Analysis of a protected Loss Of Flow Accident (LOFA) in the ITER TF coil cooling circuit