Establishing confidence in the safety of deep disposal

The NEA Performance Assessment Advisory Group set up a working group on Integrated Performance Assessments of Deep Respoitories (IPAG) in 1994. The aim of IPAG is to provide a forum to discuss safety and assess performance, and examine the overall status of safety cases and their supporting integrated performance assessment (IPA) studies.

The third exercise, IPAG-3, was to evaluate the approaches used to establish confidence in safety. The objectives of IPAG-3 were to evaluate the state of the art for obtaining, presenting and demonstrating confidence in long-term safety, and make recommendations on future directions and initiatives for improving confidence.

Development of a deep geologic repository is characterised by several stages and requires several decades for completion. The long duration of this process reflects the novelty and complexity of the tasks of elaborating a repository concept as well as the sensitivity of such projects in society.

At the end of each development stage, a decision is taken whether to move forward, and whether the requirements for the next development stage need to be adjusted. It is important to communicate, for each stage, the basis for the current level of confidence, and clearly indicate the strategy for resolving the outstanding issues.

Various issues need to be addressed to help build confidence in both technical reviewers and other stakeholders. The key confidence arguments identified in IPAG-3 are:

Confidence in the proposed disposal system

• Intrinsic robustness of the multi-barrier-system.

• ?hat if??scenarios.

• Comparisons with familiar examples and natural analogues.

Confidence in the data and knowledge of the disposal system

• Quality of the research programme and site investigations.

• Quality assurance procedures.

• Data from a variety of sources and methods of acquisition.

• Formal data tracking systems.

Confidence in the assessment

• Logical, clear, systematic assessment approach.

• Assessment conducted within an auditable framework.

• Building understanding through an iterative approach.

• Independent peer review.

Confidence in the IPA models

• Explaining why results are intuitive.

• Consideration of alternative conceptual models and modelling approaches ?simple and complex.

• Testing of models against experiments and observations of nature.

• Model comparison exercises.

• Natural analogues.

• Independent evidence such as paleohydrogeological information.

Confidence in the safety case and the IPA analyses

• Clear statements and justifications of assumptions.

• Demonstration that assumptions are representative or conservative.

• Sensitivity studies.

• Clear strategy for managing and handling uncertainty.

• Multiple safety indicators.

• Multiple lines of reasoning.

Confidence via feedback to design and site characterisation

• Support for any disposal concept design changes.

• Overall quality and safety of the disposal system.

A multi-barrier system is common to all disposal systems represented within IPAG. However, the exact definition of a multi-barrier system can vary from country to country. IPAG-3 recommends that implementers define what is meant by the multi-barrier concept, including any functional requirements required for long-term safety.

At the highest level, the main challenge for any safety case is addressing the uncertainties that arise from the long time scales associated with repository performance. It is necessary in an IPA to comprehensively address such uncertainties and show that the repository can be expected to provide for the long-term protection of human health and the environment.

Confidence in data employed in the safety case rests on the assurance that the research and site characterisation work has been properly carried out and the data correctly understood and interpreted. A suitable quality control system should be in place to track data from its source to its use in the safety case and IPA. The assessment approach is also a key part of the safety case, and it needs to be clear and transparent in order to build confidence.

IPAG-3 recommends that a safety case should include a clearly developed confidence statement, and this should be given a prominent location within the documentation. Such a statement could be supported by a review of the approach to managing and handling uncertainty, citing the most important conservative assumptions made and their impacts, and highlighting any reserves of safety, such as positive features or processes not included in the analyses. The confidence statement should explain how assessment results compare with appropriate regulatory criteria, and could make comparisons with levels of naturally occurring radiation and other everyday risks, to put the radiological risks arising from the repository into perspective.

Building technical confidence

Trust is an essential prerequisite for decision-making to proceed. Trust consists of two main components: technical competence and an ?ffective component?which is a combination of the following social elements: openness, reliability, credibility, fairness, and caring.

