Systems Analysis Versus Systems Design

Wohlstetter, Albert

Systems Analysis Versus Systems Design

by Albert Wohlstetter

The Economic Analysis of Defense Problems—Choice Without Markets

Systems Analysis versus Models; and the Problems Motivating Analysis.
1. SA not the same as model building, includes more difficult framing of questions relevant to AF decisions, devising systems and relating results to policy.
2. SA difficulties are AF's difficulties. Mutual benefit from recognizing this. A good SA starts and ends with AF objectives, but may refine these in process.
An Air Force Example: Genesis of the Intercontinental Mission.

B-36 decisions illustrate choice among multiplicity of uncertain alternatives at least as great as C. J. Hitch showed for SA. AF objectives stated in their connection were multiple, rapidly changing, partially overlapping and partially in conflict. Some in the nature of hedges or contingency plans.
Objectives and Constraints in the Design of Systems Studies.
1. One man's means is another man's objective.
  1. Contractor and sub-contractor objectives. Examples of GOR, master base plans. Interceptor and fire control systems.
  2. Some narrow AF objectives, and examples of interactions requiring revaluation of objectives. Master base plan, ANP, etc.
  3. Complexity of interdependence and the speed to technical and political change affects objectives, making continual re-examination of constraints vital.
2. Broader AF objectives.
  1. Interdependence of counter-force, disruption, and retardation target systems. Effect on design of systems studies.
  2. Still broader AF objectives: provocation, deterrence, and capability of winning war once started. Spectrum of victories from delectable to desperate.
3. Overlap and Divergencies.
  1. Hypothetical campaigns showing interplay of wartime capabilities and other major objectives.
  2. Example of a proposed defense of SAC which might increase wartime capabilities but sacrifice deterrence.
  3. Importance of deterrence and low-confidence measures.
The Enemy's Objections and Agreements.
1. Conflict clear, but SA and staff studies seldom give enemy full freedom.
  1. Fixed enemy intentions and capabilities. Examples.
  2. No constraints at all. Other extreme.
  3. Games and minimax strategies. Difficulties for distant future.
  4. "Inert" strategies as benchmark and as low-confidence measures.
2. Points of agreement: Avoid mutual destruction. Deterrence.
The Modest Value of Mutually Unsatisfactory Strategies.
1. Our fondest desires and his.
2. Possibilities of preventing him from reaching his high-confidence objectives, without our reaching ours. Deterrent value.
3. Low-confidence measures do not replace high-confidence measures, but deserve more attention than they have received.
Uncertainty and the Design of Systems Studies.
1. Uncertain Goals and Workable Objectives.
  1. Too narrow: maximizing a specific performance parameter.
  2. Broad but empty.
  3. Intermediate criteria useful but not final. Examples from RAND Air Defense and Base studies. Unbiased and a fortiori comparisons.
  4. More comprehensive criteria.
  5. Two-sided criteria.
  6. Insurance criteria and contingency planning.
2. Other Uncertainties.
Systems Design versus Systems Analysis.
1. SA best conceived as constructive, not judicial. Multiple uncertainties require invention of strong flexible systems. Double function of such invention: simplifies analysis and, more important, prepares for contingencies.
  1. Analysis easier for very weak or very strong systems.
  2. Example of runway—taxi-way system.
2. Principles for designing strong systems:
  1. "It's-hotter-in-the-combat-zone-principle." Examples: nuclear cruise, tankers.
  2. The "Thermo-nuclear-war-is-not-peace-principle." Examples.
3. Systems good in contingencies.
  1. C. J. Hitch's example of overseas base systems versus intercontinental ones. His two extremes, including second sense of "minimax."
  2. Expansion of alternative systems and of contingencies in Hitch example. How define "worst" contingency?
  3. Three sorts of disasters denying bases: enemy bomb attack, weather, political defection. Systemic and extra-systemic disasters.
    1. Systemic disasters may be treated by minimax methods in the sense defined earlier.
    2. Extra-systemic disasters require gross judgment of inequalities in probabilities, contingency planning, and the devising of flexible systems.
4. Flexible systems and the principle of multiple use.
  1. Flexibility, postponement and decision.
  2. Mixed versus convertible systems.
  3. Performance in likely and less likely events. Desperate measures for desperate circumstances.
5. Can we invent a dominant system, "best possible?"
  1. Like "worst possible," "best possible" hard to define. In any case hardly to the point.
  2. Changes in modern weapon technology swift and continual. Implications complex and far reaching. Not unlikely therefore that actual programs will lag. Opportunities for an inventive systems analyst. Our inertia.
  3. SA helpful if it can find and prove system better than others, which might otherwise be accepted. This it has done.

The Economic Analysis of Defense Problems—Choice Without Markets

The subject assigned in this lecture—the design and formulation of systems studies—is among the most important and at the same time among the most difficult to say anything very formal, precise, and positive about. It is easy to say a lot of negative things on the subject. But it must be clear at the outset that no rules will guarantee a fruitful system design. For systems analysis is not the same thing as model construction or game building. I would like to say a bit about the distinction between them.

I. Systems Analysis vs. Models, and the Problems Motivating Analysis

A systems analysis is an attempt to discern and answer questions of importance in the choice of policy, and a mathematical model, as Mr. Specht has made clear in an earlier lecture, is frequently a most useful device in obtaining answers to these questions. Sometimes two or three mathematical models are even more helpful. However, as he suggested, the construction and manipulation of such models is by no means the whole of the job. In fact, asking fruitful questions, ingeniously designing alternative systems to be compared, and skillfully interpreting the results of the calculations performed in the comparison, relating them to the problems that motivated the inquiry, are much more critical phases than the manipulation itself. Analysts are sometimes prone to forget this because most of their time is spent in the manipulation, and because the manipulatory techniques are most easily explained and transferred—cook-book fashion.

But a careful study of the Palmer method of penmanship is no foolproof formula for writing a good novel. Though a clear hand, speed in at least one-finger typing, knowledge of grammar, and ability to spell all help. For a systems analysis skill in quantitative model building is useful and, where the problem is complex, even essential (unlike the case of penmanship and the novel). But it is not enough. Systems analysis would be much easier if it were merely model construction.

I think that Mr. Hitch's introductory lecture made clear that systems analyses are anything but easy. You will recall that he illustrated how the intrepid analyst, interested in comparing alternative systems for development, might be attempting to pick one out of a million or more alternatives. I would like to stress in this connection that the difficulties that Mr. Hitch recounted arise largely because of the necessity to relate the results of calculation to the Air Force problems which motivate the inquiry. They are in fact the Air Force's difficulties. The four-to-the-tenth-power alternatives that explicitly beset the analyst are present in equal multiplicity, if not in equal explicitness, whenever the Air Force makes a decision to develop a specific type of bomber or missile. The analyst's problem is the same, in this respect, as that of the decision-maker.

By pointing to the complexity of the decision-maker's problem, I do not mean to suggest that sensible decisions are impossible without systems analysis. It's quite clear, in fact, that several have been made. Some of the million alternatives can, with impunity, be dismissed by a sensible fellow, whether an analyst or a decision-maker. On the other hand, it is also clear that in the past some very important alternatives have been ignored. And while systems analysis is no guarantee that we will consider all the relevant important alternatives (it should be clear that systems analysis is not a substitute for sense), it does force much greater explicitness and it does make the alternatives examined—and the omissions—a little more open to scrutiny.

The complaints not infrequently heard about the Assumptions Made in Systems Analyses do not, I think, mean that by comparison staff studies and staff decisions are innocent of arbitrary or unrealistic assumptions. Much less that, as I heard suggested once, they are innocent of assumption altogether. The comparative frequency of such complaints, which are sad to say sometimes quite well founded, are a tribute to the relative explicitness of the assumptions and reasoning in a systems analysis. Systems analysis can assist decision.

The above also suggests that a systems analysis is likely to be most helpful if the analyst has taken care to examine closely the character and source of the problem confronting the decision-maker, the objectives he wants to achieve, the obstacles he must surmount to achieve them, and what achieving them does for him.

II. An Air Force Example: Genesis of the Intercontinental Mission

Let me illustrate these points—the complexity of the decision-maker's problem, its identity with the problem tackled by the analyst, and the usefulness to the analyst of examining the way the decision-maker's problem arises—by recalling the history of the B-36 and the genesis of the Air Force requirement for an intercontinental bombing capability. This story will throw a little light on "Missiles Systems for the Future" (MSF), the hypothetical systems analysis which Mr. Quade presented for course study.

