SPK-04

NC3 Interface Boundary Kernel

The interface where presidential authority flows to the weapon system and operational status returns to national leadership is the most consequential boundary in defense acquisition. Sentinel must integrate into an NC3 enterprise that is itself transforming — new satellites, new networks, new threats — while maintaining nuclear surety through a multi-decade dual-stack transition with Minuteman III. The EMP Commission recommends hardening to 85 V/km — an order of magnitude beyond commercial standards. NC3-IBK defines and validates this boundary.

[Zenodo DOI]

NC3 Interface Boundary Kernel architecture diagram showing the four-tuple structure: P(t) physical surface, E(params) threat envelope, M(stack,epoch) message contract, and S(lifecycle) surety/cyber contract
0

The Problem — Why NC3 Integration Is Different

Sentinel is the first U.S. strategic nuclear system designed for a digital, networked environment. Minuteman III uses point-to-point analog wiring and hardware logic. Sentinel uses IP-based communications, software-defined processing, and a Modular Open Systems Architecture. This is not an upgrade — it is an architectural transformation.

The 2024 Nunn-McCurdy breach documented "ineffective systems engineering" and "incomplete basic system design" as root causes.[1] While cost growth concentrated in ground infrastructure (~80% from the command and launch segment), the breach revealed that NC3 integration planning was designed against assumptions that no longer hold.

Three simultaneous challenges: Sentinel integrates into an NC3 enterprise undergoing its own transformation (ESS replacing AEHF, IOC FY2032). It must support dual-stack operations with Minuteman III for potentially two decades. And the Minuteman III may operate until 2050 — forcing legacy NC3 interfaces to be sustained well beyond design life.

No validated Integrated Master Schedule for NC3 integration exists.[22] The AN/USQ-225 NC3 Weapon System has mandatory interface control documentation (T-1 requirement), but the substance of those interfaces — what must be specified, verified, and maintained — lacks computational structure.[23]

What NC3-IBK is not: NC3-IBK does not design the NC3 enterprise (ESS, SACCS, FAB-T, NC3 Next internals), does not specify weapon system internals (missile guidance, launch control processing, warhead integration), does not replace existing standards (MIL-STD-188-125-1, MIL-STD-461, MIL-STD-464, DoDI 3150.02, AFMAN 91-118/119), and cannot prevent technical failures or requirements changes. It synthesizes applicable standards into a unified boundary contract and ensures that whatever interface configuration is proposed has the structural properties required for valid verification.
1

Historical Failures — Why Interface Rigor Matters

Three documented incidents validate the need for rigorous NC3 interface specification.

F.E. Warren, October 23, 2010

50 Minuteman III missiles dropped offline — one-ninth of the active U.S. ICBM arsenal. Command authority was severed. The root cause: a single replacement circuit card seated one-eighth of an inch from fully seated. This caused a Launch Control Center to transmit data in the wrong time slot, desynchronizing the multiplexed communication network.[27]

The lesson: A maintenance error of fractional precision severed command authority over 50 nuclear missiles. The "enemy" was not external EMP — it was an improperly seated circuit card. This validates the need for as-built verification and configuration drift detection at the NC3 boundary.

REACT Console, 1996

DoD IG Report 96-073 documented that the REACT program used out-of-date Interface Control Documents during qualification testing. The IG recommended higher priority for maintaining current ICDs. The principle: "as-documented" is a hypothesis — only "as-built" reality matters.[25]

Guidance Replacement Program, 1993

GAO/NSIAD-93-181 found the Minuteman III Guidance Replacement Program planned to proceed to EMD before degradation was "adequately justified." The flight reliability impact of wet slug tantalum capacitor dry-out was unknown — yet the program moved forward. The pattern of committing to architectural changes without verified interface baselines recurred in Sentinel's 2020 baseline.[29]

2

The Threat Evolution — E1, E2, E3

The electromagnetic threat has evolved beyond the assumptions underlying foundational hardening standards.

