Review of the Modelling of Corrosion Processes and Lifetime Prediction for HLW/SF Containers—Part 2: Performance Assessment Models

Abstract

The disposal of high-level radioactive waste (HLW) and spent nuclear fuel (SF) presents a unique challenge for the prediction of the long-term performance of corrodible structures since the HLW/SF canisters are expected, in some cases, to have lifetimes of one million years or longer. Various empirical and deterministic models have been developed over the past 45 years for making predictions of the long-term corrosion behaviour, including models for uniform and localized corrosion, environmentally assisted cracking and microbiologically influenced corrosion. As well as process models focused on specific corrosion mechanisms (described in Part 1 of this review), there is also a need for performance assessment models as part of the overall analysis of the safety of a deep geological repository (DGR). Performance assessment models are often based on simplified or abstracted process models. The manner in which various international waste management programs have predicted the long-term performance of HLW/SF containers with copper, steel, Ni and Ti alloy corrosion barriers is discussed. Performance assessments are repeated periodically during the development and implementation of a DGR, and the corrosion models are constantly updated in light of new mechanistic understanding and/or more information about the deep geological environment. Two examples of how the container performance assessment models evolve over time are also described. Performance assessment models cannot easily be validated, so it is important to build confidence in the long-term predictions using other methods, including natural analogues and large-scale in situ tests and the use of complementary models.

1. Introduction

The container is an important component of the multi-barrier system for the disposal of high-level waste (HLW) or spent fuel (SF) in a deep geological repository (DGR). As with other aspects of the disposal system, it is necessary to make long-term predictions of the corrosion behaviour of the containers and, ultimately, to predict their functional lifetime. Many different types of predictive model have been developed for this purpose over the past 45 years and which are the subject of this review. For convenience, the review has been divided into two parts, with process models focussed on specific corrosion processes or mechanisms discussed in Part 1 [1] and performance assessment models for the prediction of container lifetimes described here in Part 2. In addition to a discussion of process models, Part 1 also contains much information regarding the nature of the disposal environment and how it evolves over time, which should be reviewed as background to the discussion of performance assessment models described here.

Performance assessment (PA) models are defined here as models designed to predict the lifetime of HLW/SF containers as part of a larger safety assessment of the disposal system.

Table 1. Comparison of the characteristics of performance assessment and process models for HLW/SF containers.

	Performance Assessment Models	Process Models
Focus	Prediction of the lifetime (or distribution of lifetimes) of containers as a consequence of one or more corrosion processes.	Interpretation or prediction of a single corrosion process. May be used for develo** reasoned arguments to exclude specific corrosion processes from PA models.
Scale (spatial and temporal)	Entire repository for the service life of containers.	Laboratory or full-scale in situ test.
Accuracy of prediction	Conservative assumptions used to address uncertainties.	Aim to predict the corrosion behaviour as accurately as possible.
Validation	Difficult to validate because of spatial and temporal scales.	Validation against experimental observations possible.
Deterministic basis	Desirable, but models often based on simplifying assumptions or bounding estimates.	Often based on detailed mechanistic understanding.

compares the characteristics of PA and process models. Typically, PA models account for the consequences of one or more corrosion processes on a larger physical and temporal scale than process models. While accuracy of lifetime prediction is desirable, the models often involve conservative assumptions to address areas of uncertainty which inevitably results in an over-prediction of the extent of corrosion and an under-prediction of the container lifetime. Unlike process models, PA models are difficult or impossible to validate against experimental observations, and for this reason various approaches are used to build confidence in the predictions, such as the use of natural and archaeological analogues or the results from large-scale in situ experiments. In some cases, the distinction between process and PA models is unclear, and detailed mechanistically based process models can be used for making container lifetime predictions as, for example, in the case of the Probabilistic Canister Breaching Model (PCBM) for carbon steel containers [2]. Process models are also frequently used to develop reasoned arguments for excluding certain corrosion processes from PA models. PA models are often based on simplifying assumptions or bounding calculations and depart from the level of determinism common in many process models. For example, the sulfide corrosion model for copper canisters in Posiva’s safety case for the operating licence application (SC-OLA) [3,4] is partly based on the detailed mechanistic process models of microbial sulfate reduction [5,6,7], but with the assumption that all sulfate is reduced to sulfide regardless of the availability of electron donor (organic carbon or H₂) or of the kinetics of the microbial reduction reaction.

In Part 2 of this review, we focus on the development and evolution of PA models in various international waste management programs. To provide context, a general background to performance assessment and the development of the overall safety case is presented. Next, examples of PA models for various container materials are presented, including copper, carbon steel and Ni and Ti alloys. Two examples are then provided of how the nature of the PA models evolve over time as mechanistic insight into the various corrosion processes improves and as more is understood about the nature of the disposal environment. Finally, the different methods for building confidence in long-term predictions using PA models are discussed.

2. Background

2.1. Evolution of the Repository Environment and of the Container Corrosion Behaviour

The nature of the disposal environment is described in some detail in Part 1 [1], along with a discussion of the implications for the long-term corrosion performance of the container. One of the most important aspects of the repository environment is that it evolves over time. As a consequence, the corrosion behaviour also changes with time and this evolution of corrosion mechanisms is taken into account in PA models. Figure 1, Figure 2, Figure 3, Figure 4 and Figure 5 show cartoons used in various international waste management programs to describe, in a qualitative manner, this evolution of environmental conditions and the resulting corrosion behaviour.

Such images are used to pictorially represent the evolution of the repository environment and the corrosion behaviour and are used to convey this key underlying mechanistic understanding to a range of audiences, both expert and non-expert alike. For example, Figure 1 highlights the near-field thermal and saturation transients and divides the overall evolution into a number of phases, illustrating the relevant corrosion mechanisms for the carbon steel canister and steel mesh tunnel supports during each phase for a repository in Opalinus Clay [8]. A similar evolution is shown in Figure 2 for the Belgian supercontainer concept [9], with the evolution of the cement pore-water pH dominating the environmental evolution in this case. The expected physical state of the carbon steel container (and of a steel liner used to support the horizontal borehole) at different stages in the evolution of Andra’s Cigéo disposal facility is graphically illustrated in Figure 3 [10]. Figure 4 illustrates the various corrosion processes that could occur for a copper-coated steel used fuel container in a Canadian DGR [11]. Lastly, Figure 5 again highlights the thermal evolution, in this case for the proposed repository at Yucca Mountain, Nevada, the overall design approach for which was to minimize the extent of corrosion during the period of highest radiological toxicity by maintaining dry conditions at the surface of the waste packages [12].

Table 2. Corrosion processes for reference container materials in various national nuclear waste programs [1].

Country	Reference Container Material(s)	Corrosion Processes *
Belgium	Carbon steel	Uniform corrosion, stress corrosion cracking (SCC), localized corrosion, radiation-induced corrosion (RIC)
Canada	Copper	Uniform corrosion, localized corrosion, SCC, microbiologically influenced corrosion (MIC), galvanic corrosion, RIC
China	Carbon steel	Uniform corrosion, localized corrosion, hydrogen embrittlement, RIC
Czechia	Carbon steel/stainless steel	Uniform corrosion, localized corrosion (carbon steel only), MIC, hydrogen (or hydride) induced cracking (HIC), galvanic corrosion, RIC
Finland	Copper	Uniform corrosion, localized corrosion, SCC, MIC
France	Carbon steel	Uniform corrosion, MIC, SCC, HIC, RIC
Germany **	Carbon steel	Uniform corrosion, pitting, SCC, intergranular attack (IGA), RIC
Japan	Carbon steel	Uniform corrosion, localized corrosion, SCC, HIC, RIC
Spain	Carbon steel	Uniform corrosion, localized corrosion, SCC, IGA
Switzerland	Carbon steel	Uniform corrosion, localized corrosion, SCC, HIC
Sweden	Copper	Uniform corrosion, localized corrosion, SCC, MIC
Taiwan	Copper	Uniform corrosion, localized corrosion, SCC, MIC
USA	Alloy 22 waste package Ti-7 drip shield	Uniform corrosion, crevice corrosion, SCC, MIC Uniform corrosion, SCC, HIC

* Corrosion processes considered to be most important highlighted in bold font. ** A broad site-selection process was launched in Germany in 2022. The container material and corrosion processes listed here are for an earlier salt repository program.

summarizes the container material and the relevant corrosion processes considered in various international programs. When develo** a PA model to predict container lifetimes, the general approach is to quantitatively assess those processes that are considered likely to occur (highlighted in bold font in Table 2) and to develop reasoned arguments for excluding those processes that are considered unlikely (shown in normal font in Table 2).

2.2. Development of the Safety Case and the PA Model

2.2.1. Safety Case

The container PA model is part of a larger total system performance assessment (or safety assessment) model that is, in turn, part of a larger safety case. The safety case comprises a series of documents that summarize the status of the knowledge of the host rock, the DGR design and of the overall safety of the disposal system. Most waste management organizations (WMOs) have developed their own method for constructing the safety case, but all are based on the procedure outlined in the International Atomic Energy Agency (IAEA) safety standard [13].

Table 3. Listing of various international waste management organizations and the corresponding regulatory authority.

Country	Waste Management Organisation	Regulator
Belgium	Belgian agency for radioactive waste and enriched fissile materials (ONDRAF/NIRAS)	Federal Agency for Nuclear Control (FANC)
Canada	Nuclear Waste Management Organization (NWMO)	Canadian Nuclear Safety Commission (CNSC)
Czech Republic	Czech Radioactive Waste Repository Authority (SÚRAO)	State Office for Nuclear Safety (SÚJB)
Finland	Posiva Oy	Radiation and Nuclear Safety Authority (STUK)
France	Agence nationale pour la gestion des déchets radioactifs (Andra)	Nuclear Safety Authority (ASN)
Germany	Bundesgesellschaft für Endlagerung (BGE)	Federal Office for the Safety of Nuclear Waste Management (BASE)
Japan	Nuclear Waste Management Organization of Japan (NUMO)	Nuclear Regulation Authority Japan (NRA)
Korea	Korea Radioactive Waste Agency (KORAD)	Nuclear Safety and Security Commission (NSSC)
Spain	Empresa Nacionale de Residuos Radiactivos (ENRESA)	Spanish Nuclear Safety Council (CSN)
Sweden	Swedish Nuclear Fuel and Waste Management Co (SKB)	Swedish Radiation Safety Authority (SSM)
Switzerland	Nationale Genossenschaft für die Lagerung radioaktiver Abfälle (Nagra)	Swiss Federal Nuclear Safety Inspectorate (ENSI)
Taiwan	Taipower	Atomic Energy Council
United Kingdom	Nuclear Waste Services (NWS)	Office for Nuclear Regulation (ONR) Environmental Agency (EA)
United States	Department of Energy (DOE)	Nuclear Regulatory Commission (NRC) Environmental Protection Agency (EPA)

summarizes the WMOs and associated regulatory agencies in a number of countries worldwide.

A key component of the safety case is the performance assessment which provides a quantitative analysis of the safety of the overall system, usually as a predicted dose to an identified individual or group. That dose is then compared to a standard or limit set by the regulatory authority. The container PA model is a sub-model of the overall total system performance assessment (TSPA) and determines the time at which radionuclides could first be released to the near-field environment. The TSPA is usually not just a single assessment but consists of a number of scenarios that describe various possible evolutions of the repository system. There is invariably a base case or expected evolution scenario that describes how the system is expected or designed to evolve. Then there will be a number of variant cases that may describe possible alternative evolutions, possibly involving failure or sub-optimal performance of a given barrier; for example, an initial through-wall defect in one or more containers or bentonite buffer emplaced with a density insufficient to suppress microbial activity. Variant cases may also be based on different future climate evolutions, such as an extended global warming scenario that results in a delay of the next glaciation event [3,4]. There may also be a class of disruptive scenarios that, while of low probability, would result in a significant consequence. For instance, for the Yucca Mountain licence application, the consequences of disruptive scenarios involving either seismic or igneous activity were analyzed [12]. The consequences of human intrusion are also usually assessed. Lastly, there may be one or more “what-if” scenarios that describe events or processes that are considered unlikely, or impossible, but which are included to demonstrate the robustness of the overall disposal system. For example, for SKB’s SR-Site safety case, the consequences of copper corrosion in anoxic H₂O were considered as a what-if case, albeit not as a fully developed scenario [14,15]. A separate prediction of the container lifetime is required for each of these scenarios.

A number of safety cases and safety assessments will be performed during the development, construction and operation of the DGR. These safety cases will be performed both at specific junctures, for example, for the construction or operational licence applications or for final closure, and periodically as the disposal system is developed or during construction as more is learned about the nature of the host rock and underground environment. Design, development, construction and operations of the DGR may span a century or more in some cases and it is inevitable that the nature of the container PA model will evolve with successive safety cases. Changes to the container PA model may result from increased understanding of the mechanisms of the corrosion processes involved and often will result in a reduction in the level of conservatism typical of early-stage PA models. Successive PA models may also involve changes in container design, either due to optimization of an existing design or a complete re-design of the container concept in response to new information regarding the nature of the underground environment. Two examples of how PA models have evolved during the DGR development phase up to the stage of construction licence application are described in Section 4.

2.2.2. PA Models

A number of factors will determine how a PA model is structured. For example, one important factor is the expected or target container lifetime, which in turn is influenced partly by the nature of the host rock and partly by specific regulatory requirements. In fractured crystalline host rock where the container is a significant contributor to the safety of the entire system, it is desirable to be able to demonstrate that the containers will remain intact for periods of up to 1 million years. As a consequence, it is necessary to account for not only the long-term evolution of the near-field environment but also low-probability events such as possible seismic events that could disrupt the DGR and impact container integrity [4,15,16]. In contrast, for certain low-permeability rocks where the geological barrier is the main contributor to safety, the container lifetime may have relatively little influence on the dose to the receptor group. In these circumstances, a relatively simple PA model that ensures a minimum container lifetime, for instance, to allow for safe emplacement and potential retrieval of the waste, may be sufficient [10], although long-lived containers have also been considered for sedimentary rock [17]. For programs at a generic stage without an identified repository site, it may only be necessary to demonstrate a minimum container lifetime, for example, 1000 a as in the case of the Japanese program [18]. A minimum container lifetime of 1000 a is commonly defined by the regulatory authorities to ensure that containment extends beyond the period of highest radiotoxicity and the early part of the thermal-saturation-redox transient phase in the evolution of the near-field environment.

Other factors that will determine the structure of the container PA model include the nature of the overall TSPA model. For instance, if the overall assessment of the safety of the repository is based on a probabilistic model, then it may be desirable to develop a probabilistic container failure model in which uncertainty and variability in corrosion mechanisms and model input parameters are described by probability density functions. Probabilistic models provide a distribution of container lifetimes, rather than discreet lifetimes. As well as the temporal variability in container lifetimes, it may also be necessary to predict the spatial distribution of failures if there are different radionuclide transport characteristics in different locations in the far-field [19,20].

It is usual for HLW/SF container lifetimes to be predicted based only on the time-dependent corrosion behaviour. Containers are designed with a minimum wall thickness necessary to withstand the various mechanical loads that are expected under normal and disruptive conditions, with the remainder of the wall thickness serving as the corrosion allowance. This approach is based on the implicit assumption that there are no time-dependent processes that degrade the structural integrity of the container. This assumption is reasonable for dual-wall container designs in which the two components serve different functions, i.e., an outer corrosion barrier with an inner structural component. However, for single-wall container designs, it may be necessary to take into account the time-dependent degradation of the mechanical properties due to corrosion or irradiation. While the neutron flux from spent fuel is too low to cause radiation damage even over geological timescale [21], the absorption of hydrogen by carbon steel or titanium can degrade the mechanical properties of these materials. For single-wall carbon steel containers, especially, it may be necessary to take into account the joint effects of corrosion and mechanical degradation modes when predicting the container lifetime [22,23].

The other factor that determines the structure of a container PA model is the definition of what constitutes “failure” of the container. In the majority of performance assessments, failure is simply defined as the point at which the corrosion allowance, either the entire wall thickness of the corrosion barrier of a dual-wall container or the allowance set aside for corrosion for a single-shell design, is first penetrated. That point defines the container lifetime and it is usual to assume that the container no longer provides any barrier function after that time. For carbon steel and Ti-alloy containers, however, failure could occur prior to consumption of the corrosion barrier as a result of embrittlement of the container material due to absorbed hydrogen [19,22,23,24].

