Tobacco Documents Online

SCIENCE AND ITS LIIVIa[TSo The Regulator's Dilemma Alvin M. Weinberg PROLOGUE: The shift in environmental concerns from visible pollution to more subtle threats, such as toxic pollutanis, presents special problems for regulators xho must fi4nction outside the limits of scientific certainly. The same handicap besets judges who tnust adjudicate disputes over claims for damages arising from new and hazardous technologies that involve adverse health effects that are latent or unpredictable. In this area of uncertainty in which accidental exposure to hazards is rare, scieni'i;,,ts resort to probabilistic risk assessment to estimate the likeli- hood and consequences of events that may carry a threat to human health. Such scienti,6c techniques for the investigation of rare events, however, often cannot provide definitive answers for regulators and judges. In this essaY phtsicist .9lvin Id'einberg suggests that instead of asking sci- entists for answers to unanswerable questions, regulators should settle for less-definitive answers and regulate on the basis of uncertainty. Technologi- cal ftxes, including greater reliance on inherent safetyfeatures that depend on the imnnutable laws of nature, can help reduce risk. But ultimately, says ti'einberg, it tna' y be necessary to establish some threshold beyond which blame for accidents and other untoward events would be unprovable and vic- tims would be compensated by a society as a whole. t Alvin A1. Id'einberg received his Ph.D. in physics from the University of Chicago in i' 939. He has been a leading figure in the development of nu- clear energy and has served as director of the Oak Ridge National Labora- ton- and as director of the Institute for Energy Analysis of the Oak Ridge Associated Universities. He is the coauthor of The Physical Theory of Neu- tron Chain Reaction (1958) and has written extensivelv on nuclear energy, nuclear proliferation, and the interaction between modern technology and s(X'iet 1'. FALL 1985 59

I n his essay "Risk, Science, and Democracy," William D. Ruckelshaus expresses very clearly what I call the regulator's dilemma. During the past 15 years. Ruckelshaus notes, there has been a shift in public emphasis from visible and demonstrable pollution problems, such as smog resulting from automobiles and raw sewage, to potential and largely invisible problems, such as the effects of low concentrations of toxic pollutants on human health. This shift is important for two reasons. First, it has changed the way that science is applied to practical questions of public health protection and environmental regulation. Second, it has raised difficult questions about managing chronic risks within the context of free and democratic institutions.z When the environmental concern was patent and obvious-such as the problem of smog in Los Angeles-science could and did provide unequivocal answers. Smog, for example, comes from the gas emissions from burning liquid hydrocarbons, and the answer to the smog problem lies in controlling these emissions. The regulator's course was rather straightforward because the science upon which regulatory decisions are made was operating well within its power. However, when the environmental concern is subtle-for example, how much cancer is caused by an increase of 10 percent in mean background radiation-science is being asked a question that lies beyond its power; the question is trans-scientific. Yet the regulator, by law, is expected to regulate even though science can hardly help him; this is the regulator's dilemma. Although my essay is subtitled The Regulator's Dilemma, many of the same issues anse in the adjudication of disputes over who is to blame and who is to be compensated for damage allegedly caused by rare events, such as nuclear accidents. The regulator's dilemma is also faced by the judge who is presiding over a tort case involving, for example, a claim for damages blamed on a toxic waste dump. Indeed, the regulator's dilemma could equally be called the toxic tort dilemma. A lawsuit involving alleged injury from chemical pollutants is unlike the traditional liability case. If my car injures a pedestrian, I am liable to be sued. What is at issue, however, is not whether I have injured a pedestrian. Rather, it is whether I am at fault. On the other hand, if the lead from my car's exhaust is alleged to cause bodily harm, the issue is not whether my car emitted the lead but whether the lead actually caused the alleged harm. The two situations are quite diffetent.. In the first example the relation between cause and injury is not at issue. In the second it is the issue. In this essay, therefore, I try to delineate more precisely those limits to sci- ence that give rise to the regulator's dilemma. I speculate on how these intrinsic limits to science seem to have catalyzed a profound attack on science by some sociologists and public-interest activists. In addition, I offer a few ideas that may help the harried regulators finesse these trans-scientific issues. I I Science deals with regularities in our experience; art deals with singularities. It is no wonder that science tends to lose its predictive or even explanatory power when the phenomena it deals with are singular, 60 ISSUES IN SCIENCE AND TECHNOLOGY

