E Zio

G E Apostolakis
email: apostola@mit.edu

N Pedroni

Quantitative functional failure analysis of a thermal-hydraulic passive system by means of bootstrapped Artificial Neural Networks

GFR) is presented. The functional failure probability of the system is estimated together with global Sobol sensitivity indices. The bootstrapped ANN regression model built with low computational time on few (e.g., 100) data examples is shown capable of providing reliable (very near to the true values of the quantities of interest) and robust (the confidence intervals are satisfactorily narrow around the true values of the quantities of interest) point estimates.

Abstract

The estimation of the functional failure probability of a thermal-hydraulic (T-H) passive system can be done by Monte Carlo (MC) sampling of the epistemic uncertainties affecting the system model and the numerical values of its parameters, followed by the computation of the system response by a mechanistic T-H code, for each sample. The computational effort associated to this approach can be prohibitive because a large number of lengthy T-H code simulations must be performed (one for each sample) for accurate quantification of the functional failure probability and the related statistics.

In this paper, the computational burden is reduced by replacing the long-running, original T-H code by a fast-running, empirical regression model: in particular, an Artificial Neural Network (ANN) model is considered. It is constructed on the basis of a limited-size set of data representing examples of the input/output nonlinear relationships underlying the original T-H code; once the model is built, it is used for performing, in an acceptable computational time, the numerous system response calculations needed for an accurate failure probability estimation, uncertainty propagation and sensitivity analysis.

The empirical approximation of the system response provided by the ANN model introduces an additional source of (model) uncertainty, which needs to be evaluated and accounted for. A bootstrapped ensemble of ANN regression models is here built for quantifying, in terms of confidence intervals, the (model) uncertainties associated with the estimates provided by the ANNs.

For demonstration purposes, an application to the functional failure analysis of an emergency passive decay heat removal system in a simple steady-state model of a Gas-cooled Fast Reactor

Introduction

Passive systems (IAEA, 1991) are expected to contribute significantly to the safety of future nuclear power plants by combining their peculiar characteristics of simplicity, reduction of human interaction [START_REF] Prosek | Success criteria time windows of operator actions using RELAP5/MOD3.3 within human reliability analysis[END_REF] and reduction or avoidance of hardware failures [START_REF] Mathews | Functional reliability analysis of safety grade decay heat removal system of Indian 500 MWe PFBR[END_REF]. On the other hand, the uncertainties associated to their actual operation and modelling are usually larger than in active systems.

Two different sources of uncertainties are usually considered in safety analyses: randomness due to intrinsic variability in the behavior of the system (aleatory uncertainty) and imprecision due to lack of data on some underlying phenomena (e.g., natural circulation) and to scarce or null operating experience over the wide range of conditions encountered during operation (epistemic uncertainty) [START_REF] Apostolakis | The concept of probability in safety assessment of technological systems[END_REF][START_REF] Helton | Alternative representations of epistemic uncertainties[END_REF].

Due to these uncertainties, there is a nonzero probability that the physical phenomena involved in the operation of a passive system do not occur as expected, thus leading to the failure of performing the intended safety function even if safety margins have been dimensioned [START_REF] Marquès | Methodology for the reliability evaluation of a passive system and its integration into a probabilistic safety assessment[END_REF][START_REF] Patalano | Risk-informed design changes in a passive decay heat removal system[END_REF].

Various methodologies have been proposed in the open literature to quantify the probability that T-H passive systems fail to perform their functions: the reader is referred to [START_REF] Burgazzi | State of the art in reliability of thermal-hydraulic passive systems[END_REF]Zio and Pedroni, 2009a) for a review. A reasonable approach to take is that founded on the concept of functional failures in the framework of reliability physics and load-capacity exceedance probability [START_REF] Burgazzi | Reliability evaluation of passive systems through functional reliability assessment[END_REF]. In this view, a passive system fails to perform its function due to deviations from its expected behavior which lead the load imposed on the system (e.g., the peak value of the fuel cladding temperature during a LOCA transient) to overcome its capacity (e.g., a threshold value imposed by regulating authorities or by the mechanical properties of structural materials). This concept is at the basis of many works of literature, including [START_REF] Jafari | Reliability evaluation of a natural circulation system[END_REF][START_REF] Marquès | Methodology for the reliability evaluation of a passive system and its integration into a probabilistic safety assessment[END_REF][START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF][START_REF] Bassi | Reliability assessment of 2400 MWth gas-cooled fast reactor natural circulation decay heat removal in pressurized situations[END_REF][START_REF] Mackay | Incorporating reliability analysis into the design of passive cooling systems with an application to a gas-cooled reactor[END_REF][START_REF] Mathews | Functional reliability analysis of safety grade decay heat removal system of Indian 500 MWe PFBR[END_REF]2009;[START_REF] Patalano | Risk-informed design changes in a passive decay heat removal system[END_REF][START_REF] Fong | Reliability analysis of a passive cooling system using a response surface with an application to the flexible conversion ratio reactor[END_REF]Zio and Pedroni, 2009a and b); in these works, the passive system is modeled by a detailed, mechanistic T-H system code and the probability of not performing the required function is estimated based on a Monte Carlo (MC) sample of code runs which propagate the epistemic (state-of-knowledge) uncertainties in the model describing the system and the numerical values of its parameters/variables; because of these uncertainties, the system may not accomplish its mission, even if no hardware failure occurs.

MC simulation allows a realistic assessment of the T-H system functional failure probability, thanks to its flexibility and indifference to the complexity of the T-H model. This, however, is paid in terms of the high computational efforts required. Indeed, a large number of Monte Carlo-sampled T-H model evaluations must generally be carried out for an accurate estimation of the functional failure probability. Since the number of simulations required to obtain a given accuracy depends on the magnitude of the failure probability to be estimated, with the computational burden increasing with decreasing functional failure probability [START_REF] Schueller | On the treatment of uncertainties in structural mechanics and analysis[END_REF], this poses a significant challenge for the typically quite small (e.g., less than 10 -4 ) probabilities of functional failure of T-H passive safety systems. In particular, the challenge is due to the time required for each run of the detailed, mechanistic T-H system code which can take several hours (one code run is required for each sample of values drawn from the uncertainty distributions of the input parameters/variables to the T-H code) [START_REF] Fong | Reliability analysis of a passive cooling system using a response surface with an application to the flexible conversion ratio reactor[END_REF]. Thus, alternative methods must be sought to tackle the computational burden associated to the analysis.

