The safety case for a deep geological repository in Switzerland: concepts for waste disposal and methodology for safety assessment

1 Introduction

Radioactive waste needs to be managed safety (see, e.g., SSR-5, IAEA 2011). It can be safely stored for limited periods in surface facilities, but, because these facilities need maintenance and care, their safety is inevitably reliant on continued societal stability, uncertainties in which, over time, inevitably become far greater than those associated with conditions deep underground in stable geological formations. As a long-term waste management option, disposal in a geological repository located in such a formation has the positive attribute that, if the site and design are chosen appropriately, neither the societal stability needed for governmental and regulatory control, nor any specific controls on activities occurring at the surface of the Earth are prerequisites for post-closure safety. This attribute is particularly advantageous for long-lived waste that will remain hazardous far into the future.

Geological disposal as a waste management option is being actively pursued by many nations around the world. In general, any proposal for a geological repository must undergo a multi-stage, legally mandated licencing process that governs the construction, operation and final closure of such a facility. This paper describes the deep geological repository concept currently considered in Switzerland by the National Cooperative for the Disposal of Radioactive Waste (Nagra) in support of its recent general licence application, the first stage in the licencing process in Switzerland, and the methodology used by Nagra to make the case for its post-closure safety. A full safety case must also demonstrate the safety of workers and the public during the operational period. In Switzerland, the current argumentation for post-closure and operational safety is summarised in an overarching safety report (Nagra, 2024a). Up to now, the focus in the Swiss programme has been primarily on post-closure safety, since a detained assessment of operational safety is only possible once the repository design and the processes for implementation are defined in detail. In future iterations, the safety case will be expanded in scope to include a more comprehensive case for operational safety.

According to the Swiss regulatory authority (ENSI), the overriding post-closure safety objective of a deep geological repository is “the long-term protection of humans and the environment from the effects of ionising radiation, without imposing undue burdens and obligations on future generations” (English version of ENSI Guideline G03 (ENSI, 2023)). Before a repository can be implemented at a site, a post-closure safety case must be made that clearly demonstrates that this protection objective is met. This is also in accordance with the International Atomic Energy Agency (IAEA) Joint Convention on the Safety of Spent Fuel and on the Safety of Radioactive Waste Management (IAEA, 1997) to which Switzerland is a signatory.

In line with the Swiss legal and regulatory framework, as well as national and international principles and practice (see Ch. 2 of Nagra, 2024b), the repository proposed by Nagra will provide safety by means of both geological and engineered barriers, i.e., it is a multi-barrier system. These barriers operate passively, meaning that, after closure of the repository, no further measures, such as maintenance, control, or monitoring, are required to ensure post-closure safety. This relieves future generations of the burden of having to manage or monitor the repository. The individual barriers contribute to so-called safety functions of the repository system, which together ensure a robust system, i.e., a system for which a high degree of safety can be demonstrated in all reasonably foreseeable scenarios, irrespective of the presence of any residual uncertainty. The safety case is built on multiple types of evidence and lines of argument for the performance of individual barriers, including their contributions to the safety functions, and for the performance and robustness of the overall disposal system.

Safety assessment is defined by Nagra as the process of gathering all relevant evidence and arguments and carrying out analyses for the safety of the disposal system during the post-closure phase. The safety case rests essentially on the quality of the repository system and on the quality of the safety assessment, as well as on the safety assessment findings. Key features of the repository system contributing to safety (the “safety and repository concept”) are outlined in Section 2 of this paper. International developments and guidance on safety assessment and the safety case are summarised in Section 3. The quality of the safety assessment rests on its sound scientific basis, i.e., the “assessment basis”, as described in Section 4, and on a sound safety assessment methodology. The Swiss safety assessment methodology is presented in overview in Section 5, with detailed aspects of performance assessment, safety scenarios development and the analysis of radiological consequences covered by separate papers within this special issue. The various lines of argument for demonstrating post-closure safety are presented in Section 6. Finally, a set of conclusions is presented in Section 7.

2 Safety and repository concept

In Nagra’s programme, long-term safety ensuring the protection of humans and the environment is based on the safety functions of the repository system at the proposed site which rest on the properties of the engineered and geological safety barriers. According to Nagra’s concept, as illustrated in Figure 1, waste is disposed of in emplacement rooms, located approximately 900 m underground within a host rock formation - the Opalinus Clay - a Jurassic-aged, highly impermeable mudstone formation, sandwiched between generally low permeability confining rock units. The geological barrier comprises the rock and the geological units above and below the host rock layer with similarly favourable properties, collectively termed the containment-providing rock zone (CRZ). The CRZ is delimited during the site selection process according to ENSI 33/649 ENSI (2018) and documented in Nagra (2024a).

