lable at ScienceDirect

Progress in Nuclear Energy 78 (2015) 36e46

Contents lists avai

Progress in Nuclear Energy

journal homepage: www.elsevier .com/locate/pnucene

Efficient functional reliability estimation for a passive residual heatremoval systemwith subset simulation based on importance sampling

Baosheng Wang a, Dongqing Wang a, Jin Jiang a, b, *, Jianmin Zhang a, Peiwei Sun a

a Department of Nuclear Science and Technology, Xi'an Jiaotong University, Xi'an, Shaanxi 710049, Chinab Department of Electrical & Computer Engineering, The University of Western Ontario, London, Ontario N6A5B9, Canada

a r t i c l e i n f o

Article history:Received 19 May 2014Received in revised form29 July 2014Accepted 30 July 2014Available online

Keywords:Functional reliabilityPassive safety systemReliability estimationImportance samplingSubset simulation

* Corresponding author. Department of Electrical &University of Western Ontario, London, Ontario N6A52111x88320; fax: þ1 519 850 2436.

E-mail addresses:wang.baosheng@stu.xjtu.edu.cn,cn (B. Wang), wang.dongqing@stu.xjtu.edu.cn (D.(J. Jiang), zhangjm@mail.xjtu.edu.cn (J. Zhang), sunpeiw

http://dx.doi.org/10.1016/j.pnucene.2014.07.0430149-1970/© 2014 Elsevier Ltd. All rights reserved.

a b s t r a c t

An innovative reliability analysis approach known as “Subset Simulation based on Importance Sampling”is developed for the efficient estimation of the small functional failure probability of a passive safetysystem. This approach is based on the idea that a small failure probability can be expressed as a productof larger conditional failure probabilities by introducing a proper choice of intermediate failure events.Importance sampling simulation is carried out to generate conditional samples for each intermediatefailure region. This application is illustrated for the functional reliability analysis of a passive residualheat removal system due to epistemic uncertainty parameters. The numerical results demonstrate thehigh level of computational efficiency and excellent computational accuracy by comparison with directMonte Carlo simulation, Importance Sampling simulation and Subset Simulation based on Markov ChainMonte Carlo. The sensitivity, defined as the partial derivative of the failure probability with respect to thedistribution parameter is also discussed, which can help to identify the contribution of each parameterand guide the optimization model.

© 2014 Elsevier Ltd. All rights reserved.

1. Introduction

The expanded consideration of severe accidents, the increasedsafety requirements, and the aim of introducing effective e yettransparent e safety functions lead to growing interest in passivesafety systems for future nuclear reactors. As a result, innovativereactor designs incorporate passive safety features with activesafety or operational functions (Marqu�es et al., 2005). According toan IAEA definition, a passive safety system is either a systemwhichis composed entirely of passive components and structures or asystem which uses active components in a limited way to initiatesubsequent passive operation. Most often, a passive system doesnot need any external input (especially energy) to operate (IAEA,1991). This is why passive safety systems are simple and robust.

Many passive safety systems are based on natural circulations,which have much weaker driving forces than their active counterparts. Therefore, it is important to consider fluid mechanics issues,

Computer Engineering, TheB9, Canada. Tel.: þ1 519 661

wangbaosheng@stu.xjtu.edu.Wang), 04032018@163.comei@mail.xjtu.edu.cn (P. Sun).

as well as disturbances or changes in operating parameters. Insummary, the uncertainties of passive safety systems are usuallyhigher than those in active systems. Two different sources of un-certainties usually exist in safety analysis of passive safety systems:randomness due to intrinsic variability in the actual geometricalproperties, material properties and the initial/boundary conditions,known as aleatory uncertainty and incomplete knowledge due tolack of data on some underlying physical phenomena and translatein uncertainties in the models and parameters used to representthem, known as epistemic uncertainty (Apostolakis, 1990; Zio andPedroni, 2009b, 2011). Because of these uncertainties, there is al-ways a nonzero likelihood that a physical phenomena utilized bythe passive systems fails to perform intended functions eventhough there is no hardware failure. Hence, it is necessary toquantify the reliability of such systems first. The unreliability ofpassive safety systems can have two aspects: malfunctions of sys-tems/components, i.e. hardware failure and absence of intendedphysical phenomena, referred to as functional failure (Burgazzi,2003, 2004; Mathews et al., 2008; Fong et al., 2009; Zio andPedroni, 2009a,b). The present paper mainly focuses on the reli-ability analysis of the functional failure in passive safety systems.

Severalmethodologies havebeendeveloped for the evaluationoffunctional failure probabilities of passive safety systems, known asReliability Evaluation of Passive Safety (REPAS) (D'Auria et al., 2002;

B. Wang et al. / Progress in Nuclear Energy 78 (2015) 36e46 37

Jafari et al., 2003; Zio et al., 2003), and Reliability Methods for Pas-sive Safety (RMPS) (Marqu�es et al., 2005; Bassi andMarqu�es, 2008),respectively. These methods have been applied to residual heatremoval systems in light water reactors (Wang et al., 2013). Similarapproach is used for decay heat removal systems in gas-cooled fastreactors (Pagani et al., 2005; Mackay et al., 2008; Zio and Pedroni,2009a,b) and sodium-cooled fast breeder reactors (Mathews et al.,2008, 2011; Arul et al., 2009, 2010). Among all these methods, aprimary cause for the functional failure is assumed to be arisingmainly from the existence of the uncertainties in the systemmodeland input parameters and consequently, the system cannotaccomplish its required mission even if no hardware failure occurs.In thiswork, the passive safety system ismodeled bya deterministicthermal hydraulic code and the functional failure probability isestimated based on a Monte Carlo (MC) sample simulation whichpropagates the epistemic uncertainties in the model and the nu-merical values of its input parameters.

MC simulation is well known to be robust to the realistic esti-mation of a passive safety system functional failure probability (Zioand Pedroni, 2009b). In practice, the probability of functional fail-ure for a passive safety system can be relatively low. Hence, a largenumber of samples are required to gain a sufficient confidencelevel. Unfortunately, the computational cost is normally prohibi-tively high, if a direct MC simulation (DMCS) is used with a deter-ministic thermal hydraulic model code (Schueller and Pradlwarter,2007; Zio and Pedroni, 2009b; Wang et al., 2013). To reduce thecomputational cost, efficient sampling techniques can be adoptedto perform functional reliability estimations of passive systems.