To tackle the computational issue, efficient sampling techniques can be adopted for obtaining robust estimations with a limited number of input samples. Techniques like Importance Sampling (IS) [START_REF] Au | Subset Simulation and its application to seismic risk based on dynamic analysis[END_REF][START_REF] Koutsourelakis | Reliability of structures in high dimensions, Part I: algorithms and application[END_REF], Stratified Sampling [START_REF] Helton | Latin hypercube sampling and the propagation of uncertainty in analyses of complex systems[END_REF][START_REF] Cacuci | A comparative review of sensitivity and uncertainty analysis of large scale systems -II: Statistical methods[END_REF] and Latin Hypercube Sampling (LHS) [START_REF] Helton | Latin hypercube sampling and the propagation of uncertainty in analyses of complex systems[END_REF] have been widely used in reliability analysis and risk assessment [START_REF] Helton | Uncertainty and sensitivity analysis results obtained in the 1996 performance assessment for the waste isolation power plant[END_REF]. Recently, advanced sampling methods such as Subset Simulation (SS) [START_REF] Au | Estimation of small failure probabilities in high dimensions by subset simulation[END_REF][START_REF] Au | Subset Simulation and its application to seismic risk based on dynamic analysis[END_REF] and Line Sampling (LS) (Koutsporelakis et al., 2004;Pradlwarter et al., 2005) have been proposed for structural reliability assessment and subsequently applied to the estimation of the functional failure probability of a T-H passive system (Zio and Pedroni, 2009a and b) 1 . These methods have been shown to improve the computational efficiency although there is no indication yet that the number of model evaluations can be reduced to below a few hundreds, which may be mandatory in the presence of computer codes requiring several hours to run a single simulation.

1 Apart from efficient MC techniques, there exist methods based on nonparametric order statistics [START_REF] Wilks | Statistical prediction with special reference to the problem of tolerance limits[END_REF] that propagate uncertainties through mechanistic T-H codes with reduced computational burden, especially if only one-or two-sided confidence intervals are needed for particular statistics (e.g., the 95 th percentile) of the outputs of the code. For example, the so-called coverage [START_REF] Guba | Statistical aspects of best estimate method-I[END_REF][START_REF] Makai | Best estimate method and safety analysis II[END_REF] and bracketing [START_REF] Nutt | Evaluations of nuclear safety from the outputs of computer codes in the presence of uncertainties[END_REF] approaches can be used to identify the precise number of sample code runs required to obtain a given confidence level on the estimates of prescribed statistics of the code outputs.

In such cases, the only viable alternative seems that of resorting to fast-running, surrogate regression models, also called response surfaces or meta-models, to approximate the input/output function implemented in the long-running T-H model code, and then substitute it in the passive system functional failure analysis. The construction of such regression models entails running the T-H model code a predetermined, reduced number of times (e.g., 50-100) for specified values of the uncertain input parameters/variables and collecting the corresponding values of the output of interest; then, statistical techniques are employed for fitting the response surface of the regression model to the input/output data generated in the previous step. Several examples can be found in the open literature concerning the application of surrogate meta-models in reliability problems. In [START_REF] Bucher | A comparison of approximate response function in structural reliability analysis[END_REF][START_REF] Gavin | High-order limit state functions in the response surface method for structural reliability analysis[END_REF][START_REF] Liel | Incorporating modeling uncertainties in the assessment of seismic collapse risk of buildings[END_REF], polynomial Response Surfaces (RSs) are employed to evaluate the failure probability of structural systems; in [START_REF] Arul | Adjoint operator approach to functional reliability analysis of passive fluid dynamical systems[END_REF][START_REF] Fong | Reliability analysis of a passive cooling system using a response surface with an application to the flexible conversion ratio reactor[END_REF][START_REF] Mathews | Integration of functional reliability analysis with hardware reliability: An application to safety grade decay heat removal system of Indian 500 MWe PFBR[END_REF], linear and quadratic polynomial RSs are employed for performing the reliability analysis of T-H passive systems in advanced nuclear reactors; in [START_REF] Deng | Structural reliability analysis for implicit performance function using radial basis functions[END_REF][START_REF] Hurtado | Filtered importance sampling with support vector margin: a powerful method for structural reliability analysis[END_REF][START_REF] Cardoso | Structural reliability analysis using Monte Carlo simulation and neural networks[END_REF][START_REF] Cheng | A new artificial neural network-based response surface method for structural reliability analysis[END_REF], learning statistical models such as Artificial Neural Networks (ANNs), Radial Basis Functions (RBFs) and Support Vector Machines (SVMs) are trained to provide local approximations of the failure domain in structural reliability problems; in [START_REF] Volkova | Global sensitivity analysis for a numerical model of radionuclide migration from the RRC "Kurchatov Institute" redwaste disposal site[END_REF][START_REF] Marrel | Calculations of Sobol indices for the Gaussian process metamodel[END_REF], Gaussian meta-models are built to calculate global sensitivity indices for a complex hydrogeological model simulating radionuclide transport in groundwater.

In this work, Artificial Neural Networks (ANNs) are considered to reduce the computational burden associated to uncertainty propagation in the functional failure analysis of a natural convection-based decay heat removal system of a Gas-cooled Fast Reactor (GFR) [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]. A limited-size set of input/output data examples is used to construct the ANN regression model; once the model is built, it is used to perform, in a negligible computational time, the functional failure analysis of the T-H passive system: in particular, the functional failure probability of the system is estimated together with global sensitivity indices of the naturally circulating coolant temperature.

The use of regression models in safety critical applications like nuclear power plants raises concerns with regards to the model accuracy, which must be not only verified but also quantified; in this paper, we resort to the bootstrap method for quantifying, in terms of confidence intervals, the model uncertainty associated to the estimates provided by ANNs [START_REF] Efron | An introduction to the bootstrap[END_REF]. Some examples of the application of the bootstrap method for the evaluation of the uncertainties associated to the output of regression models in safety-related problems can be found in the literature: in [START_REF] Zio | A study of the bootstrap method for estimating the accuracy of artificial neural networks in predicting nuclear transient processes[END_REF], bootstrapped ANNs are trained to predict nuclear transients processes; in [START_REF] Cadini | An empirical model based bootstrapped neural networks for computing the maximum fuel cladding temperature in a RBMK-1500 nuclear reactor accident[END_REF][START_REF] Secchi | Quantifying uncertainties in the estimation of safety parameters by using bootstrapped artificial neural networks[END_REF], the model uncertainty, quantified in terms of a standard deviation, is used to "correct" the ANN output in order to provide conservative estimates for important safety parameters in nuclear reactors (i.e., percentiles of the pellet cladding temperature); finally, in [START_REF] Storlie | Implementation and evaluation of nonparameteric regression procedures for sensitivity analysis of computationally demanding models[END_REF], the bootstrap procedure is combined with different regression techniques, e.g. Multivariate Adaptive Regression Spline (MARS), Random Forest (RF) and Gradient Boosting Regression (GBR), to calculate confidence intervals for global sensitivity indices of the computationally demanding model of a nuclear waste repository.