The B-36 was conceived in April, 1941, after the fall of France, and a succession of defeats which isolated the United Kingdom and consolidated the German position in Western Europe. It was thought of as a hedge against the possible loss of England, an insurance that in the event of this loss, we would be able to fly over the bodies of our fallen friends to administer some damage to Germany. Major Vandenberg and a small study group in the Air Plans Section called for a bomber of 10,000 statute mile range, capable of delivering 10,000 pounds of high explosive. By the fall of that year after a design contest, two prototypes were ordered.

But while the prototypes were being readied, the situation changed drastically. The prototypes had not been delivered by the summer of 1943, and by then it was clear that the United Kingdom was not going to be lost. We were, however, now at war with Japan. Though we had won Guadalcanal, the outcome of the stepping stones campaign was uncertain. The B-36 was then conceived as a hedge against failure here. To shorten the slow development–procurement–operation cycle, we ordered 100 B-36's in advance of the delivery of the prototypes. Some place along in this process also there was trouble with the B-29. And the B-36 then assumed the role of insurance against trouble here.

But the stepping stones campaign succeeded, and the B-29's began to look very good. And, since there was an aluminum shortage, the B-36 program was stretched out. After VE day it was clear the B-36 was not going to play a role in World War II. The Air Force, however, was clear about the fact that World War III had to be considered, and there was a serious problem as to the base-target radii which might be forced on us. What bases could we obtain for use in the next war, and how long would it take us to get them in time of peace or war? As we know, now that we have secured military rights in a great many countries, such negotiations are long drawn out and uncertain. General Vandenberg recommended buying the B-36 to hedge against the uncertainties of peace-time negotiation and as an alternative to seizure after the outbreak of war.

This brings us to the post-war period. Up to this time the B-36 had been conceived entirely in terms of the delivery of high explosives, with all of the limitations this imposes on effectiveness at extended distances. Hiroshima changed the aspect of strategic bombing in general and improved in particular the prospects of intercontinental delivery, which up to then could have had only a marginal value even as a measure of desperation. Now it appeared that if we could get the B-36 into production, we might have a real hedge for assuring a devastating bombing of Russia in case this became necessary. And the succession of war scares beginning with the Berlin airlift, and before we had developed an extensive overseas base system, suggested that it might indeed be necessary.

The role of strategic bombing at this time was conceived rather differently from the way we look at it today. We had, and assumed we would continue to have, only a very limited supply of A-bombs. We assumed the enemy had none, and could wage only a high-explosive campaign against the U.S. and against our bases. The B-36 atomic attack against the enemy's vital industrial and administrative centers appeared then not merely as a retaliation and a deterrent, but, by interrupting the slow process of attrition which was all the enemy could hope for in a high-explosive campaign, it appeared it would serve also as a war-time defense of our own military potential.

But meanwhile more troubles beset the B-36. There were performance problems, for example, in achieving military missions with the range originally called for. And there were a variety of modifications of the plane incorporating some of the advances in the state of the art not originally anticipated. By the end of 1947 other instruments for accomplishing very long-range missions were being given favorable consideration. In particular air-refueling was recommended by the heavy bombardment committee as permitting bombers with better speeds and other desirable performance characteristics, as distinct from combat radius, while preserving extended radius for the system (tanker plus bomber) as a whole. And the need for high performance in the penetration segment of the mission was emphasized by the perfection of jet fighters.

About this time the well known inter-service disagreements on the subject occurred, and there were also a good many differences of opinion in the Air Force. In these disagreements the relative importance of range, altitude, speed, and weight were much agitated. Within the Air Force there were advocates of the B-29 as well as advocates of the B-36. The former stressed the B-29's speed superiority, the latter emphasized the B-36's longer legs. But throughout the discussion one thing was evident. Speed and range were both desirable performance characteristics, as were also altitude, military load, and a good many others. But, in general, if you got a maximum of one in any given state of the arts, you sacrificed one or several of the other performance features of the plane. Unfortunately, it isn't possible to get the best of everything. You have to trade something of one for something of another. But at what rate should we trade? How do speed and altitude affect our anticipated attrition in the air? How does range affect our attrition on the ground, and our dependency on our allies? If in the long history of the B-36 no very clear-cut answers to these questions were made, this is hardly a derogation of the disputants. This systems analysis course, I'm afraid, will make evident there are at least a few aspects of these questions that are not exactly settled now. In fact, it is not easy to describe exactly how you go about answering these questions.

The Morals

One question I do not intend to raise is whether the Air Force was always right or sometimes wrong in the extended sequence of decisions it had to make in the press of this fascinating history. Such a question I feel is supremely unimportant. It is of course much easier to be wise at this stage. (Many of the decisions, I think, were correct in context even if improvable with hindsight. And while others were questionable, this is hardly interesting.)

There are, however, several morals. The first is that the Air Force decision-maker's lot is not an easy one. The history of the B-36 development, procurement, and operation illustrates vividly the process of selection among a huge multiplicity of uncertain alternatives. Bases, targets, range, speed, altitude, bombs, enemy defense and offense all assumed in prospect and in actuality at least as many values as Mr. Hitch demonstrated were present in a systems analysis. And these were not trivial variations. Just think of the change of our bomb load from iron bombs to the Hiroshima A-bomb and then to the multi-megaton H-bomb. And the change in the enemy's defenses from props to jets.

Second, the objective of an Air Force decision may itself be far from simple. In the case of the B-36, the Air Force had not one but many objectives and these were altered radically by swift changes in the strategic and technical situation.

The third point also concerns objectives. It appears that the differing vehicle types in "Missiles Systems for the Future," like the B-29 and the B-36, might serve partially different (as well as partially identical) objectives. But how then do we compare them?

The fourth point this history illustrates is that while choice among nice things is difficult, it is also necessary. Objectives conflict. It is not possible to move ahead simultaneously in range, speed, altitude, and everything else. But how do we choose a particular combination when we make up, say, a general operating requirement for SAC? And how do we design our systems studies so as to answer rather than beg such questions?

The fifth point the story illuminates is the function of hedging or insurance objectives and the role of intercontinental bombing. The B-36 was conceived as a hedge and the problem of hedging against analogous uncertainties is always with us. Such a problem should generate plans for contingencies which might not eventuate, in fact may be unlikely. As I have mentioned, "Missiles Systems for the Future" hardly faced this problem in its comparison of intercontinental and overseas missiles, but neither do most staff studies or systems analyses. How do we design such studies? And how can we best design a force that includes an insurance capability?

I have stressed that systems analysis is no more difficult than Air Force decisions. In a sense, they are no less difficult either. They should start and end with the Air Force objectives and the obstacles to obtaining them. But in the process of analysis these objectives may be refined and altered. I would like to examine the way in which objectives enter into the process of Air Force development.

III. Objectives and Constraints in the Design of Systems Studies

One man's means is another man's objective

This brings us to the subject of Air Force objectives. The Air Force gets out in the course of its development planning various documents called GOR's: general operating requirements for an interceptor, say, or for a bomber. A GOR for a chemically fueled bomber might state as an objective that the plane be able to travel 4,500 nautical miles and return without refueling, that it be able to go Mach 2.5 for 1,200 of these 4,500 miles, that it be able to carry bombs of a certain size and weight and deliver them with a given accuracy, say 1,500 feet, and that the altitude of penetration and bombing be greater than a certain minimum. Another GOR, for a nuclear-powered bomber, might state in addition to a certain combination of the familiar performance parameters, that the radiation dose absorbed by the crew must be no greater than .2 roentgens per hour. And similarly in the field of base installations the Air Force sets certain goals. For example, it has in the past asked contractors planning air bases in the ZI to concentrate the elements on the base so as to reduce utilities such as roads, plumbing, etc. to a minimum within the limits set by the normal fire safety clearances.

