Development of a Generic Safety Narrative for a UK Geological Disposal Facility

Abstract The UK has published a generic Disposal System Safety Case for a geological disposal facility (NDA, 2010) and is planning to update this in 2016. However, it is a challenge to present a meaningful safety case when the location and hence the design of a geological disposal facility are not known. Consequently, this paper describes our aim to present a narrative, explaining how we can have confidence in the long-term safety of a geological disposal facility. This narrative is based on an understanding of the environmental safety functions of a geological disposal facility and the features, events and processes (FEPs) that support them. The highest level environmental safety functions required for a geological disposal facility are isolation and containment. By isolation we mean removal of the wastes from people and the surface environment. By containment we mean retaining the radioactivity from the wastes within various parts of the disposal facility for as long as required to achieve safety. Beneath these top-level environmental safety functions we have identified generic environmental safety functions associated with each of the key safety barriers within a geological disposal facility, namely: the wasteform, the container, the local buffer or backfill, the mass backfill (in the access tunnels and service ways), the plugs and seals and the geosphere. This paper discusses the application of environmental safety functions and FEPs to building a safety narrative and explains how it is proposed to use such an approach to develop a generic environmental safety case for the UK to provide confidence in the longterm safety of a geological disposal facility after it has been sealed and closed.


Introduction
THE UK policy for the long-term management of higher activity radioactive wastes is deep geological disposal, and a new siting process has recently been launched (DECC, 2014) to identify a suitable site for the construction of a geological disposal facility (GDF) in the UK. As regards long-term safety, a suitable site will be one where the geology has appropriate properties to work with appropriately designed engineered barriers to keep the wastes safe. To identify potential sites for a GDF, the UK Government favours a voluntarist approach based on working with communities that are willing to participate in the siting process.
Of fundamental importance, is the demonstration that a GDF will be safe. The implementing organization, Radioactive Waste Management Limited (RWM) will present a series of safety cases during the development of a GDF, which will need to be scrutinized and accepted by the regulatory authorities before permission is given for the construction of the GDF and as the GDF is built and operated and eventually closed. The safety cases will set out plans for the safe transport of wastes to the GDF, the construction and operation of the GDF and will explain how the GDF uses multiple natural and engineered barriers to provide long-term environmental safety.
However, at the current time, as a potential site has not yet been identified for a GDF, UK safety case work is generic, i.e. not specific to any particular site or GDF design. This is because the design of a GDF will be very much influenced by its geological setting. It is a challenge to present a meaningful safety case when the location and design of a GDF are not known. Therefore, at this generic stage, it is proposed that the main focus of the long-term environmental safety case is a 'narrative', explaining how it is possible to have confidence in the long-term safety of a GDF. Where required, this narrative will be supported by illustrative calculations to provide confidence that it will be possible to satisfy the regulatory requirements for a suitably designed and sited GDF. Such a narrative will continue to be developed, including site-specific discussion, as the GDF development programme progresses. The supporting calculations will become more meaningful as the safety case becomes site-specific.
In siting and designing a GDF, it is important to consider those aspects of the site and design that contribute to its safety. The various ways in which components of a GDF may contribute to safety are termed 'safety functions'; for example, a clay buffer around the disposal containers has the safety function of protecting the containers and also provides a diffusive barrier to limit the migration of radionuclides should a container fail as a separate safety function.
Long-term, post-closure environmental safety involves consideration of the evolution of a GDF and its geological setting over hundreds of thousands of years. This requires understanding and integration of research into engineered barrier materials, wasteforms and radionuclide behaviour under GDF conditions. It is necessary to show that a GDF will be safe for all credible environmental evolution scenarios. Demonstrating this at a generic stage involves building a 'safety narrative' that describes the safety functions provided by different geological settings and engineered barriers. Such a narrative may be conveniently structured by considering the safety functions and examining the timescales over which they are effective and the situations in which they may be challenged or compromised.
A generic post-closure safety narrative requires the identification and consideration of a range of scenarios. These scenarios will consider normal, planned operations and also potential accident situations or unexpected evolutions of a GDF, which test the robustness of the safety of a GDF under less desirable situations. Appropriate scenarios can be identified by considering the action of features, events and processes (FEPs) that may be detrimental to one or more of the safety functions.
The UK is fairly unique in developing a totally generic safety case. The UK has a diverse range of higher activity waste types for disposal as well as a wide range of different potential geological settings in the UK that could be considered suitable for hosting a GDF. Together, these facts mean a wide range of disposal concepts require consideration. In comparison, for example, both Sweden and Finland sought sites for the disposal of spent nuclear fuel in the crystalline bedrock of the Scandinavian Shield with a well-developed disposal concept (SKB, 2011;Posiva, 2012). France also has a diverse disposal inventory, but is focusing its search for a GDF location in clay host rocks and has produced a feasibility study for the disposal of high-level reprocessing wastes in a clay host rock (Andra, 2005). The US has a licensed facility for transuranic wastes (similar to UK intermediate-level waste) in a salt formation (USDoE, 1996) and is currently developing generic safety assessments for the disposal of spent nuclear fuel and high-level waste.

