and operation, most necessary statements will need to be well-substantiated, ideally through multiple lines of evidence, argument, and analyses including, for instance, full-scale demon- strations and quantitative modelling. For example, the issue of acceptability of costs is a neces- sary statement in that a repository will not be implemented if the associated financial costs are found to be unacceptable. Cost constraints are, however, likely to be more flexible than the absolute requirements for both long-term and operational safety. Thus, although good engineering practice is to recognise the need for reasonable costs as a factor at all stages of repository planning, the cost assessments that are carried out as part of a feasibility assessment need not be detailed and precise at early programme stages. Rather, it must be shown that costs are unlikely to be prohibitive and that the most important cost items have been identified (with a view to optimisation). Cost evaluations are, however, likely to become more detailed and precise as the programme matures.
Figure 4 – Necessary versus nice-to-have statements in the overall structured set of safety and fea- sibility statements. Necessary statements are represented as plain boxes. Nice-to-have statements are represented as outlined boxes.
2.2.4.3 Assessment of the level of support available for safety and feasibility statements
Safety and feasibility statements generally begin as unsubstantiated or poorly-substantiated claims and develop into increasingly well-substantiated claims as the design and implementa- tion procedures are developed and optimised, and the evidence, arguments and analyses that support each statement are acquired or progressively developed.
While safety and feasibility statements are generally developed from the top-down, they tend to be assessed in terms of the level of support available from the bottom-up, beginning with lower-level, more detailed statements, and progressing to higher-level, broader statements (Figure 5). For example, in order to establish whether the construction of a waste package, which may consist of a number of different components, is technically feasible, the engineering practicality and operational safety of constructing and installing each of its components must
There is confidence that the safety concept and the design of the proposed disposal system show sufficient promise to proceed to the next programme stage
Residual uncertainties
first be established. Generally speaking, most branches of the structured set of statements are underpinned, at their lowest level, by such elements as calculation results, records of the appli- cation of quality assurance procedures or demonstrations of feasibility. The branch related to the safety concept and some additional branches are underpinned directly, at their lowest level, by phenomenological evidence from the assessment basis (Section 3.5.2.1).
Figure 5 – The bottom-up assessment of the level of support for safety and feasibility statements. Low-level statements directly supported by phenomenological evidence from the assessment basis are shown in grey.
ONDRAF/NIRAS currently distinguishes three possible levels of support available for a safety or feasibility statement during a given programme stage: green, orange and red (Figure 6):
green level: the statement is adequately supported for the programme stage at hand; orange level: support for the statement is being developed;
red level: the statement is not supported and no support is currently being developed. A necessary statement “on red” in the hierarchy of statements implies that all higher-level statements that should be underpinned by that statement are also “on red”.
All necessary statements will need to be adequately supported or, in other words, to be “on green”, to justify a positive decision to proceed with the compilation of the safety and feasibil- ity case aimed at supporting the decision at hand. (By contrast, nice-to-have statements can, by definition, be “on orange” or “on red”.) In accordance with the definition of safety and feasibil- ity case, however, such a case must also discuss the significance of the remaining uncertainties and open issues and provide guidance for work to resolve, in future programme stages, those that have been found to be both relevant and significant. In addition, the level of support that is required for the successive safety and feasibility cases will increase as the B&C Programme progresses towards licence applications. For example, additional lines of evidence may become desirable and some feasibility aspects will need to be looked at in more detail.
There is confidence that the safety concept and the design of the proposed disposal system show sufficient promise to proceed to the next programme stage
Safety concept Residual uncertainties Feasibility Safety Development of statements Development of substantiating evidence, arguments and analyses top
down
bottom up …
In other words, whereas all necessary statements are expected to be on green for a safety and feasibility case to be compiled, this safety and feasibility case will also contain an update of the structured set of safety and feasibility statements, where this update will take into account the more stringent requirements attached to the next programme stage. It will visualise the level of support judged to be available for the revised statements, together with the degree of knowl- edge of the remaining uncertainties, taking account of the objectives of the next programme stage. This exercise will be carried out statement by statement, and will serve as a basis to de- fine the RD&D priorities for the next programme stage. How exactly the set of statements will be updated (for example, through rephrasing the statements or through complementing them with more specific sentence fragments) and how exactly the degree of knowledge of the re- maining uncertainties will be represented are still to be determined.
Figure 6 – Representation of the results of the assessment of the level of support available for a structured set of safety and feasibility statements, in the course of a given programme stage. The level of support is represented by the status of traffic lights.
At every programme stage, the assessment of the level of support for individual safety and fea- sibility statements is carried out during assessment basis development and through so-called “preparatory assessments”, followed in a second phase by formal assessments, as defined by the safety assessment methodology [15] and as will be defined by the feasibility assessment methodology, though this is still to be formalised.
