The safety case for a deep geological repository in Switzerland: system evolution and performance assessment

1 Introduction

In line with the Swiss legal and regulatory framework, as well as national and international principles and practice (Nagra, 2024b), safety in the repository proposed by Nagra is provided by means of both geological and engineered barriers, i.e., a so-called multi-barrier system (Smith, 2026). These barriers operate passively, meaning that, after closure of the repository they require no further measures (i.e., maintenance, control, or monitoring) and contribute to so-called safety functions of the repository, described in Smith (2026). Together they provide a repository system that is considered robust when a high degree of post-closure safety can be demonstrated in all reasonably foreseen scenarios (Smith, 2026). According to Nagra’s concept, waste is disposed of in emplacement rooms, located approximately 900 m underground within a host rock formation–the Opalinus Clay. The geological barrier, described in detail in Wüst et al. (2026), comprises the host rock and the geological units above and below with similarly favourable properties, collectively termed the containment-providing rock zone (CRZ). In the current provisional design used to develop the safety case, two repository sections are foreseen consisting drifts for high-level waste (HLW) and low- and intermediate-level waste (L/ILW), respectively. Note that in the Swiss disposal concept spent fuel (SF) and vitrified HLW from reprocessing (RP-HLW) are disposed in the HLW section. The engineered barriers for HLW disposal are described in Diomidis et al. (2026). The engineered barriers for L/ILW disposal are described in Martin et al. (2026). In addition, a closure system for the repository consists of seals emplaced at the open ends of emplacement rooms, termed V1 seals, at the entrances to pilot and disposal area accessways, termed V2 seals, and in the shafts up to the top of the Opalinus Clay host rock, termed V3 seals. In addition, backfill material is emplaced in all remaining underground openings (Smith, 2026). The so-called “pillars of safety”, i.e., the repository barriers that mainly contribute to high-level safety functions, comprise the (i) deep underground location of the waste, (ii) CRZ, (iii) SF and RP-HLW matrices, (iv) SF and RP-HLW disposal canisters, (v) HLW bentonite buffer, (vi) L/ILW cementitious nearfield, and (vii) closure system (for a more extensive overview see also Smith, 2026).

Safety assessment is the process of gathering all relevant evidence and arguments and carrying out analyses for the safety of the disposal system during the post-closure phase (Smith, 2026). In Nagra’s safety case for the general license application, the performance assessment (PA) is the first step in the safety assessment that builds on multiple types of evidence for lines of argument for the performance of individual barriers, including their contributions to safety functions, and for the performance and robustness of the overall disposal system (Nagra, 2024a; 2024b; Smith, 2026). In this process, the PA introduces simplifications of the real repository system into abstracted representations of the repository and its components. Following international standards of transparent and traceable assessment workflows (OECD/NEA, 2002; 2004; IAEA, 2011), the post-closure performance of the repository is addressed at a level of abstraction that bridges the gap between the real repository system and the further abstraction used for the analysis of radiological consequences (Li, 2026). The performance assessment workflow consists of four components (Nagra, 2024g):

• Performance assessment by barrier analyses the performance of each element of the multibarrier system with respect to how it fulfils its safety functions and conveys an evaluation of safety relevance of the collected evidence.
• Total system performance screens for any potentially safety-relevant thermo-hydro-mechanical-chemical (THMC) interactions between the individual barrier components.
• Uncertainty quantification, with focus on parametric and conceptual uncertainties associated with the simplified, modelled representations of the repository system in the abstracted performance assessment framework, as well as the uncertainty propagation associated with the abstraction process.
• Performance screening, encompassing a probabilistic assessment of the expected repository performance and of deviations thereof to screen the possible paths of repository evolution and to identify, consolidate and formulate the safety-relevant paths in a format that can be used in the next step of the safety assessment workflow.

The performance by barrier as well as potential THMC interactions in the repository system are addressed in an auditable framework (“C-A-E: Claims, Arguments and Evidence”) using model-based assessment tools and quantitative performance indicators whenever possible.

Together with the assessment basis (Guillemot et al., 2026; Diomidis et al., 2026; Martin et al., 2026; Wüst et al., 2026; Brown et al., 2026), the findings of the PA forms the basis for the development of a set of safety scenarios (Javanmard, 2026; Nagra, 2024c) for which the radiological consequences are evaluated (Li, 2026; Nagra, 2024d). To demonstrate that the protection objective is met, these are compared to regulatory criteria formulated in terms of effective dose and risk limits under consideration of uncertainties (ENSI, 2023). Note that although dedicated analyses are available on the comparison of site-specific projects as part of the site selection in Switzerland, including comparisons of combined HLW and L/ILW disposal to separate repositories, respectively, they are not part of the safety case and accordingly not reported in the present paper.

2 Assessment principles

Nagra’s safety assessment methodology has been developed in line with international guidance, advancements and publications as elaborated in Smith (2026). The following principles are particularly relevant to the performance assessment:

2.1 Rigour in consideration and treatment of uncertainty

As far as possible, all potential sources of uncertainty and the various sources of bias are considered and recognised when conducting and interpreting the analyses. In particular, the model-based assessment of long-term repository performance respects all categories of uncertainty introduced by the simplified representation of the repository system in terms of geometry, prevailing processes, parameter assignment, boundary and initial conditions and source terms introduced in models. A key part of performance assessment is the identification and analysis of uncertain and potentially detrimental phenomena, together with other uncertainties, as input to the formulation of safety scenarios. More details on uncertainty treatment are provided in Section 5.

2.2 Validation and verification of models and databases

Quality assurance and control measures are adopted and regularly reviewed to ensure that the models and databases developed and applied in the analyses are suitable for their intended purpose. Each computer code used to perform analyses is subject to code and calculation verification and model validation programme, formulated in terms of qualitative and quantitative performance measures (see also Thacker et al., 2014). Development of benchmark workflows for this purpose as well as continuous surveys of state-of-the-art coupled process modelling tools on international level are embedded in the RD&D programme. Accordingly, extensive benchmarking exercises are carried out within Nagra’s programme as well as in the framework of international modelling platforms.

2.3 Multiple lines of argument for safety

In line with, e.g., the recommendations of OECD/NEA (2004), claims related to the performance and safety of the disposal system are supported, as far as possible, by multiple lines of argument. In turn, each argument is substantiated by so-called evidence. The development of high-level claims supported by arguments and evidence is a key element of the performance assessment methodology. The approach adopted here for claims-arguments-evidence is discussed in Section 3.

2.4 Assurance of comprehensiveness

The assurance of comprehensiveness, i.e., the minimisation of “completeness uncertainty” is discussed in Nagra (2024b). Although it is impossible to prove beyond all possible doubt the comprehensiveness of a safety assessment, measures are taken to ensure the inclusion of a comprehensive set of potentially relevant phenomena. Specifically, the description of the phenomenological evolution of the repository (Nagra, 2024e; Diomidis et al., 2026; Martin et al., 2026) on which the present performance assessment is based has undergone iterative development over many years, with each version having been peer-reviewed and informed by Nagra’s extensive RD&D programme (Nagra, 2021a). The comprehensiveness of this description is further enhanced by effective information exchange among safety assessors, technical experts within Nagra, and the broader scientific community. Nagra (2024b) describes how an audit is carried out to verify the inclusion of all relevant features, events and processes (FEPs) in the performance assessment and in the wider safety assessment, and to justify the omission of other features.

