6 ms·

The problem with fault tolerance is that it allows the normalization of deviance, since something is always failing, but it's okay because there is always a bac

The problem with fault tolerance is that it allows the normalization of deviance, since something is always failing, but it's okay because there is always a backup (until there isn't). The bigger issue with nuclear power is that we can trust humans to keep up the level of effort to keep it working without a fault for a few decades, maybe centuries if we're lucky, but there's no way you can operate a plant for a millennia without a catastrophic accident, but accidents take much more than a thousand years to clean up. So it's all totally imbalanced unless you just assume we'll have fusion in fifty years, so nothing matters. But I don't think we can assume that anymore.

WalterBright 6y ago
> The problem with fault tolerance is that it allows We do that with airplanes. Think about it - you're flying at 30,000 feet, 500 mph, 50 degrees below zero, no land in sight over the North Atlantic, in a tin balloon loaded to the gills with fuel and two flaming engines. And yet you're perfectly safe. How did that come about? Tolerance of failure.
- silvestrov 6y ago
  https://en.wikipedia.org/wiki/List_of_missing_aircraft#2001–2019 https://en.wikipedia.org/wiki/List_of_missing_aircraft#2001–...
  - WalterBright 6y ago
    Look at how few of them there are, despite millions and millions of flights. It's an absolutely incredibly good safety record. You're much safer flying across the Atlantic than driving to the airport.
    - aYsY4dDQ2NrcNzA 6y ago
      Hundreds of millions in the U.S. alone, over that 18-year span.
- earthboundkid 6y ago
  The machines are designed to tolerate fault, but the FAA is designed to not let you take off unless you do a checklist that proves all the engines are working, not just the one you need for a crippled landing. So the system as a whole requires that the FAA not give in to the pressure from industry to sign off on less fault tolerance. It's a difficult issue for systemantics.
  - WalterBright 6y ago
    Um, there isn't a backup if the backup isn't operable before you take off.
    - AdamN 6y ago
      That's their point. If the FAA didn't mandate it you can be sure budget airlines would be taking off and doing routes with one engine broken :-)
      - WalterBright 6y ago
        That's not a fault of the airliner design. > you can be sure Not likely. Who you gonna get to fly it? Who you gonna get to pay to fly in it?
        andrekandre 6y ago
        > Who you gonna get to fly it? Who you gonna get to pay to fly in it? a. people in less developed countries b. people in said countries with less money to spend than others this has happened before (south america in the 70s, etc), which is why the aviation industry has the regulatory system it has today
        WalterBright 6y ago
        Really? You know of examples of passenger planes taking off with only one engine turning? Or of any twin engine airplane doing this deliberately (other than a test flight or desperate emergency, like the volcano is gonna blow any moment).
- lmm 6y ago
  Not just tolerance of failure. Also strict incident investigations and reporting requirements, including for "near misses"; also a strong safety culture made possible by strong unions and strict seniority-based promotion rules; also...
  - WalterBright 6y ago
    > a strong safety culture made possible by strong unions and strict seniority-based promotion rules ??
    - lmm 6y ago
      Pilots can't get ahead by cutting corners, and (to a somewhat lesser extent) it's hard for maintenance people to be pressurised to sign off on unsafe work.
      - WalterBright 6y ago
        Strict seniority rules means no incentive for doing quality work above the minimum.
        lmm 6y ago
        Indeed, but also no incentive for bypassing safety checks that are redundant most of the time (which is how you get the normalisation of deviance that eventually leads to catastrophe). Sometimes that's the right tradeoff.
        jmcdl 6y ago
        Could nuclear power plant operators be incentivised by using "proactive risk detection" metrics or something along those lines? I suppose there will then be incentives to exaggerate or "invent" new risks for career advancement, but is that not preferable to the alternative?
        6y ago
- nine_k 6y ago
  Airplanes are highly standardized. Dozens and hundreds of essentially the same model are built. A few of them are built specifically to test in various ways and even crash and burn, and make sure they behave reasonably in such situations. Civilian nuclear reactors are mostly built by a handful, rarely by a dozen. This makes learning from past mistakes and taking preventative measures across the fleet hard. I think France has partly solved it exactly by having a small number of standardized reactors, and a number of nuclear plants which can be run in a reasonably uniform way.
  - WalterBright 6y ago
    > Airplanes are highly standardized. Not really. