Assessment of the safety and performance of a radioactive waste repository

144

Assessment of the safety and performance of a radioactive waste repository Paul A. Smith SAM (Safety Assessment Management) Ltd, North Berwick, Scotland, UK

6.1. Introduction For permission to be granted to construct, operate and finally close a geological repository, the facility operations must be safe and it must also be shown to fulfil its primary role of protecting man and the environment from the long-term hazards associated with the radioactive waste that it contains. The task of analysing the performance of a repository and evaluating its safety in the long term, beyond the time when active control of the facility can be relied on, is termed long-term or post-closure SA. In this chapter, the methodologies of post-closure SA are discussed, illustrated by examples of their application in various repository programmes internationally. For brevity, the term SA is often used for assessments of safety in the post-closure period. Issues surrounding safety during construction and operation, though also of key importance, are beyond the scope of the chapter but are briefly addressed in Chapter 10. It should be noted, however, that processes occurring during repository construction and operation and in any extended open period before closure may have implications for long-term safety and may thus need to be taken into account in post-closure SA. There has been a history of international cooperation in developing the approaches and methods for analysing the long-term safety of geological disposal. This work has been documented in numerous publications of the NEA and the IAEA since the early 1980s, where current examples of relevant publications include IAEA (1995, 2003) and NEA (1997, 1999a, 2000, 2002 and 2004a). A key conclusion, stated in various ways in many of the documents, is that absolute proof of safety is not possible for the long timescales considered, but that what is required for the implementation of a disposal system is a reasonable assurance of long-term safety. SA is the procedure by which safety is tested and this assurance developed. The safety criteria that a repository must satisfy are defined by relevant nationally and internationally accepted safety standards. The IAEA has recommended approaches and provided standards and guidance for use by governments, regulatory bodies and DEEP GEOLOGICAL DISPOSAL OF RADIOACTIVE WASTE VOLUME 9 ISSN 1569-4860/DOI 10.1016/S1569-4860(06)09006-1

 2007 Elsevier Ltd. All rights reserved.

Safety and performance assessment of repository

145

implementers in formulating their own national regulations or showing compliance with them, where the radiation protection approach and standards are based on those recommended by the ICRP. National regulations set more specific legal requirements, including dose or risk targets, and in some cases the time period over which detailed quantitative evaluations should be presented. Some national regulations also set requirements with regard to protection of non-human biota or natural resources, such as groundwater. In some countries, regulations are formulated that are specific to the development of a particular disposal facility, whereas in other countries national regulations are expected to apply to a range of possible facilities. To test compliance with regulatory safety criteria in SAs, an understanding is required of how, and under what circumstances, radionuclides might be released from a repository, how likely such releases are, and what the radiological1 consequences of such releases could be to man and the environment. Thus, scenarios for the potential evolution of the repository and its environment must be defined and their consequences evaluated using quantitative models as well as more qualitative reasoning. The development and analysis of scenarios is based on an understanding of how the geological characteristics of the site and the components of the EBS function in concert to prevent, lower the likelihood of, or attenuate such releases. This in turn involves developing a scientific understanding of relevant processes and their interactions, collating data, developing models and performing analyses related to safety (see also Chapter 8). The use of SA to support a case for safety and to provide input to decision-making in repository planning and implementation is discussed in section 6.2. The tasks carried out in the course of SA are discussed in section 6.3, with some illustrative examples taken from recent SAs conducted by different national organisations. The issue of the timescale over which safety must be assessed is considered in section 6.4. Finally, section 6.5 addresses the construction and presentation of a safety case, based, at least in part, on the results of SA.

6.2. The role of SA and the safety case in decision-making The process of siting, design and eventual implementation of a repository may extend over several decades and requires a commitment of considerable resources. This process typically involves a number of stages punctuated by interdependent decisions on whether and how to move to the next stage. Even at an early stage of a project, to justify a positive decision to move from one stage to the next, the organisation charged with development, as well as other stakeholders, will require some assurance that the option or options being considered have a reasonable chance of proving acceptable in terms of factors including cost, operational safety, environmental impact and, crucially, postclosure safety. SAs are therefore carried out not only at a late stage of a project, where permission to construct, operate or close a repository is being sought, but also periodically throughout the planning process and documented in safety reports. The ways in 1 There may also be potential pollutants released from the repository that are non-radioactive and these may need to be taken into account in any overall evaluation of safety. In this chapter, however, discussion is restricted to the assessment of radiological consequences.

146

P.A. Smith

Fig. 6.1. An example from Sweden of the incremental process of developing a geological repository (from Fig. 1 of NEA, 1999a). SR = safety report.

which SAs and safety reports can be used as a basis for decision-making at various stages of a repository project are illustrated in Fig. 6.1. In the early stages of a programme, several siting and design options may be kept open and the information available on any particular site or design is likely to be limited (see comments in Chapters 5 and 7). More information can be obtained over the course of a programme by site characterisation and R&D. Uncertainties can also, to some extent, be avoided or their effects mitigated by the choice of site and by design optimisation. They can never, however, be completely eliminated (and this option may not even exist in the case of a volunteer site – see Chapter 4 for discussion) and any predictions of the evolution of a repository and its environment are always subject to some uncertainty. Fortunately, there is no need to make precise predictions for SA to serve its purpose as a basis for decision-making. If a SA shows that a certain level of release of radioactivity to the environment is unlikely to be exceeded, and that this level of release satisfies all relevant criteria (such as national dose limits), then this may be enough. It may not matter, from the point of view of decision-making, if the releases that will occur in reality are actually much lower than this. SAs need only (and can only) provide predictions in the sense of bounds on the likelihood and consequences of particular adverse situations arising. Figure 6.2 provides a schematic illustration of how SAs support decision-making. The figure shows how, within a repository programme, site selection and characterisation, repository design studies and R&D are carried out in parallel and that project milestones exist that separate the project into stages and at which progress is reviewed and decisions

Project milestone/ decision point

Begin assessment

Safety and performance assessment of repository

147

Site selection and characterisation Repository design studies R&D

Review assessment basis and update as necessary

Carry out SA

Internal review of assessment and findings

No

Adequate?