3 Claims-arguments-evidence methodology

The need for an auditable assessment framework calls for a traceable method of proof with quantitative performance targets whenever possible. For this, claims are formulated that relate to how the individual repository components and the overall repository system contribute to the different safety functions to satisfy the assigned functional requirements (Nagra, 2024f; Smith, 2026).

A suite of arguments is developed to substantiate each claim. Each argument is backed up by evidence. Evidence are essentially scientific findings based on analyses that inherently carry some level of uncertainty. Accordingly, multiple lines of evidence are essential in building confidence and formulating sound arguments–while multiple lines of arguments add to the robustness of the associated claims. In line with the assessment principles, the robustness of each claim is thereby strengthened through seeking and establishing multiple lines of argument and underlying evidence in a traceable manner. Arguments and evidence can both broadly be grouped according to the following categories (see Figure 1):

3.1 Empirical knowledge and evidence from elsewhere

This includes knowledge from other scientific disciplines (i.e., oil and gas), from other radioactive waste programmes and from natural and archaeological analogues. Arguments based on such knowledge and experience provide confidence in the solid scientific foundation of the safety concept. Empirical evidence derived from desk studies summarising knowledge from other waste disposal programmes or other geoscientific disciplines provides general confidence in the consistency of the arguments with the state of the art (Nagra, 2024g; Diomidis et al., 2026; Martin et al., 2026; Wüst et al., 2026). However, the transferability of this general knowledge and experience to the specific conditions of the project under investigation can be limited.

3.2 Project-related experimental databases

Dedicated experimental databases are collected in the context of Nagra’s RD&D programme (e.g., in situ experiments in rock laboratories, geotechnical characterisation of the barrier materials) and as part of recent site investigation programmes (Wüst et al., 2026) to provide direct evidence for the performance of the repository project under investigation. Specifically, experimental evidence derived from targeted site investigation programmes provides the specific databases needed to prove the performance of the geosphere as a transport barrier and to demonstrate the robustness of the geological barrier in the context of geological long-term evolution. Together with the extensive scientific databases developed and continuously evolving internationally across waste management organizations and research institutions, dedicated scientific studies of THMC processes at laboratory and field scale as part of Nagra’s RD&D programme provide confidence in the governing phenomena and processes associated with the engineered barrier system (Nagra, 2021a; Diomidis et al., 2026; Martin et al., 2026).

3.3 Safety-driven repository design and associated model-supported evidence

The individual barrier components and the entire repository are designed such that the intended safety functions are expected to be provided with large safety margins in most reasonably foreseeable circumstances (Smith, 2026). Model-supported sensitivity and robustness analyses support the optimisation of the performance of individual barrier components and of the entire repository system. In the context of performance assessment, model-supported evidence provides important insights into the adequacy of repository performance when the multibarrier system is subjected to internal or external perturbations.

As part of their substantiation, and in accordance with the assessment principles, claims need to be tested for their robustness with respect to uncertainties, including, for example, uncertainties in the rates or occurrence of processes, the spatial extent of features and the timing of events, as well as the conceptualizations used to develop the argumentation. Specific arguments can be developed for robustness with respect to some uncertain phenomena (e.g., the self-sealing potential of the host rock provides robustness with respect to phenomena that could give rise to either the creation of fractures or reactivation of existing faults, see Wüst et al., 2026). In addition, model-supported quantitative assessments, including sensitivity and uncertainty analyses, play a key role in assessing robustness.

4 Performance indicators, targets and indices

The model-supported quantitative assessments are implemented with a so-called indicator approach. It makes use of numerical models to evaluate a set of performance indicators or indices, which are compared with a set of performance targets. A first implementation for semi-generic repository configurations in Papafotiou et al. (2018) comprised preliminary indicators to assess so-called repository induced effects under different site-specific parametric uncertainties evaluated through integrated probabilistic and deterministic analysis. In Papafotiou et al. (2022), the workflow was further extended to conceptual and scenario uncertainties considered in the performance assessment workflow developed to support the site selection process. In Nagra (2024g) the workflow is further developed and implemented for the post-closure safety case. The performance indicators, indices and targets are herein defined as follows:

4.1 Performance indicator

A measurable or calculable quantity that quantifies one or more system components with respect to their expected performance.

4.2 Performance target

A specific target value related to a calculated performance indicator. A performance target, if met, provides evidence that one or more potentially detrimental phenomena do not compromise the performance of individual components or of the overall repository with regards to their assigned safety functions. This evidence is typically used to substantiate a performance assessment claim.

Performance targets are generally defined based on the known physical and chemical properties of repository materials (including the rock) and general scientific understanding of the behaviour of these materials in the presence of thermal, hydraulic, mechanical, and chemical loads (i.e., they are not tied to the specific repository concept and design under consideration). They represent limits for which materials maintain their intended functions.

The performance indicators, on the other hand, are defined using models that are concept- and design-specific and are used to quantify the loads that will arise in a repository context.

4.3 Performance index

A calculated, dimensionless quantity derived from the performance indicator, generally by dividing the performance indicator by its corresponding performance target, such that, for example, a performance index of less than one indicates favourable performance.

By design, the repository components and the overall repository system are expected to fulfil their performance targets and provide their assigned safety functions in accordance with the safety concept. This expected performance is deduced from a well-constrained assessment basis (Guillemot et al., 2026; Diomidis et al., 2026; Martin et al., 2026; Wüst et al., 2026) and further supported by deterministic and probabilistic performance assessment simulations, which account for inherent conceptual and parametric uncertainties associated with the initial state of the barrier system (Sections 7 and 8). The difference between calculated performance and the performance targets determines the performance margin. The model-based performance indicators and indices also generally show large margins, building confidence in the post-closure safety of the repository as designed, including its robustness with respect to repository-induced effects (e.g., gas and heat). The safety margins represent a measure of barrier performance which can be expressed in terms of evaluation scales, classifying the performance in qualitative terms such as “very favourable”, “favourable”, “less favourable” or “unfavourable” with respect to potentially detrimental phenomena.

5 Uncertainty quantification and model abstraction chain

By definition, a model is an abstraction of a real-world system, gained by eliminating unnecessary spatial and temporal detail. Consequently, any type of conceptualisation of a physical problem, or model abstraction, introduces some level of inaccuracy and uncertainty, in that it involves a reduction of the degrees of freedom in the modelled system. In the PA workflow, the elimination of unnecessary detail is a required and desirable feature, as it improves the traceability of the system behaviour. At the same time, it must be shown that this process does not impair the intended use of the model as a tool for unbiased assessment of repository safety.

