Enrico Zio
email: enrico.zio@ecp.fr

Nicola Pedroni

How to effectively compute the reliability of a thermal-hydraulic nuclear passive system

Keywords: Nuclear passive system, functional failure analysis, computational cost, efficient Monte Carlo Simulation, fast-running regression model

The computation of the reliability of a thermal-hydraulic (T-H) passive system of a nuclear power plant can be obtained by i) Monte Carlo (MC) sampling the uncertainties of the system model and parameters, ii) computing, for each sample, the system response by a mechanistic T-H code and iii) comparing the system response with pre-established safety thresholds, which define the success or failure of the safety function. The computational effort involved can be prohibitive because of the large number of (typically long) T-H code simulations that must be performed (one for each sample) for the statistical estimation of the probability of success or failure. The objective of this work is to provide operative guidelines to effectively handle the computation of the reliability of a nuclear passive system. Two directions of computation efficiency are considered: from one side, efficient Monte Carlo Simulation (MCS) techniques are indicated as a means to performing robust estimations with a limited number of samples: in particular, the Subset Simulation (SS) and Line Sampling (LS) methods are identified as most valuable; from the other side, fast-running, surrogate regression models (also called response surfaces or meta-models) are indicated as a valid replacement of the long-running T-H model codes: in particular, the use of bootstrapped Artificial Neural Networks (ANNs) is shown to have interesting potentials, including for uncertainty propagation. The recommendations drawn are supported by the results obtained in an illustrative application of literature.

Introduction

Nuclear safety has expanded its considerations to severe accidents and increased its requirements for guaranteeing effective safety functions. This explains the interest in passive systems [START_REF] Ahn | Deterministic and risk-informed approaches for safety analysis of advanced reactors: Part I, deterministic approaches[END_REF][START_REF] Kim | Deterministic and risk-informed approaches for safety analysis of advanced reactors: Part II, Risk-informed approaches[END_REF], which all innovative reactor concepts make use of, to a large extent in combination with active systems [START_REF] Mackay | Incorporating reliability analysis into the design of passive cooling systems with an application to a gas-cooled reactor[END_REF][START_REF] Mathews | Functional reliability analysis of safety grade decay heat removal system of Indian 500 MWe PFBR[END_REF]2009].

According to the International Atomic Energy Agency (IAEA) definitions, a passive component does not need external input (especially energy) to operate [IAEA, 1991]. Then, the term "passive" identifies a system which is composed entirely of passive components and structures, or a system, which uses active components in a very limited way to initiate subsequent passive operation. The currently accepted categorization of passive systems, developed by the IAEA, is summarized in Table 1 [IAEA, 1991].

Passive systems are expected to contribute significantly to nuclear safety by combining peculiar characteristics of simplicity, reduction of human interaction and reduction or avoidance of external electrical power and signals input [Nayak et al., 2008a and b;[START_REF] Nayak | Reliability assessment of passive isolation condenser system of AHWR using APSRA methodology[END_REF]. On the other hand, the assessment of the effectiveness of passive systems must include considerations on their reliability; these have to be drawn in the face of lack of data on some underlying phenomena, scarce or null operating experience of these systems over the wide range of conditions encountered during operation and less guaranteed performance as compared to active safety systems [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]Burgazzi, 2007a]. Indeed, although passive systems are credited a higher reliability with respect to active ones, because of the reduced unavailability due to hardware failure and human error, the uncertainties involved in the actual operation of passive systems in the field and their modeling are usually larger than in active systems. Two different sources of uncertainties are usually considered in passive system analysis: randomness due to intrinsic variability in the behavior of the system (aleatory uncertainty) and imprecision due to lack of data on some underlying phenomena (e.g., natural circulation) and to scarce or null operating experience over the wide range of conditions encountered during operation [Apostolakis, 1990;[START_REF] Helton | Alternative representations of epistemic uncertainties[END_REF].

As a consequence of these uncertainties, in practice there is a nonzero probability that the physical phenomena involved in the passive system operation lead to failure of performing the intended safety function even if i) safety margins are present and ii) no hardware failures occur. In fact, deviations in the natural forces and in the conditions of the underlying physical principles from the expected ones can impair the function of the system itself: this event is referred to in the literature as functional failure [Burgazzi, 2003]. The quantification of the probability of this occurrence is an issue of concern both for the "nominal" passive systems (e.g., the ESBWR operating in nominal conditions) [START_REF] Juhn | IAEA activities on passive safety systems and overview of international development[END_REF][START_REF] Rohde | Investigating the ESBWR stability with experimental and numerical tools: a comparative study[END_REF] and the "emergency" passive systems (e.g., accumulators, isolation condensers, etc.) [START_REF] Chung | Passive cooldown performance of a 65MW integral reactor[END_REF]. In the following, the discussion will focus on the latter type of systems.

The occurrence of functional failures is especially critical in type B passive systems, i.e., those involving moving working fluids and referred to as Thermal-Hydraulic (T-H) passive systems (Table 1). The reason lies behind the small driving forces engaging passive operation and the complex and delicate T-H phenomena determining the system performance. For performing their accident prevention and/or mitigation functions, these passive systems rely exclusively on natural forces, e.g. gravity or natural convection, not generated by external power sources. Because the magnitude of the natural forces which drive operation is relatively small, counter-forces (e.g., friction) cannot be ignored because of comparable magnitude. This leads to uncertainty in the actual T-H system performance which must be evaluated by a specific, systematic and rigorous methodology 1 .

In recent years, several methodologies have been proposed in the literature to quantify the probability that nuclear passive systems fail to perform their functions [Burgazzi, 2007b;Zio and Pedroni, 2009a]. A number of methods adopt the system reliability analysis framework. In [START_REF] Aybar | Dynamic probabilistic reliability and safety assessment: an application to IS-BWR[END_REF], a dynamic methodology based on the cell-to-cell mapping technique has been used for the reliability analysis of an inherently safe Boiling Water Reactor (BWR). In [Burgazzi, 2007a], the failure probability is evaluated as the probability of occurrence of different independent failure modes, a priori identified as leading to the violation of the boundary conditions and/or physical mechanisms needed for successful passive system operation. In [Burgazzi, 2002], modeling of the passive system is simplified in terms of the modeling of the unreliabilities of the hardware components of the system: this is done by identifying the hardware components failures that degrade the natural mechanisms which the passive system relies upon and associating the corresponding components unreliabilities. This concept is also at the basis of the Assessment of Passive System ReliAbility (APSRA) approach which has been applied to the reliability analysis of the natural circulation-based Main Heat Transport (MHT) system of an Indian Heavy Water Reactor (HWR) [Nayak et al., 2008a and b;[START_REF] Nayak | Reliability assessment of passive isolation condenser system of AHWR using APSRA methodology[END_REF]. 1 Notice that in the following, the discussion will focus on Type B passive systems, i.e., those involving moving working fluids and referred to as T-H passive systems; thus, the locution "passive system" will implicitly mean "T-H passive system" in the remainder of the paper.

An alternative approach is founded on the introduction of the concept of functional failures, within the reliability physics framework of load-capacity exceedance [Burgazzi, 2003[Burgazzi, , 2007a[Burgazzi, and c, 2008 and 2009]: a passive system fails to perform its function due to deviations from its expected behavior which lead the load imposed on the system to overcome its capacity. In [Woo andLee, 2009a, b and2010;[START_REF] Han | A quantitative evaluation of reliability of passive systems within probabilistic safety assessment framework for VHTR[END_REF], this concept is at the basis of the estimation of the functional failure probability of passive decay heat removal systems of Very High Temperature Reactors (VHTRs). It also provides the basis for the methodologies known as Reliability Evaluation of PAssive Safety (REPAS) systems [D' Auria et al., 2002;[START_REF] Jafari | Reliability evaluation of a natural circulation system[END_REF][START_REF] Zio | The analytic hierarchy process as a systematic approach to the identification of important parameters for the reliability assessment of passive systems[END_REF] and Reliability Methods for Passive Safety (RMPS) functions [START_REF] Marquès | Methodology for the reliability evaluation of a passive system and its integration into a probabilistic safety assessment[END_REF], developed and employed for the analysis of passive Residual Heat Removal Systems (RHRSs) of Light Water Reactors (LWRs). It has also been used to evaluate the failure probabilities of decay heat removal systems in Gas-cooled Fast Reactors (GFRs) [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF][START_REF] Bassi | Reliability assessment of 2400 MWth gas-cooled fast reactor natural circulation decay heat removal in pressurized situations[END_REF][START_REF] Mackay | Incorporating reliability analysis into the design of passive cooling systems with an application to a gas-cooled reactor[END_REF][START_REF] Patalano | Risk-informed design changes in a passive decay heat removal system[END_REF]Zio andPedroni, 2009b, c and2010;[START_REF] Pedroni | Comparison of bootstrapped Artificial Neural Networks and quadratic Response Surfaces for the estimation of the functional failure probability of a thermal-hydraulic passive system[END_REF]Zio et al., 2010], sodium-cooled Fast Breeder Reactors (FBRs) [START_REF] Mathews | Functional reliability analysis of safety grade decay heat removal system of Indian 500 MWe PFBR[END_REF]2009;[START_REF] Arul | Adjoint operator approach to functional reliability analysis of passive fluid dynamical systems[END_REF]2010] and the lead-cooled, fast spectrum Flexible Conversion Ratio Reactor (FCRR) [START_REF] Fong | Reliability analysis of a passive cooling system using a response surface with an application to the flexible conversion ratio reactor[END_REF]. In all these analyses, the passive system is modeled by a detailed, mechanistic T-H system code and the probability of not performing the required function is estimated based on a Monte Carlo (MC) sample of code runs which propagate the epistemic (stateof-knowledge) uncertainties in the model describing the system and the numerical values of its parameters. Because of the existence of these uncertainties, it is possible that even if no hardware failure occurs, the system may not be able to accomplish its mission2 .

The functional failure-based approach provides in principle the most realistic assessment of the T-H passive system, thanks to the flexibility of Monte Carlo simulation which does not suffer from any T-H model complexity and, therefore, does not force to resort to simplifying approximations: for this reason, the functional failure-based approach will be taken here as reference. On the other hand, such approach requires considerable and often prohibitive computational efforts. The reason is twofold. First, a large number of Monte Carlo-sampled T-H model evaluations must generally be carried out for an accurate uncertainty propagation and functional failure probability estimation.

Since the number of simulations required to obtain a given accuracy depends on the magnitude of the failure probability to be estimated, with the computational burden increasing with decreasing functional failure probability [Schueller, 2007 and2009], this poses a significant challenge for the typically quite small (e.g., less than 10 -4 ) probabilities of functional failure of T-H passive safety systems. Second, long calculations (several hours) are typically necessary for each run of the detailed, mechanistic T-H code (one code run is required for each sample of values drawn from the uncertainty distributions) [START_REF] Fong | Reliability analysis of a passive cooling system using a response surface with an application to the flexible conversion ratio reactor[END_REF]Pourgol-Mohamad et al., 2010] 3 .

Finally, notice that for the same reasons a high computational burden is associated also to the sensitivity analysis process, i.e., the identification of the model parameters that contribute the most to the uncertainty in the performance of the passive system and consequently to its functional failure [START_REF] Saltelli | Global sensitivity analysis[END_REF][START_REF] Marrel | Calculations of Sobol indices for the Gaussian process metamodel[END_REF].

Thus, efficient simulation techniques must be sought to perform robust functional failure probability estimation, uncertainty propagation and sensitivity analysis while reducing as much as possible the number of T-H code simulations and the associated computational time.

The objective of the present paper is to show how the computational issues associated to the functional reliability assessment of nuclear passive systems can be effectively handled. Two conceptual directions of computation efficiency are considered: efficient Monte Carlo Simulation techniques for performing robust estimations based on a limited number of samples drawn (i.e., T-H code simulations); fast-running, surrogate regression models (also called response surfaces or metamodels) in replacement of the long-running T-H model codes.

Within this conceptual framework, different computational methods are recommended for efficiently tackling the different phases of the functional reliability assessment of nuclear passive systems: in particular, an optimized Line Sampling (LS) method [Zio and Pedroni, 2010] is recommended for functional failure probability estimation, whereas the use of Subset Simulation (SS) [START_REF] Au | Estimation of small failure probabilities in high dimensions by subset simulation[END_REF]Au and Beck, 2003b] and bootstrapped Artificial Neural Networks (ANNs) [START_REF] Efron | An introduction to the bootstrap[END_REF]Zio, 2006] is suggested for uncertainty propagation and sensitivity analysis.

