The safety case for a deep geological repository in Switzerland: development of safety scenarios

1 Introduction

Swiss regulatory framework (ENSI, 2025), international guidelines and best practices provide the framework for developing scenarios for deep geological repositories. International guidelines define scenarios as structured descriptions of possible repository evolutions that support safety assessment, system understanding, model development and transparent communication among stakeholders (IAEA, 2012; OECD/NEA, 2013; OECD/NEA, 2001; OECD/NEA, 2015). These guidelines and national regulations necessitate a distinction between expected evolution, less likely but plausible evolutions, bounding “what-if?” cases, and future human actions (FHA). They also recognise two broad but complementary approaches in scenario development: a bottom-up approach, which starts from comprehensive lists of features, events, and processes (FEPs) that are screened and combined into scenarios, and a top-down approach, which begins with safety functions and expected system evolution and then identifies perturbations and uncertainties that could affect performance (IAEA, 2012; IAEA, 2004; OECD/NEA, 2012). In practice, most waste management programmes combine both approaches, often using FEP databases as auditing tools rather than as the sole basis for scenario generation (IAEA, 2012; OECD/NEA, 2015). Across methodologies, common objectives are to ensure completeness in the treatment of perturbing phenomena, document the rationale for inclusion or exclusion of processes, and provide an auditable link from scientific evidence and expert judgement to models, scenarios, and calculation cases. This formalism is considered essential for demonstrating comprehensiveness, supporting confidence building, and aligning scenario development with programme-specific and regulatory requirements (OECD/NEA, 2001; IAEA, 2004; OECD/NEA, 2015).

International waste management programmes have implemented these principles in different but broadly comparable ways. Programmes such as SKB in Sweden, Andra in France, and NWMO in Canada all combine an assessment of expected system evolution with structured consideration of less likely or disruptive developments, supported by FEP databases, expert review, and explicit treatment of uncertainty (SKB, 2011; OECD/NEA, 2015; ANDRA, 2005; Garisto, 2018; SKB, 2022; ANDRA, 2016). SKB integrates top-down and bottom-up approaches with a focus on impact on safety functions to define reference, additional, and residual (“what-if?“) scenarios with formal support from FEP databases. Andra develops a Normal Evolution Scenario, an Altered Evolution Scenario, “What-if” scenarios and stylised human intrusion cases using a predominantly top-down process. NWMO employs a systematic and iterative FEP identification and screening process to define normal evolution, disruptive events, “what-if?”, and human-intrusion scenarios. Despite differences in terminology and implementations, these programmes share a common emphasis on structured scenario classification, FEP-based completeness checks, and explicit treatment of uncertainties. Together they provide the broader international context that informs Nagra’s approach. In the Swiss context, regulatory requirements additionally mandate the bounding of radiological consequences through careful selection of the scenarios (ENSI, 2025).

At Nagra, “safety scenario” development constitutes the second of four main, consecutive processes in the safety assessment methodology developed in support of the Swiss general licence application (Smith, 2026). Within this framework, a distinction is made between performance assessment scenarios, which examine the efficiency of repository barriers against repository-induced effects and external perturbations, and safety scenarios, which form the basis for the radiological consequence analysis. Adhering to the principles outlined above, safety scenario development synthesises information from the assessment basis (Diomidis et al., 2026; Guillemot et al., 2026; Wüst, et al., 2026; Martin et al., 2026) and from findings of performance assessment (PA) (Papafotiou et al., 2026) to define a comprehensive, auditable, and regulatorily compliant set of safety scenarios for subsequent radiological consequence analysis (Li, 2026). In doing so, the consequence analyses solely focus on the processes and conditions most relevant to radionuclide release, retention and transport within the multi-barrier system.

The safety scenario development methodology and its application to Swiss general licence application are described in full in (Nagra, 2024a). The present paper summarises that methodology and discusses selected safety scenarios in detail.

2 Methodology

This section provides an overview of the methodology applied in the Swiss general licence application to develop a comprehensive and regulatorily compliant set of safety scenarios. As illustrated in Figure 1 the methodology consists of the following distinct steps:

• Gathering input data

Safety scenario development builds on an extensive assessment basis that provides a scientific understanding of the repository system, including the waste inventory (Guillemot et al., 2026), repository layout (Smith, 2026) and engineering design (Diomidis et al., 2026; Martin et al., 2026), properties of the host rock and confining units and long-term geological and climatic developments (Wüst, et al., 2026). Together, this information defines the initial state of the repository and the uncertainties associated with potential evolutions of the repository system.