H4ZARDS SCIEtiCE 4tiD ITS LIMITS irreproducible, and one of a kind-in other words, rare. Although science can often anal;~ze a rare event after the fact-for example. the extinction of ,4 ir;os:iur< during the Cretaccous-Ter;ian p,:rio.i fullo,,.ine the presumed ccllision of the earth and an asteroid-it has great difficult\ predicting when such an uncommon event will occur. I distinguish here between two sorts of rare events-accidents and low- level insults.. whose potential to cause injunt is unknown. Accidents are large- scale malfu nctions whose etiology is not in doubt, but whose likelihood is very small. The partial nuclear reactor meltdown at Three Mile Island in 1979 and the release of toxic gas from a chemical plant at Bhopal, India, in 1984 are ex- amples of accidents. The precursors to these specific events-for example, the condition of the auxiliary water feed system and other components at Three Mile Island-and the way in which the accidents unfolded are well under- stood. Estimates of the likelihood of the particular sequence of malfunctions are less firmly grounded. As the number of individual accidents increases, prediction of their probability becomes more and moi-e reliable. We can predict very well how many automobile fatalities will occur in 1986; we can hardly claim the same degree of reliability in predicting the number of serious reactor accidents in 1986. Low-level insults are rare in a rather different sense. We know that about (00 rems of'radiation will double the mutation rate in a large population of exposed mice. How many mutations will occur in a population of mice exposed to 100 millirems of radiation? In this case the mutations. if induced at all by such Iow levels of exposure. are so rare that to demonstrate an effect with 95 percent confidence would require the examination of many millions of mice. Although such an effort is not impossible in principle. it is in practice. Moreover, even if we could perform so heroic a mouse experiment, the extrapolation of these findings to humans would still be fraught with uncer- tainty. Thus. human injury or abuse from low-level exposure to radiation is a rare event whose frequency cannot be accurately predicted. III When dealing with events of this sort, science resorts to the language of probability. Instead of saying that this accident will happen on that date. or that a particular person exposed to a low-level dose of radiation will suffer a particular fate. it tries to assign probabilities for such occurrences. Of course, ~khere the number of instances is very large or the underlying mechanisms are fully under>tood, the probabilities are themselves perfectly reliable. In quan- tum mechanics there is no uncertainty as to the probability distribution of the phenomenon being described. In the class of phenomena considered here, however, even though the likelihood of an event happening or of a disease being caused by a specific exposure is given as a probability, the probability it- self is very uncertain. One can think of a somewhat fuzzy demarcation between what, I have called science and trans-science. The domain of science covers phenomena that are deterniinistic or whose probability of occurrence can itself be stated precisely; in contrast, trans-science covers those events whose probability of occurrence is itself highly uncertain. Although science can often analyze a rare event after the fact, it has great difficulty predicting when such an uncommon event will occur. F4tL P485 , 61

Despite the difficulties, scientific mechanisms have been devised for estimating, however imperfectly, the probability of rare events. For accidents the technique is probabilistic risk assessment (PRA); for low-level insults various empirical and theoretical approaches are used. Although probabilistic risk assessment had been used in the aerospace industry for a long time (for example, to predict the reliability of compo- nents), it first sprang into public prominence in 1975 with a reactor safety study directed by nuclear engineer Norman C. Rasmussen.3 The Rasmussen study, sponsored by the Atomic Energy Commission (now known as the Nuclear Regulatory Commission), was designed to estimate the public risks involved in potential accidents at commercial nuclear reactors. Probabilistic risk assessment, when applied to nuclear reactors, seeks to identify all sequences of subsystem failures that may lead to a failure of the overall system; it then tries to estimate the consequences of each subsystem failure so identified. The result is a probability distribution, P(C): that is., the probability, P, per reactor year, of a consequence having magnitude C. Consequences include both material damage and health effects. Usually, the probability of accidents having large consequences is less than the probability of accidents having small consequences. A probabilistic risk assessment for a reactor requires two separate estimates: first, an estimate of the probability of each accident sequence; second, an estimate of the consequences-particularly the damage to human health-caused by the uncontrolled radioactive effluents released in the accident. An accident sequence is a series of equipment or human malfunc- tions, such as a pump that fails to start, a valve that does not close, or an oper- ator confusing an ON with an OFF signal. We have statistical data for many of these individual events; for example, enough valves have operated for enough years so that we can, at least in principle, make pretty good estimates of the probability of failure. Uncertainties still remain, however, because we can never be certain that we have identified every relevant sequence. Proof of the adequacy of proba- bilistic risk assessment must therefore await the accumulation of operating experience. For example, the median