These recommendations are arrived at on the basis of i) a critical review of the methods available in the literature on the subject and ii) the experience of the authors in nuclear passive systems functional reliability assessments [Zio andPedroni, 2009a-c and2010;[START_REF] Pedroni | Comparison of bootstrapped Artificial Neural Networks and quadratic Response Surfaces for the estimation of the functional failure probability of a thermal-hydraulic passive system[END_REF]Zio et al., 2010].

The remainder of the paper is organized as follows. In Section 2, the main sources and types of uncertainties involved in the operation and modeling of nuclear passive systems are recalled. In Section 3, the reliability analysis of nuclear passive systems is framed in terms of the concept of functional failure. In Section 4, the two conceptual directions considered for reducing the computational burden associated to the reliability assessment of nuclear passive systems (i.e., advanced MCS and empirical regression modeling) are presented and critically analyzed on the basis of a literature review. In Section 5, techniques are recommended to effectively tackle the computational burden associated to the different phases of the reliability assessment; results of the application of the proposed techniques to a case study of literature are also shown. Finally, guidelines and recommendations are summarized in the concluding Section.

Sources and types of uncertainties in the operation and modeling of nuclear passive systems

Uncertainties in the operation and modelling of nuclear passive systems must be accounted for in their reliability evaluations within a Probabilistic Risk Assessment (PRA) framework [Burgazzi, 2004;[START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]Burgazzi, 2007a-c].

To effectively represent and model these uncertainties, it is useful to distinguish two kinds: "aleatory" and "epistemic" [Apostolakis, 1990;[START_REF] Helton | Alternative representations of epistemic uncertainties[END_REF][START_REF] Usnrc | Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making[END_REF]. The former refers to phenomena occurring in a random way: probabilistic modeling offers a sound and efficient way to describe such occurrences. The latter captures the analyst's confidence in the PRA model by quantifying the degree of belief of the analysts on how well it represents the actual system; it is also referred to as state-of-knowledge or subjective uncertainty and can be reduced by gathering information and data to improve the knowledge on the system behavior.

As might be expected, the uncertainties affecting the operation of nuclear passive systems (Table 2) are both of aleatory kind, because of the randomness in the occurrence of some phenomena, and of epistemic nature, because of the limited knowledge on some phenomena and processes and the paucity of the relative operational and experimental data available [Burgazzi, 2007a].

Aleatory uncertainties concern, for instance, the occurrence of an accident scenario, the time to failure of a component or the variation of the actual geometrical dimensions (due to differences between the as-built system and its design upon which the analysis is based) and material properties (affecting the failure modes, e.g. concerning undetected leakages and heat losses) [NUREG-1150[NUREG- , 1990;;Helton, 1998;[START_REF] Usnrc | An approach for using probabilistic risk assessment in riskinformed decisions on plant-specific changes to the licensing basis[END_REF]Burgazzi, 2007a-c]. Two examples of classical probabilistic models used to describe this kind of uncertainties in PRAs are the Poisson model for events randomly occurring in time (e.g., random variations of the operating state of a valve) and the binomial model for events occurring "as the immediate consequence of a challenge" (e.g., failures on demand) [NUREG-CR-6850, 2005]. The effects of these uncertainties are then propagated onto the risk measure, e.g. by Monte Carlo simulation based on Importance Sampling or Stratified Sampling [START_REF] Hofer | An approximate epistemic uncertainty analysis approach in the presence of epistemic and aleatory uncertainties[END_REF][START_REF] Cacuci | A comparative review of sensitivity and uncertainty analysis of large scale systems -II: Statistical methods[END_REF]Krzykacz-Hausmann, 2006]. The contribution of aleatory uncertainty to nuclear passive systems failure is quite clear: for example, natural circulation could be altered by a random disturbance in the system geometry or by a random variation of the operating state of a component [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF].

In the present paper, the representation and propagation of aleatory uncertainties are not considered, the focus being on epistemic uncertainty [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]Bassi and Marques, 2008;Mackay et al., 2008;[START_REF] Mathews | Functional reliability analysis of safety grade decay heat removal system of Indian 500 MWe PFBR[END_REF][START_REF] Patalano | Risk-informed design changes in a passive decay heat removal system[END_REF][START_REF] Arul | Adjoint operator approach to functional reliability analysis of passive fluid dynamical systems[END_REF]2010].

Epistemic uncertainty is associated to the lack of knowledge about the properties and conditions of the phenomena (i.e., natural circulation) underlying the behavior of the passive systems. This uncertainty manifests itself in the model representation of the system behavior, in terms of both (model) uncertainty in the hypotheses assumed and (parameter) uncertainty in the values of the parameters of the model [START_REF] Cacuci | A comparative review of sensitivity and uncertainty analysis of large scale systems -II: Statistical methods[END_REF][START_REF] Helton | Survey on sampling-based methods for uncertainty and sensitivity analysis[END_REF][START_REF] Patalano | Risk-informed design changes in a passive decay heat removal system[END_REF].

Model uncertainty arises because mathematical models are simplified representations of real systems and, therefore, their results may be affected by error or bias. Model uncertainty also includes the fact that the model could be too simplified and therefore would neglect some important phenomena affecting the final result. This latter type of uncertainty is sometimes identified independently from model uncertainty and is known as completeness uncertainty [START_REF] Usnrc | Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making[END_REF]. Model uncertainty may for example involve the correlations adopted to describe the T-H phenomena, which are subject to errors of approximation. Such uncertainties may for example be captured by a multiplicative model [START_REF] Zio | Two methods for the structured assessment of model uncertainty by experts in performance assessment in radioactive waste repositories[END_REF][START_REF] Patalano | Risk-informed design changes in a passive decay heat removal system[END_REF]

: , ) ( ε ⋅ = x c z (1)
where z is the real value of the quantity to be predicted (e.g. heat transfer coefficients, friction factors, Nusselt numbers or thermal conductivity coefficients), c(•) is the mathematical model of the correlation (i.e., the result of the correlation as computed by the T-H code), x is the vector of correlating variables and ε is the associated multiplicative error factor: as a result, the uncertainty in the quantity z to be predicted is translated into an uncertainty in the multiplicative error factor ε.

This error is commonly classified as representing model uncertainty.

Furthermore, uncertainty affects the values of the parameters used to describe the system (e.g., power level, pressure, cooler wall temperature, material conductivity, …), e.g. owing to errors in their measurement or insufficient data and information. For example, according to industry practice and experience, an error of 2% is usually considered in the determination of the power level in a reactor, due to uncertainties in the measurements. As a consequence, the power level is usually known only to a certain level of precision, i.e., epistemic uncertainty is associated with it.

Both model and parameter uncertainties associated to the current state of knowledge of the system can be represented by subjective probability distributions within a Bayesian approach to PRA [Apostolakis, 1990[Apostolakis, , 1995[Apostolakis, and 1999]]. In current PRAs, the effect of these uncertainties is often propagated on the risk measure by Latin Hypercube Sampling (LHS) [START_REF] Helton | Latin hypercube sampling and the propagation of uncertainty in analyses of complex systems[END_REF].

Epistemic uncertainties affect also the identification of the failure criterion to be adopted for the system under analysis: for instance, reactor parameters (e.g., the maximal cladding temperature) as well as passive system variables (e.g., the thermal power exchanged in a cooler) could be equally adopted as indicators of the safety performance of the passive system; furthermore, the failure thresholds may be established as point-targets (e.g., a specific quantity of liquid must be delivered within a fixed time) or time-varying targets or even integral targets over a defined mission time (e.g., the system must reject at least a given value of thermal power during the entire system intervention) [START_REF] Jafari | Reliability evaluation of a natural circulation system[END_REF]Marques et al., 2005].

Finally, state-of-knowledge uncertainty affects the identification of the possible failure modes and related causes and consequences, such as leaks (e.g., from pipes and pools), deposit thickness on components surfaces (e.g., pipes or heat exchangers), presence of non-condensable gases, stresses, blockages and material defects [Burgazzi, 2007a]. The identification of all the relevant modes/causes of failure in terms of critical parameters for the passive system performance/stability and the assessment of the relative uncertainty may be attempted by commonly used hazard identification procedures, like HAZard and OPerability (HAZOP) analysis and Failure Mode and Effect Analysis (FMEA) [Burgazzi, 2004 and2006].

The contribution of epistemic uncertainties to the definition of the reliability/failure probability of nuclear passive systems can be qualitatively explained as follows. If the analyst is not fully confident on the validity of the correlations adopted to estimate, e.g., the design value of the heat transfer coefficient in the core during natural convection (e.g., due to the paucity of experimental data available in support of the use of a particular correlation), he/she admits that in a real accident scenario the actual value of the heat transfer coefficient in the core might deviate from the nominal/design one (i.e., different from the value computed by a deterministic correlation). If this variation (accepted as plausible by the analyst) were to take place during an accident scenario, it may cause the passive system to fail performing its safety function; based on the current state of knowledge of the heat transfer phenomenon in the core under the expected conditions, the likelihood of the heat transfer coefficient variation is to be quantified for estimating the reliability/failure probability. A future improvement in the state of knowledge, e.g. due to the collection of data and information useful to improve the characterization of the heat transfer phenomenon, would lead to a change in the epistemic uncertainty distribution describing the likelihood of the various values of heat transfer coefficient and eventually to a more accurate estimate of the system reliability/failure probability [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]Bassi and Marques, 2008;[START_REF] Mackay | Incorporating reliability analysis into the design of passive cooling systems with an application to a gas-cooled reactor[END_REF][START_REF] Mathews | Functional reliability analysis of safety grade decay heat removal system of Indian 500 MWe PFBR[END_REF]2009;[START_REF] Patalano | Risk-informed design changes in a passive decay heat removal system[END_REF][START_REF] Arul | Adjoint operator approach to functional reliability analysis of passive fluid dynamical systems[END_REF]2010;[START_REF] Fong | Reliability analysis of a passive cooling system using a response surface with an application to the flexible conversion ratio reactor[END_REF].

In the present paper, only epistemic uncertainties are considered in the estimation of the reliability/failure probability of nuclear passive systems [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]Bassi and Marques, 2008;[START_REF] Mackay | Incorporating reliability analysis into the design of passive cooling systems with an application to a gas-cooled reactor[END_REF][START_REF] Mathews | Functional reliability analysis of safety grade decay heat removal system of Indian 500 MWe PFBR[END_REF][START_REF] Patalano | Risk-informed design changes in a passive decay heat removal system[END_REF][START_REF] Arul | Adjoint operator approach to functional reliability analysis of passive fluid dynamical systems[END_REF]2010].

Functional failure analysis of nuclear passive systems

The essential steps for the conceptual development of the functional failure analysis of nuclear passive systems are briefly reported below [START_REF] Marquès | Methodology for the reliability evaluation of a passive system and its integration into a probabilistic safety assessment[END_REF] 4. Estimation of the functional failure probability of the passive system conditional on the current state of knowledge about the phenomena involved (step 2. above) [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]Bassi and Marques, 2008;[START_REF] Mackay | Incorporating reliability analysis into the design of passive cooling systems with an application to a gas-cooled reactor[END_REF][START_REF] Mathews | Functional reliability analysis of safety grade decay heat removal system of Indian 500 MWe PFBR[END_REF]2009;[START_REF] Patalano | Risk-informed design changes in a passive decay heat removal system[END_REF][START_REF] Arul | Adjoint operator approach to functional reliability analysis of passive fluid dynamical systems[END_REF]2010;[START_REF] Fong | Reliability analysis of a passive cooling system using a response surface with an application to the flexible conversion ratio reactor[END_REF]Zio andPedroni, 2009a-c and2010;[START_REF] Pedroni | Comparison of bootstrapped Artificial Neural Networks and quadratic Response Surfaces for the estimation of the functional failure probability of a thermal-hydraulic passive system[END_REF]Zio et al., 2010]. Formally, let Y( x ) be a single-valued scalar variable indicator of the performance of the passive system (e.g., the fuel peak cladding temperature) and α Y a threshold value defining the corresponding failure criterion (e.g., a limit value imposed by regulating authorities)4 . For illustrating purposes, let us assume that the passive system operates as long as Y( x ) < α Y ; equivalently, introducing a variable called Performance Function (PF) as

( ) Y x Y g α - = x x) ( , failure occurs if 0 ) ( > x x g
. The probability P(F) of system functional failure can then be expressed by the multidimensional integral:

( ) ( )

∫∫ ∫ = x x x d q I F P F ) ( ... (2)
where ( ) ⋅ q is the joint Probability Density Function (PDF) representing the uncertainty in the parameters x , F is the failure region (where g x (•) > 0) and I F (·) is an indicator function such that I F (x) = 1, if x ∈ F and I F (x) = 0, otherwise. The MCS procedure for estimating the functional failure probability entails that a large number N T of samples of the values of the system parameters x be drawn from the corresponding probability distributions and used to As is true for uncertainty propagation (step 4. above), sensitivity analysis relies on multiple (e.g., many thousands) evaluations of the code for different combinations of system inputs.