To improve efficiency, the Subset Simulation (SS) approach,originally developed to estimate the reliability of multidimensionalstructures (Au and Beck, 2001, 2003), is introduced. Structuralreliability problems are naturally formulated within a functionalfailure framework of analysis, because structural systems fail whenthe load exceeds their capacity (Schueller and Pradlwarter, 2007).This makes SS suitable for the application to the functional failurereliability analysis of a passive thermal hydraulic safety system,because a passive system fails to perform its function when de-viations from its expected behavior lead the load imposed on thesystem to exceed its capacity (Bassi and Marqu�es, 2008; Patalanoet al., 2008; Zio and Pedroni, 2009b). The SS method is efficientto perform the reliability analysis in a progressive manner. A set ofintermediate failure events are introduced first, SS separates theoriginal probability space into a sequence of subsets, the smallfailure probabilities can be expressed as a product of large condi-tional failure probabilities. For given conditional probability densityfunction (PDF), Markov Chain Monte Carlo (MCMC) can be used togenerate conditional samples and to estimate the conditionalprobability (Au and Beck, 2001, 2003; Zio and Pedroni, 2009b).However, MCMC simulation relies on certain PDF. Therefore,additional simulations based on a thermal hydraulic code have tobe used, which further increases the computational cost. Moreover,the conditional samples generated by MCMC simulation are typi-cally dependent. These samples are used for statistical averaging asif they are independent and identically distributed (i.i.d.) with somereduction in efficiency (Song et al., 2009). Considering this limita-tion, an improved Subset Simulation method, known as SubsetSimulation based on Importance Sampling (SS-IS) is developed. Theconcept of IS procedure is employed to generate the i.i.d. condi-tional samples in the failure region to effectively calculate theconditional failure probability under specified levels of failureprobabilities. The advantage of this methodology is demonstratedby comparing it to DMCS, IS and SS-MCMC in a functional reliabilityanalysis of a passive residual heat removal system.

A sensitivity analysis, which concerns with ranking of the in-dividual uncertainty parameters according to their relative

contribution on the functional failure probability, has been carriedout. A usual approach is to base the sensitivity analysis on a linearregression method, which is based on the hypothesis of a linearrelation between the response variables and input parameters.This, in case of passive safety systems is often restrictive (IAEA,2005; Mathews et al., 2008). In this case, an alternative approachis applied to identify and rank influential individual uncertaintyparameters based on the sensitivity of the cumulative distributionfunction (CDF) of the functional failure probability. The approachdoesn't assume a linear or other explicit functional relationshipbetween the response and the input parameters, and provide moreinformation than the traditional regression-based methods. Thesensitivity coefficient is expressed as an expectation of the partialderivative of the failure probability with respect to the distributionparameter.

The remainder of paper is organized as follows. A reliabilityanalysis methodology for passive safety systems in terms of theconcept of functional failure is summarized in Section 2. In Section 3,the functional reliability assessment analysis procedure for thepassive residual heat removal system of a 1000 MWe PressurizedWater Reactor (PWR) is carried out. The functional failure proba-bilityestimation bySS-IS and comparisonof resultsDMCS, IS and SS-MCMC is discussed in Section4. The sensitivityanalysis is performedto determine the contributions of the individual uncertain param-eters in Section 5 and some conclusions are given in Section 6.

2. A methodology for functional reliability analysis of passivesafety systems

In reliability analysis of a passive thermal hydraulic safety sys-tem, the probability that the corresponding response variable (e.g.coolant outlet temperature at critical location) exceeds the limitingthreshold value is termed as the functional failure probability. Aprocedure for the evaluation functional failure probability has beenproposed known as RMPS methodology. The organization of themethodology for the evaluation the functional reliability is depic-ted in Fig. 1. The basic steps of the functional reliability analysis ofpassive safety systems are as follows (Marqu�es et al., 2005; Zio andPedroni, 2009a,b; Arul et al., 2010; Wang et al., 2013):

1. Detailed modeling for the passive safety system using deter-ministic thermalehydraulics code.

2. Identification of the uncertainty relevant parameters/variablesin the passive safety system.

3. Quantification of appropriate probability density functions tothese parameters/variables.

4. Evaluation of the failure criteria for the passive system on basisof its function and failure modes.

5. Propagation of uncertainties through the deterministic thermalhydraulic code by using MC simulation.

6. Quantification of functional failure probability, LetX ¼ fx1; x2;…; xng be the vector of the uncertainty parameters,Y(X) be the indicator of the performance of passive system, AY bethe threshold value defining the failure criterion. By introducinga variable called Limit State Function (LSF) as gðXÞ ¼ AY � YðXÞ,failure occurs if gðXÞ<0. The system failure probability P(F) canbe evaluated by the following integral:PðFÞ ¼ R / R

gðXÞ<0fXðXÞdx1/dxn, where fX(X) is the jointprobability density function, and

7. Determination of the contributions from each uncertaintyparameter via parametric sensitivity analysis.

Though this has been the general framework structure proposedfor the passive systems reliability estimation, there have beenseveral studies especially in the field of the probabilistic safety

Fig. 1. Organization of the functional reliability analysis methodology.

B. Wang et al. / Progress in Nuclear Energy 78 (2015) 36e4638

assessment to improve the efficiency and the accuracy of the reli-ability analysis. In practice, the DMCS requires considerablecomputational efforts. This work attempts to improve the compu-tational efficiency and accuracy for the evaluation functional failureprobability of a passive residual heat removal system of a1000 MWe PWR design by including modeling of the passive decayheat removal system, uncertainty propagation, functional failureprobability estimation and uncertainty sensitivity analysis.

Fig. 2. A sketch diagram of passive residual heat removal system.

3. Functional reliability analysis of a passive residual heatsystem

3.1. System description

The layout of the primary coolant system components and thePRHRS of the 1000 MWe PWR are shown in Fig. 2. The PRHRS isdesigned to provide emergency core cooling following postulateddesign-basis events, which consists of a passive residual heatexchanger, normally open valves, isolation valves, relevant pipesand a water cooled tank. The motor-operated valve in the PRHRSHX inlet line is normally open during normal plant operation. Thisvalve receives an actuation signal to confirm that it is open in theevent of an accident. The two multiple air-operated valves in thePRHRS HX outlet line are normally closed and open upon receipt ofan air pressure signal (Wang et al., 2012). The passive residual heatremoval exchanger consists of inlet and outlet channel headsconnected together by vertical C-shaped tubes. The tubes aresupported inside the water cooling tank with a very large size,which locates up to the reactor core and inside the containment(Wang et al., 2013).