So far as the contractor is concerned, these goals are taken as constraints within which he does his work of design. This is necessary in order for him to get on with his work. The aircraft designer then considers in the light of his knowledge of the state of the arts, such questions as the best system for controlling armament on a platform moving in the way required of the given aircraft, the optimal configuration for the wing and fuselage in order to house the required military load at minimum weight or cost. If the contract concerns bases, the contractor will consider the best configuration of runways, parking areas, housing, etc., given a certain site in order to keep costs to a minimum for the desired operation. If we designate the objectives which the Air Force specifies O_i, and the means which the contractor uses to obtain these objectives N_i, we might describe this situation as follows:

(1) M_i –› O_i

Now within the contractor's organization, in perfecting the detailed design of M_i, it will be useful for M_i itself to appear in the form of a constraint or objective toward which some smaller section of his organization is working, a lower-order objective clearly than O_i. We might write it O_i-1. And revrite formula (1) as

(2) O_i-1 –› O_i

And just as little fleas have smaller fleas to bite 'em, and so on ad infinitum, this process of division of labor might be continued with profit. So that we could write formula (3) as follows:

(3) . . . –› O_i-2 –› O_i-1 –› O_i

For example, to achieve one component objective in the development of an interceptor, there might be a very large group working on the fire control system, and this group might have separate teams working on the airborne radar system, the analogue computer, and the armament systems, which are components of the fire control system. The team might take as an objective the design of the airborne radar with, among other things, a scan angle of 70 degrees each side of dead ahead, and work within this constraint. (See Figure 1A.) But the point to recognize is that just as we have extended our horizon to the left of O_i, analyzing the way means to the Air Force objective might appear in the form of narrower goals, we might also extend it to the right and on occasion must, looking to see what further ends are served by the Air Force requirement.

(4) . . . –› O_i-2 –› O_i-1 –› O_i –› O_i+1 –› O_i+2 –› . . .

Or take our example of the fire control system for the interceptor. We might have a sequence of increasingly comprehensive systems: airborne radar, fire control system, interceptor, interceptor wing plus ground radar, a defended offensive wing consisting of an interceptor wing plus a ground radar plus a bomber wing, and so on. Figures 1A and 1B taken together illustrate this hierarchy of systems. While the narrowest systems can be treated, and, in fact, most frequently must be treated, in comparative isolation, this isolation is only comparative and never final. it is always possible that there is some important interaction affecting design on other levels. For example, it might be that it is difficult to design the radar to have a scan angle of ±70 degrees as specified, but by designing the interceptor to have atighter turning radius this angle could be narrowed. Or one might have to move further up the echelon of systems: It might be best to relax both of these constraints and increase the accuracy of the ground data-handling process to get the optimal solution for the problem of increasing the kill probability of the interceptor plus ground radar system. A still wider analysis of the problem of defending the SAC wing might indicate solutions in which interceptors were not involved at all. Local defense missiles, for example, might be a better way to do it, or some form of passive defense. Specific constraints are necessary at every point, but none of them can be regarded as final.

The history of the B-36 illustrates that no set of specifications such as 4,500 nautical mile combat radii, Mach number equal to 2.5 etc. can be regarded as final. It represents a choice among a lot of other alternative combinations of speed, altitude, radius, etc. and inevitably compromises some performance in order to better others. Whether or not this is a good choice depends on a variety of uncertain variables whose interaction we are bound to get to understand better in the process of design and development, and whose aspect may change over time.

The requirement that air base design concentrate elements in order to keep utilities to a minimum was sensible so long as these bases were not seriously subject to enemy bombing attack. Up to fairly recently overseas bases were designed for protection only against high explosive attack, and ZI bases were designed with no protection against enemy attack whatsoever. Given a growth in enemy capability it is clear that we must choose a different combination of utility cost, operational convenience, and resistance to attack. The Air Force has therefore re-evaluated this objective.

It is not merely that changing circumstances alter cases, that what was a correct choice at one time is outmoded by events. At any instant of time choice is a very complicated act. The crew dosage limits for nuclear-powered aircraft, ANP, which I mentioned a short while ago, will illustrate this point. The question of these limits is central in the ANP program. To reduce the dose, we must increase the shield. But when we add such dead-weight to a plane, we must increase the gross weight by a very much larger amount. Implicit in the limits set is the assumption that nuclear-powered bombers will be used in time of peace frequently, the way we use chemically-fueled bombers. But if the crew is to fly frequently in time of peace, it must receive a very small hourly dose in order to keep life-time doses within tolerable bounds. Very small doses mean very large shields, and large sacrifices in other parameters. The peace-time training requirement, then, which has an obvious utility, has also a large cost, and therefore needs looking into. Frequent nuclear operation in time of peace involves large costs, not only in aircraft design to protect the air crew, but also in base design and base operation to protect the ground crew. The Air Force contractor, as I have said, must of necessity accept as fairly firmly given, the Air Force statement of requirements, so that he can get on with his job. But the Air Force itself and the systems analyst must continuously re-evaluate these objectives in terms of what they cost and in terms of the alternatives they sacrifice. The analysis of just such constraints is one of the most fruitful areas for systems analysis. Analysis of this hourly dosage constraint might lead to the design of ANP systems which exploit to a maximum the very different needs of operation during an extended period of peace and operation during a short atomic campaign. In summing up what I have said on the subject of objectives and constraints, I want to stress that the goals set down in the course of Air Force policy decision should never be taken as final. Ends are means to further ends and on occasion must themselves be evaluated. One man's means is another man's objective.

Broader Air Force Objectives

If we are to evaluate the fairly narrow or specific objectives we have referred to so far in terms of broader ones, what are some of these broader objectives? Are they final? (You may observe that I wrote formula (4) in a way that suggests that they are not. I ended up with some dots — "O_i+2 –› . . ." — suggesting "and so on.") The objective of defending a SAC wing is interdependent with the objective of defending our cities. And it is subordinate to the goal of using SAC to destroy such enemy target systems as the enemy SAC, cities, and ground forces. But these target systems themselves are interdependent. Joint capability for their defense and joint capability for their attack are relevant considerations which will affect the design and the results of a systems study.

Moreover we might—I would argue sometimes must—consider a still broader menu of Air Force objectives. If we were to set up a comprehensive menu, this would include many things that would be very nice to have, some we'd willingly settle for, and some items which we would regard as the minima necessary for life. let me discuss some of these alternatives under three heads: 1) provocation, 2) deterrence, and 3) capability of winning the war once started.

First, provocation. It is clear that in the past there have been advantages in getting into at least some sort of war. And, while this is a delicate matter, it is also possible that in the future there might be some sorts of conflict which would be to our advantage. This depends on the nature of the damage done to us, both physically and in our relations to the rest of the world, as well as on the certainty with which we could achieve our objectives in the war. In any case it is apparent that one might use the Air Force to help stimulate this hypothetically advantageous conflict. While this is clear, I think it is also clear to most of us that there are a great many advantages in not getting into World War III.

This brings us to deterrence, the second category. This is frequently, and I think correctly, stated to be the Air Force's most important objective. If the winner in World War III could conceivably sustain thirty million casualties it is clear that there might be some difficulty in defining the notion of winning the war game. The symmetrical thermo-nuclear war game is what game theoreticians call non-zero-sum. The "winner" does not come out with an increment in utility which equals in amount the loser's loss. In this case it is very important to concentrate on the cold war game whose pay-off is the avoidance of the non-zero-sum thermo-nuclear game, in which both sides are merely trying to keep their catastrophes to a minimum. This is the function of deterrence.

The third category, having a capability of winning the war once started, has already been illuminated some by the comments on deterrence. We would like this capability, not for the sake of using it so much as to avoid the occasion for its use. And the difficulty of defining winning, which I have suggested, indicates also that there is a whole spectrum of victories which we might arrange in order of decreasing desirability:

victory in style: for example, being sure that all our cities and those of our friends and allies will survive;
at least all our cities;
anyway a fifty-fifty chance for a significant number;
technical win—two Americans surviving and only one Russian.

We would want in such a war to have a high confidence that we could destroy the enemy's economy and administrative centers. Or at least a good chance. And on the other hand we might also consider the advantages of having something left to reconstruct of the enemy's economy and population.

Overlap and Divergencies

The variety of all the things we want sets quite as much of a problem for the analyst and the decision-maker as does the multiplicity of alternative measures for achieving these wants, and the huge number of things which can interfere. For these objectives are interdependent. Getting one affects the satisfaction of another. Sometimes favorably: we kill two birds with one stone, or a plant as well as an administrative center with one bomb. And even if the interdependence is favorable for the fulfillment of the real problem, it may complicate the analysis. We find ourselves in a welter of considerations of such matters as the incremental cost to do job J₁ with weapon system W₁, when in any case you are doing job J₂ with weapon system W₁, and comparing these results with similar results for weapon system W₂.

At other times the interdependence is unfavorable. Suppose in our birds and stone example, for one reason or another it is important for us to discriminate. Suppose, for example, we want to attack counter-force targets and not cities.

Consider some hypothetical campaign comparisons between two strategic bombing systems, one based and operated overseas and the other based in the continental United States and in this example to be fueled exclusively by air. Figure 2 depicts their (purely hypothetical) comparative effectiveness in a counter-force mission, given U.S. initiative. The overseas based system destroys three-fourths of the Soviet strategic force (SUSAC); the U.S. based system only one-fourth.

