How Switzerland Plans to Prove Its Nuclear Waste Repository Is Safe for a Million Years

Switzerland has moved a decisive step closer to burying its radioactive waste deep underground, and the scientific case resting beneath that decision is now on full display. In a paper published in Frontiers in Nuclear Engineering, Hoda Javanmard of the National Cooperative for the Disposal of Radioactive Waste, known as Nagra, describes the systematic methodology used to develop safety scenarios for the post-closure safety case supporting the Swiss general licence application for deep geological disposal. The work is not a single calculation but an entire architecture of reasoning, designed to show that a repository carved into Opalinus Clay in northern Switzerland will contain radionuclides safely for up to one million years, even when the future refuses to cooperate with expectations.

At the heart of the methodology is a deceptively simple question: how can anyone prove the safety of a facility whose most important performance period lies hundreds of thousands of years in the future? The answer, according to the framework described in the paper, is to build a scenario set that is simultaneously comprehensive, traceable and deliberately conservative. The approach combines two complementary strategies that international waste management programmes have refined over decades. The first is a top-down method that begins with the safety functions of the repository system and asks what perturbations or uncertainties could undermine them. The second is a bottom-up method that starts from exhaustive lists of features, events and processes, abbreviated as FEPs, which are screened and combined into scenarios. Nagra uses both, with its long-curated FEP database serving as an auditing tool to confirm that nothing safety-relevant has been overlooked.

The methodology does not operate in isolation. It draws on an extensive assessment basis covering the waste inventory, repository layout and engineering design, the properties of the host rock and its confining units, and the long-term geological and climatic evolution of the region. It also integrates the outcomes of performance assessment, a separate analytical stage that examines whether the repository’s barriers can withstand internal and external perturbations. Performance assessment scenarios and safety scenarios serve distinct purposes: the former investigate processes that might compromise barrier integrity, while the latter translate those impairments into consequences for radionuclide release, retention and transport. By systematically mapping every performance assessment outcome onto the safety scenario set, either explicitly or through parameter ranges, the developers ensure completeness and traceability across the entire chain of reasoning.

The resulting framework organises the future into four categories of safety scenarios. The reference safety scenario describes the expected evolution of the repository system, including barrier performance, radionuclide behaviour and biosphere assumptions, and is substantiated by performance assessment results confirming compliance with performance targets. Alternative safety scenarios represent credible deviations from that expected evolution, arising from uncertainties in the initial state or in how the system develops, which cannot be confidently excluded within the one-million-year assessment period. What-if cases are deliberately hypothetical, applying extreme assumptions that exceed evidence-based parameter ranges in order to test the robustness of the system and bound its behaviour. Finally, future human action scenarios are developed independently of likelihood considerations, using stylised representations of potential human activities that could disrupt the repository’s pillars of safety, such as drilling or excavation long after institutional memory has faded.

This categorisation is not merely administrative. Swiss regulatory requirements mandate that radiological consequences be bounded through careful selection of scenarios, and the four-category structure is designed to represent and bound all plausible ways the repository might evolve, addressing what specialists call scenario uncertainty. Each scenario is then supplemented by variants, which address conceptual uncertainties by altering one or more key factors that significantly influence radiological consequences, such as the extent, timing, location or properties of critical features and processes. Typically only the bounding variant, the one judged to produce the highest radiological consequences, is carried forward into consequence analysis. Where such judgement is not possible in advance, multiple variants may be propagated to ensure nothing is missed.

The reference safety scenario illustrates the machinery in action. Two variants are defined, differing in how the containment-providing rock zone, the CRZ, is conceptualised. The first follows the abstracted stratigraphic column for the Nördlich Lägern site, bounding the CRZ with the local Keuper aquifer below and the regional Malm aquifer above. The second assumes the Keuper aquifer beneath the high-level waste section is hydraulically inactive, consistent with observed high groundwater residence times at that location, which extends the CRZ downward to the lower regional Muschelkalk aquifer. Although the second variant is not the bounding one, it is propagated through the radiological consequence analysis anyway, specifically to illustrate the level of conservatism embedded in the reference conceptualisation.