The technical competence component of trust implies that confidence is needed in the safety case and its supporting IPA that form the technical basis for the decision. The safety case will be widely reviewed by internal and external peers, and checked against the needs of varied audiences. The safety case needs to describe:

• The context in which the report was prepared.

• The safety concept, including the main features and processes upon which safety rests.

• The principles and assumptions adopted, the methods followed, and the data and information to evaluate long-term safety and safety and develop confidence in the appropriateness of the overall safety assessment strategy.

• The results of the IPA.

• The provisions within the research, development and demonstration programme to further demonstrate and support the safety concept.

• The strategies to deal with the remaining uncertainties that are important to long-term safety.

Inevitably, there will be people who suggest that the information provided in a safety case or the confidence in its findings are not sufficient to permit the decision at hand to be made. To help put the safety case in the context of the stage of repository development and the needed decision, IPAG-3 suggests that the following four issues need to be explicitly addressed.

• Inherent limitations in modelling future evolution of the repository: is it reasonable to move forward?

• The level of integration: is all collected information properly used, and does it lead to a consistent picture of the system? What are the potential impacts of the unresolved inconsistencies on safety?

• The completeness and quality of various types of information and data available for making the safety case: what are the uncertainties and their potential impacts on safety?

• Were there any disagreements amongst technical experts?

The four points illustrate another central issue: what level of confidence should be required for a decision? Certain aspects of the evolution of repository are important to safety, while others may have only a limited influence. This should be made clear in a safety case, to allow a productive discussion on whether the confidence achieved is sufficient for decision making at each step.

The step-wise approach taken by nuclear waste management programmes offers the possibility of addressing technical and non-technical issues in a manner acceptable to a wide range of stakeholders. The step-wise approach to decision making offers the following benefits:

• Remaining issues and approaches and prospects for their resolution are detailed at each stage.

• Decisions can be reviewed and revised or reversed.

• Confidence in developers and reviewers of safety cases and repository development and decision making processes can be gradually developed and confirmed.

• Subdividing the process into steps, giving society the chance to form an opinion during development.

It is important to build confidence in the final safety case by making that case incrementally. The safety case needs to be structured, technically argued, and supported with a clear link to the decision-making process, including the decision at hand and the decisions required for future steps.

Developing confidence arguments

People need to be convinced of the safety of the disposal system. A safety case is to support a decision in repository development. As such confidence arguments are required to show that a sufficient base of information exists to make the decision at hand, and that it is appropriate to take the course of action recommended.

Arguments are required to build confidence in the safety of the disposal system. A disposal system for radioactive waste should be designed, sited and constructed to intrinsically favour safety and provide confidence that the overall system will maintain its integrity over long periods of time. Several radwaste management organisations are siting and designing deep geological repositories using a robust disposal system that incorporates simple features, for which there is practical experience, and which are acted upon by well-understood forces. By avoiding complex features and phenomena, the engineering performance and safety of these repository systems are simpler to evaluate.

In addition, many waste management organisations have programmes that demonstrate the technology for disposal of radioactive waste. These demonstrate the feasibility of the disposal system.

One of the most important features for deep geologic disposal is a repository design based on a multi-barrier system. A deficiency in one barrier should not significantly jeopardise the long-term safety of the entire system. Generally, barriers consist of a series of physical components that contribute to the containment and isolation of the waste, protect the waste from humanity and the environment, and prevent or delay the migration of radionuclides and other contaminants from the waste to the accessible environment.

Examples of barriers include:

• Low solubility waste form (particularly for vitrified high-level waste).

• Fuel cladding (for spent fuel).

• Long-lived container vessel with structural support.

• Diffusion-controlling buffer material.

• Backfill materials and repository seals with favourable chemical properties.

• Low permeability host rock with stable geochemical and mechanical properties.

Not all of these barriers will be relevant for all disposal systems. Some repository designs include an over-design of the engineered barrier system to account for uncertainty in barrier performance and provide an additional margin to meet regulatory compliance, while other systems may rely more on maintaining favourable chemical conditions in the near field and on the performance of the geosphere.