In the current provisional design used to develop the safety case, as illustrated in Figure 2, two repository sections are foreseen, consisting of a set of dead-end drifts for high-level waste (HLW) and a set of dead-end caverns for low- and intermediate-level waste (L/ILW). These drifts and caverns are concrete lined for mechanical stability and centrally located within the Opalinus Clay. The HLW and L/ILW repository sections share a common central area with three access shafts. As well as the main disposal areas, each disposal section includes a pilot repository for its respective waste category. Each pilot repository contains a representative amount of waste and is used to monitor the behaviour of the wastes, the backfill, the seals and the host rock during a pre-closure monitoring period.

The engineered barriers for HLW disposal are described in Diomidis et al. (2026). The innermost barriers consist of spent fuel (SF) assemblies with fuel rods (UO₂ or mixed oxide fuel (MOX) pellets in cladding tubes) and vitrified HLW from reprocessing of SF (RP-HLW), both packaged in steel canisters. These HLW disposal canisters are emplaced co-axially in the dead-end HLW drifts on compacted bentonite pedestals, with the remaining void space between the canisters and the liner subsequently backfilled with a bentonite clay buffer. The engineered barriers for L/ILW disposal are described in Martin et al. (2026). They consist of waste packages for L/ILW, placed inside concrete disposal containers which are in turn emplaced in the L/ILW caverns, with remaining void spaces backfilled with cement-based mortar. In addition, a closure system for the repository is foreseen consisting of:

• seals, which are emplaced at the open ends of the emplacement drifts and caverns and at various locations within the access structures, including the shafts that connect the underground facilities with the surface, and
• backfill material that is emplaced in all remaining underground openings.

Candidate materials for this backfill include processed Opalinus Clay from the excavation of the repository and Friedland clay, both of which would be mixed with sand and/or gravel, or a sand-bentonite mixture. Such a mixture would be chemically and mineralogically compatibility with the host rock and would remain stable under the expected conditions.

As illustrated in Figure 3, which shows the underground repository facilities in the provisional design for the safety case, the seals comprise:

• V1-HLW and V1-L/ILW seals (emplacement room seals) located at the entrances of the HLW emplacement drifts and L/ILW emplacement caverns, respectively. These seals are installed immediately after emplacing the waste and the complete backfilling of the emplacement drifts and caverns.
• V2-HLW and V2-L/ILW seals (disposal area access seals) located at the entrances to the pilot repository accessways and the disposal area accessways of the HLW repository section (in the construction, operations and ventilation tunnels) and the L/ILW repository section (in the ventilation and operations tunnel), respectively. These seals are installed prior to repository closure.
• V3 seals (shaft seals) located in the shafts up to the top of the Opalinus Clay host rock. These are the outermost seals and are installed as part of the final closure of the repository.

All seals are designed, once water-saturated, to limit water flow. In addition, the V1-L/ILW and V2-L/ILW seals are designed with sand/bentonite sealing elements with a low bentonite content to allow the passage of repository generated gas from the L/ILW emplacement rooms. The closure system backfill is also designed to be gas permeable, preventing the build-up of potentially damaging gas pressures. All remaining seals are designed with highly impermeable compacted bentonite sealing elements. The evolution and performance of the sealing system, including the fate of repository generated gas, are described in Papafotiou et al. (2026).

Collectively, the geological and engineered barriers perform the following high-level safety functions:

• S1: isolation of radioactive waste from humans and the environment,
• S2: complete containment of radionuclides for a period of time (for HLW, this period is required by Swiss regulations to extend to at least 1,000 years; ENSI, 2023),
• S3: immobilisation, retention, and slow release of radionuclides,
• S4: compatibility of the components of the repository system, and
• S5: long-term stability of the system regarding long-term geological and climatic evolution.