PA outcomes, organised as PA scenarios, are integrated as a second key outcome (Papafotiou et al., 2026). PA scenarios and safety scenarios fulfil distinct purposes and are defined according to different criteria. PA scenarios investigate the processes that may compromise barrier integrity, whereas the corresponding safety scenarios focus on the implications of such barrier impairments for radionuclide release, retention and transport. This approach ensures completeness and traceability by confirming that the full range of PA outcomes is systematically reflected in the safety scenario development, either explicitly by a safety scenario or implicitly through parameter ranges. Uncertainties identified in the assessment basis or regulatory requirements not captured in PA scenarios, e.g., climate evolution, or FHA, are also incorporated at this stage.

• Categorisation of Safety Scenarios

Consistent with international guidelines, Nagra defines four categories of safety scenarios that together span the range of expected to hypothetical system evolutions:

• - The reference safety scenario describes the expected repository system evolution, including barrier performance, radionuclide release, retention, and transport, as well as the biosphere assumptions. It is substantiated by the PA results, which confirm compliance with performance targets.
• - Alternative safety scenarios represent credible deviations from the reference safety scenario, arising from uncertainties in the initial state or repository evolution, that cannot be confidently excluded within the one-million-year assessment period. They are characterised by a lower likelihood of occurrence relative to the reference safety scenario.
• - “What-if?” cases are hypothetical cases used to bound uncertainties and test system robustness by considering either implausible evolutionary pathways, parameter values beyond the evidence-based range, or postulated degradations of pillars of safety ¹ unrelated to specific phenomena.
• - FHA safety scenarios are developed independently of likelihood considerations and are based on stylised representations of potential human actions that could disrupt the repository’s pillars of safety. These scenarios are derived from FHA FEPs within the Nagra FEP database using a dedicated methodology. The development of FHA safety scenarios is not discussed further in this paper but is described in detail in (Nagra, 2024b).

This categorisation ensures systematic coverage of expected, less likely, and hypothetical conditions and aims to represent and bound all plausible ways in which the repository might evolve, thereby addressing the so-called “scenario uncertainty”.

• Development of bounding variants

Variants are defined to address conceptual uncertainties within a given safety scenario. All variants share the same general description of system evolution associated with that safety scenario but differ in one or more key factors that significantly influence radiological consequences, including the extent, timing, location, or properties of critical features and processes. Assumptions regarding these key factor(s) are plausible and evidence based. Typically, only the variant judged to give rise to the highest radiological consequences, the bounding variant, is propagated to consequence analysis. This selection is based on a qualitative assessment of variants. In instances where such judgment is not possible a priori, multiple variants may be carried forward.

• Definition of calculation cases

Each safety scenario or the associated variant is represented through one or more calculation cases that specify the additional abstractions, parameter values and modelling assumptions required for radiological consequence analysis. The number of calculation cases are kept as few as reasonably achievable while ensuring that the full range of potential radiological consequences is confidently bounded. To achieve this, parameter values and simplifications in definition of calculation cases may deliberately extend beyond the most realistic ranges supported by the assessment basis or PA findings. Consequently, calculation cases should not be interpreted as literal representations of system evolution, but rather as conservative representations designed to robustly envelope potential outcomes.

3 Reference safety scenario

The reference safety scenario represents the expected evolution of the repository system and provides the foundation for developing alternative and FHA safety scenarios and “what-if?” cases.

3.1 Variants

Two variants of the reference safety scenario are defined, differing in their conceptualisation of the containment-providing rock zone (CRZ). The first variant follows the abstracted stratigraphic column for Nördlich Lägern and assumes that the CRZ is bounded by the local Keuper aquifer below and regional Malm aquifer above (Figure 2D – (Wüst, et al., 2026)).

The second variant assumes that the Keuper aquifer below the provisional location of the HLW section of the repository is hydraulically inactive, consistent with the observed high residence times of the groundwater sampled from the Keuper aquifer at this location (Nagra, 2024c). Under this assumption, the CRZ below the HLW section of the repository is extended to the lower regional Muschelkalk aquifer.