Yes (as basis of a broader safety case for external decision-making)

Yes (as basis for internal decision-making)

Compile safety case and present to external decisionmakers (if required for a given project milestone) Fig. 6.2. The role of SA in decision-making within the step-wise process of repository planning and development. Note: The SA process starts at some time before the project milestone or decision point and draws on information from site characterisation (Chapter 4), repository design studies (Chapter 5) and R&D (Chapter 8).

taken regarding the following stages. Examples of typical project milestones are the point at which a single site is to be selected for detailed characterisation from the surface and the point at which a decision is to be taken on whether to begin construction of an URL at a chosen site (see also detailed comments in Chapter 7). If the decision at hand is to be supported by a SA, the first stage is to review the scientific understanding, databases, mathematical models and computer codes on which the assessment is to be based. These are termed the ‘‘assessment basis’’ in recent NEA reports (e.g., NEA, 1999a, 2002, 2004a). If some aspects of the assessment basis are judged to be inadequate, then

148

P.A. Smith

work may be undertaken, e.g., to acquire new data or develop new models and computer codes (see also comments in Chapter 8 on the R&D programme). The SA is then carried out. It is often the case that requirements for improvements to the assessment basis are identified in the course of the SA, e.g., to fill gaps or to resolve inconsistencies in the available data. Even if not specifically requested by the safety assessors, ongoing laboratory programmes and site measurements will often generate new and relevant data as the SA is being carried out. At some stage, however, to ensure the traceability of the data used in the assessment, all databases must be ‘‘frozen’’. No newly generated data are then admitted to the databases used by the assessors, although they are, of course, recorded and may be used in future assessments (c.f. comments in Pate et al., 1994). The findings of the SA are then reviewed internally by the safety assessors, to check that the aims of the assessment have been fulfilled and, in particular, that the findings are adequate as a support to decision-making. If not, then either the assessment basis may need to be updated or the assessment itself may need to be extended in its scope, perhaps to explore possibilities or uncertainties that had been overlooked the first time. Some decisions are the sole responsibility of the repository implementer. Others may require the consent of local or national governments, taking into account reviews by regulators or licensing authorities, or require the direct consent of the local or national population via a referendum (see examples in Chapters 4 and 9). To support external decision-making, the implementer must first satisfy itself that a positive decision to progress to the next development stage is justified in terms of long-term safety by conducting a SA. The implementer must then present the reasons why such a decision is justified to the regulators (and often other external decision-makers) in the form of a ‘‘safety case’’. The safety case, which is discussed in more detail in section 6.5, provides a synthesis of relevant evidence, analyses and arguments, including those from SA. It may also give guidance, based in part on the results of the SA, on the R&D, site characterisation and design work that should be carried out in the course of future stages to address remaining uncertainties and open questions.

6.3. SA tasks Although there are differences between national programmes in the detailed procedures that are followed, the broad tasks that are carried in the course of any post-closure SA are essentially the same, namely:  carefully describe the initial appearance or state of the repository (i.e., the state of the repository when it has just been closed, taking into account perturbations caused by construction, operation and any pre-closure open period), and consider what changes the repository could undergo in time as a consequence of both internal processes within the repository and external forces,  identify broad scenarios that illustrate the range of possibilities for the evolution of the repository under consideration and its surrounding environment, and  analyse these scenarios, taking into account all relevant uncertainties, to evaluate their consequences for safety. These broad tasks are described in the following sections.

Safety and performance assessment of repository

149

6.3.1. System description Detailed scientific understanding of FEPs that define the initial state of a repository and its environment, and determine how this will change over the course of time, provides the foundation of all post-closure SAs. According to the NEA (2004a), the system components that are described should include the host rock and surrounding geological environment, the surface site, waste inventory, the engineered barriers and particular features of the repository layout or design with implications for post-closure safety, e.g., the arrangement of seals in the backfilled tunnels (see Chapter 5). The description of each generally includes:  its geometry and constituents,  its safety functions (as discussed further below), and  a general description of its expected evolution and performance, including all relevant uncertainties. Relevant uncertainties are, where possible, quantified or bounded, taking into account how uncertainties vary over time. Expected FEPs that are potentially important for system safety, as well as those that are considered unlikely but still plausible, may be included, as are design constraints or criteria, such as the maximum temperature that is expected to occur within the buffer. The system description generally includes a description of (or references to) site characterisation procedures and field, laboratory, natural analogue and URL studies that have been carried out in support of the SA. Furthermore, it is clearly important that the system considered in the SA is one that can be implemented (i.e., constructed, operated and closed) in practice using currently available technology. An evaluation of engineering feasibility does not generally form part of the SA and is usually considered in a separate study (see Chapter 5). The SA may, however, refer to the findings of such a study and may also include a description of any QA procedures (Chapter 5) and waste acceptance criteria (Chapter 2) that ensure that the specifications of the engineered features, including the waste form itself, will be met. In the Swedish SR 97 SA (SKB, 1999), processes affecting the evolution of the repository and its environment, and their various interconnections, are illustrated schematically (Fig. 6.3) in THMC diagrams, where the processes are categorised as thermal (T), hydraulic (H), mechanical (M) and chemical (C). Some processes are also radiation-related (R). The diagrams show the relationship between the variables, such as temperature and groundwater composition, that define the system at any time and the processes that affect its evolution. In the Swiss SA for Project Opalinus Clay (Nagra, 2002a–d), the system description comprises separate descriptions of the ‘‘system concept’’ and the ‘‘safety concept’’. The description of the system concept identifies the key features of the system, events, processes and interactions that may affect its evolution and the possible paths that its evolution might take. On the basis of the system concept, a description can be made of how the system provides safety; this is the safety concept. Typically, a repository and its environment provide safety via a number of safety functions, such as:  isolation and limited accessibility of the waste from the human environment,  long-term confinement and decay of radionuclides within the multi-barrier EBS (e.g., due to the integrity of waste canisters or containers and the stability of the waste forms), and

150

P.A. Smith

Fig. 6.3. The main features and processes of the repository system in the base scenario of the SR 97 SA (from Fig. 3.2 of SKB, 1999).

 attenuation of releases to the environment (e.g., due to dispersion and slow transport coupled with radioactive decay in the host rock), The safety concept is essentially a description of how the chosen site and design are expected to provide these safety functions and limit the consequences of any potentially detrimental phenomena and uncertainties. When describing the safety functions, their changing role or reliability in different periods or time frames has to be considered. Figure 6.4 shows an example of this from the Belgian SAFIR-2 study (ONDRAF, 2001a,b). In this example, a ‘‘latent function’’ is one that only operates if other safety functions (unexpectedly) fail to operate. A ‘‘reserve function’’ is one that may well enhance the level of safety, but where uncertainties are such that it cannot currently be relied upon with confidence within a given time frame. 6.3.2. Identification of scenarios and cases for analysis The system description, or more specifically the safety concept, explains how a system has been sited and designed to provide safety. It is, however, also necessary to evaluate whether the level of safety provided is sufficient to satisfy relevant safety criteria, taking into account all potentially relevant detrimental phenomena and uncertainties. In some cases, it may be adequate to treat uncertainties using conservative model assumptions and pessimistic parameter values and estimates of likelihood, which ensure that the evaluated radiological consequences of a repository error on the side of caution. There are, however, limitations to this approach, particularly at the early stages of a project. In particular,

Safety and performance assessment of repository

10 00

10 22

[year]

operational operational phase phase

10 33

thermal thermal phase phase

physical confinement (C1 + C2)

10 4

isolation isolation ph. ph.

10 66

geological geological phase phase

reserve resistence to leaching (R1)

latent function

151

reserve diffusion and retention (R2)

latent function

dilution and dispersion (D)

limited accessibility (L)

Key to symbols Physical confinement (C): isolation of the radionuclides from their immediate environment, especially from water, achieved by: • water tightness (C1): primarily associated with the engineered barriers, and • limitation of water influx (C2): mainly associated with the natural barrier but also the capacity for certain engineered barriers to delay the ingress of water. Delay and spread the release (R): after, or in the event of, breaching the physical containment, this second function delays and spreads the migration of the radionuclides towards the biosphere for, and over, as long a time as possible, achieved by: • •

difficulty of leaching (R1): the system inhibits the release of the radionuclides from the matrix in which they are contained (spreading the release over time), and diffusion and retention (R2): the system retains the radionuclides once released from their matrices (locally in the EBS and also in the near geosphere).