In normal operating conditions, the heat exchanger is filled withwater and isolated by a normally closed valve and an isolationvalve. The PRHRS provides primary coolant heat removal to thewater cooling tank via a natural circulation loop under stationblackout accident. The hot primary coolant rises through the PRHRS

inlet line attached to one of the hot legs. The hot primary coolantenters the tube sheet in the top header of the PRHRS heatexchanger and then the coolant flows into the PRHRS heatexchanger tubes. The cold primary coolant returns to the primaryloop via the PRHRS outline line that is connected to the steamgenerator lower head (Wang et al., 2013). In the event of the stationblackout accident, the protection system makes the reactorscrammed, the turbine tripped and the main steam valves closed.At the same time, the coolant pumps do not work but still coastdown once the ac power is lost and the secondary feed water is alsounavailable. The forced circulation in the primary loop turns intonatural circulation. The PRHRS HX is designed to remove the decayheat during its operation, in conjunctionwith available inventory insteam generators, provides reactor coolant systems cooling and

B. Wang et al. / Progress in Nuclear Energy 78 (2015) 36e46 39

prevents water relief through the pressurizer safety valves.Consequently, the residual decay heat of the core is passivelyremoved to the ultimate heat sink by three interknitted naturalcirculation loops, respectively.

3.2. System thermal hydraulic mathematical model

The mathematic model has been established to simulate thedynamic characteristics of the PRHRS by given a set of boundaryand initial conditions and system major structural parameters.This model can be used to propagate the uncertainties associatedwith the model and input parameters and to carry out sensitivityanalysis. A complete model including the reactor core, pressur-izer, steam generators, reactor coolant pumps, PRHRS heatexchanger, water cooling tank, etc. has been modeled by one-dimensional dynamics simulation code PRHRSDSC (Passive Re-sidual Heat Removal System Dynamics Simulation Code) (Wanget al., 2012). Fig. 3 schematically shows the nodalization of thesystem.

The model predictions have been compared with those ofthermalehydraulic analysis code, LOFTRAN developed by West-inghouse (Burnett et al., 1984; Westinghouse, 2004). The

Fig. 3. Nodalization of the passive

comparison of results shows that the system analysis code,PRHRSDSC, has the capability to adequately predict the systembehavior.

3.3. Identification and quantification of uncertainties

In this present analysis, only epistemic uncertainties areconsidered. Model uncertainty derives from the simplifiedapproximation of the real thermalehydraulic models. It rangesfrom the use of empirical correlations to simulate the thermal-ehydraulic physical performance, which are subject to predictionserrors of approximation. Also, some input parameters exist in someuncertainties, such as power level, pressure, cooler temperatureand material thermal conductivity, due both to the errors in theirmeasurement and fluctuations during the operation (Pagani et al.,2005).

A tentative list of fifteen uncertainties and their probabilitydistributions considered in this analysis are summarized in Table 1(Wang et al., 2013). The input parameter uncertainties are associ-ated to the pressure in primary coolant system loop, P, the reactorresidual decay heat power, Qu, the fuel pin thermal conductivity, lf,the fluid temperature in the cooling tank, TCT, the pressure drop

residual heat removal system.

Table 1Input parameters and model uncertainties together with their probability distributions.

Parameter Distribution ma Rangeb sc Remarks

Parameter uncertainty P/MPa Normal 15.5 14.4e16.6 0.67 Pressure in the primary coolant system loopQu/MW Normal 220 214.9e225.1 3.10 Reactor residual decay heat powerlf/W(m �C)�1 Normal 3.0 2.0e4.0 0.61 Fuel pin thermal conductivityTCT/�C Normal 50.0 41.6e56.2 4.46 Fluid temperature in the cooling tankKloc/(kg m)�1 Normal 1.7 1.45e1.96 0.16 Pressure drop coefficientsd

Hg/W(m2 �C)�1 Normal 5678 5157e6199 317 Gas gap conductance between cladding and fuel finld/W(m �C)�1 Normal 14 11.9e16.1 1.28 Cladding thermal conductivityRi/(m2 K/W) Normal 5.77e�04 (4.90e6.64)e�04 2.89e�05 Thermal resistance at the PRHRS HX inner tube surfaceRo/(m2 K/W) Normal 5.77e�04 (4.90e6.64)e�04 2.89e�05 Thermal resistance at the PRHRS HX outer tube surface

Model uncertainty(error factor, z)

z1 Normal 1.0 0.9e1.1 0.06 Heat transfer coefficient in single-phase convection regimez2 Normal 1.0 0.75e1.25 0.15 Heat transfer coefficient in pool boiling regimez3 Normal 1.0 0.8e1.2 0.12 Heat transfer coefficient in forced convection boilingz4 Normal 1.0 0.7e1.3 0.18 Heat transfer coefficient in natural convection regimez5 Normal 1.0 0.95e1.05 0.03 Friction factor in single-phase flow regimez6 Normal 1.0 0.85e1.15 0.09 Friction factor in two-phase flow regime

a The nominal value is from the design document or calculated by the thermal hydraulic code.b The range assigned 95% confidence boundary of the nominal value.c The standard deviation is estimated by s¼ jXR � mj/Z0.95 where Z0.95¼ 1.6449 is a distance of left-side confidence level 95% and XR is a range value and m is a nominal value.d The pressure drop coefficient, Kloc, is defined as Kloc ¼ (k/2rA2), where k is the local loss coefficient, r is the density, A is the area.

B. Wang et al. / Progress in Nuclear Energy 78 (2015) 36e4640

coefficients, Kloc, the Gas gap conductance between cladding andfuel fin, Hg, the cladding thermal conductivity, ld, the thermalresistance at the PRHRS HX inner tube surface, Ri, and the thermalresistance at the PRHRS HX outer tube surface, Ro. Model un-certainties are associated to the empirical correlations used tocalculate the heat transfer coefficients and friction factors. In thiswork, the PDFs of uncertainties are assumed to be normal distri-butions with the mean values correspond to the nominal values.The standard deviation can be considered as s ¼ jXR � mj/Z0.95 (Hanand Yang, 2010).