Although it is commonly assumed that the container no longer serves any function after first penetration of the corrosion allowance, some PA models do account for the effect of the remaining barrier. For example, in the Waste Package Degradation (WAPDEG) PA model for the corrosion of Alloy 22 waste packages in the Yucca Mountain repository, the container surface was divided into ~1400 “patches”, each approximately the size of a corrosion coupon used in the complementary long-term corrosion tests used to provide input data for the model [25,26,27]. Each patch was assigned a corrosion rate from a Weibull distribution of the experimentally observed rates, so that some patches corroded faster than others. The outcome was not only the time to first penetration of the waste package, but also the time-dependent size of the corroded area. The uncorroded regions of the waste package continued to provide a barrier to the ingress of water and the egress of radionuclides. It was also argued in the Yucca Mountain program that narrow, tortuous stress corrosion cracks would continue to limit the transport of species into and out of the waste package [28], even though the container wall had theoretically been penetrated. Attempts have also been made to take credit for the inner structural component of a dual-wall container [29].

2.2.3. Treatment of Uncertainty and Variability

An important aspect of PA models that distinguishes them from process models is the treatment of uncertainty and variability. While the aim of process modelling is generally to represent or predict the corrosion process as accurately as possible, an important feature of PA models is to take into account various types of uncertainty and variability.

Uncertainty may arise from incomplete understanding of a corrosion mechanism or of insufficient certainty in the value of input parameters. For example, there is some uncertainty about the form that localized corrosion of copper may take under aerobic conditions. Although there is good evidence that the surface will undergo roughening rather than discrete pitting [4,30,31], Posiva chose to estimate separate corrosion allowances for surface roughening and pitting under either saturated or unsaturated conditions. Similarly, there is uncertainty about whether localized corrosion of copper is possible under anaerobic conditions in the presence of sulfide. While SKB [21,32] and Posiva [3,31] elect to make an allowance for possible “micro-galvanic corrosion”, albeit only if the flux of sulfide is high due to chemical erosion of the buffer, NWMO [11] and Nagra [33] do not. Thus, different WMOs assess the level of uncertainty in different ways. There may also be uncertainty in the value of certain input parameters. This form of uncertainty is generally addressed using either probabilistic models, in which the input parameters are represented by probability density functions, or through sensitivity analyses.

Probabilistic models and/or sensitivity analyses are also used to account for sources of variability. Common examples of variability include the groundwater sulfide concentration [14,15,34], container temperature [19,26,35] and the corrosion rate [19,23,26]. As noted above, these and other sources of variability can lead to distributions in the container lifetime and/or spatial variations in container failure in different regions of the DGR.

Thus, many factors go into determining the form and structure of an HLW/SF container PA model and these are reflected in the wide range of modelling approaches described in the following sections. Making predictions over such long timescales is difficult. The aim of such PA models is not to necessarily predict the exact container lifetime but instead, taking into account the various sources of variability and uncertainty, to predict the minimum lifetime.

3. Container Corrosion Modelling in Safety Assessments

Table 4. Methods used for the long-term prediction of the corrosion behaviour of canister materials.

	Uniform Corrosion	Localized Corrosion	Environmentally Assisted Cracking	MIC
C-steel	Mass-balance for aerobic corrosion. Empirical rate for anaerobic corrosion.	Pitting factor. Maximum penetration based on extreme value analysis.	Reasoned argument for no SCC based on environemntal conditions and/or low susceptibility of specific alloy. No effects of H because of low H concentration and use of low strength steel OR assessment of failure by fracture or plastic collapse of defected container as a result of hydrogen absorption.	Reasoned argument based on lack of microbial activity.
Copper	Mass-balance for aerobic phase. Mass-transport limited corrosion due to sulfide.	Pitting factor or extreme value analysis of maximum pit depth. Allowance for surface roughening. Probabilistic pitting models.	Reasoned argument for no SCC based on absence of SCC agents and/or insufficient stress.	Reasoned argument based on lack of microbial activity.
Ti alloys	Empirical corrosion rates.	Limited propagation argument for Ti-2, -12 or use of resistant Ti-7, Ti-16, Ti-29 alloys.	HIC based on either critical absorbed H concentration or critical hydride layer thickness.	Assumed to be immune.
Ni alloys	Empirical corrosion rates.	Initiation based on threshold potential (ERP).	Slip dissolution model.	Enhancement factor for uniform corrosion.

provides an overview of the different approaches used for the prediction of the long-term corrosion performance in PA models for the four broad classes of container material. As can be seen, there is a general reliance on empirical corrosion rates or damage functions (i.e., pitting factors, surface roughness allowances and statistical analysis of observed pit depths), rather than the use of deterministic approaches favoured for the development of process models [1]. Deterministic models are, however, used for develo** reasoned arguments for excluding various corrosion processes. Furthermore, although the actual calculation of the container lifetime may be largely empirically based, an underlying mechanistic understanding is essential as one of the means used to build confidence in these long-term predictions (see Section 5).

PA models for each of the four classes of container materials will be described in more detail in the following sections.

3.1. Prediction of the Lifetime of Copper Containers

All PA models for copper HLW/SF containers follow a similar format. For the processes considered likely to occur, corrosion allowances are defined for each of processes considered to be limited in either duration or extent, such as uniform corrosion due to the initially trapped O₂ or the extent of radiation-induced corrosion (RIC). These allowances are then subtracted from the nominal wall thickness, with the remainder of the corrosion barrier available for long-term corrosion due to the presence of sulfide. The container lifetime is then defined as the time at which the corrosion allowance has been consumed by a combination of these limited corrosion processes and the long-term corrosion by sulfide. In addition, reasoned arguments are defined for the exclusion of those corrosion processes considered not to occur under repository conditions.

3.1.1. Limited Corrosion Processes

Table 5. A summary of the allowances for “limited” corrosion processes in various performance assessments for copper HLW/SF containers. Corrosion depths in mm.

Corrosion Process	Posiva SC-OLA [3,4,31]	SKB PSAR [32]	NWMO [11]	Nagra [33]	Taipower [34]	NUMO [36]
Uniform corrosion due to initially trapped O2	0.03 (0.0–0.77)	2.5 *	0.080 (0.298 max.)	0.074	0.102	0.07–0.32 #
Localized corrosion under aerobic conditions	0.050 (surface rough.) 1.3 (pitting, saturated) 0.10 (pitting, unsaturated)	*	0.050 (0.10 max.)	0.011		-
Atmospheric corrosion prior to emplacement	0.001	<0.001	-	-	0.0015	-
Radiolytic corrosion (external)	0.020	<0.001 (unsat.) 0.003 (sat. buffer)	0.0094 0.050 (non-uniform)	0.001	<0.001 (unsat.) 0.011 (sat. buffer)	##
Localized corrosion under anaerobic conditions	0.100 (micro-galvanic coupling) ** Localisation factor of 2 under biofilm **	0.150	-	-	-	-
Sulfide from pyrite dissolution	Excluded by reasoned argument	0.001–0.114	-	-	0.114	-
Microbial activity in intact buffer	Excluded by reasoned argument	-	-	-	0.177	-
Anoxic uniform corrosion (pure H2O, high [Cl−])	Excluded by reasoned argument	Excluded by reasoned argument	0.001 (0.1 max.)	Excluded by reasoned argument	Excluded by reasoned argument	Excluded by reasoned argument
TOTAL (mm)	0.1 (0.07–1.4 range)	2.6 (0.6–9)	0.19 (0.61 max.)	0.086	0.41	0.07–0.32 #

* For the SKB PSAR, the extent of aerobic corrosion of 2.5 mm accounts for both uniform corrosion and pitting. ** Only in the event of buffer erosion, and not included in total. # Lower bound based on O₂ inventory in buffer only, upper bound based on total O₂ inventory of buffer and backfill. ## To be assessed in future.

defines the various limited corrosion processes and the associated corrosion allowances reported for a number of recent safety assessments. Not all processes are considered to be possible by all WMOs; however, there is reasonable consensus on the nature of the corrosion processes that will, and will not, occur under repository conditions.

Corrosion allowances are made for the following processes in at least one of the assessments listed in Table 5:

• Uniform corrosion due to the initially trapped O₂—the corrosion allowance for the initially trapped O₂ in the buffer (and backfill) is invariably determined using a bounding mass-balance calculation and the assumption that Cu corrodes as Cu(I), so that each mole of O₂ oxidizes 4 moles of Cu. The depth of uniform corrosion depends on the repository design and on the properties of the buffer, particularly the initial degree of saturation since >90% of the initial O₂ inventory is in the form of gaseous O₂ in the unsaturated pore volume. For the KBS-3 repository design with vertical deposition holes and backfilled tunnels, another important consideration is the extent to which O₂ initially present in the backfilled tunnels reaches the container in the deposition holes. Various methods have been used to estimate what fraction of the backfill O₂ inventory should be included in the corrosion allowance calculation, including assumptions about the fraction that could diffuse from the backfill into the top of the deposition hole [32] and reactive-transport modelling of the amount of O₂ consumed by corrosion of steel tunnel support materials [37]. If only the buffer material is considered, the depth of corrosion is limited to approximately 0.1 mm (Table 5).
• Localized corrosion under aerobic conditions—there is now a general consensus that localized corrosion of copper under aerobic conditions takes the form of surface roughening rather than discrete pitting [11,15,16,17,30,31,32,33,38]. Thus, unlike the early PA models for copper containers in which a pitting factor was used [39], a surface roughening allowance of 50–100 μm is now used. (The pitting factor is defined as the ratio of the maximum depth of penetration measured from the original surface to the mean depth of corrosion.) The surface roughness allowance is based on the maximum peak-to-trough distance observed empirically on copper surfaces exposed to simulated repository conditions [38]. However, Posiva [31] and SKB [32] also assess the maximum depth of corrosion based on the assumption that pitting could occur under either saturated or unsaturated conditions during the initial repository redox transient. Based on process models for pitting under saturated [35] and unsaturated [31] conditions, maximum pits depths of a few mm have been proposed (Table 5).
• Atmospheric corrosion prior to emplacement—this is a trivial corrosion allowance and is a holdover from early SKB assessments where, in a desire to be rigorous, all conceivable sources of corrosion were included. Based on empirical atmospheric corrosion rates and the maximum length of time that the canister might be temporarily stored prior to disposal, this corrosion allowance is of the order of a few nm at most.
• Radiation-induced corrosion (RIC)—different process models have been used to assess the extent of RIC [1]. Generally, these assessments have involved uncoupled radiolysis models in which a bulk radiolysis model is used to predict the amounts of radiolytic oxidants that could be formed, and a separate corrosion model is used to predict the extent of damage.
• Localized corrosion under anaerobic conditions—the majority of WMOs do not consider that localized corrosion is possible due to the presence of sulfide under anaerobic conditions. In the presence of compacted buffer material, the rate of uniform corrosion under anaerobic conditions is controlled by the rate of transport of sulfide to the container surface [40]. Under transport control, the interfacial sulfide concentration is zero and there is no concentration gradient to act as a driving force for the transport of sulfide into pits ahead of the uniform corrosion front. At high sulfide fluxes, as might occur if the buffer density is reduced by chemical erosion of the bentonite, there is some experimental evidence for a form of localized attack referred to as micro-galvanic corrosion [41]. The extent of such attack is limited [31,32] and is treated using a corrosion allowance of 0.1–0.15 mm for canisters in deposition holes experiencing chemical erosion of the buffer and the resulting increased sulfide flux. Another consequence of buffer erosion and reduction in density is the possibility of microbial activity close to the container surface. SKB argue that such activity is limited because of the absence of organic nutrients in deep groundwaters [32]. However, Posiva take a more conservative view and allow for the possibility of microbial activity and biofilm formation on the canister surface. In the presence of a biofilm, a localization factor of 2 is used to account for the possibility of non-uniform corrosion [4,31].
• Sulfide from pyrite dissolution—commercial bentonites often contain pyrite as an impurity mineral. Pyrite is a polysulfide in which S has an average oxidation state of (-I) and which, theoretically, could be a source of reduced S species that could cause corrosion of the container. However, the solubility of pyrite is so low under anoxic conditions that few studies of the chemical dissolution of FeS₂ have been published [42]. Most organizations do not consider pyrite to be a source of sulfide (or other reduced S species) because of the low solubility of FeS₂. However, SKB continue to make a corrosion allowance for this potential source of corrosive species and estimate a corresponding depth of corrosion based on mass-balance calculations and the fraction of pyrite in the bentonite.
• Microbial activity in the buffer—in the absence of buffer erosion, the majority of WMOs exclude the possibility of microbial activity in compacted buffer based on empirical evidence [1]. The one exception is the Taiwanese assessment [34] which, based on earlier SKB assessments in which the possibility of microbial activity in the buffer was conservatively assumed, specify an allowance of 0.114 mm (Table 5) based on empirically measured rates of sulfide production.
• Anoxic corrosion—anoxic corrosion is defined as that in the absence of O₂ or sulfide and, historically, has been associated with the claims of copper corrosion in O₂-free pure water [43]. These claims have now been thoroughly investigated and have been found to be unsubstantiated [44]. As a result, no allowance is made for corrosion in O₂-free H₂O in any PA model (Table 5), although “what-if” calculations for this mechanism have been made in earlier safety cases [14]. The possibility that high [Cl⁻] could also cause corrosion with the evolution of H₂ has long been considered, with the most-recent thermodynamic calculations resulting in the conclusion that corrosion would not be significant under repository conditions [45,46]. Nevertheless, NWMO do make a small corrosion allowance for anoxic corrosion based on the results of highly sensitive measurements of the evolution of H₂ from copper corrosion experiments in hypersaline solutions representative of sedimentary rock porewater [11].

The total depth of corrosion for this series of “limited” corrosion processes ranges from 0.1 mm to 2.6 mm (Table 5). No timescale is attached to these estimates, even though many of the processes will be limited in duration. This total depth of corrosion is simply subtracted from the total corrosion allowance to arrive at the remaining thickness available for corrosion by sulfide.

There are also corrosion processes that are not considered to be possible under repository conditions for which reasoned arguments are constructed to justify their exclusion. In addition to the examples listed in Table 5, other processes are also excluded based on reasoned arguments, the most notable being stress corrosion cracking (SCC) and hydrogen-related degradation mechanisms. These reasoned arguments are documented as part of the safety case [4,32] and are often based on the process models described in Part 1 of this review [1].

3.1.2. Long-Term Sulfide Corrosion

The container lifetime is calculated based on the time to corrode the remaining wall thickness by sulfide supplied by the groundwater or from locations where microbial sulfate reduction is deemed to be possible. The near-field mass-transport characteristics depend on the repository design and on the properties of the host rock. Generally, the rate-controlling process is the diffusive transport of sulfide across a layer of intact (i.e., not chemically eroded) compacted bentonite. For crystalline host rock, groundwater flow through fractures that intersect the container location may also be taken into account [5,14]. For non-fractured host rock, it may be sufficient to impose a constant (sulfide) concentration boundary condition at the outer boundary of the buffer material [11,47,48,49,50].

In addition to the mass-transport characteristics of the near-field, the other parameter that needs to be defined is the source-term concentration, i.e., the concentration of sulfide. This concentration may simply be based on the groundwater concentration [14,34], although this does not take into account possibly elevated sulfide concentrations due to microbial activity resulting from the excavation of the repository and the emplacement of additional electron donors and acceptors. Alternatively, the sulfide concentration may be controlled by the solubility of a sulfide-containing mineral phase, although that introduces the question of which phase should be considered since the solubilities of the various forms of iron sulfide vary by many orders of magnitude [42]. However, since the rate of diffusive transport and, hence, the corrosion rate, is proportional to the source-term concentration, it is common to assess the remaining container lifetime based on a sensitivity analysis involving various assumed sulfide concentrations [11,36].

3.1.3. Lifetime Prediction

Based on this general approach, the lifetime of copper HLW/SF containers depends on the following factors:

• The total corrosion allowance, which may differ from the nominal wall thickness;
• The sum of the individual corrosion allowances for the “limited” corrosion processes (Table 5); and
• The flux of sulfide to the container surface during the long-term anaerobic phase.

The total corrosion allowance depends on the container design and assumptions regarding the initial state of the container. The nominal wall thickness of the outer corrosion barrier of the KBS-3 copper-cast iron canister is 50 mm [14] but, for the purposes of lifetime prediction, a thickness of between 32 mm [4] and 45–49 mm [14] is assumed to account for factors such as post-weld machining and coincident defects in the container wall and external mechanical damage during handling. For copper-coated container designs, the thickness of the corrosion barrier is typically 3 mm [11,33,36], all of which is assumed to be available for the purposes of calculating the container lifetime.