Dilution and dispersion (D): in the long term, this function (associated with the further geosphere and biosphere interface) ensures that the radionuclides will be diluted and dispersed by flows of groundwater in the geosphere and surface water in the biosphere.

Fig. 6.4. The safety functions identified in the SAFIR-2 study and the time frames over which they are expected to operate (from Fig. 2.6 of ONDRAF, 2001a).

 it is not always possible to decide in advance of SA calculations being carried out which alternative scenarios, model assumptions or even parameter values are the more conservative or pessimistic, and  if an extreme combination of multiple conservative or pessimistic assumptions is made to pre-empt any objection that some unfavourable situation has been excluded, then unrealistic or highly improbable combinations may be selected and it may not be possible to satisfy relevant regulatory criteria. This can then impact public confidence at a later time in the programme (see also Chapter 9). In the early stages of a project, when information is limited and uncertainties may be large, the usual aim of SA is not to demonstrate that relevant safety criteria are satisfied for a fixed site and design. Rather, it is to show that there are reasonable

152

P.A. Smith

prospects for satisfying these criteria following further R&D, siting studies, site characterisation work and design optimisation to reduce, avoid or mitigate the effects of the most important uncertainties. A purely conservative or pessimistic approach does not give a basis for deciding which uncertainties are the most important in terms of repository performance. Thus, the impact of at least the more well-defined uncertainties is usually investigated by considering a wide range of possibilities for system evolution and evaluating their consequences using mathematical models or more qualitative reasoning (although a conservative/pessimistic approach may still be used for some uncertainties, as discussed further below). Calculations are generally carried out using computer codes to solve the governing equations of mathematical models, with given sets of parameter values. They may be performed  deterministically (i.e., with the models and parameter values defining each calculation individually specified by the safety assessor to investigate the impact of particular uncertainties),  probabilistically (i.e., with parameter values sampled from probability distribution functions), or  using some combination of these methods. The impact of different uncertainties on the evolution of the system can vary widely, as can the methods used to evaluate their impact. The impact of some uncertainties can be evaluated by simply adjusting the value of a parameter describing, say, the spatial extent of a feature, the rate of a process, or the timing of an event. Other uncertainties are such that alternative models may have to be considered for individual processes, or groups of processes. Finally, there may be uncertainties that fundamentally affect the path that the evolution of the system may take and the ways in which the exposure to radionuclides could conceivably take place at some future time. For this reason, some SAs have adopted a categorisation of uncertainties, such as that shown below from the Swiss Project Opalinus Clay SA (Nagra, 2002a), which differentiates between scenario uncertainties, which are most far-reaching in their impact on system evolution, conceptual or model uncertainties and parameter uncertainties (see Box 6.1). A number of different models and scenarios can be built into a single computer code and switched on or off via an input parameter. In this sense, all uncertainties can be described as parameter uncertainties. Nevertheless, the categorisation of uncertainties in the manner indicated above can provide a useful way of organising the potentially very large number of calculations that must typically be performed in a SA according to the types of uncertainty that they address. Often, a ‘‘base’’ or ‘‘reference’’ scenario is analysed first and in most detail. A number of other scenarios are then analysed in which the course of events differs from that of the base or reference scenario as a result of specific scenario uncertainties. Figure 6.5 shows the classification of scenarios in the Japanese H12 SA (JNC, 2000a–d). In many SAs, in the base or reference scenarios the repository is postulated as being built according to design specifications and present-day conditions and the surroundings, including the climate, are assumed to persist for all times considered. Figure 6.3 shows the main features and processes of the repository system in the base scenario of the Swedish SR 97 SA (SKB, 1999), and the assumptions regarding its surroundings, such as the persistence of present-day climate.

Safety and performance assessment of repository

153

Box 6.1. Example of a system for categorising uncertainties for treatment in SA (from Section 3.4 of Nagra, 2002a). Scenario uncertainty is the uncertainty in the broad evolution of the repository and its environment. This can also be considered as the uncertainty related to inclusion, exclusion or alternative realisations of FEPs that may affect this broad evolution. Conceptual uncertainty is uncertainty in the assumptions or conceptual model used to represent a given scenario or set of FEPs, including uncertainty related to the existence of plausible alternative conceptual models. Parameter uncertainty is the uncertainty in parameter values used in a model. Parameter uncertainty can be due to spatial variability and evolution over time of relevant properties and to uncertainty in the extrapolation of observations from laboratory or natural system conditions and scales of space and time to the conditions and scales relevant to the repository and its environment. Parameter uncertainty can also arise from uncertainty in the models used to interpret the raw data used to derive the parameters required for SA models.

Scenarios considered in the H12 SA

“Groundwater Scenarios” Radionuclides are transported to the biosphere by flowing groundwater

Base Scenario - The geological environment remains stable and the present day geological conditions remain unchanged indefinitely into the future.

Perturbation Scenarios Account is taken of: - Natural phenomena - Future human activities - Initial EBS defects etc.

“Isolation Failure Scenarios” The human environment is affected due to the physical isolation of the waste being compromised by: Uplift and erosion Direct magma intrusion Direct human intrusion - Meteorite impact, etc.

Fig. 6.5. Scenarios considered in the Japanese H12 SA (adapted from JNC, 2000a).

Within each scenario, conceptual uncertainties may give rise to various possibilities for how individual processes or groups of processes are modelled and parameter uncertainties may give rise to a range of possibilities for the parameter values to be assigned to these models. Thus, e.g., in the methodology used in the Swiss SA for Project Opalinus Clay, a scenario is represented by a group of individually analysed ‘‘assessment cases’’. Within each scenario group, sub-groups address alternative possibilities arising from conceptual uncertainties. Finally, individual cases within each subgroup address alternative possibilities arising from parameter uncertainties. This hierarchy of assessment case groupings is illustrated in Fig. 6.6. Some SAs also examine ‘‘what-if?’’ cases that, while not necessarily physically impossible, lie outside the range of possibilities reasonably expected to occur according

154

P.A. Smith

Different scenarios to illustrate scenario uncertainty Alternative scenario

Reference scenario

Different conceptualisations of a scenario, illustrating conceptual uncertainty

Different parameter sets to illustrate parameter uncertainty for one conceptualisation

Reference conceptualisation

Reference parameter set Alternative parameter set

Alternative conceptualisation

Alternative parameter set Alternative parameter set

Alternative scenario

Alternative scenario

Alternative conceptualisation

Alternative conceptualisation

Fig. 6.6. Schematic illustration of a hierarchy of assessment case groupings. Groups of assessment cases illustrate each scenario. Within these groups, sub-groups illustrate alternative conceptualisations. Within these sub-groups, individual cases illustrate alternative parameter sets (from Fig. 3.7.3 of Nagra, 2002a).

