Understanding the likelihood and consequences of post-closure criticality in a geological disposal facility

Abstract A geological disposal facility (GDF) will include fissile materials that could, under certain conditions, lead to criticality. Demonstration of criticality safety therefore forms an important part of a GDF's safety case. Containment provided by the waste package will contribute to criticality safety during package transport and the GDF operational phase. The GDF multiple-barrier system will ensure that criticality is prevented for some time after facility closure. However, on longer post-closure timescales, conditions in the GDF will evolve and it is necessary to demonstrate: an understanding of the conditions under which criticality could occur; the likelihood of such conditions occurring; and the consequences of criticality should it occur. Work has addressed disposal of all of the UK's higher-activity wastes in three illustrative geologies. This paper, however, focuses on presenting results to support safe disposal of spent fuel, plutonium and highlyenriched uranium in higher-strength rock. The results support a safety case assertion that post-closure criticality is of low likelihood and, if it was to occur, the consequences would be tolerable.


Introduction
RADIOACTIVE Waste Management (RWM), a wholly owned subsidiary of the Nuclear Decommissioning Authority (NDA), is responsible for implementing geological disposal of the UK's higher-activity waste inventory. At present in the UK a site for a GDF has not been identified. Therefore, RWM has produced an initial 'generic' Disposal System Safety Case (DSSC) (Nuclear Decommissioning Authority, 2010a) to communicate the safety arguments for geological disposal using a range of illustrative disposal concepts and paired host geologies.
A GDF will include disposal of a significant amount of fissile material, which if not managed appropriately, could hypothetically, under very specific conditions, lead to an unplanned neutron chain reaction ('criticality'). Therefore, demonstration of criticality safety forms an important part of the DSSC.
The environment agencies' Guidance on Requirements for Authorisation (GRA) for a GDF (Environment Agency, 2009) requires a demonstration that "the possibility of a local accumulation of fissile material such as to produce a neutron chain reaction is not a significant concern". Furthermore, the GRA states that the "environmental safety case should also investigate, as a 'what-if' scenario, the impact of a postulated criticality event on the performance of the disposal system." The environmental safety case (Nuclear Decommissioning Authority, 2010b) is an important component of RWM's DSSC.
Containment provided by the waste package (e.g. wasteform and container combinations) will contribute to criticality safety during package transport and the GDF operational phase, and the GDF multiple-barrier system will ensure that criticality is unlikely for some time after facility closure. However, over extended post-closure timescales, conditions in the GDF will evolve and it is necessary to demonstrate: an understanding of the conditions under which criticality could occur; the likelihood of such conditions being reached; and the consequences of criticality should it occur. This paper summarizes results from two recent projects that form part of RWM's post-closure criticality safety research programme. The 'likelihood of criticality' project considers the possibility of post-closure criticality and the 'modelling of consequences of hypothetical criticality' project focuses on understanding the consequences of a hypothetical post-closure criticality event. A companion paper (Mason et al. 2015) discusses the local consequences of hypothetical post-closure criticality in greater detail than is covered in this summary paper. Both projects have recently been fully documented and are available via the NDA's bibliography (Hicks et al. 2014a,b;Hicks and Baldwin, 2014;Mason & Smith 2015a,b;Mason et al., 2014).

Scope of research
Work conducted has addressed the disposal of all of the UK's higher-activity wastes in the 2007 Derived Inventory (e.g. low-level waste destined for a GDF, intermediate-level waste, depleted, natural and lowenriched uranium, high-level waste, spent fuel (SF), plutonium (Pu) and highly-enriched uranium (HEU)). Disposal in three illustrative geologies (higher-strength rock (HSR), lower-strength sedimentary rock (LSSR) and evaporite) has been considered. This paper, however, focuses on presenting results to support safe disposal of SF, Pu and HEU in a HSR geology, as this geology is broadly bounding from a criticality safety perspective (i.e. advection-dominated transport resulting in focusing of fissile material compared to diffusive transport in LSSR and little/no transport potential in dry evaporite).
