Piero Baraldi

Irina Crenguţa Popescu

Enrico Zio
email: enrico.zio@polimi.it305

Methods of Uncertainty Analysis in Prognostics

Keywords: Prognostics, reliability prediction, Time to failure prediction, uncertainty representation and propagation, probability, possibility, Monte Carlo simulation, fatigue crack growth NPP Nuclear Power Plant RAMS Reliability, Availability, Maintenance, Safety SSC Structure, System or Component Probability density function S X Uncertain Boolean variable 1

The goal of prognosis on a structure, system or component (SSC) is to predict whether the SSC can perform its function up to the end of its life and in case it cannot, estimate the Time to Failure (TTF), i.e., the lifetime remaining between the present and the instance when it can no longer perform its function. Such prediction on the loss of functionality changes dynamically as time goes by and is typically based on measurements of parameters representative of the SSC state. Uncertainties from two different sources affect the prediction: randomness due to variability inherent in the SSC degradation behavior (aleatory uncertainty) and imprecision due to incomplete knowledge and information on the SSC failure mechanisms (epistemic uncertainty). Such uncertainties must be adequately represented and propagated in order for the prognostic results to have operational significance, e.g. in terms of maintenance and renovation decisions. This work addresses the problem of predicting the reliability and TTF of a SSC, as measurements of parameters representative of its state become available in time. The representation and propagation of the uncertainties associated to the prediction are done alternatively by a pure probabilistic method and an hybrid Monte Carlo and possibilistic method. A case study is considered, regarding a component which is randomly degrading in time according to a stochastic fatigue crack growth model of literature; the maximum level of degradation beyond which failure occurs is affected by epistemic uncertainty.

Prognosis is an important and challenging task in Reliability, Availability, Maintainability and Safety (RAMS). The primary goal of a prognostic system is to indicate whether the structure, system or component (SSC) of interest can perform its function throughout its lifetime with reasonable assurance and, in case it cannot, to estimate its Time To Failure (TTF), i.e. the lifetime remaining before it can no longer perform its function. The prediction is more effective if informed by measurements of parameters representative of the state of the SSC during its life.

The predictive task must adequately account for the uncertainty associated to the future behavior of the SSC under analysis. Sources of uncertainty derive from: (1) randomness due to inherent variability in the SSC degradation behavior (aleatory uncertainty) and ( 2) imprecision due to incomplete knowledge and information on the parameters used to model the degradation and failure processes (epistemic uncertainty).

Two methods for the representation and propagation of these uncertainties are considered in this work: (1) a pure probabilistic method and (2) an hybrid Monte Carlo and possibilistic method. In the context of the pure probabilistic approach, both epistemic and aleatory uncertainties are represented in terms of probability distributions and a double-randomization Monte Carlo simulation is carried out in which epistemic variables are sampled in the outer loop and aleatory variables are sampled in the inner loop, to propagate the uncertainty through the model onto the prediction of the SSC reliability and TTF [START_REF] Rao | Quantification of epistemic and aleatory uncertainties in level-1 probabilistic safety assessment studies[END_REF]. By so doing, the method obtains a different cumulative distribution of the reliability and TTF for each realization of the epistemic variables, thus maintaining separated the two types of uncertainty. In this way, all information on the uncertainty in the TTF is preserved, although its interpretation may not be straightforward in practical terms. Also, a probabilistic representation of the epistemic uncertainty may not be appropriate when sufficient data is not available for statistical analysis, even if one relies on expert judgments within a subjective view of probability [START_REF] Cooper | Hybrid processing of stochastic and subjective uncertainty data[END_REF], [START_REF] Baudrit | Joint propagation and Exploitation of Probabilistic and Possibilistic Information in Risk Assessment[END_REF]. Some of the limitations of the above pure probabilistic approach to uncertainty representation and propagation can be overcome by an hybrid method in which the aleatory uncertainties are properly represented by probability distributions while the epistemic uncertainties are represented by possibility distributions [START_REF] Cooper | Hybrid processing of stochastic and subjective uncertainty data[END_REF], [START_REF] Baudrit | Joint propagation and Exploitation of Probabilistic and Possibilistic Information in Risk Assessment[END_REF]. Monte Carlo sampling of the random variables is repeatedly performed to process the aleatory uncertainty in the behavior of the SSC and possibilistic interval analysis is carried out at each sampling to process the epistemic uncertainty. The method leads to the computation of a possibilistic random distribution representing the SSC reliability or TTF for each considered realization of the aleatory variables. Finally, the obtained possibilistic random distributions can be combined (1) into a set of limiting cumulative distributions characterized by different degrees of confidence [START_REF] Cooper | Hybrid processing of stochastic and subjective uncertainty data[END_REF] or [START_REF] Cooper | Hybrid processing of stochastic and subjective uncertainty data[END_REF] accordingly to the Dempster-Shafer Theory, into Belief and Plausibility measures that can be interpreted as "rational averages" of the above mentioned limiting cumulative distributions [START_REF] Baudrit | Joint propagation and Exploitation of Probabilistic and Possibilistic Information in Risk Assessment[END_REF].

For exemplification, the prognostics is carried out with reference to a case study regarding a component which is randomly degrading in time according to a stochastic fatigue crack growth model of literature [START_REF] Myotyri | Application of stochastic filtering for lifetime prediction[END_REF]. This degradation process is typical of, for example, components in the pressure boundaries of a nuclear power plant (NPP) [START_REF] Jeong | Environmental fatigue crack propagation behavior of cast stainless steels under PWR condition[END_REF] and may initiate from the foundry flaws which are always present in large cast components subject to fatigue loading caused by allowed power variations or incidental transients; once initiated, the degradation process can propagate under stressful operating conditions, up to limits threatening the components' structural integrity [START_REF] Mustapa | Influence of R-ratio on fatigue crack growth rate behavior of type 316 stainless steel[END_REF]. The prediction of the reliability and remaining useful lifetime of the component is based on the knowledge of the value of a degradation parameter that is assumed to be measured at the present time. If the process is such to lead its value above a given limit, then the SSC fails. The maximum level of degradation beyond which structural integrity is lost is considered to be affected by epistemic uncertainty.

The paper is organized as follows. Section 2 recalls the probabilistic and the possibilistic viewpoints for to the representation of epistemic uncertainty; little detail is given on the well known probabilistic view and its difficulty in representing epistemic uncertainty in cases of limited knowledge and information, whereas relatively more details are provided to illustrate the possibilistic view. In Section 3, the pure probabilistic method and the hybrid Monte Carlo and possibilistic method for uncertainty propagation are resumed. The case study of fatigue crack propagation is presented in Section 4 and the corresponding prognostic results are reported and commented in Section 5. Finally, some conclusions on the advantages and limitations of the two methods of uncertainty treatment are given in Section 6.

Representing uncertainty in prognostic tasks

When modeling the degradation and failure behavior of an SSC, uncertainty can be considered essentially of two different types: randomness due to inherent variability in the physical behavior and imprecision due to lack of knowledge and information on it. The former type of uncertainty is often referred to as objective, aleatory, stochastic whereas the latter is often referred to as subjective, epistemic, state-of-knowledge [START_REF] Apostolakis | The Concept of Probability in Safety Assessments of Technological Systems[END_REF], [START_REF] Helton | Alternative Representations of Epistemic Uncertainty[END_REF].

The distinction between aleatory and epistemic uncertainty plays a relevant role in prognostics. The aleatory uncertainty affects the time evolution of the degradation process of the SSC, whereas epistemic uncertainty arises from incomplete knowledge of fixed but poorly known parameter values which enter the models used for the evaluation of the SSC reliability and remaining useful lifetime.

While the aleatory uncertainty is appropriately represented by probability distributions, current scientific discussions dispute the advantages and disadvantages of two possible representations of the epistemic uncertainty, probabilistic and possibilistic [START_REF] Rao | Quantification of epistemic and aleatory uncertainties in level-1 probabilistic safety assessment studies[END_REF], [START_REF] Baudrit | Joint propagation and Exploitation of Probabilistic and Possibilistic Information in Risk Assessment[END_REF].

Probabilistic representation of the epistemic uncertainty

In the current RAMS practice, epistemic uncertainty is often represented by means of probability distributions as is done for aleatory uncertainty. When sufficient data is not available for statistical analysis, one may adopt a subjective view of probability based on expert judgment. For example, in risk assessments and RAMS analyses it is common practice to represent by means of lognormal distributions the epistemic uncertainty on the parameters of the probability distributions of the TTF and time to repair (TTR) of a component [START_REF] Rao | Quantification of epistemic and aleatory uncertainties in level-1 probabilistic safety assessment studies[END_REF].

However, there might be some limitations to the probabilistic representation of epistemic uncertainty under limited knowledge. Let us consider, for example, an extreme case in which the available information on a model parameter x is only that its value is located somewhere between a value min x and a value max x . In this case, a uniform probability distribution between min x and max

x ,   max min 1/( ) p x x x  ,   min max , x x x 
is typically assumed to represent the uncertainty on x within a probabilistic scheme [START_REF] Helton | Alternative Representations of Epistemic Uncertainty[END_REF]. This choice of the uniform distribution appeals to i) Laplace principle of insufficient reason according to which all that is equally plausible is equally probable and to ii) the maximum entropy approach [START_REF] Gzyl | The Method of Maximum Entropy[END_REF]. On the other hand, it may be criticizable since the uniform distribution implies that the degrees of probability of the different values of x depend on the equal range min max , X x x    . Further, the uniform distribution results in the following relationship [START_REF] Helton | Alternative Representations of Epistemic Uncertainty[END_REF]: From the above considerations, it seems that lack of knowledge may not be satisfactorily represented by specific functional choices of probability distributions, like the uniform, but it should somehow be expressed in terms of the full set of possible probability distributions on X so that the probability of a value xX  is allowed to take any value in   0, 1 .

    min max Pr , Pr , mean mean x x x x x x            (1)

Possibilistic representation of the epistemic uncertainty

Due to the potential limitations associated to a probabilistic representation of epistemic uncertainty under limited information, a number of alternative representation frameworks have emerged, e.g. fuzzy set theory [START_REF] Klir | Fuzzy Sets and Fuzzy Logic: Theory and Applications[END_REF], evidence theory [START_REF] Shafer | A Mathematical Theory of Evidence[END_REF], possibility theory [START_REF] Dubois | Possibility Theory: An Approach to Computerized Processing of Uncertainty[END_REF], interval analysis [START_REF] Moore | Methods and Applications of Interval Analysis[END_REF] and imprecise probability [START_REF] Walley | Statistical Reasoning with Imprecise Probabilities[END_REF]. Possibility theory, in particular, is attractive for the prognostic task here of interest, because of its representation power and relative mathematical simplicity. It is similar to probability theory in that it is based on set functions but differs in that it relies on two cumulative functions, called possibility    and necessity   N measures, instead of only one, to represent the uncertainty. The basic notion upon which the theory is founded is the possibility distribution of an uncertain variable (not necessarily random) which assigns to each real number x in a range X (Universe of Discourse, UOD) a degree of possibility    

0,1 x  
of being the correct value [START_REF] Dubois | Possibility Theory and Statistical Reasoning[END_REF]. A possibility distribution is thus an upper, semi-continuous mapping from the real line to the unit interval describing what an analyst knows about the more or less plausible values x of the uncertain variable ranging on .