The main objective of the present study is to show the possibility of:

• limiting the computational burden associated to the uncertainty propagation and sensitivity analyses underpinning a quantitative functional failure analysis of a T-H passive system; to this aim, ANN regression models trained on a small data set are used for the first time for the estimation of:

the functional failure probability of the passive system; first-order global Sobol sensitivity indices determining the contribution of the individual uncertain parameters (i.e., the inputs to the T-H code) to the uncertainty in the coolant temperature (i.e., the output of the T-H code) and consequently to the probability of functional failure of the passive system; • quantifying, in terms of confidence intervals, the model uncertainty associated to the estimates of the functional failure probability and Sobol indices provided by the ANN models. To the best of the authors' knowledge, the issue of quantification of model uncertainty in the regression estimates has not been addressed in the literature regarding the functional failure analysis of T-H passive systems [START_REF] Arul | Adjoint operator approach to functional reliability analysis of passive fluid dynamical systems[END_REF][START_REF] Fong | Reliability analysis of a passive cooling system using a response surface with an application to the flexible conversion ratio reactor[END_REF][START_REF] Mathews | Integration of functional reliability analysis with hardware reliability: An application to safety grade decay heat removal system of Indian 500 MWe PFBR[END_REF]; in the present work, bootstrapped ANNs are used to the purpose.

The paper organization is as follows. In Section 2, the concepts of functional failure analysis for T-H passive systems are synthetically summarized. Section 3 briefly presents the problem of empirical regression modeling by means of ANNs and provides a snapshot on the bootstrap method for the quantification of the ANN (model) uncertainty. In Section 4, the case study of literature concerning the passive cooling of a GFR is presented. In Section 5, the results of the application of bootstrapped ANNs to the functional failure analysis of the T-H passive system of Section 4 are reported. Conclusions are provided in the last section. Finally, algorithmic details about the bootstrap-based method for quantifying, in terms of confidence intervals, the model uncertainty associated to the estimates of safety parameters computed by ANN regression models are reported in the Appendix at the end of the paper.

Functional failure analysis of T-H passive systems

Since a comprehensive functional failure analysis of a T-H passive system is beyond the scope of this work, only the essential steps for the conceptual development of the analysis are briefly reported below [START_REF] Marquès | Methodology for the reliability evaluation of a passive system and its integration into a probabilistic safety assessment[END_REF]:

1. Define the failure criteria of the passive system.

2. Build a deterministic, best-estimate T-H model to simulate the passive system behavior.

3. Identify and characterize by proper probability distributions the factors of uncertainty in the results of the best estimate T-H calculations. In the present work, only epistemic uncertainties are considered, due to the limited knowledge on some phenomena and processes (e.g., models, parameters and correlations used in the T-H analysis).

4. Propagate by Monte Carlo Simulation (MCS), the epistemic uncertainties associated to the identified relevant parameters, models and correlations (step 3. above) through the deterministic, long-running T-H code in order to estimate the functional failure probability of the passive system conditional on the current state of knowledge about the phenomena involved (step 3. above) (Bassi and Marques, 2008;[START_REF] Mackay | Incorporating reliability analysis into the design of passive cooling systems with an application to a gas-cooled reactor[END_REF][START_REF] Mathews | Functional reliability analysis of safety grade decay heat removal system of Indian 500 MWe PFBR[END_REF][START_REF] Patalano | Risk-informed design changes in a passive decay heat removal system[END_REF]. Formally, let x = {x 1 , x 2 , …, x j , …, i n x } be the vector of the relevant uncertain system parameters/variables, Y( x ) be a scalar indicator variable of the performance of the passive system (e.g., the fuel peak cladding temperature) and α Y a threshold value defining the corresponding failure criterion (e.g., a limit value imposed by regulating authorities). For illustrating purposes, let us assume that the passive system operates as long as Y( x ) < α Y . The MCS procedure for estimating the functional failure probability entails that a large number N T of samples of the values of the system parameters x be drawn from the corresponding probability distributions and used to evaluate The computational burden posed by the uncertainty propagation and sensitivity analysis of steps 4. and 5. above may be tackled by replacing the long-running, original T-H model code by a fastrunning, surrogate regression model properly built to approximate the output from the true system model. In this paper, Artificial Neural Networks (ANNs) [START_REF] Bishop | Neural Networks for pattern recognition[END_REF] are used. A confidence interval is evaluated by means of the bootstrap method [START_REF] Efron | An introduction to the bootstrap[END_REF]; a brief description of this latter technique is given in the following Section, whereas the relevant algorithmic details can be found in the Appendix at the end of the paper.

Bootstrapped Artificial Neural Networks for empirical regression modelling

As discussed in the previous Section, the computational burden posed by uncertainty and sensitivity analyses of T-H passive systems can be tackled by replacing the long-running, original T-H model code by a fast-running, surrogate regression model. Because calculations with the surrogate model can be performed quickly, the problem of long simulation times is circumvented.

Let us consider a generic meta-model to be built for performing the task of nonlinear regression, i.e., estimating the nonlinear relationship between a vector of input variables x = {x 1 , x 2 , ..., x j , ..., [START_REF] Zio | A study of the bootstrap method for estimating the accuracy of artificial neural networks in predicting nuclear transient processes[END_REF]. It can be assumed that the target vector y is related to the input vector x by an unknown nonlinear deterministic function

( )

x µ y corrupted by a noise vector ( )

x ε , i.e., ( ) ( ) ( ) x ε x µ x y y + = . ( 1
)
Notice that in the present case of T-H passive system functional failure probability assessment the vector x contains the relevant uncertain system parameters/variables, the nonlinear deterministic function ( )

x µ y
represents the complex, long-running T-H mechanistic model code (e.g., RELAP5-3D), the vector y(x) contains the output variables of interest for the analysis and the noise ( )

x ε represents the errors introduced by the numerical methods employed to calculate ( ) x µ y [START_REF] Storlie | Implementation and evaluation of nonparameteric regression procedures for sensitivity analysis of computationally demanding models[END_REF]; for simplicity, in the following we assume ( ) [START_REF] Secchi | Quantifying uncertainties in the estimation of safety parameters by using bootstrapped artificial neural networks[END_REF].