Assumed disposal concept Figure 1a shows the illustrative design assumed for geological disposal of SF, HEU and Pu in HSR. In brief, the disposal area consists of disposal tunnels designed for in-tunnel vertical emplacement of individual containers in deposition holes, with each container surrounded by bentonite (a swelling clay-based material). When all of the deposition holes in a disposal tunnel have been filled, the tunnel would be backfilled with bentonite. For the HSR geology, a thick walled copper container (for corrosion resistance) is assumed with a cast iron insert (for structural strength). Figure 1b shows the assumed disposal concept for a pressurized water reactor (PWR) SF. In this case four PWR assemblies would be packaged within a copper container. Figure 1c shows the assumed disposal concept for Pu and HEU. In this concept the fissile material is immobilized in a titanium-based ceramic, incorporating neutron poisons (hafnium and gadolinium, substances with a large neutron absorption cross-section) and loaded into stainless steel cans ( purple cylinders). The cans of ceramic 'pucks' are then encapsulated by borosilicate glass (green) within a stainless steel canister (light purple). This canister is placed within a cast-iron insert (orange annulus) and an outer copper container (brown). The copper container is surrounded by bentonite. There are seven stacks of cans within the inner package, all surrounded by borosilicate glass. Each copper container would hold ∼280 kg of ceramic pucks (equivalent to 33.3 kg of PuO 2 or UO 2 ).

Criticality-scenario construction and evaluation
The proximity of a given system to criticality is measured by the neutron multiplication factor, known as K effective . If K effective is <1, the system is sub-critical. A value = 1 shows a just critical system and a value >1 means that the system is super-critical.
Criticality scenarios were constructed based on consideration of the features, events and processes (FEPs) that might affect K effective after GDF closure. Three criticality scenarios were defined broadly in terms of: (1) FEPs that could result in increased reactivity inside a single waste package; (2) FEPs that could result in accumulation of fissile materials outside a single waste package; and (3) FEPs that could result in accumulation of fissile material from multiple failed waste packages. The likelihood of criticality work firstly applied qualitative judgements on the credibility of each scenario before conducting a probabilistic assessment if it was deemed necessary. GoldSim Monte Carlo simulation software was used for the modelling (GoldSim, 2009(GoldSim, , 2010. The approach involved implementing in GoldSim equations representing fissile material migration and accumulation mechanisms and associated parameter value uncertainties for each post-closure criticality scenario requiring assessment. The probabilistic modelling capability in GoldSim allows probability density functions of parameters relevant to each criticality scenario to be sampled, such as the range of copper container corrosion rates or possible groundwater flow rates that might be expected in a GDF in HSR. By sampling parameter values over many realizations (1000), the model was used to estimate the likelihood of critical concentrations or masses of fissile material developing after GDF closure. A schematic diagram showing the main components of this model is given in Fig. 2. For scenarios involving accumulation of fissile material outside a waste package, modelling outputs were compared conservatively to minimum critical masses required to achieve criticality for idealized spheres of fissile material in various barrier materials (referred to here as criticality maps). K effective inside a degrading waste package was calculated using the MCNP neutron transport code based on the GoldSim outputs. The present work sought to identify scenarios where post-closure criticality is incredible and scenarios where it is not. Scenarios that could not be demonstrated to be incredible are still considered to be of extremely low likelihood.
The work did not attempt to assign a probability to these low-likelihood events.
In contrast, the consequences of criticality work focused on evaluating the consequences of hypothetical criticality based on 'what-if' scenarios. It used the same three broad scenarios but took no credit for the likelihood of their occurrence. Instead, a two stage process was applied. Firstly, static criticality calculations were undertaken to understand if critical configurations could exist for a given scenario. If critical configurations were demonstrated to be possible, transient criticality calculations were undertaken to understand the consequences of an evolving criticality. This methodology was discussed further by Mason et al. (2015).
