- Email: [email protected]
Chapter 12 Accounting for uncertainty
Chapter 12
Accounting for Uncertainty
In assessing the potential future behaviour of any technical system, we must always deal with uncertainties. Decisions to implement any technology must always be taken in the light of the residual uncertainties. Often, these can be reduced by extensive prior research and development, by extrapolation from knowledge of similar systems and, ultimately, by observing the performance of earlier examples of the technology in question. This is how society has developed acceptably safe transport systems, power production facilities and drugs, for example. For radioactive waste disposal, however, there are some especially challenging aspects of uncertainty. Whilst there are important uncertainties associated with many aspects of a repository development programme (e.g. in the inventory of wastes that might be sent for disposal and in the timescale of the programme itself), the main concern is always associated with long-term safety. In fact, the long timescales considered in geological disposal are a key feature making treatment of uncertainties more challenging than for other, sometimes more complex, technological undertakings. Interestingly, the aspect of radioactive waste management which focussed attention on the long timescales and on the corresponding uncertainties in disposal was our very exact knowledge concerning the times taken for radionuclides to decay. The precision of measured half-lives exceeds that in almost all other parameters, but the extremely long half-lives of some radionuclides draw attention to the difficulty of assessing how other parts of the system might behave over such times. In other areas, such as disposing of heavy metals, which stay toxic forever, consideration of far future effects was long neglected. Increasingly, however, society is recognising that some technologies introduced by man may have potentially enormous impacts sometime in the future, that the uncertainties in predicting these impacts can be huge and that decisions must, nevertheless, be taken in the face of these uncertainties. The examples are growing in number, including pesticides, CFCs and other ozone depleting gases, CO2 and other greenhouse gases and genetically modified
-
-
191
192
Principlesand standardsfor the disposal of long-lived radioactive wastes
organisms. It may come to be recognised that, by their explicit acknowledgement of the uncertainties of future technology impacts and their search for approaches to address these uncertainties, scientists involved in planning radioactive waste disposal have, in fact, played a pioneering role. It is today accepted that uncertainty is an unavoidable aspect of planning and regulating deep geological disposal programmes. This fact was recognised early in the development of assessment methodology. Twenty-five years ago, Bartlett et al. (1977) noted that: Assessment of geologic isolation safety is unique relative to assessments for other engineered systems because some elements of the analysis are not amenable to uncertainty reduction by additional R&D. Wisely, the authors went on to warn that "highly sophisticated models.., could create an unwarranted 'illusion of certainty'". Nevertheless, they were able to propose specific modelling techniques that could address the task of quantitatively assessing some kinds of uncertainty. Their suggestions were to use fault trees, simulation analysis and stability analysis, all of which were recognised to be still at the conceptual phase.
12.1
Development of a Systematic Approach
Soon thereafter, the terms uncertainty analysis and sensitivity analysis became common in the technical literature on repositories. The IAEA (IAEA, 1981) included these in a glossary in Safety Series 56, noting that estimation of uncertainty and error bands needed the application of statistical techniques and definition of input parameters in probabilistic form. However, it was soon realised that a purely quantitative approach was not possible. In an updated performance assessment methodology report (IAEA, 1985), the following causes of uncertainties that could be addressed quantitatively were identified: a) inability of models to represent the system completely; b) approximations used in solving model equations; c) uncertainties in parameters. In addition, it was recognised that a problem was presented by "the inherent irreducible type of uncertainty represented by gaps in our current understanding of the system" and the opinion was offered that "there is little that can be done to resolve this type of uncertainty". It is worthwhile repeating here that considerations of this sort are, in fact, relevant for many technologies. A more topical and, arguably much more important, example today, concerns the emission of greenhouse gases and their effect on future climate. Great uncertainty in this area results from all three causes discussed above and the completeness of current understanding continues to be hotly debated. A consequence of this is that decision makers do not have consistent
Accounting for uncertainty
193
guidance from experts or, to be less charitable, they can choose views that support politically motivated ends. One of the largest sources of uncertainty is predicting the future behaviour of human populations. Societal changes happen much faster than the decades to hundreds of years of importance for climate change mechanisms and very much faster than the tens or hundreds of thousands of years for radioactive waste decay (see Chapter 2). Of critical importance, however, are not the uncertainties in individual parts of the system, but rather the impact of these uncertainties on the overall consequences of any technology. This is one of the key conclusions which have led to geological disposal being favoured for long-lived wastes. Properly chosen deep geological formations are one of the very few environments accessible to man which have such an immensely long stable history that they can reliably isolate wastes from the effects of more transient changes. As pointed out by Thunberg (1999), "we use the relative predictability of geological time to nullify the uncertainty of other time spans". Typically, four types of uncertainty are associated with assessing the future performance of repositories: 9 System uncertainty: uncertainty as to whether the disposal system (repository, EBS and natural environment) has been sufficiently understood and properly characterised. 9 Scenario uncertainty: uncertainty as to how appropriate and how comprehensive or complete are the choices of scenarios of future events and processes that will perturb system evolution. 9 Model uncertainty: uncertainty as to whether the conceptual models used to describe the behaviour of parts of the disposal system represent reality sufficiently well and whether the algorithms of the calculational models correctly represent the conceptual understanding. 9 Parameter uncertainty: uncertainty over the specific parameter values and parameter ranges to use in the models; these parameter uncertainties may be due to the natural variability of the system or to the inexact nature of our measurement techniques. Of particular importance for repositories are the uncertainties in parameters characterising the geological environment. A large volume of rock must be characterised, the spatial scales of key features determining behaviour are small, and the requirement to leave the natural rock barrier intact precludes extensive destructive testing. Ten years ago, it was believed by many that most types of uncertainty could be reasonably managed by a combination of parametric sensitivity analyses, probabilistic analyses, model "validation" and the use of alternative conceptual models. With time, however, it has become appreciated that, in assessing uncertainties associated with looking into the far future, other less quantitative approaches are also needed. In 1991, an NEA expert group (NEA, 1991), whilst recognising that uncertainties can never be completely eliminated, expressed the opinion that "by using both quantitative methods and expert judgement, the amount of uncertainty can be evaluated and a basis for decisions can be provided".