probability of a core melt in a light water reactor, according to the 1975 Rasmussen study, was I in every 20,000 reactor-years; the core melt at Three Mile Island's number two reactor (TMI- 2) occurred after only 700 reactor-years. The number two reactor, however, differed from the reactors Rasmussen studied, and in retrospect, one could rationalize most of the discrepancy between his estimate and the seemingly premature occurrence at TMI-2. Since the core melt at Three Mile Island. the world's light water reactors have accumulated some 1,500 reactor-years of operation without a core melt. This performance places an upper limit on the a priori estimate of the core- melt probability. Thus. if this probability were as high as I in every 1,000 reactor vears. the likelihood of su5iving 1,500 reactor-years would not be more than 22 percent; put otherwise, we can say with 78 percent confidence that the core-melt probability is not as high as I in 1,000 reactor years. With 500 light water reactors on line in the world, should we survive until the year 2000 without another core melt, we could then say with 95 percent confidence 62 ISSI!ES IN SCIENCE AND TECH'.OLOG1'

HAZARDS: SCiIENCE AND ITS LIMITS that the core-melt probability is not higher than I in 3,000 reactor-years. In the absence uf such experience, one is left with rather subjective judgments. Although Harold «' Lewis, in his critique of Rasmussen's 1975 study,' asserts that he could not place a bound on the uncertainty of probabilistic risk assessment, Rasmussen argued that his estimate of core-melt probability may be in error by about a factor of 10 either way-that is, the probability may be as high as 1 in 2,000 reactor-years or as low as I in 200,000 reactor-years. As we see, after 3,000 reactor-years of operation without a core melt, we can say with about 78 percent confidence that Rasmussen's upper limit (1 in 2,000 reactor-years) is not too optimistic. Furthermore, if we survive to the year 2000 wir.hout a core melt, the confidence level with which we can make this assertion rises to 95 percent. Our confidence in probabilistic risk assess- ment can eventually be tested against actual, observable experience. Until this experience has been accumulated, however, we must concede that any probability we predict must be highly uncertain. To this degree our science is incapable of dealing with rare accidents, but time, so to speak, annihilates uncertainty in estimates of accident probability. Unfortunately, time does not annihilate uncertainties over consequences as unequivortlly as it does uncertainties over frequency of accidents. A large reactor or chemical plant accident can canse both immediate, acute health effects and delayed, chronic effect,;. If the exposure either to radiation or to methyl isocyanate is high enough, the effect on health is quite certain. For example, asi,ngle exposure of about 400 rems will cause about half of the people exposed to die. On the other hand, in a large accident many people will also be exposed to smaller doses-indeed, to doses so low that the resulting health effects are undetectable. At Bhopal many thousands of people were exposed to rni°thyl isocyanate but they recovered. We cannot say positively whether or r,ot they will suffer some chronic disability. The very worst accident envisaged in the Rasmussen study, with a probability of I in I billion reactor-years, projected an estimated 3,300 early fatalities, 45,O{30 early illnesses, and 1,500 delayed cancers per year among 10 million exp<)&°d people. Almost all of the estimated delayed cancers are attributed to exposures ofless than 1,000 millirems per year-a level at which we are very hard put to estimate the risk of inducing cancer. Similarly, the American Physical Society's critique of the Rasmussen study attributed an additional 10,000 deaths over 30 years among 10 million people exposed to cesium-135 distributed in a very large aecident.s The average exposure in this case was assurred to be 250 millirems per year-again, a level at which our es- timates of the health effects are extremely uncertain. Has the nuclear community, particularly its regulators, figuratively shot itself in the foot by trying to estimate the number of delayed casualties as a re- sult of these low-level exposures? In retrospect, I think the Rasmussen study would have been on more solid ground had it confined its estimates to those health effects resulting from exposures at higher levels, where science makes reliable estimates. For the lower exposures the consequences could have been stated simply as the number of man-rems (the number of people multiplied by the number of rems) of exposure of individuals whose total exposure did not exceed, say, 5,000 millirems, without trying to convert this man-rems number Our confidence in probabilistic risk assessment can eventually be tested against actual, observable experience. FALL 1985 63