In this work, we propose to tackle the computational burden posed by the uncertainty propagation, failure probability estimation and sensitivity analysis of steps 3. -5. above in two effective ways (Section 4): from one side, efficient Monte Carlo Simulation techniques can be employed to perform robust estimations with a limited number of input samples (Section 4.1); from the other side, fast-running, surrogate regression models (also called response surfaces or meta-models) can be used to replace the long-running T-H model code (Section 4.2).

Handling the computational issues associated to the functional reliability assessment of nuclear passive systems

In this Section, the two approaches considered for dealing with the computational issue associated to the functional reliability assessment of nuclear passive systems are summarized: in Section 4.

Advanced Monte Carlo Simulation methods

As previously stated, the computational issues described in the previous Section 3 can be tackled from one side by resorting to efficient simulation techniques that perform robust estimations with a limited number of input samples, thus with an associated low computational time.

One such technique is the Importance Sampling (IS) method [START_REF] Kalos | Monte Carlo methods[END_REF]Au and Beck, 2003a;Au, 2004;[START_REF] Schueller | A critical appraisal of reliability estimation procedures for high dimensions[END_REF]. This technique amounts to replacing the original Probability Density Function (PDF) of the uncertain variables with an Importance Sampling Distribution (ISD) chosen so as to generate samples that lead to failure more frequently [Au and Beck, 2003a]. IS has the capability of considerably reducing the variance of the estimates compared with standard Monte Carlo Simulation (MCS), provided that the ISD is chosen similar to the theoretical optimal one. In practice, substantial insights on the system behaviour and extensive modelling work may be required to identify a "good" ISD, e.g. by setting up complex kernel density estimators [Au and Beck, 2003a], by identifying the design point of the problem [Au, 2004] or simply by tuning the parameters of the ISD based on expert judgment and trial-and-error [Pagani et al., 2005]. Overall, this increases the effort associated to the simulation; furthermore, there is always the risk that an inappropriate choice of the ISD may lead to worse estimates compared to

Standard MCS [START_REF] Schueller | A critical appraisal of reliability estimation procedures for high dimensions[END_REF].

Another technique is Stratified Sampling. This technique requires dividing the sample space into several non-overlapping subregions (referred to as "strata") and calculating the probability of each subregion; the (stratified) sample is then obtained by randomly sampling a predefined number of outcomes from each stratum [START_REF] Helton | Latin hypercube sampling and the propagation of uncertainty in analyses of complex systems[END_REF][START_REF] Cacuci | A comparative review of sensitivity and uncertainty analysis of large scale systems -II: Statistical methods[END_REF]. By so doing, the full coverage of the sample space is ensured while maintaining the probabilistic character of random sampling. A major issue related to the implementation of Stratified Sampling lies in defining the strata and calculating the associated probabilities, which may require considerable a priori knowledge. As a remark, notice that the widely used event tree techniques in nuclear reactor Probabilistic Risk Assessment (PRA) can be seen as defining and implementing Stratified Sampling of accident events and scenarios [START_REF] Cacuci | A comparative review of sensitivity and uncertainty analysis of large scale systems -II: Statistical methods[END_REF].

A popular compromise between plain random sampling (i.e., standard MCS) and Importance/Stratified Sampling is offered by Latin Hypercube Sampling (LHS), which is commonly used in PRA [Morris, 2000] for efficiently generating random samples [START_REF] Mackay | A comparison of three methods for selecting values of input variables in the analysis of output from a computer code[END_REF][START_REF] Helton | Latin hypercube sampling and the propagation of uncertainty in analyses of complex systems[END_REF][START_REF] Helton | A Comparison of Uncertainty and Sensitivity Analysis Results Obtained with Random and Latin Hypercube Sampling[END_REF][START_REF] Sallaberry | Extension of Latin Hypercube samples with correlated variables[END_REF]. The effectiveness of LHS, and hence its popularity, derives from the fact that it provides a dense stratification over the range of each uncertain variable, with a relatively small sample size, while preserving the desirable probabilistic features of simple random sampling; moreover, there is no necessity to determine strata and strata probabilities like in Stratified Sampling [START_REF] Helton | Latin hypercube sampling and the propagation of uncertainty in analyses of complex systems[END_REF]. For these reasons LHS is frequently adopted for efficiently propagating epistemic uncertainties in PRA problems [NUREG-1150[NUREG- , 1990;;Helton, 1998;[START_REF] Hofer | An approximate epistemic uncertainty analysis approach in the presence of epistemic and aleatory uncertainties[END_REF]Krzykacz-Hausmann, 2006;[START_REF] Helton | Computational implementation of sampling-based approaches to the calculation of expected dose in performance assessments for the proposed high-level radioactive waste repository at Yucca Mountain[END_REF].

On the other hand, LHS is very efficient for estimating mean values and standard deviations in complex reliability problems [START_REF] Olsson | On Latin hypercube sampling for structural reliability analysis[END_REF], but only slightly more efficient than standard MCS for estimating small failure probabilities [START_REF] Pebesma | Latin hypercube sampling of Gaussian random fields[END_REF], like those expected for passive safety systems.

Recently, Subset Simulation (SS) [START_REF] Au | Estimation of small failure probabilities in high dimensions by subset simulation[END_REF]Au and Beck, 2003b] and Line Sampling (LS) [START_REF] Koutsourelakis | Reliability of structures in high dimensions, Part I: algorithms and application[END_REF][START_REF] Pradlwarter | Realistic and efficient reliability estimation for aerospace structures[END_REF] have been proposed as advanced Monte

Carlo Simulation methods for efficiently tackling the multidimensional problems of structural reliability. These methods have proved efficient also in the estimation of the functional failure probability of T-H passive systems [Zio andPedroni, 2009b, c and2010]. Indeed, structural reliability problems are also formulated within a functional failure framework of analysis, in which the systems fail whenever the load applied (i.e., the stress) exceeds their capacity (i.e., the resistance) [START_REF] Schueller | Benchmark study on reliability estimation in higher dimensions of structural systems -An overview[END_REF]. This makes the two methods suitable for application to the functional reliability analysis of nuclear passive systems, where the failure is specified in terms of one or more safety variables (e.g., temperatures, pressures, flow rates, ...) crossing the safety thresholds specified by the regulating authorities [Bassi and Marques, 2008;[START_REF] Mackay | Incorporating reliability analysis into the design of passive cooling systems with an application to a gas-cooled reactor[END_REF][START_REF] Mathews | Functional reliability analysis of safety grade decay heat removal system of Indian 500 MWe PFBR[END_REF][START_REF] Patalano | Risk-informed design changes in a passive decay heat removal system[END_REF].

More specifically, in the SS approach, the functional failure probability is expressed as a product of conditional probabilities of some chosen intermediate and thus more frequent events. The problem of evaluating the small probabilities of functional failures is thus tackled by performing a sequence of simulations of more frequent events in their conditional probability spaces; the necessary conditional samples are generated through successive Markov Chain Monte Carlo (MCMC)

simulations [START_REF] Metropolis | Equations of state calculations by fast computing machines[END_REF], in a way to gradually populate the intermediate conditional regions until the final functional failure region is reached.

In the LS method, lines, instead of random points, are used to probe the failure domain of the highdimensional problem under analysis [START_REF] Pradlwarter | Realistic and efficient reliability estimation for aerospace structures[END_REF]]. An "important direction" is optimally determined to point towards the failure domain of interest and a number of conditional, one-dimensional problems are solved along such direction, in place of the high-dimensional problem [START_REF] Pradlwarter | Realistic and efficient reliability estimation for aerospace structures[END_REF]. The approach has been shown to perform better than standard MCS in a wide range of reliability applications [START_REF] Koutsourelakis | Reliability of structures in high dimensions, Part I: algorithms and application[END_REF][START_REF] Schueller | A critical appraisal of reliability estimation procedures for high dimensions[END_REF][START_REF] Pradlwarter | Realistic and efficient reliability estimation for aerospace structures[END_REF]2007;[START_REF] Schueller | Benchmark study on reliability estimation in higher dimensions of structural systems -An overview[END_REF][START_REF] Lu | Reliability sensitivity method by Line Sampling[END_REF][START_REF] Valdebenito | [END_REF]Zio andPedroni, 2009c and2010]. Furthermore, if the boundaries of the failure domain of interest are not too rough (i.e., almost linear) and the "important direction" is almost perpendicular to them, the variance of the failure probability estimator could be ideally reduced to zero [START_REF] Koutsourelakis | Reliability of structures in high dimensions, Part I: algorithms and application[END_REF] 5 .

In the present paper, particular focus is devoted to SS and LS: for this reason, synthetic descriptions of these techniques and an illustrative application to the functional failure analysis of a T-H passive system are reported in Section 5.

Empirical regression modeling

Another way to tackle the computational issues associated to the reliability analysis of nuclear passive systems is that of resorting to fast-running, surrogate regression models, also called response surfaces or meta-models, to approximate the input/output function implemented in the long-running system model code, and then substitute it in the passive system reliability analysis [START_REF] Storlie | Multiple predictor smooting methods for sensitivity analysis: Description of techniques[END_REF].

The construction of such regression models entails running the system model code a predetermined, reduced number of times (e.g., 50-100) for specified values of the uncertain input variables and collecting the corresponding values of the output of interest; then, statistical techniques are employed for calibrating/adapting the internal parameters/coefficients of the response surface of the regression model in order to fit the input/output data generated in the previous step.

5 Apart from efficient MC techniques, there exist methods based on nonparametric order statistics [Wilks, 1942] that propagate uncertainties through mechanistic T-H codes with reduced computational burden, especially if only one-or two-sided confidence intervals are needed for particular statistics (e.g., the 95 th percentile) of the outputs of the code. For example, the so-called coverage [START_REF] Guba | Statistical aspects of best estimate method-I[END_REF][START_REF] Makai | Best estimate method and safety analysis II[END_REF] and bracketing [START_REF] Nutt | Evaluations of nuclear safety from the outputs of computer codes in the presence of uncertainties[END_REF] approaches can be used to identify the number of sample code runs required to obtain a given confidence level on the estimates of prescribed statistics of the code outputs.

Putting it in a formal framework, let us consider a generic meta-model to be built for performing the task of nonlinear regression, i.e., estimating the nonlinear relationship between a vector of input variables x = {x 1 , x 2 , ..., x j , ..., [Zio, 2006]. It can be assumed that the target vector y is related to the input vector x by an unknown nonlinear deterministic function

( ) { } train p p train N p D ..., , 2 , 1 , , = = y x

( )

x µ y corrupted by a noise vector ( )

x ε , i.e., ( ) ( ) ( ) x ε x µ x y y + = . ( 3
)
As introduced in Section 3, in the present case of T-H passive system functional failure probability assessment the vector x contains the relevant uncertain system parameters/variables, the nonlinear deterministic function

( )

x µ y represents the complex, long-running T-H mechanistic model code (e.g., RELAP5-3D), the vector y(x) contains the output variables of interest for the analysis and the noise ( )

x ε
represents the errors introduced by the numerical methods employed to calculate ( )

x µ y [START_REF] Storlie | Implementation and evaluation of nonparametric regression procedures for sensitivity analysis of computationally demanding models[END_REF]; for simplicity, in the following we assume ( )

x ε
= 0 [START_REF] Secchi | Quantifying uncertainties in the estimation of safety parameters by using bootstrapped artificial neural networks[END_REF].

Thus, the objective of the regression task is to estimate ( ) for example, the Root Mean Squared Error (RMSE) is commonly adopted to this purpose [Zio, 2006].