There are two broad types of criticality event, one with negative temperature feedback and one with positive temperature feedback. Negative temperature feedback means that, as temperature rises, the K effective of the system reduces, and therefore a mechanism is required to insert reactivity into the system (e.g. the arrival of further fissile material in flowing groundwater or the progressive flooding of a SF assembly) to hold K effective close to unity, otherwise the excursion will shut down. This type of criticality event is referred to as a quasi-steadystate (QSS) criticality. RWM work has developed a model to understand the consequences of this type of low-power, potentially long-duration criticality event occurring in a GDF. The second type of criticality event possesses positive temperature feedback, meaning that, as the temperature rises, the K effective of the system also rises, causing the heat output to accelerate and a sudden energetic release. This type of criticality is referred to as rapid transient criticality. RWM work has also developed a range of models to understand the consequences of this second type of criticality occurring in a GDF. Importantly, scenarios can only result in rapid transient criticality for dilute 239 Pu systems. Therefore, the passage of time reduces the possibility of rapid transient criticality occurring (as 239 Pu decays to 235 U). It is acknowledged that a hypothetical post-closure criticality event would not necessarily evolve purely as a QSS or RT event.
Complex dependencies of K effective with evolving temperature, fissile composition and neutron moderation, for example, could lead to changes in whether the system has negative or positive temperature feedback as the criticality evolves. For the purposes of scoping studies, such variations have not been considered in detail; on the basis that QSS or RT analysis should bound the local consequences of criticality. The likelihood of criticality work presented in this paper focuses on the expected post-closure evolution of waste containers and the GDF itself (based on substantial national and international research, documented in RWM's 2010 DSSC; Nuclear Decommissioning Authority, 2010a). Because of this, the likelihood analysis has been restricted to PWR fuel with an expected average irradiation history (60 GWd/te). In contrast, from the point of view of 'what-if' consequence analysis, consideration has also been given to fuel that may have experienced less irradiation (than average), including zero irradiation (referred to as fresh fuel). This type of analysis is useful for providing bounding consequences, even if the presence of such SF is not considered likely.

Likelihood results
Figure 3 shows a single model run illustrating the evolution of the various materials that make up a PWR SF package over post-closure timescales. In this typical model run, failure of the copper container occurs by general corrosion after >10 6 y (see red line showing copper-volume reduction). Importantly, by this time most 239 Pu in the fuel will have decayed to 235 U. Most of the uranium remains in solid form, but a small amount is advected out of the container on very long timescales, >10 8 y. The results of MCNP calculations of the reactivity of the system after water has entered the container are shown as black lines on the right hand axis for two different fissile material distributions: 'water mixed' where all materials are uniformly mixed with water and 'segregated' where solid material slumps to the base of the waste package. The largest value of K effective is ∼0.5, which shows that a degrading waste package would remain sub-critical and demonstrates that in-package criticality occurring from the disposal of PWR SF is incredible. Note that the PWR SF considered in this analysis has been assumed to be subject to an average irradiation history or 'burn-up' (a measure of the neutron irradiation of the fuel), such that it has an effective enrichment (the weight fraction of the fissile nuclides) of ∼1.2 wt.% 235 U.
As a small amount of fissile material would be advected out of a failed package on very long timescales, work also considered accumulation of 235 U in the bentonite buffer surrounding a failed container. The maximum calculated fissile mass occurred in the mid-buffer component (Fig. 2), but was at most, little more than 1 kg of 235 U after 10 8 y. By comparison with criticality maps, which show that for low-enriched uranium systems, tens of kg of 235 U would be required in saturated bentonite to achieve criticality, it is possible to state that such accumulations would not result in criticality (Mason and Smith, 2015b). The calculated maximum mass of 235 U in the tunnel components and downstream accumulation zone (allowing for the possibility of accumulation from multiple failed containers) (Fig. 2) is <0.1 kg. Such an accumulation of 235 U would not result in criticality.
In the case of separated Pu waste packages, the 239 Pu in the package will have decayed almost entirely to 235 U by the time of earliest breach of the container by corrosion. Consequently, the results for Pu and HEU waste packages are virtually the same, and are therefore discussed together.
