing, the entire distribution of the system failure probability conditional on the values of the individual uncertain input parameters is produced: the associated information is relevant from the sensitivity analysis viewpoint because it quantifies how the failure probability of the system would change if a given uncertain input parameter were set to a given value (e.g., if its epistemic uncertainty were reduced).

Table 1 .

 1 Values of the failure probability estimates ( )

	P ˆ	F	and corresponding standard deviations

Table 2 .

 2 Values of the estimates

		6781 (1)	0.5301 (3)	0.5893 (3)	0.6527 (2)	0.6750 (1)	0.5375 (2)	0.5869 (1)	0.4008 (3)
	θ 2	3.0850•10 -3 (3)	0.5329 (2)	-0.7678 (2)	0.4105 (3)	-0.2543 (2)	0.5070 (3)	-0.0240 (3)	0.4026 (2)
	θ 3	-9.2199•10 -3 (2)	6.1939 (1)	-2.4670 (1)	5.0863 (1)	-0.1240 (3)	6.4965 (1)	0.0557 (2)	5.8401 (1)

Table 6 .

 6 Values of the functional failure probability estimates ( ) SS and LS with N T = 1850 samples for the nuclear passive system of Section 5.1. The "true" (i.e., reference) value (i.e., P(F) = 3.541·10 -4 ) obtained by standard MCS with N T = 500000 samples is also reported

	P ˆ	F	and corresponding standard

Case study 2: nuclear passive system Global sensitivity analysis -Total-order Sobol indices Parameters

		1 y Tj S (rank)	2 Tj y S (rank)	Y Tj S (rank)
	x 1	8.846•10 -3 (5)	0.0121 (5)	0.0113 (5)
	x 2	0.8391 (1)	0.7985 (1)	0.8259 (1)
	x 3	0.0434 (4)	0.0682 (3)	0.0546 (4)
	x 4	1.908•10 -4 (6)	3.058•10 -3 (8)	2.226•10 -3 (6)
	x 5	0.0554 (3)	0.0833 (2)	0.0711 (3)
	x 6	1.559•10 -4 (7)	3.195•10 -3 (6)	2.217•10 -3 (7)
	x 7	1.318•10 -4 (8)	3.062•10 -3 (7)	2.201•10 -3 (8)
	x 8	0.0832 (2)	0.0609 (4)	0.0827 (2)
	x 9	1.134•10 -4 (9)	3.053•10 -3 (9)	2.197•10 -3 (9)

Table 8 .

 8 Values of the total-order Sobol sensitivity indices1

	y Tj S , 2

For example, the computer code RELAP5-3D, which is used to describe the thermal-hydraulic behavior of nuclear systems, may take up to twenty hours per run in some applications.

To identify the relevant failure modes of the system, well-structured and commonly used qualitative hazard analyses may be employed, e.g., Failure Mode and Effect Analysis (FMEA) and HAZard and OPerability (HAZOP) analysis

It is worth noting that due to the simplicity of the problem failure regions {F l : l = 1, 2, 3,

4} (22)-[START_REF] Bassi | Reliability assessment of 2400 MWth gas-cooled fast reactor natural circulation decay heat removal in pressurized situations[END_REF] have been determined analytically by straightforward analysis of performance function[START_REF] Woo | The statistical analysis of the passive system reliability in the Nuclear Power Plants (NPPs)[END_REF].

Notice that the SS-and Sobol-based approaches are here compared because they are both global; however, their outcomes are conceptually quite different: the first one identifies the most important contributors to system failure, whereas the second one identifies the most important contributors to the variability of the model outputs.

)Case study 2: nuclear passive system -Global sensitivity analysis by SS

 3.

Table 3

It can be seen that contrary to the (erroneous) indications provided by the results in Table 2, variable θ 3 is the most effective in driving the system to failure: indeed, the absolute values of

is about the same.

Global sensitivity results

The results obtained in the previous Section 4.2.2.1 by the local reliability sensitivity approaches are compared here to those produced by the global SS-based sensitivity approach of Section 3.1.2.2.