The sums of the different allowances for the limited corrosion processes are summarized in Table 5. Clearly, if the available total corrosion allowance is only a few mm then there is a need for greater certainty in the individual allowances than if the total corrosion allowance is of the order of a few cm, as in the KBS-3 canister design. In particular, a detailed mechanistic understanding is required for localized corrosion processes and such studies are a key component of the R&D programs of those WMOs considering a copper-coated design.

Lastly, the flux of sulfide to the canister surface depends on assumptions about the nature of the sulfide source term and the mass-transport properties of the buffer. In addition to the factors described in Section 3.1.2, the other major factor affecting the flux of sulfide is whether the bentonite buffer maintains diffusive conditions or not. For intact, as-emplaced bentonite, mass-transport is dominated by diffusion, with typical sulfide fluxes of the order of 10⁻¹⁸ to 10⁻¹⁶ mol cm⁻² s⁻¹ [3,40]. However, loss of buffer density by chemical erosion can permit advective transport, with sulfide fluxes of the order of 10⁻¹⁶ to 10⁻¹⁴ mol cm⁻² s⁻¹ or approximately two orders of magnitude higher than for intact buffer [3,40]. In addition to the increased sulfide flux associated with a reduced buffer density, there is also the possibility of localized corrosion and biofilm formation and microbial activity in the deposition hole, as described above.

In terms of the resulting canister lifetimes, detailed assessments have been performed by SKB [15] and Posiva [3,4]. If the buffer remains intact and diffusive conditions are maintained, then the predicted lifetimes of KBS-3 canisters exceed 1 million years [3,4,15]. In the case of eroded buffer and with other conservative assumptions about sulfide solubility, a minimum canister lifetime of 280,000 a was predicted for Posiva’s SC-OLA, with a further 40–60 canisters out of the total of 3304 canisters failing within 1 million years [3,4]. Rather than predict the precise lifetime, or distribution of lifetimes, WMO’s investigating the use of copper-coated containers tend to express their predictions in terms of the corrosion allowance required to provide containment for a given period of time [11,33,36], although the implication is that containment periods of 1 million years or longer are also possible with thin copper corrosion barriers.

3.1.4. Example of PA Model Abstraction and Treatment of Uncertainty

The treatment of the long-term sulfide corrosion of copper canisters in Posiva’s SC-OLA provides an interesting example of the relationship between deterministic process models and an abstracted PA model, as well as the handling of uncertainty and variability [3,4,5]. The SC-OLA safety case involved a number of complementary models for the production, transport and consumption of sulfide [3]. These complementary models included detailed reactive-transport process models based on Monod microbial kinetics to describe the rate of sulfide production in the repository [5,6,7]. However, such detailed models are too complex to include in a PA model designed to predict the corrosion rates on a repository scale involving over 3000 canisters. Instead, a simplified sulfide production model was abstracted from the detailed deterministic model based on the simplifying assumption that all of the sulfate reaching the deposition hole is reduced to sulfide by microbial activity. Such a simplified model is clearly conservative and implicitly assumes that the microbial activity is not limited by the availability of electron donors (organic carbon and/or H₂). The spatial distribution of groundwater sulfate concentrations in the repository was available from ancillary groundwater flow models, and included temporal variations in groundwater [${\mathrm{SO}}_4^{2-}$] due to periodic future glaciation events. (At the Olkiluoto repository site, there is isotopic evidence for the periodic intrusion of saline waters to repository depth as the site becomes submerged due to an increase in sea level during glaciation events.) In order to simulate the sequestration of a fraction of the microbially produced sulfide by reaction with Fe(III)/Fe(II) minerals, a level of detail that was included in the process models but not in the abstracted PA model, a solubility limit was applied to the sulfide (i.e., sulfate) concentration in the PA model to simulate solubility control by the precipitation of iron sulfide. In this manner, the abstracted PA model captured a number of the details of the underlying process model but without a level of complexity that would have made application on a repository scale intractable.

The repository scale PA model was also used to address different sources of uncertainty in the system. For Posiva’s SC-OLA, each source of epistemic uncertainty (“key factor”) is characterized by different quantitative values (“key factor states”) representing the base scenario (State 0) and different levels of uncertainty (States 1 and 2). One of the key factors, i.e., areas of uncertainty, for the sulfide transport PA model is the extent to which sulfide will be sequestered by reaction with Fe-containing minerals. For, the base scenario State 0, almost complete sequestration was assumed, consistent with the results from the detailed process modelling [5,6,7]. The different levels of uncertainty were represented by different limits for the sulfide (sulfate) concentration representing uncertainty in the solubility of mackinawite, with State 1 defined as a solubility of 10⁻⁴ mol/L and State 2 as a solubility of 3 × 10⁻⁴ mol/L, with State 2 resulting in a worse outcome (i.e., a higher corrosion rate) than State 1. Canister lifetimes were calculated for the base scenario and the two key factor states as a way of quantifying the effect of uncertainties in the system.

3.1.5. Other Assessments

Several other assessments of the lifetime of copper containers have been published, in addition to those listed in Table 5. The results of earlier PA models have been summarized elsewhere [51], including assessments from Sweden and Finland, Canada, Japan and Switzerland that have been largely superseded by the assessments in Table 5. For the Korean program, Hwang [52] focussed on the effects of the supply of sulfide from the groundwater and of the mass-transfer resistance of the fractured host rock. Based on the assumption of a transport-limited corrosion rate and a rather high groundwater [HS⁻] of 2 × 10⁻⁴ mol/L, container lifetimes for a KBS-3 style repository design were predicted to be >5 × 10⁹ a for mass-transfer properties derived from crystalline rock in Korea, despite the assumption of a pitting factor of 5 under anaerobic conditions, for which no rationale was provided. These calculations were for intact bentonite and illustrate the large mass-transport resistance of highly compacted bentonite.

3.1.6. Summary

In summary, there is a general consensus between different WMOs regarding the main forms of corrosion that will, and will not, impact the lifetimes of copper HLW/SF containers under repository conditions. The various PA models that have been developed are also consistent and are based on a series of corrosion allowances for processes of limited extent and/or limited duration, with the remainder of the corrosion barrier available for long-term corrosion by sulfide. The container lifetime is then calculated based on a mass-transport calculation of the rate of supply of sulfide to the container surface. In essence, this is the same approach that was recommended by the Swedish Corrosion Institute in their 1978 assessment [39].

3.2. Prediction of the Lifetime of Carbon Steel Containers

In addition to copper, the other candidate container material most frequently selected by WMOs is carbon (or mild) steel (Table 2). Carbon steel is a good candidate material because of the generally predictable corrosion behaviour and the extensive experience in the fabrication and application of ferrous materials. Carbon steel also offers flexibility in container and DGR design, being suitable for both single- and dual-wall container designs and either clay-based or cementitious buffer materials.

This section is structured differently from that in the previous section and describes the approaches used by different WMOs separately rather than collectively as was done for copper. This different structure reflects, in part, the different approaches used by the different organizations, with much less consistency of approach than is the case for copper containers.

Table 6. A summary of performance assessment models for steel HLW/SF containers.

Corrosion Process	NUMO, Japan [18,53]	Nagra RBG [2]	Andra DAC [54]	ONDRAF/NIRAS [55,56,57]
Aerobic uniform corrosion	Mass-balance calculation based on initial O2 inventory.	Excluded on the basis that the maximum extent of corrosion is small compared with the wall thickness.	The ingress of O2 to the disposal cells will be limited during the operational phase by the design of the plug and cementitious backfill around the outside of the borehole liner. A conservative corrosion rate of 10 μm/a is specified to account for possible residual O2.	Empirically based corrosion rate for each period during the Corrosion Evolutionary Path (CEP).
Aerobic localized corrosion	Depth-dependent pitting factor based on empirical data.	Excluded on the basis that any surface roughness or pits will be removed by subsequent anaerobic corrosion.	Excluded based on selection of alloy with low inclusion content.	Pits could initiate during the initial oxic phase, but will stifle once anoxic conditions have been established within the concrete buffer.
Anaerobic uniform corrosion	Constant rate of 2 μm/a based on empirical data.	Normal distribution of corrosion rates with a mean of 0.3 μm/a and a standard deviation of 0.1 μm/a.	A conservative corrosion rate of 10 μm/a is specified to account for corrosion during both the operational and disposal stages, including the effects of microbial activity and residual O2.	Empirically based corrosion rate for each period during the CEP.
Anaerobic localized corrosion	Extreme value analysis of empirical data.	Excluded on the basis that will not occur under anaerobic conditions.	Excluded based on selection of alloy with low inclusion content.	-
SCC	Excluded based on the argument that the appropriate environmental conditions will not exist in the repository and use of post-weld stress relief to reduce tensile residual stresses.	Excluded on the basis that the absence of cyclic loading and of a suitable environment will not support SCC.	Excluded based on non-susceptibility of selected steel grades for the borehole liner and container in relevant environment and over range of electrochemical potentials [58]. In addition, post-weld heat treatment will be used to reduce the level of residual stress in the container closure weld.	Excluded based on empirical evidence from slow strain rate testing.
HIC	Excluded using the same arguments as for SCC.	Failure by fracture or plastic collapse if the stress intensity factor (SIF) for defects in the closure weld exceed the threshold SIF for slow crack growth, with the latter a function of the H2 gas pressure.	Excluded on the basis of the choice of steel grade, composition and microstructure.	-
MIC	Excluded because of the presence of highly compacted bentonite which suppresses microbial activity. Remotely produced sulfide not considered to increase corrosion rate of carbon steel based on empirical evidence.	Excluded on the basis that the presence of highly compacted bentonite will suppress microbial activity. The impact of remotely produced sulfide is considered insignificant based on reactive-transport modelling.	The uniform corrosion rate of 10 μm/a includes any effects of microbial activity.	Excluded based on the alkaline pH of the cementitious buffer.
RIC	Excluded on the basis that the surface dose rate is less than the threshold of 3 Gy/h for an effect of radiation based on empirical evidence.	Excluded on the basis that the maximum surface dose rate is less than the empirical threshold (1 Gy/h) for a significant effect of radiation.	Excluded on the basis that no significant effect on the corrosion rate is observed at the maximum dose rate of ≤10 Gy/h.	Excluded based on experimental evidence of no significant impact for the highest dose rate expected.
Resistance to external loads	Minimum thickness estimated assuming maximum isotropic pressure of 11 MPa.	External loads contribute to the assessment of HIC based on the SIF for defects in the closure weld.	A buckling wall thickness allowance of 15 mm is assumed.	-
Overall lifetime assessment	Reference 190 mm wall thickness sufficient to provide minimum 1000-year lifetime.	Reference 140 mm wall thickness sufficient to provide lifetimes greater than 10,000 a.	Container lifetimes of 550 a and 3800 a for wall thicknesses of 20.5 mm and 53 mm, respectively.	No formal estimate of overpack lifetimes has yet been made, but will be based on the time required for the passive corrosion rate to consume the corrosion allowance.

summarizes a number of current programs proposing the use of carbon steel containers and which are discussed in more detail below. First, though, we start with a review of early work from the UK, which was among the first to develop a detailed PA model for carbon steel containers.

3.2.1. Early UK Modelling Studies

One of the first complete assessments of the lifetimes of carbon steel HLW/SF containers was that done by Marsh and Taylor [59] for the early UK nuclear waste program. The assessment was aimed at establishing the minimum wall thickness required to provide 1000 a containment using a carbon steel HLW container with a compacted bentonite buffer in a DGR in granitic host rock. The corrosion processes considered were (i) uniform corrosion, including the effect of γ-radiation; (ii) localized corrosion in the form of pitting, (iii) SCC; and (iv) MIC. Two approaches were used to predict the extent of uniform corrosion, namely: extrapolation of empirical corrosion rates and an electrochemically based reactive-transport model, resulting in corrosion allowances of 20 mm and 216 mm, respectively. The electrochemical model prediction was considered to be conservative, as the calculation did not take into account the effects of decreasing container temperature or the protective nature of precipitated corrosion products. In both cases, the effect of γ-radiation was accounted for using an empirically determined effective G-value for radiolytic oxidants. Pit growth was modelled based on an empirically determined expression and the conservative assumption that pitting was possible at all times, despite the expected consumption of the initially trapped O₂. A maximum pit depth of 200 mm was predicted after 1000 a, but this was considered to be overly conservative as it was based on the extrapolation of short-term experimental measurements. A mass-balance calculation (based on the assumption that the inventory of organic matter was limiting) was used to predict the maximum extent of corrosion by SRB, which amounted to an additional 13 mm of corrosion. Environmentally assisted cracking was excluded based on the arguments that (i) post-fabrication stress relief could be used to reduce the level of residual stress below 50% of the yield strength and, hence, preclude the possibility of SCC; and (ii) the specification of a low-strength grade of carbon steel would reduce the susceptibility to hydrogen-related degradation mechanisms. Based on these individual assessments, it was concluded that a container with a wall thickness of 200–250 mm would provide a minimum containment period of 1000 years. Many of the same methods are still used to predict the extent of corrosion of carbon steel HLW/SF containers and, although there is more certainty in some of the corrosion rates and more-substantive arguments for the exclusion of environmentally assisted cracking (EAC), the same general approach to lifetime assessment and the same corrosion processes remains relevant to this day.

3.2.2. Generic NUMO (Japan) PA Model

The Japanese program is at a generic stage until such time that a specific site and repository concept have been selected, with carbon steel as the current reference container (overpack) material. The main safety function of the overpack is to prevent contact between the waste and groundwater, which contributes to the basic safety requirement of restricting the leaching of radionuclides [18]. In turn, these safety requirements led to a number of design requirements, including (i) a sufficiently low corrosion rate to provide containment for a prescribed period of time; (ii) a low radiation field to prevent significant acceleration of the corrosion rate; (iii) structural integrity to prevent mechanical failure due to the applied loads; (iv) a design that can be fabricated with current or foreseeable technology; (v) the ability to remotely encapsulate the waste; and (vi) the ability to remotely emplace the waste in the repository. The first two of these design requirements relate directly to the corrosion behaviour of the canister and are used to define a minimum wall thickness necessary to provide containment for a period of 1000 a.

The corrosion-related considerations used to define the overpack wall thickness are summarized in Table 6 [53]. A mass-balance argument is used to assess the extent of uniform corrosion due to the initially trapped O₂, with an empirical corrosion rate of 2 μm/a used to account for anaerobic corrosion. A depth-dependent pitting factor and statistical extreme value analysis are used to account for localized corrosion under aerobic and anaerobic conditions, respectively, both based on analyses of empirical data. Reasoned arguments are used to exclude both SCC and HIC; the former due to a combination of the absence of a suitable environment and the use of post-weld heat treatment to reduce residual stress, and the latter due to the low susceptibility of the selected grade of carbon steel in combination with a low absorbed hydrogen concentration under repository conditions. Lastly, RIC is excluded from consideration because the wall thickness is sufficient to ensure that the maximum surface dose rate is less than the level of 3 Gy/h found experimentally to result in no significant enhancement of the rate of corrosion.

Based on these considerations, as well as the requirement to provide sufficient structural integrity, it is concluded that an overpack wall thickness of 190 mm will provide containment for the prescribed period of 1000 a [18,53].

3.2.3. Nagra’s General Licence Application (RBG)

Nagra are currently preparing a general licence application (RBG or Rahmenbewilligungsgesuch) for the planned combined repository for low- and intermediate-level and high-level radioactive waste in Switzerland. The proposed repository is located at a depth of 800–900 m in Opalinus Clay in the Nördlich Lägen region in northern Switzerland. Carbon steel is the reference canister material for both HLW and spent fuel. The canister is required by regulation to have a minimum lifetime of absolute containment of 1000 a, although Nagra have defined a design lifetime of 10,000 a [2]. Demonstration of the minimum lifetime of 10,000 a will be based largely on empirically determined corrosion rates and the exclusion of SCC and HIC based on reasoned arguments.

In parallel, however, a more-detailed model is being developed to predict the distribution of canister lifetimes, referred to as the Probabilistic Canister Breaching Model (PCBM). Unlike the PA models for copper and for steel described to this point, the PCBM takes a more holistic approach to predicting canister corrosion rather than an assessment based on separate corrosion allowances for different corrosion processes. Canister failure (breaching) is based on an assessment of both the corrosion behaviour and time-dependent structural integrity of the canister using a well-established fracture mechanics approach. The PCBM is an example of a joint mechanical-corrosion process model described in Part 1 of this review [1]. Instead of assigning separate allowances for corrosion resistance and mechanical strength, the PCBM assesses the lifetime of the canister by taking into account all processes that may ultimately lead to canister breaching, as well as their interactions. Importantly, the PCBM links the fabrication of the canister to the post-closure behaviour through the assessment of the impact of manufacturing defects on the long-term performance. Lastly, as the name implies, the PCBM is a probabilistic code that accounts for variability and uncertainty through the use of Monte Carlo methods to produce a distribution of breaching times.