Repository barriers and their properties that are well understood, insensitive to perturbations and are the main contributors to these safety functions are termed “pillars of safety”. There are seven of these pillars of safety:

• The deep underground location of the waste emplacement rooms in a stable geological environment that lacks underground resources specific to the region that could attract future human exploitation. It ensures that the repository is not susceptible to geological events and processes relevant to post-closure safety and that inadvertent human intrusion remains unlikely.
• The containment-providing rock zone (CRZ), which includes the host rock as well as its upper and lower confining units. The host rock, Opalinus Clay, is characterised by a fine and homogeneous pore structure, extremely low hydraulic permeability, homogeneous and high clay-mineral content and the associated high sorption capacity for many radionuclides. The CRZ is characterised by favourable properties (especially self-sealing ability) for long-term stability, forming a very effective and stable barrier against radionuclide transport and a compatible (physical and chemical) environment for the engineered barriers (Nagra, 2024c).
• Both the SF and RP-HLW matrices, which are chemically stable in the expected environment.
• The SF and RP-HLW disposal canisters, which are mechanically stable and corrosion-resistant in the expected environment. They ensure complete containment of radionuclides for at least as long as the heat generated by the waste has significant potential to affect transport processes in the surrounding barriers. They are also designed to satisfy the regulatory requirement of complete containment for at least 1,000 years (ENSI, 2023).
• The HLW bentonite buffer, which serves as a suitable physical and chemical environment that enhances the longevity of the HLW disposal canisters. Additionally, the buffer provides mechanical support for the surrounding rock after the degradation of the tunnel support. It compartmentalises the repository by isolating the disposal canisters from one another, thereby reducing the potential impact of accidental human intrusion. The buffer conducts heat away from the HLW canisters, limit temperature build-up within and around these objects, and also acts as a barrier against radionuclide transport.
• The L/ILW cementitious near field, which sorbs many radionuclides, decreases corrosion of metals and inhibits degradation of organic materials, which in turn reduces gas generation. The cement-based backfill can also store a significant volume of gas and provides mechanical stability to the host rock, even after the degradation of the tunnel support.
• The closure system (backfill and seals) provides retention of radionuclides released from the waste packages, and a transport and storage system for repository-generated gas, which retains gaseous radionuclide species within the underground structures while limiting the build-up of gas pressure. The sealing of both the individual waste emplacement rooms and the HLW and L/ILW repository sections reduces safety-relevant interaction between the repository sections and the radiological impact of inadvertent human intrusion. The closure system further provides mechanical stabilisation of the host rock after the rock support has degraded.

Each pillar of safety contributes directly and/or indirectly to the high-level safety functions. For example, the HLW disposal canisters contribute directly to the containment of radionuclides, while the surrounding buffer contributes indirectly as it helps to protect the canisters. The contributions of these seven pillars of safety to the five safety functions are summarised schematically in the case of HLW in Figure 4 and in Figure 5 in the case of L/ILW. Further details of the safety and repository concept are given in Nagra (2024c).

3 International developments and guidance on safety assessment and the safety case

There has been a long history of international collaboration in developing the approaches and methods for analysing the post-closure safety of deep geological disposal. This work is documented in numerous publications by the International Atomic Energy Agency (IAEA) and the Nuclear Energy Agency (NEA) of the Organisation for Economic Cooperation and Development (OECD). A concise summary with work up to 2014 is provided by the OECD/NEA Sourcebook of International Activities Related to the Development of Safety Cases for Deep Geological Repositories (OECD/NEA, 2017a). Of particular relevance are the three IAEA safety standards SSG-14 (IAEA, 2011a), SSR-5 (IAEA, 2011b) and SSG-23 (IAEA, 2012). More recently, work has preliminarily concentrated on specific subtopics of the safety case such as scenario development (OECD/NEA, 2016) or communication aspects (OECD/NEA, 2017b), and on practical applications of the proposed approaches, such as the third stage of the IAEA GEOSAF project (IAEA, 2017).

With respect to safety assessment methodology, the outcome of the NEA Initiative Methods for Safety Assessment for Geological Disposal Facilities for Radioactive Waste (MeSA) (OECD/NEA, 2012) was a significant milestone. The assessment strategy is defined as the approach to safety assessment and the compilation of the safety case. In its safety case brochure (OECD/NEA, 2013), the NEA states that part of the assessment strategy should be to provide “a range of arguments and analyses for the safety case that are well-founded, and supported, where possible, by multiple lines of evidence”. The development of a wide range of arguments and evidence, including model-based analysis, is a key feature of the safety assessment methodology described in Section 5 of the present paper.

