Post-Closure Safety Calculations for the Disposal of Spent Nuclear Fuel in a Generic Horizontal Drillhole Repository

: The post-closure performance of a generic horizontal drillhole repository for the disposal of spent nuclear fuel (SNF) is quantitatively evaluated using a physics-based numerical model that accounts for coupled thermal-hydrological flow and radionuclide transport processes. The model incorporates most subcomponents of the repository system, from individual waste canisters to the geological far field. The main performance metric is the maximum annual dose to an individual drinking potentially contaminated water taken from a well located above the center of the repository. Safety is evaluated for a wide range of conditions and alternative system evolutions, using deterministic simulations, sensitivity analyses, and a sampling-based uncertainty propagation analysis. These analyses show that the estimated maximum annual dose is low (on the order of 10 − 4 mSv yr − 1 , which is 1000 times smaller than a typical dose standard), and that the conclusions drawn from this dose estimate remain valid even if considerable changes are made to key assumptions and property values. The depth of the repository and the attributes of its configuration provide the main safety function of isolation from the accessible environment. Long-term confinement of radionuclides in the waste matrix and slow, diffusion-dominated transport leading to long migration times allow for radioactive decay to occur within the repository system. These preliminary calculations suggest that SNF can be safely disposed in an appropriately sited and carefully constructed and sealed horizontal drillhole repository. integrity of the engineered barrier components and the e ﬀ ective stress in the near ﬁeld. modiﬁers are generated using sequential Gaussian simulations [56]. The geostatistical parameters are identical throughout the geosphere. Layer-speciﬁc reference porosities are multiplied by the stochastic modiﬁers, generating local heterogeneity in porosity while at the same time preserving the layered structure of the geosphere. The porosity modiﬁers are log-normally distributed and follow a spherical semi-variogram, γ ( h ) = c · sph ( h / a ) , where h , where h (m) is the lag distance, a (m) is the correlation length, and c is the sill value. The correlation length is di ﬀ erent in a minor (subvertical) and principal (subhorizontal) direction, with an anisotropy ratio α = a v / a h ; 11 Di ﬀ usion coe ﬃ cient in bulk water at 25 ◦ C; adjusted for temperature according to the Stokes–Einstein equation. The e ﬀ ective di ﬀ usion coe ﬃ cient in a porous medium is related to porosity by a factor φ 4/3 [57]; 12 FWDR = fractional waste degradation rate; 13 IRF = instant release fraction. 1 potentially adjusted sensitivity or probabilistic uncertainty propagation analyses. parameter or multiple model input variables; 2 or mode of probability distribution used for uncertainty propagation analysis; 3 Probability distribution used for sampling-based uncertainty propagation analysis; (log)-normal, (log)-uniform, or (log)-triangular; n/a not parameter regional geological studies, surface-based geophysical surveys, exploratory boreholes, core analyses. processes be in complementing ﬁeld investigations and natural analogue


Introduction
The safety objective for a nuclear waste repository is to protect people and the environment from harmful effects of ionizing radiation [1]. This safety objective is best achieved by containing and isolating the radioactive waste from the biosphere by disposal in deep geological formations [1][2][3][4]. Proposed disposal concepts include the direct emplacement of waste canisters in mined caverns or large-diameter drifts, or in relatively short vertical or horizontal deposition holes emanating from mined access tunnels (for an overview of these concepts, see Reference [5]). As alternative concepts to mined repositories, waste disposal in deep vertical or horizontal boreholes has been investigated. The following study solely considers the deep horizontal drillhole concept as described in Reference [6].
This article describes the results from preliminary post-closure radiological safety calculations of a horizontal drillhole repository for spent nuclear fuel (SNF) from commercial reactors sited in an argillaceous host rock, e.g., shale. A system of multiple engineered and natural barriers is relied Consistent with this general description of a deep horizontal drillhole repository, a specific configuration is selected as a generic reference repository to be analyzed using numerical modeling. This generic repository (schematically shown in Figure 1a) consists of an array of ten 1 km (3300 feet) long, nominally horizontal drillholes bored into a shale formation at a depth of 1 km (3300 feet) using directional drilling technology. The disposal sections of the drillholes are parallel and spaced 100 m (330 feet) apart. One-hundred-fifty-three 5.5 m (18 feet) long waste canisters are placed end-to-end, separated by a 1 m (3 feet) gap, into the cased disposal section of each of the drillholes (see Figure   Figure 1. Schematic of a deep horizontal drillhole repository (not to scale); (a) vertical access hole, which gradually turns horizontally. The near-horizontal waste disposal section holds the canisters. A repository may consist of multiple drillholes; (b) during pre-closure operations, casings provide stability, protect aquifers, and guide canister emplacement; (c) individual spent nuclear fuel (SNF) assemblies are placed into canisters, which are pushed into the horizontal disposal section of the drillhole using a tractor, coiled tubing, or drill pipe.
Consistent with this general description of a deep horizontal drillhole repository, a specific configuration is selected as a generic reference repository to be analyzed using numerical modeling. This generic repository (schematically shown in Figure 1a) consists of an array of ten 1 km (3300 feet) long, nominally horizontal drillholes bored into a shale formation at a depth of 1 km (3300 feet) using Energies 2020, 13,2599 4 of 31 directional drilling technology. The disposal sections of the drillholes are parallel and spaced 100 m (330 feet) apart. One-hundred-fifty-three 5.5 m (18 feet) long waste canisters are placed end-to-end, separated by a 1 m (3 feet) gap, into the cased disposal section of each of the drillholes (see Figure 1c). Each of the canisters contains a single fuel assembly from a pressurized water reactor (PWR). Note that such a repository accommodates the waste generated by a 1 GWe reactor in 30 years.

Radionuclide Inventory and Mobilization
Carter et al. [26] provide an estimate of the waste inventory for a variety of commercial once-through fuel cycle alternatives. For this generic analysis, we select SNF characteristics from a commercial PWR with an initial enrichment of 4.73%, a burn-up of 60 gigawatt days per metric ton of initial heavy metals (GWd/MTIHM), and a cooling time of 30 years.
Nuclear waste is composed of more than 100 different radionuclides. If accidentally released at the land surface shortly after removal from the reactor, their total activity (which is related to the isotope's abundance and decay constant) and toxicity are a measure of their relative danger to exposed people. The ultimate purpose of waste disposal in a deep geologic repository is to make sure that the danger the waste poses to future generations is decoupled from the danger it presents if it were released today at the land surface. This goal is accomplished by removing the waste both in space and time from people and the environment. By doing so, many of the most dangerous radionuclides decay, either while still encapsulated in the solid waste matrix, or on their very long migration from the repository to the accessible environment. As a result, only a small fraction of the radionuclides present in the initial inventory contribute significantly to the total dose. Moreover, criteria other than activity and toxicity become dominant when compiling the list of radionuclides that are relevant for long-term safety, which is different from and much shorter than the list of radionuclides that are of concern at the time of disposal.
While a considerable number of radionuclides (and their daughter products) will be tracked in a comprehensive safety analysis, it is appropriate to include only a small subset of the radionuclides present in SNF in these generic calculations. Radionuclides to be tracked are selected based on their potential relevance for the long-term safety of a drillhole repository. The screening criteria are the radionuclide's initial inventory, its half-life, its adsorption coefficient and solubility limit, and its toxicity. Table 1 summarizes the initial inventory of 129 I, 36 Cl, 79 Se, and 99 Tc, which are the radionuclides selected for numerical evaluation. This list is consistent with the radionuclides emerging in other, comprehensive safety analyses, e.g., [3,7], as the main contributors to the annual individual effective dose. (Note that the decay heat released from the waste is calculated based on the entire inventory of all radionuclides present in the canister.) Table 1. Initial inventory, specific activity, and dose coefficient of selected radionuclides.

Isotope
Half-Life (Years) assembly [27], (Appendix E-1). 3 Activity A (Bq) is calculated as A = λN = m MW · ln(2) t 1/2 ·N A , where λ = ln(2)/t 1/2 (s −1 ) is the decay constant, N is the number of decaying particles, m (g) is the inventory mass, MW (g mol −1 ) is the molecular weight, t 1/2 (s) is the half-life, and N A = 6.022 × 10 23 (mol −1 ) is the Avogadro number; 1 Ci = 3.7 × 10 10 Bq; 4 Source: [28,  The entire radionuclide inventory is initially contained within the canister, most of it encapsulated in the solid uranium dioxide fuel pellets. Together, the waste form and canister are two of the main components of the engineered barrier system (EBS). The canister is expected to initially isolate the fuel matrix from the surrounding geologic environment. Once the canister is breached (either by corrosion, manufacturing defects, or mechanical stress), radionuclides are mobilized by degradation of the solid waste form, which is the result of complex radiolytic oxidation and transport processes that depend on the characteristics of the waste form itself as well as the geochemical environment. Waste form degradation is approximated by an annual fractional degradation rate. This is the rate at which the spent fuel degrades per year, releasing and thus mobilizing the radionuclides that have not yet decayed while still being encapsulated in the solid waste matrix. The conservative assumption is made that the waste degrades even when the canister is still intact.
Some radionuclides (e.g., 129 I) are concentrated on pellet and crack surfaces and in the gap between the fuel and cladding [7,29]. This localized enrichment is the result of enhanced release from the fuel matrix due to thermal stresses present during reactor operation. This component of the inventory is leached rapidly, a phenomenon that is captured by specifying an instant release fraction (IRF).
Radionuclides released from the degrading waste form dissolve in the brine that is in contact with the spent fuel assemblies. The concentrations of 129 I, 36 Cl, and 79 Se released from the waste matrix are close to or below their respective solubility limits in the aqueous phase. The mobilization and subsequent release of these radionuclides to the near field is only limited by the efficiency with which they are transported away from the canister. As the main transport process is molecular diffusion, the radionuclide source is conceptualized by a diffusion-limited source-term model.
By contrast, 99 Tc does not readily dissolve in water under reducing conditions, where the dominant aqueous complexes are TcO(OH) 2 (aq) or TcO 2 ·H 2 O [30]). 99 Tc released from the solid waste matrix reaches the solubility limit shortly after waste degradation begins. The amount of dissolved 99 Tc that migrates away from the waste is immediately replaced by further dissolution of precipitate; as a result, the 99 Tc concentration in and near the canister remains fixed at the solubility limit. This conceptualization is referred to as a solubility-limited source-term model. Once dissolved in the aqueous phase, radionuclides become mobile and can be transported by diffusion or advection.