Several examples can be found in the open literature concerning the application of surrogate metamodels in reliability problems. In [START_REF] Bucher | A comparison of approximate response function in structural reliability analysis[END_REF][START_REF] Gavin | High-order limit state functions in the response surface method for structural reliability analysis[END_REF][START_REF] Liel | Incorporating modeling uncertainties in the assessment of seismic collapse risk of buildings[END_REF],

polynomial Response Surfaces (RSs) are employed to evaluate the failure probability of structural systems; in [START_REF] Arul | Adjoint operator approach to functional reliability analysis of passive fluid dynamical systems[END_REF]2010;[START_REF] Fong | Reliability analysis of a passive cooling system using a response surface with an application to the flexible conversion ratio reactor[END_REF][START_REF] Mathews | Integration of functional reliability analysis with hardware reliability: An application to safety grade decay heat removal system of Indian 500 MWe PFBR[END_REF], linear and quadratic polynomial RSs are employed for performing the reliability analysis of T-H passive systems in advanced nuclear reactors; in [Deng, 2006;Hurtado, 2007;[START_REF] Cardoso | Structural reliability analysis using Monte Carlo simulation and neural networks[END_REF][START_REF] Cheng | A new artificial neural network-based response surface method for structural reliability analysis[END_REF], learning statistical models such as Artificial Neural Networks (ANNs), Radial Basis Functions (RBFs) and Support Vector Machines (SVMs) are trained to provide local approximations of the failure domain in structural reliability problems; in [START_REF] Volkova | Global sensitivity analysis for a numerical model of radionuclide migration from the RRC "Kurchatov Institute" redwaste disposal site[END_REF][START_REF] Marrel | Calculations of Sobol indices for the Gaussian process metamodel[END_REF], Gaussian meta-models are built to calculate global sensitivity indices for a complex hydrogeological model simulating radionuclide transport in groundwater.

However, when using the approximation of the system output provided by an empirical regression model, an additional source of model uncertainty is introduced which needs to be evaluated, particularly in safety critical applications like those related to nuclear power plant technology. In this paper we propose to resort to bootstrapped regression models [START_REF] Efron | An introduction to the bootstrap[END_REF],

i.e., ensembles of regression models, constructed on different data sets bootstrapped from the original one [Zio, 2006;[START_REF] Storlie | Implementation and evaluation of nonparametric regression procedures for sensitivity analysis of computationally demanding models[END_REF]. In fact, the ensemble framework of regression modeling allows quantifying the model uncertainty associated to the estimates provided by the regression models in terms of confidence intervals.

The bootstrap method is a distribution-free inference method which requires no prior knowledge about the distribution function of the underlying population [START_REF] Efron | An introduction to the bootstrap[END_REF]. The basic idea is to generate samples from the observed data by sampling with replacement from the original data set [START_REF] Efron | An introduction to the bootstrap[END_REF]: each of these bootstrapped data sets is used to build a bootstrapped regression model which is used to calculate the reliability quantity of interest (e.g., the passive system failure probability in this case). From the theory and practice of ensembles of empirical models, it can be shown that the estimates given by bootstrapped regression models is in general more accurate than the estimate of the best regression model in the bootstrap ensemble of regression models [Zio, 2006;[START_REF] Cadini | An empirical model based bootstrapped neural networks for computing the maximum fuel cladding temperature in a RBMK-1500 nuclear reactor accident[END_REF].

Some examples of the application of the bootstrap method for the evaluation of the uncertainties associated to the output of regression models in safety-related problems can be found in the literature: in [Zio, 2006], bootstrapped ANNs are trained to predict nuclear transients processes; in [START_REF] Cadini | An empirical model based bootstrapped neural networks for computing the maximum fuel cladding temperature in a RBMK-1500 nuclear reactor accident[END_REF][START_REF] Secchi | Quantifying uncertainties in the estimation of safety parameters by using bootstrapped artificial neural networks[END_REF], the model uncertainty, quantified in terms of a standard deviation, is used to "correct" the ANN output in order to provide conservative estimates for important safety parameters in nuclear reactors (i.e., percentiles of the pellet cladding temperature); finally, in [START_REF] Storlie | Implementation and evaluation of nonparametric regression procedures for sensitivity analysis of computationally demanding models[END_REF], the bootstrap procedure is combined with different regression techniques, e.g. Multivariate Adaptive Regression Spline (MARS), Random Forest (RF) and Gradient Boosting Regression (GBR), to calculate confidence intervals for global sensitivity indices of the computationally demanding model of a nuclear waste repository.

In the present paper, particular emphasis is given to bootstrapped ANN regression models: for this reason, a synthetic description of this technique and an illustrative application to the functional failure analysis of a T-H passive system is reported in Section 5.

Recommendations for reducing the computational burden associated to the functional reliability analysis of nuclear passive systems

In this Section i) the different phases of the functional reliability analysis of nuclear passive systems are considered: in particular, the estimation of the functional failure probability (Section 5.1), the uncertainty propagation (Section 5.2) and sensitivity analysis (Section 5.3) phases; ii) on the basis of the literature review and the considerations made in the previous Section 4, techniques are recommended to efficiently tackle the computational burden associated to each of these analyses;

iii) guidelines on the recommended techniques are provided, with illustrative applications to the functional reliability analysis of a nuclear passive system of literature [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF].

Functional failure probability estimation

If the analyst is only interested in an accurate and precise estimation of the (typically small) functional failure probability of the T-H passive system (modelled by a long-running, nonlinear and non-monotonous T-H code), then the use of the Line Sampling technique is strongly suggested.

In extreme synthesis, the computational steps of the algorithm are [START_REF] Pradlwarter | Realistic and efficient reliability estimation for aerospace structures[END_REF]2007]:

1. From the original multidimensional joint probability density function ( )

) , 0 [ : ∞ → ℜ ⋅ n q , sample N T vectors { } T k N k ..., , 2 , 1 : = x , with { } k n k j k k k x x x x ..., , ..., , , 2 1 = x . 2. Transform the N T sample vectors { } T k N k ..., , 2 , 1 : = x defined in the original (i.e., physical) space into N T samples { } T k N k ..., , 2 , 1 : = θ defined in the so-called "standard normal space",
where each random variable is represented by an independent central unit Gaussian distribution; also the PFs

∑ = ⋅ = T T N k k T N F P N F P 1 , 1 1 ˆD , (4) ( ) [ ] T N F P 2 σ = ( ) ( ) ( ) ( ) ∑ = - ⋅ - T T N k N k D T T F P F P N N 1 2 , 1 1 1 . ( 5
)
The LS method here outlined can significantly reduce the variance (5) of the estimator (4) of the failure probability integral (2) [START_REF] Koutsourelakis | Reliability of structures in high dimensions, Part I: algorithms and application[END_REF]; however, its efficiency depends on the determination of the important direction α (step 3. above).

With respect to this issue, four methods have been proposed in the open literature to estimate the important direction α for LS. In [START_REF] Koutsourelakis | Reliability of structures in high dimensions, Part I: algorithms and application[END_REF], the important unit vector α is computed as the normalized "center of mass" of the failure domain F of interest; in [START_REF] Koutsourelakis | Reliability of structures in high dimensions, Part I: algorithms and application[END_REF][START_REF] Valdebenito | The role of the design point for calculating failure probabilities in view of dimensionality and structural nonlinearities[END_REF], the important unit vector α is taken as pointing in the direction of the "design point" in the standard normal space; in [START_REF] Pradlwarter | Realistic and efficient reliability estimation for aerospace structures[END_REF]], the direction of α is identified as the normalized gradient of the performance function

( ) ⋅ θ g
in the standard normal space; finally, in a previous paper by the authors [Zio and Pedroni, 2010], the important direction α is taken as the one minimizing the variance (5) of the failure probability estimator (4). This latter method produces more accurate and precise failure probability estimates than those provided by the other three techniques of literature and, for this reason, its adoption is recommended for the estimation of the small failure probabilities of T-H passive systems.

In more details, in [Zio and Pedroni, 2010] the optimal important direction opt α for Line Sampling is defined as the one minimizing the variance In mathematical terms, the optimal LS important direction opt α is obtained by solving the following nonlinear constrained minimization problem:

( ) [ ] ( ) [ ] { } ( ) (
).

0 , i.e. to subject min : Find 2 2 2 2 > ∈ = = = θ θ θ θ α θ θ α θ σ σ g F F P F P T T N N opt opt opt (6)
The conceptual steps of the procedure for solving (6) are [Zio and Pedroni, 2010]:

1. An optimization algorithm proposes a candidate solution 2 θ θ α = to (6): for example, probabilistic search algorithms like Genetic Algorithms (GAs) [START_REF] Konak | Multi-objective optimization using genetic algorithms: A tutorial[END_REF][START_REF] Marseguerra | Basics of genetic algorithms optimization for RAMS applications[END_REF] are particularly suitable for multivariate nonlinear problems like those involving nuclear passive safety systems [Zio and Pedroni, 2010].

2. The LS failure probability estimator ( ) T N F P ˆ (4) and the associated variance σ for each proposed solution (step 2. and 3. above); as a consequence, the computational effort associated to this technique would be absolutely prohibitive with a system model code requiring hours or even minutes to run a single simulation. Hence, for practical applicability, one has to resort to a regression model as a fast-running approximator of the original system model code for performing the calculations in steps 2. and 4. above, to make the computational cost acceptable.

The regression model suggested is the classical three-layered feed-forward ANN [Bishop, 1995]. In order to improve the accuracy in the approximation of the system PF g θ (•) (needed for an accurate estimation of the LS important direction α), the employed ANN models can be trained by a properly devised sequential, two-step algorithm based on error back-propagation, as proposed in [Zio and Pedroni, 2010]. In extreme synthesis, a first-step ANN regression model is built using a set of input/output data examples. The resulting ANN model is used (instead of the original, long-running system model code) to provide an approximation to the design point of the problem: this is meant to provide an approximate, rough indication of the real location of the failure domain F of interest.

Subsequently, a new data set is randomly generated centred on the approximate design point previously identified: a second-step ANN model is then constructed on these newly generated data set. This should result in an ANN regression model which is more accurate in proximity of the failure domain F of interest, thus providing reliable estimates of the system PF g θ (•) for the identification of the LS important direction α [Zio and Pedroni, 2010].

For completeness, we report some of the results obtained in a previous work by the authors [Zio and Pedroni, 2010], in which the optimized LS method described above is applied for the estimation of the small functional failure probability P(F) of the passive decay heat removal system of a Gascooled Fast Reactor (GFR) of literature [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF] (notice that in this example P(F) = 3.541•10 -4 ). A detailed description of the system is not reported here for brevity: the interested reader is referred to [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF] for details.

Further, the benefits coming from the use of the proposed method is shown by means of a comparison between the estimation accuracies and precisions of the following simulation methods: i) standard Monte Carlo Simulation (MCS); ii) Latin Hypercube Sampling (LHS) [START_REF] Helton | Latin hypercube sampling and the propagation of uncertainty in analyses of complex systems[END_REF]; iii) standard Importance Sampling (IS) [Au and Beck, 2003a;Au, 2004]; iv) a combination of standard Importance Sampling (IS) and Latin Hypercube Sampling (LHS) (hereafter referred to as IS + LHS) [START_REF] Olsson | On Latin hypercube sampling for structural reliability analysis[END_REF]; v) Subset Simulation (SS) [Au andBeck, 2001 and2003b]; vi) optimized Line Sampling (LS) [Zio and Pedroni, 2010]; vii) a combination of optimized Line Sampling (LS) and Latin Hypercube Sampling (LHS) (hereafter referred to as LS + LHS) [Zio and Pedroni, 2010]. Part of the results used in the comparison are derived from the manipulation of results previously obtained by the authors [Zio andPedroni, 2009b, c and2010].

In order to properly represent the randomness of the probabilistic simulation methods i)-vii) adopted and provide a statistically meaningful comparison between their performances in the estimation of the system failure probability P(F), S = 2000 independent runs of each method have been carried out. In each simulation s = 1, 2, …, S, the percentage relative absolute error ε s between the true (reference) value of the system failure probability P(F) and the corresponding estimate

T N s F P ) ( ˆ obtained with N T samples is computed as follows: 100 ) ( ) ( ) ( ⋅ - = F P F P F P T N s s ε , s = 1, 2, …, S (7)
The accuracies of the simulation methods of interest in the estimation of P(F) are then compared in terms of the mean percentage relative absolute error ε over S = 2000 runs:

∑ = ⋅ = S s s S 1 1 ε ε (8)
The quantity (8) provides a measure of the percentage relative absolute error in the estimation of the failure probability P(F) made on average in a single run by the simulation method with N T samples; obviously, the lower ε , the higher the accuracy of the method.

The failure probability estimates

T N T N F P CI F P CI U L , , , (9)
where Obviously, the lower CI w , the higher the precision of the method.