The simplification introduced in the representation of the repository system and processes as well as their evolution in the safety assessment is treated within a comprehensive uncertainty treatment framework. Thacker et al. (2024) categorize uncertainty as a potential deficiency in the description of a physical system or numerical model that is due to inherent variability (irreducible uncertainty) or lack of knowledge (reducible uncertainty). Uncertainty quantification in the PA workflow is decomposed accordingly into conceptual, parametric, and scenario uncertainties (Figure 2). Conceptual uncertainties are essentially reducible uncertainties associated with simplifications in the representation of geometries (“geometric abstraction”), the formulation of phenomena and processes (“process abstraction”), the spatial and temporal averaging of material properties (“homogenisation and scaling”), and the boundary/initial conditions and source terms. Parametric uncertainties are irreducible uncertainties including the inherent variability of material parameters. On the other hand, scenario uncertainties arise from different evolutionary paths of the repository system.

The model chain implemented to support the PA is structured accordingly (Figure 2). A first suite of deterministic models is implemented in 3D for analyses of the total system as well as individual components thereof (Nagra, 2024h; 2024i). A model of the entire repository represents the repository structures in a stylised manner, e.g., through volumetric scaling and effective properties of homogenized materials representing different repository sections Papafotiou and Senger (2016). Component models represent selected parts of the repository that are most relevant to safety, namely, the emplacement rooms for high-level waste (HLW) and low- and intermediate-level waste (L/ILW), and the V1, V2, and V3 sealing sections. The geometric representations on this scale become more accurate, and materials explicitly represented in the models correspond to the provisional design of components in the geological repository (Smith, 2026; Diomidis et al., 2026; Martin et al., 2026). The deterministic models provide comprehensive picture of flow and transport in the repository system, provide the underpinning assessment of the repository hydraulic evolution, screen potential THMC interactions in the repository, and ensure readiness of the model chain to evaluate performance indicators. A second suite of probabilistic models is implemented in simplified 2D geometries to propagate parametric uncertainty to performance indicators by means of probabilistic analysis. Monte Carlo simulations are used as a sampling-based propagation method (Morgan et al., 1990; Helton et al., 1991; Helton, 1993). Where necessary, the probabilistic models are extruded to so-called 2.5D geometries to account for axial transport along the repository structures. Key parameters for sampling in the probabilistic framework are selected per performance indicator based on sensitivity screening and ranking (Papafotiou et al., 2016; 2017; 2018; Nagra, 2024h). The probabilistic approach provides for each indicator the estimation of confidence ranges around the best estimate (Nagra, 2024g). Source terms derived from the inventories of waste (Nagra, 2024j) and construction materials (Nagra, 2024k) are scaled accordingly with the dimensionality of the model. Extensive benchmarking exercises are carried out to validate the modelling tools which are used in the context of safety assessment (Nagra, 2024d; 2024g; 2024h). Code and calculation verification and model validation exercises, aimed at the justification of model abstractions and uncertainty quantifications, are embedded in Nagra’s long-term RD&D strategy. Recent activities in international modelling platforms are associated with Nagra’s FE Task Force (Alcolea et al., 2021; Buchwald et al., 2025; Wojnarowicz et al., 2024), EURAD-HITEC, EURAD-GAS (Jacops and Kolditz, 2024; Marschall et al., 2024; Wendling et al., 2024) and with the EBS Task Force (Romero and Gonzales-Blanco, 2019; Madaschi and Laloui, 2019). Further information on relevant modelling activities is given in Nagra (2024g).

6 System evolution

6.1 Key aspects

The long-term evolution of the geological barrier is detailed in Wüst et al. (2026). This addresses the expected tectonic, geomorphological, and hydrological changes during glacial-interglacial cycles over the next one million years. The construction and operation of the repository will introduce thermal, hydraulic, geomechanical and geochemical disequilibrium in the repository near-field over an extended period, as described phenomenologically in Nagra (2024e) for the expected evolution of the repository. This includes coupled processes that may be relevant to post-closure safety and take place during excavation, installation of support structures, and ventilation of the repository, as well as after emplacement of the waste, the backfill and the sealing materials. An overview is provided in the following.

The excavation of the repository structures introduces pore pressure changes in the rock and creates an excavation disturbed zone (EDZ) around the tunnels where the properties of the Opalinus Clay are altered. The subsequent ventilation at prescribed temperature and relative humidity causes depressurization and partial desaturation of the EDZ and surrounding rock. After emplacement and backfilling of the repository, the EDZ will start to resaturate, and pressure in the host rock will gradually recover. In the HLW repository section, thermal effects will be introduced by the heat generated from the waste (Guillemot et al., 2026; Nagra, 2024g). At the same time, gas will be generated in both HLW and L/ILW sections of the repository (Guillemot et al., 2026; Guillemot (2023); Nagra, 2024i), increasing the gas pressure. Porewater will migrate between the host rock and backfill materials depending on the balance of capillary, viscous and gravity forces over time in different sections of the repository. In general, transport in the low-permeable host rock is diffusion-dominated (Wüst et al., 2026; Nagra, 2024m), whereas transport in some parts of the repository, comprising materials with sufficiently high porosity and permeability, can be driven by advection if sufficient gas pressure gradient develops.

Accordingly, two distinct phases can be discerned with regards to system analysis after closure of the repository (Nagra, 2024e). The first phase corresponds to the early post-closure phase (e.g., hundreds of years) and is marked by the development of a thermal pulse extending radially (resp. in ellipsoid form) around the HLW disposal area from the heat released by the waste. The increasing temperature in the HLW nearfield results in porewater pressure increase through the difference between the expansivity of water and of the pores in the low-permeable rock, referred from here onwards as differential thermal expansion. The second phase of the evolution is in the late post-closure phase (thousands to tens of thousands of years) and is marked by the accumulation of gas in the L/ILW and HLW repository sections. The increasing mass of gas in the repository increases pressure as gas compresses in the pore volume available in the repository nearfield in the low-permeable rock, referred from here onwards as gas pressure buildup. Through the process of gas dissolution in porewater, the pore volume available to gas is also coupled to porewater exchange with the surrounding rock. In general, the rate of gas generation in the L/ILW caverns is orders of magnitude higher than that in the HLW drifts of the repository (Nagra, 2024i). The design in the L/ILW and HLW repository sections is tailored accordingly. In the L/ILW section, high porosity backfill materials in the L/ILW emplacement caverns are combined with gas-permeable L/ILW-V1 and L/ILW-V2 seals to facilitate a gas transport path through the seals into the backfilled access and operations tunnels and the repository central area (Martin et al., 2026; Nagra, 2024i). In the HLW section, the gas generation rate is lower, and gas dissipates by radial transport and dissolution through the nearfield and surrounding host rock (Nagra, 2024i).

6.2 Implementation in the model-based assessment

From a long-term safety perspective, the resulting perturbations of the physico-chemical state conditions are drivers for thermal, two-phase hydraulic, mechanical and chemical (TH²M-C) interactions between the individual repository components. These can be outlined as follows:

• Thermal interactions, which take place through the transport of heat in the repository near-field.
• Hydraulic interactions, which take place through transport of fluid mass.
• Mechanical interactions are predominantly a consequence of thermal and hydraulic effects that may introduce hydro-mechanical and thermo-mechanical perturbations, respectively.
• Chemical (and biological) interactions, which are predominantly facilitated through transport of chemical species and/or energy in the form of heat.