Engineered Barrier System
The first EBS component the mobilized radionuclides encounter after being released from the breached waste canister is the space between the canisters and the casing, which may be filled with a buffer material, such as cement, grout mixtures, bentonite, slurry, oil-based materials (such as tar, bitumen, or asphalt), pellets, or other suitable materials. For these generic safety calculations, no specific buffer material has been selected; instead, generic properties have been assigned.
The buffer is contained by the casing, whose main purpose is to enable the smooth and controlled emplacement (and potential retrieval) of the canisters during the operational phase. The casing is not specifically designed to resist corrosion, and no long-term barrier functions are assigned to it. The hydrological, mechanical, or geochemical effects of corrosion (mainly the generation of hydrogen gas and the products of the corrosion of the canisters and casing) are not considered in this analysis. Preliminary simulations suggest that hydrogen generation due to corrosion and its impacts on fluid flow are very minor and short-lived; gas generation is therefore not considered in this generic study.
The flow and transport processes in the immediate vicinity of the waste are initially affected by the temperature increase due to the decay heat. Radionuclides migrate into and through the buffer material mainly by diffusion, which is increased due to the temperature dependence of the diffusion coefficient. Thermal expansion and contraction of the fluids (partly modulated by the expansion and contraction of the pore space) affect the local pressure distribution. Other processes perturbing the local pressure field include local or regional changes in hydrological and mechanical stress conditions and disruptive events. If sufficiently strong, these pressure gradients induce fluid flow and associated advective radionuclide transport, preferentially in the axial direction along annuli that may exist or Energies 2020, 13, 2599 6 of 31 develop between interfaces, within the buffer and other backfill materials, and potentially along the excavation disturbed zone (EDZ). The near-field model extends axially from the disposal section of the drillhole repository along the curved and vertical segments of the access hole to the land surface.

Natural Barrier System and Biosphere
The disposal section of the drillhole is embedded in the host rock, which is the main component of the natural barrier system (NBS). The key safety function of the NBS is to mechanically protect the repository from near-surface impacts and disturbances, and to inhibit radionuclide migration. In the absence of open faults and highly conductive fracture networks, the transport of radionuclides is slow due to the geosphere's low permeability and porosity, and is further retarded by adsorption of the solutes onto the solid phase.
Different types of geological formations have been considered as host rocks for nuclear waste repositories, including salt, granites, and tuffs, as well as sedimentary rocks such as shales, unconsolidated muds or mudstones, and claystones. The current generic study considers shale as the host formation. Shales are fine-grained, laminated sedimentary rocks with a fissile texture that are formed by compacting silt and clay-size mineral particles. Despite a relatively large total volume of the shale's pore space, the individual pores are very small; consequently, shale permeability is typically very low. The clay minerals present in shale have the ability to take up and adsorb considerable amounts of water and ions, including radionuclides.
Shale has been selected for this generic analysis because argillaceous formations are considered viable host rocks for a high-level waste repository [7, 8,31], and because the ability to complete extended horizontal drillholes in such formations has been amply demonstrated by the oil and gas industry. However, shale properties vary considerably [32], including their self-sealing capability [33][34][35]. For the purposes of hosting a repository, shales that are clay-rich and more plastic, less indurated, and less fissile are preferable [36]. However, to remain generic, safety-relevant shale properties are examined over a wide range. The natural barrier system also involves formations above and below the host rock, as these adjacent units may affect the conditions in the repository. Units overlying the host formation are also encountered by radionuclides as they migrate towards the land surface. For these numerical simulations, the formation between the host rock and the aquifer is conceptualized as a generic overburden with properties that do not unduly contribute to the overall safety of the system.
Similarly, the formation underlying the host rock is conservatively assumed to be relatively permeable, i.e., it responds to and transmits changes in the regional hydrogeologic conditions. For example, if representing a deep saline formation, it could be used for wastewater injection or geologic carbon sequestration, human activities that may affect repository performance even if occurring at a considerable distance.
A near-surface aquifer providing potable water defines the interface to the biosphere. Groundwater is pumped from the aquifer at a high enough rate so that essentially all contamination from the repository reaches the drinking water well and enters the local water supply.

Scenarios
A post-closure safety analysis includes multiple steps that lead to a quantitative evaluation of repository performance. Because the time frame of concern is far beyond that of social and technical experience or planning, safety cannot be demonstrated by direct observation (other than those offered by natural analogues [37,38]). Instead, long-term performance of the engineered and natural barrier components must be illustrated by developing defensible conceptual and numerical models for a number of expected as well as unlikely scenarios, and by accounting for the impact of simplifying assumptions, uncertainties, and variabilities. These numerical simulations are further supplemented by independent evidence, arguments, and analyses that combined justify the conclusion that a specific repository system will be safe. As a first step, a list of safety-relevant features, events, and processes (FEPs) is compiled based on the international FEP list, which is a comprehensive and structured generic catalog of factors relevant to the assessment of the long-term safety of geologic repositories [39,40]. Based on an initial FEPs disposition, multiple scenarios are developed, describing the nominal case as well as select disruptive events, which illustrate the impact of detrimental FEPs and related uncertainties on the level of safety provided by the disposal system. Scenarios for sensitivity analyses and bounding calculations are also described. Given that neither a finalized design nor site-specific data are available, the range of assessment cases is incomplete and, therefore, does not include all realistically conceivable possibilities affecting the post-closure evolution of the repository system.
The nominal scenario considers the pathways for radionuclide migration from the waste form to the recipient, assuming undisturbed conditions. These potential pathways include diffusive releases from the degrading waste form through breached canisters to the backfilled drillhole. After their mobilization, radionuclides are transported by advection and diffusion (a) in the axial direction (i.e., along the backfilled drillhole as well as the EDZ of the horizontal disposal section to the curved section and, eventually, the vertical access hole towards the aquifer), and (b) outwards into the host rock and through the overburden to the aquifer. Once in the aquifer, they are advectively transported towards a well, which feeds into a water supply system distributing the untreated drinking water to the recipient.
Disruptive events are low-probability events with potentially high impact. As such, they are outside the envelope of repository evolutions described by the nominal scenario. We focus here on a disruptive seismic event in which a large natural earthquake activates a new fault or reactivates an undetected, existing fault. (The site-specific occurrence probability of such an event is not evaluated.) While vibratory ground motions have no detrimental impact on the engineered barrier in the disposal drillhole, waste canisters may be sheared during the activation of faults or fractures that directly intersect the repository and exhibit a sufficiently large displacement. Moreover, faults and the associated fracture zones may be preferential flowpaths with a direct connection between a pressurized compartment of the deep subsurface and the repository, or between breached waste canisters and the aquifer.
Several sensitivity analyses are performed to better understand the influence of key factors and assumptions. We only discuss two aspects: (1) the impact of permeability, as it determines whether transport is diffusion-or advection-dominated, and (2) the magnitude of the vertical head gradient imposed by overpressurization of the deep saline formation. Finally, we present a bounding calculation in which the unrealistic assumption is made that radionuclides are mobilized completely and instantly, i.e., that the waste form, canister, and casing degrade immediately after the repository is sealed, and that there is no solubility limit and no adsorption. While such a scenario is unrealistic, it reveals the relative importance of the source-term model, the EBS, and the barrier function of the host rock for estimating repository performance.
These generic scenarios need to be adapted to site-specific conditions once characterization data and other relevant information about a potential repository site become available.

Performance Metrics
Ultimately, the safety of a long-term repository system is evaluated based on whether pre-defined protection objectives are met. We calculate a number of performance metrics as indicators of repository performance. The main performance measure is the effective dose received by an individual who drinks water exclusively from a well drilled into an aquifer above the repository. Because properties (such as half-life and adsorption coefficients) are radionuclide-specific, the radionuclide concentration in drinking water reaches its maximum at different times. To properly account for this variability, the peak dose is calculated based on the sum of the dose contributions of all relevant radionuclides. Peak dose is calculated as a single value for select, deterministic simulation cases, or is reported as the probabilistically evaluated peak-dose distribution. To avoid the issue of risk dilution in the probabilistic analysis [41], the overall performance measure is the maximum peak dose-independent Energies 2020, 13, 2599 8 of 31 of the time it occurs. No time cut-off is imposed on the analysis, i.e., the performance metrics are evaluated at least up to the time when maximum potential consequences have occurred.
While peak dose is considered the main performance measure, other metrics are calculated to gain insight into the behavior and robustness of the calculated system response. Table 2 is a list of performance measures evaluated as part of this generic study. Overpressures generated by thermal expansion. 1 Peak dose is the main performance measure used to assess the long-term safety of a nuclear waste repository by comparison to an individual dose-based standard; 10 mrem per year (0.1 mSv yr −1 ) is a typical individual dose not to be exceeded by the release of radionuclides from a sealed repository given processes and events reasonably expected as described by the nominal scenario; 2 Maximum radionuclide concentrations in groundwater (expressed as activity in units of pCi per liter) can be used to assess compliance with maximum contaminant levels in groundwater; 3 High temperatures may lead to vaporization and high thermal stresses, and may affect component properties in the near field; 4 Thermally induced overpressures may affect the integrity of the engineered barrier components and the effective stress in the near field.