As with the other PA models described here, the PCBM accounts for a wide range of corrosion processes, although a number of them are excluded as insignificant and having no impact on the breaching time (Table 6). Thus, aerobic uniform and localized corrosion are both excluded because the uniform wall loss is trivial (maximum of a few hundred μm) compared with the wall thickness of 140 mm and because any localized corrosion will be removed by the subsequent anaerobic corrosion prior to canister breaching. Under anaerobic conditions, uniform corrosion will not only contribute to the reduction of the load-bearing wall thickness but will also produce H₂ which could lead to HIC of the canister (see below). However, in the absence of O₂, any localized corrosion will be minor under anaerobic conditions and is not considered in the lifetime assessment. As in other programs, SCC is excluded from consideration because of the absence of a suitable environment and because of the reduction in residual stress by post-weld heat treatment. Lastly, MIC and RIC are excluded because of the presence of highly compacted bentonite buffer material and because of the low surface dose rate, respectively (Table 6). This then leaves anaerobic uniform corrosion and HIC as the two processes that could lead to canister breaching. Unlike the early UK and Japanese programs described above, HIC is of concern because the low permeability of the Opalinus Clay host rock could lead to the development of a H₂ gas phase at the canister surface, with a pressure as high as 10–15 MPa [2].

Breaching of the canister is assessed using a fracture-mechanics approach based on the acceptability of flaws in metallic structures subject to residual stresses and applied loads. The methodology used is based on that described in standard procedure BS 7910 [60], but other standard methods could also be used. Breaching occurs as a result of either global plastic collapse or because of fracture or local plastic collapse due to the presence of a defect. The breaching time is defined as the point at which an assessment point plotted on a failure assessment diagram crosses the envelope that separates “safe” from “unsafe” conditions [2,22]. Wall thinning by anaerobic uniform corrosion will lead to an increase in stress on the canister which will increase the likelihood of either plastic collapse or fracture, whereas the absorption of hydrogen and the resulting HIC will increase the likelihood of fracture. Whether the ultimate breaching mechanism is plastic collapse or fracture, or a combination of the two, will depend on the relative rates of wall thinning and of embrittlement of the canister material.

As noted above, an important feature of the PCBM is that it links canister fabrication and inspection procedures to the subsequent long-term performance. Flaws in the closure weld act as local stress raisers and can induce fracture or local plastic collapse when subjected to residual stresses or applied loads. The propensity for fracture is enhanced by hydrogen absorption. The number as well as the shape, size and orientation of flaws will depend on the welding procedure, as well as on the capability of the remote inspection techniques to detect and size the flaws.

The PCBM also accounts for different sources of variability and uncertainty. Uncertainty may arise due to the value of the anaerobic corrosion rate or the extent to which the fracture toughness of the weld material is reduced by the absorption of hydrogen. Sources of variability include the time dependence of the temperature and the H₂ pressure at the canister surface. Each of these model inputs is described by a probability density function from which a single value is chosen for a given model realization, with many such realizations (up to 1 million) used to address the impact of the uncertainty and variability in the system. The primary output of the model is the temporal distribution of canister breaching times.

3.2.4. Andra’s Cigéo Construction Licence Application (DAC)

A series of laws passed by the French parliament have defined the process for the management of radioactive wastes in France, including the storage and disposal of HLW (and SF should it be deemed to be a waste). The ”Bataille” law of 1991 involved three lines of investigation; namely: transmutation, interim surface storage for a period of 300 years and deep geological disposal. This approach has been refined by the “waste” law of 2006 and the planning act of 2016, which defined the concept of reversibility and established reversible storage in a deep geological formation as the reference concept.

These changes in the legal framework have impacted the nature of the corrosion R&D and of the predictive modelling in the French program. In the context of the original “Bataille” law, Hélie et al. [61] described an assessment of the extent of corrosion of HLW containers during a period of 300 years surface storage. Corrosion of the steel containers was assumed to be uniform in nature, with no consideration of localized corrosion or EAC. Cooling of the HLW containers by natural convection of air coming into the facility resulted in an early period (of at least 100 years) of dry air oxidation at a relative humidity (RH) of <40%, followed by a period of atmospheric corrosion at RH ≥ 80%. Both empirical and mechanistic models were applied to the period of dry oxidation, with an empirical model based on the results from long-term exposure tests used for the period of atmospheric corrosion. The predicted depth of corrosion over the entire 300-year storage period due to dry air oxidation and atmospheric corrosion was estimated to be between 0.35 and 1 mm, or <2% of the nominal container wall thickness.

More recently, Andra has focussed on the concept of reversible deep geological disposal of HLW based on the Cigéo project for a joint HLW-ILW facility located at Bure in north-eastern France [62]. A construction licence application (Dépôt de la demande d’autorisation de creation, DAC) was submitted to the French nuclear safety authorities at the beginning of 2023. The concept for the disposal of HLW involves placing the primary stainless steel canisters containing the vitrified waste inside carbon steel storage containers which are then emplaced in horizontal boreholes drilled into the sedimentary Callo-Oxfordian argillaceous host rock. Carbon steel liners are used to prevent the boreholes from collapsing and will delay the lithostatic loading of the containers until the liners have eventually corroded. A cementitious grout is placed between the outer surface of the liner and the host rock to counteract the effect of acidic conditions produced by the oxidation of pyrite in the host rock during the operational phase, thus extending the service life of the liner. The horizontal boreholes, liners and HLW containers collectively comprise the “HA cells”, which will eventually accommodate a total of approximately 56,000 HLW containers [63] divided between an initial pilot phase and subsequent storage phase. There are a number of different types of HA storage containers, with a minimum wall thickness of either 20.5 mm or 53 mm [63]. The purpose of the pilot phase is to demonstrate the viability of the disposal system and to allow monitoring during the operational phase. The pilot phase may last for 15–25 a [64], with a total operational phase of perhaps 100 a [64].

The safety function associated with the HA containers is the prevention of water from coming into contact with the waste. In order to address uncertainties in the mechanism and rate of alteration of the glass matrix at elevated temperature, the container is required to remain intact until the waste has cooled to a temperature of 50 °C in the pilot area and 70 °C in the storage area, the higher temperature limit in the storage area reflecting the expectation that further insight into the alteration mechanism will be available following the pilot phase. There is also a requirement that the container remain intact until the level of short-lived radionuclides has decayed to a certain level. Together, these requirements translate into a minimum container lifetime of 350–500 a for the different types of HA cells [54].

The environment within the HA cells is controlled during the operational phase to minimize the extent of corrosion of the carbon steel storage containers. Thus, the closure plug for the HA cells is designed to prevent the ingress of O₂ from the access tunnels, with flushing with an inert gas also used for the pilot cells. The target is to maintain an O₂ concentration of <1 vol.% in order to minimize corrosion. The small amount of water that is expected to enter the HA cells during the operational phase (a few m³ per year per cell) will be drained away [10]. After repository closure, the HA cells are expected to fill with groundwater relatively quickly, although complete saturation will be delayed by gas (H₂) generation due to anaerobic corrosion of the containers and borehole liner [10]. For the purposes of the post-closure safety assessment, the HA cell environment is assumed to be saturated and anoxic.

Carbon steel was selected for the storage containers and liner because the corrosion behaviour is expected to be dominated by uniform corrosion in the repository environment. In particular, a forged steel with good ductility, a low inclusion content and a fine-grained ferrite-pearlite microstructure was selected to minimize the susceptibility to SCC [58] and HIC, as well as to localized corrosion [63]. Post-weld stress relief will also be used to minimize the level of residual stress and the susceptibility to SCC [63].

Uniform corrosion is accounted for using a corrosion rate of 10 μm/a. This relatively conservative rate is used for both unsaturated (humid) conditions during the operational phase as well as the saturated post-closure period, including the possibility of some residual O₂ during the operational phase. This rate also includes any contribution from microbial activity. [54]. Any effect of irradiation is excluded on the basis that no significant effect on the corrosion rate is observed at the maximum dose rate of ≤10 Gy/h [54,65].

The lifetime of the containers is simply calculated from the nominal wall thickness, minus a mechanical buckling allowance of 15 mm, divided by the assumed corrosion rate of 10 μm/a. Lifetimes range from 550 a for the HA containers with a wall thickness of 20.5 mm to 3800 a for the majority of containers with a wall thickness of 53 mm [54]. For the post-closure safety assessment, no credit is taken for the delay in radionuclide release due to the primary stainless steel canister.

The safety assessment comprises a number of scenarios to address various levels of uncertainty [54]. Under the normal evolution scenario, no storage containers fail prior to the required minimum lifetime of 350–500 a. An altered evolution scenario is also defined in which a “few” containers are assumed to malfunction (i.e., to lose containment prior to the minimum lifetime) to represent the situation of an isolated defect or lack of quality control affecting a limited number of containers. A broader loss of containment in which all storage containers are assumed to malfunction is covered by a “what-if” scenario.

3.2.5. ONDRAF/NIRAS’ Supercontainer Concept

The design philosophy behind the Belgian supercontainer concept is to ensure passivation of the carbon steel overpack through the use of a cementitious buffer material [55,57]. Under passive conditions, uniform corrosion is expected to be the only form of corrosion of consequence [57]. The possibility of localized corrosion and SCC are excluded based on either deterministic or empirical evidence [56,66,67], with cracking currently excluded on the basis of slow strain rate tests generally used to rank the relative susceptibility to SCC.

This design philosophy has implications for the PA model used to predict overpack lifetimes. Although no formal assessment of the expected lifetimes has yet been published, the approach would be based simply on the time required to consume the corrosion allowance by slow passive corrosion. A reliable estimate of the passive corrosion rate is clearly important in this case [57,67].

3.2.6. Summary of the Status of Carbon Steel HLW/SF Container PA Modelling

Robust PA models for carbon steel containers have been developed by a number of WMOs, with various aims in mind (Table 6). In some cases, the aim is simply to demonstrate a minimum target lifetime, whereas in others the aim is to predict the distribution of container lifetimes. Unlike the PA models for copper containers which are all very similar, a broader range of approaches has been used for carbon steel containers, ranging from the relatively simple, based on an empirical corrosion rate, to the more complex, involving a holistic approach to both corrosion and mechanical degradation mechanisms.

3.3. Prediction of the Lifetime of Titanium Containers

Titanium alloys have been assessed as a container material for the disposal of SF in Canada [19,20,68,69] and both HLW [70] and TRU waste [71,72] in Japan. (In Japan, “TRU” waste is defined as long-lived low-level waste from reprocessing activities and MOX fuel fabrication and contains radionuclides such as C-14 and I-129 as well as transuranics [73]).

Table 7. A summary of performance assessment models for titanium HLW/SF containers.

	AECL [19,20,68,69]	JNC [70]	RWMC [71,72]
Material/container	Grade-2	Grades-1, -2, -7, -12, -17	Various Ti-Pd alloys
Uniform corrosion	Excluded based on the argument that the rate of uniform corrosion is low compared with the rate of crevice propagation.	Empirical corrosion rate from long-term tests (applicable for both aerobic and anaerobic conditions).	Depassivation of Ti in alkaline saline environment of TRU-waste repository shown not to occur. Passive current density measured electrochemically and used to predict the rate of H pick up.
Crevice corrosion	Initiation of crevice corrosion assumed possible on all containers. Empirically based temperature-dependent crevice propagation rate, with no stifling despite consumption of O2 in repository.	Excluded based on the selection of a grade of material that would be immune to crevice corrosion for the site conditions (temperature and [Cl−]).	Excluded for Ti-Pd alloys containing at least 0.01 wt.% Pd based on comparison of ECORR and ERCREV.
Pitting	Pitting potential exceeds 5 V and, therefore, Ti considered to be immune to pitting under repository conditions.	Pitting potential exceeds 5 V and, therefore, Ti considered to be immune to pitting under repository conditions.	-
Hydride-induced cracking (HIC)	Containers that do not fail due to crevice corrosion are assumed to fail by hydride-induced cracking once the temperature falls to 30 °C due to H absorbed during crevice corrosion.	Based on threshold HABS for HIC of approximately 500 wppm. Increase in [HABS] calculated based on empirical corrosion rate and assumption of 100% H pick-up. Assume initial [HABS] of 50 wppm. As an alternative, also measured H pick-up experimentally. Total [HABS] after 1000 a < 340 wppm (based on calculation) or 11–16 wppm (based on experiment).	Based on HIC mechanism involving progressive fracture of surface layer of acicular hydrides. Critical hydride layer thickness for cracking of 10 μm. Empirical relationship between hydride layer growth rate and current density. Based on measured ipass, hydride layer thickness predicted to be either 30 μm [71] or 1.3 μm [72] thick after 60,000 a.
SCC	Ti considered to be immune to SCC under repository conditions.	Ti considered to be immune to SCC under repository conditions.	-
MIC	Ti alloys considered to be immune to MIC due to the absence of multiple oxidation states.	Ti alloys considered to be immune to MIC due to the absence of multiple oxidation states.	-
Other considerations	Between approximately 1 in 104 and 1 in 103 containers fail due to undetected defects within the first 50 years post-closure. Model accounts for spatial distribution of container failures in the repository.	-	-
Overall lifetime assessment	Earliest container failure after 300 a (due to HIC), but only 0.06% of the total of 140,000 containers would fail by 1000 a. Majority of containers fail by crevice corrosion between 1200 a and 2500 a, with all containers failing by ~6000 a.	No container failure in less than 1000 a based on slow uniform corrosion and limited H absorption.	No HIC failure within 60,000 a, corresponding to 10 half-lives of C-14.

summarizes the corresponding PA models, including the treatment of various corrosion processes and the range of predicted container lifetimes.

The two main corrosion processes of concern for Ti containers are crevice corrosion and hydride-induced cracking (HIC). The rate of uniform corrosion is minimal (of the order of nm/a) under both aerobic and anaerobic conditions due to the stability of the TiO₂ passive film. This film is also highly resistant to both pitting and MIC, and SCC has not been reported in repository-relevant environments.

The resistance to crevice corrosion depends on the composition of the Ti alloy and, in particular, the Pd content [74]. Atomic Energy of Canada Limited (AECL) were the first to propose the use of Ti containers and assessed the corrosion resistance of commercially pure (CP) Ti Grade-2. This alloy is susceptible to crevice corrosion and the PA model was based on the assumption that initiation was inevitable but that the rate of propagation could be predicted based on the time-dependent container temperature. An empirical crevice propagation expression was used to estimate the time to penetrate the 6.35-mm-thick container wall, with the implicit assumption that propagation was not limited by the availability of O₂. The spatial variation of container temperature—and therefore of the rate of crevice corrosion—was also taken into account, with cooler containers around the periphery of the disposal vault and hotter containers in the centre. The entire disposal vault was divided into sectors, with differing numbers of “hot”, “cool” and “cold” containers, with the different sectors linked to sector-specific mass transfer rates in the far-field.

Although crevice corrosion was the main failure mechanism, accounting for 96.7% of the failures of the total population of ~140,000 containers [19], some containers were predicted to fail by HIC. At the time of the original PA model, the understanding of HIC was limited, but was understood to be of more concern at lower temperatures due to the decrease in hydrogen solubility. Failure by HIC was deemed to have occurred if the container temperature fell to 30 °C before failure by crevice corrosion, with the implicit assumption that the material had absorbed sufficient hydrogen for HIC. The containers failing by HIC tended to be the cooler containers around the periphery of the disposal vault, with the earliest failure being ~300 a post-closure. Failure by crevice corrosion predominated between 1200 a and 2500 a post-closure, with all containers having failed by ~6000 a [19].

In a subsequent treatment of HIC, although not as part of a full PA model prediction, failure was deemed to occur by fast fracture once a threshold absorbed hydrogen concentration ([H_ABS]) was reached [24]. Hydriding was viewed as a process affecting the entire material resulting in a loss of fracture toughness. Thus, HIC was treated on the basis of the time to initiation rather than the rate of propagation.