to the scientific understanding available to the safety assessors. Although whether or not particular scenarios, model assumptions and parameter values are in fact impossible is often partly a matter of subjective judgement, if the system can be shown to provide safety even in extreme ‘‘what-if?’’ cases, then this can, to some extent, preempt any criticism that the chosen ranges of possibilities are too narrow and guard against the possibility that some significant FEPs or sources of uncertainty have been overlooked. Finally, it must be mentioned that, in SA, the treatment of uncertainties associated with the biosphere and with future human actions is generally different to the treatment of uncertainties associated with the near-field and geosphere. This is in part because some aspects of the evolution of the biosphere, and also the nature and timing of future human actions, become highly speculative even over relatively short times into the future. They are affected by uncertainties that are difficult to quantify or bound (e.g., what will humans be eating in 1000 years2) and so reliable, detailed modelling is not possible, although these uncertainties can have a significant effect on evaluated levels of safety. The role and treatment of the biosphere in long-term SA has been discussed extensively in international fora. The consensus that has developed suggests that a reasonable approach is to separate the assessment of the biosphere from that of the repository and its geological environment, as proposed, e.g., by an NEA ad hoc working group (NEA, 1999b), and to develop a range of credible illustrations for the biosphere, thereby exploring the uncertainty related to it (IAEA, 1999; Sumerling et al., 2001). For example, in the Swiss Project Opalinus Clay SA (Nagra, 2002a), the majority of the assessment 2

As an example of this, who could have guessed that the consumption of spinach in the USA would increase 20-fold within a few years of the introduction of the cartoon character ‘‘Popeye’’?

Safety and performance assessment of repository

155

cases were evaluated using a single stylised biosphere situation to convert releases into dose. As in most SAs, it was acknowledged that there will be some modification of the near-surface environment over the very long timescales involved due to a range of factors including climate change and the sensitivity of calculated doses to different stylised climate states was investigated in a number of stand-alone biosphere calculations, each based on the same releases from the geosphere. 6.3.3. Consequence analysis Having identified the possibilities for system evolution to be considered in the SA, these must be analysed to evaluate their consequences for safety. Although some (usually less likely) possibilities may be discussed partly qualitatively, or by the use of simple approximations, the main effort in consequence analysis is generally on the quantitative modelling of assessment cases. In most SAs conducted internationally, radionuclide releases from the repository near-field, geosphere transport and biosphere transport, accumulation and dilution are modelled using separate computer codes, coupled together in a ‘‘model chain’’. The near-field code provides a source term for the geosphere code, which in turn provides input (radionuclide release rates as a function of time) for the biosphere code. Figure 6.7 shows the model chain COMP23 ! FARF31 ! BIO42 used in the SR 97 SA (SKB, 1999). Modelling inevitably involves a certain number of conservative assumptions and simplifications because of the complexity of the systems considered, the impossibility of complete characterisation (particularly in the case of the geosphere), the limited understanding that is available for some processes and the wish to avoid treating some poorly defined uncertainties explicitly. Some processes are well-understood and can be modelled using fairly simple relationships based on fundamental physical and chemical principles, such as Darcy’s Law for groundwater flow, Fick’s Laws for diffusion and the Bateman Equations for radioactive decay and ingrowth. These are incorporated, in some form, into most SA model chains. Other processes are more complex to model and, in some cases, less well-understood, examples being advection in flowing groundwater in highly heterogeneous geological media, the range of radionuclide retardation processes that are grouped together as ‘‘sorption’’ and the transport of radionuclides in association with colloids (Box 6.2). The approach used in many SAs for these processes is to incorporate them in a relatively simple form in the model chain codes and to develop separate, more detailed and realistic models to derive input parameters (e.g., the use of geo/hydro analyses, as illustrated in Fig. 6.7) to provide input parameters, with conservative margins applied to the parameter values to deal with uncertainties. Some poorly understood processes are less amenable to modelling. There is, for example, considerable uncertainty in the radionuclide transport resistance provided by fractured waste forms (such as blocks of vitrified HLW, which may fracture during cooling after fabrication) and by breached canisters, and the way in which this evolves over time. Most SA models conservatively omit this transport resistance altogether. In many cases, the lack of the necessary model or code to treat a particular phenomenon (like fracturing of the waste form) in detail reflects the fact that uncertainties in the phenomenon are large and are unlikely to be reduced significantly by further R&D

156

P.A. Smith

Fig. 6.7. The model chain COMP23 ! FARF31 ! BIO42 used in the SR 97 SA and supporting models and data that provide input parameters (from Fig. 3–11 of SKB, 1999).

(Chapter 8). Even if more refined models and computer codes were available, a pessimistic case in which, say, the transport resistance was small or negligible might still have to be considered. This reduces the motivation to develop such models or codes in the first place, something which is not easy to explain to the general public (Chapter 9). Over-simplified models and conservative assumptions have to be used with particular care if an aim of a SA is to support site selection or design optimisation. There may, at a given stage of a programme, be more information (and less uncertainty) about some site or design options compared to others, simply because these have been the focus of more intensive site characterisation and design studies. A conservative approach will tend to be most conservative for the least understood options and there is obviously a danger that this may unduly bias a decision against these options. Safety assessors are often wary about using the word ‘‘prediction’’ to describe evaluations of the performance and levels of safety provided by a repository. This is because there is a danger that the word may be misinterpreted as meaning precise

Safety and performance assessment of repository

Box 6.2. Transport processes in the geosphere Advection is the process by which dissolved (or colloidal) species (e.g., radionuclides) are transported by the bulk motion of flowing groundwater. Pressure gradients driving groundwater flow may arise, for example, from variations in the hydraulic head (e.g., in a mountainous site), glacial rebound (e.g., Scandinavian and Canadian Shields) and variations in density associated with salinity and temperature contrasts (e.g., at a coastal or island site). In unsaturated systems, flow occurs under gravity following any period of rainfall. Groundwater flow rates may vary considerably even within a single rock formation due to the heterogeneity in fracture and pore space structures and to friction on flow path walls. The resulting spreading of transported solutes (or colloids) is known as mechanical dispersion. In contrast, diffusion is the process by which radionuclides will migrate driven by gradients in chemical potential. In advective systems, diffusion causes solute dispersion which, when combined with mechanical dispersion, is called hydrodynamic dispersion. The rate of diffusion is determined by the magnitude of the concentration gradient and the diffusion coefficient of each particular solute. The diffusion coefficient is itself a function of the properties of the rock, such as the tortuosity of pore spaces, the properties of the groundwater and, in particular, its temperature, and the properties of the diffusing species, such as their charge and size.

