Assessment principles

A key role of safety assessment is to gain quantitative and qualitative information that allows one to judge the safety of the proposed system and to provide guidance on the future repository development programme. The assessment has to show how a disposal system could evolve over the course of time and discuss what level of safety can confidently be expected. The resulting safety case needs to be robust, i.e. it needs to address all reasonably conceivable issues, and be based on arguments for safety that are reliable.

These aims can be achieved if the following broad principles are obeyed:

• Focus of the safety case – The focus depends upon the stage that has been reached in the overall programme. For the Swiss HLW programme the focus is currently on assessing the feasibility of disposal and on providing guidance of future work by providing a platform for discussion, e.g. with respect to Nagra's proposal to focus future work on the Opalinus Clay in the potential siting area in the region of the Zürcher Weinland. Besides assessing the expected level of safety, the main emphasis is on the evaluation of the reliability and robustness of the system: Is there enough confidence that no outstanding issues exist with the potential to undermine the safety case and thus to justify focusing future work on the Opalinus Clay of the Zürcher Weinland?

• Sufficient scientific understanding – Scientific understanding is the core of a safety case and thus, it has to be convincingly shown that the understanding is adequate for the stage of the programme, i.e. that it is appropriate for the focus of the safety case.

• Systematic and defined method – The safety case has to be developed in a systematic manner based on a clearly defined method. This also contributes to transparency and trace-ability.

NAGRA NTB 02-05 40

• Multiple arguments for safety – The discussion of safety should not only look at compli-ance with regulatory criteria but also other arguments for safety should be provided.

• Documentation – The development of the safety case and its results should be documented in manner that provides transparency and traceability.

For each of these broad principles more detailed principles are defined, which are again based in part on regulations and in part on internal considerations by Nagra, guided by international con-sensus. These are described in the next sections.

2.6.4.1 The focus of the safety case

The focus of the safety case defines where to put the main emphasis of the study and also indicates the level of rigour required in the different areas. It thus defines the scope and boundary conditions of the assessment. The focus depends on the stage of the repository pro-gramme, and moves from assessing broad feasibility and providing guidance towards a more detailed and precise consideration of dose and risk impacts as the programme progresses. The focus of the safety case must be defined by the assessor. It also needs to be explained by putting the safety report in context with the overall repository development programme.

• Assessment of feasibility – In the current phase of the Swiss programme it is important to assess the feasibility of the project and to discuss its robustness. No excessive demands are placed on the level of detail for quantifying uncertainties and for those uncertainties that are difficult to quantify with respect to their likelihood of occurrence, bounding assessments are considered to be acceptable. Thus, the main aim is to be comprehensive with respect to the identification of sources of uncertainty.

• Guidance for future stages – At the current early stage of the repository programme, an important role of safety assessment is to provide a platform for the discussion of a broad range of topics related to repository development. More specifically, the findings from the safety assessment, together with those from the regulatory authorities' review thereof, will provide guidance for future stages of repository planning and development. In order to provide an adequate platform for discussion, in the safety report much emphasis is put on the evaluation of the level of confidence available for the option "Opalinus Clay of the Zürcher Weinland". This includes the identification of key phenomena with respect to long-term safety and an evaluation of current understanding about the performance of these phenomena, as well as calculations of overall system performance for a broad spectrum of cases covering all realistically conceivable possibilities for the characteristics and evolution of the barrier system. These quantitative analyses are complemented with qualitative evaluations.

2.6.4.2 Scientific understanding

Scientific understanding is the basis for each safety analysis and determines which phenomena can be relied upon in developing the safety case.

• Documentation of the scientific basis – The scientific basis for the key assumptions of the safety analysis needs to be clearly described and discussed. This also includes the referen-cing to key reports.

• Evidence for key phenomena – The safety assessment will allow identification of the phenomena most important to safety. For these phenomena the scientific evidence for their reliable operation needs to be discussed.

41 NAGRA NTB 02-05

• Resolution of open issues – The assessment of the information base for describing and quantifying key phenomena and the level of confidence in their reliable operation will indicate if there are any outstanding issues that have the potential to undermine the safety case. If such issues exist, it is important to assess the possibilities for their satisfactory resolution in the course of the project.

2.6.4.3 Systematic and defined method for conducting the analyses Principles and objectives relevant to the carrying out of the analyses⁵⁷ are:

• Systematic approach to information collection, treatment and abstraction – The assess-ment has to rely on a systematic approach that ensures that no important issues are over-looked and that their treatment (including abstraction) is done in an adequate manner.