Figure 3 shows the distribution of the system failure probability conditional on the values of the individual uncertain input parameters, i.e. P(F|x 1 ) (top, left), P(F|x 2 ) (top, right) and P(F|x 3 ) (bottom) obtained according to [START_REF] Burgazzi | Reliability evaluation of passive systems through functional reliability assessment[END_REF]. This information is relevant because it quantifies how the failure probability P(F) of the system would change if the value of the uncertain parameter x j were set to a given value (e.g., if its uncertainty were reduced): for example, fixing x 1 to 1.5 would result in P(F) ≈ 6•10 -3 , fixing x 2 to -1.5 or +1.5 would result in P(F) ≈ 4•10 -3 , whereas fixing x 3 to about -3 or +3 would result in P(F) ≈ 8•10 -3 .

In addition, the shape of the distributions P(F|x j ), j = 1, 2, 3, obviously reflects the "structure" of the four failure regions {F l , l = 1, 2, 3, 4} ( 22)-(25): for example, the distribution P(F|x 1 ) takes values different from zero when x 1 approximately ranges between +1 and +2 (see ( 22)-( 25)); the distribution P(F|x 2 ) takes values different from zero when x 2 approximately ranges between -2 and -1 (see [START_REF] Jafari | Reliability evaluation of a natural circulation system[END_REF] and [START_REF] Bassi | Reliability assessment of 2400 MWth gas-cooled fast reactor natural circulation decay heat removal in pressurized situations[END_REF]) or between +1 and +2 (see [START_REF] Zio | The analytic hierarchy process as a systematic approach to the identification of important parameters for the reliability assessment of passive systems[END_REF] and ( 24)); finally, the distribution P(F|x 3 ) takes values different from zero when x 3 assumes values around -3 (see [START_REF] Jafari | Reliability evaluation of a natural circulation system[END_REF] and ( 23)) or +3 (see [START_REF] Marquès | Methodology for the reliability evaluation of a passive system and its integration into a probabilistic safety assessment[END_REF] and ( 25)).

Figure 3

Finally, the results shown in Figure 3 can be used to rank the uncertain input variables {x j : j = 1, 2, 3} according to their effectiveness in driving the system to failure (or, in other words, to quantify the importance of the variability of the individual uncertain input variables in determining the failure probability of the system). A ranking can be established on the basis of the (maximum) value assumed by the distribution P(F|x j ) over the range of variability of x j , j = 1, 2, 3: in particular, the larger P(F|x j ), the larger the contribution of the variability of x j in determining the system failure probability. For example, as x 1 varies in its range [-π, +π], P(F|x 1 ) takes values from 0 (minimum) to 6•10 -3 (maximum); as x 2 varies in [-π, +π], P(F|x 2 ) takes values from 0 (minimum) to 4•10 -3 (maximum); finally, as x 3 varies in [-π, +π], P(F|x 3 ) takes values from 0 (minimum) to 9•10 -3 (maximum). According to this criterion, x 3 is much more important than both x 1 and x 2 , whereas x 1 is slightly more important than x 2 in affecting the failure probability of the system.

Application

In this Section, the SS and LS methods are applied for i) the estimation of the functional failure probability P(F) (Section 5.2.1) and ii) the sensitivity analysis of the performance of the 600-MW GFR passive decay heat removal system in Figure 4 (Section 5.2.2).

Functional failure probability estimation

For completeness and only for illustration purposes, Table 6 reports the values of the estimates ( ) In order to evaluate the accuracy of the SS and LS estimates, a "true" value of the functional failure probability P(F) is also reported in Table 6 for reference (i.e., P(F) = 3.541•10 -4 ); this has been obtained by standard MCS with a very large number N T (i.e., N T = 500000) of simulations of the original T-H code, which actually runs fast enough to allow repetitive calculations (one code run lasts on average 3 seconds on a Pentium 4 CPU 3.00GHz). Finally, in order to evaluate the precision of the SS and LS estimates, the standard deviation

is also computed.

Table 6

As before, LS significantly outperforms the other methods in terms of accuracy (i.e., the LS failure probability estimate ( )

is closer to the true value P(F) than those of the other methods) and precision (i.e., the standard deviation

is lower than those of the other methods) of the failure probability estimates.

Sensitivity analysis results

The same N T = 1850 samples used in the previous Section 5.2.1 to estimate the functional failure probability of the nuclear passive system are here used to analyze the sensitivity of its performance to the uncertain input variables {x j : j = 1, 2, …, 9} of

Case study 1: Ishigami function -Local reliability sensitivity analysis

Line Sampling, N T = 3700 -Four important directions {α l : l = 1, 2, 3, 4}