3.4. Failure criteria

The PRHRS is considered to fail to provide its safety functionwhen the coolant temperature at the reactor core outlet goesbeyond the values of 350 �C (IAEA, 2005; Wang et al., 2013). Thisvalue is expected to avoid the occurrence of heat transfer deterio-ration between the fuel pin or the coolant and insufficient decayheat residual removal, which can lead to the coolant boiling or theflow instability in the primary coolant system (Yuan et al., 2010).

3.5. Subset simulation based on importance sampling

3.5.1. Basic idea of subset simulation and limitation of subsetsimulation based on MCMC

Given a failure event F, let F1IF2I/IFm ¼ F be a decreasingsequence of failure events so that Fk ¼ ∩k

i¼1Fi, k ¼ 1, 2, …, m. Ac-cording to the multiplication theorem and the definition of con-ditional probability, the failure probability P(F) can be written as:

PðFÞ¼PðFmÞ¼P�Fm

���� ∩m�1

i¼1Fi

�P�

∩m�1

i¼1Fi

�¼/¼PðF1Þ

Ym�1

i¼1

PðFiþ1jFiÞ

(1)

The idea of SS is to calculate the failure probability P(F) byestimating P(F1) and the conditional probabilitiesfPðFiþ1jFiÞ : i¼1;…;m�1g. Observe that, even if P(F) is small, bychoosing m and fFi : i¼1;…;m�1g appropriately, the conditionalprobabilities can still be made sufficiently large. P(F1) can be esti-mated by DMCS. Similarly, the conditional failure probabilities canbe estimated by drawing the samples according to the conditionaldistribution of X given that it lies in Fi, that is the conditional PDFqðXjFiÞ¼ fXðXÞIFi ðXÞ=PðFiÞ. And IFi ð$Þ is an indicator function, such as

IFi ðXÞ¼1, if X2Fi and IFi ðXÞ¼0, otherwise. In general, the task ofefficiently simulating conditional samples is not trivial by DMCS.

In the original SS procedure, MCMC simulation was used toobtain conditional samples of the conditional PDF q XjFið Þ in thefailure region Fi. However, the conditional samples generated byMCMC are dependent in general. These samples are used for sta-tistical averaging as if they are i.i.d. with some reduction in effi-ciency. The variance of the failure probability estimator cannot beevaluated by an approximate value but only by an upper limit (Songet al., 2009). The concept of importance sampling procedure isemployed for generating conditional samples to efficiently calcu-late the conditional failure probability.

3.5.2. Generation of conditional samples with importance samplingand failure probability

Since it is not efficient for the DMCS to generate conditionalsamples, and the correlation of MCMC samples reduces thecomputational efficiency, an alternative procedure by introducingIS density function hiðXÞ is used to generate conditional samples asfollows

PðFiþ1jFiÞ ¼Z

/

ZFi

qðXjFiÞdX ¼Z

/

ZU

IFi ðXÞqðXjFiÞdX

¼Z

/

ZU

IFiðXÞqðXjFiÞhiðXÞ

hiðXÞdX; i ¼ 1;2;…;m� 1

(2)

where U denotes the whole variables space, hiðXÞ is the introducedIS density function corresponding to the ith intermediate failureregion gðXÞ<0, whose probability density center point is selectedas the design point X*

i .By sampling from the IS density function hiðXÞ, the conditional

failure probability can be estimated by the information of thesesamples. The SS-IS process is given as follows:

1. Generate N1 ¼ N independent and identically distributed sam-ples fXð1Þ

k : k ¼ 1;2;…N1g of PDF fXðXÞ by DMCS.2. Compute the corresponding identified safety response variables

fyðXð1Þk Þ : k ¼ 1;2;…;N1g. Denote M1 ¼ N1 for the ease of

description in the following text.3. Choose the first intermediate threshold value A1 as the (1 � p0)

M1th response variables in the increasing list of M1 response

B. Wang et al. / Progress in Nuclear Energy 78 (2015) 36e46 41

value. And define the first intermediate failure event asF1 ¼ fX : g1ðXÞ ¼ A1 � yðXÞ<0g. Thus, the failure probabilityP1 ¼ P(F1) can be estimated as p0.

4. With these conditional samples which locate in the failure re-gion Fi�1 ði ¼ 2;3;…;mÞ, take the maximum PDF as the designpoint of gi�1ðXÞ ¼ 0. The IS density function hiðXÞ is introducedby locating the probability density center at the design point.Draw Ni samples by means of the importance sampling densityfunction hiðXÞ, using Mi to denote the number of conditionalsamples which lie in the failure region Fi�1.

5. Compute the response variable fyðXðiÞk Þ : k ¼ 1;2;…;Mig of the

Mi samples generated by hiðXÞ, which lie in Fi�1. Choose theintermediate threshold value Ai as the ð1� p0ÞMith responsevariables in the increasing lists of Mi response value. Thus, theestimator of conditional failure probability PðFiþ1jFiÞ can beobtained as: � ðiÞ� � ðiÞ�� �

bPðFiþ1jFiÞ ¼

1Ni

XNi

k¼1

IFi Xk q Xk �Fihi�XðiÞk

� ; i ¼ 1;2;…;m� 1 (3)

And the failure probability P(Fi) can be estimated frombPðFiÞ ¼ ∏ij¼1bPj.

6. Return to step 4 above until the mth chosen threshold valueAm � A. Then, identify the target failure probability levelbPðFÞ ¼ ∏m

i¼1bPðFiÞ.

The SS-IS procedure is illustrated in Fig. 4 for simulation Level0 with DMCS and Level 1with IS procedure. Firstly, we simulate Nsamples by DMCS. The subscript ‘0’ here denotes that the samplescorrespond to ‘Conditional Level 0’ Perform N1 system analyses toobtain the corresponding response values (Fig. 4(a)). The first in-termediate threshold value A1 is adaptively chosen as the [(1 � p0)N]th value. So that the sample estimate for P(Y > A1) is always equal

Fig. 4. Illustration of Subset Simulation based on Importance Sampling procedure: (a) Levethreshold level A1; (c) Level 1: Importance Sampling Monte Carlo simulation; (d) Level 1: a

to p0 (Fig. 4(b)). Due to the choice of A1, there are p0M1 sampleswhose response Y lies in F1 ¼ {Y > A1}. These are samples at ‘Con-ditional Level 1’ and are condition on F1, distributed as p(�jF1). Withthe density function h1(X), we draw a total of N conditional samplesagain at Conditional Level 1 (Fig. 4(c)). The intermediate thresholdvalue A2 is then adaptively chosen as the [(1 � p0)N]th value, and itdefines the next intermediate failure event F2 ¼ {Y > A2}(Fig. 4(d)).