194
Principlesand standards for the disposal of long-lived radioactive wastes
The key element is the recognition that the goal is sufficient confidence in the reliability of the analysis to allow an adequately justified decision to be made. This was made clear in a specific regulatory context by the publication in 1997 of an IAEA report entitled "Regulatory decision making in the presence of uncertainty in the context of the disposal of long-lived radioactive wastes" (IAEA, 1997d). The task of "increasing confidence" in analyses of repository, behaviour has continued to grow in importance. In 1999, a further publication entitled "Confidence in the Longterm Safety of Deep Geological Repositories" was published (NEA, 1999a), concluding that "methods exist to evaluate confidence.., in the inevitable presence of uncertainty" and giving the specific examples of these methods that are described below. Subsequently, the NEA initiated a dedicated Forum on Stakeholder Confidence (NEA, 2000a). Although these are all laudable efforts on the part of the waste management community to address the crucial issues of reducing uncertainties and increasing confidence, there is an undoubted element of "preaching to the converted". In the past, o u t s i d e r s - including even scientists from other disciplines were often not included in the debate. Researchers pointed out that increasing study of an area could also lead to growth in uncertainty, e.g. because new complicating effects are brought to light. An example is the discovery of plutonium in groundwater at a far larger distance from underground weapons tests than the most commonly accepted scientific theories would have predicted (cited in NRC, 2000a). Furthermore, some controlled experiments aimed at determining how well scientific experts could themselves subjectively estimate uncertainties in knowledge have indicated that the more familiar the expert is with the problem, the greater their estimate of uncertainty is likely to be. In the light of this complex situation, advice from international agencies is now recognising that regulations need to be discriminating and practicable in what they require of an implementor as assurance of longer-term safety. For example, it is now a principle of geological disposal that absolute assurance of safety cannot be achieved: what is sought by regulators is reasonable assurance of safety or reasonable expectation that the system will perform safely (IAEA, 1997d). The same reservation is obviously valid for any technological endeavour, but in other areas it is not highlighted in the same way. The IAEA recommends that regulations and standards should include a statement to the effect that absolute proof is not to be had, and that the implementors need only provide reasonable assurance of safety, based on the record of information available to regulators and the public. Already in 1993, the regulations in the USA contained explicit reference to this: Proof of the future performance of engineered systems and the natural geological setting over time periods of thousands of years is not to be obtained in the ordinary sense of the word. ...the standards must accommodate large uncertainties. These include both uncertainties in our current knowledge about disposal techniques and inherent uncertainties about the distant future. (EPA, 1993)
Accountingfor uncertainty
195
Recent regulations for the proposed Yucca Mountain repository continue with these messages. The U S N R C 10 C F R 163 section 101 notes the following: Although the performance objective.., is generally stated in unqualified terms, it is not expected that complete assurance that the requirement can be met will be presented. A reasonable assurance ... is the general standard that is required. The USEPA in its corresponding regulation, 40 C F R 197, section III.C.3, uses a similar term: ... we are proposing the concept of "reasonable expectation" to reflect our intent regarding the level of "proof" necessary ... We intend for this term to convey our position and intent that unequivocal proof of compliance is neither necessary nor likely to be obtainable The back-drop to these considerations is that all parties must be confident that the uncertainties inherent in geological disposal are not so significant as to call a particular course of action into question. The precautionary principle, on which (together with the sustainability concept) much environmental legislation is now being based (see Chapter 3), implies that, where there is significant uncertainty and a potentially serious risk associated with a new practice, then the practice should not be undertaken until the uncertainty has been addressed. Regulators must thus be confident that uncertainty has been addressed adequately, and/or be prepared to make arguments about the risks of taking alternative measures and about the deployment of society's resources (see Chapter 3). The remainder of this chapter examines ways in which reasonable assurance of safety might be demanded of the implementor in regulations.
12.2
Providing Reasonable Assurance of Safety
A comprehensive PA will endeavour, as a matter of course, to quantify the impacts of as much of the known types of uncertainty as possible, by means of: 9 sensitivity analysis (to parameter variation), which could involve probabilistic analysis; 9 the analysis of a range of scenarios of alternative future states of the system; 9 the application of alternative conceptual models of features or processes. To appreciate the importance of the latter two points, it is essential to emphasise again that a single, accurate prediction of future system behaviour is not needed to assure safety. If we look at alternatives, all of which indicate that adequate safety will be provided, then the only question is whether these properly scope the range of possible futures. This brings us again to the question of completeness. Are there effects or consequences which have not been thought of?. The uncertainties raised by this question cannot be quantified.