JNC [70] considered a range of Ti alloys for the disposal of HLW, including both CP grades (Grades-1 and 2) and Pd-containing alloys that were highly resistant to crevice corrosion (Grades-7 and -17). The design philosophy was to select a grade that was resistant to crevice corrosion under the expected repository conditions and to base the PA model on an empirical rate of uniform corrosion and the time-dependent absorption of hydrogen, with HIC susceptibility based on a threshold [H_ABS] of 500 wppm from [24]. After 1000 a, the specified minimum container lifetime for this generic stage of the Japanese program, the total [H_ABS] was predicted to be <340 wppm. On this basis, it was concluded that a crevice-corrosion resistant alloy could provide sufficient containment.

Ti-Pd alloys have also been considered as an alternative container material for TRU waste in Japan [71,72]. Again, the design philosophy was to avoid crevice corrosion through the use of resistant grade (an alloy with a minimum of 0.01 wt.% Pd was considered to be sufficient) and to base the lifetime prediction on the HIC behaviour. In contrast to the earlier treatments of HIC [24,70], hydriding was considered to affect only the surface layer with fracturing of the hydride occurring at a critical hydride layer thickness of 10 μm. Cracks were observed to only propagate 50% of the thickness of the hydride layer. Thus, HIC was predicted on the basis of the rate of crack propagation [71,72] rather than on the time to initiation as previously [24,70]. The rate of hydride-layer thickening was related to the passive current density via an empirical relationship between thickness and charge density. In different assessments, the thickness of the hydride layer was predicted to be either 1.3 μm (below the critical thickness for cracking) or 30 μm (with a crack depth of 15 μm) after 60,000 a, corresponding to the target lifetime based on ten half-lives for C-14, one of the main radionuclides of concern in TRU waste.

Grade-7 Ti has also been proposed as the material for the drip shield to be placed over waste packages in the Yucca Mountain repository [12]. Interestingly, the implementing agency (the US Department of Energy) screened out HIC of the drip shield, in part because the proposed repository would be permanently aerobic and the reduction of O₂, rather than of H₂O, would be the primary cathodic reaction [75]. However, in two complementary PA models developed by the Electric Power Research Institute (EPRI), HIC was considered. The drip shield lifetime was based on a threshold [H_ABS] and slow hydrogen absorption on the argument that both O₂ reduction and H₂O reduction would occur concurrently, even under aerobic conditions [76,77,78]. However, for both EPRI models, failure of the drip shields was predominantly due to uniform corrosion rather than HIC as the wall thinning supported by both O₂ and H₂O reduction occurred at a faster rate than embrittlement due to the absorption of hydrogen [77,78].

A generally forgotten performance assessment for Ti containers was that carried out for the disposal of HLW in Sweden, referred to as KBS-1 [79]. At the time, reprocessing was considered an option in Sweden and the KBS-1 system included a 6-mm-thick CP Ti container to house stainless steel flasks containing vitrified HLW, with the Ti containers disposed of in vertical deposition holes with a sand/bentonite buffer material. As in later PA models, the long-term corrosion performance was assessed based on uniform corrosion, crevice corrosion and hydrogen embrittlement. It was considered that crevice corrosion could be avoided because the maximum container temperature and the groundwater [Cl⁻] were expected to be lower than those associated with localized corrosion based on industrial experience. The absence of crevice corrosion would also obviate the possibility of hydrogen embrittlement, since the absorption of hydrogen during crevice propagation was considered to be the major source of absorbed hydrogen. Based on these considerations, and the slow rate of general corrosion, it was estimated that a minimum container lifetime of 500–1000 a was likely. Although the details of the treatment of crevice corrosion and hydrogen embrittlement changed somewhat over the subsequent decades, it is interesting to note that the basic processes considered in this 1977 assessment are the same as those still considered over 40 years later.

In summary, PA models based on the expected corrosion behaviour of Ti alloys have been developed for various applications. Although the models are structured around well-established corrosion mechanisms, predictions are still largely based on empirical data, either in the form of uniform or localized corrosion rates or observed HIC behaviour. Interestingly, two different approaches have been used to predict HIC, one based on the assumption of the initiation of the embrittlement of the entire material and the other based on the propagation of cracks within a superficial hydride layer. There have also been different approaches to the assessment of crevice corrosion, based either on predicting the rate of propagation or on avoiding the possibility of crevice corrosion entirely through the specification of a Pd-containing crevice-corrosion-resistant alloy.

3.4. Prediction of the Lifetime of Nickel Alloy Containers

Although Ni alloys have been investigated as possible HLW/SF container materials in various countries [1], PA models for these alloys are primarily limited to their use as waste packages (WP) for the Yucca Mountain Program (YMP) [12]. Although the YMP has effectively ceased, Yucca Mountain remains the only designated repository site for HLW and SF in the United States based on the Nuclear Waste Policy Act (as amended in 1987).

Table 8. A summary of performance assessment models for Ni-based HLW/SF containers.

	CNWRA [80]	CNWRA [81]	DOE [12,82,83,84]	EPRI [76,77]	EPRI [78]
Model	EBSPAC	EBSFAIL	WAPDEG	EBSPA	EBSCOM
Waste package design	Carbon steel outer barrier with Alloy 825 inner container.	Alloy 22 waste package (WP).	Alloy 22 WP, Ti Grade-7 drip shield (DS).	Alloy 22 WP, Ti Grade-7 DS.	Alloy 22 WP, Ti Grade-7 DS.
Uniform corrosion	Dry air oxidation of carbon steel. Humid air corrosion rate of approximately 10 μm/a. Passive corrosion rate of Alloy 825 of approximately 2 μm/a.	Empirically determined passive current density ipass.	Alloy 22 WP Temperature-dependent uniform corrosion rate based on fit to empirical data. WP surface divided into approx. 1400 patches, with the corrosion rate sampled for each patch. Patches allowed the assessment of the variation of corrosion depth for a given WP. Time to first penetration was determined, as well as the number of penetrated patches as a function of time. MIC enhancement factor of between 1 and 2 for uniform corrosion of Alloy 22. Ti Grade-7 DS Uniform corrosion based on fit to empirical rates (not temperature dependent), with more aggressive environments on top of DS than on underside.	Weibull distribution of temperature-dependent corrosion rates for Alloy 22 based on empirical data. Weibull distribution of uniform corrosion rates for Ti Grade-7 based on empirical data.	Empirically based temperature-dependent rate expression for DS and WP. Microbial enhancement of uniform corrosion rate of WP based on empirical data.
Localized corrosion	Localized intergranular oxide penetration based on diffusion model. Pit initiation on carbon steel based on ECORR ≥ ERP criterion; pit propagation based on empirical time-dependent pit-depth expression. Localized corrosion of Alloy 825 based on ECORR ≥ ERP criterion; pit penetration rate of approximately 200 μm/a.	Initiation based on criterion ECORR ≥ ERCREV, with dependence of ERCREV on T and [Cl−] determined empirically. Stifling occurs if ECORR < ERCREV. Penetration calculated based on empirical power law expression and duration of propagation.	Alloy 22 WP Localized corrosion under aqueous (drip**) conditions, subject to ECORR ≥ ERCREV criterion. Propagation modelled as a constant rate of penetration. Included in PA but shown not to occur in the repository. Localized corrosion due to dust deliquescence screened out. Ti Grade-7 DS Localized corrosion of DS screened out because of the use of a crevice-corrosion resistant grade and because of the very positive potential for film breakdown.	Crevice corrosion of Alloy 22 following failure of the drip shield and provided that the temperature is greater than a critical temperature of 90 °C. Initiation assumed to occur, with time-dependent propagation modelled using a power-law expression with sampled time exponent of 0.1 to 0.3.	Crevice corrosion of WP due to seepage water, with initiation dependent on (i) prior DS failure; (ii) correct seepage water composition; and (iii) threshold temperature. Propagation predicted based on time-dependent power law expression.
SCC	-	-	Alloy 22 WP Slip dissolution model for crack propagation based on threshold stress and crack growth rates. Stresses arise from residual stress from closure weld and mechanical damage during seismic events. Effect of weld flaws on crack initiation and growth taken into account. The environmental conditions necessary to support cracking assumed to be present. Ti Grade-7 DS SCC screened out because corrosion products would block cracks and prevent seepage drips from contacting the waste package.	SCC of waste package closure weld assumed to occur when the depth of uniform and crevice corrosion is sufficient to penetrate to a region of tensile residual stress with an embedded flaw, defined by the flaw depth dflaw.	SCC of WP closure welds contingent on (i) appropriate aqueous environment; (ii) threshold potential; and (iii) tensile residual stress that exceeds threshold stress. Propagation assumed to be fast if crack initiates.
HIC	-	-	HIC of the DS excluded on the basis that the environment is aerobic, the temperature of the drip shields is relatively low, the pH is near-neutral, and there is no galvanic effect to polarize the potential [75].	HIC failure of the DS when the absorbed H concentration (dependent on the rate of corrosion and the hydrogen absorption efficiency) reaches a critical value.	HIC of DS based on rate of H absorption and threshold [HABS] for crack initiation.
Other processes	Galvanic coupling between outer carbon steel corrosion allowance barrier and inner corrosion resistant Alloy 825, with coupled potential determining whether Alloy 825 undergoes uniform or localized corrosion.	Ennoblement of ECORR due to γ-radiation.	Extensive treatment of WP failure due to seismic activity and associated ground motion. Creep of Ti Grade-7 DS of limited extent. Early DS and WP failures due to manufacturing defects considered. Effects of long-term thermal ageing on uniform and localized corrosion screened out because of limited phase transformation for times and temperatures of concern.	All forms of corrosion contingent on the presence of a condensed aqueous phase, which is assumed to be present at temperatures below a threshold value of 120 °C. Waste package failure defined either by the occurrence of SCC or penetration of the wall thickness by a combination of uniform and crevice corrosion. Probabilistic assessment using Monte Caro techniques.	All processes treated using probabilistic (Monte Carlo) methods in order to predict the distribution of DS and WP failure times.
Overall lifetime assessment	2700 a to >10,000 a depending on thermal loading and effectiveness of galvanic coupling between carbon steel and Alloy 825.	37,000 a to >100,000 a depending on assumed passive corrosion rate.	DS failure by uniform corrosion between 20,000 a and 200,000 a. No localized corrosion failures of WP. First WP patch breach by uniform corrosion after ~40,000 a, with failure by SCC possible after 11,000 a.	Minimum WP lifetime approximately 100,000 years, with no failures by localized corrosion, 33% by SCC and the remainder due to uniform corrosion.	15% of WP fail by 1 million years. First failure of DS, WP and combined DS + WP after 40,000 a, 336,000 a and 375,000 a, respectively.

summarizes various PA models that have been developed for the YM repository by the implementing agency (the US DOE); on behalf of the regulator, the Nuclear Regulatory Commission (via their research contractor, the Center for Nuclear Waste Regulatory Analyses, CNWRA); and by the nuclear industry (via the Electric Power Research Institute, EPRI).

As discussed in the next section, the WP design evolved in the YMP as more was learnt about the nature of the underground environment. The corresponding evolution of the US DOE PA code WAPDEG is described in Section 4.2. Table 8 lists an early CNWRA PA model for one of the earlier WP designs comprising a carbon steel outer barrier and an inner Alloy 825 container [80]. An interesting feature of this design is that, following the initial penetration of the outer carbon steel barrier, there is the possibility of galvanic protection of the inner Alloy 825 container due to polarization of the corrosion potential (E_CORR) into a region of immunity from localized corrosion or SCC. The possible benefit of galvanic protection was explored in the PA model EBSPAC and was found to result in WP lifetimes > 10,000 a [80]. However, this particular WP design was eventually superseded because of concerns about the possible effects of Fe(III) ions that would be produced by corrosion of the outer carbon steel container in the aerobic YM environment.

All of the other PA models described in Table 8 relate to the ultimate WP design comprising an outer barrier of Alloy 22, with or without a Ti Grade-7 drip shield (DS). These different models share some common features but also differ in the respective treatments of different corrosion processes. The YM repository is located in the unsaturated zone, so the formation of an aqueous phase on the WP (or DS) surface necessary for any form of corrosion is only possible at temperatures below a threshold value of approximately 120–140 °C, and many of the codes employed such a threshold value to preclude corrosion at higher temperature when the presence of an aqueous phase is not possible. All of the models treat uniform corrosion of the WP (and DS if considered), based either on an experimentally measured passive current density i_pass [81] or on a distributed corrosion rate determined from five-year exposure tests in a range of postulated aqueous environments that could be formed in the disposal drifts [83]. An empirical enhancement factor was also applied in two of the models to account for possible microbial activity [12,79]. Uniquely, the WAPDEG model divided the WP and DS surfaces into a series of patches, each the approximate size of a coupon in the long-term corrosion tests. A corrosion rate was selected for each of these patches from the distribution which allowed the expected variability in corrosion rate across the WP surface to be represented. This procedure resulted in different patches being corroded through at different times, leading to a time-dependent corroded area that was subsequently linked in the overall TSPA code to the ability of water to enter the failed WP and of radionuclides to escape.

All of the PA models also considered the possibility of localized corrosion of the WP. It is worth repeating here that, unlike the majority of DGR designs, the YM repository is in the unsaturated zone and assumed to be permanently aerobic, so that the occurrence of localized corrosion is not necessarily limited to the early thermal transient. Crevice corrosion is only possible in certain environments at temperatures greater than 90–100 °C because of the corrosion resistance of Alloy 22 (pitting resistance equivalent number PREN of 40–70 depending on the scale used). In particular, permissive environments could only form due to the evaporation of seepage drips on the WP surface. Therefore, for models that included a DS, failure of the DS was a prerequisite factor for localized corrosion. In the CNWRA [81] and DOE [12,82,83] models, the initiation of crevice corrosion was assessed based on the electrochemical criterion E_CORR ≥ E_RCREV, where E_RCREV is the crevice repassivation potential (also see the discussion in Section 3.2.4 of [1]). DOE screened out localized corrosion based on these various criteria for the initiation of crevice corrosion and concluded that localized attack was not possible at any time in the evolution of the repository environment (Figure 5). The electrochemical initiation criterion was not employed in the EPRI models [76,77,78], with the result that some cases of localized corrosion were predicted in the Monte Carlo simulations. The extent of propagation was predicted using a power law expression for the time-dependent depth of attack, with a time exponent n of between 0.1 and 0.5 to simulate crevice stifling. However, the number of WP failing by localized corrosion was small and generally occurred at times greater than 1 million years [79].

Stress corrosion cracking of the closure lid welds was also included in the DOE [12,82,84,85] and EPRI [76,78] PA models (The WP was designed with two welded closure lids, inner and outer, with only the outer surface of the outer closure lid weld stress relieved by a non-thermal process. The non-closure lid weld and the body of the WP would be heat treated to relieve residual stresses). In the DOE model, both initiation and crack propagation were considered, the latter based on a slip-dissolution model [85]. For the EPRI models, it was assumed that crack propagation was rapid, and that failure would occur soon after initiation, with the latter contingent on a suitable environment and, for the outer closure lid weld, sufficient uniform corrosion to remove the surface layer of compressive residual stress imparted by the stress-relief process. The inner closure lid weld was only considered susceptible to SCC once the outer lid had failed. SCC was predicted to lead to some WP failures, with the earliest failure in the DOE model after 11,000 a [82].

The DOE also considered the possibility of SCC of the DS, but screened out the process on the grounds that, even if a through-wall crack formed, the tortuous crack path would be filled with corrosion product and the DS would still fulfil its function of preventing seepage drips from contacting the WP surface.

As discussed in the previous section, Ti alloys are susceptible to HIC, including the Pd-containing Grade-7 alloy specified for the DS. The DOE elected to screen out HIC of the DS on the grounds that [75]: (i) the permanently aerobic environment would minimize the extent of H₂O reduction and the formation of absorbable hydrogen; (ii) HIC is generally observed at temperatures higher than that of the DS because of the enhanced H diffusivity at elevated temperature; (iii) the pH of any possible aqueous phase was too high to promote significant H absorption; and (iv) the absence of cathodic polarization of the Ti by contact with a dissimilar metal as commonly observed in practical cases of HIC. EPRI, however, took a different position and considered that HIC was possible, both because the reduction of H₂O could occur at the same time as the reduction of O₂ and because the presence of Pd intermetallic particles in the Grade-7 alloy could act as preferential “windows” for hydrogen absorption [76,77,78]. In both EPRI models, HIC was modelled on the basis of a threshold [H_ABS] for crack initiation (followed by fast fracture), with the initiation time determined by the rate of hydrogen production and a fractional hydrogen absorption efficiency. Qin and Shoesmith [78] suggested that HIC could be an important failure model for the DS, but the EBSCOM model [79] predicted that >99% of DS failures would be the result of uniform corrosion rather than HIC. A major uncertainty in both models, however, was the fraction of the total cathodic current due to H₂O reduction.