4. Functional failure probability estimation and comparisonof results

4.1. Verification and implementation of SS-IS

In this work, the intermediate threshold values are chosenadaptively in such away that the estimated conditional probabilitiesare equal to a fixed value p0 (p0 ¼ 0.1 has been used). In the appli-cation of SS-IS for the passive residual heat removal system, theconditional intermediate failure events are chosen such that a con-ditional failure probability of p0¼ 0.1 is attained all simulation levels.

Fig. 5 shows the scattering of samples for the coolant outlettemperature at different levels. Firstly, 1500 samples are generatedby DMCS, i.e., they are independent and identically distributedsamples generated according to p($). Perform these 1500 sampleswith the dynamics simulation code PRHRSDSC to obtain the cor-responding temperature variables. The first intermediate thresholdvalue A1 ¼ 331.551 �C (red solid line) (in the web version), which isless than the failure criterion value A ¼ 350 �C (green dashed line)(in the web version) and is adaptively chosen as the 1350th value inthe ascending list of the corresponding temperature variables(Fig. 5(a)). Due to the choice of A1, there are 150 samples whosetemperature variables is greater than A1, and hence lie inF1 ¼ {y1 > 331.551 �C}. There are conditional samples at conditionallevel 1, distributed as p($jF1). Starting from these conditionalsamples, IS density function simulation is used to simulate another

l 0: Direct Monte Carlo simulation; (b) Level 0: adaptive selection of first intermediatedaptive selection of second intermediate threshold level A2.

Fig. 5. The coolant outlet temperature at different simulation conditional levels 0, 1, 2, 3, respectively.

B. Wang et al. / Progress in Nuclear Energy 78 (2015) 36e4642

1500 samples and then the intermediate threshold valueA2 ¼ 342.264 �C, which is also less than the failure criterion value of350 �C (Fig. 5(b)). Repeating this process, one can generate condi-tional samples for higher conditional levels until the target failurecriterion. In this analysis, when the conditional level reaches level 3(Fig. 5(d)), the intermediate threshold value A3 ¼ 350.007 �C isgreater than the failure criterion. Fig. 5 clearly indicates that as thesimulation level increases, that is, when the failure becomes moresevere, the samples of the passive residual heat removal systemperformance shift quickly toward failure criterion. This “largemagnitude, small samples” regime with respect to the small func-tional failure probability estimation is achieved at a much highercomputational effort.

The statistical properties of each 1500 conditional samples arereported in Table 2. It can be seen that the means of each consid-eration level samples are gradually increasing and drifting towardthe failure threshold value. While the standard deviations aregradually decreasing, which indicates a good convergence.

4.2. Functional failure probability estimation and comparison ofresults

In this work, SS-IS was compared to DMCS, IS and SS-MCMC forthe estimation of functional failure probability for passive residualheat removal system, respectively.

Table 2Results of the coolant outlet temperature with SS-IS at different conditional levels.

SC Mean/�C SD/�C Lower/�C Upper/�C Level/�C

0e1500 326.732 6.37 307.867 350.061 331.5111500e3000 336.276 5.43 320.533 350.004 342.2643000e4500 342.909 4.07 328.378 350.042 347.5194500e6000 348.776 2.57 334.544 350.0312 350.007

Fig. 6 depicts the functional failure probability convergencewiththe sampling simulation numbers for four different runs of DMCS,IS, SS-MCMC and SS-IS, respectively. It can be seen that the func-tional failure probability estimators are less sensitive to the numberfor SS-IS (red symbol line) (in the web version) with the simulationnumber increasing to 6000. However, the outcomes still have thefluctuation even the simulations number arriving at 9800 for SS-MCMC (cyan symbol line) (in the web version). While the simula-tion number must reach 50,000 (blue symbol line) (in the webversion) for IS and 100,000 (black symbol line) for DMCS, respec-tively, the convergence of failure probability can be accordant. Fig. 6

Fig. 6. Functional failure probability convergence for different methods with thesampling numbers increase.

B. Wang et al. / Progress in Nuclear Energy 78 (2015) 36e46 43

shows that SS-IS has higher convergence rate as compared withother methods. In this work, for our case, SS-IS has been drawnwith a total of NT ¼ 6000 simulations for the estimation of thefunctional failure probability. Meanwhile, DMCS with a total ofNT ¼ 100,000 simulations, SS-MCMC with a total of NT ¼ 9800simulations and IS with a total of NT ¼ 50,000 simulations havebeen drawn to estimate the functional failure probabilities,respectively.

Fig. 7 presents and compares the probability density functions(PDFs) and cumulative probability functions (CDFs), respectively,for the coolant outlet temperature calculated with a total ofNT ¼ 100,000 simulations with the dynamics simulation codePRHRSDSC (black solid lines). The same figures also show the PDFsand CDFs built with a total of NT ¼ 9800 simulations by SS-MCMC(cyan solid lines) (in the web version) and a total of NT ¼ 50,000simulations by IS (blue solid lines) (in the web version), respec-tively. It is assumed that the results estimated by DMCS with a totalof NT ¼ 100,000 simulations are treated as a reference by com-parison. It can be seen from Fig. 7 that the results estimated by SS-ISwith a total of NT ¼ 6000 simulations almost exactly match inaccordance with the reference values obtained by DMCS but this iscarried out with the simulations number lower than 16 times.

A numerical index called as the unitary coefficient of variation(c.o.v.), D, which is independent of the total number NT samples isintroduced (Zio and Pedroni, 2009a), to compare the computational

Fig. 7. (a) The coolant outlet temperature empirical PDFs and (b) the coolant outlettemperature empirical CDFs.

efficiency of different methods for the same failure probability. Thecoefficient of variation, c.o.v., is estimated as the ratio of the stan-dard deviation of failure probability to its expectation. The unitaryc.o.v. D is defined as:

D ¼ dhbPðFÞi ffiffiffiffiffiffi

NTp

¼

ffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiVar

hbPðFÞirEhbPðFÞi ¼

shbPðFÞi

EhbPðFÞi

ffiffiffiffiffiffiNT

p(4)

where d½bPðFÞ� is the c.o.v. of bPðFÞ. It is considered that the lower thevalue of D is and the higher the computational efficiency is.