In the same publication, it is noted that the safety case must include an adequate treatment of uncertainty and that processes relevant to safety should be well understood and reliably modelled. Furthermore, “potentially detrimental processes or features or events should be disclosed and directly taken into account in the safety assessment, if their probability warrants it”. Similarly, ENSI Guideline G03 (ENSI, 2023) states that the safety case must provide information on the reliability of the claims made and on the safety relevance of uncertainties. In the methodology described in Section 5, potentially detrimental processes, features or events are systematically analysed in the performance assessment, defined as one of the processes within safety assessment.

Much of the work of the NEA Integration Group for the Safety Case (IGSC), which was set up to develop, review and update safety cases for geological repositories, has focused on clarifying the nature of the multiple lines of evidence within the safety case and providing specific examples their use (see, e.g., the IGSC 20th Anniversary Brochure; OECD/NEA, 2021). Multiple lines of evidence, which may include, for example, performance and safety indicators in addition to dose and risk and the use of natural and archaeological analogues, are seen as a way of increasing the robustness of the safety case and are features of the methodology set out in this paper. Thus, ENSI Guideline G03 (ENSI, 2020) notes that complementary arguments can be used to support the assessment basis and the safety assessment results and that, where available, observations from natural analogues can be used to support the claims made in the safety case.

Other key areas in the work of the IGSC summarised in the brochure include:

• integration of the wide-ranging information that contributes to the safety case,
• safety functions, which play an increasing role in many national programmes in response to challenges associated with demonstrating and communicating post-closure safety and its link to design,
• handling of uncertainty, with a key challenge being to show that any residual uncertainty that could call the safety case into question can be avoided, mitigated, or reduced at least to the extent needed to justify a positive decision to proceed to the next programme phase, and
• scenario development, with the trend being the increasingly widespread use of safety functions in scenario development and the recognition of the wide range of roles scenarios can play in a disposal programme.

All these aspects are inherent parts of the methodology presented in this paper.

Nagra’s approach and methodology are further inspired by safety cases compiled by disposal programmes in other countries, including, for example, France (Andra et al., 2006; Andra, 2022), Finland (Posiva, 2021), and Sweden (SKB, 2022; 2023).

4 Nagra’s assessment basis and safety assessment principles

Confidence in the findings of safety assessment requires a sound scientific understanding of the repository system and its evolution based on both empirical evidence and modelling, and that uncertainties are identified and, where possible, quantified. In Nagra’s terminology, the evidence, knowledge, assessment tools, and methodologies developed or acquired in support of the safety assessment are termed the assessment basis. Nagra’s scientific understanding relevant to the post-closure safety of the proposed repository system and its associated uncertainties has been developed through an interdisciplinary and collaborative programme of RD&D and site characterisation. Evidence and knowledge relevant to long-term safety have been acquired using a systematic approach to information gathering and integration. Information is obtained from:

• field observations and monitoring activities,
• laboratory experiments, field testing and demonstration/verification activities,
• modelling studies,
• literature surveys, and
• expert elicitation.

An overview of the evidence and knowledge related to the multi-barrier system is summarised in the following separate papers within this special issue:

• Radioactive Waste Inventory and Properties (Guillemot et al., 2026),
• Engineered Barriers for High-Level Waste Disposal (Diomidis et al., 2026),
• Engineered barriers for Low- and Intermediate-level waste disposal (Martin et al., 2026),
• Site and Geological Barrier Characteristics for a Deep Geological Repository in Switzerland (Wüst et al., 2026), and
• Post-closure Biosphere Assessment in Switzerland’s Deep Geological Repository Programme (Brown et al., 2026).

Tools within the assessment basis include the models, codes and databases used for quantitative analyses of system performance and of radionuclide release, retention and transport. Appropriate quality assurance and control measures are adopted to ensure that the models, codes and databases developed and applied in the analyses are suitable for their intended purpose These measures are in accordance with the principles of:

• Applicability and validation–validation of models, codes and databases involves testing their consistency, as far as possible, with available information, including laboratory and field experiments, general scientific understanding, experience from other safety assessments, and observations from nature. Natural analogues and palaeohydrogeological models are used to evaluate and, where possible, reduce uncertainties arising from the temporal scales of concern. Finally, use is made of expert judgement and critical internal and external review. Where these are available, alternative conceptual models are considered.
• Accuracy and verification–each computer code used to perform analyses is verified to ensure it provides a sufficiently accurate solution of the governing equations of the corresponding mathematical model. Model abstractions, including the use of simplifications and conservatism in modelling, are carefully justified.
• Correct application–care is taken that the codes and models used in support of the post-closure safety case are applied correctly and in line with their intended use.