X These values are mutually exclusive, since the uncertain variable can take on only one true value. This also gives the normalization condition:

  :1 x X x     (2)
which is a claim that at least one value is viewed as totally possible, a much weaker statement than   1 px .

The possibility and necessity measures

  A  ,

 

NA for all subsets A in the power set   PX of X are defined by the associated possibility distribution  

x  through the following maximization and minimization relationships, respectively:

    sup xA Ax    (3)         1 inf 1 xA N A A x        (4)
The relation between the possibility distribution   NA means that A is certainly true and it implies that   A unimodal numerical possibility distribution may also be viewed as a set of nested confidence intervals A  , which are the cuts   of  

x  [START_REF] Baudrit | Joint propagation and Exploitation of Probabilistic and Possibilistic Information in Risk Assessment[END_REF]. The degree of certainty that , aa     contains the value of the uncertain variable is  

, N a a     , which is equal to 1   if   x  is continuous. Furthermore, the family of nested confidence intervals       1 1 2 2
, , , , , ,

mm A A A      , where   ii NA  
, can be reconstructed from the possibility distribution  

x  [START_REF] Dubois | Possibility Theory and Statistical Reasoning[END_REF].

Under this view, a pair   , A  supplied by an expert is interpreted as stating that the subjective probability   pA is at least equal to  [15]. In particular, the Thus, we can interpret any pair of dual necessity/possibility functions as lower and upper probabilities induced from specific probability families: degrees of necessity are equated to lower probability bounds and degrees of possibility to upper probability bounds.

Formally, let  be a possibility distribution inducing a pair of necessity/possibility functions   , N  . The probability family   P  is defined as [START_REF] Dubois | When Upper Probabilities are Possibility Measures[END_REF]:

              P , measurable : , measurable : p A N A p A p A p A A         (5)
In this case, the probability family  

i i i p A p A     (8)
In this view, given a continuous uncertain variable x , it is possible to interpret

  , Nx  and   , x  
as the lower and upper limiting cumulative distributions   Fx and   Fx, respectively [START_REF] Dubois | When Upper Probabilities are Possibility Measures[END_REF].

To exemplify a case in which a possibilistic representation of the epistemic uncertainty may be useful, let us consider an uncertain parameter x for whose definition we know that the parameter can take values only in the range   0.8,1.2 and the most likely value is 1 [START_REF] Mauris | Fuzzy Modeling of Measurement Data Acquired from Physical Sensors[END_REF]. This case can be represented by the triangular possibility distribution reported in Figure 1(a) where to the most likely value is assigned a level of possibility equal to one while the certain interval   0.8,1.2 is the "support" of the possibility distribution, implying that values located outside the interval are considered impossible. Finally, let us return to the same case of "ignorance" discussed from a probabilistic point of view in the previous Section 2.1, and consider an uncertain model parameter x for which the only available information is that its true value is located between min x and max x . Within the possibilistic framework, the uncertainty on x is represented by a possibility distribution

  1 x   ,   min max , x x x  and   0 x   , otherwise. Such
distribution simply describes the fact that any value

  min max , x x x  is possible and for any set   A P X  with AX  ,   0 NA while   1 A  .
Moreover, according to the interpretation of eq. ( 4), for any set

  min max , A x x  the only information available is that   01 PA  .
From this example, it seems that imprecision or partial information can be adequately described in terms of possibility distributions representing families of probability distributions [START_REF] Dubois | Possibility Theory and Statistical Reasoning[END_REF]. Actually, the connection between the possibility and probability theories could be very powerful in providing an integrated framework of representation and analysis of uncertainties of both the aleatory and epistemic type [START_REF] Baudrit | Joint propagation and Exploitation of Probabilistic and Possibilistic Information in Risk Assessment[END_REF].

Transformation from a possibilistic distribution to a probabilistic distribution

For the purposes of comparing probability and possibility representations of uncertainty, it is useful to consider a method for transforming a possibility distribution into a probability distribution. Obviously, it remains that the probabilistic and the possibilistic representations of uncertainty are not equivalent: the possibilistic representation is weaker than the probabilistic one because it explicitly handles imprecision (e.g. incomplete knowledge) and because its measures are based on an ordinal structure rather than an additive one [START_REF] Dubois | Probability-Possibility Transformations, Triangular Fuzzy Sets, and Probabilistic Inequalities[END_REF]. Remembering this, given that a possibility measure encodes a family of probability measures, the transformation aims at finding the probability measure which preserves as much as possible of the uncertainty in the original possibility distribution.

Considering the possibility distribution ) (x

 on ] , [ max min x x X 
, its transformation into the corresponding probability distribution ) (x p according to [START_REF] Dubois | On possibility/probability transformations[END_REF] is:

    0 x d px A      min max , x x x    (9)
where A  is the width of the

  A cut  , i.e. if , A a a      then A a a    .
Indeed, selecting  in   0,1 is done with infinitesimal probability d and yields to the uniform density p  such that

  1/ p x A   . For xA   the infinitesimal probability of x in A  is thus equal to / dx d A    [18].
For instance, if the possibility-probability transformation is applied to the triangular possibility distribution of Figure 1(a) with support  

1, 1  and modal value 0, then the

probability density function     1/ 2 p x Log x 
is obtained [START_REF] Dubois | On possibility/probability transformations[END_REF], [START_REF] Chanas | Single value simulation of fuzzy variable[END_REF].

Uncertainty propagation

Uncertainty in the input variables and parameters of a model must be adequately propagated to the output, to provide the relevant representation of its uncertainty.

Let us consider a model whose output is a function  

f  of n uncertain variables , 1, , j Y j n 
, of which the first k are affected by aleatory uncertainty and the last nk  are affected by epistemic uncertainty. This Section briefly presents two methods for the propagation of such a mixed uncertain information: (1) a purely probabilistic method and (2) an hybrid Monte Carlo -Possibilistic method.

The Purely Probabilistic Method of Uncertainty Propagation

The uncertainty affecting both the aleatory variables Notice that the purely probabilistic method keeps separated the two types of uncertainty: the aleatory uncertainty is captured in the slope of the obtained cumulative distributions of u , the epistemic one is contained in the spectrum of different cumulative distributions of u . On the other hand, the interpretation of the set of cumulative distributions obtained may not be straightforward in practical terms given the difficulty of extracting concise information on the output uncertainty from such a representation. In this respect a possible way to represent the epistemic uncertainty is to fix a given percentile of the cumulative distributions   1 ,..., e e e i i i kn F u y y  , i.e. 95%, and then build the probabilistic distribution of this percentile from the different realizations of the epistemic variables.

  , , , 11 ,.

An hybrid Monte Carlo and possibilistic method for uncertainty propagation

The hybrid Monte Carlo and possibilistic method for uncertainty propagation considers that the uncertainty on the measuring the degree of possibility that the linguistic variables j Y be equal to y. For the propagation of such mixed uncertainty information, the Monte Carlo technique [START_REF] Kalos | Monte Carlo methods[END_REF] can be combined with the possibility theory [START_REF] Zadeh | Fuzzy Sets[END_REF] by means of the following two main steps [START_REF] Baudrit | Joint propagation and Exploitation of Probabilistic and Possibilistic Information in Risk Assessment[END_REF]: i. repeated Monte Carlo sampling of the random variables to process aleatory uncertainty; are combined to give an estimate of () fY as a random possibility distribution in the sense of [START_REF] Gil | Special Issue on Fuzzy Random Variables[END_REF].

The operative steps of the procedure are (Figure 2

The joint aggregation method

First of all, for each set

  A P X  ,

 

Bel A and the plausibility () Pl A measures by using, respectively [3]:

    aa a f ii i Bel A p N A   (10)     aa a f ii i Pl A p A   (11)
        , F u Bel f Y u    ,         , F u Pl f Y u 
  can then be computed [START_REF] Baudrit | Joint propagation and Exploitation of Probabilistic and Possibilistic Information in Risk Assessment[END_REF]. Let the core and the support of a possibilistic distribution ()

f u 
be the crisp sets of all points of X such that ()

f u
 is, respectively, equal to 1 and non zero.

      ,1 Pl f Y u    if and only if       , 1, 1, , f i f Y u i m       , i.e. for       * max inf f ii u u core   .
Similarly,

      ,0 Pl f Y u    if and only if       , f i f Y u    0, 1, , im    , i.e. for       * min inf f ii u u support   .

The Ferson aggregation method

In [START_REF] Cooper | Hybrid processing of stochastic and subjective uncertainty data[END_REF], a different technique for the aggregation of the random possibility distributions 1 ,..., a ff m  obtained in Section 3.2.1 is proposed.