Then, in order to compare the computational accuracy of fourdifferent methods, another numerical index known as the relativeerror x of the failure probability estimator is introduced as:

x ¼�����bPðFÞ � PðFÞ

PðFÞ

������ 100% (5)

where P(F) is the real value and bPðFÞ is the estimator. Notice that thesmaller the value of the relative error is, the higher the computa-tional accuracy is.

Table 3 shows the values of the number of simulations NT, thefunctional failure probability estimators bPðFÞ, the c.o.v. of theprobability bPðFÞ, the unitary c.o.v.D, the relative error x and the CPUcomputational time t, respectively. In Column 3, the estimatedfunctional failure probability for the failure criterion of 350 �C ob-tained by DMCS is considered as a reference value, the value of3.410 � 10�3. In Table 3, Column 2, the simulations are selected dueto the convergence rates of different methods shown in Fig. 6. InTable 3, Column 5, it can be seen that the unitary c.o.v. value ob-tained by SS-IS estimator is the minimum, which is about 10 timeslower than that of DMCS estimator, 6 times lower than that of ISestimator and 2.5 times lower than that of SS-MCMC estimator,respectively. Thus, as compared with the other methods, SS-ISprovides an increase in computational efficiency of the estimationof the passive system functional failure probability only using therelatively small number of sampling simulations. In Column 6, it isfound that the functional failure probability estimated by SS-IS is ingood agreement with the reference result calculated by DMCS. Also,in Table 3, Column 7, one can see that for small magnitude ofprobabilities, the DMCS estimator is generally very expensive inCPU time with the dynamics simulation code PRHRSDSC, which isabout 12 times as long as that of SS-IS estimator. In conclusion, IS-SS procedure provides not only a higher level computing efficiencybut also a more excellent level computing accuracy by comparisonwith other methods for the small functional failure probability ofthe passive safety system.

5. Sensitivity analysis

In this work, the sensitivity of the passive residual heat removalsystem performance to the uncertainty parameters is defined as thepartial derivative of the functional failure probability with respect

Table 3Results comparison of computational efficiency and accuracy with differentmethods.

Methods Number ofsimulations,NT

Failureprobability,P(F)

c.o.v. D Relativeerror, x

t (s)

DMCS 100,000 3.410 � 10�3 0.05406 17.09 e 174,844IS 50,000 3.125 � 10�3 0.04548 10.17 8.37% 117,471SS-MCMC 9800 3.057 � 10�3 0.04168 4.13 10.36% 40,199SS-IS 6000 3.315 � 10�3 0.02173 1.68 2.79% 14,656

Fig. 8. Normalized sensitivity coefficients of the input parameters.

B. Wang et al. / Progress in Nuclear Energy 78 (2015) 36e4644

to the distribution parameter of the basic random variable. Thederivatives are statistically estimated from the samples generatedby IS density function and used to identify and rank the influentialuncertainty parameters affecting the performance of the passivesystem. As stated above, the sensitivity can be formulated as:

vPðFÞvqXk

¼Z

/

ZU

vfXðXÞvqXk

dX ¼Z

/

ZU

Pf vfXðXÞfXðXÞvqXk

�fXðXÞPðFÞ

�dX

¼ E�PðFÞvfXðXÞfXðXÞvqXk

U

(6)

where qXkdenotes the mean mXk

or standard deviation sXkof the

input parameters. The partial derivative represents the sensitivity,which is the change in probability due to the change in a statisticalparameter such as mean or standard deviation characterizing thedistribution function of the uncertainty parameters. The compu-tational procedure is presented in Appendix A in detail.

In this work, it is introduced two probabilistic sensitivity co-efficients: the mean sensitivity Smk

and the standard deviation Ssk ,which are defined as (Mohanty and Wu, 2007):

Smk ¼�vPðFÞvmXk

��sXkPðFÞ

�

Ssk ¼�vPðFÞvsXk

��sXkPðFÞ

� (7)

where mXkand sXk

are the mean and the standard deviation of therandom variable Xk, respectively. In Eq. (7), the standard deviationis used as a normalization factor to make the sensitivity coefficientsmeasures dimensionless and more appropriate for variablesranking.

Table 4Results of the simulationsmeans and standard deviations (SD) of the estimator failure probsimulations and DMCS with a total of NT ¼ 100,000 simulations, respectively, for (i) oriuncertainty parameters model with the most sensitive parameters as shown in Fig. 8.

Methods Numbers of simulations, NT Original model-average 50 runs

Means SD D

SS-IS 6000 3.319 � 10�3 7.027 � 10�5 1.6DMCS 100,000 3.414 � 10�3 0.185 � 10�3 17SS-ISa 6000 e e e

a Simulations without the 8 most sensitive parameters as depicted in Fig. 8.b Simulations without these insensitive parameters as depicted in Fig. 8.

The normalized sensitivity coefficients (NSC) of the input un-certainty parameters for the response coolant outlet temperatureare given in Fig. 8. It can be seen that the reactor residual decay heatpower, Qu, is strongly sensitive to the performance of the passiveresidual heat removal system, which is mainly because it acts asheat source for natural circulation and directly determines themaximum coolant outlet temperature. The major contributors tothe failure probability in order are the pressure drop coefficient,Kloc, the correlation error on the heat transfer coefficient in the subcooling boiling regime, z2, the fluid temperature in the cooling tank,TCT, the correlation error on the heat transfer coefficient in thesaturated boiling regime, z3, the pressure in the primary coolantsystem loop, P, the correlation errors in the friction factor, z5, andthe correlation error on the heat transfer coefficient in the single-phase forced convection regime, z1, respectively. These uncer-tainty parameters affecting the passive system response perfor-mance are highly sensitive to functional failure among others. Also,the normalized sensitivity coefficients can reflect the significance ofthe distribution parameters with respect to the functional failureprobability. The sign of the sensitivity estimator implies the influ-ential tendency of the distribution parameter. When vPf =vm isnegative, it indicates that the increase of the mean value of theuncertainty parameters leads to the decrease of the functionalfailure probability. It is observed from Fig. 8 that the mean value ofthe parameters P, lf, Hg, ld, z1, z2, z3 and z4 have negative influenceon the functional failure probability, i.e. the functional failureprobability reduces with the increase in mean values of these un-certainty parameters.