into numbers of latent cancers. Thus, health consequence would be reported in two categories: (1) for highly exposed individuals, the number of health effects; and (2) for slightly exposed individuals, the total man-rems or even the distribution of exposures accrued by the large number of individuals so exposed. Perhaps such a scheme could be adopted in reporting the results of future probabilistic risk assessments; at least it has the virtue of being more faithful than the present convention to the state of scientific knowledge IV In both of my examples of accidents (Bhopal and nuclear accidents), many people are exposed to low-level insult. The uncertainties inherent in estimating the effects of such low-level exposure are heaped on top of the uncertainties in estimating the probability of the accident that may lead to exposure in the first place. Science has exerted great effort to ascertain the shape of the dose- response curve at low dose-but very little, if anything, can be said with certainty about the low-dose response. Thus, to quote the report of the National Research Council, The Effects on Populations of Exposure to Low Levels of Ionizing Radiation: 1980 (also known as BEIR-III, for the commit- tee that prepared it, the Committee on the Biological Effects of Ionizing Radiation). "The Committee does not know whether dose rates of gamma or x-rays of about 100 mrads/yr are detrimental to man.... It is unlikely that carcinogenic and teratogenic effects of doses of low-LET radiation adminis- tered at this dose rate will be demonstrable in the foreseeable future."6 This prompted Philip Handler, then president of the National Academy of Sci- ences, to comment in his letter of transmittal to the Environmental Protection Agency, which had requested the study, "It is not unusual for scientists to disagree ...(and) ... the sparser and less reliable the data base, the more opportunity for disagreement.... The report has been delayed ... to permit time ... to display all of the valid opinions rather than distribute a report that might create the false impression of a clear consensus where none exists."' This forthright admission that science can say little about low-level insults I find admirable. It represents an improvement over the unjustified assertion in the BEIR-II report of 1972 that 170 millirems per year over 30 years, if imposed on the entire U.S. population, would cause between 3,000 and 15,000 cancer deaths per year.8 I do not quarrel with the estimated upper limit-which amounts to I cancer per 2.500 man-rems, but I regard placing the lower limit at 3,000 rather than at zero as unjustified. Moreover, I think it has caused great harm. The proper statement should have been that at 170 millirems per year, we estimate the upper limit for the number of cancers to be 15.000 per year; the lower limit may be zero. Since the appearance of the BEIR reports, two other developments have added to the burden of those who must judge the carcinogenic hazard of low- level insults: an awareness and study of (1) natural carcinogens, and (2) ambiguous carcinogens. Natural carcinogens. Is cancer environmental in the sense of being caused by technology's effluents. or is it a natural consequence of aging? In the 64 . ISSC'.ES IN SC'IEtiCE AND TECHNOLOGY

HAZARDS: SCIENCE AND ITS LIMITS past few years we have seen a remarkable shifft in viewpoint; whereas 15 years ago most cancer experts would have accepted a primarily environmental etiology foir cancer, today the view that natural carcinogens are far more importaM than are manmade ones has gained many converts. In his 1983 article in Science, biochemist Bruce N. Ames marshaled powerful evidence that many of our most common foods contain naturally occurring carcino- gens.9 Indeed, biochemist John R. Totter, former director of the Atomic Energy Commission's division of biology and medicine, has offered evidence for the oxygen radical theory of carcinogenesis: that we eventually get cancer because we metabolize oxygen and subsequently produce oxygen radicals that can play ihavoc with our DNA.10 As such views of the etiology of cancer acquire scientific support, I think that the trans-scientific question, as to how much cancer is caused by a tiny chemical or physical insult will be recognized as irrelevant. One does not swat gnats when pursued by elephants. Ambiguous carcinogens. To further complicate the cancer picture, there is evidence that some agents, such as dioxin, various dyes, and even moderate levels of radiation, seem to diminish the incidence of some cancers while simultaneously increasing the incidence of others. The lifespan of the animals exposed to these agents in laboratory tests on average exceeds that of animals not exposfxj.'1 A most striking example, given by biostatistician Joseph K. Haseman, is yellow dye number 14 given to leukemia-prone female rats. This dye completely suppresses leukemia, which is always fatal, but causes liver tumors, most of which are benign. I mention these two findings-or perhaps they should be considered points of view-to stress my underlying point: that when we are concerned with low-level insult to human beings, we can say very little about the cancer dose-response curve. Saying that so many cancers will be caused by so much low-level exposure to so many people, a practice that terrifies many people, goes far beyond what science actually can say. V Does the scientific community accept the notion that there are intrinsic limits to what it can say about rare events; that as events become rarer, the un- certainty in the probability of occurrence of a rare event is bound to grow? Perhaps a better way of framing this question is: Of what use can we put scientific tools of investigation of rare events, such as probabilistic risk assessment and large-scale animal experiments, if we concede that we can never get definitive answers? I believe that probabilistic risk assessment with an uncertainty factor as high as 10 is often useful, especially if one uses the technique for comparing risks. For example, the 1,500 reactor-years already experienced since the Three Mile Island accident suggest that a reactor core-melt probability is likely to be less than I in 1,000 reactor-years and may well be as low as less than I in 10,000 reactor-years. This is to be compared with dam failures whose probability, based on many hundreds of thousands of dam-years (where time has annihilated uncertainty), is around I in 10,000 dam-years. Even with an uncertainty factor of 10, we can judge how safe reactors are compared to dams. Some agents, such as dioxin, various dyes, and even moderate levels of radiation, seem to diminish the incidence of some cancers while simultaneously increasing the incidence of others. FALL 1985 65