Model Development
The general modeling approach is guided by the purpose of the model, which is to evaluate the system-level performance of the deep horizontal drillhole disposal system. The challenge of calculating the total system performance is typically addressed by performing detailed analyses of subsystems and/or select processes, abstracting the results by only considering key features and most influential parameters, and integrating the abstracted submodels into a system-level model for efficient deterministic and probabilistic calculations. However, the simplifications inherent in model abstraction require defensible justification, and the interfaces between abstracted submodels are not always fully transparent. Specifically, consistency of scenarios, assumptions, and parameters must be assured across the many interfaces.
A horizontal drillhole repository is relatively simple compared to other disposal concepts. This simplicity offers a unique opportunity to develop a transparent system-level model that does not compromise its fidelity in representing FEPs and their interactions. A single numerical model is created that includes all subsystems encountered along the radionuclide transport pathway from the heat-generating waste to the receptor. The goal of completeness using a single high-fidelity model, however, is not fully achieved. Specifically, the current model is limited to coupled thermal-hydrological processes, with geochemical and geomechanical effects only approximately accounted for through the use of effective parameters. Similarly, simplified representations of source-term processes (see Section 2.2) and the biosphere are considered appropriate for this generic assessment. The software used for the analysis is the iTOUGH2 simulation-optimization framework [42], which includes an extended version of the TOUGH2 nonisothermal flow and transport code [43]. The module EOS1nT [44] is used for the simulations. It calculates two-phase (liquid, gas) flow of water and an arbitrary number of Energies 2020, 13, 2599 9 of 31 tracers (i.e., radionuclides) through fractured porous media. Flow is described by a multiphase version of Darcy's law. All thermodynamic fluid properties are calculated from steam table equations [45]. The radionuclides may preferentially partition into the liquid or steam phase, they can adsorb to the solid phase (using a reversible, instantaneous, linear sorption model), they may be stable or decay (with daughter products being tracked), and they can diffuse, where the effective diffusion coefficient is a function of temperature, saturation, and porosity. Heat flux includes conductive and convective components; fluid and heat flow are fully coupled. The governing continuum equations are discretized using the integral finite difference method in space; time is discretized using first-order finite differences and a fully implicit scheme. The resulting coupled, nonlinear algebraic equations are solved simultaneously using Newton-Raphson iterations. Preconditioned conjugate gradient solvers are used to invert the set of linear residual equations arising at each iteration [42,46,47].
iTOUGH2 was used because it offers additional forward simulation capabilities and user features [48], and because it provides a framework for performing sampling-based uncertainty analyses. iTOUGH2's main features, inverse modeling and error analyses [42,49], will become important once potential repository sites are identified and need to be characterized.
The conceptual model is a description of the subsystems and processes that affect the evolution of the engineered and natural barrier systems from their initial, undisturbed states, and the transport of radionuclides through this system to the accessible environment. The model domain consists of a symmetry cell, which contains a single drillhole. The model extends vertically from the land surface to a depth of 2.0 km (1.25 miles), and is 5.75 km (3.6 miles) wide in the direction of the horizontal disposal section. Vertical symmetry planes go through the drillhole axis and the midpoint between parallel drillholes, which are 100 m (330 feet) apart. Within this three-dimensional geosphere model, the drillhole is represented by a local, cylindrical coordinate system, because both the geometry and key processes in and around the drillhole (up to a distance of 10 m (33 feet)) occur almost exclusively in a radial direction; potential advective flow and transport in the drillhole and surrounding excavation disturbed zone occur predominantly in the axial direction. The axial coordinate follows the trajectory of the drillhole, i.e., from the surface along the vertical access hole through the curved segment to the near-horizontal disposal section. Changes in the gravitational component along the entire length of the drillhole axis are thus accurately represented. In the radial direction, the cylindrical model offers an accurate representation of the radially symmetric geometry of the waste form, canister, backfill, casing, drillhole, and EDZ. The canister has an inner diameter of 28.0 cm (11 inches) and a thickness of 2.54 cm (1 inch); the casing has an inner diameter of 38.2 cm (15 inches) and a thickness of 1.27 cm (0.5 inches); the drillhole in the horizontal disposal section has a diameter of 48.2 cm (19 inches); the EDZ has a thickness of 24.1 cm (9.5 inches). Furthermore, the cylindrical model provides for a more accurate and efficient calculation of diffusion-dominated heat and radionuclide transport processes radially away from the central string of waste canisters. This axial-radial near-field model is embedded in the three-dimensional Cartesian far-field model. The unstructured computational mesh visualized in Figure 2 consists of 34,424 elements and 91,765 connections between them, with element sizes ranging from the thickness of the casing of 1.27 cm (0.5 inches) to 50 m (164 feet) in the geosphere within the repository footprint.
The waste is conceptualized as a heat-generating, degrading, radionuclide-releasing amorphous porous medium placed within 153 individually represented, initially impermeable canisters. Waste degradation processes are not explicitly simulated, but are abstracted by a fractional waste degradation rate. For the nominal scenario, a fractional waste form degradation rate of 10 −5 yr −1 is assumed based on [50]. For 129 I, an instant release fraction (IRF) of 20% is assumed based on Reference [7]. The radionuclides that are released instantly upon canister failure or slowly mobilized thereafter due to degradation of the solid waste matrix dissolve in pore water; for 99 Tc, a solubility limit of 10 −8 mol L −1 is applied based on Reference [7]. The radial discretization is shown on the rightmost cross section; interface radii conform to material contacts between waste, canister, backfill, casing, cement, excavation disturbed zone (EDZ), and host rock. (The radii of the drillhole wall and EDZ vary along the trajectory from the surface to the disposal section, leading to uneven spacings between the radial interfaces.) Outside the maximum radius shown here, the host rock is discretized using logarithmically increasing interface spacings up to a radius of 10 m (33 feet), at which point the radial-axial grid is connected to the three-dimensional Voronoi grid of the geosphere. The axial discretization is indicated by the spacing of the circular cross sections. Along the drillhole axis within the disposal section, grid blocks represent the canister's top cap, the waste, the bottom cap, and the backfilled space between canisters; this four-grid-block sequence is repeated 153 times. A detailed description of the grid can be found in [25], Appendix C.
The waste is conceptualized as a heat-generating, degrading, radionuclide-releasing amorphous porous medium placed within 153 individually represented, initially impermeable canisters. Waste degradation processes are not explicitly simulated, but are abstracted by a fractional waste degradation rate. For the nominal scenario, a fractional waste form degradation rate of 10 −5 yr −1 is assumed based on [50]. For 129 I, an instant release fraction (IRF) of 20% is assumed based on Reference [7]. The radionuclides that are released instantly upon canister failure or slowly mobilized thereafter due to degradation of the solid waste matrix dissolve in pore water; for 99 Tc, a solubility limit of 10 −8 mol L −1 is applied based on Reference [7].
The decay heat generated by radionuclides in a PWR SNF assembly is taken from Reference [51], Figure 7.2, which shows a total power output of 630 watts per canister at the time of disposal, i.e., 30 years after discharge. After 100 and 1000 years, heat generation declines to values of 240 and 25 watts The radial discretization is shown on the rightmost cross section; interface radii conform to material contacts between waste, canister, backfill, casing, cement, excavation disturbed zone (EDZ), and host rock. (The radii of the drillhole wall and EDZ vary along the trajectory from the surface to the disposal section, leading to uneven spacings between the radial interfaces.) Outside the maximum radius shown here, the host rock is discretized using logarithmically increasing interface spacings up to a radius of 10 m (33 feet), at which point the radial-axial grid is connected to the three-dimensional Voronoi grid of the geosphere. The axial discretization is indicated by the spacing of the circular cross sections. Along the drillhole axis within the disposal section, grid blocks represent the canister's top cap, the waste, the bottom cap, and the backfilled space between canisters; this four-grid-block sequence is repeated 153 times. A detailed description of the grid can be found in [25], Appendix C.
The decay heat generated by radionuclides in a PWR SNF assembly is taken from Reference [51], Figure 7.2, which shows a total power output of 630 watts per canister at the time of disposal, i.e., 30 years after discharge. After 100 and 1000 years, heat generation declines to values of 240 and 25 watts per canister, respectively. The power curve of Reference [51] is supplied as a time-dependent heat source to each of the 153 canisters.
The components of the EBS (i.e., the waste canister, buffer material, casing, and cement in the annulus, as wells as plugs, seals, and backfills between the waste canisters and along the access hole) are explicitly represented in the model. Their properties are described by effective porous-medium parameters. Construction of the repository is assumed to have created an EDZ around the drillhole. Corrosion processes are not simulated explicitly; however, the corrosion and eventual perforation of the canisters and casing are represented by a time-dependent increase in permeability. In the reference case, canisters are assumed to have lost their barrier function after 10,000 years, which is considerably shorter than the time frame calculated by [52] for general corrosion of Ni-Cr-Mo alloy canisters under repository conditions of high temperature and high salinity. The steel casing is assumed to be completely corroded after 100 years. Early-canister-failure and instant-waste-mobilization scenarios are examined separately.
The geosphere is conceptualized as consisting of four horizontally layered hydrostratigraphic units, representing (1) the near-surface freshwater aquifer, (2) the overburden (the set of formations below the aquifer and above the formation hosting the repository), (3) the host rock, and (4) an underlying, relatively permeable saline formation. The hydrostratigraphic layers are not site-specific, but generic, i.e., they represent a variety of rock types. Typically, the near-surface aquifer consists of quaternary or tertiary sedimentary rocks; the overburden can be a carbonate (e.g., limestone, dolomite), marl, sandstone, siltstone, shale, mudstone, or clay; the host rock is considered to be a shale; the saline formation can be a carbonate, sandstone, metamorphic rock (e.g., schist, gneiss), composite rock, or igneous basement rock. All these generic formations are modeled using effective properties that vary over a relatively wide range. While each layer has reference properties typical for the corresponding formation, they have heterogeneous porosities, which exhibit a spatially correlated and anisotropic, layered structure. In the seismic disruptive event scenario, a steeply dipping fault and associated fracture zone are present, cutting through the geosphere and the horizontal disposal section of the repository.
Fluid flow is simulated throughout the model domain using consistent process descriptions, accounting for viscous flow based on Darcy's law driven by pressure gradients and gravity. Fluid properties (specifically density and viscosity) are functions of pressure, temperature and salinity, potentially giving rise to buoyancy effects. Conductive and convective heat transfer is considered. Radionuclide transport from the waste canisters to the drinking water well occurs by advection and diffusion. Radioactive decay is accounted for. Reactive geochemical processes are not explicitly simulated; however, the effects of pore water geochemistry are partly reflected by assumptions on waste and metal degradation rates and adsorption coefficients. Similarly, geomechanical processes are not explicitly modeled, with the exception of pore compressibility, which reflects the coupling between poroelasticity and fluid pressures. The mathematical models describing these fluid and heat flows, as well as radionuclide transport processes, are discussed in detail in References [25,43].
Processes in the biosphere are summarized in a simple dose coefficient (see Table 1), which is a measure of the radiological impact due to the ingestion of water containing radionuclides. The exposed individual is assumed to obtain drinking water exclusively from a well that is centered above the disposal section of the repository. This model is consistent with the Example Reference Biosphere 1A dose model, referred to as ERB1A [28].
The simulated post-closure system behavior depends on the imposed boundary conditions, sink and source terms, and the initial conditions within the model domain. Slightly over-or underbalanced drilling, waste emplacement, and sealing of the repository are assumed to lead to only small perturbations in pressure and temperature, which are equilibrated within a time frame that is very short compared to the thermal-pulse and repository performance periods.
The initial state of the post-closure simulation model is itself obtained by a steady-state simulation; it calculates the flow field in equilibrium with the regional geothermal and hydrological boundary conditions. The initial temperature distribution is calculated by assuming an average surface temperature of 13 • C and a geothermal gradient of 30 • C km −1 . At depth, a salinity of 50,000 ppm (corresponding to a NaCl concentration of 0.86 mol L −1 ) is specified, which classifies the deep groundwater as a brine. The initial pressure profile is approximately hydrostatic, assuming the groundwater table is at the land surface and accounting for density effects due to changing temperatures and salinity, both of which increase with depth. Moreover, by overpressuring portions of the saline formation by 2 bars, a sideways and upward regional pressure gradient is induced. No-flow symmetry boundaries are specified in the vertical planes that go through the repository axis and parallel to it at a distance of 50 m (164 feet), assuming that multiple drillholes are constructed with a separation distance of 100 m (330 feet; see Figure 1a). No-flow boundaries are also specified at a sufficiently far distance to the left and right of the repository. Groundwater is continuously pumped at a constant rate of 2.0 kg s −1 from a well that is centered above the disposal section of the repository and perforated immediately above the interface between the overburden and the aquifer. This rate is large enough to ensure that the well collects all the contamination stemming from the nuclear waste repository. These initial and boundary conditions are chosen to generate a configuration that is not unduly optimistic regarding the potential for upward fluid flow and related upward transport of radionuclides.
Parameters need to be specified to arrive at a physically meaningful, realistic but generic model of the disposal system. Table 3 contains key hydrological, thermal, and transport properties specified for each of the natural and man-made materials. Other parameterized aspects include the initial inventory, waste degradation rates, and geostatistical parameters. (A more complete list can be found in Reference [25]).
A single value for each of these model input parameters is specified to define the nominal scenario. The selected values are considered cautious, i.e., they do not overestimate repository performance but at the same time are not overly conservative so as to render the analysis irrelevant. In some instances, conservative assumptions are made because they simplify the model without significantly impacting simulation results. This cautious approach is pursued to make the analysis relatable to a wide range of sites that may be considered for hosting a deep horizontal drillhole repository, and to keep the conclusions regarding safety justifiable. For example, the permeability of the host rock is not assumed to be extremely low; it is chosen significantly higher than that of argillaceous formations that have been specifically targeted as host rocks because of their low permeability (see, e.g., References [7, 8,31,33]). Instead of choosing and referencing a site-specific value, we selected parameters that serve the purpose of a generic analysis, with the added condition that they are consistent with property values reported in review articles for the corresponding material (see, e.g., Reference [13] for permeabilities and porosities of shales and clays, Reference [53] for reservoir properties, and Reference [54] for thermal properties).
In Table 3, a parameter's value is fixed if it is well known, or it has a small influence on the performance measures of interest (see Table 2). The question whether a parameter is influential or not also depends on the level of prediction uncertainty that is considered acceptable [55]. In particular, stakeholders and regulators must have sufficient confidence that the model-predicted radiation dose is accurate enough to make a defensible assessment of the repository's long-term safety. Prediction uncertainty is estimated using a sampling-based probabilistic analysis (see Section 6.3). Figure 3 shows the hydrostratigraphic layering and heterogeneous porosity distribution of the model used to examine the nominal scenario. k waste 10 −20 fixed n/a n/a n/a k canister, casing 6 10 −24 fixed n/a n/a n/a k backfill 7 10 −16 log-tri 10 −18 10 −14 n/a k a EDZ factor 8 10 2 log-norm 1. k fault 10 −13 fixed n/a n/a n/a c φ all materials 10 −9 log-norm 10 −10 λ canister, casing 40.0 fixed n/a n/a n/a k d EBS 0.0 fixed n/a n/a n/a k d geosphere 129 I 10 −5 log-normal 10 −7 10 −3 1.0 36 Cl 0.0 fixed n/a n/a n/a 79 Se 0.0 fixed n/a n/a n/a 99 Tc 10 −2 log-normal 10 −3 1.0 0.5 Initial Radionuclide Inventory, m κ waste (kg per canister) (see Table 1)