The typical evolution of the package-material volumes for a single model run in which the copper container fails through general corrosion is shown in Fig. 4. Once the ceramic wasteform containing the HEU (or originally Pu) is exposed to water, it begins to degrade, but most of the uranium remains in solid form, with dissolution being solubility limited. In this example some dissolved uranium is advected out of the container (based on the assumed flow rates). Cautiously, as the ceramic degrades, the neutron poisons (hafnium and gadolinium contained within the ceramic wasteform) are assumed to be dissolved and removed in flowing groundwater. The calculated K effective values of the flooded system increase as the ceramic degrades, as shown in Fig 4. However, the largest K effective value calculated was ∼0.75 when the ceramic had degraded and all the poisons were removed. This shows that in-package criticality caused by failure of copper containers, containing HEU and/or Pu is incredible. Independent consequences of criticality analysis reached the same conclusion (i.e. in seeking cases for in-package HEU/Pu consequence analysis, none was found) (Mason and Smith, 2015b).
In some of the model runs, larger amounts of 235 U were shown to be advected out of a failed HEU/Pu package on very long timescales. Therefore, work also considered accumulation in the bentonite buffer surrounding a failed container. The maximum calculated uranium mass occurred in the mid-buffer component (see Fig. 2) and was ∼25 kg 235 U (i.e. almost the entire content of a waste package) after 10 8 y. The uranium has an enrichment of ∼30 wt.% 235 U (reduced from ∼100 wt.% 235 U by the 238 U added to the wasteform to act as a diluent and neutron absorber). A few kg 235 U would be required for criticality in bentonite under optimum conditions (Mason and Smith, 2015b). Therefore, it is not possible to demonstrate that post-closure criticality occurring from the accumulation of uranium outside of a failed HEU/Pu container is incredible on timescales in excess of 10 6 y. Table 1 summarizes the likelihood of postclosure criticality results presented in this paper for SF and HEU/Pu disposed of in copper containers in HSR. Over the long post-closure timescales considered (up to and exceeding 1 m.y.), because of the very long half-life of 235 U (∼704 m.y.), we cannot always demonstrate that uranium-based post-closure criticality is incredible (note that we can still demonstrate that the likelihood is low/ vanishingly small). However, as there is a finite likelihood attached to such scenarios we require understanding of what the consequences would be (i.e. to the GDF multiple barrier system) if one of these low-likelihood events was to be realized. Ultimately we need to be able to demonstrate that the facility could tolerate such an event.

Consequence results
In the consequences work, the MONK criticality software was used to produce detailed criticality maps for accumulation of fissile materials (Fig. 5) in a range of GDF-relevant barrier materials: grout (at different levels of degradation/porosity); Nirex Reference Vault Backfill (NRVB, a porous cementbased backfill material); bentonite (a swelling clay buffer material); granite, clay, evaporite and crushed rock (Mason and Smith 2015a,b). The host materials that are most relevant to SF, Pu and HEU disposal in HSR are bentonite and granite. The critical mass of the oxide is plotted on the vertical axis against the concentration of oxide on the horizontal axis of Fig. 5. All curves are derived by searching for concentration and mass combinations that have a K effective = 1 (i.e. a just-critical system). The region below the curves is sub-critical and the region above the curves is super-critical.
A comparison of criticality maps for accumulation of 239 PuO 2 is shown in Fig. 5, for the different materials likely to be present in a GDF. While porosity is an important control on where critical Only credible for fresh/low burnup fuel.
Not credible under the conditions assumed.
Not credible under the conditions assumed. Not credible if we assume PWR fuel of typical burn-up. Criticality may be possible following failure of a container of fresh PWR fuel. Earliest failure has been assumed to occur after 2 × 10 5 y.
Insufficient fissile material accumulation in bentonite, even if the fuel was assumed to be unirradiated.
Insufficient fissile material accumulation in the deposition tunnel, even if the fuel was assumed to be un-irradiated.

HEU (and Pu)
Not credible under the conditions assumed Only credible over very long timescales.
Only credible on very long timescales. Insufficient mass of fissile material in the waste package, but the peak reactivity calculated on a timescale of tens of millions of years indicates that the waste package is only marginally subcritical at that time.