The Delaney clause is the worst example of how a disregard of an intrinsic lir,nit of science can lead to bad policy by overenthusiastic politicians. When one compares the relative intrinsic safety of two very similar devices-such as two water-moderated reactors-probabilistic risk assess- ment is on much more solid ground. Here one is not asking for absolute estimates of risk, but rather for estimates of relative safety. If reactors A and B differ in only a few details-say reactor A has two auxiliary water feed trains whereas B has only one-the ratio of core-melt probabilities should be much more reliable than their absolute values because the ratio requires an estimate of failure of a single subsystem, in this instance the extra auxiliary water feed on reactor A. Not only can one say with reasonable assurance how much safer reactor A is than reactor B, but as a result of the detailed analysis one can identify the subsystems that contribute most to the estimated failure rate. Even if proba- bilistic risk assessment is inaccurate, it is very useful in unearthing deficien- cies; one can hardly deny that a reactor in which deficiencies revealed by probabilistic risk assessment have been corrected is safer than one in which they have not been corrected, even if one is unwilling to say how much safer. Somewhat the same considerations apply to low-level insult. An agent that does not shorten lifespan at high dose will not shorten lifespan at low dose. An agent that is a very powerful carcinogen at high dose is more likely to be a carcinogen at low dose than one that is a less powerful high-dose carcinogen. Thus, animal experiments surely are useful in deciding which agents to worry about and which not to worry about. Of course, the Ames test (which determines by a relatively simple procedure whether a substance is mutagenic) has made at least some preliminary screening of carcinogens more feasible because substances that cause mutations are considered to be poten- tial carcinogens. The difficulty today seems to be not so much identifying agents that at high dose may be carcinogens as it is prohibitin- exposures far below levels at which no effect can be, or perhaps ever will be, demonstrated. The regulator and the concerned citizen are inclined to approve the Delaney clause of the Federal Food, Drug, and Cosmetic Act, which prohibits the use of any food additive that has been shown to cause cancer in laboratory animals or humans. This clause, however, is of no help in resolving such issues as the relative risks of, say, cancer induction by nitrosamines (carcinogenic compounds that can be formed in the body from nitrites) and digestive disorders caused by meat untreated with nitrites. The Delaney clause is the worst example of how a disregard of an intrinsic limit of science can lead to bad policy by overenthusiastic politicians. Harvard physicist Harvey Brooks has oft~ en pointed out that one can never prove the impossibility of an event that is not forbidden by a law of nature. Most will agree that a perpetual motion machine is impossible because it violates the laws of thermodynamics. That one molecule of a polychlorinated biphenyl (PCB) may cause a cancer in humans is a proposition that violates no law of nature: hence many, even within the scientific community, seem willing to believe that this possibility is something to worry about. It was this error that led to the Delaney clause. When is an event so rare that the prediction of its occurrence forever lies outside the domain of science and therefore within the domain of trans- science? Clearly we cannot say, and perhaps as science progresses, this 66 ISSUES IN SCIENCE AND TECHNOLOGY

HAZARDS: SCIENCE AND ITS LIMITS boundary between science and trans-science will recede toward events of lower frequency. At any stage, however, the boundary is fuzzy, and much scientific aontroversy boils overdeciding where it lies. One need only read the violent exchange between Edward P. Radford and Harald H. Rossi over the risk of cancer from low levels of radiation to recognize that where the facts are obscure, argument--even ad hominem argument-blossoms.tz Indeed, Alice Whittemore in her "Facts and Values in Risk Analysis for Environmental Toxicants," has pointed out that facts and values are always intermingled at this "rare event" boundary between science and trans-science." A scientist who believes that nuclear energy is evil because it inevitably leads to prolifera- tion of nuclear weapons (which is a common basis for opposition to nuclear energy) is likely to judge the data on induction of leukemia from low-level exposures at Nagasaki differently than is a scientist whose whole career has been devoted to making nuclear power work. Cognitive dissonance is all but unavoidabli: when the data are ambiguous and the social and political stakes are high. VI No one -would dispute that judgments of scientific truth are much affected by the scientist's value system when the issues