Boundary Conditions
P top (bar) 1.0 fixed n/a n/a n/a 13.0 fixed n/a n/a n/a T bot ( • C) 73.0 fixed n/a n/a n/a  13 20 fixed n/a n/a n/a 1 Key parameters of reference scenario, potentially adjusted during sensitivity or probabilistic uncertainty propagation analyses. Each parameter refers to one or multiple model input variables; 2 Reference value, mean or mode of probability distribution used for uncertainty propagation analysis; 3 Probability distribution used for sampling-based uncertainty propagation analysis; (log)-normal, (log)-uniform, or (log)-triangular; n/a = not applicable as parameter is fixed; 4 Probability distributions are truncated at the minimum and maximum values; 5 Standard deviation of (log)-normally distributed parameters; if log-normally distributed, the standard deviation refers to the logarithm; 6 The permeabilities of the casing and canister increase to 10 −16 m 2 after 100 and 100,000 years, respectively; 7 Here, the term backfill refers to the buffer in the disposal section and any material filling the vertical and curved portions of the access hole after removal of the casing. Backfills may consist of cementitious materials, grout mixtures, bentonite, oil-based materials (such as tar, bitumen or asphalt), crushed rocks, sand, or other suitable materials; 8 The axial and radial permeabilities of the EDZ are assumed to be, respectively, two and one orders of magnitude greater than the horizontal permeability of the formation in which the drillhole is located; EDZ thickness is assumed 1 2 of the drillhole radius; 9 The anisotropy factor of horizontal over vertical permeability of all geosphere materials is 10; 10 Random, spatially correlated, anisotropic fields of porosity modifiers are generated using sequential Gaussian simulations [56]. The geostatistical parameters are identical throughout the geosphere. Layer-specific reference porosities are multiplied by the stochastic modifiers, generating local heterogeneity in porosity while at the same time preserving the layered structure of the geosphere. The porosity modifiers are log-normally distributed and follow a spherical semi-variogram, γ(h) = c·sph(h/a), where h, where h (m) is the lag distance, a (m) is the correlation length, and c is the sill value. The correlation length is different in a minor (subvertical) and principal (subhorizontal) direction, with an anisotropy ratio α = a v /a h ; 11 Diffusion coefficient in bulk water at 25 • C; adjusted for temperature according to the Stokes-Einstein equation. The effective diffusion coefficient in a porous medium is related to porosity by a factor φ 4/3 [57]; 12 FWDR = fractional waste degradation rate; 13 IRF = instant release fraction.

Ttop (°C)
13.0 fixed n/a n/a n/a Tbot (°C) 73.0 fixed n/a n/a n/a Sink/Source Terms qwell (kg s −1 ) 2.0 uniform 0.2 4.0 n/a FWDR (yr −1 ) 12 10−5 log-triang 10 −6 10 −4 n/a IRF (%) 13 20 fixed n/a n/a n/a 1 Key parameters of reference scenario, potentially adjusted during sensitivity or probabilistic uncertainty propagation analyses. Each parameter refers to one or multiple model input variables; 2 Reference value, mean or mode of probability distribution used for uncertainty propagation analysis; 3 Probability distribution used for sampling-based uncertainty propagation analysis; (log)-normal, (log)-uniform, or (log)-triangular; n/a = not applicable as parameter is fixed; 4 Probability distributions are truncated at the minimum and maximum values; 5 Standard deviation of (log)-normally distributed parameters; if log-normally distributed, the standard deviation refers to the logarithm; 6 The permeabilities of the casing and canister increase to 10 −16 m 2 after 100 and 100,000 years, respectively; 7 Here, the term backfill refers to the buffer in the disposal section and any material filling the vertical and curved portions of the access hole after removal of the casing. Backfills may consist of cementitious materials, grout mixtures, bentonite, oil-based materials (such as tar, bitumen or asphalt), crushed rocks, sand, or other suitable materials; 8 The axial and radial permeabilities of the EDZ are assumed to be, respectively, two and one orders of magnitude greater than the horizontal permeability of the formation in which the drillhole is located; EDZ thickness is assumed ½ of the drillhole radius; 9 The anisotropy factor of horizontal over vertical permeability of all geosphere materials is 10; 10 Random, spatially correlated, anisotropic fields of porosity modifiers are generated using sequential Gaussian simulations [56].

Reference Cases
The nominal scenario provides a cautious assessment of repository performance under undisturbed conditions (i.e., the system is not affected by low-probability disruptive events). Figure 4a shows the first performance metrics of Table 2, i.e., the annual dose as a function of time from the exposure to 129 I, tracked in this simulation is 8.0 × 10 −5 mSv yr −1 (8.0 × 10 −3 mrem yr −1 ); it occurs after 1.6 million years and is essentially identical to that from 129 I. The dominance of 129 I is explained by its long half-life, which leads to minimal decay despite the very long travel time from the repository to the accessible environment. The peak doses of 79 Se and 36 Cl are 1.3 × 10 −6 and 4.5 × 10 −8 mSv yr −1 , respectively. The peak dose of 79 Se is higher than that of 36 Cl because of its larger inventory and its higher dose coefficient (see Table 1). Both radionuclides reach their peak dose after approximately 775,000 years. Peak doses, as well as peak-dose times, are curtailed by the decay of these two radionuclides as they migrate through the geosphere. 99 Tc does not arrive at the aquifer in any significant concentration despite its large inventory. This is mainly due to its limited solubility, shorter half-life, and retardation by adsorption. The peak dose for the nominal scenario is more than three orders of magnitude below a typical dose standard of 0.1 mSv yr −1 (10 mrem yr −1 ).