Accumulation of fissile material in the bentonite could result in criticality on a timescale of tens of millions of years.
Accumulation of fissile material in the deposition tunnel could result in criticality on a timescale of the order hundreds of millions of years.
configurations could hypothetically occur, it is not the only consideration. Had porosity been the only control (i.e. the solid only acts as a diluent to the concentration of fissile and moderating materials), then the curve for clay (12% porosity) would have been between granite (1%) and grout (30%). Instead the clay curve is similar to the grout (30%) curve. This indicates that the chemical composition of the solid influences the criticality map.
From Fig. 5, we conclude that critical accumulations are hypothetically possible in grout, NRVB, granite, clay and bentonite, assuming idealized conditions for criticality (i.e. spheres of homogeneous, optimally moderated fissile material). Minimum critical masses vary from ∼0.7 to 40 kg of 239 Pu, depending on the host material. No critical systems were found in evaporite or for lowenriched uranium (<10 wt.% 235 U) in granite.
The calculated criticality maps for accumulation of fissile material in bentonite (the material surrounding the container in the disposal concept considered; see Fig 1a) is shown in Fig. 6. In the figure legend, the ratio Pu:U means 239 Pu: 235 U and 100U, 100U10 and 100U3 mean pure uranium at 100% 10% and 3% 235 U enrichments, respectively. Significant trends are observed. Firstly, as 239 Pu decays to 235 U, the minimum critical mass required to achieve criticality increases. Furthermore, if neutron absorbers (such as 238 U) are also present, then the minimum critical mass increases further. Figure 6 also shows that for fissile-material accumulations in bentonite, positive temperature feedback (therefore rapid transient criticality) is only possible for a narrow range of fissile concentrations and, as the fraction of 235 UO 2 increases in the mixed 239 PuO 2 : 235 UO 2 systems, the total fissile mass required for positive feedback increases significantly. Positive temperature feedback occurs to the left of the diamonds shown in Fig. 6. When no diamond is shown, temperature feedback is always negative. This observation shows that the longer it takes for hypothetical accumulations of fissile material to occur, the less credible a rapid transient criticality becomes. We conclude that rapid transient criticality is not credible after ∼100,000 y (or ∼4 half-lives of 239 Pu). As RWM is confident that it can design container and wasteform combinations that can collectively ensure that 239 Pu is not accumulated in significant masses within a 100,000 y timeframe, the occurrence of a rapid transient post-closure criticality can be discounted. Figure 6 shows this for accumulation in bentonite, but similar trends are observed in other GDF-relevant materials. The present paper therefore only discusses how a negative temperature, QSS post-closure criticality event may evolve, and what the consequences of such a low-likelihood event might be. Masses at the minimum critical mass (MCM) in bentonite, as defined by a criticality map, three times the MCM and ten times the MCM were considered. A range of fissile material arrival rates in flowing groundwater were considered (to act as the required reactivity insertion). The QSS model FIG. 7. Calculations of K effective as a function of water ingress into a PWR fuel copper disposal container for fuel compositions at different levels of irradiation of initially 5% enriched uranium. The average irradiation is given in GWd/te, and the cooling period, T, is given in years where applicable. 10 kg of water per compartment is equivalent to a flooded height of ∼30 cm (156.5 kg = fully flooded). predicted that for mass arrival rates of the order of 1 g/y, or lower, the power of the hypothetical criticality event was limited to a few kilowatts, and temperature rises of more than 10°C above ambient were restricted to a localized region of a few metres around the fissile accumulation. Larger consequences were observed at higher rates of accumulation, but only if it was assumed that fissile arrival (in-flowing groundwater) could continue after the pore water (moderator) boiled, which is not thought to be credible. For fresh PWR fuel (zero irradiation) a flooded container would become critical after water ingress causing ∼30 cm of flooding (Fig. 7). As the irradiation of the fuel increases, the possibility of criticality reduces. At an average fuel irradiation of >35 GWd/te (quite modest compared to the typical UK PWR fuel inventory) the container remains sub critical, even if it fully floods. The general conclusion is that a post-closure criticality following the flooding of a copper container is not possible, provided that the average irradiation of the fuel is >35 GWd/te.