are at or close to the boundary lx~tween science and trans-science. On the other hand, as the matter under dispute approaches the domain of science, most would claim that the scientist's extrascientific values intrude less and less. Soviet scientists and U.S. scientists may disagree on the effectiveness of a ballistic missile defense, but they agree on the cross section of U23` or the lifetime of the pi meson. This all seems obvious, even trite. Yet in the past decade or so a school of sociology of' knowledge has sprung up in Great Britain that claims that "scientific vicws are deter7nined by social (external) conditions, rather than by the internal logic of scientific tradition and inherent characteristics of the phenomen:jl w•orld,"'4 or that "all knowledge and knowledge claims are to be treated as lxing socially constructed: genesis, acceptance, and rejection of knowledge [is] sought in the domain of the Social World rather than... the Natural Wor'l!.d."15 The attack here is not on science at the boundary with trans-science, in particular--the prediction of the frequency of rare events. At least the more extreme of the sociologists of knowledge claim that using traditional ways of establishing scientific truth-by appealing to nature in a disciplined man- ner-is not how science really works. Scientists are seen as competitors for prestige, pay, and power, and it is the interplay among these conflicting aspirations, not the working of some underlying scientific ethic, that defines scientific truth. To be sure, these attitudes toward science are not widely held by practicing scientists; however, they are taken seriously by many political activists who, though not in the mainstream of science, nevertheless exert important influence on other institutions-the press, the media, the courts- that ultimately influence public attitudes toward science and its technologies. If one takes such a caricature of science seriously, how can one trust a sci- entific expert? If scientific truth, even at the core of science, is decided by FALL 1985 67

Instead of asking science for answers to unanswerable questions, regulators should be content wa th less far-reach i ng answers. negotiation between individuals in conflict because they hold different non- scientific beliefs, how can one say that this scientist's opinion is preferable to that one's? Furthermore, if the matter at issue moves across the boundary between science and trans-science, where all we can say with certainty is that uncertainties are very large, how much less able are we to distinguish between the expert and the charlatan, between the scientist who tries to adhere to the usual norms of scientific behavior and the scientist who suppresses facts that conflict with his political, social, or moral preconceptions? One way to deal with these assaults on scientists and scientific truth would be to define a new branch of science, called regulatory science, in which the norms of scientific proof are less demanding than are the norms in ordinary science. I should think that a far more honest and straightforward way of dealing with the intrinsic inability of science to predict the occurrence of rare events is to concede this limitation and not to ask of science or scientists more than they are capable of providing. Instead of asking science for answers to unanswerable questions, regulators should be content with less far-reaching answers. For example, where the ranges of uncertainty can be established, regulate on the basis of uncertainty; where the ranges of uncer- tainty are so wide as to be meaningless, recast the question so that regulation does not depend on answers to the unanswerable. Furthermore, because these same limits apply to litigation, the legal system should recognize, much more explicitly than it has, that science and scientists often have little to say, probably much less than some scientific activists would admit. The expertise of scientific adversaries is often at the heart of litigation over personal injury alleged to be caused by subtle, low-level exposures. Each side presents witnesses whose scientific credentials it regards as impeccable. Because the issues themselves tend to be trans-scientific, one can hardly decide the validity of the assertions of either side's witnesses. Under the circumstances, I suppose, one is justified in regarding a scientific witness no differently than any other witness; his credibility is judged by his past record, behavior, and general demeanor, as well as the self-consistency of his testi- mony. Such, at least, was the way in which a federal district court judge, Patrick Kelley, settled Johnston v. United States, in which the issue was the claim that exposure to radiation from reworking old aircraft instrument dials had caused injury; Kelley impugned, on grounds no different from those one would invoke in an ordinary lawsuit, the competence if not the integrity of some of the plaintiffs scientific witnesses. VII There are various ways to provide some assurance of safety despite uncertainty. Here I briefly describe two of these ways-which I call the technological fix and de minimis-without claiming that these are the most important, let alone the only, ones. Technological fix. Science cannot exactly predict the probability of a serious accident in a light water reactor or the likelihood that a radioactive waste canister in a depository will dissolve and release radioactivity to the environment. Can one design reactors or waste canisters for which the 68 ISSUES IN SCIENCE AND TECHNOLOGY