The second variant is not a bounding variant. It is nevertheless propagated to the radiological consequences analysis to illustrate the level of conservatism applied in the development of safety scenarios, given that the first variant, selected as the “reference conceptualisation of the CRZ”; forms the basis for subsequent safety scenario development.

3.2 Calculation cases

The most important additional factors affecting the radiological consequences in the context of the reference safety scenario are:

• - the assumed surface conditions including biosphere and surface morphology, and
• - the parameter uncertainty reported in the assessment basis.

3.2.1 Surface conditions

Geological barrier characterisation also considers the long-term evolution of climate and concludes that northern Switzerland is expected to experience repeated glacial/interglacial cycles. Following each glaciation, progressive warming is anticipated, towards a continental, temperate or potentially an even warmer-drier climate (Wüst, et al., 2026; Nagra, 2024e). To address uncertainties associated with the geomorphological and climatic changes over a period of up to one million years, four deterministic calculation cases are developed within the variant reference conceptualisation of the CRZ. These assume different, though still steady-state, biosphere conditions:

• Reference Case (RS-RC ² ), assuming present-day climatic conditions,
• RS-BIOS/WARM_DRY, assuming a warmer and drier climate,
• RS-BIOS/COLD, assuming a colder climate,
• RS-BIOS/DRAINED_FARMLAND, assuming anthropogenically altered drained-farmland conditions.

These calculation cases span the range of climatic and surface conditions considered plausible for northern Switzerland. By assuming steady-state biosphere conditions in each calculation case, the analyses ensure that the resulted radiological consequences remain bounded under long-term plausible surface conditions, as required by Swiss regulatory guidance (ENSI, 2025).

RS-RC constitutes the principal basis for further safety scenario development as well as for interpretation and comparison of radiological consequences across all other calculation cases. All parameters with defined uncertainty ranges are evaluated at their reference values as reported in the assessment basis, while remaining uncertainties are addressed through conservative assumptions.

3.2.2 Parametric uncertainty

Additional calculation cases, are defined that aim to identify, illustrate and quantify the impact of uncertainty in the parameters that control radionuclide retention and transport in the repository barriers:

• - RS-PROB is derived directly from RS-RC and is identical in terms of conceptualisation; however, uncertain parameters are treated probabilistically rather than fixed at their reference values. It comprises multiple realisations in which uncertain parameters are sampled at random from probability distributions derived from the assessment basis. The results support global sensitivity analysis, identifying parameters with the greatest influence on radiological consequences.
• - RS-PROB-param is a set of deterministic calculation cases in each one sensitive parameter identified in RS-PROB is individually set to its most unfavourable value within its probability distribution. These cases isolate the impact of specific parameters on system behaviour.
• - RS-CMB is a single deterministic calculation case in which all sensitive parameters, as identified in RS-PROB, are simultaneously set to their most unfavourable value within their respective probability distributions, providing a highly conservative envelope on radiological consequences.

3.2.3 Variant on conceptualisation of CRZ

One calculation case is defined within this variant:

• - RS-KEUPER_INACTIVE is a single deterministic calculation case adopting conceptual variant of the CRZ, in which the Keuper aquifer below the HLW section of the repository is hydraulically inactive. Here, radionuclides reaching the Keuper are assumed to diffuse downward into the Muschelkalk aquifer rather than being advected laterally.

Table 1 summarises all variants and calculation cases for the reference safety scenario and clarifies which conceptual and parameter uncertainties they address.

TABLE 1. Variants and calculation cases for the reference safety scenario.

4 Alternative safety scenarios

Alternative safety scenarios address credible deviations from the expected system evolution that cannot be excluded based on current knowledge. PA results indicate that potentially detrimental phenomena do not significantly alter the overall evolution of the repository or compromise its safety functions. Probabilistic analysis indicates that performance targets are met even under unfavourable parameter combinations, typically with large safety margins (Papafotiou et al., 2026). These findings demonstrate the robustness of the repository with respect to system-performance uncertainties and support the expectation that it will evolve according to the reference safety scenario.

Residual uncertainties relate primarily to geological characterisation. Future site investigations for licensing milestones are expected to reduce these, potentially allowing some alternative safety scenarios to be excluded or treated only as “what-if?” cases in later safety-case iterations. At present, two alternative scenarios are considered: (i) the presence of a hydraulically active confining unit within the CRZ above or below the Opalinus Clay, and (ii) an undetected fault in the vicinity of the repository. This paper focuses on the first alternative scenario (hydraulically active confining unit). The second alternative scenario (undetected fault) is presented in (Nagra, 2024d) and not further elaborated here.