Figure: The retardation mechanisms that may affect radionuclides in the geosphere (after McKinley and Hadermann, 1984). (Continued )

157

158

P.A. Smith

Box 6.2. (Continued) In addition to the direct processes of advection, dispersion and diffusion, a range of coupled processes, including thermal, chemical and electrical osmosis, thermal diffusion, hyperfiltration and electrophoresis, can transport porewater and radionuclides in solution in response to gradients in temperature, pressure, solute concentration and electrical potential. Although such coupling is generally negligible for most practical applications, some of these processes, including chemical osmosis and hyperfiltration, can be significant in microporous media such as some argillaceous sediments. Where there is significant groundwater flow, advection and mechanical dispersion are often far more effective transport processes than diffusion or the coupled processes mentioned above. This does not mean, however, that these processes can necessarily be neglected. In many media, groundwater flow is predominantly confined to discrete water-conducting features, such as fractures, sand lenses, thrust planes, alluvial or glacial channels and rock unconformities. Elsewhere in the rock body, groundwater may effectively be stagnant. In such cases, diffusion may, e.g., transport radionuclides from waterconducting features into stagnant porewater ‘‘matrix’’ regions and vice versa. This process of matrix diffusion (see Fig. a) is referred to as a retardation process, since it results in slower transport. In some media, matrix pores may be accessible to solutes by diffusion, but larger molecules, ions and colloids may be excluded due to size and/or charge effects (Fig. b). The retarding effect of matrix diffusion may thus apply to radionuclides associated with solutes, but not to those associated with colloids (although colloids may be retarded or immobilised in other ways, such as by filtration).

evaluations of, for example, the actual future release of radioactivity from the repository, the actual rate at which radioactivity from the repository enters the biosphere or radiation doses received by human populations living in the future. In fact, doses and risks calculated on the basis of stylised approaches and simplified models should be interpreted as illustrations based on agreed sets of assumptions for particular scenarios and well-defined, but not necessarily realistic, model assumptions, and not as actual measures of future health detriments and risks (ICRP, 2000).

6.4. Timescales for evaluation As discussed earlier, the evolution of a repository and its environment is always subject to some uncertainties. These uncertainties tend to increase the further into the future that the assessment must consider and affect different components of the repository and its surroundings in different ways. Figure 6.8 illustrates how increasing uncertainty affects the extent to which the future behaviour of the different components of the disposal system considered in the Belgian SAPHIR 2 SA (ONDRAF, 2001a,b) could be reliably assessed. The most stable and predictable component of a geological disposal system is generally considered to be the host rock itself (‘‘Clay’’ in Fig. 6.8, which considers the Boom Clay in Belgium as a potential host rock), but even this will be subject to poorly predictable changes over long enough timescales. The questions then arise:  Is it necessary to evaluate the performance and safety of a repository at distant times when even the evolution of the geological environment, which is typically chosen, at least in part, for its long-term stability, may be subject to poorly predictable changes?  If so, how can safety be evaluated when assumptions, such as geological stability that typically underlie the models used to evaluate dose and risk, cease to be valid?

Safety and performance assessment of repository

159

ROBUSTNESS

106 years 105 years 104 years 103 years 102 years 10 years Radioactive decay

Waste form

Overpack

Clay Backfill

Biosphere Aquifers

Fig. 6.8. The extent to which the future behaviour of the components of the disposal system considered in the Belgian SAPHIR 2 SA could be reliably assessed – ‘‘robustness’’ in the terminology of this SA (from Fig. 4.2 of ONDRAF, 2001a). Note: Radioactive decay and the biosphere are included in the figure, even though they are not normally classed as components of the disposal system.

These questions were addressed at a recent NEA workshop (NEA, 2003, 2004b) which concluded that there are no ethical arguments that justify imposing a definite limit to the period addressed by SAs, in spite of the technical difficulties that this can present to those conducting such assessments. ‘‘It is an ethical principle that the level of protection for humans and the environment that is applicable today should also be afforded to humans and the environment in the future, and this implies that the safety implications of a repository need to be assessed for as long as the waste presents a hazard. In view of the way in which uncertainties generally increase with time, or simply for practical reasons, some cut-off time is inevitably applied to calculations of dose or risk. There is, however, generally no cut-off time for the period to be addressed in some way in SA, which is seen as a wider activity involving the development of a range of arguments for safety’’ (NEA, 2004b). Recent SAs have recognised the limitations of the models used to calculate dose and risk and impose ‘‘cut-off’’ times or use presentational techniques, so that calculations are not reported without suitable qualification when the underlying model assumptions may no longer hold. In the Swiss Project Opalinus Clay SA, e.g., the timescale beyond which significant geological changes cannot be ruled out is judged to be one million years. Beyond this time, doses calculated on the basis of an assumption of geological stability may not be meaningful. This is reflected in the dose curves presented in the safety report by using dark background shading for the time interval between 106 and 107 years, as illustrated in Fig. 6.9. Most calculations in this assessment are truncated at 107 years. When considering times when calculated doses and risks may no longer be meaningful, some SAs, including the Belgian SAPHIR 2, the Swedish SR 97 and the Swiss

160

P.A. Smith 10 2 10 1

Typical natural radiation exposures in Switzerland

10 0

Regulatory guideline: 0.1 mSv a–1

Dose [mSv a–1]

10 –1

“Level of insignificant dose”: 0.01 mSv a–1

10 –2 10 –3 10 –4 10 –5 10 –6

129

10 –7

C(org)

10 –8 10

79

Se

14

36

CI

–9

10 2

10 3

10 5

10 4

10 6

10 7

Time [a]

Fig. 6.9. Total dose as a function of time for the Reference Case of the Swiss Project Opalinus Clay SA (from Fig. 8.2-1 of Nagra, 2002a).

Project Opalinus Clay, have used the radiotoxicity of the waste form on ingestion as a safety indicator in addition to, or in place of, the dose or risk arising from repository releases. Radiotoxicity provides a measure of the radiological hazard associated with the waste that can be compared to that of natural materials including uranium ore. Figure 6.10 shows how the radiotoxicity of SF on ingestion decreases over time due to radioactive decay, and that, after about 200,000 years, it is on a par with that of the uranium used in its fabrication. It is important not to over-interpret such comparisons. For example, they take no account of radionuclide mobility. Furthermore, since they only consider radiotoxicity on ingestion, they do not address the issue of external radiation that could arise if the waste were exposed at the surface after a prolonged period of uplift and erosion of the geosphere. Nevertheless, in Project Opalinus Clay, the strongly decreased radiotoxicity of the waste was an important factor in the decision that the timescale over which the repository system has to provide well-functioning barriers against radionuclide release and transport is of the order of one million years.

6.5. Constructing and presenting a safety case The final stage of a SA is to document the assessment and its findings, including the implications of the assessment for the safety of the proposed repository. The findings of the assessment may form part of a safety case to support external decision-making (by regulators, government, etc.), and may also provide input to the planning of a work programme for future project stages to further develop the concept and to improve the case that can be made for its safety. A safety case is defined as: ‘‘. . . an integration of arguments and evidence that describe, quantify and substantiate the safety, and the level of confidence in the safety, of the geological disposal facility’’ (NEA, 2004a).

Safety and performance assessment of repository

161

Fig. 6.10. Radiotoxicity of spent fuel as a function of time after discharge from the reactor for Swedish BWR fuel with a burnup of 38 MWd/tU. Radiotoxicity pertains to ingestion via food (from Fig. 1–2 of SKB, 1999).