The procedure, called Ferson aggregation method, follows the next steps [START_REF] Cooper | Hybrid processing of stochastic and subjective uncertainty data[END_REF], [START_REF] Baudrit | Joint propagation and Exploitation of Probabilistic and Possibilistic Information in Risk Assessment[END_REF]:

(1) Select a possibility value  and consider the corresponding

cut   , a a a i i i A f f        of the possibility distribution   a f i u  . (2) Define a new possibility distribution   a i u   :     1 if 0 otherwise a a a i i i u u A u             (12)
(3) Compute the possibility and the necessity measures associated to From a practical point of view, this is equivalent to computing the possibility and the necessity measures as:

    1, if , 0, otherwise a a i i uf u            (13)     1, if , 0, otherwise a a i i uf Nu           (14)
(4) Repeat steps 1-3 for all 1,..., aa im  and finally compute an upper ( F  ) and a lower ( F  ) cumulative distributions for the  -cut chosen at step 1:

      , ai a a i i F u p u       (15)       , aa a ii i F u p N u      (16)
Notice that since 10 aaa iii AAA   then:

            1 0 ,,, aaa iii uuu          (17)             10 , , ,
a a a i i i N u N u N u       (18)
and thus: F  represents the imprecision due to epistemic variables; the slopes of F  and F  characterize the variability of the results caused by the aleatory uncertainty. A confident user who assumes high precision would work with the cores of the fuzzy intervals ( 1 cut   ), whereas a cautious one may choose 0 cut   to work with their supports.

      10 aaa iii F u F u F u   (19)       10 aaa iii F u F u F u   (
For a comparison between the Ferson and the joint aggregation methods (Section 3.2.1), consider that the latter produces upper and lower cumulative distributions which span the ranges between 0 F and 1 F and between 0 F and 1 F , respectively:

        10 , F u Pl u F u    (21)
        01 , F u Bel u F u    (22)
In particular, in [START_REF] Dubois | The mean value of a fuzzy number[END_REF] it is demonstrated that the plausibility and belief measures obtained by the joint aggregation method are the mean values of the upper and lower boundary cumulative distributions of the Ferson method, respectively:

      1 0 , Pl u F u d      (23)       1 0 , Bel u F u d      (24)
Finally notice that also the Ferson method treats aleatory and epistemic uncertainties separately as does the purely probabilistic method (Section 3.1). Nevertheless, it uses a probabilistic representation for the aleatory uncertainty and a possibilistic representation for the epistemic uncertainty.

Case study

Let us consider the process of crack growth in a component subject to fatigue. The common Paris-Erdogan model is adopted for describing the evolution of the crack depth h as a function of the load cycles L [24]:

() dh CK dL   (25)
where C and  are constants related to the material properties [25], [26], which can be estimated from experimental data [START_REF] Bigerelle | Bootstrap Analysis of FCGR, Application to the Paris Relationship and to Lifetime Prediction[END_REF] and K  is the stress intensity amplitude, roughly proportional to the square root of h [26]:

Kh   ( 26
)
where  is again a constant which may be determined from experimental data.

The intrinsic stochasticity of the process may be inserted in the model by modifying eq. ( 26) as follows [START_REF] Provan | Probabilistic fracture mechanics and reliability[END_REF]:

() dh e C h dL    ( 27
)
where 2 ~(0, ) N   is a white Gaussian noise. For L  sufficiently small, the state-space model (30) can be discretized to give:

1 () k kk h h e C K L        (28
) which represents a non-linear Markov process with independent, non-stationary degradation increments.

This degradation process is typical of, for example, components in the pressure boundaries of a nuclear power plant [START_REF] Jeong | Environmental fatigue crack propagation behavior of cast stainless steels under PWR condition[END_REF] and may initiate from the foundry flaws which are always present in large cast components subject to fatigue loading caused by allowed power variations or incidental transients; once initiated, the degradation process can propagate under stressful operating conditions, up to limits threatening the components' structural integrity [START_REF] Mustapa | Influence of R-ratio on fatigue crack growth rate behavior of type 316 stainless steel[END_REF].

In this work, it is assumed that the level of degradation affecting the component is indicated by the crack depth . h At each time step, the degradation level can either remain constant or be incremented according to eq. ( 28). The probability d p that the component degrades between two successive time instants is assumed to be known.

The component is designed to accomplish its function for a certain time window, called mission time miss T and it is considered failed when the value of the degradation exceeds a certain threshold, max H . With respect to the degradation threshold max H , its value is affected by epistemic uncertainty due to limited information: according to an expert, max H lies between 9 and 11 with a most likely value of 10, in arbitrary units. Table 1 reports the values of the parameters defining the degradation process considered in this work. , most likely value = 10

Prognostic Results

In this Section, the methods for uncertainty representation and propagation described in Section 3 are applied to the case study introduced in Section 4 to address the associated prognostic task of predicting the component performance during the mission time. The problem of estimating the component reliability, i.e. the probability that the component survives until the mission time, is firstly addressed in Section 5.1. Then, in Section 5.2, the problem of estimating the TTF, i.e. the remaining lifetime from the present instant until the component fails, is considered. Both estimations are performed assuming that at the present time p t a measurement of the current degradation level is available: this is given by the crack depth   p ht . The results that follow refer to the case   11 h  , in arbitrary units.

Reliability estimation

Let us introduce an uncertain Boolean variable S X indicating the state of the component at the mission time by 0 (failure) and 1 (success). Such variable depends on the crack depth at the mission time   miss hT

, which is affected by aleatory uncertainty, and on the failure threshold max H , which is affected by epistemic uncertainty:

  max max 1 if ( ( ), ) 0 otherwise miss S miss h T H X f h T H        (29)
Assuming that no repairs are allowed on the component, the objective is to estimate the component reliability, i.e. the probability that the component has not failed prior to the mission time, i.e.   1 S pX  .

Application of the hybrid Monte Carlo-possibilistic method

Following the example of Section 2.2, the epistemic uncertainty associated to the available scarce information on the value of the threshold max  obtained for the four simulated degradation evolutions of Figure 4: the realization 1 (fourth row in Figure 5) ends with   13.74 miss hT  and thus corresponds to a failed component independently from the considered cut   of max H ; this leads to a possibility distribution equal to a singleton in 0; -in the simulation of the second and third realizations (second and third rows of Figure 4), the state at the mission time depends on the considered cut   of max H ; in particular, for small  the state is uncertain as represented by a possibility larger than 0 of both success and failure, while for large values of  the state is of failure in the second realization simulation and success in the third one, which end with   According to the joint aggregation method (Section 3.2.1), the believe and plausibility are computed by simple averaging of the necessity N and possibility  measures (Figure 5 simulated degradation processes (last row of Figure 6). Notice that the limiting interval for the probability of 0

S X  is     0 , 0 FF  
and thus the limiting interval for the probability of 1

S X  is     1 0 ,1 0 FF    .
Applying the Ferson aggregation method to all

 

0.912, 0.916 .

Application of the purely probabilistic method

For applying the purely probabilistic method, firstly the probability distribution describing the epistemic uncertainty on For the interpretation of the results, it is possible to choose a level of confidence

Comparison of the results

Let us first compare the representation of the available uncertain information given by the probabilistic and possibilistic methods. allows us to consider all the possible cumulative distributions lying between the believe and the plausibility measures of the set

  0, Au 
, the probabilistic representation forces us to consider only one specific cumulative distribution, albeit conservatively the one containing as much uncertainty as possible (thanks to the transformation of Section 2.3). In this application characterized by a rather limited available information on the value of max H , the probabilistic density function tends for this reason to force information in the representation.

With respect to the uncertainty propagation and representation techniques, notice that both the purely probabilistic and the Ferson methods keep separate the epistemic uncertainty from the aleatory uncertainty whereas the hybrid aggregation method merges them. From a practical point of view, the interpretation of the results obtained by the hybrid method is straightforward (the component reliability is between [0.896,0.927]), while the purely probabilistic and the Ferson methods require to fix the level of confidence that the analyst wants in the estimation. Notice, however, that the interpretation of the parameter   1   of the Ferson method and the parameter   1   of the purely probabilistic method is different, the former indicating a degree of certainty that the interval of values of max H that is considered in the uncertainty propagation contains the true max H , the latter being amenable of the classical interpretation of confidence level in statistics. Hence, fixing   1   does not imply a choice on the interval of values of the epistemic variable that will be propagated further in the analysis, whereas fixing   1 



does not imply a choice on the probability that the obtained confidence interval of the success probability will contain its true value. Due to the different interpretation of the parameters, fixing a confidence level, for example    

Application of the hybrid Monte Carlo-possibilistic method

Considering as before the triangular possibility distribution   If one accepts to merge the epistemic and aleatory uncertainties for a synthetic representation of the results, considering that each of the obtained cumulative distributions is the conditional probability of the TTF given a certain value of max H , it is possible to compute the cumulative distribution of the TTF (Figure 12(b)) by: For the interpretation of the results, it is possible to choose a level of confidence  and then provide the upper limit of the one-sided confidence level of the TTF. For example for a confidence level 0.95

        max max max Pr | F t TTF t F t H g H dH     (

 

(dotted line in Figure 12), the resulting upper limit is 988, which means that with 95% probability the TTF is lower or equal than 988.

On the other side there are several reasons, both from a practical and mathematical point of view [START_REF] Rao | Quantification of epistemic and aleatory uncertainties in level-1 probabilistic safety assessment studies[END_REF][START_REF] Vose | Risk analysisa quantitative guide[END_REF], that suggest to keep separate the epistemic and aleatory uncertainties. The main advantage is that the separation of uncertainty permits to understand the causes of the uncertainty in the results. In this respect, a possible way to represent separately the uncertainty is to fix a given percentile of the cumulative

Comparison of the results

Let us first compare the representation of the available uncertain information given by the probabilistic and possibilistic methods. Figure 9 shows that while the possibilistic representation of the uncertainty on In this application characterized by a rather limited available information on the value of max H , the probabilistic density function tends for this reason to force information in the representation.

With respect to the uncertainty propagation and representation techniques, notice that the interpretation of the results obtained by all proposed methods, possibilistic and probabilistic, requires to fix the level of confidence β that the analyst wants in the estimation, i.e. the classical confidence level in statistics. Furthermore, the Ferson method requires an additional level of trust on the value of max H , i.e. the parameter   2 reports the confidence intervals obtained for the TTF by the different methods fixing the levels of confidence  and  to 0.95. Notice that the hybrid method combined with the Ferson aggregation method finds a larger confidence interval than the purely probabilistic method in the case in which the epistemic and aleatory uncertainties  in the probabilistic method does not imply a choice on the interval of values of the epistemic variable that will be propagated further in the analysis, whereas in the Ferson method it does not imply a choice on the probability that the obtained confidence interval of the success probability will contain its true value.