• Ensurance of completeness – All reasonably foreseeable possibilities for the characteris-tics and evolution of the disposal system must be considered in developing safety case arguments, and the various sources of bias must be recognised when conducting and interpreting the analyses. Intentional human intrusion, and processes and events that are either extremely unlikely or have considerably more serious non-radiological consequences are, however, excluded, in accordance with the HSK-R-21 regulatory guideline.

• Rigour in consideration and treatment of uncertainty – Although, as far as possible, all potential sources of uncertainty must be considered, the degree of detail required in quanti-fying uncertainty will depend on the stage of the programme, and will increase as the proposed site and design become more firmly fixed. In the current early phase of the project bounding analyses are in many cases considered to be appropriate.

• Irreducible uncertainties – A stylised approach is adopted for the modelling of the evolution of the biosphere and the nature of future human behaviour and actions, on account of the largely irreducible and unquantifiable uncertainties associated with predictions, even over relatively short timescales.

• Development and validation of models and databases – A range of measures must be adopted to ensure that the models and databases developed and applied in the analyses are suitable for their intended purpose, in accordance with the requirement for validation in the HSK-R-21 regulatory guideline.

• Verification of codes – Each computer code used to perform analyses must be verified, in accordance with the HSK-R-21 regulatory guideline.

• Internal and external reviews – All important issues are subject to internal and/or external review.

• Timescales to be considered in the assessment – The safety of the disposal system must be assessed for as long as the waste poses a significant hazard. Quantitative analyses must be carried out into the distant future, as required by the HSK-R-21 guideline. The limits to the applicability of models, particularly at distant times, must, however, be recognised when interpreting results. In this analysis, as in Nagra's previous safety assessment for HLW (Nagra 1994a), the main emphasis is on the period up to one million years. However, the analyses are complemented with arguments that the good performance of the system will continue beyond one million years for at least another few million years. Therefore, the quantitative calculations are carried out for the period up to 10 million years although it is

57 In addition to the principles and objectives mentioned below, for completeness' sake it should be mentioned that all activities in carrying out a safety assessment are performed under strict quality assurance measures.

NAGRA NTB 02-05 42

recognised that at times so far in the future some of the assumptions may no longer hold.

Additionally, in Section 5.2.2.3 a more qualitative discussion is provided for the different evolutionary stages of the repository that may arise in the period beyond a few million years.

2.6.4.4 Multiple arguments for safety

Safety will be assessed using several indicators and arguments:

• Compliance with regulatory criteria – Compliance with regulatory criteria is essential for judging safety. For Project Entsorgungsnachweis, the criteria are defined in HSK-R-21 (Protection Objectives 1 and 2, see Section 2.3.2).

• Complementary safety indicators – In addition to the criteria defined in HSK-R-21, other indicators will be used for judging the safety of the system. These include the radiotoxicity of the wastes compared with naturally occurring radiotoxicity, the spatial distribution of radiotoxicity as a function of time, a comparison of radiotoxicity fluxes from the repository system with naturally occurring radiotoxicity fluxes and radiotoxicity concentrations in the host rock due to the repository compared with natural radiotoxicity concentrations. The characteristics of these alternative indicators are such that they give an appropriate indication of the performance of the system and are less sensitive to the uncertainties in surface conditions than dose calculations.

• Existence of reserve FEPs – Reserve FEPs are a qualitative argument for safety because their existence indicates that in reality performance will be positively affected by pheno-mena that have been excluded from the current safety assessment.

• No outstanding issues with the potential to compromise safety – The safety assessment will allow the identification of those phenomena that are key to the safety of the repository.

The evidence available that provides confidence in their reliable operation will show if the argument can be made that no outstanding issues exist that have the potential to undermine the safety case.

2.6.4.5 Principles relevant to the documentation of the safety case

The documentation of the safety case should be guided by the (in some respects, conflicting) principles of transparency and traceability. In consideration of this requirement, and as dis-cussed in Chapter 1, the safety assessment report is divided into two parts; i.e. this report, which aims at a transparent presentation of the safety case, and the Models, Codes and Data report (Nagra 2002c) which aims to provide traceability of the calculations that support the safety case:

• Transparency – The arguments and analyses that make up the safety case, and the process by which these are derived, must be readily understood. Too many details can result in a loss of transparency. This is why the present report aims at pulling together the arguments and analyses that make up the safety case without giving all the detailed formulae and data used in the evaluation of the assessment cases.

• Traceability – The documentation of the arguments and analyses that make up the safety case should provide the information required for a reviewer, for example, to reproduce key calculations, to understand the reasoning leading to particular model assumptions and to trace the source of parameter values employed in the analyses. The Models, Codes and Data report (Nagra 2002c) is designed to provide traceability in this sense.

43 NAGRA NTB 02-05