Model-based analyses of the interactions between the different barrier components require a balance between component-scale and repository-scale considerations (Section 5), including complex couplings between the phenomena and processes involved. From a component-scale consideration these may be limited to the waste nearfield, whereas the main drivers for TH²M-C interactions at the total system level are phenomena and processes that occur within and along the backfilled and sealed underground structures. Notably, in clay-rich host rocks, chemical interactions are of little relevance at the scale of the entire repository, because transport of species in the near-field is diffusion-dominated. Chemical interactions, and any associated microbiological activity, are therefore localized predominantly at interfaces between barrier components and are addressed at the component level (Section 7.1). Note that in Nagra’s safety case, the performance assessment does not explicitly perform radionuclide transport calculations. Instead, a conservative tracer is used (e.g., no decay, no sorption) assuming a source term equal to a conservative estimate of the instantaneous release fraction of the most safety-relevant radionuclide identified in the safety analysis (Li, 2026, see also Section 8). Accordingly, tracer mass fluxes are scaled with decay and biosphere conversion factors to approximate dose rates. The detailed analysis of radiological consequences with the implementation of the detailed inventory, including decay chains and radionuclide-specific sorption and diffusion databases is described in Li, 2026. As input to this analysis, the performance assessment screens scenarios for potential relevance to safety. These are formulated on the one hand based on screening of features, events, and processes (FEPs) that are deemed relevant, and on the other hand by identifying and bundling the large number of evolutionary paths of the repository system into a manageable number of safety scenarios. As an example, subsurface evolutionary paths bracketed by the assessment basis on the geological barrier (Wüst et al., 2026) are formulated in scenarios in the PA in terms of deviations from the expected performance of the CRZ. These include scenarios of hydraulic gradients and potential release paths in the subsurface, undetected faults in the repository nearfield, faults induced by processes in the repository, earthquakes, loss of overburden due to erosion processes, and potential activation of faults (Table 1). Future climate scenarios are addressed only in the subsequent radiological consequence analysis (Li, 2026).

TABLE 1. PA scenarios used to evaluate deviations from the expected performance. Adapted from Nagra (2024g).

7 Performance of the multibarrier system

The repository performance is first assessed by barrier components and then for the multibarrier as a total system.

7.1 Performance by component

The performance of system of technical and geological barriers is first evaluated at the level of individual components. Building on the safety concept for HLW and L/ILW (Smith, 2026), this first step systematically assesses the seven pillars of safety individually (Nagra, 2024b; Smith, 2026) and how these contribute to the specific safety functions assigned to them (Nagra, 2024b; Smith, 2026). The evaluation is carried out through the formulation of claims, and the substantiation of these claims by multiple arguments and evidence developed to confirm the performance with respect to safety functions. The outcome are traceable C-A-E tables for the deep underground location of the waste, the CRZ, the SFRP-HLW matrices, the SF and RP-HLW disposal canisters, the buffer of the HLW emplacement drifts, the cementitious near-field of the L/ILW emplacement caverns, and the closure system, respectively. For brevity, the reader is referred to Nagra (2024g) for a detailed account.

7.2 Performance of the total system

From a total system perspective, it is first demonstrated that interactions between HLW and L/ILW can be excluded by design (Section 7.2.1). Consequently, interactions between components are classified into thermal and gas-induced, addressed in Sections 7.2.2 and 7.2.3, respectively.

7.2.1 Interactions between HLW and L/ILW repository sections

Interactions between the HLW and L/ILW repository sections that may be detrimental to safety (Nagra, 2021b) are excluded by repository design, namely, the physical separation of the two sections and the staggered closure system that provides an effective hydraulic decoupling between them. Claims, arguments and evidence on such interactions are detailed in Nagra (2024g).

Exemplified evidence from the model-based assessment is given in Figure 3 that shows distributions of temperature, pressure, HLW-gas tracer, and L/ILW-gas tracer after 1,000 and 100,000 years, respectively. A marked local increase of temperature is calculated in the HLW nearfield but never reaches the L/ILW disposal area, indicating the thermal decoupling of the two repository sections. Furthermore, thermally-induced overpressures from heat emitted by the HLW are limited to the vicinity of the HLW drifts (e.g., pressure after 1,000 years in Figure 3). Similarly, gas-induced overpressures that develop in the HLW nearfield are also limited to the HLW disposal area (e.g., pressure after 100,000 years in Figure 3). This is further supported by gas tracer simulations tracing H₂ generated by the corrosion of HLW, showing that gas is effectively contained within the drift sections sealed off by the HLW-V1 and HLW-V2 seals, respectively. In addition, these seals effectively prevent any inflow of gas from the L/ILW disposal area. Gas generated by the L/ILW migrates along the emplacement caverns as well as the operations tunnels of the repository due to the gas-permeable V1-L/ILW and V2-L/ILW seals used in the L/ILW repository section (see also Section 7.2.3), where it remains effectively contained within the repository system for tens of thousands of years. The detailed analysis of gas pathways through the closure and backfill system of the L/ILW and associated confinement of gas is discussed in Nagra (2024i). Furthermore, mechanical interactions by thermal- or gas-related disturbances are examined and excluded through calculations of heave and potential for mechanical failure of intact rock in Nagra (2024g).

The results discussed here correspond to the expected performance of the barrier system–similar deterministic analyses for a broad range of deviations from expected performance are detailed in Nagra (2024h) and Nagra (2024i). The probabilistic assessments carried out within the performance screening (Section 8) confirm the findings under consideration of parametric and source term uncertainties (Nagra, 2024h; 2024g).

7.2.2 Thermal interactions

As part of the provisional repository design (Smith, 2026), the necessary design measures have been taken to avoid any detrimental impacts of thermal interactions on the safety functions of individual components and on the multibarrier system (Diomidis et al., 2026; Nagra, 2024e). Although, as discussed above, effects on the L/ILW disposal section can be excluded, the decay heat emitted by the HLW canisters causes elevated temperatures in the HLW near-field for thousands of years, which could potentially impair the safety functions of the HLW buffer, the host rock and the HLW-V1 seals. In addition, the thermal disturbances to the HLW near-field could enhance radionuclide release in the event of premature breaching of the HLW canisters. Claims, arguments and evidence on thermal interactions are detailed in Nagra (2024g). A summary of selected model-based evidence gained from integrated modelling on different scales (see also Figure 2) is provided in the following.