Table 8 summarizes the main predictions form the various models. It is difficult to directly compare the predicted failure times because of the overall complexity and differences in formulation of the different models. However, in general, it is apparent that WP lifetimes well in excess of 10,000 a (the initial regulatory compliance period) are achievable with Ni-based alloys, even in the permanently aerobic YM environment.

The corrosion resistance of Ni alloys also makes them suitable candidate materials for containers for deep borehole disposal of nuclear waste. Environmental conditions at depths of several kilometres underground are hotter and potentially more-saline than those at the depth of 400–1000 m associated with conventional DGRs. Payer et al. [86] have estimated the corrosion allowance necessary for a lifetime of 10,000 years for an Alloy 625 HLW container. As in conventional DGRs, the environment evolves over time, with an initial short period (up to 2 years) of warm, oxic conditions, followed by a period (up to 20 years) of hot, anoxic conditions, with temperatures as high as 180 °C. The container then cools gradually to the ambient rock temperature of 60 °C over the following 10,000 years and remains at that temperature indefinitely. Based only on the temperature-dependent rate of uniform corrosion, it was predicted that container failure (defined as the time to consume 50% of the original 9.5 mm wall thickness) would occur after 40,000 years [86]. Although localized corrosion and SCC were not explicitly addressed in the lifetime assessment, the Ni–Cr–Mo alloy selected was specifically chosen for the known resistance of this alloy group to these forms of corrosion. Deep borehole disposal has not received the same level of regulatory oversight as conventional DGRs and further safety assessments that more-rigorously address the possibility of other forms of corrosion may be required in future.

In summary, detailed PA models have been developed for Ni-based alloys (and Ti DS), primarily for the permanently aerobic conditions expected for the YM repository. Because of the permanent presence of O₂, highly corrosion-resistant alloys are required. If it can be shown that localized corrosion and SCC are unlikely under repository conditions, then the lifetime is determined by the rate of uniform corrosion. This then raises the question, which has not yet been thoroughly addressed, of whether relatively short-term empirical corrosion rates can be used for predictions over many hundreds of thousands of years when the composition of the residual alloy after say, 100,000 a will be quite different from that of the original composition on which the empirical rates are based.

4. Evolution of Performance Assessment Models

Safety (or performance) assessments are carried out at different stages of the development and implementation of a DGR. During the development stage, periodic assessments may be performed in order to develop the PA methodology. Later, specific assessments will be required to permit construction, operation and closure of the repository, as well as interim assessments throughout the operational phase. Each country will have their own requirements for periodic assessments based on their respective regulatory frameworks. What is likely, however, is that the nature of the PA model for the containers will evolve over time with successive overall safety assessments.

Evolution of the container PA model is inevitable. Changes to the model may result from new information about specific corrosion mechanisms or improved understanding of the underground environment to which the containers will be exposed. The container design may also change, either because previously conservative assumptions can be relaxed based on new information and a thinner corrosion allowance can be used, or because a more- or less-corrosion resistant alloy can be used based on updated information about the underground environment. The container design may, and perhaps is likely to, change when a program moves from the development stage to the implementation phase and a design is required that is suitable for the fabrication of thousands or tens of thousands of containers.

This evolution in the nature of PA models is illustrated here using two examples. In the first example, the history of safety assessments and the corresponding PA models is described for the KBS-3 canister developed by SKB. This is an example of minor changes in the canister design, but significant improvements to the understanding of the associated corrosion mechanisms and how they are handled in the PA model. The second example follows the history of PA models for the YM repository. In this case, there have been significant changes to the waste package design over the years, largely as a result of increasing uncertainty about the nature of possible aggressive environments that could be formed and the need for alloys of ever-increasing corrosion resistance.

4.1. SKB’s Treatment of the Corrosion Behaviour of Copper SF Canisters

Sweden was the first country to propose the use of copper as a canister material for the disposal of SF dating back to the seminal report from the Swedish Corrosion Institute [87] and the associated KBS-2 safety assessment [88]. The review by the Swedish Corrosion Institute [87] described the types of corrosion that were, and were not, of concern for copper canisters under repository conditions and defined methods for estimating the extent of corrosion for each. With some exceptions, the subsequent safety assessments and canister PA models follow the same general principles first defined back in 1978 and it is a tribute to the members of the reference group responsible for the report that their analysis has stood the test of time.

Table 9. Evolution of SKB’s container design and associated performance assessment modelling.

Safety Assessment	Container Design	Uniform Corrosion (Oxic)	Uniform Corrosion (Sulfide)	Localized Corrosion	SCC
KBS-2 [87,88]	Oxygen-free high-conductivity (OFHC) Cu, minimum wall thickness 200 mm, electron-beam welded lid, cast lead interior.	40 μm after 106 a due to O2 in deposition hole, supplied via the groundwater and in the form of oxidizing radiolysis products.	510 μm after 106 a due to sulfide from groundwater and from microbial activity in the buffer and backfill. Pyrite in buffer not considered to be a source of sulfide.	Rate of pit propagation decreases with time, resulting in more or less uneven attack in the long term. A conservative pitting factor of 25 used to assess maximum possible localized penetration for both aerobic and anaerobic conditions.	OFHC Cu not considered to be susceptible to SCC.
KBS-3 [89]	OFHC or phosphorus deoxidized copper, wall thickness 10, 60, 100, or 200 mm, Pb filled and electron beam closure weld or hot isostatically pressed (HIP) copper power interior, HIP diffusion-welded lid.	30 μm after 106 a due to O2 in deposition hole, tunnel and groundwater. Similar amount due to radiolysis depending on wall thickness.	280 μm after 106 a due to sulfide from microbial activity in the groundwater, buffer and backfill and from pyrite in the buffer and backfill.	Rate of pit propagation decreases with time, resulting in more or less uneven attack in the long term. Pitting factor of 5 (applied for both aerobic and anaerobic conditions) based on additional studies on buried copper objects.	Excluded based on results of experimental study in nitrite solutions.
Swedish Corrosion Institute [90]	Phosphorus-deoxidzed copper (P 20 ppm max.), wall thickness 10, 60, or 100 mm, hot isostatically pressed (HIP) copper powder interior, HIP diffusion-welded lid.	90 μm after 106 a due to O2 in deposition hole, tunnel and groundwater. 0.3–420 μm after 106 a due to radiolysis for wall thicknesses of 200–10 mm, respectively.	590 μm after 106 a due to sulfide from microbial activity in the groundwater, buffer and backfill and from pyrite in the buffer and backfill.	Rate of pit propagation decreases with time, resulting in more or less uneven attack in the long term. Pitting factor of 5 (applied for both aerobic and anaerobic conditions) based on additional studies on buried copper objects.	Excluded based on results of experimental study in nitrite solutions.
Werme [91]	KBS-3 (detailed design not specified).	50 μm after 106 a based on mass-balance for 100% of O2 in deposition hole and a fraction of that in the tunnels. Maximum 40 μm due to radiolysis after 106 a.	270 μm after 106 a from (i) sulfide in buffer and backfill materials; (ii) groundwater; and (iii) microbial activity in deposition hole, tunnel and groundwater.	Pitting factor of 5 applied to corrosion by both O2 and sulfide.	Excluded based on absence of suitable environment and assumption of low stresses in Cu shell due to internal structural support.
SR-97 [92,93,94]	Copper shell with cast iron insert. Minimum Cu shell thickness of 50 mm. An oxygen-free Cu grade specified, conforming with the specifications for ASTM UNS C10100 (Cu-OFE), with 50 ppm phosphorus.	Mass-balance calculation based on 100% of O2 initially trapped in buffer in the deposition hole and backfill in the tunnel, amounting to an average penetration of 300 μm. Negligible corrosion (<1 μm) due to radiolytically produced HNO3 during buffer saturation (assuming 30-a half-life). Intrusion of O2-containing glacial water to repository depth estimated to add an additional 0.1 mm uniform corrosion per event. A few μm atmospheric corrosion prior to emplacement of the canister.	Sources of sulfide considered include: (i) the groundwater, (ii) dissolution of pyrite in the buffer. Microbial activity in buffer excluded based on the high compaction density.	Pitting factor of 5 applied to oxic uniform corrosion only.	Excluded on the basis that neither the environmental nor mechanical conditions necessary for SCC will exist at the repository site.
SR-Can [95,96]	Copper shell with cast iron insert. Minimum Cu shell thickness of 50 mm. Oxygen-free Cu conforming with the specifications for ASTM UNS C10100 (Cu-OFE), with the additional requirements of O < 5 ppm, P 30–70 ppm, H < 0.6 ppm, S < 8 ppm.	20–30 μm due to initially trapped O2 in buffer and backfill. Negligible corrosion (<1 μm) due to radiolytically produced HNO3 during buffer saturation (assuming 30-a half-life). An additional 3 μm due to radiolysis of saturated buffer over a period of 300 a. Intrusion of O2-containing glacial melt water treated by a separate analysis.	Sulfide from (i) pyrite dissolution in buffer (0.1–3 mm corrosion, depending on type of buffer and location on canister surface); (ii) groundwater (<1 mm in 105 a); and (iii) microbial activity in buffer prior to full saturation (4 μm).	Surface roughening under aerobic conditions amounting to ±50 μm, with a similar allowance for surface roughening due to sulfide corrosion.	Excluded on the basis that a suitable environment will not be present in the repository.
SR-Site [14,15,97]	Oxygen-free, phosphorus doped (OFP) copper; 30–100 ppm P, <12 ppm S, <0.6 ppm H, up to a few tens ppm O.	≤500 μm due to initially trapped O2 in buffer and backfill. Negligible corrosion (<1 μm) due to radiolytically produced HNO3 during buffer saturation (assuming 30-a half-life). An additional 14 μm due to radiolysis of saturated buffer over a period of 300 a. Maximum 6 mm due to intrusion of O2-containing glacial melt water. <1 μm atmospheric corrosion prior to disposal.	1–114 μm due to pyrite dissolution (depending on type of bentonite and assumptions regarding pyrite solubility and sulfide diffusivity) Up to 3 mm in 106 a due to microbial activity in buffer (depending on assumed sulfate reduction rate and area of canister affected [14]). Distribution of corrosion rates from 10−9 μm/a to 10−4 μm/a due to groundwater sulfide.	Surface roughening of ±50 μm for localized corrosion under aerobic conditions.	Excluded for aerobic conditions due to absence of suitable environment.
PSAR [32]	Oxygen-free, phosphorus doped (OFP) copper; 30–100 ppm P, <12 ppm S, <0.6 ppm H, <5 ppm O	Maximum 2.5 mm including atmospheric corrosion, uniform corrosion and localized corrosion under aerobic conditions. Negligible corrosion (<1 μm) due to radiolytically produced HNO3 during buffer saturation (assuming 30-a half-life). An additional 3 μm due to radiolysis of saturated buffer over a period of 300 a. <1 μm atmospheric corrosion prior to canister emplacement. Intrusion of O2-containing glacial melt water to repository depth excluded based on geological evidence.	0.001–0.114 mm due to pyrite dissolution (depending on type of bentonite and assumptions regarding pyrite solubility and sulfide diffusivity). Sulfide from groundwater (intact bentonite) 0.06–0.6 mm in 106 a. Sulfide from groundwater (eroded buffer) 0.3–3.2 mm. Plus, conservative allowances after 106 a for: (i) microbial reduction of sulfate in buffer and backfill pore solution (0.5 mm), (ii) gaseous H2S (0.175 mm), (iii) microbial activity supported by organics (0.3 mm), (iv) SRB under biofilm on rock (0.075 mm), (v) SRB supported by H2 from iron/steel corrosion (4 mm).	Included in allowance for uniform corrosion for aerobic conditions. Under aerobic conditions, 150 μm due to micro-galvanic coupling but only for deposition holes experiencing high sulfide fluxes.	SCC under aerobic conditions excluded due to absence of suitable environment. SCC due to sulfide is excluded because the sulfide flux in the repository in less than that found necessary to observe crack-like features in the laboratory.

summarizes the treatment of the different corrosion processes for the KBS-2 and subsequent safety assessments. Although the general characteristics of the PA models may have changed little, the details of how each process is quantified has changed over the years as a result of additional knowledge obtained from a large number of experimental studies conducted by SKB and by other WMOs considering the use of copper containers. There have also been additional processes added to the list of those included in more-recent PA models, such as the atmospheric corrosion of canisters prior to emplacement. There have also been changes to the design of the canister, not least in terms of the proposed wall thickness, but also in terms of the internal structural component. All of these factors have resulted in an evolution of the PA models, as described in this section.

First, let us consider the evolution of the canister design. There are several aspects of the canister design that have changed over the years, including:

• The nature of the internal structural support;
• The minimum wall thickness (corrosion allowance); and
• The copper alloy composition.

At the time of the initial assessment in 1978, the copper wall was supported by casting lead around the SF assemblies to create a void-free structure [87,88]. Later, by the time of the KBS-3 assessment [89,90], the option of filling the internal spaces with copper powder and using hot-isostatic pressing to create a monolithic canister was considered. A number of alternative designs for the KBS-3 system were considered in the Project on Alternative Systems Study (PASS) [98], including a copper/steel canister with flat or hemispherical heads in which the outer copper shell was supported by an internal carbon steel cylinder. This latter design was referred to as the Advanced Cold Process (ACP) canister, in which the voids around the fuel assemblies were filled with particulates, such as glass beads, lead shot, quartz sand, or magnetite [99]. An alternative design was later proposed in which the carbon steel internal vessel was replaced by a cast iron insert [100], which has remained the design of the KBS-3 canister to this date. The cast iron insert provided benefits in terms of criticality control, increased compressive strength and simplified handling procedures in the encapsulation plant.

At the same time that the nature of the internal support structure evolved, so too did the minimum wall thickness of the outer copper corrosion barrier (Table 9). For the first assessments, the wall thickness was defined as 200 mm [87,88], but this had been reduced by the time of the KBS-3 assessment [89,90], for which wall thicknesses of 10, 60, 100 and 200 mm were considered. This reduction in wall thickness was in recognition of the minor amount of damage being predicted (a few mm in 10⁶ a) due to the limited amount of oxidants in the repository. There was also presumably increasing confidence in the robustness of the lifetime predictions with successive safety assessments and a corresponding relaxation of the degree of conservatism. By the time of the PASS study in the early 1990s, a wall thickness of 50 mm became the standard and remains so to this day.

Another aspect of the canister design that has changed over the years is the composition of the copper (Table 9). Although SKB have consistently specified oxygen-free copper, the precise grade has changed from the early specification of commercial alloys (e.g., oxygen-free, high-conductivity OFHC UNS C10100 [87,88] or a phosphorus-deoxidized grade [89,90]) to an alloy with a specific composition designed to improve the corrosion and mechanical properties [32]. This new alloy, generally referred to as oxygen-free copper, phosphorus-doped (OFP Cu), has the following specifications: ≥99.99 wt% Cu for corrosion resistance, 30–100 ppm P and <12 ppm S to improve the creep ductility, <0.6 ppm H to avoid embrittlement, and <5 ppm O to prevent corrosion of grain boundaries [101].

Along with these design changes, the details of the PA models have also evolved, sometimes in a subtle way (Table 9). The extent of uniform corrosion due to the O₂ initially trapped in the buffer and backfill materials has consistently been assessed based on a mass-balance calculation, although varying assumptions have been made over the years regarding the fraction of the O₂ in the backfill that will reach the canister surface. For SR-97, SR-Can and SR-Site, the amount of O₂ that could reach repository depth due to the intrusion of glacial meltwater was also assessed and, for SR-Site amounted to up to 6 mm of additional oxic corrosion [14,15]. However, for the most-recent PA model for the PSAR, this source of O₂ has been excluded because of the conclusion based on geological evidence that the O₂ would be consumed prior to reaching the repository horizon [32,101]. Starting with SR-97, the possibility of atmospheric corrosion of the canister prior to emplacement was recognized, although the extent of corrosion is negligible (<1 μm, Table 9).