How do these systems make out against Soviet cities? And (remembering this is a two-sided war) what, in the face of our attacks do the Soviets do to our cities? Figure 3 purports to show this. The overseas based system knocks out well over three-fourths of the Soviet city targets and, because of its extensive demolition of the Soviet long-range air force, the remainder are unable to saturate our defenses and do more than a moderate amount of damage to our cities. This would be winning the atomic war in style. The U.S. based air refueled system does considerable damage to his cities—gets about half of them—and so could be at least a moderate deterrent, but it does not succeed in staving off an even more massive destruction of our own cities.

Would the capability shown for the overseas based system be a deterrent? The answer to that might seem to be a resounding "Yes!" But Figure 3 like Figure 2 assumed we had the first strike and after all what we are supposed to be deterring is his strike. What would happen to him if he did strike first, assuming in one case that we have the overseas operating base system referred to and in another case assuming the U.S. based air refueled system? Figure 4 shows this for our two fictitious systems. With the first strike the enemy destroys almost three-fourths of our cities, a full three-fourths of our overseas based SAC and the undestroyed remainder of our overseas force manages only a very minor retaliation against Soviet cities. Here he wins the war in style. The ZI based system on the other hand which did not do so spectacularly well where we had the first strike does not do much worse when the enemy takes the initiative; at least the enemy does not come off unscathed. Which of our two hypothetical systems then is the better deterrent? It seems fairly clear that in this example at any rate it is not the overseas operating base system.

Among the overlaps in our major objectives we should mention then that our capability of winning the war (objective three) and especially of winning it in style is a deterrent (objective two) provided that we can win it even if he strikes first, that is, even if he does what we are trying to deter him from doing. If this proviso is not fulfilled and the outcome of the campaign depends entirely on who strikes first we have no deterrent but only a provocation and in this case an unwelcome one. The analyst must always be wary that the specific methods of accomplishing one objective do not compromise some other even more important objective. This is a caution which must be observed in evaluating alternatives in terms of our major objectives as well as in the case of our narrow objectives. While I need not point out that there is a distinction between provocation and deterrence there are many less obvious points of divergency and distinction between the job of deterrence and the job of having the capability of winning the war once started.

Let me illustrate this point with an example which is, alas, familiar to all of us: the activities of the traffic cop. The city fathers would like to reduce the number of violations of the law. They would also like to fine or put in the clink as many violators as they can. There are two well known alternative techniques for accomplishing these nefarious ends: one is the familiar ambush technique; the other is sometimes called the visible patrol technique. The first increases the probability of interception and arrest. The second discourages culpability. Now if our goal is to maximize the number of speeders punished, or the proportion of speeders punished, or the total of municipal revenue through fines, ambush, however uneasy such sneaky tactics make us, is very likely the best way to do the job. If our goal, on the other hand, is a reduction in the total number of traffic accidents, say, or in the number of attempts to violate the law (even if on the whole such attempts as take place are more likely to be successful, since better informed), it may very well be that the most frequent, obvious presence of policemen capable of massive and instantaneous retaliation against speeders would encourage caution, and so achieve such goals best. (It might also avoid some of the undesirable side effects of the ambush technique such as the occasional, faintly ludicrous vision of a burly grown-up on a motorcycle trying to look invisible behind a palm tree, with its undoubtedly crucial dissolving effect on our respect for municipal authority.)

Let me offer an actual example which concerns the vital problem of making sure our strategic force will survive any enemy attack, and so is related to the hypotheticals just dealt with. One of a great many methods that I have heard suggested for protecting SAC would reduce the chance of SAC's being hit essentially by deceiving the enemy into thinking that SAC was very vulnerable some place where in fact it is not. The enemy, the argument runs, would attack our strategic force in this apparent soft spot, expends its bombs fruitlessly and so gain us a crucial advantage in winning the war. The particular line of deception that was suggested in this argument involved costs of over a billion dollars and it seemed clear that the deception might not work even then. Fortunately, there are alternative deceptive tactics that are cheaper and more deceptive. But the essential weakness of the argument was that it ignored the fact that if the enemy answered this invitation to clobber a supposedly soft SAC with a joint attack against our cities and our strategic force he might very well miss SAC but, unfortunately for us, hit Washington D.C., New York, Los Angeles, and the rest of our major cities. He would then open a war he might not have dared to start unless he had been deluded into thinking he could destroy our retaliatory force. Deceiving the enemy into thinking SAC is vulnerable some place where it is not ignores the fact that SAC's deterrent effect depends on a reputation for invulnerability everywhere.

The possibility of overlap and divergency among our objectives must affect our analyses. This can happen in the formal part of the analysis, perhaps by forcing a broader criterion of choice encompassing the inter-dependent objectives. Formal introduction is not always easy, as our deterrence example suggests. But if they cannot be introduced into the numerical model, neither can these difficult-to-measure interdependencies be banished from our interpretation of that model. They must qualify the numerical comparisons.

Deterrence in general does not enter directly in our models. We make a bow in the direction of deterrence in the prefaces to our reports, but seldom recur to the subject in the body of the analysis. The analysis measures our capability of performing some tasks during the war itself. But if it is hard to assign numbers to deterrence, in comparing systems we should at least check for possible disadvantages one or another of the systems may have, considered from the standpoint of this important objective. And, I think more can be done by analysts in this difficult area. I shall refer to a class of measures which are not completely satisfactory in the sense that they are inadequate to provide us with high-confidence capabilities for success in various tasks during the war, and yet might have a large deterrent value. Some of these measures might be very cheap and their exploration fruitful, even though they give us no firm assurance either in the cold or in the hot wars, but merely make it less likely that the cold war will turn hot. Such an objective is a modest one perhaps, but hardly to be sneezed at. I will return to this class of unsatisfactory but valuable measures after saying a little about the enemy's objectives and their relevance to a systems analysis.

IV. The Enemy's Objections and Agreements

In talking of the Air Force objectives which a systems analysis might help to further, I listed a whole hierarchy of desires ranging from delectable to desperate minima. I said nothing of the enemy's objectives and the objections he might have to our fulfilling our own desires. But of course it is part of the essence of the problems we are considering that they must always be looked at symmetrically. The enemy has goals which are counterparts of ours and in direct conflict with them. (He also, fortunately, has some goals in common with us, but not enough to make our problem a simple one.) Clear as this is in principle, it is frequently forgotten both by analysts and decision-makers. And it is not easy to introduce the enemy into our calculations in a way that assigns him the degree of freedom, which he in reality has, to louse up, say, our simple desire to maximize the number of his cities destroyed. In considering the enemy's active defense through which our offensive systems must penetrate, do we take into account the devices open to exploit the peculiar weaknesses of each of these systems? In most of the analyses I have seen, either formal systems analyses or staff papers, I think not. MSF is deficient here, but hardly more so than the run-of-the-mill study.

For example, MSF does not permit the enemy to adjust his defense budget so as to spend more money on local defense to combat systems primarily vulnerable to local and not area defense. This is bad. But MSF leaves the enemy offense out of account altogether. While differential air attrition is looked at, differential ground attrition is not allowed to figure at all. In this respect, unfortunately once again, MSF is not below standard. And this deficiency is by no means trivial. RAND has found that the effects of ground attrition in a strategic bombing analysis can frequently dominate the air attrition effects. Some analytic empirical method of dealing with ground attrition, however grossly, is in general essential. I stress empirical method because I have come across a recent study of some strategic bombing systems in which the outcome of the comparison was determined almost entirely by costs of defending SAC bases on the ground. The whole very considerable margin of superiority of the preferred system over the rejected system was attributable to these defense costs. But unfortunately these costs were wholly arbitrary and not themselves the results of analysis. While this arbitrary assumption was embedded in a fairly elaborate model, it hardly fulfilled the requirement that I am describing, namely taking enemy offense into analytic and empirical account.