Conclusions

In this paper, the problems of the representation and propagation of uncertainty in prognostic models have been addressed by investigating a purely probabilistic method and a hybrid Monte Carlo and possibilistic method. In the pure probabilistic approach, both epistemic and aleatory uncertainties are represented in terms of probability distributions and a double-randomization Monte Carlo simulation is carried out in which epistemic variables are sampled in the outer loop and aleatory variables are sampled in the inner loop, to propagate the uncertainty through the model. On the other side in the hybrid Monte Carlo and possibilistic method, Monte Carlo sampling of the random variables is repeatedly performed to process the aleatory behavior and possibilistic distribution analysis is carried out at each sampling to process the epistemic uncertainty in the epistemic variables.

The investigation of the two methods has been carried out with reference to a case study regarding the prediction of component reliability and time to failure, knowing at the current time the value of the degradation parameter of a component which is randomly degrading in time according to a stochastic fatigue crack growth model of literature.

With respect to the representation of the uncertainties affecting the parameters of the degradation process (epistemic uncertainty), possibilistic distributions seem to provide a more satisfactory characterization of the uncertainties than probability distributions in the common case of incomplete information or knowledge on the parameters values, whereas the randomness due to the inherent variability in the system behavior (aleatory uncertainty) is appropriately represented by probability distributions.

For what concerns the propagation of the uncertainties in the input variables and parameters to the output of the degradation model, the purely probabilistic method results in a family of cumulative distribution functions. The information contained in these distributions has been aggregated in two different ways: i) by merging the epistemic and aleatory uncertainties affecting the reliability or TTF distribution onto one single cumulative distribution ii) by maintaining them separated. Although in the former case it is possible to obtain a synthetic value of the reliability or of a given percentile of the TTF whereas in the latter case one can only build a probabilistic distribution of the reliability or of a percentile of the TTF from the different realizations of the epistemic variables, it seems more useful for the interpretation of the results to keep the uncertainties separated providing to the analyst the possibility of understanding the causes of the uncertainty. In this respect, notice that the epistemic uncertainty affecting the results, represented by the spread of the probabilistic distribution of the percentile, can be theoretically reduced by acquiring new information on the parameters of the degradation process.

The hybrid Monte Carlo -Possibilistic method has proven effective for jointly propagating the aleatory and epistemic uncertainties through the model. The possibilistic random distributions obtained by this method can be combined into a set of limiting cumulative distributions characterized by different degrees of confidence (Ferson Aggregation Method) or, accordingly to the Dempster-Shafer Theory, into Belief and Plausibility measures that can be interpreted as "rational averages" of the above mentioned limiting cumulative distributions (joint aggregation method). The interpretation of the results in the form of limiting cumulative distributions (Ferson aggregation method) requires the introduction of a degree of confidence directly connected with the confidence on the value of the epistemic parameters. On the contrary, the joint aggregation method provides average information on the limiting cumulative distributions without requiring to the analyst the definition of confidence levels, giving in this way a more synthetic, albeit less informative, representation of uncertainty in the prediction of the reliability or TTF.

Finally, the hybrid Monte Carlo -Possibilistic method for the prognosis of the reliability or TTF of a degrading component seems more appropriate in case of lack of information or knowledge on the degradation model parameters given that it does not force information into the model and it is able to joint-propagate epistemic and aleatory uncertainties.

Figure 1 :

 1 Figure 1: Example of: (a) triangular possibilistic distribution and (b) corresponding possibility and necessity measures of the set   , Ax   A necessity value   1NA means that A is certainly true and it implies that   1

  the uncertainty in the input variables through the function   f  is based on a double-randomization Monte Carlo simulation built on two sampling loops[START_REF] Rao | Quantification of epistemic and aleatory uncertainties in level-1 probabilistic safety assessment studies[END_REF]: (1) the epistemic variables are sampled in the outer loop and (2) the aleatory variables are sampled in the inner loop.The operative steps of the procedure are: of the model corresponding to the e i -th realization of the epistemic variables and the a i -th realization of the aleatory variables:

k

  random variables (aleatory uncertainty) is represented by the probability distributions   j Y py and the uncertainty on the nk  possibilistic variables (epistemic uncertainty) is represented by the possibility distributions

Figure 2 :

 2 Figure 2: The hybrid method for uncertainty propagation ii. possibilistic interval analysis to process the epistemic uncertainty. For the generic a i th  k tuple  of random values, 1,..., , aa im  sampled by Monte Carlo from the probability distributions of the aleatory variables, a possibilistic distribution a f i  estimate of () fY is constructed by fuzzy interval analysis. After

am

  times, exit. At the end of the procedure an ensemble of realizations of random possibility distributions is obtained, i.e.   1 , ..., a ff m  . In this work, the information contained in the obtained random possibility distributions   1 ,..., a ff m  are aggregated according to two different methods: (1) the joint aggregation method [3] and (2) the Ferson aggregation method [2].

  at each realization of the aleatory variables 1,..., aa im  it is possible to obtain the possibility measure () end of the previous Section by using eqs. (3) and (4).Then, the a m different realizations of possibility and necessity of measures to obtain the believe

  each set A , this technique thus computes the probability-weighted average of the possibility measures associated with each output fuzzy interval. Considering a generic value u of   fY, a pair of bounding, average cumulative distributions

  according to eqs. (3) and (4).

20 )

 20 This kind of representation captures the aleatory variability and epistemic imprecision of a random fuzzy interval in a parameterized way through the cuts   and displays extreme pairs of cumulative distributions F  and F  . The gap between F  and

1 SFigure 3 :

 13 Figure 3: (a) Possibilistic distribution of max H (dotted line) and its probabilistic transformation (continuous line); (b) corresponding necessity and possibility measures of the set   max , H 

Figure 4 :

 4 Figure 4: Four different realizations of degradation evolution 2. with respect to the degradation threshold max H , 21 m   values of  have been

Figure 5 : 1 SX

 51 Figure5: Application of the hybrid method of uncertainty representation (columns 1-2) and joint aggregation method for the uncertainty propagation (column 3-4), with regards to the four realizations of the degradation process shown in Figure4

  bounds of the component reliability reported in Figure 7(a) are obtained. The ordinates report the values of  in correspondence of the upper and lower bounds of the component reliability values in abscissa.

  max H is obtained by applying the transformation described in Section 2.3 to the triangular possibility distribution considered in the previous Section (Figure 3(a), dotted line). The obtained probability density function is shown in Figure 3(a) (continuous line) and the corresponding cumulative distribution function in Figure 3(b) (continuous line). The propagation of the uncertainty can then be performed according to the double-randomization method of Section 3.1 characterized by a separation between the epistemic uncertainty (outer randomization loop) and the aleatory uncertainty randomization loop). Upon performing are used to build the cumulative function of Figure 7(b).

Figure 6 :Figure 7 :

 67 Figure 6: Application of the hybrid method of uncertainty representation (column 1) and Ferson aggregation method for the uncertainty propagation (column 2-4), with regards to the four realizations of the degradation process shown in Figure 4

Figure 7 (

 7 b) shows that while the possibilistic representation of the uncertainty on max H



  epistemic uncertainty associated to the information on the value of the threshold max Hand the measurement of crack depth   11 h  , the hybrid procedure of Section 3.2 for the propagation of the uncertainty in the estimation of the max ( proceeds along the same sequence of computational steps 1-6 illustrated in Section 5.1 for the estimation of the component reliability.

Figure 8 ,

 8 Figure 8, first column, reports the a f i  of the TTF obtained for the four simulated degradation evolutions of Figure 4. By the joint aggregation method of Section 3.2.1, the believe and plausibility functions are again obtained by simple averaging of the necessity N and possibility  measures obtained in the different 4 10 a m 

Figure 8 :Figure 9 :

 89 Figure 8: Application of the hybrid method of uncertainty representation (column 1) and joint aggregation method for the uncertainty propagation (columns 2-3), with regards to the four realizations of the degradation process shown in Figure 4

Figure 10 :

 10 Figure 10: Application of the hybrid method of uncertainty representation (column 1) and Ferson aggregation method for the uncertainty propagation (columns 2-4), with regards to the four realizations of the degradation process shown in Figure 4. As before, applying the Ferson aggregation method to all

  Figure 11 reports the limiting bounds of the upper limit of the 95% one-sided confidence level of the TTF function of the cut  . For example, considering a 0.95 cut  , at 95% confidence the upper limit for the TTF lies in the interval   983,988 (dotted line in Figure11). Notice that the analyst in this case should provide two confidence values,  for the epistemic uncertainty affecting max H and  for the aleatory uncertainties in the degradation process.

Figure 11 :

 11 Figure 11:Limiting bounds of the upper limit of the 95% one sided confidence level of the TTF computed with the Ferson aggregation method 5.2.2. Application of the purely probabilistic method Upon performing 4 10 a m  simulations of the degradation process for each of the

  build the probabilistic distribution of this percentile from the different realizations of the epistemic variables. Figure13reports the cumulative distribution of the  =0.95 percentile of   max ee ii F TTF H .For the interpretation of the obtained distribution it is possible to choose, also in this case, an additional level of confidence 1   connected with the epistemic uncertainty and then provide the confidence interval for the 95% percentile of the TTF given by the percentiles epistemic uncertainty the 95% percentile of the TTF is between [939,1020].

  maxHallows us to consider all the possible cumulative distributions lying between the believe and the plausibility measures of the set  0, Au , the probabilistic representation, Figure12(b) and Figure13, forces us to consider only one specific cumulative distribution, albeit conservatively the one containing as much uncertainty as possible (thanks to the transformation of Section 2.3).