There are three approaches to exploring the adequacy of a multi-barrier system:

• Evaluation of barrier effectiveness under a given scenario.

• Exploration of the evolution of barriers to investigate how the safety functions of the barriers may change.

• Exploration of the consequences of one or more barriers being less effective.

Confidence in the data

Many challenges of developing a safety case derive from the fact that performance must be demonstrated over tens of thousands of years. There is certainty regarding some key aspects of the concept of deep geological disposal, such as the decay of radionuclides over time. However, there will be uncertainties regarding phenomena and data over such time scales, such as uncertainty regarding the future course of events external to the repository and the long-term evolution of repository materials. The uncertainty over the evolution of repository materials is dependent on the extent of available knowledge of the material properties.

Safety of the repository system will be more strongly affected by some uncertainties than others. It is beneficial to identify and address such sensitivities at an early stage.

Confidence in data used in the safety case rests on the assurance that the research has been properly carried out and the data has been correctly understood. It is therefore essential to have traceable documentation of all data, and clear records of their use.

Not all data is generated under the auspices of a repository programme. Most repository design principles rest on established scientific understanding and fundamental relations like conservation of mass and thermodynamics. Confidence in the quality of data and its interpretation can be enhanced by using data from a broader base.

Considering the time over which a repository project is developed, it is important that clear records are kept of all important decisions and their basis.

Confidence in assessment

A safety assessment should be conducted within an auditable framework, consistent with a regulatory framework that is clear and accepted by stakeholders. The assessment methodology should be systematic and logical, making it clear what features, events and processes (FEPs) have been considered, and the justification for excluding any FEPs from consideration.

A repository is developed in stages. Original design concepts are transferred into engineering proposals. Sites are selected and explored from the surface via boreholes and finally underground. The assessment approach should allow incorporation of any new data or understanding. All IPAG-3 participants adopt an iterative approach to development of an IPA. Within this iterative framework, it is important to demonstrate how each assessment cycle builds upon the one before.

Confidence in safety case

Explicit treatment of uncertainties is recognised as an essential part of building confidence in the safety case.

Uncertainties in data may be handled by probabilistic safety assessments, which provide a systematic treatment of the effects of input parameter uncertainty. Some organisations use deterministic sensitivity studies which are helpful in exploring the impact of uncertainty in a particular parameter.

Systematic scenario selection based on FEP analysis is the preferred approach to handling uncertainties regarding evolution of the repository system. This is generally based on a reference scenario and a range of variant scenarios that assess the impacts of the uncertainties in the repository evolution on long-term safety.

Multiple safety indicators

Most IPAG-3 participants consider the total system evolution, not just radionuclide transport, and many organisations use alternative safety indicators as a complement to individual risk and dose calculations. Examples of indicators, in addition to dose rate to humans and individual risk, which have been assessed in different safety cases produced or reviewed by IPAG-3 participants include:

• Comparison of dose rate with natural background radiation levels.

• Collective dose calculations.

• Calculation of radionuclide fluxes from various barriers.

• Comparison of radionuclide releases with the volume of natural environment containing the same amount of radioactivity.

• Comparison of radionuclide concentrations at selected points with naturally occurring levels.

• Assessment of chemical toxicity impacts by comparing estimated concentrations in the biosphere with naturally occurring concentrations and with the environmental increment.

• Calculation of dose rates to biota or ecological risk assessments for specific non-human biota at the site.

• Calculation of time scales for which various barriers provide isolation.

• The fate of specific radionuclides, describing where in the engineered system or migration path they decay.

• Calculation of time evolution of radionuclides in different components of the repository system.

• Calculation of the fractions of the initial inventory which reach the geosphere and biosphere.

• Consideration of the spatial distribution of radiotoxicity between barrier components as a function of time.

• Making comparisons with the IAEA (1996) proposed clearance levels for removal of low-level radioactive material from regulatory control.