The other source of oxidizing species is radiolysis of the near-field environment. An allowance for RIC has been made in all of the PA models, but the methodology used to estimate the extent of corrosion has changed. Up until the SR-97 assessment, the extent of RIC was estimated based on an estimation of the yield of radiolytic oxidants from a radiolysis model and the accumulated dose over periods up to 10⁶ a. Different assumptions were made for the radiolysis model but the fact that the calculations were performed up to 10⁶ a is interesting as the dose rate becomes negligible after a few hundred years, even though the total dose continues to increase. In fact, for a Pb-filled canister with a 10 cm wall thickness containing PWR SF with a burn-up of 33 MWd/t, the total dose increases from 15 kGy after 300 a to 430 kGy after 10⁶ a [102]. For these early PA, models, therefore, the extent of RIC increased with time, as well as with decreasing wall thickness [90]. From SR-97 onwards, separate analyses have been performed for the formation of HNO₃ due to the radiolysis of humid air and for the subsequent radiolysis of buffer porewater following saturation of the near-field. However, in both cases, the calculation was performed only for the first 300 a (equivalent to ten half-lives of Cs-137), based on the argument that this corresponds to the period of highest dose rate (Table 9). In both cases, the predicted damage is minor (<0.1 mm) but this change in approach is implicitly based on the concept that the effect of radiolysis is based on the dose rate (for SR-97 onwards) rather than on the total dose (as in the early assessments).

It has always been recognized that, under anoxic conditions, the major cause of corrosion of the canister is the transport of sulfide to the canister surface. Over the years, different sources of sulfide have been considered. In the very first assessment [87,88], the two sources of sulfide considered were the groundwater (with an assumed concentration of 7 mg/L) and microbial sulfate reduction limited by the amount of organic matter in the buffer and backfill. Pyrite in the buffer and backfill was explicitly excluded as a source of sulfide due to its low solubility. This latter position changed for the KBS-3 assessment [89,90] and pyrite in the buffer and backfill were specifically included as sulfide sources in the PA models. These three sources of sulfide (the groundwater, microbial activity in the buffer and backfill and the dissolution of pyrite) continued to be included in subsequent PA models up until SR-97, for which microbial activity in the buffer was excluded because of the high buffer density and the resulting suppression of microbial activity [92,93,94]. However, based on further experimental evidence, the possibility of microbial activity in the buffer prior to complete saturation and development of the swelling pressure was included again for SR-Can [95,96], and has continued to be included in various ways ever since (Table 9).

The supply of sulfide from the groundwater was a minor contributor to the total depth of corrosion in PA models up to and including SR-Can as the rate of diffusion through highly compacted bentonite was slow. A different sulfide transport model was implemented for SR-Site [14,15], based on advective transport in a fracture intersecting the deposition hole. In addition to intact bentonite, the case of partially eroded buffer was also considered resulting from the slow chemical dissolution of bentonite by dilute groundwater. The loss of buffer mass by chemical erosion will lead to higher rates of diffusive transport and the possibility of advective transport within the buffer. The sulfide flux to the canister surface becomes, therefore, not only a function of the groundwater sulfide concentration but also of whether the buffer is eroded or not. These two extremes, intact and eroded buffer, led to large differences in sulfide flux and, hence, of the corrosion rate due to the supply of sulfide from the groundwater. The sulfide flux for the case of eroded buffer is such that canister failure in times less than 1 million years is possible [14,15]. For intact bentonite that maintains diffusive conditions, predicted canister lifetimes are still much greater than 10⁶ a [14,15,32].

The treatment of localized corrosion has also changed over the course of the various assessments summarized in Table 9. Starting with KBS-2 in 1978 [87,88] and continuing through to SR-97 in the late 1990s [92,93,94], the localized corrosion was quantified using a pitting factor, although it was always recognized that, mechanistically, the pit depth would generally follow a power-law expression with a time exponent n of <1 (as opposed to the value of n = 1 implicit in the use of a pitting factor) [87,88,89,90,91,92,93,94]. The value of the pitting factor used to assess the maximum depth of penetration changed over the course of successive PA models, starting with a conservative value of 25 for the KBS-2 assessment [87,88] and then a “more-reasonable” value of 5 for subsequent models (Table 9). There was also a change to the period over which the pitting factor was applied. Prior to SR-97, the pitting factor was applied to the depth of uniform corrosion under both oxic and anoxic (sulfide) conditions, implying that pitting was considered possible at all times (Table 9). However, for SR-97, the pitting factor was applied to only the depth of oxic corrosion. A more significant change to the treatment of localized corrosion began with SR-Can [95,96], for which the pitting factor was replaced by a surface roughening allowance of ±50 μm. This change was based on the results of laboratory- and full-scale experiments which revealed that copper surfaces exposed to realistic repository conditions do not display discrete pits, but rather a roughened surface characteristic of the non-permanent spatial separation of anodic and cathodic reactions [30]. As with the treatment of pitting for SR-97, this surface roughening allowance was specifically for localized corrosion under oxic conditions. Since SR-97, localized corrosion under anoxic conditions has generally been considered unlikely because, in the absence of O₂, there is no mechanism to spatially separate anodic and cathodic processes. However, for PSAR a surface roughening allowance has been made for “micro-galvanic” corrosion that might be operative at high sulfide fluxes [32].

The other major corrosion process for which the treatment in successive PA models has changed is SCC. At the time of the first assessment in 1978, there was a general opinion that pure metals were not susceptible to SCC [103], and partly for this reason the OFHC material proposed for the canister was deemed to be immune [87]. However, in light of studies of the SCC of pure metals, this position was reconsidered in KBS-3 [89,90], although it was still considered that the canister would not be subject to cracking as the laboratory conditions under which cracking had been observed would not exist in the repository. This has remained the position in all subsequent PA models, and the database supporting the exclusion of SCC from consideration is now considerable [31,51,104].

In summary, SKB’s treatment of copper canister corrosion has evolved over time as improvements have been made in the mechanistic understanding of processes that are, and are not, expected to occur under repository conditions. This improvement in understanding was also accompanied by changes in the canister design, although these design changes were generally unrelated to the corrosion performance and instead were related to canister fabrication and its mechanical performance. The need for interim performance assessments will continue, as may also continued design changes, especially during the implementation stages and repository operation.

4.2. Evolution of the Design and Performance of Waste Packages for the YMP

The second example of the evolution of PA models concerns the Yucca Mountain repository (

Table 10. Evolution of the YMP container design and associated performance assessment modelling.

Safety Assessment	Container Design	Uniform Corrosion	Localized Corrosion	SCC	Other Processes
PA-EA [27]	Type 304 stainless steel (10 mm).	Stylistically modelled as an exponential distribution of failure times with a mean failure time of 104 a. No specific corrosion process was associated with this failure distribution, but it is reasonable to assign it to a combination of uniform and localized corrosion.		Stylistically modelled as an instantaneous failure subject to a minimum WP lifetime of either 300 a or 1000 a.
PA-91 [27]	Type 304 stainless steel (10 mm).	Stylistically modelled as a log uniform distribution of failure times between 500 a and 104 a (mean 3170 a), following a 300 a dry period and a 1000 a saturation period.
PA-93 [27]	Single shell Alloy 825 for vertical in-floor emplacement. Multi-barrier design for horizontal in-drift emplacement, comprising an outer layer (100 mm) carbon steel for structural strength and an inner Alloy 825 (10 mm) corrosion resistant layer.	Temperature-dependent humid air corrosion for both Alloy 825 and carbon steel. Temperature-dependent aqueous corrosion of carbon steel at T < 100 °C. Aqueous corrosion for Alloy 825 not assessed.	Discrete localized corrosion (pitting) of carbon steel not considered as rate of uniform corrosion is high. Pitting of Alloy 825 under wet (not humid) conditions based on empirical pit growth data. Temperature dependent.		Juvenile failures due to manufacturing defects, with a uniform fractional distribution of 0.0005 to 0.0025 for the multi-barrier design and twice as high for the single shell design. Median failure time of ~1500 a for cool repository design and ~4000 a for hot repository design.
PA-95 [27,105,106]	Outer layer (100 mm) carbon steel for structural strength and corrosion allowance, inner Alloy 825 (20 mm) corrosion resistant layer.	Carbon steel Humid air model derived from empirical data, dependent on time, RH, temperature and [SO2]. Aqueous corrosion model with time- and temperature-dependent rate based on empirical data. Alloy 825 Not considered.	Carbon steel Normally distributed pitting factor for humid conditions based on empirical data. Similar normally distributed pitting factor for saturated conditions. Alloy 825 Following penetration of the carbon steel outer barrier, pitting of Alloy 825 occurs under saturated conditions. Temperature-dependent pit propagation rate, with rate expression sampled from a distribution. Pit growth rate assumed to be constant for a given temperature, with no decrease in rate with increasing time.	Possibility of SCC to be considered in future.	MIC to be considered in future. Threshold temperature of 100 °C above which there is no corrosion. Threshold RH (expressed as uniformly distributed ranges) for the onset of humid air corrosion (65–75% RH) and for the transition from humid air to aqueous conditions (85–95% RH). Variability in corrosion rates from waste package to waste package for a given waste package (i.e., from patch to patch). The latter was also used to calculate the area over which the waste package has been penetrated, which was then used for radionuclide transport calculations.
Viability Assessment (PA-VA) [27,107]	Outer carbon steel mechanical barrier, corrosion allowance and radiation shield (100 mm), inner Alloy 22 corrosion barrier (20 mm).	Carbon steel Possible under both drip** and non-drip** conditions, in either humid air or aqueous solution Alloy 22 Following failure of outer corrosion barrier, under either non-drip** or drip** conditions.	Carbon steel Possible pitting under drip** conditions if pH ≥ 10 Alloy 22 Following failure of outer corrosion barrier, localized corrosion possible under drip** conditions subject to pH, [Cl−] and ECORR thresholds.	Possibility of SCC to be considered in future.	Input data derived from literature and expert elicitation. MIC to be considered in future.
Site Recommendation (PA-SR) [25,27,108]	Outer Alloy 22 corrosion barrier (20 mm) and Type 316NG stainless steel inner shell. Dual inner and outer lid system for Alloy 22. Titanium grade-7 drip shield emplaced at repository closure. No backfill.	Alloy 22 Humid air and aqueous uniform corrosion based on fit to empirical rates (not dependent on temperature), including effect of MIC. Enhancement factor for closure-lid weld region due to thermal ageing. Ti Grade-7 Humid air and aqueous uniform corrosion based on fit to empirical rates (not temperature dependent), including effect of MIC.	Alloy 22 Localized corrosion under aqueous (drip**) conditions, subject to ECORR ≥ ERCREV criterion. Screened out and not included in PA. Ti Grade-7 Localized corrosion under aqueous (drip**) conditions, subject to ECORR ≥ ERCREV criterion.	Alloy 22 SCC of closure lid weld region. Slip dissolution model for crack propagation, subject to threshold stress intensity factor for crack initiation (KISCC). No SCC of rest of waste package as drip shield is deemed to prevent damage (and induced stresses) from rockfall. Ti Grade-7 SCC of the drip shield not modelled as it is considered a low-consequence event.	Implemented in probabilistic WAPDEG model. Waste package and drip shield surfaces divided into patches characterized by different environments (e.g., drip versus no drip) and different forms and rates of corrosion.
Licence Application (PA-LA) [12,26,27,28]	Alloy 22 outer corrosion barrier (25 mm) and Type 316NG stainless steel inner shell.	Alloy 22 Temperature-dependent uniform corrosion rate based on fit to empirical data. WP surface divided into approx. 1400 patches, with the corrosion rate sampled for each patch. Patches allow the assessment of the variation of corrosion depth for a given WP. Time to first penetration determined, as well as the number of penetrated patches as a function of time. Ti Grade-7 Uniform corrosion based on fit to empirical rates (not temperature dependent), with more aggressive environments on top of drip shield than on underside.	Alloy 22 Localized corrosion under aqueous (drip**) conditions, subject to ECORR ≥ ERCREV criterion. Propagation modelled as a constant rate of penetration. Included in PA but shown not to occur in the repository. Localized corrosion due to dust deliquescence screened out. Ti Grade-7 Localized corrosion of the drip shield is screened out because of the use of a crevice-corrosion resistant grade and because of the very positive potential for film breakdown.	Alloy 22 Updated slip dissolution model for crack propagation based on updated threshold stress and crack growth rates. Stresses arise from residual stress from closure welding and mechanical damage during seismic events. Effect of weld flaws on crack initiation and growth taken into account. The environmental conditions necessary to support cracking assumed to be present. Ti Grade-7 Assessment of SCC initiation and propagation and creep of Ti alloys. Screened out of PA because of the likelihood of precipitates blocking cracks and preventing seepage drips from contacting the waste package.	MIC enhancement factor of between 1 and 2 for uniform corrosion of Alloy 22. More extensive treatment of WP failure due to seismic activity and associated ground motion. Creep of Ti Grade-7 drip shield of limited extent. Early drip shield and waste package failures due to manufacturing defects considered. Effects of long-term thermal ageing on uniform and localized corrosion screened out because of limited phase transformation for times and temperatures of concern.

).

Detailed reviews of the changes to the YM waste package design and PA model have been published elsewhere [27,109,110]. Here, a brief summary of those changes is given, along with some discussion of the underlying reason for the changes to the WP design and of the treatment of corrosion processes in the PA models.

There were a number of underlying causes for the changes to the WP design and PA models in the YMP, including:

• A desire to dispose of 3000 metric tonnes of heavy metal (3000 t_HM) annually which led to the adoption of larger waste packages.
• Evolution of the understanding of the near-field environment over time as a result of site characterization activities and external inputs.
• Change in regulatory requirements; in particular, an increase in the assessment period from 10⁴ a to 10⁶ a.
• Greater emphasis on the engineered barrier system (EBS) as the main contributor to safety.

Together, these factors led to a shift to larger, hotter, longer-lived WP manufactured from increasingly corrosion-resistant materials.

By legislation, the YM repository was designed to hold 70,000 t_HM of civilian and defence-related SF and HLW [12]. At the desired annual throughput of 3000 t_HM (with a lower amount for the first 4 a of operation), this would result in an operational phase of 25–30 a and require the annual emplacement of approximately 1400 WP of the initial design [109]. This number was reduced to approximately 500 WP/a by changing to a larger, but heavier, design. There was an advantage to using in-drift (in-room) emplacement rather than an in-floor design because of the larger WP and, in a further attempt to reduce the cost of excavation, the adoption of a tunnel boring machine for excavation [109,110]. Since the repository was to be located in the unsaturated zone (UZ), there was no need to backfill the emplacement drifts (since the drifts would not fill up with groundwater) which meant improved heat removal by radiation and convection making the use of larger, hotter WP feasible. This thermal strategy was developed even further by increasing the heat loading (i.e., by reducing the spacing between WP and drifts) to ensure above-boiling temperatures at the drift wall and WP surface for the period of highest radiotoxicity of a few thousand years (Figure 5). In 1999, repository designs were developed for both a High Temperature Operating Mode (HTOM) [111] and a Low Temperature Operating Mode (LTOM) [112], with the former adopted for the design for the licence application.

At the same time that the repository design was changing, the understanding of the in-drift environment to which the WP would be exposed was evolving. In the early years of site characterization in the later 1970s and early 1980s, it was believed that the WP surface would remain dry for an extended period and only become wet once the temperature had dropped below the boiling point of 93 °C at the altitude of the repository. Infiltration was expected to be limited [113], with only a fraction of the annual precipitation reaching the drifts. Limited infiltration, coupled with the movement of water away from the hot WP, was expected to create a “capillary barrier” around the disposal drifts, with porewater diverted to the pillars between drifts. Corrosion testing at this time was conducted in a dilute, fresh groundwater known as J-13 water, or a 10-fold concentration of this water to simulate the possible evaporation on the WP surface [114]. During the subsequent site characterization phase, however, it was found that infiltration was higher than previously thought and that there was the possibility of seepage drips contacting the WP during the thermal transient when the temperature was >120 °C. There was much discussion at this time (late 1990s–early 2000s) about the relative amounts of aggressive (Cl⁻) and inhibitive (${\mathrm{NO}}_3^{-}$, ${\mathrm{HCO}}_3^{-}$, ${\mathrm{SO}}_4^{2-}$) anions present in the seepage drips and the resulting evaporated brines. In response to the possibility of seepage into the drift, the concept of a drip shield to protect the WP was proposed in 1999 [110]. However, a question then arose about the possibility of localized corrosion due to the deliquescence of salts in dust deposits that could form on the WP surface under the drip shields [115]. Dusts were found to contain Cl⁻ as well as ${\mathrm{NO}}_3^{-}$ salts and there then began a period when progressively higher temperature deliquescent brines involving ternary and, even, quaternary combinations of nitrate salts were proposed [116]. The resulting solutions, which could form by deliquescence at temperatures approaching 200 °C, had such high ${\mathrm{NO}}_3^{-}$ concentrations that uniform corrosion of Alloy 22, rather than localized corrosion, became a concern [117]. Although the DOE and EPRI questioned the feasibility of the formation of such concentrated brines and, if they did form, of their stability under repository conditions [115,116], these arguments were challenged by an active opposition from opponents of the project [118]. The net result of this evolution of the understanding of the nature of the environment at the WP surface was that the container design evolved from a thin-walled Type 304 stainless steel WP, to the more corrosion-resistant Ni–Cr–Mo–Fe Alloy 825, to a thick-walled corrosion allowance design based on an outer carbon steel barrier, to the highly corrosion-resistant Ni–Cr–Mo–W Alloy 22, to eventually an Alloy 22 WP protected by a Ti Grade-7 drip shield.