4.1 Hydraulically active confining units

Hydrogeological and mineralogical characterisation of the confining units, including detailed tracer profiles, indicate only minor geochemical variations across the CRZ. Neither field nor laboratory data provide evidence of laterally extensive hydraulic activity within the geological units of the CRZ but rather indicate only potential zones of locally elevated transmissivity (Wüst, et al., 2026).

It is nevertheless hypothesised that fractures in clay-poor or carbonate-rich units could be denser and more interconnected than indicated by existing site characterisation data. In this alternative safety scenario, it is therefore conservatively assumed that one of the identified confining units within the CRZ behaves as a hydraulically active unit (e.g., layers with plausible low self-sealing potential such as “hard beds”).

The units considered include three in the upper confining sequence (Calcareous marl (CM), calcareous Dogger (CD), including the «Herrenwis Unit», and sand-calcareous Dogger (SCD)) and two in the lower confining sequence (calcreous Lias (KEU) and dolomitic Keuper (KAU)) (Wüst, et al., 2026).

4.1.1 Variants for hydraulically active confining unit

Two variants are defined depending on whether the assumed hydraulically active units occur above or below the Opalinus Clay, reflecting the considerable difference in horizontal hydraulic gradients between the upper and lower CRZ-bounding aquifers (Nagra, 2024e).

4.1.2 Calculation cases for hydraulically active confining unit

The other key factors influencing the radiological consequences of this scenario are: (i) the parameter values governing fluid flow, and (ii) the degree of connectivity of the hydraulically active unit.

For each variant, individual calculation cases are defined in which a single hydraulically active unit is assumed, while all other units remain hydraulically inactive, consistent with the reference conceptualisation of the CRZ. Despite the lack of evidence for lateral advective flow in these units (Wüst, et al., 2026), it is assumed that radionuclides reaching the hydraulically active unit migrate either vertically across it by diffusion or laterally through it by advection, as illustrated in Figure 2. Hydraulic conductivity is set to the upper-bound value from assessment basis. These assumptions are deliberately conservative to provide bounding estimates for radiological consequence analysis.

The variants and calculation cases propagated to the analysis of radiological consequences are summarised in Table 2.

TABLE 2. Variants and calculation cases for the alternative safety scenario that assumes an additional hydraulically active unit within the CRZ above or below the Opalinus Clay.

The set of alternative safety scenarios ensures that remaining geological uncertainties are explicitly assessed and that radiological consequences remain bounded in accordance with Swiss regulatory requirements.

5 “What-if?” cases

The “what-if?” cases apply extreme, hypothetical assumptions that intentionally exceed evidence-based parameter ranges. These assumptions are selected to explore the outer bounds of system behaviour and demonstrate the robustness of the repository system. The defined “what-if?” cases for the Swiss general licence application span a range of “what-if?” cases related to a physical phenomenon–e.g., excavation of the repository to surface caused by erosion - and those illustrating the effects of a hypothetical degraded performance of one pillar of a safety at a time linked to no causal physical phenomena. The focus of this manuscript is kept on the latter category, and the interested reader is referred to (Nagra, 2024d) for further details on both categories of “what-if?” cases.

The “what-if?” cases postulating a hypothetically degraded performance of pillars of safety are developed by systematically going through the pillars of safety and either removing them or assuming a degradation of the safety function they serve, as illustrated schematically in Figure 3. Each pillar of safety addressed can be considered a variant and, depending on the characteristic of each pillar, several calculation cases are defined and propagated to radiological consequence analysis. Table 3 lists a few of the variants and calculation cases that are also addressed in (Li, 2026) and explains how assumptions and parameter values were selected to test the system boundaries.

TABLE 3. Selected “What-if?” cases postulating a hypothetically degraded performance of pillars of safety. Where the description indicates the magnitude of a given assumption with respect to an upper bound value, this relates to the parameter value range reported in the assessment basis.

