This presentation summarizes a series of reflections on the relation of science to safety in the geological disposal of radioactive waste. The first was presented at a conference “Key Topics of Deep Geological Disposal,” held in July 2022 in Cologne, Germany (Grambow and Ewing 2022), the second at the “Migration” conference in September 2023 in Nantes, France, and the third one was prepared for the “Clay” conference in November 2024 in Hanover, Germany, but was withdrawn after Rod Ewing’s passing in July 2024. The basic thesis of these presentations is that, despite decades of research at huge costs, the field of radioactive waste management and disposal has not, by and large, capitalized sufficiently on this research in the development of a basic understanding of the key issues that dominate the safety case.[2]As described by Grambow and Ewing (2022), there is a tension between the science of near-field processes and performance assessments of geologic repositories.[3] Here, we review spent nuclear fuel and high-level waste (HLW) glass, as these two waste forms have received considerable attention over the past decades.[4] Still, quantitative safety analyses have led some scientists and safety engineers to posit that the performance of these waste forms is of little consequence to the overall performance of a deep geological repository. To answer this position, we also discuss the role of redundancy in the multi-barrier concept of geological disposal.

What we have learned

The first issue is to answer the question of whether progress has been made in the understanding of the performance of spent nuclear fuel (SNF) and HLW-glass in a geologic repository. The answer is emphatically: Yes! This is evident, for instance, when comparing the present state of knowledge with the review chapters on HLW-glass and spent nuclear fuel in Nuclear Waste Forms for the Future published in the late 1980s (Lutze and Ewing, 1988).

Nearly 40 years later, key advances in the understanding of spent fuel corrosion in a geological disposal environment include:

• Quantification of the instant release fraction[5] for safety-relevant nuclides as a function of burnup (a way to measure how much uranium is burned in the reactor) and fuel type (Lemmens et al. 2017).
• Recognition of the importance of reducing geochemical conditions.[6]
• Understanding the role of hydrogen in assuring very low solubility of the fuel matrix in water; therefore, supporting the long-term stability of spent fuel in a repository (Carbol et al. 2009).
• Recognition of the limited importance of temperature and hyperalkaline conditions (pH of 9 and above) on spent fuel performance (Lemmens et al. 2019).

Similarly, key advances in the understanding of HLW-glass performance include:

• Identification of saturation effects in water of dissolved glass constituents and understanding of glass performance as a function of the geometry and water exchange rates in the disposal setting (Grambow 2006).
• Ability to predict the formation of secondary phases[7] formed upon glass corrosion, fixing a large quantity of initially released and dissolved radionuclides.
• Appreciation of the large differences in glass behavior for different glass compositions.

There was also considerable progress in the use of natural systems of geologic age to provide both quantitative data for long-term extrapolations of the behavior of waste forms in a geologic repository and qualitative data for the long-term safety case:

• Assessment of the long-term performance of SNF and fission product release over billions of years using experimental results and observations from natural systems, such as the Oklo natural reactors in Gabon.
• Confirmation of the low glass dissolution rates in confined spaces by comparing laboratory experiments with basaltic glasses formed in the ocean.

Problems with a truncated safety assessment

Despite this progress, waste forms play a limited role in many safety analyses. Often, the arguments for long-term performance are mainly used for public relations rather than their scientific value. Research results on these two important waste forms (SNF and HLW-glass), when used in safety analyses, typically show that the waste forms are not the key barrier to protecting the future environment. This means that the waste form performance has only a limited impact on the calculated final dose from a repository in 100,000 to millions of years. Sadly, the authors note a strong tendency to repeat previous work without building on past knowledge. Our research community must address this problem of knowledge management.

There is also the issue of the multi-barrier concept,[8] which is closely tied to the use of multiple lines of evidence in support of safety. As Rustum Roy (1979) stated, “It is widely accepted now that any scheme for immobilization and isolation of wastes will contain a set of sequential barriers. For some years we have been calling this part of the system the Russian (matryoshka) doll…The solid form that contains the radionuclides is after all both the only unavoidable component of every system and possibly the strongest link in the chain.”