The simulated evolution of temperature, gas saturation and pore pressure in the vicinity of the HLW emplacement drifts are shown for the base case of the so-called expected repository performance in Figure 4. Within the first ∼10 years after emplacement, the temperature calculated at the canister surface reaches ∼135 °C and varies between ∼120 °C and ∼80 °C in the unsaturated buffer next to the canister and the tunnel wall, respectively. Note that during this period the bentonite remains mostly dry, particularly near the canister where high temperatures develop. The buffer resaturates within two to three hundred years – already after 100 years the resulting increase in thermal conductivity is expected to decrease temperatures in the buffer to below 90 °C. In this temperature range, the favourable retention behaviour of the bentonite associated with its high sorption capacity, its low hydraulic conductivity, and its high swelling pressure remains effective (Nagra, 2024g; Diomidis et al., 2026). A performance target of 150 °C for bentonite is set based on experimental programmes (Leupin et al., 2014; Müller et al., 2014; Jenni et al., 2019; Martikainen et al., 2024). However, changes in bentonite properties cannot be entirely excluded and scenarios with deviations of hydro-chemical conditions in the HLW nearfield are addressed both in the PA (Section 8) and the radiological consequences (Li, 2026).

The development of pore pressure in the HLW near-field is controlled by two processes, namely, by the compressibility and capillary suction of the HLW buffer and by the propagation of the thermal pulse and differential thermal expansion in the host rock. The associated pressure effect is mainly observed in the fully saturated host rock where the low permeability of the Opalinus Clay controls the dissipation of the thermally-induced overpressures. As shown in Figure 4, the extent of the overpressure zone initially propagates as radial fronts around the HLW drifts and later upwards and downwards as a single front towards the confining units. The most distinctive overpressures are observed after the formation of a single front, with the respective location of ∼20 m above the HLW repository centre plane being representative for estimating the failure potential of intact rock. The respective pore pressure is ∼12.5 MPa (corresponding to an overpressure of ∼4.1 MPa above hydrostatic, assuming that ambient pressure at that location corresponds to a hydrostatic column with the respective depth) which results in moderate mechanical failure potential (Nagra, 2024g). Probabilistic assessment of the failure potential confirms that the mechanical integrity of the host rock remains unaffected even assuming the upper bound of thermal source terms and unfavourable thermo-hydraulic properties of the host rock (Nagra, 2024g; see also Section 8).

Similar analysis is performed for the HLW-V1 seals using best estimate and conservative scenarios of heat emitted by the HLW canisters. The maximum temperature in the centre of the HLW-V1 seal remains below 65 °C which precludes and significant loss of mechanical and chemical integrity of the closure system (Nagra, 2024i; 2024g).

Additional model-based assessments are carried out to identify potential impacts of heat on radionuclide release. Note that by design the expected lifetime of canisters will prevent any radionuclide release in the first 10,000 years from the canisters when thermal effects may be of relevance. Nevertheless, two main mechanisms are identified in the case of premature canister failure, namely, (i) release of radionuclides from the canister to the buffer and propagation of the diffusion front through the rock under the action of the thermal gradient, and (ii) advective transport of radionuclides axially along the drifts and tunnels under the action of thermally induced porewater pressure gradients. Extensive simulations, both at repository and at component scale, confirm that the loss of barrier function associated with thermal effects in the HLW repository section is marginal even under the most conservative assumptions (Nagra, 2024g).

7.2.3 Gas-induced interactions

The provisional repository design (Smith, 2026) foresees a suite of design measures both for the HLW and the L/ILW repository sections to avoid any detrimental impacts of gas-induced interactions on the safety functions of individual components and on the multibarrier system (Diomidis et al., 2026; Martin et al., 2026; Nagra, 2024e). Claims, arguments and evidence on gas-induced interactions are detailed in Nagra (2024g), supported by extensive model-based assessment in Nagra (2024i) and Nagra (2024h). A summary of selected model-based evidence gained from integrated modelling on different scales (see also Figure 2) is provided in the following.

7.2.3.1 HLW repository section

The anaerobic corrosion of the HLW result in hydrogen (H₂) accumulation and associated pressure buildup for more than 100,000 years (see Figure 3). Gas-induced overpressures could impair the mechanical integrity of the bentonite buffer, the host rock, and the V1-HLW seals. In addition, gas in the HLW near-field could enhance the release of radionuclides dissolved in the liquid phase along the backfilled repository structures.

The transients of pressure simulated in the HLW repository section are shown in Figure 5a. The pressure drop at the beginning of the ventilation phase corresponds to the decrease from the initially hydrostatic to atmospheric pressure in the repository tunnels. In the early post-closure phase of the HLW repository section, pressure first increases in the host rock surrounding the emplacement drifts (location “OPA above HLW” in Figure 5) due to the differential thermal expansion in the low-permeable rock, whereas thermally-induced pressures within the emplacement drifts are significantly lower (location “HLW can” in Figure 5), as discussed in Section 7.2.2. Pressures in the drifts then continue to increase due to gas accumulation, reaching ∼10.5 MPa shortly after canister breaching, assumed to occur at 10,000 years (Nagra, 2024l). Due to additional corrosion of the canister from the inside (not in contact with bentonite), pressure continues to increase and reaches a maximum of ∼11.8 MPa when the canister in the model is corroded entirely after ∼115,000 years (Nagra, 2024i). Unlike the thermally induced pressures, which reach their maximum values in the rock surrounding the drifts, gas-induced pressures are higher at the gas source and dissipate in the rock away from the drifts (see also Figure 4). After the corrosion of the HLW disposal canisters is complete, pressure decreases steeply due to the decrease in the gas generation rate. The gas-induced overpressures correspond to moderate failure potential of intact rock (Nagra, 2024g). Probabilistic assessment confirms that the mechanical integrity of the host rock remains unaffected also for the upper bound of gas source terms and unfavourable gas-related properties of the host rock (see also Section 8). Note that criticality assessment was not required as part of the safety case submitted for Nagra’s general license application.

Model-based assessments further provide flow rates through the sealing sections of the HLW repository section, discussed in detail in Nagra (2024h) and Nagra (2024g). Liquid flow rates through the HLW sealing sections are limited to thermally induced water expulsion, discussed in the previous, and confirm that enhancement of dissolved radionuclide release axially along the backfilled and sealed HLW structures is excluded. With regards to volatile radionuclides, flow rates of gas released from the V1-HLW seals remains ∼ 3–4 orders of magnitude (OoM) below the respective gas generation rate from HLW, whereas no release of gas takes place from the V2-HLW seals for hundreds of thousands of years.

7.2.3.2 L/ILW repository section

The corrosion of metals and degradation of organics of the L/ILW result in accumulation of gases (cf. Guillemot et al., 2026) and associated pressure buildup for more than 100,000 years (Nagra, 2024i). The main gases produced in the L/ILW emplacement caverns under the reducing conditions expected to be established shortly after cavern closure are H₂, methane (CH₄) and carbon dioxide (CO₂) – the latter is, however, dissolved and as it forms consumed by carbonation of cementitious materials (Martin et al., 2026). As discussed in Section 6, the repository design provides gas storage volume in the L/ILW emplacement caverns and at the same time allows axial transport of gas through the repository structures for additional gas storage volume in the access and operations tunnels and central area of the repository. Nevertheless, gas-induced overpressures could impair the mechanical integrity of the host rock and enhance the release of volatile radionuclides (predominantly ¹⁴C) as well as radionuclides dissolved in the liquid phase along the backfilled repository structures.