Mr. Hitch mentioned games and game theory as devices for taking enemy reactions explicitly into account. Game theory, as he stressed, is helpful conceptually, though still far from direct application to any complex problem of policy. Games can be a useful component of a systems study, and Mr. Specht will have a good deal more to say on this. I would like to stress here that it is essential to take enemy reactions into account, and that this need not be done in the framework of a formal game, with its apparatus of explicit rules covering permissible moves and determining the pay-offs for each play. For example, RAND analysts, in conducting map exercises to determine the performance of alternative defenses typically would try some defense tactic and then try to figure the best means the enemy had available for countering this tactic; then would try another tactic, again examine the possible counter-moves, and so on. In this way each strike calculated was actually the result of a rather extensive canvas not only of our tactics but of enemy reactions. Matching best enemy counter-moves to our own choices is also an important part of RAND's work on airbase choice. This matching is one kind of minimax analysis. Such information attempts to introduce the enemy by letting him do his worst to our forces and then seeing which of our forces accomplishes the job most effectively in the face of this best enemy attempt, are sometimes more informative than a formal game. Too frequently the real questions in doubt concern the rules of the game, whereas the players of a game are likely to be concentrating all their ingenuity on how to exploit the rules.

But whether by use of formal games or by some other device, the enemy must be present in our analysis, as he will be present in the war: stubborn and uncooperative, complicating our analysis as well as our life. Sometimes the recognition of the enemy's potentialities is very unpleasant. In talking about how to conduct a campaign to destroy his force on the ground before it hits our forces and our cities, the advantages of having the first strike are obvious. Without it we are locking the barn door after some and possibly most of our forces are stolen. (It is difficult not to conclude that we just can't countenance his getting the first strike.) But one can conceive of analogous conversation among the Russians about the problem of destroying our Air Force. If the first strike is good for us, he undoubtedly would like it too. This is just the sort of thing that is difficult to negotiate with Communists. Moreover, since he has some intrinsic political advantage over us for engineering a surprise attack, we must contemplate his getting the first blow as one strong possibility. This is one contingency we must plan for.

How should a systems study deal with uncertainties as to the enemy's capabilities and intentions? We have seen one way of avoiding the problem where the enemy was considered at all was to limit consideration only to some fixed composition of offense or defense which is not allowed to shift in response to aspects of our strategy sure to be known to him. This makes a comparison of alternative systems subject to at least an unconscious bias in favor of systems that deviate from the norms this fixed force might have been invented to counter. And it makes the problem of meeting the enemy too easy. We assume some fixed combat ceilings for his fighters and then devise a bombing force capable of flying slightly higher. Or we assume some specific limit to the range of his local defenses and then work out a device for sending off bombs from just outside of this boundary.

But what is the alternative to this? To assume no resource performance constraints on his part at all? This would simplify analysis too by making the problem insoluble. If our resources are limited and his are not, not much calculation is required to figure the result. And we hardly benefit by merely assuming we have an absolute defense against his hypothetical absolute offense. There is a germ of wisdom contained in such attempts to release the enemy of any constraints whatsoever. It suggests that in addition to trying various reasonably estimated constraints, it is good to find the enemy capability at which our strategy breaks down. This of course will always occur at some finite point of enemy capability.

In general then it is important to make bracketing estimates of at least the general resource limitations in order to keep the subject short of the realm of science fiction. But on the other hand we must give the devil his due and permit him such freedom of allocation within these resource constraints as are applicable for the time period under consideration. This means that for development problems there are very few specific resource constraints, that is, inflexibilities, that we can safely assume.

The trouble with most air attrition models that have been used to answer development questions is that they treat such questions as if they concerned procurement or operations. Each of a few offense vehicles, for example, will be represented by a specific combination of numbers designating speed, altitude, payload, CEP, etc. Each is matched against the same fixed area and local defense force deployed in the same way. But even if such a model covered only procurement and operational alternatives, it is clear that such a procedure omits significant possibilities open to the enemy. And ourselves. For even when we are buying an item already developed, we invariably find it open for some growth and adaptation with changes in the state of the arts during its period of use. So the B-36 acquired jets. Such models omit much of the real freedom of choice available to both sides.

For development problems in particular we can't take performance parameters as fixed. We need some technique for picking good performance requirements, useful goals for the designer. How might we go about this? I have suggested that one method would be to test each system which fulfills a given set of performance goals against an enemy counter strategy which, within only general resource constraints and using information reasonably likely to be available to him, is devised precisely to exploit the weaknesses of the system we are testing. It is clear of course that the problem of picking optimal or even good matching strategies for the enemy and ourselves increases in difficulty as we consider strategies more distant in time. We will have to consider not just a few air battles involving specific bombers versus specific fighters, but very large families of battles of offensive vehicles of various types versus various mixtures of local and area defenses. And large families of circumstances involving differing resource allocations by both ourselves and the enemy among active and passive defense and offense.

One way of dealing with uncertainties as to the enemy capabilities and intentions then, is to assume that, within limits set by his resources and the time and information available to him, he will do what is from our standpoint the worst. I do not think that this is the only kind of enemy strategy to consider. There are some non-optimal strategies is even more difficult in analysis than dealing with optimal ones. If we're lucky there may be only one optimal strategy, but it is clear that there are always lots of bad strategies. Which of these are worth looking at? There is at least one worthy of careful attention. This is the sort of strategy we may call an "inert strategy," that is to say, one in which he continues to behave as our intelligence tells us he is presently doing, even though circumstances, and in particular our own strategy have changed. Bureaucracies have a great deal of inertia and we must not overlook this fact. He might, for example, have a rather stupid strategic base system. I have already indicated that I think that it would be very unwise to depend exclusively on the assumption that he is going to be stupid. But it would be a great mistake to ignore this possibility and so find ourselves unable to exploit any deficiency he might have. When you work on such problems as the job of destroying his strategic force, which can be very difficult if he behaves intelligently, you will want to combine such moderate success as you are able to assure in the face of an intelligent enemy defense with a capability for a resounding victory just in case he is "inert." Inert strategies are important as benchmarks, but they also are useful to consider in developing low-confidence measures. And, as I have said, given the uncertainties and difficulties the Air Force confronts we can hardly afford to neglect such measures.

This example displays the enemy in his familiar role of being precisely in conflict with us. The next subject concerns some items in which his interest coincides with ours. This is the interest in not starting something in which both sides will get thirty million or so casualties. It is only because the enemy has such points of agreement that deterrence can work. This brings us once again to the subject of deterrent measures, which as I have indicated could stand further analysis.

V. The Modest Value of Mutually Unsatisfactory Strategies

I have mentioned that measures which give us a high confidence of destroying the enemy's cities or military potential are a powerful deterrent. To have such measures fulfills our fondest desires, precisely because they decrease the likelihood of war and at the same time provide powerful assurance just in case war does break out. While it is possible to obtain some such high-confidence measures in critically important areas, this is not always the case. And therefore it is useful to consider some measures which fall short of providing us with such high-confidence war-time capabilities.

You will recall that I listed several high-confidence objectives in describing the broad categories of Air Force goals. The first I mentioned was our desire to have a high degree of confidence that all of our cities could survive an enemy surprise attack. Let's say we mean by high degree of confidence at least 90 chances our of 100. Another high-confidence objective which is more realizable is the goal of maintaining a SAC of which a large and powerful portion will remain undestroyed by an enemy surprise attack.

The enemy also has some fond desires which are symmetrical to these. He would hesitate to go into a war if he could not be fairly sure that he could destroy enough of our urban areas seriously to reduce our military potential. Even more obviously he would hesitate before undertaking a surprise attack which left our strategic striking force in a position to return a devastating blow. Let's say, then, that we would like to preserve our striking force with very high confidence (at least 90 chances out of 100). He would like to have a high confidence (at least 90 chances out of 100) of destroying all of our SAC not sure to be handled by his defenses. Now suppose we have such a high-confidence measure for a certain fraction of SAC, and then think up another measure which gives us a fifty-fifty chance of preserving a considerable additional fraction. It is clear that this additional measure does not fulfill our fondest desires. On the other hand, it should be observed that it does prevent the enemy from having a better than fifty-fifty chance of realizing his fondest desires. It makes a surprise attack a gamble and therefore acts as a deterrent. Particularly where we don't have high-confidence measures, the value of such low-confidence measures is clear.

How basic is the distinction between high- and low-confidence measures? Do two or three low-confidence measures add up to a high-confidence measure? Not necessarily. In low-confidence measures what we are trying to do it to decrease his confidence rather than raise ours. One of the ways we might decrease his confidence with respect to the success of some particular attack strategy might be to increase the variability of his result, even if we don't affect how it comes out on the average. This would increase the risks for him, and would help the deterrent function typical for the low-confidence measure. But it also means that since we have increased the variability, we have reduced our own confidence too. Therefore our fondest desires are not satisfied. That is one reason we must continue to seek high-confidence measures where we do not already have them. They can't be replaced by low-confidence measures. However, it is important to study systematically this less ambitious class of measures, especially where we are not able to find means of satisfying our more ambitious goals.