196
Principlesand standards for the disposal of long-lived radioactive wastes
There are, however, also qualitative approaches to reducing uncertainties which complement the more quantitative approaches listed above. Taken together, the different approaches can reduce uncertainties to levels that justify decision making. The various approaches to reducing uncertainty or conversely to increasing confidence in the safety of deep geological disposal have been discussed in international fora, such as the IAEA and the NEA (IAEA, 1997d; NEA, 1999a; NEA, 2002a). They are outlined below.
Apply good science and continue well-chosen R&D activities throughout the repository development programme Sound science must underlie the development of safe repositories. Over the past 25 years, extensive scientific work has been done in the wide range of disciplines needed for disposal. Although many workers in the field are of the opinion that most of the basic scientific work has been accomplished, all agree that there are areas which will benefit from more research and all recognise that a wealth of good applied science will be needed for implementing repositories and assessing their performance. An example of an area still requiring research is two-phase flow and transport of radionuclides; an example of a mature area with little need for more work is heat transport through rocks. It should be noted that continuing R&D does not imply that an implementor knows so little about the system that progress towards repository implementation is impossible. Rather, it acknowledges that, over the decades of development, science and engineering will develop, so that approaches can be improved or optimised during this period. It has been argued, moreover, that waste management scientists could and should draw more on the general scientific knowledge and experience in other fields, e.g. the complex flow and transport processes of interest have long been studied in the oil and gas industries. The particular types of R&D activities most commonly viewed as being of continued importance are those involving large-scale field tests or underground laboratory experiments. This type of work is valuable for reducing uncertainties by bridging the gap between small-scale laboratory experiments and repository scale effects that are not observable because of the long timescales involved. Use robust designs and analyses (see Box 11) Repository designs should, as far as practical, incorporate some level of obvious conservativeness or even pessimism in order to accommodate uncertainties. This means using designs and materials that are known to be resilient to a broader range of conditions than reasonably expected: effectively, a margin of safety. One illustration of this approach is taking careful measures to seal galleries or shafts which are, in any case, located relative to the existing groundwater gradients in such a way that they would not represent preferred flow paths. However, care must be taken not to expend resources that are unjustified, and the "tolerability of risk" level of 10-6 per year (see Chapter 5) is often used as a cut-off, below which it is not considered worth spending more money to reduce risk. Analyses can incorporate similar robustness by ensuring that the
Accountingfor uncertainty
197
Box 11:The Meaning of Robustness The word "robust" has been applied to two different aspects of geological disposal (McCombie et al., 1991). In both cases, the fundamental concept is that the outcome of an activity should not be sensitive to uncertainties in the data and assumptions that are used as input. The first activity is the design of the repository system itself; the second is the analysis of the potential future behaviour of that system. A robust repository system is based on: 9 simple geology, physics, chemistry, design, which enhance understanding and transparency; 9 large safety factors in the individual components, such as large corrosion allowances in choosing waste container wall thicknesses; 9 some degree of redundancy in the safety barrier system. A robust performance assessment of the resulting system ensures that: 9 9 9 9
the models employed are well validated; the models and data are realistic or conservative; all potentially negative processes are analysed; the calculated results are insensitive to reasonable parameter or model changes.
full range of possibilities is explored for negative factors about which there is uncertainty, and by not taking any credit for positive factors where there is uncertainty. An example is the common neglect in safety assessments of the ability of corrosion products from deteriorated waste containers to adsorb radionuclides.
Aim for simplicity This approach is closely associated with the previous discussion on robustness. A simple safety concept combined with simple PA models can provide considerable insight into how a system functions, and thus enhance confidence. Although complexity usually increases as a system becomes better characterised, and complex models will always be necessary in a repository development programme, a goal should be to achieve some unified simplification that incorporates both considerable knowledge and insight. This is exemplified by the copper container concept for spent fuel that is utilised in Scandinavia. Extensive and complex R&D supports the understanding of how the copper canister bentonite buffer EBS works, but the concept is simple: total containment until the levels of radioactivity of the spent fuel are the same as the original ore. A further example is the proposal to seek simple, high-isolation sites for geological disposal by performing a worldwide search for environments where the geological and
198
Principlesand standards for the disposal of long-lived radioactive wastes
hydrogeological conditions are particularly simple, which would reduce uncertainties concerning the safety of disposal (Black and Chapman, 2001; Miller et al., 1999). Use a structured approach including iterative assessments The total approach to designing and siting a repository so as to assure that safety is p r o v i d e d - and can be adequately d e m o n s t r a t e d - should be laid out clearly and understandably. The key points to be documented and communicated are the elements defining the safety concept and the features and processes involved in making the safety case. The choice of scenarios analysed must be justified and the analysis methodology clearly explained. Several iterations of performance and safety assessment should be an essential component of a repository development programme. These highlight areas of uncertainty and their impacts in the light of growing knowledge about the concept and, eventually, about a site. Whilst they do not in themselves reduce uncertainties, structured assessments provide a framework for analysing and managing them. Use multiple lines of reasoning, a range of models and natural analogues The results of any particular quantitative model of repository behaviour will not, on their own, give all stakeholders the required level of confidence in system safety. It is necessary to support the interpretations and forecasts within a PA or safety assessment with a combination of alternative predictive models, detailed system models and broadbrush "insight" models based on different principles, and with independent evidence such as that derived from studies of natural analogues (see Box 5). Typical areas where convincing information can be won from studying natural systems include the estimation of corrosion rates of metals and glasses in the ground and the demonstration of low solubility for key radionuclides under repository conditions. It is reassuring to all stakeholders if similar conclusions on the role and impact of a process can be reached using independent sources of evidence. Document the elicitation of expert judgement It is increasingly recognised that many decisions on the use of information and on the content and scope of PAs must be based on expert judgement. Because this is itself a significant source of uncertainty, the basis of decisions must be well documented and traceable. Techniques have been developed for eliciting expert judgements on parameters or processes in a formalised way that minimises biases caused, for example, by participants being influenced by the group dynamics of a common meeting. The ultimate application of human judgement in this area will, of course, be in the licensing process itself. Reaching a regulatory decision cannot be achieved by application of a simple formula: it will always be a matter of judgement. Perform quality assured analyses and have these peer reviewed Peer review helps to identify uncertainties. Alternative opinions of experts, who have not been involved in a programme, test both the concepts and the analyses carried out. In order to work well, the programme that is being peer-reviewed must have had good quality
Accounting for uncertainty
199
assurance, so that all decisions and data are traceable for the reviewers. This allows real uncertainties to be identified directly, rather than being hidden in questions about where information came from or what is assumption and what is fact.