Reference Cases
The nominal scenario provides a cautious assessment of repository performance under undisturbed conditions (i.e., the system is not affected by low-probability disruptive events). Figure  4a shows the first performance metrics of Table 2, i.e., the annual dose as a function of time from the exposure to 129 I, 36 Cl, 79 Se ( 99 Tc is not shown because its dose is insignificant). The total dose from the four radionuclides tracked in this simulation is 8.0 × 10 −5 mSv yr −1 (8.0 × 10 −3 mrem yr −1 ); it occurs after 1.6 million years and is essentially identical to that from 129 I. The dominance of 129 I is explained by its long half-life, which leads to minimal decay despite the very long travel time from the repository to the accessible environment. The peak doses of 79 Se and 36 Cl are 1.3 × 10 −6 and 4.5 × 10 −8 mSv yr -1 , respectively. The peak dose of 79 Se is higher than that of 36 Cl because of its larger inventory and its higher dose coefficient (see Table 1). Both radionuclides reach their peak dose after approximately 775,000 years. Peak doses, as well as peak-dose times, are curtailed by the decay of these two radionuclides as they migrate through the geosphere. 99 Tc does not arrive at the aquifer in any significant concentration despite its large inventory. This is mainly due to its limited solubility, shorter half-life, and retardation by adsorption. The peak dose for the nominal scenario is more than three orders of magnitude below a typical dose standard of 0.1 mSv yr −1 (10 mrem yr −1 ).   Figure 4b shows the second relevant performance measure, which is the maximum radionuclide concentration in groundwater (expressed as activity). Two sets of curves are shown: the activities of each of the radionuclides within the waste canister, and the maximum concentrations in the aquifer. The concentration in the waste itself depends on the inventory, the specific activity, and the fractional waste degradation rate. Concentrations respond to the release of radionuclides from the Energies 2020, 13, 2599 16 of 31 degrading waste matrix and their dissolution in the aqueous phase within the canister (note that in some implementations the interior of the canister might be dry prior to canister failure). As long as the canister is intact, concentrations increase (slightly moderated by radioactive decay), assuming that waste degrades even if the canister is not breached. Note that the activity of dissolved 99 Tc is low because of the imposed solubility limit, which is conservatively assumed to be 10 −8 mol L −1 [7].
Once corrosion perforates the canister (which is assumed to occur after 10,000 years), the radionuclides are released to the near field, leading to a sharp drop in concentrations within the canister. Mobilization of radionuclides declines with time because the inventory is reduced by radioactive decay and the leaching process itself. Moreover, the release is diffusion-limited with a declining concentration gradient.
Radionuclide concentrations in the aquifer are substantially lower compared to their activities in the drillhole repository. This is a result of the diffusion process, which spreads the radionuclides over a large volume within the geosphere, drastically reducing concentrations. Moreover, transport times are sufficiently long compared to the half-lives of most radionuclides (with the exception of 129 I) that decay further reduces the concentrations. Figure 4c shows radionuclide flow rates across three interfaces: (1) from the drillhole into the geosphere, (2) through the circular cross section of the drillhole and the surrounding EDZ at a depth of −725 m (2380 feet), i.e., where radionuclides traveling in the axial direction along the drillhole enter the vertical access hole, and (3) into the aquifer from the underlying formation and from the access hole. The flow rates are expressed in units of pCi s −1 to account for the different activities of the radionuclides.
After the canisters have been breached, radionuclides are released (mainly by diffusion) from the drillhole to the excavation-disturbed zone of the surrounding host rock (dashed lines in Figure 4c), from where they migrate through the geosphere. These flow rates into the geosphere are close to the diffusion-limited release rates from the breached canisters. Radionuclides migrate through the host rock and the overburden, and eventually enter the aquifer. The maximum activity flow rate from 129 I is approximately 0.03 pCi s −1 . The groundwater in the aquifer dilutes contaminants as radionuclides migrate towards the extraction well. The maximum rate of 79 Se (0.02 pCi s −1 ) is similar to that of 129 I. The higher specific activity of 79 Se compensates for its smaller inventory and shorter half-life.
Much less 36 Cl is initially present in the repository, and the mass concentration flux into the aquifer is very small; however, 36 Cl has a high specific activity, so its contribution to the total aquifer activity reaches 5% at its peak value after 770,000 years. 99 Tc does not reach the aquifer, mainly because it is effectively adsorbed in the geosphere. Figure 4d shows the temperature and pressure at the canister surface and drillhole wall as a function of time in response to the decay heat generated by the waste. The early-time heat output after the pre-disposal cooling time of 30 years is mainly due to the decay of 137 Cs and 90 Sr. The relatively short half-lives of these key fission products (approximately 30 years) lead to rapidly declining heat output, which-combined with cylindrical heat dissipation-prevents temperatures from rising to very high values. Ten years after disposal, temperatures reach a maximum of approximately 99 • C. This temperature is far below the boiling temperature under the high in situ pressures. After 1000 years, the temperature is still approximately 10 • C above the ambient temperature of 40 • C.
The temperature rise induces fluid expansion, leading to a pore pressure increase. The temperature-induced pressure changes in the drillhole and EDZ are in the order of a few bars, values that are not expected to adversely affect the engineered components or lead to additional fracturing or significant fracture dilation in the EDZ. The perturbation reaches its maximum a few years after repository closure, coincident with the temperature maximum. Reduced heat output from the waste and thermal dissipation lead to cooling and contraction of the fluid. As a result, pressures temporarily drop below the initial pressure and eventually re-equilibrate by back-flowing water. These pressure perturbations are constrained to the thermal period. They induce flows along the backfilled drillhole and into the host rock. These flow rates are, however, small and are reversed during the cool-down period. Moreover, in the nominal scenario, the canister is assumed to be intact during the thermal period, i.e., no thermally induced advective radionuclide transport will occur.
The performance measures shown in Figure 4 are derived from the time-dependent system state calculated at each point in the model domain. To better understand the evolution of the repository system (specifically the migration of radionuclides from the repository to the accessible environment), state variables at selected times are visualized.
The temperature and fluid-density distributions shown in Figure 5 indicate that the repository-induced thermal perturbation is spatially limited relative to the domain size and with respect to the natural geothermal gradient. Nevertheless, the temperature increase influences fluid flow and radionuclide transport in various direct and indirect ways, including (a) reduced fluid density, which leads to a pressure increase with associated elastic porosity changes [58,59] and potential advective fluid flow, (b) porosity increase due to thermal expansion of the rock matrix, (c) increased diffusivity according to the Stokes-Einstein equation (direct effect) and due to increased porosity (indirect effect), and (d) reduced fluid viscosity. Temperature changes also affect corrosion rates, waste form degradation, radionuclide solubilities, geochemical reaction rates, and coupled thermal-hydrological-mechanical effects; however, these effects are not accounted for in the current model. and thermal dissipation lead to cooling and contraction of the fluid. As a result, pressures temporarily drop below the initial pressure and eventually re-equilibrate by back-flowing water. These pressure perturbations are constrained to the thermal period. They induce flows along the backfilled drillhole and into the host rock. These flow rates are, however, small and are reversed during the cool-down period. Moreover, in the nominal scenario, the canister is assumed to be intact during the thermal period, i.e., no thermally induced advective radionuclide transport will occur. The performance measures shown in Figure 4 are derived from the time-dependent system state calculated at each point in the model domain. To better understand the evolution of the repository system (specifically the migration of radionuclides from the repository to the accessible environment), state variables at selected times are visualized.
The temperature and fluid-density distributions shown in Figure 5 indicate that the repositoryinduced thermal perturbation is spatially limited relative to the domain size and with respect to the natural geothermal gradient. Nevertheless, the temperature increase influences fluid flow and radionuclide transport in various direct and indirect ways, including (a) reduced fluid density, which leads to a pressure increase with associated elastic porosity changes [58,59] and potential advective fluid flow, (b) porosity increase due to thermal expansion of the rock matrix, (c) increased diffusivity according to the Stokes-Einstein equation (direct effect) and due to increased porosity (indirect effect), and (d) reduced fluid viscosity. Temperature changes also affect corrosion rates, waste form degradation, radionuclide solubilities, geochemical reaction rates, and coupled thermalhydrological-mechanical effects; however, these effects are not accounted for in the current model.  Figure 6 shows the radionuclide plumes of 129 I at six select times (radionuclide concentration is converted to radioactivity in pore water and represented using an exponential scale). In general, the plumes indicate a diffusion-dominated transport process within the low-permeable host rock. At later times, the pressure perturbation imposed by the constantly pumping drinking water well combined with the slight overpressure in the deepest strata induces an advective flow and transport component, and thus an advective activity pattern in the overlying formations.
Even for the weakly-sorbing, long-lived 129 I, the bulk of the radionuclide mass remains in the shale host rock up to and beyond the time when peak dose is reached (at about 1.5 million years). After very long times (10 million years), the activity has slowly dispersed by diffusion and slow advective transport, driven by the regional pressure gradient in the underlying saline formation. Recall that peak dose is dominated by the activity of 129 I in the near-surface aquifer. Figure 7 shows the radionuclide plumes of 36 Cl, 79 Se, and 99 Tc after 100,000 and 1,500,000 years. The concentrations of 36 Cl and 79 Se show an evolution that is qualitatively similar to that of 129 I, because the model assumes that they are not retarded by adsorption. The activity of 79 Se is generally higher than that of 36 Cl because of its larger inventory. Both radionuclides have approximately the  Figure 6 shows the radionuclide plumes of 129 I at six select times (radionuclide concentration is converted to radioactivity in pore water and represented using an exponential scale). In general, the plumes indicate a diffusion-dominated transport process within the low-permeable host rock. At later times, the pressure perturbation imposed by the constantly pumping drinking water well combined with the slight overpressure in the deepest strata induces an advective flow and transport component, and thus an advective activity pattern in the overlying formations.
Even for the weakly-sorbing, long-lived 129 I, the bulk of the radionuclide mass remains in the shale host rock up to and beyond the time when peak dose is reached (at about 1.5 million years). After very long times (10 million years), the activity has slowly dispersed by diffusion and slow advective transport, driven by the regional pressure gradient in the underlying saline formation. Recall that peak dose is dominated by the activity of 129 I in the near-surface aquifer. Figure 7 shows the radionuclide plumes of 36 Cl, 79 Se, and 99 Tc after 100,000 and 1,500,000 years. The concentrations of 36 Cl and 79 Se show an evolution that is qualitatively similar to that of 129 I, because the model assumes that they are not retarded by adsorption. The activity of 79 Se is generally higher than that of 36 Cl because of its larger inventory. Both radionuclides have approximately the same half-live (of 300,000 years), i.e., most of their initial mass has decayed by the time peak dose is reached. Despite its large inventory, the release of 99 Tc from the canister is limited by its poor solubility in pore water, and its transport is considerably retarded due to adsorption. As a result, most of the 99 Tc is retained in the waste form and near field of the repository, where it is essentially immobilized while it decays.
Energies 2020, 13, x FOR PEER REVIEW 18 of 31 same half-live (of 300,000 years), i.e., most of their initial mass has decayed by the time peak dose is reached. Despite its large inventory, the release of 99 Tc from the canister is limited by its poor solubility in pore water, and its transport is considerably retarded due to adsorption. As a result, most of the 99 Tc is retained in the waste form and near field of the repository, where it is essentially immobilized while it decays.

I
[pCi/L] 50,000 years 100,000 years 500,000 years 1,000,000 years 1,500,000 years 10,000,000 years Figure 6. Simulated 129 I activity distribution throughout the repository system. Figure 6. Simulated 129 I activity distribution throughout the repository system.

Sensitivity Analyses
The following subsections discuss the impact of select parameters and conceptualizations, specifically the relative importance of advection and diffusion, and the influence of a regional, vertical head gradient. We also present the bounding case of instant waste mobilization.