The construction and use of safety cases have recently been discussed in an NEA brochure (NEA, 2004a). An initial safety case can be established early in the course of a repository project. A safety case will, however, generally become more comprehensive and rigorous as a programme progresses and as the depth of understanding and the technical information available increase. It is generally presented in the form of a structured set of documents that are tailored in their style of presentation to the intended audience (i.e., usually the regulators and the government) and is typically required at major decision-points in repository planning and implementation, including decisions that require the granting of licences. Input to the safety case comes not only from the findings of SA, but also more directly from site selection and characterisation and design studies; in particular, evidence that the system has been well chosen, has a range of positive attributes that intrinsically favour safety and that no obviously better system exists. The favourable characteristics of the geosphere that can be cited in a safety case were discussed at a recent NEA workshop, the first in the AMIGO series (Approaches and Methods for Integrating Geologic Information in the Safety Cases, NEA, 2004c), which took the Swiss Project Opalinus Clay (Nagra, 2002a–c) as a case study. Examples of such characteristics from this study are given in Box 6.3. Most national regulations give safety criteria in terms of dose and/or risk. The results of a SA may well indicate that such criteria are satisfied. The credibility of these results, however, depends on the reliability of the analyses and the adequate treatment of uncertainties (i.e., the adequacy of the range of scenarios, alternative conceptualisations and parameter variations considered). The reliability of the analyses, in turn, depends on the quality of the models, computer codes and databases used to analyse assessment cases and the adequacy of the QA procedures for performing SA calculations. Factors also relevant to a safety case thus include, e.g., whether sensitivity analyses have been carried out to ensure that scenarios and calculational cases address key uncertainties affecting the performance of the disposal system, whether calculational

162

P.A. Smith

Box 6.3. Favourable characteristics of the geosphere that can be cited in a safety case – examples from the Swiss Project Opalinus Clay (from NEA, 2004c).  Long-term geological stability, implying, e.g., a low-rate of uplift and erosion and insensitivity of the geochemical and hydrogeological environment to geological and climatic changes;  Favourable physical, chemical and structural properties, including thickness of the host formation, low rates of groundwater movement, a geochemical environment that is beneficial in terms of radionuclide retention and protection of the engineered barrier system, and rock mechanical properties that support the feasibility of construction (although not strictly part of the safety case, engineering feasibility is relevant in that the system described in the safety case must be one that can be realised in practice);  Sufficient lateral extent, which gives flexibility in the location and layout of the repository;  Absence of, low likelihood of, or insensitivity to detrimental phenomena and perturbations, including climatic and geological events and processes, perturbations caused by the repository itself (gases, chemical alterations), and future human intrusion;  Explorability, or the ability to characterise the rock at any stage of the project to a degree that is adequate to support a decision to proceed (or not) to the next stage (e.g., site characterisation from the surface can provide sufficient evidence to support the decision to proceed with further characterisation from underground tunnels); and  Predictability, meaning that the range of possible geological evolution scenarios is sufficiently limited over the timescale for which the geological environment plays a role in the safety case (perhaps, e.g., a million years).

results are in agreement with simplified calculations and understandable from a scientific perspective, whether models and databases are consistent with wide-ranging field, natural analogue, URL and laboratory evidence and with fundamental scientific principles, whether models and databases can be shown to err on the side of conservatism3, whether they have been subjected to peer review and whether the computer codes used have been developed and applied in the framework of a QA procedure and have been adequately verified and tested. As mentioned earlier, at sufficiently distant times in the future, and particularly when the stability of the geological environment cannot be relied upon with confidence, the models used to calculate dose and risk may not be appropriate and arguments based on radioactive decay and the resulting decrease in the radiological hazard presented by the waste may receive more prominence in a safety case. In particular, the radiotoxicity of the waste at distant times in the future may be compared with that of naturally occurring mineral deposits and rocks (cf. Fig. 6.10). As discussed in NEA (2004b), although an evaluation of dose or risk may still be required by regulations, a less rigorous assessment of these indicators may well be acceptable on account of the decreased hazard potential. 3 This aspect of SAs is often difficult for many people to understand: an important premise of a SA is to show that, despite assuming the worse case scenario for each process or mechanism (e.g., ignoring geosphere retardation or irreversible sorption), a repository can be shown to satisfy the safety criteria set out by the regulatory authorities. Expressed in another way, the repository is deliberately ‘‘over-engineered’’ to provide large margins of safety (i.e., belt and braces).

Safety and performance assessment of repository

163

Other safety indicators can also complement the evaluation of dose and risk and provide supporting arguments for the low consequences of any radionuclide releases to the surface environment (EU, 2003; IAEA, 1994, 2003). In particular,  radiotoxicity fluxes due to radionuclides released from the repository in the course of time can be compared with natural radiotoxicity fluxes in the surface environment, and  concentrations of radiotoxicity originating from the repository within the host rock as functions of time can be compared with natural radiotoxicity concentrations in the rock. Figure 6.11 gives an example from the Japanese H12 SA (JNC, 2000a–d). The concentrations of 238U and its daughters in river water resulting from radionuclide releases from the repository are shown as functions of time, calculated using H12 Reference Case releases to the biosphere and assuming the same river flow rate as in the H12 Reference Biosphere. Comparison is made with the concentrations of the same radionuclides naturally present in river water and also the maximum permissible uranium concentration for drinking water, according to the Drinking Water Quality Guidelines of the World Health Organisation (WHO, 1998). The figure shows that any addition from the repository releases is negligible compared to the natural concentrations. The robustness of the safety case is favoured if, where possible, multiple lines of argument are used to support the choice of particular scenarios, model assumptions and parameter values, so that shortcomings in any single line of argument do not undermine those choices. The use of multiple lines of evidence in the context of the geosphere was

Fig. 6.11. The concentrations of 238U and its daughters in river water resulting from radionuclide releases from the repository, calculated using H12 Reference Case releases to the biosphere and assuming the same river flow rate as in the H12 Reference Biosphere (from JNC, 2000d). Concentrations naturally present in river water shown as horizontal lines: U(a) and Ra: ranges taken from Mikaka et al. (1964); U(b): range taken from Tsumura and Yamasaki (1992); U-234 and U-238: ranges taken from Kametani et al. (1991).

164

P.A. Smith

also discussed at the recent AMIGO workshop. Examples from the case study, the Swiss Project Opalinus Clay, are given in Box 6.4. A safety case may indicate what enhancements to the system itself or the models and databases used in SA may be considered eventually to make a case that is adequate for licensing purposes. In the Swiss Project Opalinus Clay SA, phenomena were identified that were omitted from the evaluation of assessment cases on the grounds that it was conservative to do so, but for which there were considered to be good prospects for improved scientific understanding, models and data, so that they might be included at a later stage of the repository programme. In the terminology of that assessment, these are ‘‘reserve FEPs’’, and their existence is said to constitute an additional argument for safety. Particularly when a SA is carried out in the early stages of a programme, there may well be a number of uncertainties with the potential, at least, to call safety into question, as well as open issues regarding, e.g., specific design options that will eventually be selected. It is often, however, still possible to make a safety case that is adequate to support the decision at hand, as long as these uncertainties and unresolved issues are acknowledged and a strategy is set out to address them (see Chapter 8). A safety case needs to be presented in a style that is understandable and useful to its intended audience, taking account of their interests, concerns and level of technical knowledge. The audience may include the regulator, political decision-makers and the