Calculation cases then translate these scenarios into concrete numerical analyses. For the reference scenario, four deterministic cases address uncertainty in surface conditions over periods of up to one million years, assuming steady-state biospheres that span present-day climate, a warmer and drier climate, a colder climate, and anthropogenically altered drained farmland. These span the range of climatic and surface conditions considered plausible for northern Switzerland, where repeated glacial and interglacial cycles are expected. Additional cases tackle parametric uncertainty head-on. One case, RS-PROB, treats uncertain parameters probabilistically, sampling them at random from probability distributions derived from the assessment basis and enabling global sensitivity analysis to identify the parameters with the greatest influence on radiological consequences. Another, RS-CMB, sets all sensitive parameters simultaneously to their most unfavourable values, providing a highly conservative envelope on outcomes.

Alternative safety scenarios confront the residual uncertainties that remain, which relate primarily to geological characterisation. Field and laboratory data, including detailed tracer profiles, show only minor geochemical variations across the containment-providing rock zone and provide no evidence of laterally extensive hydraulic activity within its geological units. Nevertheless, the analysis conservatively hypothesises that fractures in clay-poor or carbonate-rich units could be denser and more interconnected than site characterisation indicates. Five units are considered, three in the upper confining sequence and two in the lower, each treated in a separate calculation case as if it were hydraulically active while all other units remain as in the reference conceptualisation. Hydraulic conductivity is set to upper-bound values, and radionuclides reaching the active unit are assumed to migrate either vertically by diffusion or laterally by advection, assumptions that are deliberately conservative to produce bounding estimates.

The what-if cases push the analysis to its logical extremes. Rather than modelling specific physical phenomena, some of these cases systematically strip away or degrade the pillars of safety one at a time, the well-understood barriers and properties that are insensitive to perturbations and serve as the main contributors to the safety functions. Examples include disregarding sorption of radionuclides in the geological barrier entirely, doubling the radius of the persistent excavation damage zone around emplacement rooms, increasing radionuclide-specific diffusion coefficients by an order of magnitude above upper-bound values, imposing hypothetically high hydraulic gradients in either direction, and even assuming the complete loss of the confining units’ contribution to retention, with radionuclides exiting the host rock transferred directly to the biosphere. Further cases postulate the instantaneous release of the entire radionuclide inventory in spent fuel at the moment of canister breach, or dissolution rates for spent fuel and high-level waste increased tenfold beyond assessment-basis upper bounds.

Underpinning the entire edifice is the question of phenomenological completeness, the assurance that all safety-relevant features, events and processes have been identified and treated appropriately. Absolute completeness can never be proven, but the methodology applies systematic measures to minimise what the paper calls completeness uncertainty. Confidence rests on the robustness of the assessment basis, developed iteratively over many years and peer reviewed; on the Nagra FEP database, benchmarked against international compilations and audited entry by entry to confirm that each item is either explicitly represented in safety scenarios and models or that its exclusion is clearly justified; and on the what-if cases themselves, which expand beyond the phenomena investigated in performance assessment to pre-empt concerns that relevant processes may have been overlooked. Taken together, these measures yield a defensible, regulatorily compliant and scientifically grounded scenario set that bounds the radiological consequences of a comprehensive range of plausible and hypothetical evolutions, providing the structured foundation on which Switzerland’s case for deep geological disposal now stands.

Subject of Research: Development of safety scenarios for the post-closure safety case of Switzerland's deep geological repository for radioactive waste

Article Title: The safety case for a deep geological repository in Switzerland: development of safety scenarios

Article References: Javanmard, H. (2026). The safety case for a deep geological repository in Switzerland: development of safety scenarios. Frontiers in Nuclear Engineering, 5, Article 1843718. https://doi.org/10.3389/fnuen.2026.1843718

Image Credits: AI Generated

DOI: 10.3389/fnuen.2026.1843718

Keywords: deep geological repository, radioactive waste, safety scenarios, Nagra, Opalinus Clay, performance assessment, FEP database, radiological consequences, nuclear waste disposal, Switzerland, post-closure safety, what-if cases