Preparatory assessments are partial assessments, conducted continuously and repeatedly on the basis of phenomenological evidence from the assessment basis, and in parallel with system development. They take the form of exploratory calculations (sensitivity analyses and/or model calculations of the evolution of the system or part(s) thereof) and often in- volve expert judgements. Preparatory assessments aim to assess the impact of uncertainties on long-term safety and feasibility qualitatively and, to the extent possible, quantitatively. Together with the development of the assessment basis, they aim to generate multiple lines of evidence, arguments and analyses to support safety and feasibility statements. They also
There is confidence that the safety concept and the design of the proposed disposal system show sufficient promise to proceed to the next programme stage
Residual uncertainties
Definition Safety Feasibility
aim to identify any significant deficiencies in current knowledge and understanding and in the plans to address these in the RD&D programme. Modifications can then be made in the programme and, should this appear necessary, in the strategic choices (Figure 2 in Chap- ter 2).
Formal assessments comprise analyses that considers the evolution of the system as a whole. They are quantitative and as exhaustive as possible, and are conducted only every few years, shortly before the planned compilation of a safety and feasibility case. There is likely to be greater use of formal and quantitative methods as the programme proceeds, in- cluding, for example, quantitative risk assessments of potential accident scenarios that may not be included in early stages of the programme. Formal assessments are carried out when preparatory assessments indicate good prospects that these will confirm the safety and fea- sibility of the proposed disposal system to the extent needed for the programme stage at hand. The formal assessments should, however, provide a finer understanding of the re- maining uncertainties than preparatory assessments. Should they not confirm the safety and/or the feasibility of the system, then the RD&D, and possibly also the strategic choices, need to be adjusted (Figure 2 in Chapter 2).
Once the level of support available for the statements and the knowledge of the impact of un- certainties are judged sufficient, given the programme stage at hand, for proceeding with for- mal assessments of the safety and the feasibility of the disposal system, the design and the key datasets within the assessment basis, including design specifications, are formally frozen, that is, they will not be changed as formal assessments are conducted. Such freezing is necessary in the interest of traceability and reproducibility of the evaluations supporting the safety and fea- sibility case. This does not mean that the RD&D will also be frozen, but new findings that, for example, could allow conservatism in the databases to be reduced, will be set aside until the next programme stage. Actual errors in the datasets will, on the other hand, be corrected even after the assessment basis is frozen, but in such a way that traceability is ensured.
2.3 Major outputs from the application of the safety strategy
At every programme stage, the application of the safety strategy is intended to provide input to the safety and feasibility case in support of the decision at hand and to provide feedback to system development (including the development of the assessment basis through RD&D) or system implementation.
2.3.1 Input to the safety and feasibility case
The application of the safety strategy should provide, as input to the safety and feasibility case, a safety concept and a repository design (or the reaffirmation of an existing safety concept and design and, at advanced programme stages, implementation procedures), and the evidence, arguments and analyses to substantiate safety and feasibility statements to a degree that is ade- quate for the purposes of the decision at hand, that is, the decision to progress to the next pro- gramme stage.
The confidence in the statement that the safety concept and the design of the proposed disposal system show sufficient promise, in terms of both safety and feasibility, to proceed to the next programme stage will depend, in part, on the judgement made of the quality of the assessments, where this quality concerns, for example, the comprehensiveness of the range of assessment cases considered, the quality of the methods, models, computer codes and datasets used and the correctness of their application, and the treatment of uncertainties. Such considerations are taken into account through general principles guiding the long-term safety assessment method- ology [15] and the feasibility assessment methodology and enhance confidence in their find- ings.
2.3.2 Feedback to system development and RD&D
Safety and feasibility assessments provide feedback to system development (including to the development of the assessment basis through RD&D) and implementation, and possibly also to the strategic choices, in an iterative way. In particular, the assessment of the support that is available for the necessary and nice-to-have statements provides guidance to the RD&D pro- gramme regarding the priority with which uncertainties or deficiencies in the assessment basis or, if the case arises, in the strategic choices upon which the safety concept and the design are based need to be addressed.
During a given programme stage, the highest priorities for further work are indicated by the necessary statements for which the available level of support is on red or orange. Nice- to-have statements for which the available level of support is on red or orange are potential lower-priority targets for the RD&D programme.
From one programme stage to the next, the priorities for further work are identified by updating the structured set of statements to take account of the more stringent require- ments attached to the next programme stage and of then assessing the level of support judged to be available for those revised statements and the necessary work for reducing relevant and significant uncertainties (Sections 2.2.4.3 and 3.5.4).
Other factors than the application of the safety strategy provide guidance to the RD&D pro- gramme. For example, even if the level of knowledge and understanding already available is considered adequate for future safety and feasibility cases, it is important to maintain it or to monitor general scientific developments in order to have confidence that it remains adequate. In addition, as well as planning RD&D for the next programme stage, a longer view also needs to be taken, especially since some activities (for example, long-term in situ experiments) take many years to plan and execute.