VI. Uncertainty and the Design of Systems Studies

Low-confidence measures offer an example of how we might exploit uncertainty. But I have said enough to indicate that whether it is useful or merely annoying, uncertainty is a central problem in the design of systems studies. (Mr. Marshall's lecture is devoted entirely to this subject, but you will observe that most of the speakers are forced to engage this dragon.)

We are uncertain, then, even as to what we want to do, and certainly as to what we can do, and what the enemy can and will do, and as to the physical and political environment of our and his actions. How do we deal with any of these uncertainties in designing a systems study? I have said a little about the treatment of enemy intentions and capabilities. How about the first of these uncertainties, the uncertainty as to our objectives? This should be somewhat easier to handle than the other dragons.

There are several ways of dealing with the problem of framing an objective for our analysis, which is both workable and of some policy interest. Some appealing methods merely avoid the problem. For example, we might 1)frame the objective narrowly enough to measure, and so make it workable, but also make it too narrow for validity or interest. Some of the issues raised in the course of the B-36 history illustrate this. We are clearly being too narrow if we select one performance characteristic and simply maximize this, or maximize it subject to a few constraints. For example, if we attempt merely to pick the fastest plane, or the longest radius plane. The longest radius plane possible in the current state of the art of power plant and air frame design, neglecting any considerations of payload, speed, etc. might travel some 7500 nautical miles and return, according to the lecture by Mr. Rumph earlier in the series. Mr. Rumph stresses, however, that such a plane would hardly do a militarily useful job. We might therefore specify certain minimum performance in speed, altitude, and payload, etc. and then call for the maximum radius plane subject to these conditions. Alternatively we might maximize speed, subject to certain minimum requirements placed on radius and the other performance parameters. Both these courses are simple, but leave us no method of choosing between them. Nor do they suggest precisely what minimum constraints to place on the performance parameters we are not maximizing. For this reason, the selection of general operating requirements for SAC bombers cannot be solved so simply. Such a procedure merely evades the problem.

A second way of evading the problem might be to take the opposite course, formulate the objective with perfect breadth, but fatal hallowness. We do this, for example, when we merely formulate criteria which appear to test for a variety of contingencies, but don't, because of the presence of a variable which cannot be determined in the degree of specificity needed for decision. It is easy, for example, to write out criteria for choosing the best system considering the maximum expected performance under a variety of contingencies, each of which is supposed to have a specific probability associated with it. The contingencies might in one case be: outbreak of war next year, and the year following, and the year following that, and so on. In another case they might be: defection of England, defection of Libya, defection of Canada, defection of Texas, and a series of similar catastrophes. But if our choice depends on our being able to assign exact numbers to the probabilities of each of these contingencies, such a formulation does not advance us very far, since none of us knows how to do this. (The case, I shall argue, takes on a different aspect if we can find or construct systems, the choice among which depends only on very gross inequalities in some such probabilities.)

In going about the job of framing workable and useful objectives, it is not inconsistent with our cautions about narrow criteria to use narrow criteria as an intermediate step. In fact, this is one of the most useful ways in a systems study to frame workable and useful objectives. Ideal kill potential is sometimes used in this way in RAND analyses of air defense. Intermediate criteria enable the comparison of large subsets of alternative weapons and the sifting of grossly inefficient ones. But the comparisons must be made carefully and only between devices that are essentially similar in the way they would enter broader optimizations. For example, an analysis of air defense may make such direct comparisons among defense weapons with ranges of say, 15 to 25 miles, and it may make direct comparisons among weapons of 200 to 300 mile radii. But it must not use the kill potential concept to compare the 20 mile radius weapon with the 200 mile radius weapon. Similarly a RAND study of airbase choice used as one of several intermediate criteria "maximum number of enemy targets killed in the face of enemy defense (but neglecting enemy attack)" and as another, "maximum number of bombers surviving enemy attack on the ground." In some cases, systems could be compared here usefully, even though they were expected to enter broader optimizations with contrasting success, because the difference between the systems was likely to be emphasized by taking a broader criterion and including certain additional variables. For some of the comparisons, in other words, the intermediate criteria provided an a fortiori argument.

But such intermediate criteria fall short of complete trustworthiness. For example, let us take the criterion of maximum number of bombers surviving an enemy attack on the ground. Such a criterion neglects the offensive function of SAC (just as the other intermediate criterion cited neglected defense). Therefore it is not hard to construct a system which would look very good on this criterion, but would fail in performing the essential strategic function. We might envisage a system which kept the parts of SAC bombers unassembled, and buried each under concrete some place in the Antarctic far beyond the reach of Soviet bombing attack. Our bombers would in this case be quite safe. But so also would the enemy. Our bombers would hardly be usable for an offense against him.

This is an extreme example, but it is only an extreme form of systems suggested all the time. Some less extreme forms of long-range operation sacrifice more bombers in order to purchase tankers than they save on the ground. There are analogous difficulties with some extreme forms of dispersal and shelter. We must then use a broader criterion which takes account of the fact that in defending SAC, we are defending an offensive force, and therefore the measure of success of any defense must reflect the performance of the offensive job. One such broader criterion is "least cost to destroy any given enemy target system (or maximum enemy targets killed for a fixed budget) in the face of enemy attacks as well as enemy defense." Our Antarctic SAC would show poorly by such a criterion. And so do several less extreme proposals.

This spreading hierarchy of working criteria can be related to our example of a little while back. You will recall that Figures 1A and 1B represented an unlimited sequence of increasingly comprehensive systems and the corresponding sequence of formally labeled but unspecified contractor and Air Force objectives. Figures 5A through 5E suggest criteria which might be useful at corresponding phases of the work:

minimum cost for airborne radar with a given performance,
maximum kill probability per pass for given interceptor investment,
maximum area kill potential,
maximum number of our bombers surviving an enemy attack,
maximum enemy targets killed considering enemy attack and defense.

We needn't stop here. As I have stressed, if we are to take into account the problems which motivate the Air Force desire for long-range operation, we must broaden our criteria still further. We should consider the performance of various systems in a variety of contingencies. We must consider not only the expected case, but also the eventualities against which the Air Force must insure itself, even though—like the events against which the B-36 hedged—they may not occur. I will have more to say about contingency planning in the final section of this talk.

Besides the uncertainties as to our objectives and criteria for evaluation, the design of our studies must take into account a number of other sorts of uncertainties. Some of these such as the weather, are not likely to be resolved. Mr. Marshall's lecture deals with techniques for taking such uncertainties into account as well as others. There are some uncertainties which might be resolved by tests within our control. Let me mention an example. The behavior and loading of structures under very extreme over-pressures is not well understood today. One of the results of recent systems analysis suggests that highly resistant structures might have a number of important military uses. A policy implication of such an analysis is that we should undertake the tests to learn more about the feasibility and costs of resisting extreme over-pressures. In this case a result of the analysis is a program for clearing up an important item of uncertainty.

But though some uncertainties can be resolved, others cannot and the problem of uncertainty remains central in any systems study.

VII. Systems Design Versus Systems Analysis

Do the multiple uncertainties we have outlined make analysis impossible or at any rate fruitless? Are we optimists if we hope to find the one alternative which is the optimum of all the millions? It would appear that dominance is a miracle.

Let me recall that these uncertainties are not merely a problem for the analyst, but one of fact. The factual indeterminacy of the political and physical environment, the variety and instability of our objectives, and the multiplicity and uncertainty of the obstacles the enemy can interpose, suggest that we must design systems which are good or viable in a variety of circumstances. That is to say, the problem is one of devising flexible, strong systems, not only taking systems that have so far been suggested and comparing them. Inventiveness in systems design has a double function. The first is its primary function, that of helping solve the decision-maker's problem of being ready for many contingencies. The second function, dear to the heart of the analyst, is that of simplifying the analysis.

Let me offer one example of how this happens in the small, so to speak, in the daily business of the analyst. In the course of a broad study of bomber systems you have to worry about the vulnerability of various components of a bombing system to enemy bombing attack. The ground facilities including the runways are one such component, though it happens that the runways can be made one of the least vulnerable elements. Getting a model for the vulnerability of a runway is very considerably complicated, if we have to worry about not only such questions as the maximum continuous length of runway surviving, but also whether there is a continuous clear path along some taxi ways providing access to this surviving length of runway. In a so-called Monte Carlo random bomb drop which we might program for the machine, the number of such possible paths of access which we might have to ask the machine to examine is very large and might be prohibitively expensive if we were trying thousands of repetitions of bomb drops as one small component of a much larger investigation.