x ε = 0
The objective of the regression task is to estimate , p = 1, 2, ..., N train ; for example, the Root Mean Squared Error (RMSE) is commonly adopted to this purpose [START_REF] Zio | A study of the bootstrap method for estimating the accuracy of artificial neural networks in predicting nuclear transient processes[END_REF]: In this work, three-layered feed-forward Artificial Neural Network (ANN) regression models are considered. In extreme synthesis, ANNs are computing devices inspired by the function of the nerve cells in the brain [START_REF] Bishop | Neural Networks for pattern recognition[END_REF]. They are composed of many parallel computing units (called neurons or nodes) interconnected by weighed connections (called synapses). Each of these computing units performs a few simple operations and communicates the results to its neighbouring units. From a mathematical viewpoint, ANNs consist of a set of nonlinear (e.g., sigmoidal) basis functions with adaptable parameters w * that are adjusted by a process of training (on many different input/output data examples), i.e., an iterative process of regression error minimization [START_REF] Rumelhart | Learning internal representations by error back-propagation[END_REF]. The details about ANN regression models are not reported here for brevity, the interested reader may refer to the cited references and the copious literature in the field. The particular type of ANN employed in this paper is the classical three-layered feed-forward ANN trained by the error back-propagation algorithm.

( ) 2 , , 1 1 1 train o N n p l p l p l train o RMSE y y N n = = = - ⋅ ∑ ∑ . ( 2
When using the approximation of the system output provided by an ANN empirical regression model, an additional source of uncertainty is introduced which needs to be evaluated, particularly in safety critical applications like those related to nuclear power plant technology. One way to do this by resorting to bootstrapped ANN regression models [START_REF] Efron | An introduction to the bootstrap[END_REF], i.e., an ensemble of ANN regression models, constructed on different data sets bootstrapped from the original one [START_REF] Zio | A study of the bootstrap method for estimating the accuracy of artificial neural networks in predicting nuclear transient processes[END_REF][START_REF] Storlie | Implementation and evaluation of nonparameteric regression procedures for sensitivity analysis of computationally demanding models[END_REF]. The bootstrap method is a distribution-free inference method which requires no prior knowledge about the distribution function of the underlying population [START_REF] Efron | An introduction to the bootstrap[END_REF]. The basic idea is to generate a sample from the observed data by sampling with replacement from the original data set [START_REF] Efron | An introduction to the bootstrap[END_REF]. From the theory and practice of ensemble empirical models, it can be shown that the estimates given by bootstrapped ANN regression models is in general more accurate than the estimate of the best ANN regression model in the bootstrap ensemble of ANN regression models [START_REF] Zio | A study of the bootstrap method for estimating the accuracy of artificial neural networks in predicting nuclear transient processes[END_REF][START_REF] Cadini | An empirical model based bootstrapped neural networks for computing the maximum fuel cladding temperature in a RBMK-1500 nuclear reactor accident[END_REF].

A bootstrap-based estimation technique is here employed for the evaluation of the so-called Bootstrap Bias Corrected (BBC) point estimate ˆBBC Q of a generic quantity Q (e.g., a safety parameter) by an ANN regression model f(x, w * ) and the calculation of the associated BBC Confidence Interval (CI) [START_REF] Zio | A study of the bootstrap method for estimating the accuracy of artificial neural networks in predicting nuclear transient processes[END_REF][START_REF] Storlie | Implementation and evaluation of nonparameteric regression procedures for sensitivity analysis of computationally demanding models[END_REF]. The complete algorithm is not reported here for brevity; some details can be found in the Appendix at the end of the paper.

Case study: functional failure analysis of a T-H passive system

The case study considered in this work concerns the natural convection cooling in a Gas-cooled Fast Reactor (GFR) under a post-Loss Of Coolant Accident (LOCA) condition [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF].

The reactor is a 600-MW GFR cooled by helium flowing through separate channels in a silicon carbide matrix core whose design has been the subject of study in the past several years at the Massachussets Institute of Technology (MIT) [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF].

In these studies, the possibility of using natural circulation to remove the decay heat in case of an accident is demonstrated. In particular, in the case of a LOCA, the long-term heat removal is ensured by natural circulation in a given number N loops of identical and parallel loops.

A GFR decay heat removal configuration is shown schematically in Figure 1; only one of the N loops loops is reported for clarity of the picture: the flow path of the cooling helium gas is indicated by the black arrows; the loop has been divided into N sections = 18 sections for numerical calculation;

technical details about the geometrical and structural properties of these sections are not reported here for brevity: the interested reader may refer to [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF].

Figure 1 here

In the present analysis, the average core power to be removed is assumed to be 18.7 MW, equivalent to about 3% of full reactor power (600 MW): to guarantee natural circulation cooling at this power level, a pressure of 1650 kPa is required in nominal conditions. Finally, the secondary side of the heat exchanger (i.e., item 12 in Figure 1) is assumed to have a nominal wall temperature of 90 °C [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF].

The model describes the quasi-steady-state natural circulation cooling that takes place after the LOCA transient has occurred. The associated simplifications introduced in the modeling allow relatively fast calculations, which enable to obtain reference values for comparison of the estimates obtained by the ANN models developed. From a strictly mathematical point of view, obtaining a steady-state solution amounts to dropping the time dependent terms in the energy and momentum conservation equations. In practice, the T-H model code balances the pressure losses around the loops so that friction and form losses are compensated by the buoyancy term, while at the same time maintaining the heat balance in the heater (i.e., the reactor core, item 4 in Figure 1) and cooler (i.e., the heat exchanger, item 12 in Figure 1); a thorough description of the deterministic T-H model is not given here for brevity: the interested reader may refer to [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF] for details.

Uncertainties in the T-H model

Uncertainties affect the actual operation of passive systems and its modeling. On the one side, there are phenomena, like the occurrence of unexpected events and accident scenarios, e.g. the failure of a component or the variation of the geometrical dimensions and material properties, which are random in nature. This kind of uncertainty in the model description of the system behavior is termed aleatory (NUREG-1150(NUREG- , 1990;;[START_REF] Helton | Uncertainty and sensitivity analysis results obtained in the 1996 performance assessment for the waste isolation power plant[END_REF][START_REF] Usnrc | An approach for using probabilistic risk assessment in risk-informed decisions on plant-specific changes to the licensing basis[END_REF]. In this work, as well as in the reference paper by [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF], aleatory uncertainties are not considered for the estimation of the functional failure probability of the T-H passive system of Figure 1.