Advection and Diffusion
Once released from their containment within the EBS, radionuclides are transported from the repository to the biosphere by diffusion and advection. A key safety function of the geosphere is to ensure diffusive spreading of the radionuclides and slow advective transport. While the molecular diffusion coefficient for various radionuclides can be determined relatively accurately, the formation-

Sensitivity Analyses
The following subsections discuss the impact of select parameters and conceptualizations, specifically the relative importance of advection and diffusion, and the influence of a regional, vertical head gradient. We also present the bounding case of instant waste mobilization.

Advection and Diffusion
Once released from their containment within the EBS, radionuclides are transported from the repository to the biosphere by diffusion and advection. A key safety function of the geosphere is to ensure diffusive spreading of the radionuclides and slow advective transport. While the Energies 2020, 13, 2599 20 of 31 molecular diffusion coefficient for various radionuclides can be determined relatively accurately, the formation-specific porous-medium component is more difficult to estimate. Permeability varies considerably, even for a given rock type, including shale [32]. This sensitivity analysis examines one-order-of-magnitude changes in the effective diffusion coefficient and in the reference permeability of all hydrogeological layers. Figure 8 shows the 129 I activity distributions after one million years for the reference case (middle row) and for diffusion coefficients and permeabilities reduced or increased by a factor of 10 (top and bottom rows, respectively). A low-diffusion environment leads to a smaller, more compact (i.e., higher average activity) radionuclide plume, whereas high diffusion leads to a larger plume with on average lower activity. Reducing permeabilities in the geosphere by an order of magnitude keeps the center of the 129 I plume near the disposal section of the drillhole repository. Increasing the geosphere permeabilities by a factor of 10 shows an upward migration of the plume center, driven by the overpressure from the deep saline formation, and the underpressure in the near-surface aquifer due to the continuous pumping.
The relatively small differences between the high-permeability case and the reference case indicate that the system is diffusion dominated. Diffusion dominance appears true specifically for the (low permeability) host formation, but is less pronounced for the overburden; transport in the aquifer is advection dominated. Advective flow patterns become apparent if the permeability is increased by an order of magnitude.
Energies 2020, 13, x FOR PEER REVIEW 20 of 31 specific porous-medium component is more difficult to estimate. Permeability varies considerably, even for a given rock type, including shale [32]. This sensitivity analysis examines one-order-ofmagnitude changes in the effective diffusion coefficient and in the reference permeability of all hydrogeological layers. Figure 8 shows the 129 I activity distributions after one million years for the reference case (middle row) and for diffusion coefficients and permeabilities reduced or increased by a factor of 10 (top and bottom rows, respectively). A low-diffusion environment leads to a smaller, more compact (i.e., higher average activity) radionuclide plume, whereas high diffusion leads to a larger plume with on average lower activity. Reducing permeabilities in the geosphere by an order of magnitude keeps the center of the 129 I plume near the disposal section of the drillhole repository. Increasing the geosphere permeabilities by a factor of 10 shows an upward migration of the plume center, driven by the overpressure from the deep saline formation, and the underpressure in the near-surface aquifer due to the continuous pumping.
The relatively small differences between the high-permeability case and the reference case indicate that the system is diffusion dominated. Diffusion dominance appears true specifically for the (low permeability) host formation, but is less pronounced for the overburden; transport in the aquifer is advection dominated. Advective flow patterns become apparent if the permeability is increased by an order of magnitude.

Vertical Head Gradient
The pressure in the underlying saline formation determines the regional flow field, which could induce advective radionuclide transport in either downward or upward directions. A downward vertical component can be expected if the repository site is located in a large-scale recharge zone, i.e., where topographic highs on the regional, basin, or continental scale lead to the recharge of deep aquifer systems [60]. This situation is likely beneficial for repository performance (unless the underpressure in the saline formation is caused by fluid extraction). Conversely, an overpressured formation leads to upward fluid flow and radionuclide transport. A deep formation could be overpressured naturally, e.g., by hydrothermal, seismic or igneous activities, by erosion and deposition of sediments, by glacial loading, or if located in a large-scale discharge zone. Human activities (e.g., waste-water injection, geologic carbon sequestration, or the operation of an enhanced geothermal system) may also pressurize deep formations, potentially on a large scale [61]. Figure 9 illustrates the advective displacement of the 129 I activity plume depending on the pressure in the saline formation underlying the repository. If the saline formation is underpressured by −5 bars, the center of the plume is pulled towards the lower right corner, whereas its upper fringe is still being drawn into the drinking water well (Figure 9a). The rate of downward advective transport is smaller than the diffusive transport (which occurs in all directions). For this beneficial case, peak dose is reduced from the reference value of 8 × 10 −5 to 1.2 × 10 −5 mSv yr −1 . If the saline formation is overpressured by +20 bars, the center of the activity plume is vertically displaced from the host formation into the overburden (Figure 9b), and the peak dose relative that of the reference case (which exhibits an overpressure of +2 bars) increases from 8 × 10 −5 to 5 × 10 −4 mSv yr −1 . In either of these situations, advective plume migration is slow, with an approximate velocity of less than 500 m (1500 feet) in a million years.
The sensitivity of advective radionuclide transport to changes in the magnitude and direction of the regional pressure gradient can be mitigated by siting the repository in a large-scale recharge zone, by avoiding locations with overpressures in underlying formations, or by selecting a host formation of sufficiently low permeability.

Vertical Head Gradient
The pressure in the underlying saline formation determines the regional flow field, which could induce advective radionuclide transport in either downward or upward directions. A downward vertical component can be expected if the repository site is located in a large-scale recharge zone, i.e., where topographic highs on the regional, basin, or continental scale lead to the recharge of deep aquifer systems [60]. This situation is likely beneficial for repository performance (unless the underpressure in the saline formation is caused by fluid extraction). Conversely, an overpressured formation leads to upward fluid flow and radionuclide transport. A deep formation could be overpressured naturally, e.g., by hydrothermal, seismic or igneous activities, by erosion and deposition of sediments, by glacial loading, or if located in a large-scale discharge zone. Human activities (e.g., waste-water injection, geologic carbon sequestration, or the operation of an enhanced geothermal system) may also pressurize deep formations, potentially on a large scale [61]. Figure 9 illustrates the advective displacement of the 129 I activity plume depending on the pressure in the saline formation underlying the repository. If the saline formation is underpressured by −5 bars, the center of the plume is pulled towards the lower right corner, whereas its upper fringe is still being drawn into the drinking water well (Figure 9a). The rate of downward advective transport is smaller than the diffusive transport (which occurs in all directions). For this beneficial case, peak dose is reduced from the reference value of 8 × 10 −5 to 1.2 × 10 −5 mSv yr −1 . If the saline formation is overpressured by +20 bars, the center of the activity plume is vertically displaced from the host formation into the overburden (Figure 9b), and the peak dose relative that of the reference case (which exhibits an overpressure of +2 bars) increases from 8 × 10 −5 to 5 × 10 −4 mSv yr −1 . In either of these situations, advective plume migration is slow, with an approximate velocity of less than 500 m (1500 feet) in a million years.
The sensitivity of advective radionuclide transport to changes in the magnitude and direction of the regional pressure gradient can be mitigated by siting the repository in a large-scale recharge zone, by avoiding locations with overpressures in underlying formations, or by selecting a host formation of sufficiently low permeability.

Instant Waste Mobilization
A bounding case is simulated to assess the significance of the source-term model for estimating peak dose. In this scenario, the entire 129 I inventory is assumed to be instantaneously released from the waste matrix. This corresponds to an instant release fraction of 100% and makes it obsolete to capture waste degradation processes in the model. Furthermore, the released iodine dissolves immediately and completely into the pore water (i.e., no solubility limit is applied). Finally, it is assumed that the canisters and casing have degraded instantaneously, i.e., they do not inhibit fluid flow nor diffusive transport of dissolved 129 I from the waste form to the near field. This extreme scenario thus assumes immediate and complete mobilization of the entire 129 I inventory. While unrealistic, this bounding case demonstrates the relative importance of the engineered and natural barrier systems for waste isolation. Figure 10 shows that while instant waste mobilization leads to an earlier arrival of the plume at the receptor, peak dose is not significantly affected. Peak dose is only weakly influenced by the temporal details with which radionuclides are released from the waste form and canisters. This insensitivity is mainly related to the already conservative assumptions made in the nominal case, where a high waste degradation rate combined with a short lifetime of the canisters and casing lead to a pulse-like release of the inventory. The details of the pulse are of little significance because its overall duration is short compared to the time needed for the radionuclides to diffusively migrate to the aquifer.
Peak dose is not significantly increased by accounting for the instant release of a fraction of the radionuclides or assuming (as in this unrealistic bounding case) that the entire inventory is mobilized immediately after repository closure. The small influence of the temporal release function, which is part of the source-term model, is a result of the dampening that occurs due to the diffusive nature of radionuclide transport and the long migration times. Therefore, determining the source term is only relevant for the estimation of peak dose if there is a need to relax the conservative assumptions made in the current nominal scenario. Specifically, if the rate with which the waste form degradesreleasing the radionuclides previously encapsulated in its solid matrix-is lower than the assumed rate of 10 −5 yr −1 , the peak dose is reduced.
These observations have significant implications. They demonstrate that conclusions about the calculated safety of the repository are relatively robust to uncertainties in the source-term model. Specifically, waste degradation and canister corrosion rates are difficult to determine with confidence for the range of geochemical, thermal, and mechanical conditions that might be encountered over the expected lifetime of these engineered barrier components. However, if the barrier functions of the

Instant Waste Mobilization
A bounding case is simulated to assess the significance of the source-term model for estimating peak dose. In this scenario, the entire 129 I inventory is assumed to be instantaneously released from the waste matrix. This corresponds to an instant release fraction of 100% and makes it obsolete to capture waste degradation processes in the model. Furthermore, the released iodine dissolves immediately and completely into the pore water (i.e., no solubility limit is applied). Finally, it is assumed that the canisters and casing have degraded instantaneously, i.e., they do not inhibit fluid flow nor diffusive transport of dissolved 129 I from the waste form to the near field. This extreme scenario thus assumes immediate and complete mobilization of the entire 129 I inventory. While unrealistic, this bounding case demonstrates the relative importance of the engineered and natural barrier systems for waste isolation. Figure 10 shows that while instant waste mobilization leads to an earlier arrival of the plume at the receptor, peak dose is not significantly affected. Peak dose is only weakly influenced by the temporal details with which radionuclides are released from the waste form and canisters. This insensitivity is mainly related to the already conservative assumptions made in the nominal case, where a high waste degradation rate combined with a short lifetime of the canisters and casing lead to a pulse-like release of the inventory. The details of the pulse are of little significance because its overall duration is short compared to the time needed for the radionuclides to diffusively migrate to the aquifer.
Peak dose is not significantly increased by accounting for the instant release of a fraction of the radionuclides or assuming (as in this unrealistic bounding case) that the entire inventory is mobilized immediately after repository closure. The small influence of the temporal release function, which is part of the source-term model, is a result of the dampening that occurs due to the diffusive nature of radionuclide transport and the long migration times. Therefore, determining the source term is only relevant for the estimation of peak dose if there is a need to relax the conservative assumptions made in the current nominal scenario. Specifically, if the rate with which the waste form degrades-releasing the radionuclides previously encapsulated in its solid matrix-is lower than the assumed rate of 10 −5 yr −1 , the peak dose is reduced.
These observations have significant implications. They demonstrate that conclusions about the calculated safety of the repository are relatively robust to uncertainties in the source-term model. Specifically, waste degradation and canister corrosion rates are difficult to determine with confidence for the range of geochemical, thermal, and mechanical conditions that might be encountered over the expected lifetime of these engineered barrier components. However, if the barrier functions of the waste form and canisters do not significantly contribute to the long-term safety of the repository, peak dose can be estimated despite uncertainties in the source-term model. waste form and canisters do not significantly contribute to the long-term safety of the repository, peak dose can be estimated despite uncertainties in the source-term model. Figure 10. Comparison of annual dose from 129 I exposure for nominal scenario and assuming that radionuclide mobilization is instant (IRF = 100%; no barrier function assigned to canister and casing) and complete (no solubility limit enforced).