For hypothetical criticality events initiated by partial flooding of a fresh PWR fuel container, the temperature feedback coefficients are negative, meaning that only a QSS criticality could occur, with continued flooding acting as the reactivity insertion. For an initial system corresponding to the just-critical point for the 5% enriched uranium curve, with no irradiation (green dashes, shown in Fig. 7) QSS consequence calculations were under taken (results not shown). Awide range of flooding rates were considered, ranging from 10 -14 m/s (∼14 m.y. to flood a package) to 10 -3 m/s (1.25 h to flood a package) because, depending on the mechanism for flooding, the rate could be relatively fast (e.g. a sudden weld failure following geological activity) to very slow (e.g. slow water ingress due to corrosion).
For all of the flooding rates considered, the temperature rise experienced was bounded by 205°C (temperature rise of 165°C above GDF ambient temperature). Furthermore, rises of >10°C were shown to be limited to a localized area of just a few metres and power output was always calculated to be <2 kW. Application of the consequence of criticality models to hypothetical post-closure events for spent fuel disposal is presented in expanded detail in (Mason et al., 2015). The figure 5 in the work by Mason et al. (2015) shows the power-output results discussed above.
Collectively, these results support the opinion that a post-closure QSS criticality occurring following accumulation of sufficient 235 U material from a failed SF or HEU/Pu container, or from flooding of a failed PWR fuel container (noting that the fuel would need to be un-irradiated to achieve criticality in the first place) would yield consequences that are low and tolerable.

Discussion
Results presented here cover spent (and fresh) PWR fuel and other nuclear materials such as Pu and HEU disposed of in copper containers in a HSR geology.
Our understanding of how the disposal system will evolve, including the corrosion behaviour of containers, is based on substantial national and international research. This underpinning knowledge base has been documented in RWM's 2010 DSSC (Nuclear Decommissioning Authority, 2010a). The findings support RWM's safety-case assertion that post-closure criticality is of low likelihood and that if one of these low-likelihood events was to be realized (over long post-closure timescales), the consequences of such an event would be low. Further ongoing work will apply this new understanding to make safety arguments as to why a post-closure criticality event is not a significant concern. This will be achieved via consideration of the effects of a potential criticality on pathways that might give rise to a post-closure risk in the future, such as the transport of radionuclides in groundwater. We will also consider the changes that a criticality would induce in the radionuclide inventory.

Conclusions
Work summarized here has achieved significant capability development with regards to understanding the likelihood and demonstrating the consequences of post-closure criticality events. For example: • Probabilistic models have been developed to evaluate post-closure criticality scenarios such as: (1) rearrangement of materials in a waste package; (2) accumulation of fissile material in the barriers outside of a waste package; and (3) accumulation from multiple packages. • Significant model development has also been achieved on the QSS criticality consequence model. We can now model and understand the consequences of a QSS criticality from flooding a SF disposal container. By utilizing the capability developed it is now possible to state the following high-level conclusions: • All SF, Pu and HEU disposal packages are subcritical by design during transport, operations and the early post-closure period of GDF. • SF disposal packages remain sub-critical under flooded conditions and accumulation of fissile material from failed SF containers is insufficient to support criticality (assuming legacy PWR fuel and expected average irradiation history). • Failed HEU/Pu packages are sub-critical because of their robust, poisoned wasteform. Sufficient 235 U could accumulate in the surrounding buffer for criticality, but only on very long timescales (>10 6 y). However, it should be remembered that accumulated masses of fissile material have been compared conservatively to idealized spherical configurations, which are not likely to occur in a GDF. When we cannot demonstrate that post-closure criticality is incredible, we can still make strong low-consequence arguments.
• Even for large (and unlikely) rates of container flooding or fissile material arrival in groundwater, the power output from a QSS criticality is no more than a few kW and temperature rises are restricted to a few hundred°C. Temperature increases of >10°C are limited to a radius of a few metres.