Environmental safety functions
In its Guidance on Requirements for Authorisation (GRA) (Environment Agency and the Northern Ireland Environment Agency, 2009), the Environment Agency (the UK environmental regulator) defines environmental safety as "The safety of people and the environment both at the time of disposal and in the future". It further defines 'environmental safety functions' as "the various ways in which components of the disposal system may contribute towards environmental safety, e.g. the host rock may provide a physical barrier function and may also have chemical properties that help to retard the migration of radionuclides".
The highest level environmental safety functions required for a GDF are 'isolation' and 'containment'. By isolation we mean the removal of the wastes from people and the surface environment. By containment we mean retaining the radioactivity from the wastes within various parts of the disposal facility for as long as required to achieve environmental safety. Features that contribute positively to providing isolation include the depth of the GDF, the stability of the surrounding geology and the lack of potentially exploitable mineral resources. Such features may be considered as desirable siting requirements.
Features and processes that contribute to containment tend to be those associated with the multiple barriers of the disposal concept, for example, the stability of the wasteform, the container integrity, the retentive properties of the buffer/backfill and the retardation properties of the geological barrier. It is helpful to consider the environmental safety functions provided by particular components of a GDF that contribute to the high-level environmental safety functions of isolation and containment. The various components of a generic geological disposal concept are illustrated in Fig. 1, together with an indication of the environmental safety functions they may provide.
The relative importance of different safety functions will vary between different disposal concepts; however, all are likely to have some combination of the following generic environmental safety functions.
Wasteform (i.e. the conditioned waste inside the container) (1) The ability to limit the release of radionuclides (in gaseous or liquid form); this safety function may be achieved by retaining the radionuclides in a stable matrix (e.g. through retardation mechanisms such as sorption) and/or influencing the chemical environment to limit releases.
(2) The ability to stabilize the structure and geometry of the engineered barriers, for example, by limiting void space.
(3) The ability to protect the internal surface of the waste container, for example, by providing and controlling an appropriate chemical environment to limit container corrosion.
(4) Preclusion of nuclear criticality within the waste package by ensuring that the package contents are and remain sub-critical.

Container
(1) Limitation of the release of radionuclides (in gaseous or liquid form); this safety function is achieved by physical containment and by the prevention of water ingress.
(2) Prevention of failure through over-pressurization; this may be achieved by robust container design and /or container venting.
(3) The ability to stabilize the structure and geometry of the engineered barriers, for example, by providing mechanical support.
Local buffer or backfill (immediately surrounding the waste packages) (1) Protection of the metallic container; this safety function may be achieved by limitation of the rate of groundwater ingress, and/or by establishing and buffering a favourable chemical environment.
(2) The ability to stabilize the structure and geometry of the engineered barriers, for example, by filling space and having the appropriate mechanical properties.
(3) Limitation of the release of radionuclides, for example, by establishing a favourable chemistry, providing sorption sites and/or limiting groundwater egress.
(4) Limitation of over-pressurization, for example, by allowing gas to escape from the engineered barriers and/or reacting with the gas to form minerals.
Mass backfill (in the access tunnels and service ways): (1) The ability to stabilize the structure and geometry of the engineered barriers, for example, by filling space and having the appropriate mechanical properties.
(2) Limitation of the release of radionuclides, for example, by limiting groundwater ingress and egress.

Plugs and seals
(1) Prevention or limitation of the release of radionuclides, for example, by limiting groundwater movement and having appropriate physical properties.
(2) Stabilization of the engineered barriers; this safety function is achieved by the appropriate location and mechanical properties of the plugs and seals.

Geosphere
(1) Limitation of the release of radionuclides; this safety function is achieved by a combination of the groundwater return time and the retardation mechanisms in the geosphere.
(2) Protection of the engineered barriers; this safety function is achieved by the mechanical stability of the geosphere and/or by its favourable chemical properties. (3) Control of concentration of contaminants in the surface environment; this is achieved by the groundwater return time, retardation mechanisms in the geosphere and/or dispersion and dilution.