One can find the important uncertainty parameters and screenthese parameters in accordance with the ranking sensitivity co-efficients. It is recommended that the uncertainty parameter canbe identified as an invariant variable when the NSC value is be-tween positive and negative 0.05, referred as the insensitive areaas shown in Fig. 8. In this analysis, we renewedly selected theeight most sensitive uncertainty parameters as the input vari-ables. Consequently, the fifteen input parameters model can besimplified into a just eight input parameters model. This isconductive to improving the computational efficiency of func-tional reliability analysis due to the reducing dimensions of theuncertainty parameters. And the benefit can be demonstrated bycomparison with the original uncertainty parameters modelshown in Table 4. It can be seen that the functional failureprobability mean value computed by the simplified uncertaintyparameters model is in close proximity to the original model.However, the computational efficiency is higher than that of theoriginal model in both terms of the unitary coefficient of varianceand the CPU time.

6. Conclusions

In this paper, the functional failure analysis of a passive re-sidual heat removal system is carried out by including the system

ability, theD and the CPU time, obtained by 50 runs of SS-IS with a total ofNT¼ 6000ginal mathematical uncertainty parameters model and (ii) simplified mathematical

Simplified model-average 50 runsb

tcputime (s) Means SD D tcputime (s)

4 14,649 3.276 � 10�3 5.117 � 10�5 1.21 6852.17 174,659 3.334 � 10�3 0.106 � 10�3 10.06 82,569

e 1.426 � 10�4 2.099 � 10�6 1.14 6423

B. Wang et al. / Progress in Nuclear Energy 78 (2015) 36e46 45

modeling, uncertainty propagation, functional failure probabilityestimation and sensitivity analysis. Functional failure probabilityis calculated by means of an improved subset simulation basedon importance sampling simulation. The probability of functionalfailure estimated is about 3.319 � 10�3. The numerical resultsdemonstrate the high computational efficiency and excellentcomputational accuracy using this method by comparison withthe DMCS, IS and SS-MCMC methods. Sensitivity analysis is car-ried out to identify the relative contribution for each parameteraffecting the passive system performance and results are pre-sented. It is found that the uncertainty in pressure in the primarycoolant system loop, reactor residual decay heat power, pressuredrop coefficients, fluid temperature in the cooling tank and themodel error factor on the heat transfer coefficient in pool boilingregime and in forced convection boiling regime are highly moresensitive to functional failure among others. This paper devotesto analyzing the functional reliability for the passive system byuse of the improved SS method and uses the result to investigatethe effects of various uncertainty parameters on theperformance.

Acknowledgment

The work presented in this paper is supported by NationalNatural Science Foundation of China (NSFC) No. 61174110.

Appendix A. Sensitivity computational procedure

Sensitivity is defined as the partial derivative of the failureprobability with respect to the distribution parameter of the basicrandom variable. As stated above, the sensitivity can be formulatedas (Song et al., 2009)

vPðFÞvqXk

¼Z

/

ZU

vfXðXÞvqXk

dX ¼Z

/

ZU

Pf vfXðXÞfXðXÞvqXk

�fXðXÞPðFÞ

�dX

¼ E�PðFÞvfXðXÞfXðXÞvqXk

U

(B.1)

On the basis of reliability analysis of SS-IS, the sensitivity mea-sure of the failure probability bPðFÞ is transformed into a set ofconditional failure probabilities Pi (i ¼ 1, 2, …, m). By using of theconditional samples generated by IS density function, the proce-dure is established to estimate the reliability sensitivity measuresof the conditional failure probabilities.

Based on PðFÞ ¼Qmi¼1Pi, the partial derivative of functional

failure probability with respect to the distribution parameter qXk

(the mean mX ior the standard deviation sX i

) can be formulated as

vPðFÞvqXk

¼Xmi¼1

PðFÞPi

vPivqXk

(B.2)

According to P1 ¼ R / RF1 fXðXÞdX and Eq. (B.2), the sensitivity can

be written as

vPðFÞvqXk

¼ PðFÞP1

Z/

ZU

IF1ðXÞfXðXÞ

vfXðXÞvqXk

fXðXÞdX

þXmi¼2

PðFÞP1

Z/

ZU

IFi ðXÞhiðXÞ

vqðXjFi�1ÞvqXk

hiðXÞdX (B.3)

Then, Eq. (B.3) can be transformed by themathematical expectationas

vPðFÞvqXk

¼ PðFÞP1

E�IF1ðXÞfXðXÞ

vfXðXÞvqXk

þXmi¼2

PðFÞP1

E�IFi ðXÞhiðXÞ

vqðXjFi�1ÞvqXk

(B.4)

With the samples, the sensitivity estimators of the conditionalfailure probability can be obtained as

vbPi

vqXk

¼ 1Ni

XNi

j¼1

24IFi�XðiÞj

�hi�XðiÞj

� vq�XðiÞj

���Fi�1

�vqXk

hi�XðiÞj

�35 (B.5)

Substituting qðXjFi�1Þ ¼ IFi�1ðXÞfXðXÞ=PðFi�1Þ into Eq. (B.5), the

following equation can be obtained as

vbPi

vqXk

¼ 1Yi�1

q¼1

Pq

1Ni

XNi

j¼1

24IFi�XðiÞj

�hi�XðiÞj

�0@vq

�XðiÞj

���Fi�1

�vqXk

�Xi�1

q¼1

fX�XðiÞj

�Pq

vPqvqXk

1A35(B.6)

Since the samples drawn by IS simulation are i.i.d., the sensi-tivity estimators of the conditional failure probabilities can beassumed as independent ones. Assume that the estimators of Pi areconstants in the sensitivity estimation. The variance of the reli-ability sensitivity estimator can be derived approximately

Var

vbPðFÞvqXk

!¼Xmi¼1

Var

bPðFÞbPi

vbPi

vqXk

!(B.7)

The coefficient of variation (Cov) is the ratio of the standarddeviation as the mean value of the estimator. Since it reflects therelatively dispensability of the estimator, it can compare theastringency of different numerical simulations very well. The co-efficient of variation of is given by

Cov

vbPðFÞvqXk

!¼������ffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiVar

vbPðFÞvqXk

!vuut , vbPðFÞvqXk

!������ (B.8)

References

Apostolakis, G.E., 1990. The concept of probability in safety assessment of techno-logical system. Science 250, 1359.

Arul, A.J., Iyer, N.K., Velusamy, K., 2009. Adjoint operator approach to functionalreliability analysis of passive fluid dynamical systems. Reliab. Eng. Syst. Saf. 94,1917e1926.