Figure 12 :

 12 Figure 12: Results obtained with the pure probabilistic method: (a) 10 conditional cumulative probability distributions; (b) total cumulative probability distribution Table2reports the confidence intervals obtained for the TTF by the different methods fixing the levels of confidence  and  to 0.95. Notice that the hybrid method combined with the Ferson aggregation method finds a larger confidence interval than the purely probabilistic method in the case in which the epistemic and aleatory uncertainties

Figure 13 :

 13 Figure 13: Cumulative distribution of the

Table 1 . Numerical values of the case study parameters

 1

	Parameter			Value
	k C  			(0,1.7) 0.005 N 1
				1.3
	d miss p T max H		  9,11	0.25 500 time units

  is too low, then one should proceed to the estimation of the component TTF in order to establish a proper maintenance intervention or component replacement. Given that in the case study considered in Section 4 a component is functioning until the value of its degradation   ht exceeds the value of the failure upper threshold max H , the TTF is a function of the crack depth time evolution  

		1	1     	0.95	, leads to
	different intervals for the component reliability, i.e. [0.875,0.940] for the Ferson method
	and [0.889,0.935] for the purely probabilistic method.
	5.2. Time To Failure estimation
	If the reliability prediction made at time p t on the basis of the crack depth
	p measurement   ht	is not satisfactory because the probability that the component fails to
	perform its function up to
	ht, of the value t at which the crack depth p   max t h t H and of the present time value ht is collected: of the failure threshold max H measurement   p         max , , , where min p e p e TTF f h t H t t t t      (30)

miss T

Piero Baraldi , Irina Crenguţa Popescu, and Enrico Zio


Nicola Pedroni

Enrico Zio
email: enrico.zio@polimi.it

George E Apostolakis
email: apostola@mit.edu

Comparison of bootstrapped Artificial Neural Networks and quadratic Response Surfaces for the estimation of the functional failure probability of a thermal-hydraulic passive system

Comparison of bootstrapped artificial neural networks and quadratic response surfaces for the estimation of the functional failure probability of a thermal-hydraulic passive system

Introduction

All innovative reactor concepts make use of passive safety features, to a large extent in combination with active safety and operational systems [START_REF] Mackay | Incorporating reliability analysis into the design of passive cooling systems with an application to a gas-cooled reactor[END_REF]. According to the definitions of the International Atomic Energy Agency (IAEA), a passive system does not need external input (especially energy) to operate (IAEA, 1991), while they are expected to contribute significantly to the safety of nuclear power plants thanks to their peculiar characteristics of simplicity, reduction of human interaction and reduction or avoidance of hardware failures [START_REF] Mathews | Functional reliability analysis of safety grade decay heat removal system of Indian 500 MWe PFBR[END_REF].

However, the uncertainties involved in the modelling and functioning of passive systems are usually larger than for active systems. This is due to: i) the intrinsically random nature of several of the physical phenomena involved in the functioning of the system (aleatory uncertainty); ii) the incomplete knowledge on the physics of some of these phenomena (epistemic uncertainty) [START_REF] Apostolakis | The concept of probability in safety assessment of technological systems[END_REF][START_REF] Helton | Alternative representations of epistemic uncertainties[END_REF].

Due to these uncertainties, the physical phenomena involved in the passive system functioning (e.g., natural circulation) might develop in such a way to lead the system to fail its intended function, even if safety margins are present. In fact, deviations in the natural forces and in the conditions of the underlying physical principles from the expected ones can impair the function of the system itself [START_REF] Marquès | Methodology for the reliability evaluation of a passive system and its integration into a probabilistic safety assessment[END_REF][START_REF] Patalano | Risk-informed design changes in a passive decay heat removal system[END_REF].

The problem may be analytically framed by introducing the concept of functional failure, whereby a passive system may fail to perform its function due to deviations from its expected behavior which lead the load imposed on the system to exceed its capacity [START_REF] Burgazzi | Reliability evaluation of passive systems through functional reliability assessment[END_REF][START_REF] Burgazzi | State of the art in reliability of thermal-hydraulic passive systems[END_REF]. This concept has been exploited in a number of works presented in the literature [START_REF] Jafari | Reliability evaluation of a natural circulation system[END_REF][START_REF] Marquès | Methodology for the reliability evaluation of a passive system and its integration into a probabilistic safety assessment[END_REF][START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF][START_REF] Bassi | Reliability assessment of 2400 MWth gas-cooled fast reactor natural circulation decay heat removal in pressurized situations[END_REF][START_REF] Fong | The use of response surface methodology to perform uncertainty analyses on passive safety systems[END_REF][START_REF] Mackay | Incorporating reliability analysis into the design of passive cooling systems with an application to a gas-cooled reactor[END_REF][START_REF] Mathews | Functional reliability analysis of safety grade decay heat removal system of Indian 500 MWe PFBR[END_REF][START_REF] Patalano | Risk-informed design changes in a passive decay heat removal system[END_REF]Zio and Pedroni, 2009a and b), in which the passive system is modeled by a detailed, mechanistic T-H system code and the probability of failing to perform the required function is estimated based on a Monte Carlo (MC) sample of code runs which propagate the epistemic (state-of-knowledge) uncertainties in the model and the numerical values of its parameters/variables.

Since the probabilities of functional failure of passive systems are generally very small (e.g., of the order of 10 -4 ), a large number of samples is necessary for acceptable estimation accuracy [START_REF] Schueller | On the treatment of uncertainties in structural mechanics and analysis[END_REF]; given that the time required for each run of the detailed, mechanistic T-H system code is of the order of several hours [START_REF] Fong | The use of response surface methodology to perform uncertainty analyses on passive safety systems[END_REF], the MC simulation-based procedure typically requires considerable computational efforts.

A viable approach to overcome the computational burden associated to the analysis is that of resorting to fast-running, surrogate regression models, also called response surfaces or metamodels, to substitute the long-running T-H model code. The construction of such regression models entails running the T-H model code a predetermined, reasonably large but feasibly small, number of times (e.g., of the order of 50-100) for specified values of the uncertain input parameters/variables and recording the corresponding values of the output of interest; then, statistical techniques are employed for fitting the response surface of the regression model to the input/output data generated.

Several kinds of surrogate meta-models have been recently applied to safety related nuclear, structural and hydrogeological problems, including polynomial Response Surfaces (RSs) [START_REF] Bucher | A comparison of approximate response function in structural reliability analysis[END_REF][START_REF] Fong | The use of response surface methodology to perform uncertainty analyses on passive safety systems[END_REF][START_REF] Gavin | High-order limit state functions in the response surface method for structural reliability analysis[END_REF][START_REF] Liel | Incorporating modeling uncertainties in the assessment of seismic collapse risk of buildings[END_REF], Gaussian meta-models [START_REF] Volkova | Global sensitivity analysis for a numerical model of radionuclide migration from the RRC "Kurchatov Institute" redwaste disposal site[END_REF][START_REF] Marrel | Calculations of Sobol indices for the Gaussian process metamodel[END_REF] and learning statistical models such as Artificial Neural Networks (ANNs), Radial Basis Functions (RBFs) and Support Vector Machines (SVMs) [START_REF] Deng | Structural reliability analysis for implicit performance function using radial basis functions[END_REF][START_REF] Hurtado | Filtered importance sampling with support vector margin: a powerful method for structural reliability analysis[END_REF][START_REF] Cardoso | Structural reliability analysis using Monte Carlo simulation and neural networks[END_REF][START_REF] Cheng | A new artificial neural network-based response surface method for structural reliability analysis[END_REF].

In this work, the possibility of using Artificial Neural Networks (ANNs) and quadratic Response Surfaces (RSs) to reduce the computational burden associated to the functional failure analysis of a natural convection-based decay heat removal system of a Gas-cooled Fast Reactor (GFR) [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF] is investigated. To keep the practical applicability in sight, a small set of input/output data examples is considered available for constructing the ANN and quadratic RS models: different sizes of the (small) data sets are considered to show the effects of this relevant practical aspect. The comparison of the potentials of the two regression techniques in the case at hand is made with respect to the estimation of the 95 th percentile of the naturally circulating coolant temperature and the functional failure probability of the passive system.

Actually, the use of regression models in safety critical applications like nuclear power plants still raises concerns with regards to the control of their accuracy; in this paper, the bootstrap method is used for quantifying, in terms of confidence intervals, the uncertainty associated to the estimates provided by the ANNs and quadratic RSs [START_REF] Efron | An introduction to the bootstrap[END_REF][START_REF] Zio | A study of the bootstrap method for estimating the accuracy of artificial neural networks in predicting nuclear transient processes[END_REF][START_REF] Cadini | An empirical model based bootstrapped neural networks for computing the maximum fuel cladding temperature in a RBMK-1500 nuclear reactor accident[END_REF][START_REF] Secchi | Quantifying uncertainties in the estimation of safety parameters by using bootstrapped artificial neural networks[END_REF][START_REF] Storlie | Implementation and evaluation of nonparameteric regression procedures for sensitivity analysis of computationally demanding models[END_REF].

The paper organization is as follows. In Section 2, a snapshot on the functional failure analysis of T-H passive systems is given. Section 3 is devoted to the detailed presentation of the bootstrapbased method for quantifying, in terms of confidence intervals, the model uncertainty associated to the estimates of safety parameters computed by ANN and quadratic RS regression models. In Section 4, the case study of literature concerning the passive cooling of a GFR is presented. In Section 5, the results of the application of bootstrapped ANNs and quadratic RSs to the percentile and functional failure probability estimations are compared. Finally, conclusions are provided in the last Section.

The quantitative steps of functional failure analysis of T-H passive systems

The basic steps of the quantitative phase of the functional failure analysis of a T-H passive system are [START_REF] Marquès | Methodology for the reliability evaluation of a passive system and its integration into a probabilistic safety assessment[END_REF]:

1. Detailed modeling of the passive system response by means of a deterministic, best-estimate (typically long-running) T-H code.

2. Identification of the parameters/variables, models and correlations (i.e., the inputs to the T-H code) which contribute to the uncertainty in the results (i.e., the outputs) of the best estimate T-H calculations.

3. Propagation of the uncertainties through the deterministic, long-running T-H code in order to estimate the functional failure probability of the passive system.

Step 3. above relies on multiple (e.g., many thousands) evaluations of the T-H code for different combinations of system inputs; this can render the associated computing cost prohibitive, when the running time for each T-H code simulation takes several hours (which is often the case for T-H passive systems).

The computational issue may be tackled by replacing the long-running, original T-H model code by a fast-running, surrogate regression model (properly built to approximate the output from the true system model). In this paper, classical three-layered feed-forward Artificial Neural Networks (ANNs) [START_REF] Bishop | Neural Networks for pattern recognition[END_REF] and quadratic Response Surfaces (RSs) [START_REF] Liel | Incorporating modeling uncertainties in the assessment of seismic collapse risk of buildings[END_REF] are considered for this task. The accuracy of the estimates obtained is analyzed by computing a confidence interval by means of the bootstrap method [START_REF] Efron | An introduction to the bootstrap[END_REF]; a description of this technique is provided in the following Section.