Probabilistic Uncertainty Analysis
The calculated performance metrics of Table 2 are uncertain because of uncertainty in (a) the model's input parameters, which represent material properties affecting the flow and transport of fluids, radionuclides, and heat through the repository system, (b) initial and boundary conditions, and (c) spatial variability in the porosity field. Probability distributions are specified for 38 individual parameters and parameter groups. The chosen probability distributions (uniform, triangular, logtriangular, normal, or log-normal) as well as their statistical parameters (lower and upper bounds, mode, and standard deviation) are summarized in Table 3.
These distributions either represent epistemic uncertainty or a range of possible property values that reflect design alternatives or assumptions. Four hundred independent samples of the parameters are taken using Latin Hypercube Sampling (LHS) and randomly combined to yield 400 realizations to be examined by Monte Carlo uncertainty propagation analysis. Before each realization is simulated, a new, spatially correlated, random porosity-modifier field is generated and mapped onto the numerical grid to include the impact of unidentifiable spatial variability of this key parameter on the simulation results.
Each of the 400 Monte Carlo simulations is run to the end time of 10 million years. The calculated doses for each of the four considered radionuclides are determined and summed to give the total dose. Furthermore, the time when peak dose occurs is extracted. Histograms are drawn for these two composite performance measures (peak dose and peak-dose time).
The results are displayed in Figure 11. The red curves show the transients of total dose for the 400 Monte Carlo realizations. Calculated peak dose values range widely (over approximately six orders of magnitude). However, only peak doses at the high end of the distribution are of interest. Just 5% of the realizations yield peak-dose values that are higher than 10 −3 mSv yr −1 (0.1 mrem yr −1 ). The maximum peak dose obtained in this probabilistic analysis is 5 × 10 −3 mSv yr −1 (0.5 mrem yr −1 ). The light blue curve is the total dose of the realization that corresponds to the median peak dose, which is close to the curve obtained with the base-case parameter set for the nominal scenario.
The spread of first arrival times (between approximately 10,000 years and more than 5 million years) is considerable, but of little relevance for safety, which is mainly characterized by peak dose rather than travel time. The earliest time when peak dose is reached is approximately 100,000 years; the median is at about 1.5 million years. A few realizations do not reach a peak dose within 10 million years (i.e., the dose curve is still rising at the end of the simulation period); however, the trajectories Figure 10. Comparison of annual dose from 129 I exposure for nominal scenario and assuming that radionuclide mobilization is instant (IRF = 100%; no barrier function assigned to canister and casing) and complete (no solubility limit enforced).

Probabilistic Uncertainty Analysis
The calculated performance metrics of Table 2 are uncertain because of uncertainty in (a) the model's input parameters, which represent material properties affecting the flow and transport of fluids, radionuclides, and heat through the repository system, (b) initial and boundary conditions, and (c) spatial variability in the porosity field. Probability distributions are specified for 38 individual parameters and parameter groups. The chosen probability distributions (uniform, triangular, log-triangular, normal, or log-normal) as well as their statistical parameters (lower and upper bounds, mode, and standard deviation) are summarized in Table 3.
These distributions either represent epistemic uncertainty or a range of possible property values that reflect design alternatives or assumptions. Four hundred independent samples of the parameters are taken using Latin Hypercube Sampling (LHS) and randomly combined to yield 400 realizations to be examined by Monte Carlo uncertainty propagation analysis. Before each realization is simulated, a new, spatially correlated, random porosity-modifier field is generated and mapped onto the numerical grid to include the impact of unidentifiable spatial variability of this key parameter on the simulation results.
Each of the 400 Monte Carlo simulations is run to the end time of 10 million years. The calculated doses for each of the four considered radionuclides are determined and summed to give the total dose. Furthermore, the time when peak dose occurs is extracted. Histograms are drawn for these two composite performance measures (peak dose and peak-dose time).
The results are displayed in Figure 11. The red curves show the transients of total dose for the 400 Monte Carlo realizations. Calculated peak dose values range widely (over approximately six orders of magnitude). However, only peak doses at the high end of the distribution are of interest. Just 5% of the realizations yield peak-dose values that are higher than 10 −3 mSv yr −1 (0.1 mrem yr −1 ). The maximum peak dose obtained in this probabilistic analysis is 5 × 10 −3 mSv yr −1 (0.5 mrem yr −1 ). The light blue curve is the total dose of the realization that corresponds to the median peak dose, which is close to the curve obtained with the base-case parameter set for the nominal scenario.
The spread of first arrival times (between approximately 10,000 years and more than 5 million years) is considerable, but of little relevance for safety, which is mainly characterized by peak dose rather than travel time. The earliest time when peak dose is reached is approximately 100,000 years; the median is at about 1.5 million years. A few realizations do not reach a peak dose within 10 million years (i.e., the dose curve is still rising at the end of the simulation period); however, the trajectories of Energies 2020, 13, 2599 24 of 31 these curves suggest that these peak doses (once they are reached in the far distant future) would be very low.
This initial probabilistic safety analysis indicates that while the calculated annual dose is uncertain, the peak dose-even for the most unfavorable parameter combination considered-remains well below the typical dose standard of 0.1 mSv yr −1 (10 mrem yr −1 ). For the generic conceptual model and its numerical implementation, and for the assumptions made about the distributions of uncertain and variable input parameters, the uncertainty analysis does not invalidate the conclusions of the deterministic nominal scenario, which appear to be reasonably robust.
Energies 2020, 13, x FOR PEER REVIEW 24 of 31 of these curves suggest that these peak doses (once they are reached in the far distant future) would be very low. This initial probabilistic safety analysis indicates that while the calculated annual dose is uncertain, the peak dose-even for the most unfavorable parameter combination consideredremains well below the typical dose standard of 0.1 mSv yr −1 (10 mrem yr −1 ). For the generic conceptual model and its numerical implementation, and for the assumptions made about the distributions of uncertain and variable input parameters, the uncertainty analysis does not invalidate the conclusions of the deterministic nominal scenario, which appear to be reasonably robust.

Disruptive Scenario: Seismic Fault Activation
The fault activation scenario assumes that a large tectonic or seismic event causes the activation (or reactivation) of a new (or existing, undetected) sub-vertical fault and generates an associated fracture zone that intersects the central part of the repository's disposal section. The fault extends from the deep strata to the aquifer and reaches the surface near the location of the drinking water well (see Figure 12a). The seismic event occurs shortly after repository closure. The fault and fractures remain highly conductive throughout the performance period.

Disruptive Scenario: Seismic Fault Activation
The fault activation scenario assumes that a large tectonic or seismic event causes the activation (or reactivation) of a new (or existing, undetected) sub-vertical fault and generates an associated fracture zone that intersects the central part of the repository's disposal section. The fault extends from the deep strata to the aquifer and reaches the surface near the location of the drinking water well (see Figure 12a). The seismic event occurs shortly after repository closure. The fault and fractures remain highly conductive throughout the performance period.
At its center, the fault has a vertical permeability of 10 −13 m 2 , which tapers off towards the edge of the fracture zone, where it reaches the respective permeability of the formation it cuts through. The fracture zone is 25 m (76 feet) wide on either side of the fault line. Figure 12b shows the dose curves with and without a fault. As expected, preferential flow and radionuclide transport along the fault leads to an earlier arrival of 129 I in the water supply system and an earlier peak-dose time. The peak dose of 1.3 × 10 −4 mSv yr −1 (1.3 × 10 −2 mrem yr −1 ) is higher than that of the nominal scenario by a factor of 1.6. In comparison to the uncertainty range of the peak dose determined by the probabilistic safety analysis (see Section 6.3), the increase in dose due to fault (re)activation is very small and statistically not significant. At its center, the fault has a vertical permeability of 10 −13 m 2 , which tapers off towards the edge of the fracture zone, where it reaches the respective permeability of the formation it cuts through. The fracture zone is 25 m (76 feet) wide on either side of the fault line. Figure 12b shows the dose curves with and without a fault. As expected, preferential flow and radionuclide transport along the fault leads to an earlier arrival of 129 I in the water supply system and an earlier peak-dose time. The peak dose of 1.3 × 10 −4 mSv yr −1 (1.3 × 10 −2 mrem yr −1 ) is higher than that of the nominal scenario by a factor of 1.6. In comparison to the uncertainty range of the peak dose determined by the probabilistic safety analysis (see Section 6.3), the increase in dose due to fault (re)activation is very small and statistically not significant. Figure 13 visualizes the migration of the 129 I plume for the seismic fault activation scenario. The activity evolution shows that the fault acts as a preferential pathway for fluid. Radionuclides are transported advectively upwards through the fault and associated fracture zone towards the aquifer. Advective fluid flow is also visible below the repository, where uncontaminated brine enters the shale formation, flushing 129 I upwards, and eventually dividing the diffusive plume into two parts.
This initial evaluation of the disruptive seismic event scenario suggests minor impacts on repository performance. The scenario needs to be refined using site-specific information about the large-scale, tectonic processes, the regional stress field, the structure and properties of the formations, and other factors that may be used to assess the probability and impact of a seismic event occurring at or near the disposal site.  Figure 13 visualizes the migration of the 129 I plume for the seismic fault activation scenario. The activity evolution shows that the fault acts as a preferential pathway for fluid. Radionuclides are transported advectively upwards through the fault and associated fracture zone towards the aquifer. Advective fluid flow is also visible below the repository, where uncontaminated brine enters the shale formation, flushing 129 I upwards, and eventually dividing the diffusive plume into two parts. At its center, the fault has a vertical permeability of 10 −13 m 2 , which tapers off towards the edge of the fracture zone, where it reaches the respective permeability of the formation it cuts through. The fracture zone is 25 m (76 feet) wide on either side of the fault line. Figure 12b shows the dose curves with and without a fault. As expected, preferential flow and radionuclide transport along the fault leads to an earlier arrival of 129 I in the water supply system and an earlier peak-dose time. The peak dose of 1.3 × 10 −4 mSv yr −1 (1.3 × 10 −2 mrem yr −1 ) is higher than that of the nominal scenario by a factor of 1.6. In comparison to the uncertainty range of the peak dose determined by the probabilistic safety analysis (see Section 6.3), the increase in dose due to fault (re)activation is very small and statistically not significant. Figure 13 visualizes the migration of the 129 I plume for the seismic fault activation scenario. The activity evolution shows that the fault acts as a preferential pathway for fluid. Radionuclides are transported advectively upwards through the fault and associated fracture zone towards the aquifer. Advective fluid flow is also visible below the repository, where uncontaminated brine enters the shale formation, flushing 129 I upwards, and eventually dividing the diffusive plume into two parts.
This initial evaluation of the disruptive seismic event scenario suggests minor impacts on repository performance. The scenario needs to be refined using site-specific information about the large-scale, tectonic processes, the regional stress field, the structure and properties of the formations, and other factors that may be used to assess the probability and impact of a seismic event occurring at or near the disposal site. This initial evaluation of the disruptive seismic event scenario suggests minor impacts on repository performance. The scenario needs to be refined using site-specific information about the large-scale, tectonic processes, the regional stress field, the structure and properties of the formations, and other factors that may be used to assess the probability and impact of a seismic event occurring at or near the disposal site.