The transients of pressure simulated in the L/ILW repository section are shown in Figure 5b. As described above, pressure drops in the repository tunnels at the beginning of the ventilation phase from the hydrostatic to atmospheric pressure. During the early post-closure phase of the L/ILW repository section, pressures increase faster in the emplacement caverns than in the operations tunnels due to the gas generation from the corrosion and degradation of waste. This pressure gradient results in axial gas transport from the emplacement caverns to the adjacent tunnels through the L/ILW-V1 and L/ILW-V2 seals, which is a key feature of the L/ILW repository section. After ∼6,000 years, pressures equilibrate across the L/ILW structures while remaining below hydrostatic. From that time until the end of the simulation, all tunnels in the L/ILW repository section have approximately the same pressure at any given time, indicating that there is effective hydraulic connection across the tunnels with sufficient gas transport capacity to distribute the gas in the available pore volume (Nagra, 2024i). Pressure in the L/ILW repository section reaches hydrostatic after ∼20,000 years, further limiting ingress of water from the surrounding rock. Pressures then continue to increase until ∼70,000 years, reaching a peak value of ∼9.3 MPa before eventually decreasing again towards hydrostatic pressures as gas generation gradually declines. Pressures in the emplacement caverns, operations tunnels and sealing sections of the L/ILW repository section and in the central area of the repository all evolve in a similar manner. On the other hand, the fast restoration of hydrostatic pressure in the shaft above the V3 seal, discussed in detail in Nagra (2024i), is indicative of the hydraulic separation of the shaft from the repository, provided by the V3 seal. The overpressures induced by gas generated from the L/ILW correspond to moderate failure potential of intact rock (Nagra, 2024g). Probabilistic assessment confirms comfortable margins also for upper bound gas source terms and unfavourable gas-related properties of the host rock (see also Section 8).

The very low hydraulic conductivity of the Opalinus Clay (Wüst et al., 2026; Nagra, 2024m) ensures that the L/ILW emplacement cavern remains partially saturated for hundreds of thousands of years (see also Martin et al., 2026). This is depicted in spatial distributions of gas saturations simulated for the L/ILW shown in Figure 6. In the post-closure phase, water gravitates to the lower part of the cavern while gas accumulates in the mortar surrounding the waste containers in the middle and upper part of the cavern (see also Martin et al., 2026). Notably, this holds for all stacks of containers along the cavern axis (Figure 6e). The unsaturated conditions in the L/ILW cavern have a significant impact on the release of dissolved radionuclides from the waste packages into the cavern backfill, because the effective diffusion coefficient of the cementitious barrier materials of the L/ILW near-field decreases by orders of magnitude with decreasing water saturation (Levasseur et al., 2021; 2023). Furthermore, simulations on repository scale confirm the axial water displacement from the L/ILW disposal area towards the central area is very low so that radionuclides dissolved in porewater will be dispersed into the backfilled structures of the central area and eventually diffuse into the host rock (Nagra, 2024g). Probabilistic release calculations of the dose relevant radionuclide ³⁶Cl along the backfilled, unsaturated repository structures and through the V3 seals of the shafts show the robust performance of the L/ILW repository section as a transport barrier for dissolved radionuclides that maintains several orders of magnitude of safety margin even for the most unfavourable scenarios and transport properties (see also Section 8).

The gas saturation distribution shown in Figure 6 indicates another key feature of the L/ILW repository section, namely, the connected gas pathway that forms along the upper part of the emplacement caverns and adjacent operations tunnels. Gas saturation transients modelled on component and repository scale show that this pathway is maintained for hundreds of thousands of years (Nagra, 2024i). On the other hand, the V3 seals of the shafts become fully saturated from porewater inflow from the surrounding formations while the repository structures are still underpressurized, providing effective confinement for gas (Nagra, 2024i). Accordingly, the gas released through the V3 seals to the upper confining units corresponds to small fraction of the gas generated by the L/ILW (e.g., ∼0.05% after 100,000 years in the expected evolution). Transport of volatile ¹⁴C is addressed explicitly to estimate the respective activity released through the V3 and demonstrate that the backfilled repository structures do not constitute a significant release path for volatile radionuclides. Probabilistic assessment confirms robust performance margins even for conservative scenarios associated with the evolution of the multibarrier system (Section 8, see also Nagra, 2024g).

7.2.4 Remarks on total system performance

The performance assessment at the system level focuses on the interactions between the individual repository components, comprising phenomena and processes that occur along the backfilled and sealed underground structures. Repository-scale modelling confirms that the HLW and L/ILW sections of the repository are hydraulically and thermally decoupled from each other. Mechanical and chemical interactions are limited to the immediate footprint areas. The thermal- and gas-induced perturbations in the HLW repository section occur at different times, which confirms that detrimental superposition of thermal- and gas-related impacts on the safety functions of the barrier components can be excluded. The repository design provides storage volumes for gas generated by the L/ILW within the underground structures, confined by the V3 and HLW-V2 seals, resulting in moderate gas overpressures. Accordingly, the impact of thermal- and gas-induced perturbations on the mechanical and chemical integrity of the barrier system is modest in both sections of the repository. Gas that may carry volatile radionuclides is effectively contained for very long times, while unsaturated conditions ensure that the release of dissolved radionuclides in the L/ILW nearfield is strongly retarded. Overall, neither the thermal- nor the gas-related disturbances lead to porewater flows along the sealed and backfilled tunnels which could increase radionuclide release from the repository.

Note that the results presented here conservatively do not consider some favourable effects relevant to gas. Molecular diffusion of H₂ dissolved in porewater is neglected – complementary simulations reported in Nagra (2024h) and Nagra (2024g) show a significant reduction in peak pressure by more than 1 MPa in the HLW as well as the L/ILW repository sections. The role of water consumption due to anaerobic corrosion is also the subject of scoping calculations that show further reduction of peak pressure by more than 1 MPa in the L/ILW nearfield (Nagra, 2024g; Martin et al., 2026). A further mechanism that could reduce the buildup of gas pressure in the HLW repository section and the operations tunnels that store L/ILW-generated gas is microbial activity (Leupin et al., 2016; Papafotiou et al., 2016). Due to currently limited predictability of long-term microbial processes, microbial gas consumption was not considered in the present PA calculations.