(
Finally, in addition to the accuracy and precision of the failure probability estimator, also the computational time associated to the simulation method has to be taken into account. To this aim, the FOM can be used:

( ) ( ) ( ) ( ) comp N comp N t F P t F P T T ⋅ ≈ ⋅ = ˆ1 ˆ1 FOM 2 2 σ σ (11)
where comp t is the computational time required by the simulation method and

( ) [ ] T N F P 2 σ is defined in (5). Since ( ) ( ) T N N F P T ∝ 2 σ and approximately T comp N t ∝ , the FOM is independent of N T .
Obviously, the higher the FOM, the higher the computational efficiency of the method.

Table 3 reports the values of the performance indicators ε (8), CI w (10) and FOM (11) obtained with N T = 1850 samples by the simulation methods i)-vii) (notice that since N T is the same for all the simulation methods, performance indicators ε (8) and CI w (10) can be compared fairly). The number of T-H code runs required by each method is also reported: actually, when a single run of the system model code lasts several hours (which is often the case for passive safety systems) the total number of simulations is the critical parameter which determines the overall computational cost (i.e., t comp ) associated to the method. In particular, N c,P(F) is the number of code runs used by the algorithm only to estimate the failure probability P(F); instead, N c,add is the number of additional code runs required to set up the method: for example, for IS and IS + LHS, N c,add code runs are used to build the Importance Sampling Density (ISD) by identification of the "design point" of the problem [Au, 2004]; instead, for LS and LS + LHS, N c,add code runs are used to identify the important direction α by minimization of the variance of the LS failure probability estimator [Zio and Pedroni, 2010].

It can be seen that the optimized Line Sampling methods (i.e., both LS and LS + LHS) provide more accurate and precise failure probability estimates than the other methods: actually, the mean percentage errors ε are about 13 to 380 times lower than those of the other methods, whereas the percentage 95% CI widths CI w are about 16 to 278 times lower than those of the other methods.

Finally, although the computational cost associated to the optimized Line Sampling methods is higher than that of the other methods (because the total number of T-H code runs is more than three times larger), the overall computational efficiency of the method is significantly higher: actually, the FOM is about 2 to 4 orders of magnitude larger than that of the other methods.

The previous example has served to demonstrate that the optimized LS methods indeed provide more accurate and precise failure probability estimates than the other simulation methods considered. However, this must be achieved with a small number of samples (and, thus, of T-H model evaluations: say, few tens or hundreds depending on the application), because in practice the T-H computer codes require several hours to run a single simulation [START_REF] Fong | Reliability analysis of a passive cooling system using a response surface with an application to the flexible conversion ratio reactor[END_REF]. Thus, we consider here a practical situation where the number N c,P(F) of T-H code runs allowed for estimating the small failure probability P(F) = 3.541•10 -4 is set to few tens (e.g., 30 in this case). The results are summarized in Table 4.

It can be seen that even in this case the optimized Line Sampling methods (i.e., both LS and LS + LHS) provide more accurate and precise failure probability estimates than the other methods:

actually, the mean percentage errors ε are about 6 to 44 times lower than those of the other methods, whereas the percentage 95% CI widths CI w are about 6 to 163 times lower than those of the other methods. Finally, the global efficiency of the method is significantly higher: actually, the FOM is about 1 to 3 orders of magnitude larger than that of the other methods.

These results confirm the recommendation of adopting this method.

Uncertainty analysis

The objective of the uncertainty analysis is to propagate the uncertainty associated to the input These recommendations are further explained and motivated below.

parameters x = {x 1 , x 2 , …, x j , …, x ni } through

Uncertainty propagation using Subset Simulation

The idea underlying the Subset Simulation (SS) method is to convert the simulation of an event (e.g., the rare failure event) into a sequence of simulations of intermediate conditional events corresponding to subsets (or subregions) of the uncertain input parameter space (for example, if a passive decay heat removal system in a nuclear reactor is assumed to fail when the fuel peak cladding temperature exceeds 725 °C, then plausible intermediate conditional events could be represented by the peak cladding temperature exceeding 350, 500 and 650 °C, respectively). During simulation, the conditional samples (lying in the intermediate subsets or subregions) are generated by means of properly designed Markov chains; by so doing, the conditional samples gradually populate the successive intermediate subsets (or subregions) up to the target (failure) region [START_REF] Au | Estimation of small failure probabilities in high dimensions by subset simulation[END_REF]Au and Beck, 2003b].

In synthesis, the SS algorithm proceeds as follows. The superior efficiency of SS with respect to standard MCS in the uncertainty propagation task has been widely demonstrated in the open literature: the interested reader may refer to [START_REF] Au | Estimation of small failure probabilities in high dimensions by subset simulation[END_REF]Au and Beck, 2003b] for mathematical details, to [START_REF] Ching | Hybrid subset simulation method for reliability estimation of dynamical systems subject to stochastic excitation[END_REF]Katafygiotis and[START_REF] Katafygiotis | [END_REF]2007;Au, 2007;[START_REF] Au | Compartment fire risk analysis by advanced Monte Carlo simulation[END_REF][START_REF] Pradlwarter | Application of line sampling simulation method to reliability benchmark problems[END_REF] for illustrative applications to high-dimensional (i.e., n ≥ 100) structural reliability problems and to [Zio and Pedroni, 2009b] for an application to the functional failure analysis of a T-H passive system.

For completeness, we report some of the results previously obtained by the authors [Zio and Pedroni, 2009b] in the use of the SS method to propagate the uncertainties through the T-H model of the passive decay heat removal system of a Gas-cooled Fast Reactor (GFR) analyzed in the previous Section 5.1 [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]. Nine uncertain input parameters {x j : j = 1, 2, …, 9} are taken into account and two safety variables {y l : l = 1, 2} (i.e., the hot-and average-channel temperatures of the naturally circulating coolant leaving the core) are considered as outputs of interest of the T-H system model code. The output variables {y l : l = 1, 2} are then used to generate a single-valued system performance indicator (or critical response variable) Y(x) for the evaluation of passive system failure; further details can be found in [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]Zio and Pedroni, 2009b].

The performance of SS is compared to that of LHS: notice that LHS has been chosen as benchmark method due to its popularity and wide use in Probabilistic Risk Assessment (PRA) [START_REF] Helton | Latin hypercube sampling and the propagation of uncertainty in analyses of complex systems[END_REF][START_REF] Sallaberry | Extension of Latin Hypercube samples with correlated variables[END_REF][START_REF] Helton | Computational implementation of sampling-based approaches to the calculation of expected dose in performance assessments for the proposed high-level radioactive waste repository at Yucca Mountain[END_REF]. Following the approach presented in [START_REF] Au | Compartment fire risk analysis by advanced Monte Carlo simulation[END_REF] and subsequently used in [Zio and Pedroni, 2009b], Figure 1 Then, the 99.9 th percentile of the performance function Y(x) of the passive system is estimated by SS with 1850 samples (obtaining 1120.1 °C) and LHS with 1850 (obtaining 1095.3 °C) and 500000 samples (obtaining 1118.9 °C). It can be seen that the estimate of the 99.9 th percentile produced by SS with 1850 samples is very accurate and close to the reference one, i.e., the one computed by LHS with 500000 samples: however, this result is obtained with a computational effort which is 500000/1850 ≈ 270 times lower; on the contrary, the percentile identified by LHS with 1850 samples is much lower than the reference one.

Finally, to assess quantitatively the statistical properties and the precision of the 99.9 th percentile estimates produced by SS with 1850 samples and LHS with 1850 samples, S = 100 independent runs have been carried out for each simulation method and the empirical 95% Confidence Intervals (CIs) of the 99.9 th percentile estimates thereby obtained have been computed: the obtained CIs are [1068.9, 1183.0] and [1012.4, 1242.1] for SS and LHS, respectively. It can be seen that the width of the 95% CI produced by SS is about 2 times lower than that of LHS: thus, conversely, the precision of the estimate is 2 times higher.

As a final remark, it is worth noting that for SS (differently from LS) there does not seem to exist any indication that it is possible to reduce the number of samples (i.e., the number of T-H model code evaluations) to below a few hundreds. Actually, referring to the computational flow of SS described above, at least N = 100 samples have to be generated in each subset F i , i = 1, 2, …, m, to produce reliable estimates in the uncertainty propagation phase: thus, if high quantiles (e.g., the 99.9 th or 99.99 th percentiles) have to be estimated (which is often the case for passive safety systems), then an amount of about N·m = 100·3 = 300 or N·m = 100·4 = 400 samples have to be generated, respectively. As a consequence, if the T-H model requires many hours, or days, to perform a single evaluation, SS is not suitable.

Uncertainty propagation using bootstrapped Artificial Neural Networks

In those cases where the T-H model requires many hours, or days, to perform a single evaluation, the use of fast-running surrogate regression models instead of the long-running original T-H code becomes somewhat mandatory: because calculations with the surrogate model can be performed quickly, the problem of long simulation times is circumvented.

Here, the use of Artificial Neural Networks (ANNs) is recommended for this task. In extreme synthesis, ANNs are computing devices inspired by the function of the nerve cells in the brain [Bishop, 1995]. They are composed of many parallel computing units (called neurons or nodes)

arranged in different layers and interconnected by weighed connections (called synapses). Each of these computing units performs a few simple operations and communicates the results to its neighbouring units. From a mathematical viewpoint, ANNs consist of a set of nonlinear (e.g., sigmoidal) basis functions with adaptable parameters w * that are adjusted by a process of training (on many different input/output data examples), i.e., an iterative process of regression error minimization [START_REF] Rumelhart | Learning internal representations by error back-propagation[END_REF]. ANNs have been demonstrated to be universal approximants of continuous nonlinear functions (under mild mathematical conditions) [Cybenko, 1989], i.e., in principle, an ANN model with a properly selected architecture can be a consistent estimator of any continuous nonlinear function, e.g. any nonlinear T-H code simulating the system of interest.

Further details about ANN regression models are not reported here for brevity; the interested reader may refer to the cited references and the copious literature in the field. The particular type of ANN considered in this paper is the classical three-layered feed-forward ANN trained by the error backpropagation algorithm.

Notice that the recommendation of using ANN regression models is mainly based on i) theoretical considerations about the (mathematically) demonstrated capability of ANN regression models of being universal approximants of continuous nonlinear functions (e.g., any nonlinear T-H code simulating the system of interest) [Cybenko, 1989] and ii) the experience of the authors' in the use of ANN regression models for propagating the uncertainties through T-H model codes simulating passive safety systems [START_REF] Pedroni | Comparison of bootstrapped Artificial Neural Networks and quadratic Response Surfaces for the estimation of the functional failure probability of a thermal-hydraulic passive system[END_REF]Zio et al., 2010]: for example, in [START_REF] Pedroni | Comparison of bootstrapped Artificial Neural Networks and quadratic Response Surfaces for the estimation of the functional failure probability of a thermal-hydraulic passive system[END_REF],

both the accuracy and precision of ANN regression models in estimating the percentiles of the temperature of the naturally circulating coolant in a passive decay heat removal system have been compared and shown to be superior to those of simple quadratic Response Surface (RS) regression models. Since no further comparisons with other types of regression models have been performed by the authors yet, no additional proofs of the superiority of ANNs with respect to other regression models can be provided at present, in general terms.

To evaluate the additional source of model uncertainty introduced by the ANN empirical regression model the use of an ensemble of ANN regression models, constructed on different data sets bootstrapped from the original one is recommended [Zio, 2006;[START_REF] Storlie | Implementation and evaluation of nonparametric regression procedures for sensitivity analysis of computationally demanding models[END_REF]. The bootstrap method is a distribution-free inference method which requires no prior knowledge about the distribution function of the underlying population [START_REF] Efron | An introduction to the bootstrap[END_REF]. The basic idea is to generate a sample from the observed data by sampling with replacement from the original data set [START_REF] Efron | An introduction to the bootstrap[END_REF]: each of these bootstrapped data sets is used to build a bootstrapped regression model which is used to calculate the quantity of interest (e.g., in this case of uncertainty propagation, the quantity of interest may be represented by the vector y of the outputs of the T-H model code, by the performance function of the passive system Y(x) and by their percentiles). In this context, the bootstrap algorithm is used to quantify, in terms of confidence intervals, the model uncertainty associated to the estimates provided by the ANN regression models. Recall also that from the theory and practice of ensemble empirical models, it can be shown that the estimates given by bootstrapped ANN regression models are in general more accurate than the estimate of the best ANN regression model in the bootstrap ensemble of ANN regression models [Zio, 2006;[START_REF] Cadini | An empirical model based bootstrapped neural networks for computing the maximum fuel cladding temperature in a RBMK-1500 nuclear reactor accident[END_REF].

