Several years ago–actually I hate to say it’s almost 10 years ago–it looked like I was going to become the Director of Defense Research and Engineering for the Defense Department. At the time the DRE was chair of the Nuclear Weapons Council. To get an understanding about nuclear weapons, you first go through definitions, such as what’s a pit. But even before I did that I went to visit Sandia and was given a series of lectures.

The first remarkable thing about nuclear weapons is the power. But you soon begin to realize the incredible safety requirements that those weapons must meet, the incredible security that has to be maintained, and the extraordinary high reliability required. How does one put all that together in one system that also has this enormous destructive force?

Fairly early in the game, the people at Sandia began to understand these questions. What has been done there is what this workshop is all about.

I want to give you a little bit of the history of how we got where we are. You’ve probably been able to figure out most of that by now, but I want to reinforce the importance of surety to us. Surety is important in terms of our direction in the future, and to the direction of a larger community. All of us need to start thinking about surety. We can help the larger community, and I believe that larger community can help us in return.

By now you know that surety is really a systems problem. There’s no silver bullet. Surety is a combination of hard engineering, good science and systems engineering. You may know it when you see it, but it’s a little hard to explain exactly. Obviously the practitioners of surety are in this room. It’s an art form as well a science that is able to put numbers on things, that is able to quantify things wherever possible.

From our perspective, the reason for this workshop is that we are faced with some new and difficult problems in the weapons complex. We’re not going to be able to test any longer. We’re not going to be able to produce whole new weapon systems any longer, unless ordered to do so by the President. Our goal is to maintain those weapons indefinitely, to do it without testing, and to maintain reliability and safety and security. How do you make that happen in a different world with different kinds of threats? We’re trying to apply surety principles to the weapons complex as a whole. Many things that we deal with are very similar to the ones that other communities are dealing with. We want to share that with you, with the purpose of getting you involved so we’ll all learn at the same time.

Surety is a systematic approach. It’s a very complicated approach, but going through it raises important questions. What level of surety do you really need for what application? How can you afford it? What are the ideas for applying surety? You’ve been through this before. I want to remind you that surety is for real. This is basically history on overtime.

From the start we recognized that nuclear weapons were very different from anything else. We needed very different approaches to problems. That was recognized at the highest level, at the presidential level. I think that’s why President Truman maintained the Atomic Energy Commission as a separate agency. I don’t think President Truman was a surety expert, but he instinctively recognized that we needed a different approach because of the enormous destructive power of these weapons.

The national laboratories of the DOE Defense Programs collaborate to cover the surety of the nuclear warhead. Sandia National Laboratories is accountable for the surety of the electronic, mechanical, and aerodynamic subsystems of the warhead and for the stockpile infrastructure. Los Alamos and Lawrence Livermore National Laboratories are accountable for the surety of the nuclear explosive. The three laboratories work the system issues with Department of Energy to assure warhead-level surety. The experiences have been instructive.

The unprecedented destructive force of these weapons necessitated a new organizational separation of powers and a culture of responsible independence. On the one hand, the military is charged with the authorized use of nuclear weapons to assure a credible deterrent. Their priority is to maintain operational readiness. On the other hand, a civilian agency–currently the Department of Energy--is charged with the cradle-to-grave stewardship of the weapons. DOE’s charter includes providing operational readiness and more–safety, security, and use control so that the weapons will not be accidentally detonated or maliciously used against us. The Department of Energy has accountability to advocate prudent improvements in safety, security, and use control even if the Department of Defense objects to the potential impact this must have on operational readiness. We have a constructive controversy.

Initially, safety was achieved by separating critical weapon components until they were authorized for immediate use. This practice made it physically impossible for an accident to result in a nuclear detonation and thus assured level 4 surety–Surety by Reliance to the Extent Possible only on the Laws of Nature and Mathematics. When the advent of missiles shortened the required response time, weapon experts inserted spoilers into nuclear components to assure level 4 surety by rendering them inoperable until authorized for war. However, this approach made it too difficult to assure a credible deterrent.

The strategy shifted to providing safety through a series of very reliable and enabling links. Many serial steps made an accidental nuclear detonation very unlikely. At the time, it seemed adequate. As viewed from the surety levels discussed in this conference, surety went from level 4–Surety by Reliance to the Extent Possible only on the Laws of Nature and Mathematics–backwards to level 3–Surety by Positive Measures of Science and Engineering. This arrangement worked well and avoided detonation in a series of accidents, but the safety margins were less than anticipated. A number of accidents forced a fundamental re-examination of the safety strategy.