3 The bootstrap method for point value and confidence interval estimation

Empirical regression modelling

As discussed in the previous Section, the computational burden posed by uncertainty and sensitivity analyses of T-H passive systems can be tackled by replacing the long-running, original T-H model code by a fast-running, surrogate regression model. Because calculations with the surrogate model can be performed quickly, the problem of long simulation times is circumvented.

Let us consider a generic meta-model to be built for performing the task of nonlinear regression, i.e., estimating the nonlinear relationship between a vector of input variables x = {x 1 , x 2 , ..., x j , .. [START_REF] Zio | A study of the bootstrap method for estimating the accuracy of artificial neural networks in predicting nuclear transient processes[END_REF]. It can be assumed that the target vector y is related to the input vector x by an unknown nonlinear deterministic function

( )

x µ y corrupted by a noise vector ( )

x ε , i.e., ( ) ( ) ( ) x ε x µ x y y + = . (1)
Notice that in the present case of T-H passive system functional failure probability assessment the vector x contains the relevant uncertain system parameters/variables, the nonlinear deterministic function ( )

x µ y
represents the complex, long-running T-H mechanistic model code (e.g., RELAP5-3D), the vector y(x) contains the output variables of interest for the analysis and the noise ( )

x ε represents the errors introduced by the numerical methods employed to calculate ( ) x µ y [START_REF] Storlie | Implementation and evaluation of nonparameteric regression procedures for sensitivity analysis of computationally demanding models[END_REF]; for simplicity, in the following we assume ( ) [START_REF] Secchi | Quantifying uncertainties in the estimation of safety parameters by using bootstrapped artificial neural networks[END_REF].

x ε = 0
The objective of the regression task is to estimate ( ) , p = 1, 2, ..., N train ; for example, the Root Mean Squared Error (RMSE) is commonly adopted to this purpose [START_REF] Zio | A study of the bootstrap method for estimating the accuracy of artificial neural networks in predicting nuclear transient processes[END_REF]:

x
( ) ∑∑ = = - ⋅ = train o N p n l l p l p o train y y n N RMSE 1 1 2 , , 1 , (2)
Once built, the regression model f(x, w * ) can be used in place of the T-H code to calculate any quantity of interest Q, such as the 95 th percentile of a physical variable critical for the system under analysis (e.g., the fuel cladding temperature) or the functional failure probability of the passive system.

In this work, the capabilities of quadratic Response Surface (RS) and three-layered feed-forward Artificial Neural Network (ANN) regression models are compared in the computational tasks involved in the functional failure analysis of a T-H passive system. In extreme synthesis, quadratic

RSs are polynomials containing linear terms, squared terms and possibly two-factors interactions of the input variables [START_REF] Liel | Incorporating modeling uncertainties in the assessment of seismic collapse risk of buildings[END_REF]; the RS adaptable parameters w * are usually calibrated by straightforward least squares methods. ANNs are computing devices inspired by the function of the nerve cells in the brain [START_REF] Bishop | Neural Networks for pattern recognition[END_REF]. They are composed of many parallel computing units (called neurons or nodes) interconnected by weighed connections (called synapses). Each of these computing units performs a few simple operations and communicates the results to its neighbouring units. From a mathematical viewpoint, ANNs consist of a set of nonlinear (e.g., sigmoidal) basis functions with adaptable parameters w * that are adjusted by a process of training (on many different input/output data examples), i.e., an iterative process of regression error minimization [START_REF] Rumelhart | Learning internal representations by error back-propagation[END_REF]. The particular type of ANN employed in this paper is the classical three-layered feedforward ANN trained by the error back-propagation algorithm.

The details of these two regression models are not reported here for brevity: the interested reader may refer to the cited references and the copious literature in the field.

The bootstrap method

The approximation of the system output provided by an empirical regression model introduces an additional source of uncertainty, which needs to be evaluated, particularly in safety critical applications like those related to nuclear power plant technology. One way to do this is by resorting to bootstrapped regression models [START_REF] Efron | An introduction to the bootstrap[END_REF], i.e., an ensemble of regression models constructed on different data sets bootstrapped from the original one [START_REF] Zio | A study of the bootstrap method for estimating the accuracy of artificial neural networks in predicting nuclear transient processes[END_REF][START_REF] Storlie | Implementation and evaluation of nonparameteric regression procedures for sensitivity analysis of computationally demanding models[END_REF]. The bootstrap method is a distribution-free inference method which requires no prior knowledge about the distribution function of the underlying population [START_REF] Efron | An introduction to the bootstrap[END_REF]. The basic idea is to generate a sample from the observed data by sampling with replacement from the original data set [START_REF] Efron | An introduction to the bootstrap[END_REF]. From the theory and practice of ensemble empirical models, it can be shown that the estimates given by bootstrapped regression models is in general more accurate than the estimate of the best regression model in the bootstrap ensemble of regression models [START_REF] Zio | A study of the bootstrap method for estimating the accuracy of artificial neural networks in predicting nuclear transient processes[END_REF][START_REF] Cadini | An empirical model based bootstrapped neural networks for computing the maximum fuel cladding temperature in a RBMK-1500 nuclear reactor accident[END_REF].

In what follows, the steps of the bootstrap-based technique of evaluation of the so-called Bootstrap Bias Corrected (BBC) point estimate BBC Q ˆ of a generic quantity Q (e.g., a safety parameter) by a regression model f(x, w * ), and the calculation of the associated BBC Confidence Interval (CI) are reported [START_REF] Zio | A study of the bootstrap method for estimating the accuracy of artificial neural networks in predicting nuclear transient processes[END_REF][START_REF] Storlie | Implementation and evaluation of nonparameteric regression procedures for sensitivity analysis of computationally demanding models[END_REF]:

1. Generate a set D train of input/output data examples by sampling N train independent input parameters values x p , p = 1, 2, ..., N train , and calculating the corresponding set of N train output vectors y p = µ y (x p ) through the mechanistic T-H system code. Plain random sampling, Latin

Hypercube Sampling or other more sophisticated experimental design methods can be adopted to select the input vectors x p , p = 1, 2, ..., N train [START_REF] Gazut | Towards the optimal design of numerical experiments[END_REF].

Q ˆ for Q as boot BBC Q Q Q 2 ˆ-= (
Q B Q 1 1 . ( 4
)
The BBC estimate BBC Q ˆ in (3) is taken as the definitive point estimate for Q.

The explanation for expression (3) is as follows. It can be demonstrated that if there is a bias in the bootstrap average estimate boot Q ˆ in (4) compared to the estimate Q ˆ obtained with the single regression model f(x, w * ) (step 3. above), then the same bias exists in the single estimate Q ˆ compared to the true value Q of the quantity of interest [START_REF] Baxt | Bootstrapping confidence intervals for clinic input variable effects in a network trained to identify the presence of acute myocardial infarction[END_REF].

Thus, in order to obtain an appropriate, i.e. bias-corrected, estimate BBC Q ˆ for the quantity of interest Q, the estimate Q ˆ must be adjusted by subtracting the corresponding bias

( boot Q ˆ - Q ˆ): as a consequence, the final, bias-corrected estimate BBC Q ˆ is BBC Q ˆ = Q ˆ -( boot Q ˆ -Q ˆ) =
i Q Q ) ( =
for some b = 1, 2, ..., B, and

) 1 ( Q < ) 2 ( Q < ... < ) ( ˆb Q < ... < ) ( ˆB Q .
b. Identify the 100•α/2 th and 100•(1α/2) th quantiles of the bootstrapped empirical

probability distribution of Q (step 4. above) as the [B•α/2] th and [B•(1 -α/2)] th elements [ ] (
)

2 / ˆα ⋅ B Q and ( ) [ ] (
)

2 / 1 ˆα - ⋅ B Q
, respectively, in the ordered list

) 1 ( Q < ) 2 ( Q < ... < ) ( ˆb Q < ... < ) ( ˆB Q ; notice that the symbol [•] stands for "closest integer". c. Calculate the two-sided BBC-100•(1 -α)% CI for BBC Q ˆ as [ ] ( ) ( ) ( ) [ ] ( ) ( ) [ ] boot B BBC B boot BBC Q Q Q Q Q Q , ˆ2 / 1 2 / - + - - - ⋅ ⋅ α α . ( 5
)
An important advantage of the bootstrap method is that it provides confidence intervals for a given quantity Q without making any model assumptions (e.g., normality); a disadvantage is that the computational cost could be high when the set D train and the number of adaptable parameters w * in the regression models are large.

Case study

The case study considered in this work concerns the natural convection cooling in a Gas-cooled Fast Reactor (GFR) under a post-Loss Of Coolant Accident (LOCA) condition [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF].

The reactor is a 600-MW GFR cooled by helium flowing through separate channels in a silicon carbide matrix core whose design has been the subject of study in the past several years at the Massachussets Institute of Technology (MIT) [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF].

A GFR decay heat removal configuration is shown schematically in Figure 1; in the case of a LOCA, the long-term heat removal is ensured by natural circulation in a given number N loops of identical and parallel loops; only one of the N loops loops is reported for clarity of the picture: the flow path of the cooling helium gas is indicated by the black arrows. The loop has been divided into N sections = 18 sections for numerical calculation; technical details about the geometrical and structural properties of these sections are not reported here for brevity: the interested reader may refer to [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF].

In the present analysis, the average core power to be removed is assumed to be 18.7 MW, equivalent to about 3% of full reactor power (600 MW): to guarantee natural circulation cooling at this power level, a pressure of 1650 kPa in the loops is required in nominal conditions. Finally, the secondary side of the heat exchanger (i.e., item 12 in Figure 1) is assumed to have a nominal wall temperature of 90 °C [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF].