E1: Early-Time HEMP

MIL-STD-188-125-1 establishes 50 kV/m as the unclassified E1 baseline with 80 dB shielding (20 MHz–1 GHz). But the Pax River PS-6 pulser tests to 77 kV/m because assessed threats exceed legacy assumptions.[30][33]

Between E1 and the late-time E3, the intermediate E2 component (lasting up to one second) resembles lightning-induced transients — but arrives after E1 may have already damaged the protective devices designed to stop it.

E3: The 85 V/km Gap

ParameterNERC TPL-007EMP Commission
Source EventSolar Geomagnetic DisturbanceNuclear Detonation (MHD)
Field Strength~8 V/km85 V/km
Affected AreaHigh latitudes primarilyEntire CONUS
Rise TimeMinutes to hoursSeconds

Sources: NERC TPL-007; EMP Commission, April 2018.

The 85 V/km figure derives from Soviet Test 184 (K-Project, Kazakhstan, 1962), which measured 66 V/km at ground level. The Commission scaled this to CONUS latitudes where E3 fields are stronger due to geomagnetic orientation.[3][5]

The implication: NC3 interfaces relying on commercial power or long-haul communications designed to the NERC 8 V/km standard are an order of magnitude under-hardened for nuclear HEMP. And MIL-STD-188-125-1 only covers the local facility — it explicitly excludes long-haul link survivability.[30]

Voltage Margin Erosion

MIL-STD-188-125-1 was derived for 5V/12V electronics. Modern COTS at 1.2V have noise margins approximately one-quarter as large. The 80 dB shield may be insufficient for contemporary components even if the facility met specifications designed for legacy electronics.

3

The Regulatory Shift — Cyber Becomes Surety

Three regulatory changes transform the NC3 interface landscape.

DoDI 3150.02 — The Fourth Surety Standard

Reissued December 17, 2024, the Fourth Surety Standard now reads: "prevent unauthorized access or unauthorized acts by physical or digital means." The phrase "by physical or digital means" is new — elevating cybersecurity from generic IT compliance to a Nuclear Surety Standard requiring the same rigor as physical custody and two-person control.[8] At the interface level, this is why critical commands cannot use simple DC voltage levels — an EMP event or short circuit could simulate a logic "high," potentially mimicking a launch signal.[39]

DoDI 5200.44 — Supply Chain as Threat

DoDI 5200.44 mandates SCRM for mission-critical functions, explicitly naming integrated circuits, FPGAs, and printed circuit boards. Hardware trojans are a surety threat.[9]

NCDSMO Raise the Bar — RAIN Principles

The NCDSMO under NSA mandates RAIN principles for Cross Domain Solutions: Redundant, Always Invoked, Independent, Non-bypassable. For NC3 interfaces, CDS devices must satisfy RAIN and survive HEMP without rebooting into an "open" state.[10]

The surety/cyber tension: Surety demands frozen configuration. Cybersecurity demands frequent patching. The SACCS modernization illustrates this — the legacy system's lack of an IP address was cited as a cybersecurity advantage, yet modernization to IP proceeds to resolve hardware obsolescence.[15]
4

The NC3 Enterprise — What Sentinel Connects To

The NC3 enterprise operates through two layers.[12]

Layer 1 — Day-to-Day ("Thick Line"): Commercial satellites, standard military networks, the modernized SACCS network. Efficient for force management. Not expected to survive full-scale nuclear attack.

Layer 2 — Survivable ("Thin Line"): AEHF/ESS satellites with protected waveforms, VLF/LF radio, airborne nodes (E-4B, E-6B Mercury). The enduring core.