Encourage international cooperation and evaluation This is closely connected with the previous point. In some cases, expertise is spread so thinly throughout the world (e.g. on thermodynamic databases) that international teams are necessary to attack a problem. Some of the experimental approaches useful for reducing uncertainties (e.g. large-scale tests underground) require such extensive resources that single national programmes can hardly afford to work alone. Lastly, in areas where parallel approaches are feasible (e.g. model development, sorption measurements), then the independent results can be compared within a framework of international cooperation, thus increasing confidence in the work. However, as with all approaches dependent upon insiders reaching a consensus on scientific issues, one must guard against this leading to a degree of over-confidence not shared by wider groupings of stakeholders.
12.3
Possible Approach to Uncertainty in Developing Regulations
Regulatory decision-making for long-term repository safety will have to be carried out using a wide range of information, some of which will inevitably be clouded by significant uncertainty. The IAEA suggests that regulatory standards need to begin with a statement that acknowledges this. Such a statement would also indicate that it is expected that some uncertainties will increase when considering times far into the future. This implies that the implementor and regulator would both be expected to adopt a different approach to evaluating performance in the long term and to reaching decisions on acceptability. For example, a common approach is to use stylised scenarios and analyses for the longer term. It would be the judgement of the regulator as to whether such stylisations were acceptable (NEA, 1999b). The options for doing this are discussed in more detail in the earlier chapters on timescales and performance measures, and are not repeated here. Nevertheless, the precautionary principle (see Chapter 3) is explicit in requiring uncertainties to be addressed as comprehensively as possible in reaching a decision whether to proceed with disposal: simply acknowledging that uncertainty exists is not adequate. An appropriate regulatory response would be to require the implementor to carry out a comprehensive programme specifically to identify and, so far as possible, to quantify uncertainties and their impacts on performance. It would be useful to the implementor if the regulations were to stipulate that a range of information would be required in order to reach a licensing decision. This could mean stipulating an iterative programme of safety assessments at key points in the implementor's programme, aimed (among other things) at quantifying the impacts
200
Principlesand standards for the disposal of long-lived radioactive wastes
of uncertainties, in parallel to the developing design and siting studies. Such assessments might be required to include: 9 a structured programme of scenario definition and analysis (addressing scenario uncertainty); 9 identification and evaluation of alternative conceptual models of system properties and of processes (addressing both system and model uncertainty); 9 sensitivity analysis of parameter ranges and combinations, utilising probabilistic methods as necessary (addressing parameter uncertainty, as well as parameter variability); 9 application of diverse arguments and multiple lines of reasoning to support key findings or assumptions; 9 a fully traceable documentation system that allows quality control on all data and decisions; 9 the findings of peer reviews of critical stages of the implementor's programme: in some countries the regulators organise such reviews for themselves (through IAEA, NEA or independently), funded by the implementors. In conclusion, three points concerning uncertainties in waste disposal are re-emphasised: 1.
2.
Quantitatively and qualitatively assessing the uncertainties in potential future behaviour of a repository is recognised as being of key importance. In its 2001 annual report to the US Congress (NWTRB, 2001), the Nuclear Waste Technical Review Board identified as a priority area the meaningful quantification of conservatisms and uncertainties and encouraged the development of multiple lines of reasoning to support the safety case. Uncertainties are unavoidable in all technological enterprises. Accordingly, decisions in all such enterprises must always be taken in the light of residual uncertainties. The NWTRB summed this up well for the case of a deep repository: The Board recognises that any projection of long-term performance ... is inherently uncertain; eliminating all uncertainties will never be possible (although they may be reduced) ... policy makers can make a decision on whether to recommend the site at any time, depending in part on how much uncertainty they find acceptable. Finally, the regulator must have a considered approach to weighing and assessing the results of the safety-based component of a license application. This means being prepared to say something about the weight attached to uncertainties, and the way in which decisions will be reached taking account of the diverse requirements of short-term safety, long-term safety, deployment of appropriate resources and equity with other environmental regulatory decisions that must also involve uncertainty.