8 Performance screening

A probabilistic indicator workflow is implemented to evaluate performance margins by comparing safety-relevant performance indices with their corresponding performance targets. By design, the multibarrier system of the provisional design (Smith, 2026) performs all required post-closure safety functions over the entire period of assessment. Accordingly, its evolution under the action of internal and external perturbations is referred to as the Expected Performance. Performance screening is the final step in the PA workflow, aimed at identifying and evaluating safety-relevant deviations from the expected barrier performance. Deviations can occur if one or several barrier components do not perform according to their assigned safety functions. In such cases, the inherent redundancy of the multibarrier system foresees that the properly functioning barrier components provide adequate overall performance of the repository system. Redundancy is therein addressed through scenarios representing deviations from expected performance of individual components of the system or combinations thereof, i.e., where components do not fulfil their assigned safety functions. The analysis aims to demonstrate that the reduced performance of a single component is partially compensated for by other components of the barrier system, so that adequate margins remain in place in the overall performance of the repository system. From the perspective of uncertainty management, deviations from expected performance are associated with conceptual and scenario uncertainties rather than parametric uncertainties. The repository evolution related to each deviation from expected performance is inferred within a parametric uncertainty range to form the respective PA scenario. Each scenario addresses a well-defined assessment aspect, expressed in terms of performance indicators and indices. These are:

• Tracer flux TF_{CRZ, I-129} representing the dose-relevant, non-sorbing radionuclide ¹²⁹I, which is dissolved in the porewater and released from the HLW near-field into the host rock and transported to the regional aquifer systems overlying and underlying the CRZ (normalised tracer flux - NTF_{CRZ, I-129});
• Temperature T_B in the bentonite at a distance of 0.05 m above an HLW canister (normalised bentonite temperature–NBT);
• Pore pressure P_{HLW, heat} in the host rock at a distance of 20 m above an HLW canister (Failure Potential associated with thermal impacts in the HLW repository–FPH: derived using the Mohr-Coulomb shear failure criterion for a given in situ stress state, considering an enhanced total stress due to thermal expansion of the rock matrix);
• Pore pressure P_HLW,gas in the host rock at a distance of 20 m above an HLW canister (Failure Potential associated with Gaseous impacts in the HLW repository–FPG_HLW: derived using the Mohr-Coulomb shear failure criterion for a given in situ stress state);
• Tracer flux TF_CRZ,Cl-36 representing the dose relevant, non-sorbing radionuclide ³⁶Cl, dissolved in the porewater and released from the L/ILW near-field into the host rock and transported to the regional aquifer systems overlying and underlying the CRZ (NTF_{CRZ, Cl-36});
• Tracer flux TF_CRZ,C-14 representing the dose relevant, volatile radionuclide ¹⁴C, released from the L/ILW emplacement caverns through the CRZ into the host rock and transported to the regional aquifer systems overlying and underlying the CRZ (NTF_{CRZ, C-14});
• Tracer flux TF_V3,C-14 of the volatile tracer ¹⁴C released from a container into the L/ILW emplacement cavern backfill and transported through the repository structures and released through the V3 seals (NTF_V3,C-14);
• Gas pressure P_L/ILW at a point inside an L/ILW emplacement cavern (FPG in the L/ILW repository–FPG_L/ILW: shear failure criterion derived similar to FPG_HLW).

Note that tracer flux TF_V3,Cl-36 representing the transport and release of ³⁶Cl along the backfilled repository structures through the V3 repository seals is not shown here because, for all PA scenarios investigated, the release of the ³⁶Cl through the V3 seals remained below the limit of significance. Further details on the methodology applied for performance screening are given in Nagra (2024g).

8.1 Expected performance

The results of performance assessment for the expected performance of the HLW and the L/ILW repository sections are discussed separately in the following.

8.1.1 HLW repository section

Indicator TF_CRZ,I-129 evaluates the efficiency of the CRZ in retaining the dose-relevant radionuclide ¹²⁹I based on an instantaneous release IRF_I-129 (10% of total initial activity of ¹²⁹I), calculated over 10 million years, which exceeds by a factor of 10 the period for assessment (1 million years). The probabilistic simulations of tracer transport show that the maximum release into the regional aquifer systems is reached after ∼0.3–1 million years. The respective performance index is calculated for each simulation by normalising the peak dose for each tracer breakthrough curve with the regulatory dose limit of 0.1 mSv/a assuming a biosphere dose conversion factor corresponding to the present-day climate. The results from 1,000 samples are shown in Figure 7a, indicating a maximal release of ∼7 × 10⁻⁵ mSv/a, which is 3.1 OoM below the regulatory dose limit. The respective histogram of NTF_{CRZ, I-129} shows a narrow spread with a width of ∼0.05 OoM (Nagra, 2024g).

The temperature T_B is the indicator used to evaluate the long-term chemical and mechanical integrity of the buffer. The results from a sample set of 1,000 simulations show that the maximum temperature is reached after around 10 years and that peak temperatures remain below 150 °C in all simulations (Figure 7b). The corresponding performance indices are calculated for each simulation by normalising each temperature curve with the performance target of 150 °C, resulting in NBT with median of 0.78 and the 95th and 99th percentiles of the frequency distribution equal to 0.82 and 0.84, indicating a narrow frequency distribution with a favourable safety margin (Nagra, 2024g).

The pore pressure P_{HLW, heat} at a distance of 20 m above an HLW canister is the indicator for the mechanical integrity of the CRZ in response to thermal loads. Probabilistic simulations based on a sample set of 1,000 simulations indicate peak pressures up to ∼15.9 MPa (Figure 7c). The magnitudes of the principal components of minimum and maximum horizonal stress S_h and S_H at the respective control point are derived from the best estimate values of in situ stress (Nagra, 2024n) and correspond to 16.8 and 18.8 MPa, respectively. These feed into the estimation of the normalised performance indicator FPH representing the potential for shear failure. The histogram of expected performance shows an FPH median of 0.37, and the 95th and 99th percentiles of the frequency distribution equal to 0.47 and 0.55, indicating large safety margins (Nagra, 2024g).

The pore pressure P_HLW,gas in the backfilled HLW drifts is the indicator for the mechanical integrity of the CRZ in response to gas-induced loads. Probabilistic simulations based on a sample size of 1,000 simulations indicate peak pressures up to ∼14.0 MPa, with a first peak after 10,000 years and a second peak after ∼100,000 years associated with canister breaching and complete canister corrosion, respectively (Figure 7d). The magnitudes of the principal components of minimum and maximum horizonal stress S_h and S_H at the respective control point are 17.2 and 19.2 MPa, respectively, whereas the vertical stress is 21.9 MPa. The histogram of the potential for shear failure due to gas overpressures, FPG_HLW, shows a median value of 0.35 and 95th and 99th percentiles equal to 0.45 and 0.46, respectively, also indicating large safety margins (Nagra, 2024g).

8.1.2 L/ILW repository section

Indicator TF_CRZ,Cl-36 evaluates the efficiency of the CRZ in retaining the dose-relevant radionuclide ³⁶Cl based on instantaneous release of the entire ³⁶Cl inventory into the porewater of the L/ILW near-field, calculated over a timescale of more than 3 times the half-life of ³⁶Cl (1 million years). Gas production and the associated unsaturated conditions in the L/ILW emplacement caverns are explicitly considered in the simulations. The probabilistic simulations of tracer flux with a sample set of 100 simulations show that the tracer flux into the regional aquifer systems remains below 10⁻⁷ mSv/year during the entire period for assessment (Figure 8a). The corresponding performance indices NTF are more than 6 OoM below the regulatory dose limit (Nagra, 2024g).