The ALCS Bypass Path — E-6B can launch missiles without ground LCCs

The E-6B Mercury's Airborne Launch Control System (ALCS) provides direct launch capability for ICBMs, bypassing ground-based Launch Control Centers entirely. This creates a secondary, wireless attack surface on the silo distinct from hardwired intersite cables. NC3_IF_BOUNDARY_SPEC must distinguish ground-initiated from airborne-initiated commands.[34]

Modernization Timeline

ProgramFunctionIOCSentinel Role
LGM-35A SentinelLand-based deterrentEarly 2030sPrimary weapon system
ESSEvolved Strategic SATCOMFY2032Future protected comms
SACCS-RTerrestrial C2 networkOngoingIP-based LCC connectivity
FAB-TSatellite terminals for LCCFieldingAEHF/ESS ground link

Sources: SSC, Breaking Defense.

The AFNWC NC3 Integration Directorate at Hanscom AFB serves as PEO for the AN/USQ-225. AFI 13-550 establishes interface control documentation as T-1 mandatory.[23][24]

5

The Architecture — NC3_IF_BOUNDARY_SPEC v2.0

NC3-IBK treats the NC3/weapon-system boundary as a single, formally structured interface contract:

⟨ P(t), E(params), M(stack,epoch), S(lifecycle) ⟩

P(t) — Physical Surface as Lifecycle Object

Every penetration of the hardened boundary — copper, fiber, waveguide, filter, guard, crypto module — exists in three states:

P_design — the intended set. P_as_built — verified by inspection and EM testing. P_live(t) — the effective set at time t, accounting for repairs, degradation, and unauthorized changes.

NC3_IF is not accepted until P_as_built matches P_design. Hardness Maintenance/Surveillance per MIL-HDBK-423 and DI-NUSU-82343 tracks degradation over the lifecycle.[6][7]

Why P(t) matters in practice — degradation is not theoretical

A 2007 survey by the Institute of the North and Claremont Institute found that 96% of state Adjutants General indicated significant concern over an EMP attack, yet the majority had done "little or no analysis" of the impact on potential targets in their state. None were actively involved in a formal EMP planning process.[38]

Real-world maintenance patterns reveal gaskets oxidizing and deforming, personnel creating penetrations without installing required waveguides, and filter grounds corroding. A single compromised gasket can degrade a shielded door's effectiveness, allowing EMP energy to couple into the facility. P(t) exists because hardening degrades — and without lifecycle tracking, the degradation is invisible until failure.

E(params) — Parameterized Threat Envelope

Rather than hard-coding threat values that become obsolete, NC3-IBK exposes parameters: E1_peak_req ≥ 50 kV/m, k_E1 margin factor ≥ 1.0, E3_grad_req ≥ 85 V/km. Classified values from MIL-STD-2169C populate the parameters; the structure remains unclassified.

E3 power interface requirement: For power feeds and long conductors entering the NC3 boundary, transfer switches must be rated for 85 V/km induced gradient. If commercial power cannot be hardened: protected local generation, islanding capability, and mission-duration backup power are required.

M(stack,epoch) — Message Contract

Nine message families crossing the boundary, each tagged with STACK_ID (MMIII, SENTINEL, DUAL, FUTURE) and EPOCH_ID (Pre_ESS, ESS_IOC, ESS_FOC, Future):

ALERT
NC3 → WS · High
Warnings, threat indicators
EXECUTE
NC3 → WS · Critical
Enable/launch commands
INHIBIT
NC3 → WS · Critical
Safety/hold/safing
STATUS
WS → NC3 · Medium
Health and state telemetry
RETARGET
NC3 → WS · High
Targeting data packages
CRYPTO_MGMT
NC3 → WS · High
Keying material, algorithm policy
MAINT_DIAG
Bidirectional · Low
Maintenance and diagnostics
ALCS_DIRECT
NC3 → WS · Critical
Airborne launch control (E-6B)
LEGACY_BRIDGE
NC3 ↔ WS · Variable
MMIII/Sentinel dual-stack

S(lifecycle) — Surety/Cyber Contract

Five mechanisms integrated at the boundary:

S_update: Secure update protocol — multi-person authentication, regression testing against surety and HEMP baselines before returning to operational mode.