Accounting for Uncertainty
In assessing the potential future behaviour of any technical system, we must always deal with uncertainties. Decisions to implement any technology must always be taken in the light of the residual uncertainties. Often, these can be reduced by extensive prior research and development, by extrapolation from knowledge of similar systems and, ultimately, by observing the performance of earlier examples of the technology in question. This is how society has developed acceptably safe transport systems, power production facilities and drugs, for example. For radioactive waste disposal, however, there are some especially challenging aspects of uncertainty. Whilst there are important uncertainties associated with many aspects of a repository development programme (e.g. in the inventory of wastes that might be sent for disposal and in the timescale of the programme itself), the main concern is always associated with long-term safety. In fact, the long timescales considered in geological disposal are a key feature making treatment of uncertainties more challenging than for other, sometimes more complex, technological undertakings. Interestingly, the aspect of radioactive waste management which focussed attention on the long timescales and on the corresponding uncertainties in disposal was our very exact knowledge concerning the times taken for radionuclides to decay. The precision of measured half-lives exceeds that in almost all other parameters, but the extremely long half-lives of some radionuclides draw attention to the difficulty of assessing how other parts of the system might behave over such times. In other areas, such as disposing of heavy metals, which stay toxic forever, consideration of far future effects was long neglected. Increasingly, however, society is recognising that some technologies introduced by man may have potentially enormous impacts sometime in the future, that the uncertainties in predicting these impacts can be huge and that decisions must, nevertheless, be taken in the face of these uncertainties. The examples are growing in number, including pesticides, CFCs and other ozone depleting gases, CO2 and other greenhouse gases and genetically modified
-
-
191
192
Principlesand standardsfor the disposal of long-lived radioactive wastes
organisms. It may come to be recognised that, by their explicit acknowledgement of the uncertainties of future technology impacts and their search for approaches to address these uncertainties, scientists involved in planning radioactive waste disposal have, in fact, played a pioneering role. It is today accepted that uncertainty is an unavoidable aspect of planning and regulating deep geological disposal programmes. This fact was recognised early in the development of assessment methodology. Twenty-five years ago, Bartlett et al. (1977) noted that: Assessment of geologic isolation safety is unique relative to assessments for other engineered systems because some elements of the analysis are not amenable to uncertainty reduction by additional R&D. Wisely, the authors went on to warn that "highly sophisticated models.., could create an unwarranted 'illusion of certainty'". Nevertheless, they were able to propose specific modelling techniques that could address the task of quantitatively assessing some kinds of uncertainty. Their suggestions were to use fault trees, simulation analysis and stability analysis, all of which were recognised to be still at the conceptual phase.
12.1
Development of a Systematic Approach
Soon thereafter, the terms uncertainty analysis and sensitivity analysis became common in the technical literature on repositories. The IAEA (IAEA, 1981) included these in a glossary in Safety Series 56, noting that estimation of uncertainty and error bands needed the application of statistical techniques and definition of input parameters in probabilistic form. However, it was soon realised that a purely quantitative approach was not possible. In an updated performance assessment methodology report (IAEA, 1985), the following causes of uncertainties that could be addressed quantitatively were identified: a) inability of models to represent the system completely; b) approximations used in solving model equations; c) uncertainties in parameters. In addition, it was recognised that a problem was presented by "the inherent irreducible type of uncertainty represented by gaps in our current understanding of the system" and the opinion was offered that "there is little that can be done to resolve this type of uncertainty". It is worthwhile repeating here that considerations of this sort are, in fact, relevant for many technologies. A more topical and, arguably much more important, example today, concerns the emission of greenhouse gases and their effect on future climate. Great uncertainty in this area results from all three causes discussed above and the completeness of current understanding continues to be hotly debated. A consequence of this is that decision makers do not have consistent
Accounting for uncertainty
193
guidance from experts or, to be less charitable, they can choose views that support politically motivated ends. One of the largest sources of uncertainty is predicting the future behaviour of human populations. Societal changes happen much faster than the decades to hundreds of years of importance for climate change mechanisms and very much faster than the tens or hundreds of thousands of years for radioactive waste decay (see Chapter 2). Of critical importance, however, are not the uncertainties in individual parts of the system, but rather the impact of these uncertainties on the overall consequences of any technology. This is one of the key conclusions which have led to geological disposal being favoured for long-lived wastes. Properly chosen deep geological formations are one of the very few environments accessible to man which have such an immensely long stable history that they can reliably isolate wastes from the effects of more transient changes. As pointed out by Thunberg (1999), "we use the relative predictability of geological time to nullify the uncertainty of other time spans". Typically, four types of uncertainty are associated with assessing the future performance of repositories: 9 System uncertainty: uncertainty as to whether the disposal system (repository, EBS and natural environment) has been sufficiently understood and properly characterised. 9 Scenario uncertainty: uncertainty as to how appropriate and how comprehensive or complete are the choices of scenarios of future events and processes that will perturb system evolution. 9 Model uncertainty: uncertainty as to whether the conceptual models used to describe the behaviour of parts of the disposal system represent reality sufficiently well and whether the algorithms of the calculational models correctly represent the conceptual understanding. 9 Parameter uncertainty: uncertainty over the specific parameter values and parameter ranges to use in the models; these parameter uncertainties may be due to the natural variability of the system or to the inexact nature of our measurement techniques. Of particular importance for repositories are the uncertainties in parameters characterising the geological environment. A large volume of rock must be characterised, the spatial scales of key features determining behaviour are small, and the requirement to leave the natural rock barrier intact precludes extensive destructive testing. Ten years ago, it was believed by many that most types of uncertainty could be reasonably managed by a combination of parametric sensitivity analyses, probabilistic analyses, model "validation" and the use of alternative conceptual models. With time, however, it has become appreciated that, in assessing uncertainties associated with looking into the far future, other less quantitative approaches are also needed. In 1991, an NEA expert group (NEA, 1991), whilst recognising that uncertainties can never be completely eliminated, expressed the opinion that "by using both quantitative methods and expert judgement, the amount of uncertainty can be evaluated and a basis for decisions can be provided".