In addition, many decades of research have provided evidence, for example, that a repository architecture in a deep clay rock formation can be built in a way that provides multigenerational isolation for radioactive waste by assuring that very slow diffusion-controlled mass transfer remains the dominant process.[9] Even if the waste had been emplaced at depth in a water-soluble form, long-term safety of future generations would be assured by the mass transfer resistance of the well’s backfill material and the sealed clay rock host formation. Evidence for this mass transfer resistance stems not only—and not primarily—from models but also from field observations dating many millions of years of migration times of soluble species, such as chlorine 36 in clay rock formations. It is demonstrated that bentonite clay barriers closing access and emplacement tunnels have comparable very high mass transfer resistance.

Even if the waste form is not the key barrier, its stability can provide important redundant evidence for safety claims and therefore more confidence in the disposal system. Confidence in safety analysis cannot be increased by increasing the calculated safety margins (relative to the legal dose threshold) of the repository system from a factor of 100 to a factor of 10,000 in millions of years, but redundancy can increase confidence. The stability of the waste form against corrosion and partial dissolution by clay pore water would still contribute as a supplementary barrier to the redundancy of the safety arguments, providing multiple lines of evidence in favor of the performance of the isolation system.

While intuitively, such barrier redundancy would create confidence in the design of the isolation system, and while the long-term performance of each barrier in the multi-barrier isolation system is always assessed, each barrier’s contribution to the overall system’s safety is typically addressed, quantified, or documented for their impact on expected final dose exposure values. These safety analyses typically show compliance of the waste isolation system to long-term (tens of thousands to million years) dose criteria, considering favorable and less favorable interactions and evolution scenarios. Safety analyses that include the contribution of the waste form also show compliance even in the unlikely and unexpected event in which the waste form would have been dissolved instantaneously (after container corrosion) in the clay pore water.

Safety case beyond safety assessment

Dose calculations are only one necessary part of the safety case. Other important elements include the qualitative scientific, technical, administrative, and managerial arguments and evidence in support of the safety of a disposal facility; the suitability of the site and the design; natural analogues; the construction and operation of the facility; the assessment of radiation risks and assurance of the adequacy, and the quality of all the safety-related work associated with the disposal facility. The safety case will also be the main basis for dialogue with interested parties. Barrier redundancy is an important argument in such a safety-oriented dialogue.

However, dose calculations are not predictions. While confidence in the realism of such calculations remains low even in the scientific and safety research communities, the confidence in their bounding character can become sufficiently high to show compliance of disposal projects in front of regulatory bodies.

Yet we can learn from aviation safety (Tufekci, 2024)—a domain in which there has been an astonishing 15 years in the United States without a single death from a crash—that redundancy of technical systems and controls is the key to safety. Redundancy layers precautions in complex safety-relevant systems involving many factors of change—technology, engineering, corporate culture, regulation, weather, human factors, politics, and more—all potentially interacting with each other.

The continued research by distinct research communities on each of the barriers of the multi-barrier system and their interactions can sometimes provide results that appear to be contradictory. These contradictory results often create scientific disputes that either challenge or comfort the barrier system’s performance. Often, the research community does not have a full understanding of how their results might contribute to the safety case. Yet, typically, it is not the scientific quality of the new research results that is in question, as this is assured by the review process of high-impact scientific journals. What is at stake is rather whether, how, and how much the conclusions of new experimental observations will impact the disposal system’s long-term evolution and its expected barrier performance.

Barrier redundancy is sometimes used to argue against the significance of research results that may negatively impact the safety calculations of the waste isolation system. Arguing that potentially negative results do not matter due to the presence of other barriers equals giving up considering barrier redundancy as an asset in a safety case.