These changes to the WP design also coincided with changes to the regulatory requirements [110]. Initially, the Environmental Protection Agency (EPA) radiological limit was a mean peak dose of less than 0.15 mSv/a for a period of 10⁴ a. Later, however, the assessment period was extended to 10⁶ a, albeit with a higher limit of 1 mSv/a for the period 10⁴ to 10⁶ a. At the same time, uncertainty in the behaviour of the natural barriers (primarily the unsaturated (UZ) and saturated zones (SZ)), tended to shift emphasis to the engineered barriers, with an obvious advantage to the use of very-long-lived WP.

As the WP design and the nature of the near-field environment changed, so too did the treatment of different corrosion processes in the PA model. What started out as a highly stylized deterministic failure model for PA-EA and PA-91, quickly became a probabilistic model for PA-93 and all subsequent assessments (Table 10). Thus, the ability to predict the distribution of WP failure times was built into the program almost right from the outset, and the YMP developed a highly coupled sequence of models to predict all aspects of the evolution of the entire system, from WP failure and waste form degradation all the way through to UZ and SZ transport and biosphere models. The flow chart for the TSPA for the licence application shows a total of 22 coupled process and PA models that are used to predict the overall radiological impact for the nominal scenario [12].

Prior to the adoption of Alloy 22 as the main corrosion barrier, the WP design for PA-95 and for the Viability Assessment (PA-VA) comprised an outer carbon steel corrosion allowance barrier and an inner corrosion resistant container made from either Alloy 825 or Alloy 22 [109]. The concept was that the outer carbon steel barrier would provide containment during the thermal transient and period of highest radiological hazard and that the corrosion-resistant inner barrier would provide long-term containment once the temperature had cooled and the likelihood of localized corrosion had lessened. Carbon steel was expected to corrode uniformly, for which empirical corrosion rates were used for both humid air and aqueous conditions [27]. By the time of PA-VA, the possibility of seepage into the drift and drip** onto the WP was accepted and localized corrosion of both the carbon steel outer and Alloy 22 inner vessels was assessed, the latter based on the nature of the environment (pH and [Cl⁻]) and the critical potential for initiation [27,107]. However, there were concerns that corrosion of the carbon steel outer vessel in the permanently aerobic drift environment would result in the formation of Fe(III) species, which could then lead to localized corrosion of the corrosion-resistant inner barrier. Therefore, for the Site Recommendation and Licence Application assessments, the materials were reversed, with an outer layer of corrosion-resistant Alloy 22 supported by an inner (stainless) steel vessel [107].

The TSPA models for the Site Recommendation and Licence Application assessments, PA-SR and PA-LA, made use of the WAPDEG PA model (Table 10). One of the interesting features of WAPDEG was the subdivision of the WP surface into ~1400 patches, each of which could be assigned a specific corrosion rate sampled from an empirical distribution and which could also be exposed to different environments that would affect the likelihood of the initiation of localized corrosion. One of the reasons for sub-dividing the WP surface was to couple failure of the container with the probability of seepage into the container and the dissolution and transport out of radionuclides. As it turned out, the environmental conditions were never found to be sufficiently aggressive that crevice corrosion of Alloy 22 initiated in the model (as assessed based on the critical potential criterion). In addition to uniform corrosion, the only other failure mechanism for the WP was SCC, which was assessed using a slip-dissolution model for crack initiation and propagation [85]. Although a crack propagation model has been used for the HIC of Ti alloys [71,72], the use of a crack propagation argument for SCC is otherwise unique, with all other programs excluding SCC from consideration based on reasoned argument (i.e., through the use of a non-initiation argument).

The PA-SR and PA-LA assessments also treated failure of the titanium drip shields. The predominant failure mode considered in WAPDEG was uniform corrosion which was assessed based on a distribution of empirical corrosion rates. Other processes, such as SCC, creep, localized corrosion and HIC were screened out, either on the basis that they were of low probability or of low consequence (Table 10).

Unfortunately, because of the effective cancellation of the program, the PA-LA was not subjected to rigorous review and critique.

4.3. Factors Affecting the Evolution of the Container Design and PA Models

These two cases studies share certain common features, but also distinct differences. Both programs involved active regulators and antagonistic opponents, which led to distractions from more-important considerations. For example, considerable resources were expended in the Swedish program investigating the corrosion of copper in pure, O₂-free H₂O, a subject that was only ever a laboratory curiosity and was repeatedly shown to have no safety significance [44,119]. Similarly, the suggestion in the YMP that the deliquescence of ternary and quaternary salt assemblages was feasible given the requirement for three of four deliquescent salt particles to be in intimate contact at the same time should not have received as much attention as it did.

This is not to say that all opposing viewpoints have been a distraction. Informed and constructive contrary opinions are absolutely vital to ensure that the proponent has considered all possible processes of importance. In this regard, the US. Nuclear Regulatory Commission’s research contractor, the CNWRA, played a particularly constructive role in the development of the YMP through their research on the localized corrosion of Ni alloys and the electrochemical criteria for initiation of crevice corrosion. Their work was adopted by the DOE and incorporated into the WAPDEG PA model.

There are also differences in the evolution of the container PA models in the Swedish and US programs. A major difference is that the repository environment was defined with some certainty right at the start of the Swedish program whereas, as described above, the understanding of the nature of the in-drift environment evolved significantly during the course of the YMP as a result of site investigations. Thus, the general format of the SKB canister PA model for the latest PSAR assessment [32,101] is remarkably similar to that defined for the KBS-2 safety assessment in 1978 [87,88]. In contrast, not only did the WP design evolve as a consequence of the changes to the in-drift environment in the YMP, but so too did the nature of the PA model (Table 10). The YMP design and WP PA model tended to become more conservative with time, whereas a feature of the successive SKB safety assessments is that some of the early conservatisms were relaxed over time as more became known about the nature of the corrosion processes.

Regardless of the similarities and differences described here, evolution of the container PA model is an expected feature of all HLW/SF programs.

5. Confidence Building

As noted in Table 1, one of the features that distinguishes the process models described in Part 1 of this review [1] from the PA models described here is that, because of their large temporal and spatial scales, the latter are difficult, if not impossible, to validate against empirical observations. For this reason, alternative methods have been developed for building confidence in, and demonstrating the robustness of, the long-term predictions.

5.1. Large-Scale In Situ Tests

Large-scale in situ tests are conducted in underground research laboratories (URL) with the aim of replicating as closely as possible the environmental conditions that will be encountered in the actual repository. In some cases, the URL may be at the actual repository site, with experiments conducted as part of the site investigation activities. In other cases, the URL will be located in a similar geological setting. The European experience of large-scale in situ corrosion testing in URLs has recently been reviewed [120].

Compared with the temporal and spatial scales associated with PA models, large-scale in situ tests occupy a middle ground between laboratory and repository scales. In terms of size, in situ tests range in scale from small corrosion coupons to one or more full-size containers. Timewise, URL experiments typically last of the order of a few years to several decades. Thus, although the exposure times are still short compared with the container lifetime, in some cases the experiments have extended to beyond the duration of the initial saturation and aerobic-anaerobic transitions, such as the FEBEX and Prototype experiments [120]. This is an important point since, for many container materials, aggressive forms of localized corrosion and some forms of EAC are expected to be limited to the early saturation-redox transient period. Therefore, those parts of the overall PA model that deal with such mechanisms can indeed be validated against the results of in situ experiments.

The other important aspect of such tests is that the environmental exposure conditions are generally more representative of the actual repository conditions than those in bench-scale experiments. In situ tests involving entire containers provide the opportunity to study how the presence of the buffer and backfill materials affect the corrosion performance. Exposure to actual deep groundwaters is also often seen as an advantage of such tests, even though the container is generally not in direct contact with the groundwater itself but with a modified (clay or cementitious) buffer porewater.

5.2. Analogues

Natural and archaeological analogues are widely used to support the long-term corrosion performance of copper and carbon steel containers [121,122,123]. Analogues can provide different types of information useful for supporting the safety case, including (i) direct input data, for example, in the form of long-term corrosion rates; (ii) underlying mechanistic information; and (iii) case studies for model validation. The great advantage of analogues is that they are the only confidence building measure that can match and, in the case of some natural analogues, exceed the timescale of the safety assessment. The downside of the use of analogues is that neither the nature of the “disposal” environment nor the metallurgical characteristics of the artefact match those of the repository or container.

Nevertheless, the power of analogues to build confidence in the long-term durability of copper and steel containers with both expert and non-expert audiences alike should not be underestimated.

5.3. Pilot Repository

All repository programs include the concept of a monitored pilot repository during the early years of the operational phase. Thus, the first containers to be emplaced will be monitored to ensure that their performance is as expected. In terms of the number of containers, a pilot repository could consist of several tens or hundreds of containers and, therefore, is closest to repository scale of any of the confidence building methods. Monitoring could continue for several decades and, therefore, will be of similar duration or longer than in situ experiments, and will similarly extend beyond the aerobic-anaerobic transition for repositories located in the saturated zone.

Generally, the extent of monitoring will be limited to the measurement of activity levels to ensure that no container has prematurely failed, and radionuclides have not been released. Direct monitoring of the corrosion performance is challenging as the majority of methods require cables or connections to be made to the container which will then compromise the quality of the seal.

5.4. Complementary Models

The use of complementary models can be used to build confidence by demonstrating that the results from different approaches are broadly in agreement. Comparison of modelling approaches is generally done at the process model level or for sub-components of a larger PA model. The development and application of alternative conceptual models was specifically used to build confidence in the YMP (see, for example [83,84]).

One form of complementary model that is popular with some regulators is a bounding calculation. For example, a bounding calculation for the uniform corrosion of the container during the aerobic phase would be to assume that 100% of the initially trapped O₂ causes corrosion. In comparison, a reactive-transport model of the process that includes O₂-consumption reactions other than container corrosion would predict a smaller degree of corrosion and would indicate the level of conservatism inherent in the bounding calculation. Taken together, the two methods provide a “best estimate” and a “worst-case” prediction for the process.

Another approach to building confidence is to compare the results from different conceptual models of the same process. The models could differ in the mechanistic description or, as in the case of the benchmarking of different copper sulfide corrosion models [124,125], differ in the treatment of the underlying reactions and/or the manner in which the mathematical solution is derived. In this latter case, it was possible to show that three models developed to predict the corrosion consequences of the microbial production, transport and consumption of sulfide produce broadly similar results, despite differences in the treatment of the different reactions (thermodynamic or kinetic) and differences in the numerical solution methods (finite difference and finite element/volume).

5.5. Mechanistic Understanding

Lastly, and perhaps most importantly, it is essential to be able to demonstrate a thorough mechanistic understanding of the corrosion processes involved. This mechanistic understanding is important regardless of whether the PA model is empirical or deterministic (mechanistic) in nature. For example, in order to justify the prediction of a long-term corrosion rate based on relatively short-term empirical data, it is necessary to be able to convincingly show that there are no mechanisms by which the corrosion rate could increase with time, for example, due to the periodic spalling of an otherwise protective corrosion product.

It is not only the corrosion mechanism for which a detailed understanding is required. It is also necessary to be able to predict the evolution of the near-field environment with confidence, as was evident during the Yucca Mountain project.

6. Response of Regulators and Reviewers

For every safety assessment there is a review. The depth of the review depends on the stage of the program; interim PA models will receive a lighter review, whereas assessments associated with major licence applications receive more scrutiny. In a well-structured program there will be a continuous review process with the regulator and/or public involved throughout. Because the process is continuous with periodic assessments every few years and because WMOs are generally committed to continuing R&D, most reviews tend to be relatively supportive, recommending continued development and, occasionally, new areas of investigation that may have been overlooked.

For example, STUK’s review of Posiva’s construction licence application included recommendations for further studies in five corrosion-related areas [126]. Similarly, the Swedish regulator SSM proposed a number of areas of further study in their reviews of SR-Site [127,128,129]. Sometimes the suggested areas of investigation are relevant, such as SSM’s [127] and the Swedish Land and Environmental Court’s [130] suggestion to investigate the effect of unsaturated conditions on the corrosion behaviour of copper containers. In other cases, the suggestions are less helpful, such as the study of the corrosion of copper in O₂-free H₂O [126]. In many cases, the suggestions are based on laboratory observations that are not relevant for the environmental conditions in the repository, such as the effect of absorbed hydrogen on the creep and SCC behaviour of copper [127]. Similar reviews have been performed for the NWMO copper-coated program [131,132].

There have rarely been any “showstopper” issues raised during the review process. One exception was the negative review comments of the Scientific Review Group (SRG) on the proposed use of Ti Grade-2 as a container material in AECL’s Environmental Impact Statement in 1995 [20,133]. The SRG were critical of certain aspects of the PA model for Ti containers, including the assumptions of immediate saturation and unlimited supply of O₂. There were also concerns about the lack of analysis of structural failure modes. Underlying these comments was a general concern that localized corrosion, in this case crevice corrosion, could not be predicted with any certainty. This concern with the use of Ti was compounded by the knowledge that the use of copper was also being investigated, in which the SRG were more confident, in part because the existence of natural and archaeological analogues [134]. Perhaps the proposal by AECL to use a material that was susceptible to localized corrosion came too early, because it is possible that it would be looked on more favourably now given the significant advances in our understanding of the initiation, propagation and stifling of localized corrosion in the past two to three decades.

7. Conclusions and Outlook

This is Part 2 of a review of the modelling of the corrosion behaviour of HLW/SF containers materials with a focus on performance assessment (PA) modelling, with process models having been considered in Part 1 [1]. Whereas process models focus on the interpretation or prediction of individual corrosion processes, PA models are designed to predict the lifetimes of HLW/SF containers based on all corrosion and mechanical-related degradation processes. The spatial and temporal scales of PA models are, therefore, much greater than those of process models. Contrary to the focus of this special issue on deterministic modelling approaches, PA models are largely empirically based.

Lifetime prediction models have been developed for a range of container materials, including copper, carbon steel, Ti alloys and Ni alloys. There has been a trend towards the use of the active materials copper and carbon steel for HLW/SF containers and away from the use of passive materials such as Ti and Ni alloys. As a consequence, the methodology for PA models for copper and carbon steel containers is well developed in a number of international nuclear waste management programs. Interestingly, the approach to the lifetime prediction of copper containers is quite consistent between different waste management organizations, whereas the approaches developed for PA models for carbon steel containers are more diverse. In the case of PA models for passive alloys, there is necessarily a greater emphasis on the prediction of localized corrosion and environmentally assisted cracking processes, which has been met with a certain degree of regulatory pushback. This apparent reluctance on the behalf of review groups to accept long-term predictions of localized corrosion processes for passive alloys will hopefully change as a result of the advances in mechanistic understanding of these processes.

Another important aspect of PA modelling is that the nature of the models inevitably evolves over the course of the decades-long process of the development of a disposal concept, site selection and characterization and ultimately repository construction and closure. This evolution in the nature of PA models has been illustrated by two examples. In the case of the development of SKB’s PA models for a copper SF container, this evolution has largely been driven by improved understanding of the corrosion processes involved and a relaxation of some of the overly conservative early assumptions. In the case of the Yucca Mountain Program, the changes to the PA models were driven by changes to the container design as the understanding of the underground environment evolved during the site characterization phase.

Another difference between process and PA models is the difficulty, or impossibility, of validating the latter against experimental observations. For this reason, a number of techniques are used to build confidence in the long-term predictions, including the use of information from natural and archaeological analogues and from large-scale in situ tests, complementary modelling approaches and the monitoring of pilot repositories during the construction and operational phases. Perhaps most importantly, however, it is necessary to be able to demonstrate a sound mechanistic understanding of the corrosion processes of interest and it is here that the deterministic modelling approaches that are the subject of this special edition support the (largely) empirically based PA models.