One way to go about this is to multiply the number of access taxi ways enough to make it very unlikely that there will be any length of runway long enough to be usable without access. Multiplying access taxi ways is quite inexpensive, not only by comparison with total systems costs, but also by comparison with base installation costs. If we do this we have a taxi way—runway system which is considerably stronger. We can have a higher confidence in its survival. At the same time the small excursion necessary to approximate the required number of access taxi ways makes it unnecessary to complicate the analysis by considering the problem of access.

Analysis is easier for strong systems. It is also easy for very bad ones. The really bad ones don't hold us for very long because, for example, we needn't worry about the interdependence of a destroyed plane and a destroyed fuel system. If the facility has many critical vulnerable elements, the capability undestroyed by bombing will be very, very low, and shown so by a simple measure of the percentage killed of some one critical, badly damaged element. A subtle analysis could measure more closely the extent to which even the small surviving elements are rendered useless by the destruction of complementary items. Why bother? We have already seen that the system is very bad.

Similarly if we so design a system of elements so that the chances are very small that any critical element will be destroyed for reasonable ranges of bombing attack, the interdependence questions are quite relaxed. In some cases a quite inexpensive amount of over-design furnishes an a fortiori argument.

Hundreds of such problems occur in the course of a systems analysis. It is always important not to take the systems as they come, but to modify them in the light of inefficiencies revealed in the course of analysis. The aspect that I'm stressing here is that strong systems permit a fortiori arguments.

Are there any principles for designing strong systems? There are no prescriptions for ingenuity, and the design of Air Force systems must proceed on the basis of the empirical characteristics of Air Force problems. Some of these are pervasive enough to suggest certain guide- lines. I will mention a couple. One is to exploit the great difference between the war and peacetime requirements imposed on the system. We might call this "The Thermo-nuclear-War-Is-Not-Peace Principle." Another is to exploit, in devising strategic systems, the very different requirements for the approach and penetration segments of the mission. This is the "It's-Hotter-In-The-Combat-Zone Principle." Let me offer an example of a system that ingeniously exploits this second difference.

With a fixed state of the arts, and an airplane of given size, higher speed can be obtained only at the cost of shorter range. Supersonic speed is very useful in reducing attrition while in range of enemy fighters, but not so important for the long leg of the mission between our bomber bases and the edge of the enemy defended area. The B-58 design represents an ingenious compromise between our design for great over-all range and high speed, by including "supersonic dash" capability for use only when penetrating enemy defenses, through the use of afterburners on the engines. In this way it is possible to attain virtually all the benefits of supersonic speed and subsonic range.

There are a number of examples of weapons systems which exploit the difference between peace and atomic war to advantage. Consider the case of shelters against atomic attack. These are called for two very different sorts of loading. Over an indefinitely extended period of peace, it will be subject to the same sorts of forces as normal civilian structures in the same locality. In a short atomic campaign it will be expected to receive very much more severe loads, but only once or twice, and then it will have fulfilled its entire purpose. Intelligent design practice takes advantage of this difference. The war-time design loads are allowed to exceed the elastic limits of the materials in the structure and work distortions which would be unacceptable in civilian use or in military use for that matter if they were repeated very frequently. They do no harm, however, to the war-time function of these shelters. Other examples could be cited of systems which exploit the great difference between the peace and atomic war-time requirements. Earlier in the lecture I suggested in connection with nuclear-powered aircraft that the shielding problem both of the air and ground crews might be attacked in a way that could exploit this difference. The ground-refueling method of operating bombers is another example of a system which exploits this difference much more completely than do air-refueled systems. Air-refueled systems haul POL which is the cheapest and bulkiest element in the weapon system long distances by air in time of war. The ground-refueled systems haul it the long distances overseas by slow freighter in time of peace and, for the most part only in time of war or on maneuver, pick it up in aircraft. Some of the contrasting forms of dispersal make a good deal of this difference by avoiding the high logistic and operational costs of operating separately in time of peace limiting the time of dispersal essentially to the war-time emergency. So also some systems exploiting assisted take-offs as an emergency device.

How about the possibility of devising systems which are good in the sense that they can meet a variety of contingencies? The B-36 example illustrates the Air Force desire to have a hedge against political and military bad luck. And the uncertainties we have outlined suggest that this is a good idea.

Mr. Hitch worked out an example of the problems of dealing with uncertainty which relates to the specific uncertainty against which the B-36 was a hedge. I would like to use his example, and to expand on some of the considerations he made. Table 1 which Mr. hitch used shows two systems, one dependent on overseas bases, and one made up of very long-range bombers operating from the ZI. It shows these two systems operating under two conditions: 1) with overseas bases available, and 2) without them. I would like to expand both the list of alternative systems and the list of alternative contingencies. Figure 6 does this and also shows in a few of the cases how they might be supposed to fare in the various contingencies.

Table 1. Targets Destroyed by Hypothetical Bomber Forces

	If Overseas Bases Available (a)	If Overseas Bases Not Available (b)	Expect Outcome if Probability of (a) = 90%	Worst
System dependent on overseas bases	100	20	92	20
Very long-range bombers from ZI	50	50	50	50 "Minimax"

Aside from the state of the weather, the six contingencies shown in Figure 6 relate to distances from enemy territory: loss of all bases within 250 miles of Russian boundaries, loss of all bases within 500 miles and so on in several lumps. We might of course lose bases in different sorts of discrete lumps, say all bases in certain politically connected areas. But this illustration will suffice. You will observe first that the contingencies listed while only a small subset of those possible are rather more extensive than those presented in Table 1. Having all our overseas bases or none are extreme cases. We have a very large number of bases in a couple of dozen different countries. And while the behavior of these countries is not by any means completely independent, there is a considerable amount of independence.

The probability that we will lose all such bases, including, say, Canada, is finite but quite small. I have also included Maine as a possible defection to indicate that anything is possible. We can't even be sure of Limestone. (The last contingency shown in Figure 6, the loss of all bases within 4,000 miles of the Russian border, would include this disaster as well as the loss of Canada.) You will observe also that the list of alternatives for operation under these varying circumstances is also now very long, though by no means exhaustive. It includes some systems which so to speak can only operate in lovely weather. This for example is literally true of the pure fighter-bomber limited-radius system which has no special tanker supplement and no possibility of converting its bombers into tankers and has resolved under no circumstance to adopt desperate measures like one-way operation. Its score is terrible in bad weather, excellent in good weather, provided we have bases within 250 miles of enemy territory, and, even then, poor if we get pushed back another 250 miles; and, in any kind of weather, terrible in case we get pushed back any further. The list also includes some systems permanently encased in a hermetically sealed diver's suit, to which are attached, also permanently, galoshes and an umbrella. This system is useful in the rain. It's something of a bother in nice weather. (It is exemplified by the unrefueled and exclusively air-refueled intercontinental systems which for a fixed budget do poorly in a uniform way no matter what bases we have available since it has prepared itself on the assumption always that we shall have to operate at a maximum range. And it is perhaps best of all exemplified by the exclusively one-way system.)

These are essentially the two extremes Mr. Hitch had in mind, his "minimax" and maximum expected value systems. Observe this kind of "minimaxing" differs from that treated earlier in this lecture. Earlier we were concerned with techniques for minimizing the maximum damage likely to be administered by an intelligent enemy. They illustrate in contrast with other alternatives the deficiency of both extremes. As Mr. Hitch stated, both the minimax system (in his sense) and the maximum expected value system are bad. The latter is totally unprepared for the worst case and is possibly destroyed by a faint sign of rain. The former is prepared only for the worst case and can't exploit the advantages inherent in any of the much more likely, more favorable circumstances. Moreover, as I have already suggested, I have not defined the worst case or the system which would minimize our cost to do the job in the event of this catastrophe. I have assumed that Maine would not defect, and that we would have Limestone. But just what other disasters might we consider? Can we be sure even of Omaha? There is a real problem in defining the maximum disaster we want to minimize. But we should recognize in moments of calm that some of the contingencies we are talking about in this connection—the political defection of Maine among others—are not very likely and also are not entirely subject to the enemy's control.

I would distinguish here several sorts of disaster. One sort, for example, an enemy attack aimed at denying our bases, is subject to his decision. If our bases are weak, the attack is both likely to take place and likely to be successful. This sort of disaster is not just bad luck. We can measure his capabilities and our susceptibility to attack and introduce the results of attack as an integral part of our systems analysis. Such disasters might be called systemic. We have discussed ways of dealing with this problem.