A special panel set the modern requirements for safety--a probability of less than one-in-a-billion chance of accidental nuclear detonation during a weapon’s lifetime in normal circumstances. In addition, the panel required a one-in-a-million chance of nuclear detonation in abnormal circumstances, including fire, transportation accidents, lightning, etc. That one-in-a-million requirement for abnormal environments assumes that any weapon could be hit by lightning, immersed in a jet-fuel fire, subjected to a missile explosion, or ejected from an airplane during an accident. The weapon must still have less than a one-in-a-million chance of detonating.

These criteria are justified by the potential consequences of an accidental detonation. They are well beyond industry standards for risk assessment. For example, the NRC regulatory guide stipulates that a nuclear reactor must have less than a 10-in-a-million likelihood per year of containment failure during normal operation. For a 40-year reactor life span, that corresponds to a failure rate of 4x10^-4 in normal circumstances–a factor of 400,000 less stringent than the requirement for a nuclear weapon. In a normal environment one part in a billion means if we have 10,000 weapons there's a chance of only one accident per 3 million years.

DoD, DOE, and other institutional efforts set up a separate organization–Sandia–whose whole purpose was to worry about safety and to continually function as a red team, to continually probe the system. The numbers I quoted are key numbers. As we move from stockpile production and nuclear testing to a stockpile stewardship era where we don’t have testing and no new productions, how do we maintain these same criteria? The specifications have not changed and are really quite extraordinary.

To achieve this extreme level of safety and the required degree of reliable performance, Sandia invented modern nuclear safety in the 1970s. It is called the Enhanced Nuclear Detonation Safety (ENDS) approach and permits level 4 Surety along with high military capability. As a result, nuclear weapon safety has moved from conventional engineering with a focus on how things work to surety science and engineering with minimal reliance on anything but the laws of nature and a focus on how things fail.

There are new challenges. We’re dealing with an aging system in a radioactive environment. Almost everything in the nuclear weapon from structural parts to electronics is in the process of changing, How do you maintain level 4 security in that system?

We do have many new tools. One of the more aggressive technologies at Sandia is in the area of nano-technology, intelligent micromachines that are one approach to maintain level 4 surety in a changing world.

Through the Accelerated Strategic Computing Initiative, we’re now doing far more simulation and modeling. We're effectively looking at these abnormal environments, environments that deal with aging systems. High performance computing has made a significant difference in our ability to advance surety. We can model these types of problems in a weapon that’s now 30 to 40 years old.

Today we have to certify parts without nuclear testing. We do have the tools. We now have to look at surety not just in terms of the weapon itself but from the viewpoint of the whole weapons complex.

We’re faced with another generation of surety problems. A major part of the stewardship program goes beyond maintaining the weapon itself without testing to maintaining the surety specification. We recognize the new tools and approaches are valuable, but also that surety problems need to be discussed in a wider community. Partnerships in the wider community are the way we will improve our own programs, with resulting benefits for all. Thank you

Q: Are you working with the Russian government with the surety of their weapons program?

A: Yes. We have a formal memorandum of understanding with the Russian government. We have a committee with a strong representation from the laboratories and DOD. It took two years to work out all the details. Some problems are relatively easy to deal with–for example, helping them with the railroad cars and physical security. Frankly, it is a difficult situation because surety is an integrated process. Obviously, we don’t deal with reliability and effectiveness of their weapons. But clearly we’re interested with the safety issues, and they’re obviously very interested in areas like probabilistic risk assessment approaches. They’re actually pretty good at that, so while it’s not an enormous program, it is a solid effort.

Q: The premise of this workshop is partnering to co-develop surety in a wide variety of applications. What would the partnering look like on one hand, and what would the mission look like on the other?

A: This is an everyday issue. DOE laboratories do much work for other parts of the government, for the Defense Department, for example. There is concern about duplication of effort. But our laboratories are national laboratories. They have done and will continue to do work for other agencies. We’re not in the law enforcement business, but we help law enforcement agencies. We’re not in the medical business, but we help medical institutions at their request. If there are real problems that we can work on jointly that save dollars and develop new technologies, then I think we can make the case that developing the technologies and solving real problems helps our mission. The agencies are mission driven. But the technologies and the approaches clearly can be shared. I fully expect that what we learn will help us in our mission, which is keeping nuclear weapons safe, secure, and reliable. We interface with other institutions everyday. We still have to fly airplanes. We are concerned about counter terrorism, law enforcement, and all the other issues that affect our mission of surety of the weapons complex. We certainly can’t afford to address all of the issues by ourselves.

Questions and Comments || Acknowledgment and Disclaimer