An additional contribution of uncertainty comes from the incomplete knowledge on the properties of the system and the conditions in which the phenomena occur (i.e., natural circulation). This uncertainty is often termed epistemic and affects the model representation of the system behaviour, in terms of both (model) uncertainty in the hypotheses assumed and (parameter) uncertainty in the values of the parameters of the model [START_REF] Cacuci | A comparative review of sensitivity and uncertainty analysis of large scale systems -II: Statistical methods[END_REF][START_REF] Helton | Survey on sampling-based methods for uncertainty and sensitivity analysis[END_REF][START_REF] Patalano | Risk-informed design changes in a passive decay heat removal system[END_REF].

Model uncertainty arises because mathematical models are simplified representations of real systems and, therefore, their outcomes may be affected by errors or bias. It may, for example, involve the correlations adopted to describe the T-H phenomena, which are subject to errors of approximation. Such uncertainties may for example be represented by a multiplicative model [START_REF] Zio | Two methods for the structured assessment of model uncertainty by experts in performance assessment in radioactive waste repositories[END_REF][START_REF] Patalano | Risk-informed design changes in a passive decay heat removal system[END_REF]:

, ) ( ζ ⋅ = x m z ( 3
)
where z is the real value of the parameter to be correlated (e.g., heat transfer coefficients, friction factors, Nusselt numbers or thermal conductivity coefficients), m(·) is the mathematical model of the correlation, x is the vector of correlating variables and ζ is a multiplicative error factor. Hence, the uncertainty in the output quantity z is translated into an uncertainty in the multiplicative error factor ζ , commonly classified as representing model uncertainty.

Uncertainty affects also the values of the parameters used in the model (e.g., power level, pressure, cooler wall temperature, material conductivity, …), e.g. owing to errors in their measurement or insufficient data and information. As a consequence, the values of such parameters are usually known only to a certain level of precision, i.e., epistemic uncertainty is associated with them [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF].

In this work, only epistemic (i.e., model and parameter) uncertainties are represented and propagated through the deterministic T-H code [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]Bassi and Marques, 2008;[START_REF] Mackay | Incorporating reliability analysis into the design of passive cooling systems with an application to a gas-cooled reactor[END_REF][START_REF] Mathews | Functional reliability analysis of safety grade decay heat removal system of Indian 500 MWe PFBR[END_REF][START_REF] Patalano | Risk-informed design changes in a passive decay heat removal system[END_REF]. Parameter uncertainties are associated to the reactor power level, the pressure in the loops after the LOCA and the cooler wall + 4σ] (Table 1, [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]. The practical and conceptual reasons underpinning the values in Table 1 are described in [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF].

Table 1 here

Failure criteria of the T-H passive system

The passive decay heat removal system of Figure 1 is considered failed whenever the temperature of the coolant helium leaving the core (item 4 in Figure 1) exceeds either 1200 °C in the hot channel or 850 °C in the average channel: these values are expected to limit the fuel temperature to levels which prevent excessive release of fission gases and high thermal stresses in the cooler (item 12 in Figure 1) and in the stainless steel cross ducts connecting the reactor vessel and the cooler (items from 6 to 11 in Figure 1) [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF].

Indicating by x the vector of the 9 uncertain system parameters of Table 1 (Section 4.1) and by ( )

x hot core out T , and
( )

x avg core out T ,
the coolant outlet temperatures in the hot and average channels, respectively, the failure event F can be written as follows: The failure event F in (4) can be condensed into a single performance indicator Y(x) (Section 2) as (5) so that the failure event F becomes specified as:

( ) ( ) ( ) ( ) ( )       =       = 850 ,
( ) { } 1 : > = x x Y F . ( 6
)
In the notation of Section 2, the failure threshold α Y is then equal to one.

Results of the application of bootstrapped ANNs for the functional failure analysis of the T-H passive system of Section 4

In this Section, the results of the application of bootstrapped Artificial Neural Networks (ANNs) for the quantitative functional failure analysis of the 600-MW GFR passive decay heat removal system in Figure 1 are illustrated. First, few details about the construction of the ANN regression model are given in Section 5.1; then, this is used to estimate the probability of functional failure of the system (Section 5.2); finally, the sensitivity of the hot-channel coolant outlet temperature to the uncertain input parameters is studied by computing first-order Sobol indices (Section 5.3). Notice that at each estimation step, the model uncertainties associated to the above mentioned quantities are also estimated by bootstrapping the ANN regression models (see Section 3 and the Appendix).

Building and testing the ANN regression model

The ANN model used in this work is built using a set x }, p = 1, 2, …., N train [START_REF] Zhang | Performance-based design and seismic reliability analysis using designed experiments and neural networks[END_REF]. Then, the original T-H model is evaluated on the input vectors x p , p = 1, 2, …, N train , to obtain the corresponding output vectors y p = µ y (x p ) = {y 1,p , y 2,p , ..., y l,p , ..., . Finally, the adjustable parameters w * of the ANN regression model are calibrated to fit the generated data: in particular, the common error back-propagation algorithm is implemented to train the ANN [START_REF] Rumelhart | Learning internal representations by error back-propagation[END_REF].

In the present case study, the number n i of inputs to the ANN regression model is equal to 9 (i.e., the number of uncertain inputs in Table 1 of Section 4.1), whereas the number n o of outputs is equal to 2 (i.e., the number of system variables of interest, the hot-and average-channel coolant outlet temperatures, as reported in Section 4.2). The number of nodes n h in the hidden layer has been set equal to 4 by trial and error.

A validation data set For a realistic measure of the ANN model accuracy, the widely adopted coefficient of determination [START_REF] Marrel | Calculations of Sobol indices for the Gaussian process metamodel[END_REF].

( ) { } , , 1

Table 2 here

The large values of the coefficient of determination R 2 , i.e., 0.9897 and 0.9866, and the small values of 12 °C and 6.3 °C for the RMSEs produced by the ANN for the hot-and average-channel coolant outlet temperatures hot core out T , and avg core out T , , respectively, lead us to assert that the accuracy of the ANN model can be considered satisfactory for the needs of estimating the functional failure probability of the present T-H passive system.

Finally, in order to demonstrate that the trial-and-error selected ANN architecture with n h = 4 hidden neurons is suitable for the present application, Table 2 contains

Functional failure probability estimation

In this Section, the bootstrapped ANNs are used for estimating the functional failure probability, and associated confidence interval of the 600-MW GFR passive decay heat removal system of Figure 1. The previous system configuration with N loops = 3 is analyzed. (BBC)-95% Confidence Interval (CI) is also reported. A "true" value of the functional failure probability P(F) is also reported in Table 3 for reference (i.e., P(F) = 3.34•10 -4 ); this has been obtained with a very large number N T (i.e., N T = 500000) of simulations of the original T-H code, which actually runs fast enough to allow repetitive calculations (one code run lasts on average 3 seconds on a Pentium 4 CPU 3.00GHz): the computational time required by this reference analysis is thus 500000•3 s = 1500000 s ≈ 417 h.