Another sort of disaster is the kind of thing that we are ordinarily thinking of when we talk of contingency planning. It is typified by extremely bad weather which denies us the possibility of operating from various bases. This is subject neither to our or his control and is a case of bad luck. An extra-systemic factor. It must be prepared for. But we must recall that we are countering nature here, so to speak, and not the enemy. When you are faced with an intelligent opponent it is sensible to suppose it likely that he will choose the best of a number of alternatives likely to be known and available to him for exploiting soft spots. Nature, however, in spite of some evidence to the contrary presented in Thurber's short stories, is not malign.

From the standpoint of contingency planning political disasters lie somewhere in between brute nature and a bombing attack, and rather closer to brute nature. The consequences of diplomatic moves are not as subject to systemic prediction as the result of a bomb exploding on a concrete runway. But like the weather they must be taken into account. To take them grossly into account in contingency planning we need not assign exact numbers to the probability of Canada's defection. We do have to be able to place some rough limits on the likelihoods involved, to make some judgment such as 1) it is more likely than not that in the next ten years or so we will lose at least a few of our hundred-odd bases; 2) it is not nearly so likely that we will lose all of them; 3) Texas is politically reliable as a base area.

It is important, however, to be prepared for some of the less likely contingencies and not just the most probable one. This is the subject of insurance. There are a large variety of systems indicated in this list of alternatives in Figure 6 which provide various degrees of insurance in contingencies. It seems unlikely that in such complex and uncertain circumstances as the Air Force prepares for that a pure force will be optimal. In making development choices we are wise to hedge and develop more than we'll procure. Mr. Hitch made this point and so other lecturers. This means that we are putting off the procurement choice until later. This tactic of delaying decisions occurs not only in development hedging but in choosing any flexible system at any stage of the development - procurement - operation cycle. Figure 6 shows several systems which can be operated in a multiplicity of ways in appropriate contingencies. When we procure such a system we leave open the choice of which way we'll operate until the contingency arises. They exploit a third principle we might call "The Multiple-Use Principle." Preserving flexibility then means delaying decisions. You may get the impression from some of the things you hear this week that the lecturers conceive the task of systems analysis not so much as that of assisting decision as of teaching the Air Force to resist it. Is Hamlet then our model of a modern major general? His example has evidenced that the decision-makers in the end must decide. The point made about preserving flexibility is best phrased not in terms of postponing decision, but in terms of not rushing it. Decision implies choosing one course of action rather than others. It means cutting out some alternatives. How is the necessity of decision consistent with the need to develop flexible systems viable under a wide variety of alternative circumstances? The answer is that a flexible system is not defined as one which incorporates all weapons alternatives by simple addition. This is the simplest sort of mixture. And, since we are constrained by a budget, even if we choose one weapons system type for each alternative contingency, we are sacrificing some quantity of weapons of other types merely by introducing a new type into the mixture. A system which will perform well in alternative contexts is good precisely insofar as it enables us to meet one contingency without sacrificing capability excessively in others. It is good for example if it enables us to preserve capability in contingencies and yet eliminate some special systems as redundant. The systems in this list which involve multiple uses for the same item are of this character.

Figure 6 lists a variety of forces of strategic bombers, some pure, some involving a mixture of bomber types each of which is largely convertible and some forces involving various convertible systems. In making our choice among these forces it is essential to consider their performance in all of the interesting contingencies and not just in one. This means we must look not only at the expected case but also at the insurance contingency. It also means that it is not enough to look at the insurance contingency alone even when we are talking of a weapon system which is primarily thought of as a hedge. Because it may be that there are alternative hedges. And it is always good to ask whether some of these hedges also turn out to be useful in the other fairly likely circumstances. There is an interplay then between our insurance and our other objectives. Unless we are dead certain that we will lose every one of our allies, if we have two systems which are equally good operating from the ZI U.S. but one of which is a great deal better just in case, for example, at least Canada is still with us, then clearly this second system is preferable. (Our choice is even clearer if the two systems compared have performance like the last two shown in Figure 6.)

Let me recur to another pair of contingencies mentioned earlier: the case in which we get the first strike in a war against the Soviets and the case in which this desirable order is reversed. There are many who think the unsatisfactory order more likely; there are some who are more optimistic. In any case it is clear that we are far from being able to be sure. And we saw earlier that systems that look just fine where we get the first strike can look very bad indeed when we don't. Designing a system which does well in both of these contingencies then is of prime importance. Such a system might, for example, save our cities in case we get the first strike, and at worst where he strikes first, insure that his own cities will be devastated. Such a system, illustrated in Figure 7, is a reliable deterrent and would dominate the two systems illustrated earlier in Figures 3, 4, and 5. This sort of dominance is not likely to be stumbled onto. It is more frequently the work of design.

The work of designing such comprehensive systems involves ingenious construction both of detailed systems components and of the force as a whole and its strategy of operation. But such invention is fruitful even if just spent on smaller systems which we are in the habit of thinking of as "components."

It may still be asked, is it possible except as an extraordinary stroke of luck, to invent any system, in the small or in the large, which dominates its many million alternatives? Can we find the optimum in the sense of the best possible? I am inclined to think that this question is beside the point.

The point is to get something better. And here the difficulties of the problems we are attacking offer a kind of inverted comfort. The solutions currently accepted for many problems of importance may be quite inadequate. This would hardly be surprising in the light of our review of the difficulties brought about by the swift and continual changes in modern weapon technology. The implications of such changes are complex, far reaching, not easily understood and still less easily faced in practice. The Departments of Defense and National Security which are the organs for making decisions in this area and carrying them out have to be big in order to handle the immense detail of administration of these programs. But big institutions, as we remarked when we noted the possibility that the enemy might be using irrational strategies, exhibit considerable inertia. The same is true for us. Our actual programs may lag. Our strategies may be inert. But this at any rate offers an opportunity for the inventive systems designer who is detached sufficiently from the detail of every-day operation to be able to look hard at the wider implications of impending technical and political change.

Even if a systems analysis cannot determine an ideal "best" (and defining "best possible" has difficulties related to those that trouble the definition of "worst possible"), it is helpful if it finds and proves some system which is distinctly better than others that are likely otherwise to be accepted. And this much systems analysis has already demonstrated that it can do.

Acknowledgments

I want to thank J. F. Digby, F. S. Hoffman, and H. J. Kahn for stimulation in connection with this lecture.

This report is part of the RAND Corporation Paper series. The paper was a product of the RAND Corporation from 1948 to 2003 that captured speeches, memorials, and derivative research, usually prepared on authors' own time and meant to be the scholarly or scientific contribution of individual authors to their professional fields. Papers were less formal than reports and did not require rigorous peer review.

This document and trademark(s) contained herein are protected by law. This representation of RAND intellectual property is provided for noncommercial use only. Unauthorized posting of this publication online is prohibited; linking directly to this product page is encouraged. Permission is required from RAND to reproduce, or reuse in another form, any of its research documents for commercial purposes. For information on reprint and reuse permissions, please visit www.rand.org/pubs/permissions.

The RAND Corporation is a nonprofit institution that helps improve policy and decisionmaking through research and analysis. RAND's publications do not necessarily reflect the opinions of its research clients and sponsors.

Financial Incentives for Businesses Can Increase Employment of People with Criminal Records

Accelerating the Transition to a New U.S. Defense Strategy

F-16s Are No Magic Bullet for Ukraine, but They Are a Game Changer with the Right Munitions

Rightsizing the Russia Threat

Supporting More-Effective Stormwater Management in the Mid-Atlantic Region

The Policy Currents Podcast

Developing Strategies for Summer Learning

Improving Psychological Wellbeing and Work Outcomes in the UK

Planning for the Rising Costs of Dementia

Helping Coastal Communities Plan for Climate Change

Systems Analysis Versus Systems Design

The Economic Analysis of Defense Problems—Choice Without Markets

The Economic Analysis of Defense Problems—Choice Without Markets

I. Systems Analysis vs. Models, and the Problems Motivating Analysis

II. An Air Force Example: Genesis of the Intercontinental Mission

The Morals

III. Objectives and Constraints in the Design of Systems Studies

One man's means is another man's objective

Broader Air Force Objectives

Overlap and Divergencies

IV. The Enemy's Objections and Agreements

V. The Modest Value of Mutually Unsatisfactory Strategies

VI. Uncertainty and the Design of Systems Studies

VII. Systems Design Versus Systems Analysis

Acknowledgments

Connect

Contact Us

I am interested in

Follow

Stay Informed

Resources

Site Information