Summary and Concluding Remarks
The deep horizontal drillhole disposal concept consists of a system of multiple engineered and natural barriers. The performance of this barrier system with respect to waste isolation from the accessible environment was quantitatively evaluated using numerical modeling and associated safety-analysis methods. The disposal concept was examined for a relatively wide range of conditions and alternative system evolutions. Moreover, it was shown that the insights gained from the simulations remain valid even if accounting for considerable variability and uncertainty in key factors that affect repository performance.
The evaluation of selected performance measures for the nominal scenario suggests that radioactive waste disposed in a horizontal drillhole repository is sufficiently isolated from the accessible environment. For the given assumptions, the maximum radiation exposure of an individual is likely far below regulatory dose standards, despite making cautious assumptions about the properties of the engineered and natural barrier systems. Radionuclide releases from the repository and transport rates along potential migration pathways are exceedingly small, leading to very low levels of contamination in the geosphere and specifically in the freshwater aquifer. Perturbations due to repository construction and operation, as well as post-closure thermal loading, are small to moderate and are unlikely to induce detrimental effects that jeopardize the integrity of the engineered or natural barrier systems.
The deep horizontal drillhole disposal concept has a number of intrinsic attributes that support safety even for a generic repository design and host formation:

•
Depth-The great depth of the repository effectively isolates the radioactive waste from the accessible environment. The total thickness of the overlying formations protects the host rock and repository from the influence of dynamic processes occurring at and near the land surface, and leads to long transport distances to the accessible environment, associated with long radionuclide migration times and large fluid volumes available for dilution. Great depth in combination with the geologic stability and fluid isolation in the host rock and underlying formations represent the essence of geologic waste disposal. • Geometry and Orientation-Each drillhole is a separate unit, i.e., not in communication with other drillholes. Because it terminates in a dead-end, axial water flow rates are limited by the small permeability of the host rock, preventing circulation or through-flow of water. The drillhole (recognized as a potential pathway for radionuclides) is long and has a small cross section and thin EDZ; it can be effectively backfilled and sealed. The vertical access hole is spatially offset and orthogonal to the horizontal waste disposal section, i.e., natural gradients or repository-induced effects are unlikely to be aligned with the changing orientation of the drillhole to drive radionuclides towards the land surface. Compartmentalization of the waste in individual, unconnected drillholes within modular, geographically separated drillhole repositories decreases the consequences associated with disruptive events.

•
Multi-Barrier Concept-The safety and security of the repository is strengthened by a multi-barrier concept, which is the combination of engineered and natural barriers. The EBS protects the repository from external disturbances, provides a suitable environment for the canisters and waste form, and serves as a barrier to radionuclide release and transport away from the repository. The depth of the disposal section and its sub-horizontal orientation along the bedding of a suitable argillaceous host formation makes the geosphere a reliable natural barrier system, drastically reducing the requirements that otherwise need to be imposed on the barrier functions of the engineered components. The drillhole may thus be designed for optimal safety during waste emplacement and the early post-closure period, without having the burden to take on long-term safety functions.

•
Perturbations-Construction and operation of a drillhole repository is considerably less intrusive than that of a mined repository. The host rock and its environment are much less perturbed-hydrologically, mechanically, and chemically. Reduced perturbation of the natural barrier system also reduces the requirements for the components of the EBS. • Confinement and Containment-The stability of the waste form in the expected chemically reducing environment provides for long-term encapsulation of radionuclides. If released from the waste containers, migration through the geosphere is slow. The targeted host rock exhibits a low hydraulic conductivity so that movement of dissolved radionuclides is predominantly by diffusion rather than advection. Low permeability prolongs travel times, allowing radionuclides to decay within the EBS and geosphere, which considerably reduces activity in potable groundwater. • Saturated, High-Pressure Environment-The repository is located in the saturated zone far below freshwater aquifers. Critically, the repository is never desaturated, severely underpressured, or exposed to significant oxidizing conditions even during the construction and operation phases. The high in situ pressure prevents boiling of water during the thermal period. It also minimizes or inhibits phase separation of gaseous corrosion products. No transport of volatile radionuclides through the unsaturated pore space to the atmosphere occurs.

•
Characterization-In a mined repository, the host rock wall can be visually inspected in a direct way. While such direct visual inspection is not possible in a drillhole, the host rock can be well characterized using well established borehole-based methods. Cores and pore fluid samples can be retrieved and analyzed, a suite of geophysical logging and imaging techniques exist, and active borehole tests can be conducted, providing sufficient information about the safety-relevant properties of the host formation. For people to directly access the host rock requires the excavation of large tunnels. Moreover, the tunnels must be drained and ventilated over decades. All these activities lead to considerable mechanical, chemical, hydrological, and thermal perturbations of the host rock. As a consequence, the data collected in a large tunnel are difficult to interpret and may not accurately reflect the properties and conditions of the undisturbed host rock. Furthermore, a large component of site characterization for both mined and drillhole repositories consists of regional geological studies, surface-based geophysical surveys, and exploratory boreholes, along with core analyses. Relevant processes can be examined in underground rock laboratories and at research institutions, complementing field investigations and natural analogue studies. Many of these common data are used identically to characterize the site-specific natural barrier system.
Stakeholders and the public need to gain confidence in the safety of a drillhole repository. Such confidence can be built, in part, by performing a comprehensive performance assessment study that passes muster with scientists, engineers, and regulators. It is recognized that waste disposal in horizontal drillholes is a novel concept with historically limited consideration by the nuclear industry; however, its components and implementation procedures are solidly based on established technologies and processes.
Based on the analysis presented in this paper, a horizontal drillhole repository offers remarkably strong post-closure isolation for spent nuclear fuel. This conclusion is contingent on the assumptions as well as the representativeness and accuracy of the simulation results for the nominal scenario (see Section 6.1). The validity and robustness of this conclusion is corroborated by (a) performing sensitivity analyses that examine the influence of specific assumptions and parameters (see Section 6.2), (b) accounting for uncertainty and spatial variability in a probabilistic uncertainty propagation analysis (see Section 6.3), and (c) considering disruptive events (see Section 6.4).
The post-closure radiological consequences-calculated using a simplified representation of a generic deep horizontal drillhole repository located in shale-show that (a) the estimated maximum annual dose is low, and (b) the conclusions drawn from this dose estimate remain valid even if considerable changes are made to key assumptions, as well as allowing for the uncertainties inherent in the analysis. Furthermore, the calculations suggest that the key safety function of long-term isolation from the accessible environment is provided by the depth of the repository and the attributes of its configuration. Long-term confinement of radionuclides in the stable waste matrix and long migration times allow for radioactive decay to occur within the repository system, considerably reducing the Energies 2020, 13, 2599 28 of 31 activity of radionuclides potentially being released to the accessible environment. Retardation and spreading of radionuclides in the geosphere, dilution in the aquifer, and attenuation in the biosphere lead to low annual doses that are calculated to be significantly below a typical dose standard of 0.1 mSv yr −1 (10 mrem yr −1 ). The calculated maximum radioactivity in the aquifer's groundwater is also very low.
The above conclusions are contingent on the stated model assumptions, i.e., they are only pertinent to a potential or actual site if the geological environment at that site exhibits similar characteristics, and if the repository system is carefully constructed, operated, and sealed as is assumed in the simulations. The calculations are preliminary and do not derive from a potential repository site or a specific geological formation. The conceptual and numerical models, as well as assumptions and parameters and their uncertainties, are reflective of this context. It is understood that repository performance has to be reassessed as new information becomes available. A reevaluation is needed for each potential disposal site, accounting for the final repository design and site-specific conditions. Nevertheless, generic calculations such as those presented here are considered a useful if not necessary step toward developing a comprehensive, site-specific safety analysis. They also serve as a basis for successive stages in repository planning, siting, and development, and provide a sound platform for interactions with interested parties and stakeholders.
This initial quantitative evaluation of a generic horizontal drillhole repository for SNF in a shale formation addresses the explicitly stated objectives to the extent they can be investigated in a generic analysis. The analysis also highlights the issues that need to be studied further, using detailed models of particular processes or subcomponents of the repository system. The described approach-after suitable adaptation-will be applied to the next phase of repository development, incorporating additional information and data as they become available. Eventually, such numerical studies will be further supplemented by independent evidence, arguments, and analyses that combined support the assertion that a specific repository system will be safe.

Patents
The basic approach is patented by Deep Isolation: U.S. patent 10,002,683 B2.