The value of barrier redundancy

Even though research communities with strong expertise in one field of research (e.g., glass or clay rock) often lack expertise in the other fields, the safety case is composed of both redundant contributions. As safety engineers put together the overall story of repository safety, including barrier redundancy, they sometimes lack the in-depth scientific background in each of the related research fields. Barrier redundancy is not a “nice to have” optional argument for long-term repository safety but a key requisite for confidence in repository safety. Barrier redundancy itself needs to become a field of study of scientific research on its own.

Barrier redundancy requires comparable protection capacity of each redundant barrier over a selected time of interest. This often can be realized only for periods of time that are much shorter than the overall disposal requirements. For example, nuclear waste glass may isolate incorporated radionuclides for some 100,000 years, whereas the clay rock of a repository may provide isolation potential for millions of years. Being able to show that having various redundant barriers that each contribute to protect future human beings from the radioactive waste for some 100,000 years would already be a tremendous positive signal. This would be even more encouraging if one of the barriers (e.g., clay) can provide protection even after the other barrier finally fails.

Redundancy does not mean that barriers are independent. Glass performance, for example, will significantly depend on the rate and quantity of water access to the repository over a very long time, limited by the porosity of the clay rock. If the safety case comprises multiple lines of evidence for long-term safety, there is no longer the need for an unreachable, unverifiable fully coupled long-term evolution model of all significant barriers. Coupled models remain useful to show expected interactions in the disposal system in time and space. But to assure long-term safety, the redundancy approach requires only to show the potential contribution of each one of the redundant barriers.

Unless the scientific community can reinvigorate the role of waste forms in containing radionuclides in the near-field, the geological disposal concepts will continue to rely solely either on dilution and sorption processes in the far-field and/or on the containment in a confinement zone in the repository rock to meet regulatory requirements.

Because of the lack of understanding of waste form behavior as a key barrier in the disposal system, scientists and experts often are solving the wrong problems, such as when proposing the use of advanced reactors to lower actinide inventories in repositories whereas, in fact, actinides in spent fuel disposed of in a repository can be safely contained by appropriate geologic conditions. Ultimately, the main safety issue with deep geological disposal of radioactive waste is often the fate of relatively mobile, long-lived fission products, and these can be retained by highly durable waste forms.

(Editor’s note: This article is published posthumously. The draft manuscript was prepared by both authors. It has been lightly edited for style, length, and clarity. Additional information and definitions have been added as endnotes, below.)

Endnotes

[1] This quote was added by Rod Ewing to his oral lecture in Nantes in 2023.

[2] The “safety case” approach has been developed to address the issue of evaluating the performance of a geologic repository in the face of the large uncertainty that results for evaluations that extend over hundreds of thousands of years (International Atomic Energy Agency 2012; OECD Nuclear Energy Agency 2013; Grambow 2023).

[3] The near-field corresponds to the volume of geological medium surrounding a geologic repository (tens of meters range radius). It is affected by coupled thermal, hydrological, and mechanical processes during the first 1,000 years after waste emplacement (Diaz-Maurin and Ewing 2018).

[4] For more details, see the article by Daniel Gregg and co-workers in this issue.

[5] The instant release fraction corresponds to the fraction of the radioactive waste inventory that is released nearly instantaneously upon contact with water after the waste package is breached.

[6] Reducing conditions occur when chemical species present in the surrounding environment tend to accept electrons, thereby creating bonds with other species. Reducing conditions are very important in a geological repository system to decrease the mobility of radionuclides into the environment.

[7] In a deep geological repository, the corrosion and alteration of the waste form and the engineered barrier system can lead to the formation of new solid phases (regions of material that are chemically uniform) that can offer additional incorporation mechanisms assuring radionuclide retention.

[8] In geological disposal, the multi-barrier approach to the containment of radionuclides consists of engineered barriers—including the waste form, the waste package, and the structural barriers—and geological barriers—including the surrounding backfill (or overpack) and the host rock (Diaz-Maurin and Ewing 2018).

[9] A mass transfer process in which the movement of a substance is controlled by the diffusion of molecules through a medium.