In synthesis, the following steps must be undertaken to perform uncertainty propagation by means of bootstrapped ANNs [Zio, 2006;[START_REF] Storlie | Implementation and evaluation of nonparametric regression procedures for sensitivity analysis of computationally demanding models[END_REF]: 8. Calculate the so-called Bootstrap Bias Corrected (BBC) point estimate BBC Q ˆ for Q (see [START_REF] Baxt | Bootstrapping confidence intervals for clinic input variable effects in a network trained to identify the presence of acute myocardial infarction[END_REF] for details) and the corresponding two-sided Bootstrap Bias

Corrected (BBC)-100•(1 -α)% Confidence Interval (CI) (using the bootstrap-based empirical probability distribution for the quantity Q obtained in step 7. above).

The complete and detailed bootstrap algorithm is not reported here for brevity; some technical details can be found in [START_REF] Efron | An introduction to the bootstrap[END_REF]Zio, 2006;[START_REF] Cadini | An empirical model based bootstrapped neural networks for computing the maximum fuel cladding temperature in a RBMK-1500 nuclear reactor accident[END_REF][START_REF] Secchi | Quantifying uncertainties in the estimation of safety parameters by using bootstrapped artificial neural networks[END_REF][START_REF] Storlie | Implementation and evaluation of nonparametric regression procedures for sensitivity analysis of computationally demanding models[END_REF][START_REF] Pedroni | Comparison of bootstrapped Artificial Neural Networks and quadratic Response Surfaces for the estimation of the functional failure probability of a thermal-hydraulic passive system[END_REF]Zio et al., 2010].

For completeness, we report some of the results obtained in a previous work by the authors [START_REF] Pedroni | Comparison of bootstrapped Artificial Neural Networks and quadratic Response Surfaces for the estimation of the functional failure probability of a thermal-hydraulic passive system[END_REF], in which bootstrapped ANNs are used to propagate the uncertainties through the T-H model of Section 5.1 [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]; again, the performance of bootstrapped ANNs is compared to that of LHS. T-H code runs): this number of samples is largely sufficient for efficiently estimating the CDF even where the cumulative probability ranges between 0.95 and 1: thus, the corresponding results are taken as benchmarks.

The bootstrapped ANNs are shown to be quite reliable and accurate, as the CDF produced is satisfactorily close to the reference one (i.e., the one produced by LHS with N T = N code = 500000 samples) in all the probability ranges considered. Also, the bootstrapped ANN results are obtained at a much lower computational effort: actually, the number N code of T-H code runs (i.e., 110) is about 4500 times lower than that of the reference case (i.e., 500000). The overall CPU time required by the use of bootstrapped ANNs (i.e., on average 2.22 h) is about 180 times lower than that required by the use of the original T-H model code (i.e., on average 409 h).

Further, it can be seen that the bootstrapped ANNs built on seen that the width of the CI produced by bootstrapped ANNs is about 2 times lower than that of LHS: thus, conversely, the precision of the estimate is 2 times higher.

N

Sensitivity analysis

For safety-critical systems, like nuclear passive systems, the task of sensitivity analysis is fundamental for reliability/failure probability assessment and safety decision-making and assurance [START_REF] Helton | Computational implementation of sampling-based approaches to the calculation of expected dose in performance assessments for the proposed high-level radioactive waste repository at Yucca Mountain[END_REF]. In particular, in the functional failure analysis of a T-H passive system, sensitivity analysis can be a useful tool for identifying the uncertain parameters (i.e., the uncertain inputs to the T-H code) that contribute most to the variability of the model outputs (i.e., the coolant outlet temperatures): this information is important for the identification of those parameter and hypothesis uncertainties that are most relevant in determining system failure [START_REF] Saltelli | Global sensitivity analysis[END_REF][START_REF] Volkova | Global sensitivity analysis for a numerical model of radionuclide migration from the RRC "Kurchatov Institute" redwaste disposal site[END_REF][START_REF] Marrel | Calculations of Sobol indices for the Gaussian process metamodel[END_REF].

In general, the sensitivity analysis outcomes provide two important insights. On the one side, the analyst is able to identify those parameters/variables whose epistemic uncertainty plays a major role in determining the functional failure of the T-H passive system: consequently, his/her efforts can be focused on increasing the state-of-knowledge on these important parameters/variables and the related physical phenomena (for example, by the collection of experimental data one may achieve an improvement in the state-of-knowledge on the correlations used to model the heat transfer process in natural convection and a corresponding reduction in the uncertainty); on the opposite side, the analyst can identify those parameters/variables that are not important and may be excluded from the modeling and analysis.

The options recommended for performing sensitivity analysis are the same as those proposed for uncertainty analysis (Section 5.2), as explained below.

Sensitivity analysis using Subset Simulation

The Markov chain samples generated by SS can be used not only for estimating the conditional probabilities but also to infer the probable scenarios that will occur in the case of failure [Au, 2005].

Intuitively, from the comparison of the probability density function ) | ( F x q j of the uncertain parameter x j , j = 1, 2, …, n i , conditional to the occurrence of failure F, with the unconditional probability density function q(x j ), an indication can be obtained on how important is the parameter

x j in affecting the system failure. Formally, for any given value of x j the Bayes' theorem reads,

) ( ) ( ) | ( ) | ( F P x q F x q x F P j j j = , j = 1, 2, …, n i (12) so that ) | ( j x F P is insensitive to x j when ) | ( F x q j ~ ) ( j x q
, i.e. when the conditional probability density function ) | ( F x q j is similar in shape to the PDF q(x j ) [Au and Beck, 2003;Au, 2005;Au et al., 2007]. The effectiveness of this approach for sensitivity analysis has been demonstrated by a number of studies conducted in the field of structural reliability: for example, in [Au and Beck, 2003] and [Au, 2005], the approach has been effectively used to address a 1500-dimensional problem concerning a steel frame subject to stochastic ground motion; in [START_REF] Au | Compartment fire risk analysis by advanced Monte Carlo simulation[END_REF] the method has been applied to perform a compartment fire risk analysis where seven uncertain parameters were considered, whereas in [Zio and Pedroni, 2009b] it has been applied to perform the sensitivity analysis of the model of Section 5.1.

In this latter work, the sensitivity of the passive system performance to the n i = 9 uncertain input parameters has been studied by examining the change of the sample distributions q(x j |F i ), j = 1, 2,

…, n i , i = 1, 2, …, m, at different conditional levels F i , i = 1, 2, …, m.
The histograms of the conditional samples of two of the nine uncertain parameters (i.e., x 2 , the pressure level established in the guard containment after the LOCA, and x 8 , the friction factor in mixed convection) at different conditional levels for a single SS run are shown in Figure 3, left. It can be seen that the performance of the passive system is strongly sensitive to the pressure level established in the guard containment after the LOCA, as indicated by the significant leftward shift of its empirical conditional distribution (histograms) from the unconditional one (solid lines). A slight sensitivity of the passive system performance is also observed with respect to the correlation errors in the friction factor (rightward shift) in mixed convection.

The information contained in the empirical conditional distributions q(x j |F i ), j = 1, 2, …, n i , i = 1, 2, …, m, can then be used to refine the sensitivity information by obtaining the distribution of the system failure probability conditional on the values of the individual uncertain input parameters, i.e.

P(F|x j ), according to (12) (Figure 3, right): this information is relevant because it quantifies how the failure probability P(F) of the passive system would change if the value of the uncertain parameter

x j were set to a given value (e.g., if its epistemic uncertainty were reduced).

Note that SS presents the advantage over other standard techniques of sensitivity analysis, of being directly "embedded" in the computation of the failure probability: the SS algorithm produces the empirical conditional distributions of Figure 3 during the simulation that is performed to compute the functional failure probability of the passive system. In other words, while estimating the functional failure probability of the system, sensitivity analysis results are produced that can be readily visualized for identification and ranking of the most important variables.

Sensitivity analysis using bootstrapped Artificial Neural Networks

Bootstrapped ANNs are used to replace the original T-H code in the multiple (e.g., many thousands) system performance evaluations (for different combinations of system inputs) required by sensitivity analysis; thus, in principle, bootstrapped ANNs could be used in the development of any of the sensitivity analysis methods available in the open literature.

Here we recommend the use of bootstrapped ANNs for computing first-and total-order Sobol sensitivity indices [Sobol, 1993] for the vector y of the outputs of the T-H code and for the passive system performance function Y(x): see [Zio et al., 2010] for a preliminary analysis of this kind.

By definition, the first-order Sobol sensitivity index S j l , j = 1, 2, …, n i , l = 1, 2, …, n o , quantifies the proportion of the variance of the output y l , l = 1, 2, …, n o , that can be attributed to the variance of the uncertain input variable x j alone, i.e., without taking into account interactions with other input variables; on the contrary, the total-order Sobol sensitivity index S Tj l , j = 1, 2, …, n i , l = 1, 2, …, n o , quantifies the proportion of the variance of the output y l , l = 1, 2, …, n o , that can be attributed to the variance of the uncertain input variable x j taking into account the interactions (of all the orders) with all the other input variables. A thorough description of these sensitivity measures goes beyond the scope of this work: mathematical details can be found in [Saltelli, 2002a, b;[START_REF] Saltelli | Global sensitivity analysis[END_REF].

As pointed out in [Saltelli, 2002a], the sensitivity indices S j l and S Tj l have the advantage of being global because the effect of the entire distribution of the parameter whose uncertainty importance is evaluated, is considered; moreover, this sensitivity index is also "model free" because its computation is independent from assumptions about the model form, such as linearity, additivity and so on. The drawback of this approach relies in the computational burden associated to its calculation: actually, thousands or millions of system model evaluations are frequently required for the evaluation of Sobol indices through Monte Carlo-based techniques [Saltelli, 2002a;Saltelli et al., 2008].

For completeness, we complete the results obtained in a previous work by the authors [Zio et al., 2010] (in which bootstrapped ANNs were applied for computing first-order Sobol indices for one of the outputs of the model of Section 5.1) by computing first-and total-order Sobol indices S j Y and S Tj Y for the performance function Y(x) of the model of the T-H passive system of Section 5.1. The algorithm proposed by [Saltelli, 2002a] has been implemented to obtain the "true" (i.e., reference) values of the first-and total-order Sobol sensitivity indices S j Y and S Tj Y for the input variables x j , j = 1, 2, …, 9: these values obtained with N T = 110000 runs of the original T-H model code are reported for reference in Table 5 (in parentheses). Finally, notice that the computational cost associated to the use of bootstrapped ANNs is much lower than that required by the use of the original T-H code: actually, the computational times associated to both analyses have been of 2.12 h and 92 h, respectively, on a Pentium 4 CPU 3.00GHz.

Conclusions

The assessment of the reliability of T-H passive systems is a crucial issue to be resolved for their extensive use in future nuclear power plants. The reliance of T-H passive systems on inherent physical principles makes their reliability evaluation quite difficult to accomplish, if compared to classical system reliability analysis, due to the lack of data which makes current knowledge of passive system operation somewhat poor, thus introducing large uncertainties in the analysis. These uncertainties are both of aleatory and epistemic nature and are mainly due to poor understanding and imprecise modelling of the phenomena affecting the T-H performance of the system and of the relative physical correlations, environmental and boundary conditions used.

These issues may in principle be detrimental for the public acceptance of future reactor designs, which conversely are expected to offer an overall, guaranteed level of safety higher than the one of the currently operating nuclear fleet, especially thanks to the adoption of passive systems.

Thus, there is a strong need for the development and demonstration of consistent methodologies and approaches for T-H passive systems reliability assessment.

As a further step forward in this direction, in this paper the computational issues associated with assessing the reliability of T-H passive systems have been considered. The copious use of expert judgement and subjective assumptions during the assessment process leads to the need of propagating the associated uncertainties by simulating several times the system response under different working conditions: this can be done by Monte Carlo sampling the uncertainties in the system model and parameters, and simulating the corresponding passive system response with a mechanistic T-H computer code. However, this approach requires considerable computational efforts. The reason is twofold. First, a large number of Monte Carlo-sampled T-H model evaluations must generally be carried out for an accurate estimation of the functional failure probability. Since the number of simulations required to obtain a given accuracy depends on the magnitude of the failure probability to be estimated, with the computational burden increasing with decreasing functional failure probability, this poses a significant challenge for the typically quite small (e.g., less than 10 -4 ) probabilities of functional failure of T-H passive safety systems. Second, long calculations (several hours) are typically necessary for each run of the detailed, mechanistic T-H code (one code run is required for each sample of values drawn from the uncertainty distributions).

These computational issues can be tackled in two different ways. From one side, efficient Monte Carlo Simulation techniques can be employed to perform robust estimations with a limited number of input samples; from the other side, fast-running, surrogate regression models (also called response surfaces or meta-models) can be used to replace the long-running T-H model code.