194
Principlesand standards for the disposal of long-lived radioactive wastes
The key element is the recognition that the goal is sufficient confidence in the reliability of the analysis to allow an adequately justified decision to be made. This was made clear in a specific regulatory context by the publication in 1997 of an IAEA report entitled "Regulatory decision making in the presence of uncertainty in the context of the disposal of long-lived radioactive wastes" (IAEA, 1997d). The task of "increasing confidence" in analyses of repository, behaviour has continued to grow in importance. In 1999, a further publication entitled "Confidence in the Longterm Safety of Deep Geological Repositories" was published (NEA, 1999a), concluding that "methods exist to evaluate confidence.., in the inevitable presence of uncertainty" and giving the specific examples of these methods that are described below. Subsequently, the NEA initiated a dedicated Forum on Stakeholder Confidence (NEA, 2000a). Although these are all laudable efforts on the part of the waste management community to address the crucial issues of reducing uncertainties and increasing confidence, there is an undoubted element of "preaching to the converted". In the past, o u t s i d e r s - including even scientists from other disciplines were often not included in the debate. Researchers pointed out that increasing study of an area could also lead to growth in uncertainty, e.g. because new complicating effects are brought to light. An example is the discovery of plutonium in groundwater at a far larger distance from underground weapons tests than the most commonly accepted scientific theories would have predicted (cited in NRC, 2000a). Furthermore, some controlled experiments aimed at determining how well scientific experts could themselves subjectively estimate uncertainties in knowledge have indicated that the more familiar the expert is with the problem, the greater their estimate of uncertainty is likely to be. In the light of this complex situation, advice from international agencies is now recognising that regulations need to be discriminating and practicable in what they require of an implementor as assurance of longer-term safety. For example, it is now a principle of geological disposal that absolute assurance of safety cannot be achieved: what is sought by regulators is reasonable assurance of safety or reasonable expectation that the system will perform safely (IAEA, 1997d). The same reservation is obviously valid for any technological endeavour, but in other areas it is not highlighted in the same way. The IAEA recommends that regulations and standards should include a statement to the effect that absolute proof is not to be had, and that the implementors need only provide reasonable assurance of safety, based on the record of information available to regulators and the public. Already in 1993, the regulations in the USA contained explicit reference to this: Proof of the future performance of engineered systems and the natural geological setting over time periods of thousands of years is not to be obtained in the ordinary sense of the word. ...the standards must accommodate large uncertainties. These include both uncertainties in our current knowledge about disposal techniques and inherent uncertainties about the distant future. (EPA, 1993)
Accountingfor uncertainty
195
Recent regulations for the proposed Yucca Mountain repository continue with these messages. The U S N R C 10 C F R 163 section 101 notes the following: Although the performance objective.., is generally stated in unqualified terms, it is not expected that complete assurance that the requirement can be met will be presented. A reasonable assurance ... is the general standard that is required. The USEPA in its corresponding regulation, 40 C F R 197, section III.C.3, uses a similar term: ... we are proposing the concept of "reasonable expectation" to reflect our intent regarding the level of "proof" necessary ... We intend for this term to convey our position and intent that unequivocal proof of compliance is neither necessary nor likely to be obtainable The back-drop to these considerations is that all parties must be confident that the uncertainties inherent in geological disposal are not so significant as to call a particular course of action into question. The precautionary principle, on which (together with the sustainability concept) much environmental legislation is now being based (see Chapter 3), implies that, where there is significant uncertainty and a potentially serious risk associated with a new practice, then the practice should not be undertaken until the uncertainty has been addressed. Regulators must thus be confident that uncertainty has been addressed adequately, and/or be prepared to make arguments about the risks of taking alternative measures and about the deployment of society's resources (see Chapter 3). The remainder of this chapter examines ways in which reasonable assurance of safety might be demanded of the implementor in regulations.
12.2
Providing Reasonable Assurance of Safety
A comprehensive PA will endeavour, as a matter of course, to quantify the impacts of as much of the known types of uncertainty as possible, by means of: 9 sensitivity analysis (to parameter variation), which could involve probabilistic analysis; 9 the analysis of a range of scenarios of alternative future states of the system; 9 the application of alternative conceptual models of features or processes. To appreciate the importance of the latter two points, it is essential to emphasise again that a single, accurate prediction of future system behaviour is not needed to assure safety. If we look at alternatives, all of which indicate that adequate safety will be provided, then the only question is whether these properly scope the range of possible futures. This brings us again to the question of completeness. Are there effects or consequences which have not been thought of?. The uncertainties raised by this question cannot be quantified.