Arul, A.J., Iyer, N.K., Velusamy, K., 2010. Efficient reliability estimate of passivethermal hydraulic safety system with automatic differentiation. Nucl. Eng. Des.240, 2768e2778.

Au, S.K., Beck, J.L., 2001. Estimation of small failure probabilities in high dimensionsby subset simulation. Probabilist. Eng. Mech. 16, 263e277.

Au, S.K., Beck, J.L., 2003. Subset simulation and its application to seismic risk basedon dynamic analysis. J. Eng. Mech. 129 (8), 1e17.

Bassi, C., Marqu�es, M., 2008. Reliability assessment of 2400 MWth gas-cooled fastreactor natural circulation decay heat removal in pressurized situations. Sci.Technol. Nucl. Install 2008. Special Issue “Natural Circulation in Nuclear ReactorSystems”, Hindawi Publishing Corporation, Paper ID 287376, 16 pages.

Burgazzi, L., 2003. Reliability evaluation of passive systems through functionalreliability assessment. Nucl. Technol. 144, 145e157.

Burgazzi, L., 2004. Evaluation of uncertainties related to passive systems perfor-mance. Nucl. Eng. Des. 230, 93e106.

Burnett, T.W.T., et al., 1984. LOFTRAN Code Description, WCAP-7907-P-A (Pro-prietary) and WCAP-7907-A (Nonproprietary).

D'Auria, F., Bianchi, F., Burgazzi, L., Ricotti, M.E., 2002. The REPAS study: reliabilityevaluation of passive safety systems. In: Proceedings of the 10th InternationalConference on Nuclear Engineering, ICONE 10-22414, Arlington, VA, USA, April14e18.

B. Wang et al. / Progress in Nuclear Energy 78 (2015) 36e4646

Fong, C.J., Apostolakis, G.E., Langewish, D.R., Hejzlar, P., Todreas, N.E., Driscoll, M.J.,2009. Reliability analysis of a passive cooling system using a response surfacewith an application to the flexible conversion ratio reactor. Nucl. Eng. Des. 239(12), 2660e2671.

Han, S.J., Yang, J.E., 2010. A quantitative evaluation of reliability of passives withinprobabilistic safety assessment framework for VHTR. Ann. Nucl. Energy 37,345e358.

IAEA, 1991. Safety Related Terms for Advanced Nuclear Plant. IAEA (TECDOC-626).

IAEA, 2005. Natural Circulation in Water Cooled Nuclear Power Plants PhenomenaModels, and Methodology for System Reliability Assessment. IAEA (TEC-DOC-1474).

Jafari, J., D'Auria, F., Kazeminejad, H., Davilu, H., 2003. Reliability evaluation ofnatural circulation system. Nucl. Eng. Des. 224, 79e104.

Mackay, F.J., Apostolakis, G.E., Hejzlar, P., 2008. Incorporating reliability analysis intothe design of passive cooling systems with an application to a gas-cooledreactor. Nucl. Eng. Des. 238 (1), 217e228.

Marqu�es, M., Pignatel, J.F., Saignes, P., D'Auria, F., Burgazzi, L., Müller, C.,BoladoLavin, R., Kirchsteiger, C., La Lumia, V., Ivanov, I., 2005. Methodology forthe reliability evaluation of a passive system and its integration into a proba-bilistic safety assessment. Nucl. Eng. Des. 235, 2612e2631.

Mathews, T.S., Ramakrishnan, M., Parthasarathy, U., Arul, A.J., Kumar, C.S., 2008.Functional reliability analysis of safety grade decay heat removal system ofIndian 500 MWe PFBR. Nucl. Eng. Des. 238, 2369e2376.

Mathews, T.S., Arul, A.J., Parthasarathy, U., Kumar, C.S., 2011. Passive system reli-ability analysis using response conditioning method with an application tofailure frequency estimation of decay heat removal of PFBR. Nucl. Eng. Des. 241(6), 2257e2270.

Mohanty, S., Wu, Y.T., 2007. Variable screening and ranking using sampling-basedsensitivity analysis. Reliab. Eng. Saf. Syst. 91, 634e647.

Pagani, L., Apostolakis, G.E., Hejzlar, P., 2005. The impact of uncertainties on theperformance of passive systems. Nucl. Technol. 149, 129e140.

Patalano, G., Apostolakis, G.E., Hejzlat, P., 2008. Risk-informed design changes in apassive decay heat removal system. Nucl. Technol. 163, 191e208.

Schueller, G.I., Pradlwarter, H.J., 2007. Benchmark study on reliability estimation inhigherdimension of structural systemse an overview. Struct. Saf. 29 (3),167e182.

Song, S.F., Lu, Z.Z., Qiao, H.W., 2009. Subset simulation for structural reliabilitysensitivity analysis. Reliab. Eng. Syst. Saf. 94, 658e665.

Wang, B.S., Wang, D.Q., Zhang, J.M., Dong, H.P., Jiang, J., 2012. Transient character-istics numerical analysis of a passive residual heat removal system followingstation blackout accident. In: Proceedings of the 9th International TopicalMeeting on Nuclear ThermaleHydraulic, Operation and Safety (NUTHOS-9),Kaohsiung, Taiwan, September 9e13.

Wang, B.S., Wang, D.Q., Jiang, J., Zhang, J.M., 2013. Efficient estimation of thefunctional reliability of a passive system bymeans of an improved line samplingmethod. Ann. Nucl. Energy 55, 9e17.

Westinghouse Electric Company, 2004. Accident analysis, revision 14. In: AP1000Design Control Document, Tier 2 (Chapter 15).

Yuan, T.H., Yu, L., Wang, Ch, 2010. Research on passive residual heat remove systemunder loss of power. Atom. Energy Sci. Technol. 44, 248e252.

Zio, E., Cantarella, M., Cammi, A., 2003. The analytic hierarchy process as a sys-tematic approach to the identification of important parameters for the reli-ability assessment of passive systems. Nucl. Eng. Des. 226, 311e336.

Zio, E., Pedroni, N., 2009a. Building confidence in the reliability assessment ofthermalehydraulic passive systems. Reliab. Eng. Syst. Saf. 94, 268e281.

Zio, E., Pedroni, N., 2009b. Estimation of the functional failure probability of athermalehydraulic passive system by subset simulation. Nucl. Eng. Des. 239,580e599.

Zio, E., Pedroni, N., 2011. How to effectively compute the reliability of a thermal-ehydraulic nuclear passive system. Nucl. Eng. Des. 241, 310e327.