S_port: Maintenance port control — physically lockable, logically disabled in normal modes. GAO-19-128 documented that red teams took control of weapon systems "relatively easily" via maintenance laptop vectors.[43]

S_SCRM: Supply chain provenance verification for all NC3_IF-critical components per DoDI 5200.44.[9]

S_CDS: Cross Domain Solutions must follow RAIN principles and fail to closed/safe under HEMP, internal faults, and combined cyber+EM stress.

S_gov: Joint ownership — AFNWC NC3 Integration Directorate + Sentinel Program Office. Any change requires dual approval.

6

Test Infrastructure — Verification Is Executable

Little Mountain Test Facility

1,000 acres west of Ogden, Utah. The primary Air Force lab for ICBM nuclear hardness. Actively upgrading: new 50,000 sq ft radiation facility with Advanced Radiation Environment Simulator, Small Flash X-Ray, and 14-MeV neutron generator. Boeing $405M contract for testing in "extreme environments."[45][46]

Patuxent River EMP Facility

The PS-6 pulser — a 125-meter outdoor system for whole-aircraft HEMP illumination. Peak fields of 77 kV/m at 24.5m, rise times 1.3–2.8 ns. System-level testing aligned with MIL-STD-464.[33]

Combined Cyber+HEMP Testing

AC8 requires at least one test combining EM stress with cyber penetration. The infrastructure exists today: configure representative NC3_IF equipment in a shielded chamber, apply EM stress (RS105, PCI, E3 injection), run concurrent red-team cyber attempts, and monitor for unauthorized command acceptance, boundary compromise, and CDS fail-state behavior. This is procedural integration, not new infrastructure.

7

The Timeline Window

Milestone B re-certification is expected by end of calendar year 2026. NC3-IBK must be established before the new baseline is approved. Once a baseline is set without NC3-IBK conformance requirements, the opportunity closes until synchronization failures or survivability gaps force another breach review.

Synchronization risk: ESS IOC (FY2032) aligns roughly with Sentinel IOC (early 2030s), but no formal dependency exists between programs. If Sentinel fields before ESS is operational, the NC3 interface relies on aging AEHF. The EPOCH_ID mechanism provides degraded-mode specifications for this scenario.

NC3-IBK requires no statutory changes, no new technology, and no research-grade algorithms. All components are TRL 9. Implementation is a specification, governance, and testing discipline problem — not a technology problem.

Acceptance Criteria

NC3-IBK defines nine testable pass/fail conditions. All remain unmet as of March 2026.

AC-1
Threat Envelope Parameterization: E1_peak_req, k_E1, and E3_grad_req ≥ 85 V/km defined as explicit parameters traceable to MIL-STD-2169 / EMP Commission.
● UNMET
AC-2
Physical Surface Lifecycle: P exists in three states (design, as-built, live) with HM/HS plan per DI-NUSU-82343 and configuration drift detection.
● UNMET
AC-3
As-Built Verification: NC3_IF cannot achieve operational acceptance without physical inspection, EM testing, and discrepancy resolution.
● UNMET
AC-4
Message Taxonomy Completeness: All messages map to ≥9 defined families with STACK_ID and EPOCH_ID. No unmapped message types.
● UNMET
AC-5
ALCS Path Distinction: Airborne launch control messages distinguishable from ground-initiated commands through independent verification.
● UNMET
AC-6
CDS Fail-State: All Cross Domain Solutions fail to CLOSED (no data pass-through) under EM and cyber stress. Open fail = FAIL.
● UNMET
AC-7
Surety/Cyber Integration: S_update, S_port, S_SCRM, S_CDS, and S_gov all documented with test requirements. Missing component = FAIL.
● UNMET
AC-8
Combined Cyber+HEMP Test: At least one scenario combining EM stress with concurrent cyber red-team activity. No combined test = FAIL.
● UNMET
AC-9
Epoch-Degraded Mode: Each EPOCH_ID has defined NC3 path requirements, degraded-mode rules, and guaranteed minimal capability.
● UNMET