Figure 1. Schematic representation of one loop of the 600-MW GFR passive decay heat removal system [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]

Uncertainties

Uncertainties affect the modeling of passive systems. There are unexpected events, e.g. the failure of a component or the variation of the geometrical dimensions and material properties, which are random in nature. This kind of uncertainty, often termed aleatory (NUREG-1150(NUREG- , 1990;;[START_REF] Helton | Uncertainty and sensitivity analysis results obtained in the 1996 performance assessment for the waste isolation power plant[END_REF]USNCR, 2002), is not considered in this work. There is also incomplete knowledge on the properties of the system and the conditions in which the passive phenomena develop (i.e., natural circulation). This kind of uncertainty, often termed epistemic, affects the model representation of the passive system behaviour, in terms of both (model) uncertainty in the hypotheses assumed and

(parameter) uncertainty in the values of the parameters of the model [START_REF] Cacuci | A comparative review of sensitivity and uncertainty analysis of large scale systems -II: Statistical methods[END_REF][START_REF] Helton | Survey on sampling-based methods for uncertainty and sensitivity analysis[END_REF][START_REF] Patalano | Risk-informed design changes in a passive decay heat removal system[END_REF].

Only

Model uncertainty

Nusselt number in forced convection, x 4 1 5%

Nusselt number in mixed convection, x 5 1 15%

Nusselt number in free convection, x 6 1 7.5%

Friction factor in forced convection, x 7 1 1%

Friction factor in mixed convection, x 8 1 10%

Friction factor in free convection, x 9 1 1.5%

Table 1. Epistemic uncertainties considered for the 600-MW GFR passive decay heat removal system of Figure 1 [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]

Failure criteria of the T-H passive system

The passive decay heat removal system of Figure 1 is considered failed when the temperature of the coolant helium leaving the core (item 4 in Figure 1) exceeds either 1200 °C in the hot channel or 850 °C in the average channel: these values are expected to limit the fuel temperature to levels which prevent excessive release of fission gases and high thermal stresses in the cooler (item 12 in Figure 1) and in the stainless steel cross ducts connecting the reactor vessel and the cooler (items from 6 to 11 in Figure 1) [START_REF] Pagani | The impact of uncertainties on the performance of passive systems[END_REF]. Denoting by ( )

x hot core out T , and
( )

x avg core out T ,
the coolant outlet temperatures in the hot and average channels, respectively, the system failure event F can be written as follows:

( ) { } ( ) { } 850 : 1200 : , , > ∪ > = x x x x avg core out hot core out T T F . ( 6
)
According to the notation of the preceding Section 3, ( )

x hot core out T , = y 1 (x) and
( )

x avg core out T , = y 2 (x) are
the two target outputs of the T-H model.

Functional failure probability estimation by bootstrapped ANNs and quadratic RSs

In this Section, the results of the application of bootstrapped Artificial Neural Networks (ANNs)

and quadratic Response Surfaces (RSs) for the estimation of the functional failure probability of the 600-MW GFR passive decay heat removal system in Figure 1 are illustrated. Some details about the construction of the ANN and quadratic RS regression models are given in Section 5.1; their use for estimating the percentiles of the hot-channel and average-channel coolant outlet temperatures is shown in Section 5.2; the estimation of the probability of functional failure of the system is addressed in Section 5.3. The uncertainties associated to the calculated quantities are estimated by bootstrapping of the regression models, as explained in Section 3. to calibrate the adjustable parameters w * of the regression models, for best fitting the T-H model code data. More specifically, the straightforward least squares method has been used to find the parameters of the quadratic RSs [START_REF] Bucher | A comparison of approximate response function in structural reliability analysis[END_REF] and the common error back-propagation algorithm has been applied to train the ANNs [START_REF] Rumelhart | Learning internal representations by error back-propagation[END_REF]. Note that a single ANN can be trained to estimate both outputs of the model here of interest, whereas a specific quadratic RS must be developed for each output to be estimated.

Building and testing the ANN and quadratic RS regression models

The choice of the ANN architecture is critical for the regression accuracy. In particular, the number of neurons in the network determines the number of adjustable parameters available to optimally fit

Figure 2. Early stopping the ANN training to avoid overfitting

As measures of the ANN and RS model accuracy, the commonly adopted coefficient of determination 2 R and RMSE have been computed for each output y l , l = 1, 2, on a new data set

( ) { } test p p test N p D ..., , 2 , 1 , , = = y x
of size N test = 20, purposely generated for testing the regression models built [START_REF] Marrel | Calculations of Sobol indices for the Gaussian process metamodel[END_REF], and thus different from those used during training and validation. = 20, 30, 50, 70, 100; the number of adjustable parameters w * included in the two regression models is also reported for comparison purposes

The ANN outperforms the RS in all the cases considered: for example, for N train = 100, the coefficients of determination R 2 produced by the ANN and the quadratic RS models for the hot- iii. performing N T = 250000 evaluations of each of the B = 1000 bootstrapped ANN and RS regression models; the corresponding CPU times are on average 6 min (i.e., 0.1 h) and 4.5 min (i.e., about 0.08 h) for the ANNs and the RSs, respectively.

The overall CPU times required by the use of bootstrapped ANNs (i.e., on average 2.22 h) and quadratic RSs (i.e., on average 0.43 h) is about 90 and 480 times, respectively, lower than that required by the use of the original T-H model code (i.e., on average 209 h). The CPU time required by the ANNs is about 5 times larger than that required by the quadratic RSs, mainly due to the elaborate training algorithm needed to build the structurally complex neural model.

Functional failure probability estimation

In this Section, the bootstrapped ANNs and quadratic RSs are compared in the task of estimating the functional failure probability of the 600-MW GFR passive decay heat removal system of Figure 1. The previous system configuration with N loops = 3 is analyzed. for P(F) lie between 9.81•10 -5 and 2.45•10 -4 ) and the associated uncertainties are quite large (e.g., the widths of the corresponding BBC 95% CIs are between 3.47•10 -4 and 7.91•10 -4 ). Two considerations seem in order with respect to these results. First, in these cases of small data sets available the analyst would still be able to correctly estimate the order of magnitude of a small failure probability (i.e., P(F) ~ 10 -4 ), in spite of the low number of runs of the T-H code performed to generate the N train = 20, 30 or 50 input/output examples; second, the accuracy of an estimate should be evaluated in relation to the requirements of the specific application; for example, although the confidence interval provided by the bootstrapped ANNs trained with N train = 50 samples ranges from 8.03•10 -5 to 4.27•10 -4 , this variability might be acceptable for demonstrating that the system satisfies the target safety goals.

Finally, it is worth noting that although bootstrapped ANNs provide better estimates and lower model uncertainties than quadratic RSs, the difference in the performances of the two regression models is less evident than in the case of percentile estimation (Section 5.2). This may be due to the fact that estimating the value of the functional failure probability P(F) is a simpler task than estimating the exact values of the corresponding coolant outlet temperatures. For example, let the true value of the hot channel coolant outlet temperature be 1250 °C and the corresponding estimate by the regression model be 1500 °C: in such a case, the estimate is absolutely inaccurate in itself, but "exact" for the purpose of functional failure probability estimation with respect to a failure threshold of 1200 °C.

Finally, the computational times required for the estimation of the functional failure probability, and the corresponding confidence interval, in the case of N train = 100 are 2.32 h and 0.50 h for the bootstrapped ANNs and quadratic RSs, respectively.

Conclusions

In The bootstrap method has been employed to estimate confidence intervals on the quantities computed: this uncertainty quantification is of paramount importance in safety critical applications, in particular when few data examples are used. In this regard, bootstrapped ANNs have been shown

to produce narrower confidence intervals than bootstrapped quadratic RSs in all the analyses performed.

On the basis of the results obtained, bootstrapped ANNs can be considered more effective than quadratic RSs in the estimation of the functional failure probability of T-H passive systems (while quantifying the uncertainty associated to the results) because they provide more accurate (i.e., estimates are closer to the true values) and precise (i.e., confidence intervals are narrower) estimates than quadratic RSs; on the other hand, the computational time required by bootstrapped ANNs is somewhat longer than that required by quadratic RSs, due to the elaborate training algorithm for building the structurally complex neural model.

  2. Build a regression model f(x, w * ) on the basis of the entire data set above) in order to obtain a fast-running surrogate of the T-H model code represented by the unknown nonlinear deterministic function µ y (x) in (1).3. Use the regression model f(x, w * ) (step 2. above), in place of the original T-H model code, to provide a point estimate Q ˆ of the quantity Q, e.g., the 95 th percentile of a system variable of interest or the functional failure probability of the T-H passive system.In particular, draw a sample of N T new input vectors x r , r = 1, 2, …, N T , from the corresponding epistemic probability distributions and feed the regression model f(x, w * ) with them; then, use the corresponding output vectors y r = f(x r , w * ), r = 1, 2, …, N T , to calculate the estimate Q ˆ for Q (the algorithm for computing Q ˆ is obviously dependent on the meaning of the quantity Q). Since the regression model f(x, w * ) can be evaluated quickly, this step is computationally costless even if the number N T of model estimations is very high (e.g., N T = 10 5 or 10 6 ). 4. Build an ensemble of B (typically of the order of 500-1000) regression models with replacement and use each of the bootstrapped regression models f b (x, w b * ), b = 1, 2, ..., B, to calculate an estimate b Q ˆ, b = 1, 2, ..., B, for the quantity Q of interest: by so doing, a bootstrap-based empirical probability distribution for the quantity Q is produced which is the basis for the construction of the corresponding confidence intervals. In particular, repeat the following steps for b = 1, 2, ..., 1, 2, ..., B, by performing random sampling with replacement from the original data set input/output patterns (steps 1. and 2. above). The data set D train , b is thus constituted by the same number N train of input/output patterns drawn among those in D train although, due to the sampling with replacement, some of the patterns in D train will appear more than once in D train , b , whereas some will not appear at all. b. Build a regression model f b (x, w b * ), b = 1, 2, ..., B, on the basis of the bootstrap data set a. above). c. Use the regression model f b (x, w b * ) (step 4.b. above), in place of the original T-H code, to provide a point estimate b Q ˆ of the quantity of interest Q. It is important to note that for a correct quantification of the confidence interval the estimate b Q ˆ must be based on the same input and output vectors x r and y r , r = 1, 2, …, N T , respectively, obtained in step 3. above. 5. Calculate the so-called Bootstrap Bias Corrected (BBC) point estimate BBC

  3) where Q ˆ is the estimate obtained with the regression model f(x, w * ) trained with the original data set D train (steps 2. and 3. above) and boot Q ˆ is the average of the B estimates b Q ˆ obtained with the B regression models f b (x, w b * ), b = 1, 2, ..., B (step 4.c. above), i.e.,

6.