Different approaches have been considered and compared with reference to a case study of literature involving the natural convection cooling in a Gas-cooled Fast Reactor (GFR) after a Loss of Coolant Accident (LOCA) [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF].

On the basis of the results obtained in the present and previous works by the authors [Zio andPedroni, 2009a-c and2010;[START_REF] Pedroni | Comparison of bootstrapped Artificial Neural Networks and quadratic Response Surfaces for the estimation of the functional failure probability of a thermal-hydraulic passive system[END_REF]Zio et al., 2010], the following guidelines and recommendations can be drawn: simulations developed in different subsets of the uncertain input space. This allows producing the PDFs and CDFs of all the T-H code outputs of interest (e.g., peak cladding temperatures, pressures, mass flow rates and so on) in a single simulation run. Moreover, the conditional samples distributions in different subsets of the uncertain input space can be used to study the sensitivity of the passive system performance to the uncertain system input parameters: the informative measure of the importance of a given parameter in determining the failure of the system is the deviation of its conditional distribution from the unconditional one.

On the other hand, differently from the LS method, there does not seem to exist any indication that it is possible to reduce the number of samples (i.e., the number of T-H model code evaluations) to below a few hundreds. Actually, at least one hundred samples have to be generated in each subset to produce reliable failure probability estimates: thus, if the failure probabilities to be estimated are 10 -4 or 10 -5 (which is often the case for passive safety systems), then an amount of 400 or 500 samples have to be generated, respectively. As a consequence, if the T-H model requires many hours, or days, to perform a single evaluation, SS is not suitable; on the other hand, if the T-H model is sufficiently simple and requires seconds or minutes to run, SS may represent the optimal choice. It is worth pointing out that the selection of a surrogate regression model suitable to replace the complex, nonlinear T-H code in the uncertainty propagation process is quite a difficult task: actually, such selection is heavily dependent on the particular application at hand, so that no general rules are available to this aim.

In the present paper, ANN regression models have been recommended on the basis of i) theoretical considerations about the (mathematically) demonstrated capability of ANN regression models of being universal approximants of continuous nonlinear functions (e.g., any nonlinear T-H code simulating the system of interest) [Cybenko, 1989] and ii) the experience of the authors in the use of ANN regression models for propagating the uncertainties through T-H model codes simulating passive safety systems [START_REF] Pedroni | Comparison of bootstrapped Artificial Neural Networks and quadratic Response Surfaces for the estimation of the functional failure probability of a thermal-hydraulic passive system[END_REF]Zio et al., 2010]. However, since no detailed and systematic comparisons with other types of regression models (except for quadratic Response Surfaces [START_REF] Pedroni | Comparison of bootstrapped Artificial Neural Networks and quadratic Response Surfaces for the estimation of the functional failure probability of a thermal-hydraulic passive system[END_REF]) have been performed by the authors yet, no additional proofs of the superiority of ANNs with respect to other regression models can be provided at present. Future research will be devoted to address this issue, although it is arguably optimistic to think that a general statement in this direction can be reached.

Finally, a general remark is in order to drive the reader towards a correct interpretation of the numerical results obtained and of the recommendations drawn in the present paper. Actually, one may interpret that the failure probabilities and sensitivity indices computed by means of the methodologies described and recommended throughout the paper are the failure probabilities and sensitivity indices associated to the "real" T-H passive system under analysis (i.e., those quantities that would characterize the behavior of the T-H passive system in its operation during a real accidental transient). However, in order for this to be true, the T-H code employed in the analyses would need to be flawless and comprehensive of all the relevant failure modes of the real T-H passive system, all aleatory uncertainties would need to be modeled perfectly, and all epistemic uncertainties would need to be well characterized. This is obviously not so and it seems in order to acknowledge that the computational methods described and recommended throughout the paper can "only" do as much, driving the T-H code with its limitations (even if very detailed and extremely demanding to run). In other words, the paper has addressed the quantification of passive system functional reliability "only" from the computational viewpoint, i.e., to the extent that the relevant failure modes are captured in the T-H model code being driven, and to the extent that the input uncertainty distributions are appropriate. Even after consistency checks are run and statistical confidence bounds are established on the results, issues may remain concerning the possibility of "extending" the results obtained in the analyses to the "actual" behavior of the "real" T-H passive system during an accidental transient, because of the model incomplete representation of reality. 11) obtained with N T = 1850 samples by methods i)-vii) in the estimation of the functional failure probability P(F) of the passive system in [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF] Functional failure probability ("True" value, P(F) = 3.

FIGURE CAPTION PAGE

  evaluate Y(x) by running the T-H code. An estimate ( ) can then be computed by dividing the number of times that Y( x ) > α Y by the total number of samples N T . 5. Perform a sensitivity study to determine the contribution of the individual uncertain parameters (i.e., the inputs to the T-H code) {x j : j = 1, 2, …, n i } to the uncertainty in the outputs of the T-H code {y l : l = 1, 2, …, n o } (and in the performance function Y(x) of the passive system) and consequently to the functional failure probability of the T-H passive system.

  a vector of output targets y = {y 1 , y 2 , ..., y l , ..., finite (and possibly small) set of input/output data examples (i.e., patterns),

  by means of a regression function f(x, w * ) depending on a set of parameters w * to be properly determined on the basis of the available data set D train . The algorithm used to calibrate the set of parameters w * is obviously dependent on the nature of the regression model adopted, but in general it aims at minimizing the mean (absolute or quadratic) error between the output targets of the original T-H code, y p = 2, ..., N train , and the output vectors of the regression model, p = 1, 2, ..., N train ;

  normal space[START_REF] Huang | A robust design method using variable transformation and Gauss-Hermite integration[END_REF].3. In the standard normal space, determine a unit vector important unit vector" or "important direction") pointing towards the failure domain F of interest.4. Reduce the problem of computing the high-dimensional failure probability integral (2) to a number of conditional one-dimensional problems, solved along the "important direction" α in the standard normal space: in particular, estimate N T conditional "one-dimensional" 2. Notice that 2•N T or 3•N T system performance analyses (i.e., runs of the T-H model code) have to be carried out to calculate each of the N T conditional one-dimensional failure probability estimates et al., 2005 and 2007 for details).5. Compute the unbiased estimator ( )

  in order to search for a physically meaningful important unit vector opt α (i.e., a vector that optimally points towards the failure domain F of interest), opt θ should belong to the failure domain F of interest, i.e.

  evaluating the system PF g θ (•) (i.e., by running the system model code) in correspondence of θ: 1. -4. are repeated until a predefined stopping criterion is met and the optimization algorithm identifies the optimal unit vector and ii) 2•N T or 3•N T system performance analyses (i.e., runs of the system model code) have to be carried out to calculate the objective function

  = 1, 2, …, S, are then used to build a bootstrapped 95% Confidence Interval (CI) for the failure probability estimator ( )

  and 97.5 th percentiles, respectively, of the bootstrapped empirical distribution of the failure probability estimator ( ) T N F P ˆ. The percentage relative width CI w of the bootstrapped 95% Confidence Interval (CI) of the LS failure probability estimator

  the deterministic, long-running T-H code in order to quantify the uncertainty associated to the output variables y = {y 1 , y 2 , …, y l , …, x no } of interest and to the performance function Y(x) of the passive system (e.g., computing Probability Density Functions-PDFs, Cumulative Distribution Functions-CDFs and percentiles).In all fairness, notice that the strongly recommended LS technique allows only the (efficient) calculation of the failure probability of the passive system, but it does not allow a complete uncertainty propagation: actually, no Probability Density Functions (PDFs), Cumulative Distribution Functions (CDFs) or percentiles of the T-H code outputs of interest can be identified in a single simulation run. Thus, if the analyst is interested in propagating the uncertainty onto the output, two options are recommended:1. in the (unlikely) case that the T-H model is sufficiently simple and requires seconds or minutes to run, the use of the Subset Simulation (SS) algorithm may represent the optimal choice (Section 5.2.1); 2. in those (more realistic) cases where the T-H model requires many hours, or days, to perform a single evaluation, the use of fast-running surrogate regression models (e.g., bootstrapped Artificial Neural Networks-ANNs, in this work) instead of the long-running original T-H code seems mandatory (Section 5.2.2).

  First, N vectors {x 0 k : k = 1, 2, …, N} are sampled by standard MCS, i.e., from the original probability density function q(·). The corresponding values of the response variable {Y(x 0 k ): k = 1, 2, …, N} are then computed and the first threshold value y 1 (identifying the first intermediate conditional event) is chosen as the (1p 0 )N th value in the increasing list of values {Y(x 0 k ): k = 1, 2, …, N}. With this choice of y 1 , there are now p 0 N samples among {x 0 k : k = 1, 2, …, N} whose response Y(x) lies in the intermediate subregion F 1 = {x: Y(x) > y 1 }. Starting from each one of these samples, Markov Chain Monte Carlo (MCMC) simulation is used to generate (1 -p 0 )N additional conditional samples in the intermediate subregion F 1 = {x: Y(x) > y 1 }, so that there are a total of N conditional samples {x 1 k : k = 1, 2, …, N} ∈ F 1 . Then, the intermediate threshold value y 2 is chosen as the (1 -p 0 )N th value in the ascending list of {Y(x 1 k ): k = 1, 2, …, N} to define F 2 = {x: Y(x) > y 2 }. The p 0 N samples lying in F 2 function as 'seeds' for sampling (1 -p 0 )N additional conditional samples lying in F 2 , making up a total of N conditional samples {x 2 k : k = 1, 2, …, N} ∈ F 2 . This procedure is repeated until the samples lying in the intermediate subregion F m-1 = {x: Y(x) > y m-1 } are generated to yield y m > y as the (1 -p 0 )N th value in the ascending list of {Y(x m-1 k ): k = 1, 2, …, N}[START_REF] Au | Estimation of small failure probabilities in high dimensions by subset simulation[END_REF] Au and Beck 2003b; Au, 2005;[START_REF] Au | Compartment fire risk analysis by advanced Monte Carlo simulation[END_REF].

  , left shows the empirical Cumulative Distribution Function (CDF) of the performance function Y(x) of the passive decay heat removal system considered; in addition, Figure 1, right focuses on the portion of CDF where the cumulative probability ranges between 0.999 and 1. The results produced by SS with a total of N T = 1850 samples (i.e., T-H code runs) are shown in solid lines, whereas those produced by LHS with the same number of samples/T-H code runs (i.e., N T = 1850) are shown in dashed lines. The dot-dashed lines correspond to the results obtained by LHS with N T = 500000 samples/T-H code runs: this number of samples is largely sufficient for efficiently estimating the CDF even where the cumulative probability ranges between 0.999 and 1: thus, the corresponding results are taken as benchmarks.Notice that the results from SS are satisfactorily close to the reference solution in all the probability ranges considered. On the contrary, LHS with 1850 samples is not able to produce accurate results for values of the cumulative probability very close to 1 (Figure1, right). This is due to the fact that with 1850 samples there are on average only 1850•(1 -0.999) = 1850·0.001 ~ 2 samples in Figure1, right. In contrast, SS (due to successive conditional MCMC simulations) generates 1850 and 500 conditional samples in Figure1, left and right, respectively, giving enough information for an efficient estimation of the CDF.

1.

  Generate a data set D train of training input/output data examples by sampling a (possibly reduced) number N train of independent input parameters values x p , p = 1, 2, ..., N train , and calculating the corresponding set of N train output vectors y p = µ y (x p ) through the mechanistic T-H system code. 2. Generate a set D val of validation input/output data examples (different from D train ) by sampling a (possibly reduced) number N val of independent input parameters values x p , p = 1, 2, ..., N val , and calculating the corresponding set of N val output vectors y p = µ y (x p ) through the mechanistic T-H system code. 3. Build an ANN regression model f(x, w * ) using the training and validation data sets train D and val D ; in particular, the training data set train D is used to calibrate the internal parameters w * of the regression model, whereas the validation data set val D is used to monitor the accuracy of the ANN model during the training procedure in order to avoid overfitting of the training data according to the so-called early stopping method. In practice, the RMSE is computed on D val at different iterative stages of the training procedure: at the beginning of training, this value decreases as does the RMSE computed on the training set D train ; later in the training, if the ANN regression model starts overfitting the data, the RMSE calculated on the validation set D val starts increasing and training must be stopped [Bishop, 1995]. 4. Measure the accuracy of the constructed regression model constructed in step 3. by computing proper numerical figures (e.g., the commonly adopted coefficient of determination 2 R and RMSE) for each output y l , l = 1, 2, ..., n o , on a new data set N test , purposely generated for testing the regression model built [Marrel et al., 2009], and thus different from those used for training and validation. 5. Use the regression model f(x, w * ), in place of the original T-H model code, to provide a point estimate Q ˆ of the quantity Q of interest (e.g., in this case of uncertainty propagation, the quantity Q may be represented by the vector y of the outputs of the T-H model code, by the performance function of the passive system Y(x) and by their percentiles). 6. Build an ensemble of B (e.g., B = 500-1000) regression models 1, 2, ..., B, generated by performing random sampling with replacement from the original training data set each of the bootstrapped regression models f b (x, w b * ), b = 1, 2, ..., B, to calculate an estimate b Q ˆ, b = 1, 2, ..., B, for the quantity Q of interest: by so doing, a bootstrap-based empirical probability distribution for the quantity Q is produced which is the basis for the construction of the corresponding confidence intervals.