Table 3 here

It can be seen that bootstrapped ANNs are quite reliable because the value of the BBC point estimate ( ) BBC F P ˆ (i.e., 3.59•10 -4 ) is quite close to the "true" value (i.e., 3.34•10 -4 ) of the functional failure probability P(F). In spite of the small value of the failure probability (i. In addition, the BBC-95% CI produced by the bootstrapped ANNs provides a measure of the (model) uncertainty associated to the ANN point estimate ( ) BBC F P ˆ: this information is particularly interesting when very few data are used to build the bootstrapped ANN models and, consequently, the confidence of the analyst in the obtained BBC point estimate ( ) BBC F P ˆ is poor. In this respect, the upper bound of the BBC-95% CI (in this case, 4.12•10 -4 ) can be used to provide a slightly conservative estimate of the corresponding functional failure probability P(F). Note that the BBC-95% CI includes the "true" value of P(F) (i.e., 3.34•10 -4 ) and it is quite narrow around it: this confirms the robustness of the estimates produced by the trained bootstrapped ANN regression models in the present application.

Finally, a computational time of about 2 hours is associated to the calculation of the BBC point estimate ( ) BBC F P ˆ for P(F) and the corresponding BBC-95% CI (Table 3)

Global sensitivity analysis based on first-order Sobol indices

In the functional failure analysis of a T-H passive system, sensitivity analysis is a useful tool for identifying the uncertain parameters (i.e., the uncertain inputs to the T-H code) that contribute most to the variability of the model outputs (i.e., the coolant outlet temperatures). In the following, firstorder Sobol sensitivity indices are computed only for the hot-channel coolant outlet temperature hot core out T , by way of example [START_REF] Sobol | Sensitivity analysis for nonlinear mathematical model[END_REF].

By definition, the first-order Sobol sensitivity index S j l , j = 1, 2, …, n i , l = 1, 2, …, n o , quantifies the proportion of the variance of the output y l , l = 1, 2, …, n o , that can be attributed to the variance of the uncertain input variable x j alone, i.e., without taking into account interactions with other input variables. It is formally defined as

( ) [ ] | , 1, 2,..., , 1, 2,..., j j x l j l j i o l V E y x S j n l n V y -     = = = x , (7)
where V[y l ] is the variance of the model output y l , l = 1, 2, …, n o , obtained when all model input parameters x j , j = 1, 2, …, n i , are sampled over their variation range,

{ }

1 2 1 1 , ,..., , ,..., i j j j n

x x x x x --+ = x is a vector containing all the uncertain input variables except x j and ( )

| j j x l j V E y x -    
x is the expected variance of y l obtained when the input parameter of interest x j is fixed and all the remaining input variables are sampled over their variation ranges; a thorough description of this sensitivity measure goes far beyond the scope of this work: further details can be found in (Saltelli, 2002a).

As pointed out in (Saltelli, 2002b), the sensitivity index (7) has the advantage of being global because the effect of the entire distribution of the parameter whose uncertainty importance is evaluated, is considered; moreover, this sensitivity index is also "model free" because its computation is independent from assumptions about the model form, such as linearity, additivity and so on. The drawback of this approach relies in the computational burden associated to its calculation. Actually, if N samples (i.e., T-H model code evaluations) are used to calculate both the expected value ( )

| j l j E y x - x
and the variance ( )

| j j x l j V E y x -    
x in ( 7) by crude Monte Carlo sampling, then the total number N T of samples required to compute ( 7) is N T = N 2 for each output y l of interest, l = 1, 2, …, n o [START_REF] Saltelli | Global sensitivity analysis[END_REF]: for example, if N = 10 2 ÷ 10 3 , then N T = 10 4 ÷ 10 6 , rendering impracticable the associated analysis. The total number N T of samples can be reduced to N(n i + 2) by resorting to an efficient algorithm proposed by (Saltelli, 2002b): in this case, if N = 10 2 ÷ 10 3 and n i = 9 (like in the present problem), then N T = 1.1•10 3 ÷ 1.1•10 4 , leading to a reduction of one or two orders of magnitude in the number of required T-H code simulations; details about these algorithms can be found in the cited references.

In this work, the hot channel coolant outlet temperature hot core out T , = y 1 is chosen as output of interest for the analysis and the algorithm proposed by (Saltelli, 2002b) to both analyses (i.e., on average 92 h and 2.12 h, respectively) is also reported, on a Pentium 4 CPU 3.00GHz. only on these important parameters/variables and the related physical phenomena (for example, the collection of experimental data could lead to an improvement in the state-of-knowledge on the correlations used to model the heat transfer process in natural convection); on the other side, the analyst is allowed to identify those parameters/variables (in this case, x 6 , x 9 , x 4 and x 7 ) that are not important so that they may be excluded from the analysis, thereby simplifying the T-H model.

In addition, it is worth recalling that in the present case these insights are obtained at the expense of only N train + N val + N test = 100 + 20 + 20 = 140 runs of the original T-H model code instead of the many thousands that are required by the crude and direct application of the algorithm in (Saltelli, 2002b) to the original, long-running T-H model code.

Finally, Table 5 has been taken as reference. For simplicity, the representation of the system behavior has been limited to a steady-state model. The results obtained show that the applied procedure is effective in reducing the computational burden associated to the functional failure analyses of T-H passive systems, while quantifying the uncertainty in the results. Although the T-H model used in this work to describe the behaviour of the natural circulation-based T-H passive system is a steady-state (thus, simplified) model, it is expected that even more significant benefits be gained with respect to more detailed thermalhydraulic models (e.g., RELAP5-3D), provided that the number of code runs to train and validate the bootstrapped ANN regression model is small, as in the proposed procedure.

A final remark is also in order with respect to the possibility of using bootstrapped ANNs in the analysis of a complete accident sequence involving a T-H passive system instead of only one phase of the sequence (as it is done in the present work). In this view, two issues must be taken into account: i) the behavior of a T-H passive system is obviously dependent on the boundary conditions note that for a correct quantification of the confidence interval the estimate b Q ˆ must be based on the same input and output vectors x r and y r , r = 1, 2, …, N T , respectively, obtained in step 3. above.

5. Calculate the so-called Bootstrap Bias Corrected (BBC) point estimate .

BBC Q ˆ for Q as boot BBC Q Q Q 2 ˆ-= ( 1
(2')

The BBC estimate BBC Q ˆ in (1') is taken as the point estimate for Q.