196
Principlesand standards for the disposal of long-lived radioactive wastes
There are, however, also qualitative approaches to reducing uncertainties which complement the more quantitative approaches listed above. Taken together, the different approaches can reduce uncertainties to levels that justify decision making. The various approaches to reducing uncertainty or conversely to increasing confidence in the safety of deep geological disposal have been discussed in international fora, such as the IAEA and the NEA (IAEA, 1997d; NEA, 1999a; NEA, 2002a). They are outlined below.
Apply good science and continue well-chosen R&D activities throughout the repository development programme Sound science must underlie the development of safe repositories. Over the past 25 years, extensive scientific work has been done in the wide range of disciplines needed for disposal. Although many workers in the field are of the opinion that most of the basic scientific work has been accomplished, all agree that there are areas which will benefit from more research and all recognise that a wealth of good applied science will be needed for implementing repositories and assessing their performance. An example of an area still requiring research is two-phase flow and transport of radionuclides; an example of a mature area with little need for more work is heat transport through rocks. It should be noted that continuing R&D does not imply that an implementor knows so little about the system that progress towards repository implementation is impossible. Rather, it acknowledges that, over the decades of development, science and engineering will develop, so that approaches can be improved or optimised during this period. It has been argued, moreover, that waste management scientists could and should draw more on the general scientific knowledge and experience in other fields, e.g. the complex flow and transport processes of interest have long been studied in the oil and gas industries. The particular types of R&D activities most commonly viewed as being of continued importance are those involving large-scale field tests or underground laboratory experiments. This type of work is valuable for reducing uncertainties by bridging the gap between small-scale laboratory experiments and repository scale effects that are not observable because of the long timescales involved. Use robust designs and analyses (see Box 11) Repository designs should, as far as practical, incorporate some level of obvious conservativeness or even pessimism in order to accommodate uncertainties. This means using designs and materials that are known to be resilient to a broader range of conditions than reasonably expected: effectively, a margin of safety. One illustration of this approach is taking careful measures to seal galleries or shafts which are, in any case, located relative to the existing groundwater gradients in such a way that they would not represent preferred flow paths. However, care must be taken not to expend resources that are unjustified, and the "tolerability of risk" level of 10-6 per year (see Chapter 5) is often used as a cut-off, below which it is not considered worth spending more money to reduce risk. Analyses can incorporate similar robustness by ensuring that the
Accountingfor uncertainty
197
Box 11:The Meaning of Robustness The word "robust" has been applied to two different aspects of geological disposal (McCombie et al., 1991). In both cases, the fundamental concept is that the outcome of an activity should not be sensitive to uncertainties in the data and assumptions that are used as input. The first activity is the design of the repository system itself; the second is the analysis of the potential future behaviour of that system. A robust repository system is based on: 9 simple geology, physics, chemistry, design, which enhance understanding and transparency; 9 large safety factors in the individual components, such as large corrosion allowances in choosing waste container wall thicknesses; 9 some degree of redundancy in the safety barrier system. A robust performance assessment of the resulting system ensures that: 9 9 9 9
the models employed are well validated; the models and data are realistic or conservative; all potentially negative processes are analysed; the calculated results are insensitive to reasonable parameter or model changes.
full range of possibilities is explored for negative factors about which there is uncertainty, and by not taking any credit for positive factors where there is uncertainty. An example is the common neglect in safety assessments of the ability of corrosion products from deteriorated waste containers to adsorb radionuclides.
Aim for simplicity This approach is closely associated with the previous discussion on robustness. A simple safety concept combined with simple PA models can provide considerable insight into how a system functions, and thus enhance confidence. Although complexity usually increases as a system becomes better characterised, and complex models will always be necessary in a repository development programme, a goal should be to achieve some unified simplification that incorporates both considerable knowledge and insight. This is exemplified by the copper container concept for spent fuel that is utilised in Scandinavia. Extensive and complex R&D supports the understanding of how the copper canister bentonite buffer EBS works, but the concept is simple: total containment until the levels of radioactivity of the spent fuel are the same as the original ore. A further example is the proposal to seek simple, high-isolation sites for geological disposal by performing a worldwide search for environments where the geological and
198
Principlesand standards for the disposal of long-lived radioactive wastes
hydrogeological conditions are particularly simple, which would reduce uncertainties concerning the safety of disposal (Black and Chapman, 2001; Miller et al., 1999). Use a structured approach including iterative assessments The total approach to designing and siting a repository so as to assure that safety is p r o v i d e d - and can be adequately d e m o n s t r a t e d - should be laid out clearly and understandably. The key points to be documented and communicated are the elements defining the safety concept and the features and processes involved in making the safety case. The choice of scenarios analysed must be justified and the analysis methodology clearly explained. Several iterations of performance and safety assessment should be an essential component of a repository development programme. These highlight areas of uncertainty and their impacts in the light of growing knowledge about the concept and, eventually, about a site. Whilst they do not in themselves reduce uncertainties, structured assessments provide a framework for analysing and managing them. Use multiple lines of reasoning, a range of models and natural analogues The results of any particular quantitative model of repository behaviour will not, on their own, give all stakeholders the required level of confidence in system safety. It is necessary to support the interpretations and forecasts within a PA or safety assessment with a combination of alternative predictive models, detailed system models and broadbrush "insight" models based on different principles, and with independent evidence such as that derived from studies of natural analogues (see Box 5). Typical areas where convincing information can be won from studying natural systems include the estimation of corrosion rates of metals and glasses in the ground and the demonstration of low solubility for key radionuclides under repository conditions. It is reassuring to all stakeholders if similar conclusions on the role and impact of a process can be reached using independent sources of evidence. Document the elicitation of expert judgement It is increasingly recognised that many decisions on the use of information and on the content and scope of PAs must be based on expert judgement. Because this is itself a significant source of uncertainty, the basis of decisions must be well documented and traceable. Techniques have been developed for eliciting expert judgements on parameters or processes in a formalised way that minimises biases caused, for example, by participants being influenced by the group dynamics of a common meeting. The ultimate application of human judgement in this area will, of course, be in the licensing process itself. Reaching a regulatory decision cannot be achieved by application of a simple formula: it will always be a matter of judgement. Perform quality assured analyses and have these peer reviewed Peer review helps to identify uncertainties. Alternative opinions of experts, who have not been involved in a programme, test both the concepts and the analyses carried out. In order to work well, the programme that is being peer-reviewed must have had good quality
Accounting for uncertainty
199
assurance, so that all decisions and data are traceable for the reviewers. This allows real uncertainties to be identified directly, rather than being hidden in questions about where information came from or what is assumption and what is fact.