Figure 2 ,

 2 Figure 2, left shows the empirical Cumulative Distribution Function (CDF) of the performance function Y(x) of the passive decay heat removal system considered; in addition, Figure 2, right focuses on the portion of CDF where the cumulative probability ranges between 0.95 and 1. The results obtained with N T = 500000 estimations from B = 1000 by bootstrapped ANNs (built on N code = N train + N val + N test = 80 + 20 + 10 = 110 input/output examples, i.e., T-H code runs) are shown in solid lines, whereas those produced by LHS with the same number of T-H code runs (i.e., N T = N code = 110) are shown in dashed lines. Notice that the comparison between these two approaches is fair because the number N code of runs of the original T-H system model code (and thus the associated overall computational effort) is the same (i.e., N code = 110); however, for LHS the few system model code runs are directly used to produce the CDF of interest, whereas for bootstrapped ANNs they are used to build the regression models, which are in turn employed to produce the CDF estimate. The dot-dashed lines correspond to the results obtained by LHS with N T = N code = 500000 samples (i.e.,

  code = N train + N val + N test = 80 + 20 + 10 = 110 input/output examples (i.e., T-H code runs) outperform LHS with the same number N code = 110 of T-H code simulations: actually, LHS is not able to produce accurate results, in particular for values of the cumulative probability very close to 1 (Figure 2, right). The two approaches are further compared in the estimation of the 95 th percentile of the performance function Y(x) of the passive decay heat removal system. The BBC point estimate of the 95 th percentile of the performance function Y(x) obtained with N T = 500000 estimations from B = 1000 bootstrapped ANNs and with N T = 110 and 500000 estimations from LHS are 802.5 °C, 824.1 °C and 794.2 °C, respectively. It can be seen that the estimate produced by the bootstrapped ANNs is quite close to the reference one, i.e., the one obtained by LHS with 500000 samples: the corresponding percentage Relative Absolute Error (RAE) is 1.04%; on the contrary, the percentile identified by LHS with N T = 110 samples is considerably larger: the corresponding percentage RAE is 3.74%. It can be seen that the percentage RAE produced by the bootstrapped ANNs is 3.6 times lower than that of LHS with N T = 110 samples: thus, conversely, the accuracy of the estimate is 3.6 times higher. Finally, to assess quantitatively the statistical properties and the precision of the 95 th percentile estimates produced by the methods considered, the 95% Confidence Interval (CI) associated to the estimates are evaluated. In particular, S = 1000 independent runs of LHS with N T = N code = 110 samples are carried out and the empirical 95% Confidence Interval (CI) of the 95 th percentile estimate thereby obtained has been computed: it turns out to be [785.6, 868.2]; on the contrary, the BBC 95% CI is produced by B = 1000 bootstrapped ANN regression models constructed on N code = 110 data examples according to steps 1. -8. above: it turns out to be [777.06, 818.92]. It can be

  with N T = 110000 estimations from B = 1000 bootstrapped ANN models built on N code = N train + N val + N test = 80 + 20 + 10 = 110 input/output examples, i.e., T-H code runs; the Table also shows the corresponding Bootstrap Bias Corrected (BBC)-95% Confidence Intervals (CIs): the information conveyed by these intervals is important when few data are used to train the bootstrapped ANNs and the consequent confidence of the analyst on the Sobol index like in the present case. It can be seen that bootstrapped ANNs are quite accurate because the BBC point estimates produced are satisfactorily close to the reference values; moreover, ANNs are sufficiently precise since the BBC 95% CIs are quite narrow around the reference values.

  2. in those (realistic) cases where the T-H model requires many hours, or days, to perform a single evaluation, the use of fast-running surrogate regression models (e.g., ANNs, quadratic RSs, …) instead of the long-running original T-H code seems mandatory. The following procedure is recommended: a. run the T-H system model code a predetermined, reduced number of times (e.g., 50-100) for specified values of the uncertain input variables; b. collect the corresponding values of the output of interest; c. employ statistical techniques for calibrating/adapting the internal parameters/coefficients of the response surface of the regression model in order to fit the input/output data generated in the previous steps; d. use the empirical regression model built at step c. to estimate the quantities of interest: in this paper, the estimation of i) the CDF of the passive system performance function, ii) its 95 th and 99.9 th percentiles and iii) first-and totalorder Sobol sensitivity indices has been illustrated; e. use the bootstrap procedure to quantify, in terms of confidence intervals, the uncertainties associated to the estimates provided by the empirical regression models.

Figure 1 .

 1 Figure1. Empirical CDF of the performance function Y(x) of the passive system in[START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]. Solid lines: SS with N T = 1850 samples; dashed lines: LHS with N T = 1850 samples; dotdashed lines: reference LHS with N T = 500000 samples

  FIGURES

Table 5

 5

	reports also the BBC point estimates Y j S , ˆ	BBC	and Y Tj	BBC

  . estimate the functional failure probability of the T-H passive system by means of Line Sampling with a small number of samples (e.g., few tens); the accuracy and precision of the estimates can be enhanced by combining Line Sampling with Latin Hypercube Sampling.It is worth remarking once more that the LS technique allows only the calculation of the failure probability of the passive system, whereas it does not allow a complete uncertainty propagation.• If the analyst is interested also in the uncertainty propagation (i.e., determination of the PDFs, CDFs, percentiles of the T-H code outputs of interest and so on) and sensitivity analysis, two options are recommended:1. the SS method offers a feasible means because it generates a large amount of conditional (failure) samples by sequential Markov Chain Monte Carlo (MCMC)

	step training algorithm on a reduced number of examples (e.g., around one hundred)
	of the input/output nonlinear relationships underlying the original system model
	code;
	b. use the ANN model as a fast-running surrogate of the original system model code in
	the determination of the LS important direction; the technique recommended for this
	is that based on the minimization of the variance of the LS failure probability
	estimator by means of Genetic Algorithms: the motivation is that since it relies

• If the interest is only in an accurate and precise estimation of the (typically small) functional failure probability of the T-H passive system (modelled by a long-running, nonlinear and non-monotonous T-H code), then the following approach is recommended (Section 5.1): a. build an Artificial Neural Network (ANN) regression model using a sequential, twodirectly on the definition of the optimal LS important direction, it produces more accurate and precise failure probability estimates than those provided by the other techniques proposed in the literature; c

Table 1 .

 1 Categorization of passive systems[IAEA, 1991]

	Functional failure probability ("True" value, P(F) = 3.541•10 -4 )
				Performance indicators (N T = 1850; S = 2000)
	Method	N c,P(F)	N c,add	ε [%]	CI w [%]	FOM
	Standard MCS (i)	N T = 1850	0	101.681	305.874	1.081•10 3
	LHS (ii)	N T = 1850	0	96.652	305.870	1.222•10 3
	IS (iii)	N T = 1850	110	3.803	18.601	6.159•10 5
	IS + LHS (iv)	N T = 1850	110	3.564	17.970	7.121•10 5
	SS (v)	N T = 1850	0	35.760	183.180	6.414•10 3
	LS (vi)	3•N T = 5550	110	0.517	2.322	1.329•10 7
	LS + LHS (vii)	3•N T = 5550	110	0.268	1.102	8.295•10 7

Table 3 .

 3 Values of the performance indicators ε (8), CI w (10) and FOM (

541•10 -4 ) Performance indicators (N c,P(F) = 30; S = 2000) Method N T N c,add ε [%] CI w [%] FOM

	Standard MCS (i)	N c,P(F) = 30	0	206.150	3.943•10 3	911.541
	LHS (ii)	N c,P(F) = 30	0	183.080	3.492•10 3	1.162•10 3
	IS (iii)	N c,P(F) = 30	110	29.049	139.280	1.474•10 5
	IS + LHS (iv)	N c,P(F) = 30	110	27.182	134.170	1.679•10 5
	SS (v)	/	0	/	/	/
	LS (vi)	N c,P(F) /3 = 10	110	7.016	36.278	2.338•10 6
	LS + LHS (vii)	N c,P(F) /3 = 10	110	4.684	24.154	5.029•10 6

Table 4 .

 4 Values of the performance indicators ε (8), CI w (10) and FOM (11) obtained with N c,P(F) = 30 T-H code runs by methods i)-vii) in the estimation of the functional failure probability P(F) of the passive system in[START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]

					Sensitivity analysis using bootstrapped ANNs
					S i	Y			S Ti	Y
	Parameters	S ˆ	Y j,	BBC	("reference")	BBC-95% CI	Y Tj, S ˆ	BBC	("reference")	BBC-95% CI
	x 1	7.6774•10 -3 (8.6372•10 -3 )	[4.751•10 -4 , 8.971•10 -3 ]		0.0113 (0.0121)	[9.001•10 -3 , 0.0195]
	x 2			0.7879 (0.7928)	[0.7792, 0.8158]			(0.8391)	[0.8188, 0.8553]
	x 3			0.0496 (0.0516)	[0.0331, 0.0510]		0.0546 (0.0434)	[0.0391, 0.0570]
	x 4	3.3248•10 -6 (8.4218•10 -6 )	[0, 8.317•10 -5 ]	2.226•10 -3 (3.0575•10 -3 )	[3.231•10 -4 , 4.385•10 -3 ]
	x 5			0.0651 (0.0522)	[0.0583, 0.0767]		0.0711 (0.0833)	[0.0655, 0.0809]
	x 6	1.2317•10 -4 (6.5814•10 -5 )	[0, 3.718•10 -4 ]	2.2169•10 -3 (3.1948•10 -3 )	[3.179•10 -4 , 4.862•10 -3 ]
	x 7	2.4542•10 -5 (6.0669•10 -5 )	[0, 4.239•10 -4 ]	2.2013•10 -3 (3.0618•10 -3 )	[3.447•10 -4 , 4.621•10 -3 ]
	x 8			0.0527 (0.0522)	[0.0500, 0.0677]		0.0827 (0.0832)	[0.0718, 0.0955]
	x 9	1.5848•10 -6 (5.9493•10 -6 )	[0, 8.168•10 -5 ]	2.1968•10 -3 (3.0531•10 -3 )	[3.455•10 -4 , 4.333•10 -3 ]

Table 5 .

 5 Bootstrap Bias Corrected (BBC) point estimates Y

	j S , ˆ	BBC	and	Y Tj	BBC

It is worth mentioning also the work performed by Lee and co-workers who took up the problem of passive system functional reliability assessment focusing on the idea of identifying the limit state function of the system (essentially referring to the generic structural reliability paradigm of load-capacity exceedance described above) as a prelude to the quantification of the functional reliability itself[Aumeier, 1994; Aumeier and Lee, 1993 and 1994;[START_REF] Aumeier | Probabilistic techniques using Monte Carlo Sampling for multi-component system diagnostics[END_REF] 2006; Lee et al., 1993[START_REF] Lee | Simulation-based diagnostics and control for nuclear power plants[END_REF]. However, since the focus of the present paper is on the efficient computation of the passive system functional reliability (given the limit state function of the system and proper input probability distributions representing the uncertainties in the system model and parameters), no further details are given here for brevity; the interested reader is thus referred to the cited references.

For example, the computer code RELAP5-3D, which is used to describe the thermal-hydraulic behavior of nuclear systems, may take up to twenty hours per run in some applications.

Note that the choice of a single-valued performance function does not reduce the generality of the approach, because any multidimensional vector of physical quantities (i.e., the vector y of the outputs of the T-H code in this case) can be conveniently re-expressed as a scalar parameter by resorting to suitable min-max transformations: see[Au andBeck, 2001 and 2003b; Zio and Pedroni, 2009b, c and 2010] for details.

Categories of uncertainties