6 Completeness in safety scenario development

A key issue in safety scenario development and in safety assessment in general, is phenomenological completeness, i.e., ensuring that all safety-relevant FEPs are identified and treated appropriately. While absolute completeness can never be proven, Nagra’s methodology applies systematic measures to minimise “completeness uncertainty”. Specifically, confidence in the comprehensiveness of the safety scenarios rests on:

• The robustness of the assessment basis: The assessment basis, including the initial state and post-closure evolution of the repository, has been developed iteratively over many years, peer reviewed, and informed by Nagra’s RD&D programme and international scientific exchange. The reference safety scenario is derived directly from this understanding, with uncertainties in key features and processes systematically analysed in performance assessment.
• The completeness of the FEP database and audit: The Nagra FEP database which has been developed over many years, reviewed by internal and external experts, and benchmarked against international compilations (OECD/NEA, 2019; Quintessa Ltd., SENES Consultants Ltd., & Geofirma Engineering Ltd, 2011; Garisto, 2018; Farrow, Doudou and Capouet, 2018), provides an additional measure to ensure completeness of the developed set of safety scenarios. Additionally, a systematic audit of Nagra FEP database was conducted by reviewing each FEP entry to confirm and document it is either explicitly represented in safety scenarios or assessment models, or that its exclusion is clearly justified and documented (Nagra, 2024a; Nagra, 2024b). For future human action scenarios, FEPs provide the starting point for dedicated scenario development (Nagra, 2024c) rather than being subjected to the FEP audit.
• Development of “what-if?” cases: Assessment of “what-if?” cases using extreme or hypothetical assumptions further demonstrate system robustness and pre-empt concerns that relevant phenomena may have been overlooked. It is worth noting that the set of defined “what-if?” cases expand beyond phenomena investigated by PA. Table 4 presents the incorporation of the PA scenarios in the safety scenarios discussed in this manuscript.

TABLE 4. Incorporation of performance assessment scenarios in safety scenarios and “what-if?” cases presented in this paper. Coloured cells indicate where a given phenomenon, as represented by a performance assessment scenario, is included in a safety scenario or “what-if” case. The codes shown in the coloured cells refer to specific scenarios, variants, or calculation cases described in this paper.

The combination of these measures ensures a defensible and regulatorily compliant safety scenario set.

7 Summary and conclusions

This paper has presented the systematic methodology underpinning the development of safety scenarios as part of the Safety Case of the Swiss general licence application for geological disposal of radioactive waste. The approach integrates the comprehensive assessment basis, performance assessment outcomes, and regulatory expectations into a structured framework that defines the reference safety scenario, alternative scenarios, hypothetical “what-if?” cases, and future human action (FHA) safety scenarios. Each category is complemented by variants and calculation cases designed to capture conceptual, parametric, and phenomenological uncertainties relevant to post-closure system evolution.

The structured categorisation of safety scenarios, along with the transparent rationale for their assignment, ensures methodological transparency and traceability throughout safety scenario development. The resulting set of calculation cases provides a coherent and manageable foundation for evaluating post-closure radiological consequences. Through conservative assumptions, bounding variants, and systematically selected “what-if?” cases, the approach ensures that the full range of plausible and hypothetical system behaviours is robustly explored.

Overall, the results demonstrate that the methodology provides a defensible, regulatorily compliant, and scientifically based safety scenario set that bounds potential radiological consequences. By combining top-down reasoning based on safety functions and performance targets with a bottom-up FEP audit, Nagra’s approach ensures both completeness and traceability in safety scenario development, in line with international guidelines and established practice in geological disposal programmes. This structured scenario framework supports a robust post-closure safety assessment and provides confidence that the post-closure safety of the proposed repository system has been comprehensively evaluated.

Generative AI statement

The author(s) declared that generative AI was not used in the creation of this manuscript.

Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.

Publisher’s note

All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.

Author disclaimer

This article reflects Nagra's claims and not necessarily the Author's. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.

Footnotes

Edited by: Paul Smith, Safety Assessment Management GmbH, Switzerland

Reviewed by: Axel Liebscher, Federal Company for Radioactive Waste Disposal, Germany

Manuel Capouet, Organisme National des Déchets Radioactifs et des Matières Fissiles Enrichies, Belgium

Footnotes

Repository barriers and their properties that are well understood, insensitive to perturbations and are the main contributors to the safety functions (Smith, 2026).

To facilitate further referral to each calculation case short keys are associated with each, e.g., for the reference case RS-RC (Reference Safety Scenario–Reference Conceptualisation of the CRZ).