Box 6.4. Key safety-relevant properties of the Opalinus Clay that are supported by multiple lines of evidence (from NEA, 2004c). Low rate of uplift and erosion, consistent evidence for which comes from:  basin modelling (burial history) of the area of the proposed repository in northern Switzerland, which takes into account stratigraphic evidence, apatite fission track analysis, organic matter maturity studies and investigations of diagenetic cements and their fluid inclusions;  geomorphological studies of the elevation and age of river terraces in northern Switzerland, from which the rates of linear erosion since the time of deposition can be evaluated, as well as an evaluation of erosion rate from the assumption that the pre-glacial landscape was a peneplain whose elevation corresponds to present day hill and mountain peaks; and  geodetic studies using precision levelling, which is available over a period of almost 100 years, relative to a point where the underlying crystalline basement is exposed. Low hydraulic conductivity and groundwater flow in the bulk rock, evidence for which comes from:  in situ and laboratory hydraulic testing;  tests for consistency with the porosity/conductivity relationship for clay formations investigated world-wide;  the existence of hydraulic overpressures, which are interpreted as relics of burial history or as a result of the compressive stress field, but can only be understood if the hydraulic conductivity is even smaller that those derived from hydraulic tests; and  concentration profiles of numerous elements and isotopes in porewater which suggest a diffusiondominated system. Self-sealing capacity, evidence for which comes from:  in situ experiments of artificially induced fractures at the Mont Terri URL; and  the absence of mineral veins and alterations, suggesting that there was not significant water flow through natural discontinuities in the past.

Safety and performance assessment of repository

165

public, as well as technical specialists advising external groups and organisations, or the personnel of the implementing organisation itself. Multiple levels of documentation may thus be required, ranging from detailed technical reports designed to record all key assumptions and data in a traceable manner to more accessible forms such as brochures and video presentations. As pointed out, e.g., in (NEA, 2004a) and Chapter 9, where the audience is primarily the general public, highlighting less quantitative evidence for safety, including evidence from natural analogues, may be more accessible, more convincing and of more interest than, say, the results of complex mathematical models. To present the Japanese H12 SA in a way that makes the SA process clear and the implications of the results meaningful both to workers within the SA field and to a wider technical audience, a report complementing the main SA reports (JNC, 2000a–d) was produced that examines the aims, procedure and results of the assessment from a wider perspective (Neall and Smith, 2004). Similar reports have been produced for earlier SAs in Japan and Switzerland (e.g., Neall, 1994). In these reports, the reasonableness of the assessment results is argued, in part, by making comparisons with results from SAs conducted by other national programmes for systems that are in some way similar. As part of this comparison, Fig. 6.12 shows the calculated annual individual dose as functions of time for the Reference Cases of H12 and eight other HLW and SF assessments conducted internationally. Doses are compared with the range of natural radiation exposure in Japan (approximately 900–1200 mSv a1) and to the range of regulatory guidelines in various countries (100–300 mSv a1). The nuclides that contribute most to dose at different times are also indicated. There are many detailed technical reasons that can be identified for the differences in the results, including differences in the waste forms, inventories, disposal concepts and the models and data used for analysis. Perhaps the most striking point about the figure is, however, how little the calculated dose maxima (although not their times of occurrence) vary between most of the assessments, given these often very significant differences. At least part of the reason for this may be related to the high reserves of safety that are, in reality, built into all of the repository concepts that are assessed. The models used for SA, on the other hand, are usually highly conservative, and disregard or simplify the treatment of many potentially favourable features and processes. It may be that, if it appears that an analysis will give results near to or exceeding regulatory guidelines, then effort is spent in developing and testing more realistic models and databases that reduce the level of conservatism, thereby reducing the calculated doses or risks to levels that are well below the relevant guidelines. A final point to note is that the lowest dose maximum in Fig. 6.12 comes from the oldest of the SAs in the figure, the Swiss Projekt Gewa¨hr (Nagra, 1985). This assessment was conducted at a time when the host rock under consideration, the crystalline basement of northern Switzerland, was less well understood than it was for the more recent Kristallin-I SA (Nagra, 1994), which addressed the same host rock and a similar repository concept. This illustrates that, although the availability of information and understanding always increases over the course of a repository programme, the level of confidence in the performance of a system may go down as well as up. It may well be that early conceptual models disregard some important phenomena that are subsequently discovered in the course of more detailed study. This is the reason why repository programmes take a cautious, step-wise approach to planning and implementation, and flexibility, as well as high reserves of safety, are built into the strategies for siting and design.

166

P.A. Smith

10 4

Annual individual dose [µSv/y]

Typical natural radiation exposure in Japan [900–1,200µSv/y] Regulatory guidelines in other countries [100–300µSv/y] 10 2

SITE-94

10 0

AECL EIS TVO92 SKB-91

Kristallin-I

H3

10 –2

TILA-99 H12

10 –4

Gewähr 10 –6

1,000

10,000

100,000

1,000,000

Time after repository closure [y] Dominant radionuclides:

SKB-91 (1992) SITE-94 (1996)

I-129 I-129

Cs-135 Ra-226

TVO92 (1992)

I-129

TILA-99 (1999)

I-129

Pa-231 (U-235) Sn-126

I-129

I-129

AECL EIS (1994)

Cs-135

Projekt Gewähr (1985) Kristallin-I (1994)

Se-79

Cs-135

Tc-99 Pa-231(U-235)

Pd-107

H3 (1992) H12 (1999)

Se-79

Cs-135

Pa-231 Th-229

Fig. 6.12. Calculated annual individual dose as a function of time for the Reference Cases of H12 (JNC, 2000a–c) and eight other HLW and SF assessments conducted internationally: SKB-91 (SKB, 1992), SITE-94 (SKI, 1996), TVO92 (Vieno et al., 1992), TILA-99 (Vieno and Nordman, 1999), AECL EIS (AECL, 1994), Project Gewa¨hr 1985 (Nagra, 1985), Kristallin-I (Nagra, 1994), H3 (PNC, 1992).

Safety and performance assessment of repository

167

6.6. Acknowledgements The author would like to thank Mr. Trevor Sumerling of SAM Ltd., UK and Dr. Ju¨rg Schneider of Nagra, Switzerland for their careful review of this chapter.