A final safety assessment principle is assurance of comprehensiveness, i.e., the need to demonstrate, as far as possible that:

• all known relevant features, events, and processes (FEPs) and their interactions that could affect post-closure safety have been thoroughly identified, and
• these FEPs have been adequately accounted for in the safety assessment.

Although it is impossible to prove beyond all reasonable doubt the completeness of a safety assessment, measures can be taken to ensure the inclusion of a comprehensive set of potentially relevant phenomena and, equally importantly, to ensure that the safety-relevant phenomena have been represented appropriately in the assessment. To support the assurance of phenomenological comprehensiveness, as part of the assessment basis, a FEP database (Nagra, 2024d) has been developed largely independently of the main safety assessment process. The FEP database has evolved iteratively over many years, with each version reviewed by internal and external experts and compared with other relevant FEP databases compiled by national organisations in other countries and by international bodies, including:

• the NEA International FEP (IFEP) list V3.0 (OECD/NEA, 2019),
• the Canadian Nuclear Waste Management Organisation’s (NWMO’s) FEP list for the Seventh Case Study for a deep geological repository for used CANDU fuel at a hypothetical site in a sedimentary rock environment (Garisto, 2018),
• Ontario Power Generation’s (OPG’s) FEP list for the post-closure safety assessment of the proposed low- and intermediate-level radioactive waste disposal facility at the Bruce site in Ontario (Quintessa Ltd. et al., 2011), and
• the Belgian radioactive waste management organisation’s (ONDRAF/NIRAS’s) FEP list (Farrow et al., 2018).

5 Safety assessment methodology

Nagra’s safety assessment methodology consists of four main processes and is illustrated in dark blue boxes on the right-hand side of Figure 6, while the light blue boxes on the left-hand side illustrate the safety-driven concept and design development process.

The starting point for the safety assessment is a provisional repository design and implementation plan, developed iteratively from the safety and repository concept described in Section 2. As illustrated by the left-hand side of the figure, the safety and repository concept is itself developed in a way that is consistent with the protection objective of ensuring long-term protection of humans and the environment by means of a system of staged, passively functioning engineered and geological barriers, and with a range of high-level design principles. It is also developed such that the quantitative protection criteria specified by Swiss regulations in the ENSI Guideline G03 (ENSI, 2023) in the form of individual effective dose and risk limits are expected to be met in most reasonably foreseeable circumstances. A formal demonstration that this is the case is, however, provided by the safety assessment.

The four processes carried out during the safety assessment, which are each supported by the assessment basis described in Section 4, are as follows.

Performance assessment develops arguments and presents evidence to show that the safety functions of the repository are upheld and that the system will evolve as expected in most reasonably foreseeable situations. Performance assessment also identifies uncertain and potentially detrimental phenomena and other uncertainties that could degrade the functionality of the components of the disposal system, as input to safety scenario development. The performance assessment in support of Nagra’s safety case is summarised in (Papafotiou et al., 2026) and is described in detail in Nagra (2024e) and Nagra (2024f).

Based on the knowledge provided by the assessment basis and the findings of performance assessment, safety scenario development defines a set of safety scenarios that capture the broad ways in which the repository system could evolve over time, as well as additional hypothetical “what-if?” cases, which are aimed at further demonstrating the robustness of the disposal system. Safety scenarios and “what-if?” cases can contain several variants and most of them are, via a set of calculation cases, carried through to the analysis of radiological consequences. Safety scenario development in support of Nagra’s safety case is summarised in (Javanmard, 2026) and is described in detail in Nagra (2024g).

The analysis of radiological consequences uses quantitative models to evaluate annual individual dose rates or risks for each of the safety scenarios, as well as a range of complementary safety indicators. Suitable conceptualisations are formulated for the calculation cases that are propagated from safety scenario development. Both deterministic calculations and probabilistic uncertainty and sensitivity analyses are performed, and the impact of uncertainty is evaluated systematically. The results are compared with the regulatory protection criteria, primarily for the safety indicator of annual effective dose rate (ENSI, 2023), and the safety margin for each calculation case is determined. The analysis of radiological consequences in support of Nagra’s safety case is summarised in (Li et al., 2026) and is described in detail for different types of scenarios in Nagra (2024h), Nagra (2024i), and Nagra (2024j).