Building a safety narrative
The environmental safety functions will each contribute to isolation and containment over different timescales, and the timescales over which particular environmental safety functions are most effective will depend on the specific disposal concept and its geological setting. For example, the containment function for a particular disposal concept may be provided in turn by the container, wasteform, buffer/backfill and geosphere. Highly durable containers (such as copper canisters for high-heat-generating wastes) may be expected to provide containment for hundreds of thousands of years, whereas containers for lowheat-generating wastes may be less durable or vented and the chemical containment provided by the backfill and the geosphere environmental safety functions will be relatively more important. Isolation is provided by the geological setting and complemented by the plugs and seals used to close the access-ways to a GDF. A stable geological setting and well-constructed plugs and seals will ensure isolation for a very long period. During the period of total isolation, the majority of the radionuclide inventory will decay. However, as a GDF and its setting gradually evolve over time, some radioactivity from the GDF may return to the surface environment.
In describing and analysing the performance of a GDF, it is therefore helpful to consider three different 'safety states': (1) containment in the engineered barrier system; (2) containment in the geological barrier; and (3) return of residual materials to the environment.
The durations of the three safety states will vary for different disposal concepts and also for different radionuclides. For example, relatively insoluble actinides may be contained in the buffer/backfill for a significantly longer period than more soluble and mobile radionuclides, such as chlorine and iodine. The safety case base scenario can be discussed in terms of these safety states and the timescales over which they are applicable for different concepts and different radionuclides. It is important to emphasize that all three 'safety states' are safe, at whatever time they occur.
The return of residual materials to the environment is governed by regulatory discharge authorizations during the operational phase of the GDF, and beyond the period of authorization by demonstration that the risks associated with the return of any residual materials to the environment are consistent with the regulatory risk guidance level (Environment Agency and the Northern Ireland Environment Agency, 2009). These regulations ensure that any releases are at acceptable levels. Residual materials will be only non-radioactive materials and very long-lived radionuclides, for example after several hundred thousand years the remaining inventory will be similar to that of a natural uranium ore body.
It is recognized that gaseous releases have the potential to occur on much shorter timescales than releases via groundwater. Features and processes that contribute to limiting gaseous releases (e.g. by reducing gas generation, promoting the dissolution of gas and/or 'trapping' the migration of gas) may be discussed in terms of siting requirements. If gaseous releases cannot be prevented, the focus will be on demonstrating that the third safety state is met, i.e. demonstrating that any releases are within acceptable levels.
Features, events and processes that have a potentially negative impact on safety will be considered in relation to their potential impacts on the safety functions that provide isolation and containment. In general, it may be possible to mitigate against potentially negative features or processes by providing enhanced safety features, for example, by providing long-lived disposal containers if the geological setting does not provide a sufficiently long groundwater travel time. The overall requirements on the disposal concept will be that the highlevel safety functions of isolation and containment can be demonstrated to be achieved through an appropriate combination of safety functions of the specific components of the disposal concept. These safety functions may be provided by natural features or processes present in the system, or by specific safety features that are designed into the disposal concept. In some instances it may be appropriate to place quantitative requirements on certain safety features, but in general it will be the combination of (designed) safety features working together with natural safety features that provide safety.
There are some potential events and processes, whose likelihood and time of occurrence are unknown, but which could have a potentially negative impact on the performance of a GDF. Some such events and processes are naturally occurring, such as seismic or volcanic events or significant climate change (including glaciation) or the events and processes that could lead to a criticality; others are human-induced, such as future human intrusions. The GRA provides clear guidance on the treatment of human intrusion as a separate, variant scenario. Other 'negative FEPs' are assessed in terms of their likelihood of occurrence and their potential impact on the safety functions of a GDF should they occur. For example, RWM's criticality research programme has followed this approach and been able to demonstrate that a criticality is extremely unlikely to occur but even if it should, the consequences would be acceptable in terms of the continued provision of isolation and containment.

Application of generic environmental safety functions
The above listed generic safety functions can be considered in more detail by identifying the FEPs that influence each of the environmental safety functions. The OECD-NEA FEP database (NEA, 2012) provides a helpful checklist to ensure that all relevant FEPs are considered. RWM is using the NEA FEP database to build a safety narrative that links consideration of FEPs to the generic environmental safety functions for each of the components in a generic disposal concept. An example of how this is being developed for the wasteform is given in Fig. 2. The FEPs shown on Fig. 2 are high-level FEPs that may represent the effects of many sub-FEPs, as included in the NEA FEP database in more detail. This diagram can be developed and expanded as needed as the project progresses; for example, a version could be produced to highlight the FEPs relevant to a specific wasteform. The development of such figures provides a pictorial summary of the safety narrative that can be produced to explain the safety role of each of the main components of a GDF.

Next steps
It is proposed that this generic safety narrative will be applied to specific disposal concepts and geological settings; for example, each of the six illustrative example concepts considered in RWM's published generic DSSC (NDA, 2010), tell the 'safety story', i.e. how safety is achieved for each of the illustrative concepts.
The safety narrative framework is also being trialled to support post-closure assessments of waste packaging proposals, thus linking the postclosure disposability assessments to the environmental safety functions by considering which FEPs present or absent in a specific packaging proposal may contribute to or potentially harm the safety functions. This will lead to safety narratives for specific waste packages, which will themselves become part of the overall safety narrative for a GDF.
The safety functions captured in the generic safety narrative can be used to identify generic safety requirements, which are in turn used to develop generic disposal concepts that are able to satisfy the safety requirements for the disposal inventory in different geological environments.
Moving forward, as RWM begins to develop a site-specific safety case, concept-and site-specific safety narratives will be iteratively developed. These will inform the development of GDF designs that can form the basis of safety assessment calculations. Figure 3 indicates the process by which a site-specific safety case may eventually be developed. This diagram highlights the important iteration between disposal system specification, design, safety assessments and needs-driven research to build understanding, identify and reduce uncertainties and control required changes in order to develop an optimized disposal system with a robust safety case. The safety narrative, which can be developed at this generic stage, provides an important role in capturing the qualitative understanding that will underpin the future iterative development of the safety case.