6.7. References AECL (1994). Environmental Impact Statement on the concept for disposal of Canada’s nuclear fuel waste. AECL Report AECL-10711, COG-93-1. AECL, Pinawa, Canada. EU (2003). Testing of safety and performance indicators (SPIN), EU Technical Report EUR19965, EU, Luxembourg. IAEA (1994). INWAC Subgroup on principles and criteria for radioactive waste disposal; International Atomic Energy Agency: Safety Indicators in Different Time Frames for the SA of Underground Radioactive Waste Repositories: First report of the INWAC Subgroup on Principles and Criteria for Radioactive Waste Disposal. IAEA-TECDOC 767, IAEA, Vienna, Austria. IAEA (1995). The principles of radioactive waste management. Safety Series No. 111-F, IAEA, Vienna, Austria. IAEA (1999). Long-term release from solid waste disposal facilities: the reference biosphere concept. BIOMASS Theme 1, working document No. 1, IAEA, Vienna, Austria. IAEA (2003). Safety Indicators for the SA of Radioactive Waste Disposal. Sixth report of the Working Group on Principles and Criteria for Radioactive Waste Disposal, IAEA-TECDOC-1372, IAEA, Vienna, Austria. ICRP (2000). Radiation Protection Recommendations as Applied to the Disposal of Long-Lived Solid Radioactive Waste. ICRP Publication 81, Pergamon Press, Oxford, UK. JNC (2000a). Project to establish technical basis for HLW disposal in Japan, Project Overview Report, second progress report on research and development for the geological disposal of HLW in Japan. JNC TN1410 2000-001. JAEA, Tokai, Japan. JNC (2000b). H12 Project to establish technical basis for HLW disposal in Japan: supporting report 1: Geological environment in Japan, second progress report on research and development for the geological disposal of HLW in Japan. JNC TN1410 2000-002. JAEA, Tokai, Japan. JNC (2000c). H12 Project to establish technical basis for HLW disposal in Japan: supporting report 2: Repository design and engineering technology, second progress report on research and development for the geological disposal of HLW in Japan. JNC TN1410 2000-003. JAEA, Tokai, Japan. JNC (2000d). H12 Project to establish technical basis for HLW disposal in Japan: supporting report 3: SA of the geological disposal system, second progress report on research and development for the geological disposal of HLW in Japan. JNC TN1410 2000-004. JAEA, Tokai, Japan. Kametani, K., Matsumura, T., Asada, M. (1991). An analytical method for uranium and investigation of 238U and 234U concentration in river waters. Radioisotopes 40, No. 3, 26–29 (in Japanese). McKinley, I.G., Hadermann, J. (1984) Radionuclide sorption database for Swiss safety assessments. Nagra Technical Report, NTB 84-40, Nagra, Wettingen, Switzerland. Mikaka, Y., Sugimura, Y., Tsubota, H. (1964). Contents of uranium, radium and thorium in river water in Japan. The Natural Radiation Environment 219–225. Nagra (1985). Project Gewa¨hr 1985 – Nuclear waste management in Switzerland – feasibility studies and safety analyses, Nagra Project Gewa¨hr Report NGB 85-09E (English summary), Nagra, Wettingen, Switzerland. Nagra (1994). Kristallin-I safety assessment report. Nagra Technical Report 93-22, Nagra, Wettingen, Switzerland. Nagra (2002a). Project Opalinus Clay: safety report, Nagra Technical Report 02-05, Nagra, Wettingen, Switzerland. Nagra (2002b). Project Opalinus Clay: Models, Codes and Data for SA, Nagra Technical Report 02-06, Nagra, Wettingen, Switzerland. Nagra (2002c). Projekt Opalinuston – Synthese der geowissenschaftlichen Untersuchungsergebnisse. Entsorgungsnachweis fu¨r abgebrannte Brennelemente, verglaste hochaktive sowie langlebige mittelaktive Abfa¨lle. Nagra Technical Report 02-03, Nagra, Wettingen, Switzerland. Nagra (2002d). Projekt Opalinuston – Konzept fu¨r die Anlage und den Betrieb eines geologischen Tiefenlagers. Entsorgungsnachweis fu¨r abgebrannte Brennelemente, verglaste hochaktive sowie langlebige mittelaktive Abfa¨lle. Nagra Technical Report 02-03, Nagra, Wettingen, Switzerland.

168

P.A. Smith

NEA (1997). Lessons learnt from ten performance assessment studies. OECD/NEA, Paris, France. NEA (1999a). Confidence in the long-term safety of deep geological repositories: its communication and development. OECD/NEA, Paris, France. NEA (1999b). The role of the analysis of the biosphere and human behaviour in integrated performance assessments, PAAG document NEA/RWM/PAAG(99)5, OECD/NEA, Paris, France. NEA (2000). Regulatory reviews of assessments of deep geologic repositories: lessons learnt. OECD/NEA, Paris, France. NEA (2002). Establishing and communicating confidence in the safety of deep geologic disposal: approaches and arguments, OECD/NEA, Paris, France. NEA (2003). The handling of time scales in assessing post-closure safety of deep geological repositories, summary of the workshop, Paris, April 2002, OECD/NEA, Paris, France. NEA (2004a). The nature and purpose of the post-closure safety case in geological disposal, OECD/NEA, Paris, France. NEA (2004b). The handling of time scales in assessing post-closure safety, lessons learnt from the April 2002 workshop in Paris, France, OECD/NEA Nuclear Energy Agency, Paris, France. NEA (2004c). AMIGO: Approaches and methods for integrating geological information in the safety case, synthesis of first AMIGO workshop, building confidence using multiple lines of evidence, Yverdon-les Bains, Switzerland, 3–5 June 2003, OECD/NEA, Paris, France. Neall, F.B. (1994). Kristallin-I Results in Perspective. Nagra Technical Report 93-23. Nagra, Wettingen, Switzerland. Neall, F.B. Smith, P.A. (2004). H12: Examination of safety assessment aims, procedures and results from a wider perspective. JNC Technical Report JNC TY1400 2004-001, JAEA, Tokai, Japan. ONDRAF (2001a). Technical overview of SAFIR 2: SA and Feasibility Interim Report 2, ONDRAF/NIRAS Technical Report NIROND 2001-05 E, ONDRAF/NIRAS, Brussels, Belgium. ONDRAF (2001b). SAFIR 2: SA and Feasibility Interim Report 1, ONDRAF/NIRAS Technical Report NIROND 2001-06 E, ONDRAF/NIRAS, Brussels, Belgium. Pate, S.M., McKinley, I.G., Alexander, W.R. (1994). Use of natural analogue test cases to evaluate a new performance assessment TDB. EU Report EUR15176EN, Luxembourg. PNC (1992). Research and development on geological disposal of High-Level Radioactive Waste. First Progress Report (H3). PNC TN1410 93-059. JAEA, Tokai, Japan. SKI (1996). SKI SITE-94 Deep repository performance assessment project. SKI Report 96-36, SKI, Stockholm, Sweden. SKB (1992). SKB 91 Final disposal of spent nuclear fuel: Importance of the bedrock for safety. SKB Technical Report TR-92-20, SKB, Stockholm, Sweden. SKB (1999). Deep repository for spent nuclear fuel, SR 97 – post-closure safety. SKB Technical Report TR-9906, SKB, Stockholm, Sweden. Sumerling, T.J., Zuidema, P., Schneider, J.W., van Dorp, F. (2001). Treatment of the Biosphere – Seeking Credible Illustrations, In: Proceedings of the 9th International High Level Radioactive Waste Management Conference (Session N-7), 29, April – 3, May 2001, Las Vegas. American Nuclear Society, Washington DC, USA. Tsumura, A., Yamasaki, S. (1992). Direct determination of rare-earth elements and actinides in fresh water by double-focussing and high resolution ICP-MS. Radioisotopes 41, 185–192 (in Japanese). Vieno, T., Hautoja¨rvi, A., Koskinen, L., Nordman, H. (1992). TVO-92 Safety analysis of spent fuel disposal. YJT Technical Report YJT-92-33E (English edition). YJT, Helsinki, Finland. Vieno, T., Nordman, H. (1999). SA of spent fuel disposal in Ha¨stholmen, Kivetty, Olkiluoto and Romuvaara – TILA-99. POSIVA Technical Report 99-07, Posiva, Rauma, Finland. WHO (1998). Guidelines for drinking-water quality, World Health Organisation, Geneva, Switzerland.