The calculated safety margins provide a key line of argument for the overall demonstration of safety in the safety case. As explained in Section 6, this line of argument is also complemented and strengthened by additional lines of argument that address various aspects of both the quality of the system and the quality of the safety assessment. The demonstration of post-closure safety is thus achieved by bringing the results of the three previous steps in safety assessment together with other information supporting the quality of the safety assessment, the safety and robustness of the repository system, and the strength of the stepwise repository siting, design and implementation processes, in the safety case. These lines of argument are described in detail in Nagra (2024b).

The safety assessment is conducted primarily for a period of one million years, although the timeframe specific to the assessment of certain processes or phenomena (e.g., heat production from HLW) can be significantly shorter. In case of the calculations of radionuclide release, retention and transport carried out for the analysis of radiological consequences, ENSI Guideline G03 (ENSI, 2023) lists the additional requirement that the dose calculations shall be performed up to the time of the maximum radiological impact of the deep geological repository. To meet this requirement, dose calculations are carried out beyond the time when the calculated dose rate is at its highest, resulting in a calculated period of 10⁷ years for HLW and 10⁶ years for L/ILW releases. Analyses for volatile radionuclides, which focus on ¹⁴C with a 5,700-year half-life, are carried out for a 10⁵-year period. After this period, the activity of ¹⁴C is insignificant, having decayed by more than 5 orders of magnitude. Beyond the period for assessment, ENSI Guideline G03 requires determination of the range of potential impacts by considering uncertainties and scenarios involving geological processes. Notably, glacial and non-glacial (fluviatile) erosion, impacting the repository barrier system, is addressed in the dedicated report (Nagra, 2024i), considering time frames that extend over a period of millions of years, and thus beyond the time period for assessment.

Nagra’s management of uncertainty related to long-term safety follows a strategy of:

• avoiding sources of uncertainty, where possible, through concept development, siting and design, or mitigating its impact, and
• quantifying the uncertainty that remains and, through safety assessment, assessing its impact on repository performance and safety.

The propagation of uncertainty through the safety assessment processes is illustrated in Figure 7. Ultimately, the goal is to show that the regulatory protection criteria are met irrespective of the uncertainty that still exists at the current programme stage. The uncertainty management strategy is iterative in that any sources of uncertainty that have previously been found to have a significant adverse effect on the calculated levels of performance and safety then became targets for RD&D work aimed at either reducing this uncertainty through the development of a better understanding of relevant processes and interactions, avoiding the sources of the uncertainty, or mitigating their impact, by further refinement of the concept and design.

6 Lines of argument for demonstrating post-closure safety

As illustrated in Figure 8, there are five lines of argument that are brought together to demonstrate post-closure safety. Each of these lines of argument is summarised in the following paragraphs and elaborated in detail in Nagra (2024b).

6.1 Safety-driven siting, design and implementation processes

Nagra has proposed a repository site and developed a provisional design and implementation plan based on transparent, safety-driven processes that have spanned many years; the repository siting, design and implementation processes generate confidence in the post-closure safety because they are safety-driven. For example, in the staged siting process, potential siting regions only progressed from one stage to the next, once they were shown to possess multiple attributes that favour post-closure safety (as well as engineering feasibility), based on a set of criteria developed by the Swiss Federal Office of Energy (BFE, 2008), together with other agencies and organisations that are independent of Nagra. The criteria included, for example, geological stability, the predictability of long-term changes and the degree to which the geological barrier could be perturbed by repository-induced effects, such as repository-generated heat and gas.

6.2 Robustness of the repository system

The repository system is robust, meaning that the site, the CRZ and the engineered barrier system have many qualities that are favourable to safety, are well-understood, and that detrimental phenomena are, as far as possible, reduced or avoided. For example, the site is in a tectonically quiet and stable area with limited deformation and is located well away from large-scale tectonic zones characterised by high uplift, enhanced seismicity or high tectonic complexity, such as the Alps. Furthermore, the geological barrier provided by the CRZ makes a powerful contribution to the robustness of the current safety concept due to its excellent qualities. The geological barrier is also complemented by a mutually compatible set of engineered barriers that minimise and mitigate disturbances to the CRZ inevitably caused by the waste and its emplacement.