Sources

  1. DoD Sentinel Nunn-McCurdy Review, July 2024. defense.gov
  2. GAO-26-108755, Feb 2026. gao.gov
  3. EMP Commission, "Recommended E3 HEMP Heave Electric Field Waveform," April 2018. firstempcommission.org
  4. NERC TPL-007, Geomagnetic Disturbance benchmark ~8 V/km.
  5. CISA EMP Protection Guidelines, 2019. cisa.gov
  6. MIL-HDBK-423, HEMP Protection for C4I Facilities, 1993. quicksearch.dla.mil
  7. DI-NUSU-82343, HM/HS Plan. quicksearch.dla.mil
  8. DoDI 3150.02, Reissued Dec 17, 2024. esd.whs.mil
  9. DoDI 5200.44, TSN/SCRM. esd.whs.mil
  10. NCDSMO / Raise the Bar. nsa.gov · Owl Cyber Defense
  11. Breaking Defense, Feb 2026. breakingdefense.com
  12. CRS IF11697, NC3 System. crsreports.congress.gov
  13. Air Force Nuclear Weapons Center, Sentinel MOSA documentation.
  14. SSC ESS Contract, July 2025. ssc.spaceforce.mil
  15. Defense News, SACCS floppy disks, Oct 2019. defensenews.com
  16. DoD FY2024 Budget, PE 0101316F (SACCS-R TDM→IP).
  17. Air & Space Forces, FAB-T. airandspaceforces.com
  18. GlobalSecurity.org, GBSD dual-stack. globalsecurity.org
  19. Air & Space Forces, restructure, Feb 2026. airandspaceforces.com
  20. Air & Space Forces, MMIII to 2050. airandspaceforces.com
  21. GAO-25-108466, ICBM Modernization. gao.gov
  22. GAO-25-108466, IMS delays. gao.gov
  23. AFI 13-550, NC3, T-1 ICD requirement. e-publishing.af.mil
  24. AFNWC NC3 Integration Directorate 10-year anniversary. afmc.af.mil
  25. DoD IG 96-073, REACT, Feb 1996. media.defense.gov
  26. DoD IG 97-037, Dec 1996. media.defense.gov
  27. AP/KSL, "Margin for error 1/8 of an inch," 2013. ksl.com · DVIDS
  28. Gizmodo, "US Lost Command of One-Ninth," 2010. gizmodo.com
  29. GAO/NSIAD-93-181, GRP, June 1993. gao.gov
  30. MIL-STD-188-125-1, 1998. volta.it (mirror)
  31. MIL-STD-2169C, classified HEMP threat definition.
  32. EMP Commission, Super-EMP weapons.
  33. Belt et al., PS-6 pulser, DTIC ADA606571, 2011. dtic.mil
  34. U.S. Navy, E-6B Mercury. navy.mil
  35. Tinker AFB, E-6B. tinker.af.mil
  36. Air & Space Forces, restructure details. airandspaceforces.com
  37. MIL-STD-464D, EM Environmental Effects.
  38. CRS RL32544, EMP/HPM (96% Adjutants General survey). umaryland.edu
  39. AFMAN 91-118, Nuclear Weapon Systems Safety, 2020. globalspec.com (abstract)
  40. AFMAN 91-119, Nuclear Software, 2012. bits.de
  41. DESR 6055.09/AFMAN 91-201, Explosives Safety. e-publishing.af.mil
  42. Defense Mirror, NSCCA, 2024. defensemirror.com
  43. GAO-19-128, Weapon Systems Cybersecurity, Oct 2018. gao.gov
  44. GAO-26-108838, Personnel Vetting, Feb 2026. gao.gov
  45. LMTF Environmental Assessment, April 2025. hill.af.mil
  46. KSL, Boeing $405M LMTF contract, 2024. ksl.com
  47. MSAR LGM-35A, Dec 2023. esd.whs.mil