The explanation for expression (1') is as follows. It can be demonstrated that if there is a bias in the bootstrap average estimate boot Q ˆ in (2') compared to the estimate Q ˆ obtained with the single ANN regression model f(x, w * ) (step 3. above), then the same bias exists in the single estimate Q ˆ compared to the true value Q of the quantity of interest [START_REF] Baxt | Bootstrapping confidence intervals for clinic input variable effects in a network trained to identify the presence of acute myocardial infarction[END_REF]. Thus, in order to obtain an appropriate, i.e. bias-corrected, estimate BBC Q ˆ for the quantity of interest Q, the estimate Q ˆ must be adjusted by subtracting the corresponding bias ( boot Q ˆ -Q ˆ): as a consequence, the final, bias-corrected estimate

BBC Q ˆ is BBC Q ˆ = Q ˆ - ( boot Q ˆ -Q ˆ) = 2 Q ˆ -boot Q ˆ.
] ( ) ( ) ( ) [ ] ( ) ( ) [ ] boot B BBC B boot BBC Q Q Q Q Q Q , ˆ2 / 1 2 / - + - - - ⋅ ⋅ α α
.

(3')

An important advantage of the bootstrap method is that it provides confidence intervals for a given quantity Q without making any model assumptions (e.g., normality); a disadvantage is that the computational cost could be high when the set D train and the number of adaptable parameters w * in the regression models are large.

. Schematic representation of one loop of the 600-MW GFR passive decay heat removal system [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]

  Y(x) by running the T-H code. An estimate ( ) P F of the probability of failure P(F) can then be computed by dividing the number of times that Y( x ) > α Y by the total number of samples N T . 5. Perform a sensitivity study to determine the contribution of the individual uncertain parameters (i.e., the inputs to the T-H code) to the uncertainty in the outputs of the T-H code and consequently to the functional failure probability of the T-H passive system. As is true for uncertainty propagation (step 4. above), sensitivity analysis relies on multiple evaluations of the code for different combinations of system inputs.

  a vector of output targets y = {y 1 , y 2 , ..., y l , ..., o n y }, on the basis of a finite (and possibly reduced) set of input/output data examples (i.e., patterns),

  by means of a regression function f(x, w * ) depending on a set of parameters w * to be properly determined on the basis of the available data set D train ; the algorithm used to calibrate the set of parameters w * is obviously dependent on the nature of the regression model adopted, but in general it aims at minimizing the mean (absolute or quadratic) error between the output targets of the original T-H code, y p = ( ) p y µ x , p = 1, 2, ..., N train , and the output vectors of the regression model,

)

  Once built, the regression model f(x, w * ) can be used as a simplified, quick-running surrogate of the original, long-running T-H model code for significantly reducing the computational burden associated to the accurate estimation and epistemic uncertainty propagation steps of the functional failure analysis of T-H passive systems. In particular, the regression model f(x, w * ) can be used in place of the T-H code to calculate any quantity of interest Q, e.g. the functional failure probability of the passive system, confidence intervals and global sensitivity indices, etc.

  temperature. Model uncertainties are associated to the correlations used to calculate the Nusselt numbers and friction factors in the forced, mixed and free convection regimes. The corresponding nine uncertain inputs of the model { } : 1, 2,...,9 j x j = are assumed to be distributed according to normal distributions of known mean µ and standard deviation σ, taking values in the range [µ -4σ, µ

  that, in the notation of the preceding Section 3, y 2 (x) are the two target outputs of the T-H model.

  data examples of size N train = 100; this is done to test the capability of the ANN regression model to reproduce the outputs of the nonlinear T-H model code on the basis of a relatively small number of runs from the original T-H code. A Latin Hypercube Sample (LHS) of the inputs is drawn to give the vectors x p = {x 1,p , x 2,p , …, x j,p , …, , i n p

  the training set D train ) is used to monitor the accuracy of the ANN model during the training procedure: in practice, the RMSE (2) is computed on D val at different phases of the training procedure. At the beginning, the RMSE computed on the validation set D val typically decreases together with the RMSE computed on the training set D train ; then, when the ANN regression model starts overfitting the data, the RMSE calculated on the validation set D val starts increasing: this is the time to stop the training algorithm.

  on the test set D test of size N test = 20 by the ANN model with n h = 4 hidden neurons, built on a data set D train of size N train = 100; the number of adjustable parameters (ANN weights) w * in the ANN regression model is also reported.

  also the values of the coefficient of determination 2 R and of the RMSE associated to the estimates of the hotrespectively, obtained on the test set D test by two additional ANN topologies: in particular, ANN regression models with n h = 3 and 5 hidden neurons are considered. It can be seen that the values of the coefficient of determination R 2 obtained by the ANN architecture with n h = 3 hidden neurons are 0.9821 and 0.9763 (i.e., lower than those produced by the ANN with n h = 4 hidden neurons), while the values of the RMSEs are 16.0 °C and 8.5 °C (i.e., larger than those produced by the ANN with n h = 4 hidden neurons) for the hot-and average-channel coolant outlet temperatures hot respectively. The values of the coefficient of determination R 2 obtained by the ANN architecture with n h = 5 hidden neurons are 0.9891 and 0.9860 (again, lower than those produced by the ANN with n h = 4 hidden neurons), while the values of the RMSEs are 13.4 °C and 7.6 °C (again, larger than those produced by the ANN with n h = 4 hidden neurons) for the hot-and average-channel coolant outlet temperatures

  per demand) P(F) obtained with N T = 500000 estimations from B = 1000 bootstrapped ANNs built on N train = 100 data examples; the corresponding Bootstrap Bias Corrected

  e., P(F) ~ 10 -4 ) this is done by resorting to quite a low number of runs of the T-H code (i.e., only N train + N val + N test = 100 + 20 + 20 = 140 input/output examples for training, validating and testing the bootstrapped ANN model).