Indicators TF_CRZ,C14 and TF_V3,C14 evaluate the efficiency of the CRZ and the backfilled and sealed underground structures, respectively, in retaining the dose-relevant radionuclide ¹⁴C based on instantaneous release of the entire inventory of ¹⁴C in the gas phase in the L/ILW near-field. The fluxes are calculated over a timescale of more than 17 times the half-life of ¹⁴C (100,000 years). The probabilistic simulations of tracer flux TF_CRZ,C14 with a sample set of 100 simulations in total reveal that no ¹⁴C is released into the regional aquifer systems (Figure 8b). The corresponding performance index NTF_CRZ,C14 is below the limit of significance. The tracer flux TF_V3,C14 along the backfilled repository structures and its release through the V3 seals indicate maximum dose rate in the order of 10⁻¹⁰ to 10⁻⁸ mSv/year after ∼30,000–50,000 years (Figure 8c). The calculated dose is more than 7 OoM below the regulatory dose limit as expressed by the corresponding performance index NTF_V3,C14 (Nagra, 2024g).

The gas-induced overpressure P_gas,L/ILW is the indicator for the mechanical integrity of the CRZ around the L/ILW emplacement caverns in response to gas-induced loads. Probabilistic simulations of pore-pressure transients with a sample size of 100 simulations indicate peak pressures up to 10.5 MPa after ∼70,000 years (Figure 8d). The magnitudes of the principal components of minimum and maximum horizonal stress, S_h and S_H, at the control point are 16.2 and 18.1 MPa, respectively, and the vertical stress is 20.2 MPa. The histogram of the potential for shear failure due to gas overpressures, FPG_L/ILW, shows a median value of 0.31 and 95th and 99th percentiles equal to 0.33 and 0.34, respectively, once again indicating large safety margins (Nagra, 2024g).

8.2 Deviations from expected performance

The PA scenarios are specified to evaluate the impact of reduced performance of individual components on the safety margins of the entire multibarrier system. A compilation of the scenarios addressed in the PA is listed with the respective barrier component in Table 1. For detailed appraisal of each scenario the reader is referred to Nagra (2024g). The assessment for scenario PESSGAS is discussed in the following as an example.

8.2.1 Assessment of deviations

In the scenario PESSGAS, it is assumed that the prevailing chemical conditions in the L/ILW emplacement caverns give rise to increased rates of the gas-producing corrosion and degradation processes. Elevated corrosion and degradation rates are linked to the upper bound gas source term for L/ILW (Guillemot et al., 2026; Nagra, 2024i; Diomidis et al., 2023). Deterministic simulations on the scale of the L/ILW emplacement caverns are analysed in Nagra (2024i), resulting in peak gas pressure of less than 10 MPa. The probabilistic simulations as part of the PA-Scenario PESSGAS are carried out with the aim of assessing performance indicators TF_CRZ,Cl-36 and P_gas,L/ILW by perturbation of the input parameters. The comparison of the PESSGAS scenario with the scenario of expected performance indicates only marginal differences in barrier performance. The tracer flux TF_CRZ,Cl-36 is practically indistinguishable from that of the expected performance. The pressure evolution P_gas shows an earlier peak after ∼10,000–20,000 years with magnitudes between nine and 11 MPa and a low failure potential (FPG_P95 = 0.35).

8.2.2 Relevance and likelihood of deviations

The indicator-based assessment used for the PA scenarios allows to evaluate their implications on repository performance and long-term safety. Evaluation scales were formulated for each performance indicator, aimed at quantifying the margins estimated for each scenario against the corresponding performance targets. The safety margins were categorized into four conditions as follows:

• Very favourable: unconditionally favourable repository performance is ensured over the full range of parametric uncertainties.
• Favourable: robust repository performance is ensured over the full range of parametric uncertainties.
• Less favourable: sufficient repository performance is provided over a wide range of parametric uncertainties.
• Unfavourable: safety margins are low or absent.

Furthermore, the conceptual uncertainties addressed in the PA scenarios are qualitatively screened in terms of likelihood and categorized accordingly into:

• Hypothetical deviations from expected performance.
• Unlikely (alternative) deviations from expected performance.
• Likely deviations from expected performance.
• Expected performance.

This qualitative assignment is substantiated by technical arguments for each scenario as detailed in Nagra (2024g). For example, scenario PESSGAS resulted in very favorable to favorable margins does not make sense and is considered unlikely/alternative based on (i) Nagra’s dedicated laboratory programme on steel corrosion and associated gas generation rates, (ii) the low rate of ingress of porewater from the low-permeability host rock that restricts the corrosion process, and (iii) the gas-induced fracturing occurring preferentially along the EDZ by re-opening existing EDZ features. The ratings of relevance and likelihood are illustrated in Figure 9. In general, robust performance margins are maintained throughout alternative scenarios formulated for the geological and technical barriers. Deviations from expected performance of a single barrier component (i.e., PA scenarios WPFAIL, V3PERM) do not lead to an adverse loss of performance of the entire system because of the redundancy of the multibarrier safety concept. Inherent limitations in the description of the geological setting, which lead to conceptual uncertainties in the assessment (PA scenarios UPFLOW, DWNFLOW, HARDBED, etc.) have only a moderate impact on the barrier performance as a whole, depicted in minor loss of margins. The same applies to effects of geological long-term evolution (PA scenarios SEISHLW, SEIS SEISLILW, LOSSOB, LOSSFLT, etc.). Scenarios of steeply dipping faults of various origins (pre-existing, thermally- and gas-induced, seismic) result in favorable performance of the CRZ even for the most pessimistic assumptions related to their properties. Overall, only hypothetical scenarios give rise to a less favorable performance. In-depth assessment of the results from the PA scenarios provide guidance for the development of the safety scenarios (Javanmard, 2026) and analyses of radiological consequences (Li, 2026).

9 Conclusion

The assessment of the repository performance follows a systematic, transparent, and traceable workflow that ensures auditability of the results. The assessment first evaluates the performance of individual components, followed by the interactions between components and their cumulative impact on the repository system. An important aspect of the assessment methodology is the integration of uncertainty quantification, which addresses parametric and conceptual uncertainties. In addition to the expected performance of the repository, the assessment addresses deviations thereof, classified and analysed at the component and total system level in the form of PA scenarios.

The performance assessment confirms that the geological repository for HLW and L/ILW at the Haberstal site is safe over the entire assessment period, with significant safety margins under expected as well as adverse conditions. The evidence-based assessment of performance through clearly defined scenarios shows confidently that the repository will meet its safety objectives even when considering internal or external perturbations of hypothetical nature. By addressing uncertainties in the thorough evaluation of the barrier components and the total repository system, the PA builds a strong case for the repository robustness and long-term safety.

Generative AI statement

The author(s) declared that generative AI was not used in the creation of this manuscript.

Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.

Publisher’s note

All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.

Footnotes

Edited by: Tara Beattie, Independent Researcher, United Kingdom

Reviewed by: Wolfram Rühaak, Chair of Geothermal Science and Technology

Bernd Grambow, UMR6457 Laboratoire de Physique Subatomique et des Technologies Associées (SUBATECH), France