PURPOSE AND CONTENT OF THE SAFETY CASE

Most programmes are nowadays committed to a step-wise or adapted staging approach. The safety case is an integral element of this approach and thus, normally, a system is assessed by a series of safety cases that will gradually change their nature and level of detail and ambition. At each decision point, the safety case has to provide the safety related information that allows a judgement on the adequacy of the decision proposed; this has to include an evaluation of the expected levels of safety but also an evaluation of the signifi-cance and implications of uncertainties and open questions. A safety case has to serve several purposes. These depend upon the phase and maturity of the repository development programme. In the very early phase of concept devel-opment, the safety case is, for example, concerned with the assessment of the broad geological possibilities for repository siting that a country offers. This is often combined with an assessment of the design concept chosen. Formally, these safety assessments are sometimes connected to the ‘demonstration’ of the basic feasibility of safe geological disposal. The results of these assessments

SESSION IIc

normally constitute one of the key elements that are used to direct the programme (what host rocks and geological situations to concentrate upon, what design concepts to further develop, etc.). As the programme progresses, the safety case will become more focused on the specific system under consid-eration and will eventually be an important element for licensing decisions.

Although the relative importance of the following elements will change as the programme progresses, the safety case is always concerned with the following broad issues:

— The assessment of the level of safety that is provided by the repository system under consideration;

— The identification of the strengths and weaknesses of the system under consideration in order to ensure that the refinement of the repository design is focused on the important issues. This also includes input for the future research and development programme;

— The justification of decisions on how to proceed with the programme. In the later stages, this also includes licensing decisions and – once a repository is in operation – recertification and eventually, the decision to close and seal the facility.

In a broad sense, the safety case evaluates whether or not the overall (safety) strategy is adequate, that is: (a) if the system chosen (site, design) is sufficiently promising to continue; and (b) if the information available and the level of understanding is adequate to proceed to the next phase. Furthermore, the safety case may give guidance on the development of both the system (site and design) and the information basis (e.g. through further focused research and development).

To fulfil its role, a safety case has to be rather broad and should include:

— A description of the purpose and context of the safety case. This may also include a compilation of a broad set of ‘objectives, criteria and principles’

to be used for assessing the quality of the system and the quality of information/understanding.

— A description of the understanding of the system — which also contains an evaluation of the corresponding uncertainties.

— A discussion of the features of the system most important for safety (both those that provide safety and also those that have the potential to severely undermine safety). The safety case has to provide the evidence available that gives confidence in the proper functioning of these features of the system (e.g. reliance on fundamental laws of science, independent nature observations, natural analogues, etc.).

ZUIDEMA

— An assessment of the quality of the system both in a quantitative and qualitative manner. Such an assessment has to examine explicitly the effects of uncertainties and to discuss any open questions of relevance to the decision at hand.

— An overall synthesis of the broad findings of the safety case in relation to the decision at hand. This may also include a discussion of future work to resolve any open issues.

To discuss the quality of the system, both quantitative and qualitative arguments are used. The quantitative assessment includes an analysis of the performance of the total system (e.g. calculation of dose or risk) but may also contain an assessment of the performance of individual components or subsystems (e.g. see Ref. [15]). Besides the quantitative assessment, more qualitative types of arguments are also used; these are considered to be equally as important as the quantitative assessment. They may include a phenomeno-logical analysis (e.g. see Refs [24, 25]) that contains both qualitative and quanti-tative arguments. Also the evaluation of so-called safety functions makes use of qualitative arguments and discusses (qualitatively and quantitatively) the contribution of the different repository features to the different safety functions (e.g. see Refs [14, 15]). This results in a ‘safety concept’ that clearly describes the key features of the repository system and its functioning.

The analysis has to include an evaluation of the impact of uncertainties.

This includes identifying the possible alternative behaviour of key features of the repository system which, in turn, may lead to alternative evolutions of the system. This process is an essential part of the development of the set of calculated cases used for the quantitative assessment of the performance and safety of the repository system.

The assessment of the quality of the system must be made against criteria.

These are, at least partially, provided by the regulatory framework, but it may also be appropriate for the regulatory criteria to be complemented by additional criteria. Besides the most common quantitative criteria, such as dose and risk, complementary safety indicators (e.g. radionuclide/radiotoxicity fluxes, evolution of concentrations, etc.; see Ref. [26]) may be used. The quanti-tative criteria are complemented by qualiquanti-tative criteria and may include design requirements. In the regulatory framework, the qualitative criteria are often expressed in the form of principles or concepts (e.g. multibarrier principle, robustness, essentially complete containment for a specified period of time, etc.).

A safety case for a satisfactory repository may result in a set of arguments as follows:

SESSION IIc

— The basic repository concept is adequate and there is ample evidence of the intrinsic quality of the site and the design chosen.

— Sufficient safety is to be expected both in relation to compliance with regulatory dose and risk criteria and safety indicators complementary to dose and risk. This also includes ‘compliance’ with more qualitative objectives and principles.

— Existing uncertainties and open questions do not jeopardize the prospects of achieving a safe repository and with the help of adequate measures it is very likely that the critical technical issues can be resolved.

Because of its importance in providing the technical basis for decision making, a safety case will have a spectrum of different audiences: the imple-menter, the regulator, the decision makers, the general public, etc. This needs to be considered in developing the documentation and, often, a range of different documents may be developed that differ in their level of detail, but are consistent in the underlying basis and in the key messages.