  ; this value includes the time required for i) generating the N train + N val + N test = 100 + 20 + 20 = 140 input/output examples, by running the T-H code (i.e., on average 140•3 s = 420 s = 7 m ≈ 0.12 h), ii) training the bootstrapped ensemble of B = 1000 ANN models by means of an error back-propagation algorithm (i.e., on average 2 h) and iii) performing N T = 500000 evaluations of each of the B = 1000 bootstrapped ANN models (i.e., on average 6 minutes = 0.1 h). The overall CPU time required by the use of bootstrapped ANNs (i.e., on average 2.22 h) is about 180 times lower than that required by the use of the original T-H model code (i.e., on average 417 h).

  has been implemented with N = 10000 and n i = 9 (i.e., N T = 110000) to obtain the "true" (i.e., reference) values of the first-order Sobol sensitivity indices 1 j S for the input variables x j , j = 1, 2, …, 9. The reference ranking of the uncertain input variables obtained with N T = 110000 runs of the original T-H model code is reported in the left column of Table 4 together with the corresponding values of the first-order Sobol sensitivity indices 1 j S , j = 1, 2, …, 9 (in parentheses) The Table also shows the ranking of the uncertain input parameters x j , j = 1, 2, …, 9, based on the BBC point estimates with N T = 110000 estimations from B = 1000 bootstrapped ANN models built on N train = 100 input/output data examples (right column); finally, the computational time (in hours) associated

  An ANN model has been constructed on the basis of a limited-size set of data which represent examples of the nonlinear relationships between 9 uncertain inputs and 2 relevant outputs of the T-H model code (i.e., the hot-and average-channel coolant outlet temperatures). Once built, such model has been used as fast-running surrogate of the original, long-running T-H model code to perform the functional failure analysis of the T-H passive system. First, a functional failure probability as small as 10 -4 has been estimated; then, the sensitivity of the passive system performance to the uncertain system input parameters has been studied by calculating first-order Sobol sensitivity indices. In both analyses, the results have demonstrated that although the ANN regression model has been built on few (i.e., 100) data examples, the point estimates provided are reliable, because they are very near to the true values of the quantities of interest.Moreover, a bootstrap of ANN regression models has been considered to produce confidence intervals for the estimates of the above mentioned safety quantities: this (model) uncertainty quantification is of paramount importance in safety critical applications, in particular when few data examples are used to build the surrogate models and, consequently, the confidence of the analyst in the obtained estimates is poor. With respect to that, the bootstrapped ANNs have been shown to be quite robust because the produced confidence intervals are satisfactorily narrow around the true values of the quantities of interest.

  ') where Q ˆ is the estimate obtained with the ANN regression model f(x, w * ) trained with the original data set D train (steps 2. and 3. above) and boot Q ˆ is the average of the B estimates b Q ˆ obtained with the B ANN regression models f b (x, w b * ), b = 1, 2, ..., B (step 4.c. above), i.e.,

6.

  Calculate the two-sided Bootstrap Bias Corrected (BBC)-100•(1α)% Confidence Interval (CI) for the BBC point estimate in (1') by performing the following steps: a. Order the bootstrap estimates b Q ˆ, b = 1, 2, ..., B, (step 4.c. above) the 100•α/2 th and 100•(1α/2) th quantiles of the bootstrapped empirical probability distribution of Q (step 4. above) as the [B•α/2] th and [B(1 -α/2)] that the symbol [•] stands for "closest integer". c. Calculate the two-sided BBC-100•(1α)% CI for BBC Q ˆ as

[

2

  R and the RMSE have been computed for each output y l , l = 1, 2, ..., n o , on a new data set

	test D	=	( {	x	p	,	y	p	) ,	p	=	, 1	, 2	...,	N	test	}	also of size N test = 20, not used during training

Table 2

 2 reports the values of the coefficient of determination 2 R and of the RMSE associated to the estimates of the hot-and average-channel coolant outlet temperatures hot

	out T ,	core	and avg core out

Table 3

 3 reports the value of the Bootstrap Bias Corrected (BBC) estimate ( ) BBC

Table 4 here

 4 It can be seen that the ranking provided by bootstrapped ANNs is exactly the same as the reference one (i.e., the one obtained by running the original T-H model code a large number N T of times): this results confirms the good estimation accuracy of the trained bootstrapped ANNs and the possibility to use this regression model for sensitivity analysis in T-H passive system functional failure assessment. It is interesting to note that the variances of the probability distributions of the first five uncertain input parameters/variables in the ranking (i.e., x 2 , x 8 , x 5 , x 3 and x 1 ) accounts for about the 96% of the total variance of the probability distribution of the hot channel coolant outlet On the one side, the analyst is able to identify those parameters/variables whose epistemic uncertainty plays a major role in determining the functional failure of the T-H passive system: consequently, his/her research efforts can be focused on increasing the state-of-knowledge

	temperature hot core out T ,	= y 1 : actually, 1 2 S + 1 8 S + 1 5 S + 1 3 S + 1 1 S = 0.9645. This outcome provides two
	important insights.

Table 5 here 6 Conclusions

 56 In this paper, Artificial Neural Networks (ANNs) have been considered for performing a fast and efficient functional failure analysis of a T-H passive system. A case study involving the natural convection cooling in a Gas-cooled Fast Reactor (GFR) after a Loss of Coolant Accident (LOCA)

of operation which depend on their turn on the particular phase of the accident sequence considered and on the "history" of the accident sequence itself: thus, possibly different ANN regression models should be built for use in different phases of the accident scenarios considered; ii) the (model) uncertainty associated to the estimates of the ANN regression model have to be propagated through the accident sequence: to this aim, the creation of bootstrap-based empirical probability distributions for the physical quantities of interest (e.g., the coolant temperature, the passive system failure probability and so on) offers a possible way to tackle this problem. Both issues i) and ii) above will be subject of future researches and applications.

Appendix

The bootstrap algorithm for bias-corrected point and confidence

interval estimation in ANN empirical regression modeling

In what follows, the steps of the procedure for the evaluation of the so-called Bootstrap Bias Corrected (BBC) point estimate ˆBBC Q of a generic quantity Q (e.g., a safety parameter) by an ANN regression model f(x, w * ) and the calculation of an associated BBC Confidence Interval (CI) are reported in detail [START_REF] Zio | A study of the bootstrap method for estimating the accuracy of artificial neural networks in predicting nuclear transient processes[END_REF][START_REF] Storlie | Implementation and evaluation of nonparameteric regression procedures for sensitivity analysis of computationally demanding models[END_REF] Hypercube Sampling or other more sophisticated experimental design methods can be adopted to select the input vectors x p , p = 1, 2, ..., N train [START_REF] Gazut | Towards the optimal design of numerical experiments[END_REF]. Nusselt number in forced convection, x 4 1 5%

Nusselt number in mixed convection, x 5 1 15%

Nusselt number in free convection, x 6 1 7.5%

Friction factor in forced convection, x 7 1 1%

Friction factor in mixed convection, x 8 1 10%

Friction factor in free convection, x 9 1 1.5%

Table 1. Epistemic uncertainties considered for the 600-MW GFR passive decay heat removal system of Figure 1 [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF] Artificial Neural Network (ANN)