6.3 Sound assessment basis

The quality of the safety assessment rests on a sound assessment basis, including sufficient scientific understanding of all relevant phenomena, a safety assessment methodology that respects national and international requirements, principles, guidance, and best practice, and models, codes and data to support both performance assessment and the analysis of radiological consequences that are fit for purpose. Key parts of the assessment basis are summarised in this special issue in Guillemot et al. (2026), Diomidis et al. (2026), Martin et al. (2026); Wüst et al. (2026) and Brown et al. (2026).

6.4 Favourable findings of the safety assessment

Performance assessment analyses the evolution of individual system components and of the entire repository with respect to its various safety functions. The analysis of radiological consequences evaluates annual individual dose or risk for a range of safety scenarios, derived from the results of performance assessment. The favourable findings of the performance assessment and of the analysis of radiological consequences are summarised in this special issue in Papafotiou et al. (2026) and Li et al. (2026) and are presented in detail in Nagra (2024e), (2024f), (2024h), (2024i), and (2024j).

6.5 Complementary lines of argument

Finally, lines of argument have been developed that are independent of, and complementary to, the main safety assessment processes. These include indirect support for the safety of deep geological repositories from observations of natural and archaeological analogues, including, for example, the longevity of uranium ore deposits in many different geological environments around the world, such as El Berrocal in Spain, Poços de Caldas in Brazil, Oklo in Gabon, Koongarra in Australia, Cigar Lake in Canada and the Witwatersrand Au-U placer deposit in South Africa (Armstrong, 1981). These analogues have also been used to investigate in detail various processes influencing the long-term behaviour of spent fuel (Smellie and Karlsson, 1996; Smellie et al., 1997; West et al., 1992).

There are also lines of argument that make use of safety and performance indicators complementary to the evaluation of dose and risk required by regulations. These indicators can provide additional insights into:

• the evolution of the hazard potential of the waste,
• how radiotoxicity (a measure of this hazard potential) is distributed within the repository system and how it diminishes over time due to radioactive decay predominantly within the repository system, with little reaching the biosphere, and
• how the fluxes and concentrations of radiotoxicity are generally much smaller than, or similar to, natural or other man-made radiotoxicity fluxes and concentrations.

Finally, conservative assumptions and simplifications are widely used in the analysis of radiological consequences. These include the omission of several “reserve FEPs”, which have the potential, in the future, to provide additional quantitative contributions to the evaluated performance of the disposal system, although many of these would likely have only minor impacts on total dose, even if they were included. Conservative assumptions and simplifications mean that the doses calculated for each of the safety scenarios err on the side of caution, being higher than would be expected in reality.

7 Conclusions and outlook

This paper has summarised how Nagra has developed a robust safety and repository concept, a comprehensive assessment basis and a safety assessment methodology based on sound assessment principles that is systematic, structured, traceable and consistent with national and international requirements, principles, guidance and best practice. Measures have been adopted to ensure inclusion of all potentially relevant phenomena and the systematic treatment of uncertainty in these phenomena and their interactions. Taken together, these various elements form the basis of a strong safety case.

Post-closure safety is demonstrated based on the current mature and robust, but still provisional concept, developed to the level of a conceptual design. However, forthcoming licences will demand progressively more detailed technical specifications. Along with a steadily improving understanding of the geological environment, e.g., due to construction activities, and along with technological progress and confirmation of engineering solutions, e.g., through testing facilities, the repository project will become increasingly specific as design decisions are finalised. This evolution will be reflected in the increasing level of detail at which arguments are discussed in the safety case. Moreover, in future iterations, the safety case will be expanded in scope to include not only post-closure safety, but also a more comprehensive case for operational safety. This is necessary to meet the needs of IAEA SSR-5 (IAEA, 2011b), which states that a safety case must consider both the operational and post-closure phases. It is necessary to ensure that actions during operation will not be detrimental to post-closure safety. Furthermore, operational aspects will be important for future design optimisation.

Generative AI statement

The author(s) declared that generative AI was not used in the creation of this manuscript.

Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.

Publisher’s note

All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.

Footnotes

Edited by: Michael Ojovan, The University of Sheffield, United Kingdom

Reviewed by: Erika Holt, VTT Technical Research Centre of Finland Ltd., Finland

Axel Liebscher, Federal Company for Radioactive Waste Disposal, Germany