  Calculate the two-sided Bootstrap Bias Corrected (BBC)-100•(1α)% Confidence Interval (CI) for the BBC point estimate in (3) by performing the following steps: a. Order the bootstrap estimates b Q ˆ, b = 1, 2, ..., B, (step 4.c. above) by increasing values, such that b

  RS and ANN models have been built with training sets data examples of different sizes N train= 20, 30, 50, 70, 100; this has allowed extensive testing of the capability of the regression models to reproduce the outputs of the nonlinear T-H model code, based on different (small) numbers of example data. For each size N train of data set, a Latin Hypercube Sample (LHS) of the 9 uncertain inputs has been drawn, x p = {x 1,p , x 2,p , …, x j,p , …, 9, p x }, p = 1, 2, …., N train[START_REF] Zhang | Performance-based design and seismic reliability analysis using designed experiments and neural networks[END_REF]. Then, the T-H model code has been run with each of the input vectors x p , p = 1, 2, …, N train , to obtain the corresponding bidimensional output vectors y p = µ y (x p ) = {y 1,p , y 2,p }, p = 1, 2, …, N train (in the present case study, the number n o of outputs is equal to 2, i.e., the hot-and average-channel coolant outlet temperatures, as explained in Section 4.2). The training data set

  the complicated, nonlinear T-H model code response surface by interpolation of the available training data. The number of neurons in the input layer is n i = 9, equal to the number of uncertain input parameters; the number n o of outputs is equal to 2, the outputs of interest; the number n h of nodes in the hidden layer is 4 for N train = 20, 30, 70 and 100, whereas it is 5 for N train = 50, determined by trial-and-error. In case of a network with too few neurons (i.e., too few parameters), the regression function f(x, w * ) has insufficient flexibility to adjust its response surface to fit the data adequately: this results in poor generalization properties of interpolation when new input patterns are fed to the network to obtain the corresponding output; on the opposite side, excessively increasing the flexibility of the model by introducing too many parameters, e.g., by adding neurons, may make the network overfit the training data, leading again to poor generalization performance when interpolating new input data. A trade-off is typically sought by controlling the neural model complexity, i.e., the number of parameters, and the training procedure, e.g., by adding a regularization term in the error function or by early stopping the training, so as to achieve a good fit of the training data with a reasonably smooth regression function which is not over-fit to the data and therefore capable of generalization when interpolating new input data[START_REF] Bishop | Neural Networks for pattern recognition[END_REF]. In the present work, early stopping is adopted: a validation input/output data set different from those of the training set D train is used to monitor the accuracy of the ANN model during the training procedure; in practice, the RMSE (2) is computed on D val at different iterative stages of the training procedure (Figure 2): at the beginning of training, this value decreases as does the RMSE computed on the training set D train ; later in the training, if the ANN regression model starts overfitting the data, the RMSE calculated on the validation set D val starts increasing and training must be stopped (Bishop, 1995). It is fair to point out that the increased ANN generalization capability typically achieved by early stopping is obtained at the expense of N val additional code simulations, with an increase in the computational cost for the training of the ANN model. In this work, the size N val of the validation set is set to 20 for all sizes N train of the data set D train considered, which means 20 additional runs of the T-H model code.

Figure 3 .

 3 Figure 3. Hot-channel coolant outlet temperature empirical PDFs (left) and CDFs (right) constructed with N T = 250000 estimations from the original T-H code (solid lines) and from bootstrapped ANNs (dashed lines) and RSs (dot-dashed lines) built on N train = 100 data examples

Figure 5 Figure 5 .

 55 Figure 5 shows the values of the Bootstrap Bias Corrected (BBC) point estimates ( ) BBC F P ˆ (dots) of the functional failure probability P(F) obtained with N T = 500000 estimations from the bootstrapped ANNs (left) and quadratic RSs (right) built on N train = 20, 30, 50 ,70 and 100 data examples; the corresponding Bootstrap Bias Corrected (BBC) 95% Confidence Intervals (CIs) are also reported (bars). Notice that the "true" (i.e., reference) value of the functional failure probability P(F) (i.e., P(F) = 3.34•10 -4 , shown as dashed lines in Figure 5) has been obtained with a very large number N T (i.e., N T = 500000) of simulations of the original T-H code to provide a robust term of comparison:the computational time required by this reference analysis is thus 500000•3 s = 1500000 s ≈ 417 h.

  this paper, Artificial Neural Networks (ANNs) and quadratic Response Surfaces (RSs) have been compared in the task of estimating, in a fast and efficient way, the probability of functional failure of a T-H passive system. A case study involving the natural convection cooling in a Gas-cooled Fast Reactor (GFR) after a Loss of Coolant Accident (LOCA) has been taken as reference. To allow accurate comparison values based on a large number of repeated T-H-model code evaluations, the representation of the system behavior has been limited to a steady-state model. ANN and quadratic RS models have been constructed on the basis of sets of data of limited, varying sizes, which represent examples of the nonlinear relationships between 9 uncertain inputs and 2 relevant outputs of the T-H model code (i.e., the hot-and average-channel coolant outlet temperatures). Once built, such models have been used, in place of the original T-H model code, to: compute the temperatures 95 th percentiles of the hot-channel and average-channel temperatures of the coolant gas leaving the reactor core; the functional failure probability of the system by comparison of the computed values with predefined failure thresholds. In all the cases considered, the results have demonstrated that ANNs outperform quadratic RSs in terms of estimation accuracy: as expected, the difference in the performances of the two regression models is much more evident in the estimation of the 95 th percentiles than in the (easier) task of estimating the functional failure probability of the system. Due to their flexibility in nonlinear modelling, ANNs have been shown to provide more reliable estimates than quadratic RSs even when they are trained with very low numbers of data examples (e.g., 20, 30 or 50) from the original T-H model code.

  .,

	i n x } and a vector of output targets y = {y 1 , y 2 , ..., y l , ...,	o n y }, on the basis of a finite (and possibly
	small) set of input/output data examples (i.e., patterns),	train D	=	( {	x	p	,	y	p	) ,	p	=	, 1	, 2	...,	N	train	}

  model uncertainties are associated to the correlations used to calculate the Nusselt numbers and friction factors in the forced, mixed and free convection regimes. The consideration of these uncertainties leads to the definition of a vector x of nine uncertain inputs of

	the model x = { x j	: = j	, 1	, 2	...,	} 9	, assumed described by normal distributions of known means and
	standard deviations (Table 1, Pagani et al., 2005).
						Name	Mean, µ Standard deviation, σ (% of µ)
	Parameter				Power (MW), x 1	18.7	1%
	uncertainty	Pressure (kPa), x 2 Cooler wall temperature (°C), x 3	1650 90	7.5% 5%

epistemic uncertainties are considered in this work. Epistemic parameter uncertainties are associated to the reactor power level, the pressure in the loops after the LOCA and the cooler wall temperature; epistemic

Table 2

 2 , computed on the test set D test by the ANN and quadratic RS models built on data sets D train of different sizes N train = 20, 30, 50, 70, 100; the number of adjustable parameters w * included in the two regression models is also reported for comparison purposes.

		reports the values of the coefficient of determination 2 R and of the RMSE associated to the
	estimates of the hot-and average-channel coolant outlet temperatures hot out T ,	core	and avg core out T , ,
				Artificial Neural Network (ANN)
					R 2			RMSE [°C]
	N train N val	N test	Number of adjustable parameters w*	hot core out, T	avg core out, T	hot core out, T	avg core out, T
	20	20	20	50	0.8937	0.8956	38.5	18.8
	30	20	20	50	0.9140	0.8982	34.7	18.6
	50	20	20	62	0.9822	0.9779	15.8	8.7
	70	20	20	50	0.9891	0.9833	12.4	6.8
	100	20	20	50	0.9897	0.9866	12.0	6.3
				Quadratic Response Surface (RS)
					R 2			RMSE [°C]

respectively

N train N val N test Number of adjustable parameters w* hot core out, T avg core out, T hot core out, T avg core out, T

	20	0	20	55	0.5971	0.7914	75.0	26.6
	30	0	20	55	0.8075	0.9348	51.9	14.8
	50	0	20	55	0.9280	0.9353	31.7	14.6
	70	0	20	55	0.9293	0.9356	31.4	14.3
	100	0	20	55	0.9305	0.9496	31.2	13.1
	Table 2. Coefficient of determination 2 R and RMSE associated to the estimates of the hot-and
	average-channel coolant outlet temperatures hot core out T ,	and avg core out T , , respectively, computed on the test
	set D test of size N test = 20 by the ANN and quadratic RS models built on data sets D train of different
	sizes N train

Q ˆboot Q ˆ.

channel coolant outlet temperature hot core out T , are 0.9897 and 0.9305, respectively, whereas the corresponding RMSEs are 12.0 °C and 31.2 °C, respectively. This result is due to the higher flexibility in modeling complex nonlinear input/output relationships offered by the ANN with respect to the quadratic RS: the ANN structure made of a large number of adaptable connections (i.e., the synapses) among nonlinear operating units (i.e., the neurons) allows fitting complex nonlinear functions with an accuracy which is superior to that of a plain quadratic regression model.

Actually, if the original T-H model is not quadratic (which is often the case in practice), a secondorder polynomial RS cannot be a consistent estimator, i.e., the quadratic RS estimates may never converge to the true values of the original T-H model outputs, even for a very large number of input/output data examples, in the limit for N train → ∞. On the contrary, ANNs have been demonstrated to be universal approximants of continuous nonlinear functions (under mild mathematical conditions) [START_REF] Cybenko | Approximation by superposition of sigmoidal functions[END_REF], i.e., in principle, an ANN model with a properly selected architecture can be a consistent estimator of any continuous nonlinear function, e.g. any nonlinear T-H code simulating the system of interest.

Determination of the 95 th percentiles of the coolant outlet temperatures

For illustration purposes, a configuration with N loops = 3 loops is considered for the passive system of Figure 1. Finally, the computational times associated to the calculation of the BBC point estimates