Writing a Requirement That Outlives Every Institution
Somewhere in the paperwork of a deep geological repository is a sentence stating how long the site must keep its contents away from people. At the Waste Isolation Pilot Plant in New Mexico that period is ten millennia. Onkalo in Finland is argued over a hundred. The dose standard applied to Yucca Mountain reaches a thousand. These are not rhetorical flourishes; they are compliance boundaries, and a safety case has to demonstrate something about the world at the far end of them.
The moment a horizon is written in millennia, the numbers stop being comparable to anything an engineer normally works with. A structural code that promises a hundred years covers a tenth of a millennium. Every language currently spoken is younger than the marker period WIPP is designed for. Converting the horizon into plain years is the first step in seeing how far outside ordinary practice the requirement sits.
What Changes Once a Horizon Passes One Millennium
No script has stayed readable for ten millennia
No custodian has survived one millennium unbroken
Materials are rated in centuries, not millennia
Beyond a few millennia the geology is the design
Reading a Deep-Time Horizon Back in Plain Years
Requirements are drafted in millennia and then compared against material data, corrosion rates and design lives that are all published in years.
Put the stated horizon on the left
Ten for a marker or isolation period, a hundred for a repository safety case, a thousand for a peak-dose standard. The year total forms as the digits arrive.
Feed a material figure in from the right
Corrosion allowances and design lives come quoted in years. Entering 120 in the target box returns 0.12, which is the fraction of a millennium that component actually covers.
Turn the pair around for a whole document
When a review is being written entirely in years, the swap control (↔) reverses the direction so every horizon in the text goes the same way without re-entry.
Carry the value into the assessment sheet
Copying returns the number with no unit and no thousands spacing, so a value like 100000 pastes into a model input without being rejected as text.
Design Lives, From a Concrete Slab to a Repository
Horizons that appear in long-duration projects, written in millennia and in the years a specification would quote, with the thing most likely to give way first. The last column is the useful one: for almost every entry, the failure is organisational or informational rather than structural.
| Facility or artefact | Design horizon (millennia) | Design horizon (years) | What is expected to fail first |
|---|---|---|---|
| Reinforced-concrete civil structure, top design category | 0.1 mil | 100 yr | Reinforcement corrosion once chlorides or carbonation reach it |
| Archival paper made to a permanence standard | 0.5 mil | 500 yr | The storage climate, long before the sheet itself |
| Permafrost-backed seed store | 1 mil | 1 000 yr | The permafrost, if the surrounding ground warms |
| Surface marker system, Waste Isolation Pilot Plant | 10 mil | 10 000 yr | Legibility — whether any message can still be read |
| US isolation demonstration for that repository | 10 mil | 10 000 yr | Continuity of the archives that explain what is buried |
| Ten-thousand-year mechanical clock | 10 mil | 10 000 yr | Anything needing maintenance, winding or willing people |
| Onkalo deep repository, Finland | 100 mil | 100 000 yr | Canister corrosion, argued over glacial cycles |
| Peak-dose standard applied to Yucca Mountain | 1 000 mil | 1 000 000 yr | Nothing engineered survives; the host rock is the whole case |
Set against each other, the entries split into two families rather than forming a gradient. Everything at or below a millennium is a maintenance promise: someone keeps the roof on, the room cold, the archive catalogued. Everything above ten millennia is a bet that no maintenance will happen at all, which is why those projects spend their effort on site selection, passive barriers and the awkward problem of communicating without a shared language. There is no engineering discipline that spans both ends, and pretending otherwise is how deep-time requirements get quietly reduced to ordinary ones.
Working With Millennium Figures in a Safety Case
Horizons expand as you enter them
Both fields track each keystroke, so a paragraph that jumps between ten, a hundred and a thousand millennia can be checked without pausing to multiply anything.
Material data enters from the target side
Design lives published in years can be typed on the right, returning the millennium fraction a component actually covers against the stated requirement.
Very large totals switch notation
Values from 1e10 upward are shown in scientific form, which keeps a million-year horizon in seconds readable instead of stretching across the field.
Model inputs get unspaced digits
Copying strips the thousands spacing, so a long figure lands in a solver or a parameter file as a number rather than as a string to be cleaned.
Questions About Designing for Deep Time
Where does the ten-millennium isolation period come from?
It is a regulatory choice rather than a physical boundary. US environmental standards for transuranic waste disposal require containment to be demonstrated over ten thousand years, and the marker system at the New Mexico site was designed against the same figure. The number was picked as a period long enough to cover the phase of greatest concern while remaining something a safety case could argue about with any credibility. Hazard does not switch off at the end of it. Other regulators chose differently, which is why the same class of facility is assessed over ten millennia in one jurisdiction and a hundred in another.
How do you write a warning that will still be understood in ten millennia?
Nobody knows, and the expert panels convened on the question said so plainly. Text fails because languages drift beyond recognition within one or two millennia. Pictograms fail because reading order and symbolic convention are learned, not innate. The strategies that survived scrutiny work in layers: hostile-looking earthworks and spike fields to make the place feel wrong on approach, multiple redundant message panels in many scripts, buried information rooms with progressively more detail, and archived records lodged in several countries. None of it is expected to work reliably; the design goal is to raise the chance that a curious future visitor hesitates.
Why do some repositories quote a hundred millennia and one quotes a thousand?
Different regulators asked different questions. A period of ten millennia asks whether the facility holds through the phase of highest concern. A hundred-millennium case, as used in the Finnish programme, extends across at least one full glacial cycle, so the assessment has to consider ice sheets, changed groundwater chemistry and land uplift. A million-year standard abandons the idea of a containment promise altogether and instead asks where the calculated dose peaks and how large it gets. Longer periods are not more conservative in a simple sense; they change what is being demonstrated, and they lean much harder on geological modelling.
Can any engineered material be trusted for a full millennium?
Very few, and only under conditions chosen to suit them. Copper in oxygen-free groundwater is the main candidate, because corrosion rates measured there are low enough that a canister wall of a few centimetres is projected to survive far past a millennium; the argument rests on the chemistry staying anoxic, which is itself a geological claim. Fired ceramics, certain glasses and native metals have survived millennia in archaeological contexts, but by accident and in unknown numbers. Ordinary structural materials are not in the conversation: concrete design lives run to about a century, and steel reinforcement is usually the first thing to go.
What is the point of a design horizon nobody alive will ever verify?
It forces the design to be defensible without a fallback. Ordinary engineering leans on inspection, maintenance and replacement, and a requirement stated in millennia removes all three by assumption, so every safety argument has to stand on physics and site geology alone. That constraint is what pushes such projects towards passive barriers, redundant records and stable host rock rather than active systems. The horizon also functions as a public commitment: it fixes what the operator has agreed to demonstrate, gives regulators a defined thing to test, and stops the period being quietly shortened when the modelling turns out to be difficult.
No comments yet. Be the first to comment!