Encourage international cooperation and evaluation This is closely connected with the previous point. In some cases, expertise is spread so thinly throughout the world (e.g. on thermodynamic databases) that international teams are necessary to attack a problem. Some of the experimental approaches useful for reducing uncertainties (e.g. large-scale tests underground) require such extensive resources that single national programmes can hardly afford to work alone. Lastly, in areas where parallel approaches are feasible (e.g. model development, sorption measurements), then the independent results can be compared within a framework of international cooperation, thus increasing confidence in the work. However, as with all approaches dependent upon insiders reaching a consensus on scientific issues, one must guard against this leading to a degree of over-confidence not shared by wider groupings of stakeholders.
12.3
Possible Approach to Uncertainty in Developing Regulations
Regulatory decision-making for long-term repository safety will have to be carried out using a wide range of information, some of which will inevitably be clouded by significant uncertainty. The IAEA suggests that regulatory standards need to begin with a statement that acknowledges this. Such a statement would also indicate that it is expected that some uncertainties will increase when considering times far into the future. This implies that the implementor and regulator would both be expected to adopt a different approach to evaluating performance in the long term and to reaching decisions on acceptability. For example, a common approach is to use stylised scenarios and analyses for the longer term. It would be the judgement of the regulator as to whether such stylisations were acceptable (NEA, 1999b). The options for doing this are discussed in more detail in the earlier chapters on timescales and performance measures, and are not repeated here. Nevertheless, the precautionary principle (see Chapter 3) is explicit in requiring uncertainties to be addressed as comprehensively as possible in reaching a decision whether to proceed with disposal: simply acknowledging that uncertainty exists is not adequate. An appropriate regulatory response would be to require the implementor to carry out a comprehensive programme specifically to identify and, so far as possible, to quantify uncertainties and their impacts on performance. It would be useful to the implementor if the regulations were to stipulate that a range of information would be required in order to reach a licensing decision. This could mean stipulating an iterative programme of safety assessments at key points in the implementor's programme, aimed (among other things) at quantifying the impacts
200
Principlesand standards for the disposal of long-lived radioactive wastes
of uncertainties, in parallel to the developing design and siting studies. Such assessments might be required to include: 9 a structured programme of scenario definition and analysis (addressing scenario uncertainty); 9 identification and evaluation of alternative conceptual models of system properties and of processes (addressing both system and model uncertainty); 9 sensitivity analysis of parameter ranges and combinations, utilising probabilistic methods as necessary (addressing parameter uncertainty, as well as parameter variability); 9 application of diverse arguments and multiple lines of reasoning to support key findings or assumptions; 9 a fully traceable documentation system that allows quality control on all data and decisions; 9 the findings of peer reviews of critical stages of the implementor's programme: in some countries the regulators organise such reviews for themselves (through IAEA, NEA or independently), funded by the implementors. In conclusion, three points concerning uncertainties in waste disposal are re-emphasised: 1.
2.
Quantitatively and qualitatively assessing the uncertainties in potential future behaviour of a repository is recognised as being of key importance. In its 2001 annual report to the US Congress (NWTRB, 2001), the Nuclear Waste Technical Review Board identified as a priority area the meaningful quantification of conservatisms and uncertainties and encouraged the development of multiple lines of reasoning to support the safety case. Uncertainties are unavoidable in all technological enterprises. Accordingly, decisions in all such enterprises must always be taken in the light of residual uncertainties. The NWTRB summed this up well for the case of a deep repository: The Board recognises that any projection of long-term performance ... is inherently uncertain; eliminating all uncertainties will never be possible (although they may be reduced) ... policy makers can make a decision on whether to recommend the site at any time, depending in part on how much uncertainty they find acceptable. Finally, the regulator must have a considered approach to weighing and assessing the results of the safety-based component of a license application. This means being prepared to say something about the weight attached to uncertainties, and the way in which decisions will be reached taking account of the diverse requirements of short-term safety, long-term safety, deployment of appropriate resources and equity with other environmental regulatory decisions that must also involve uncertainty.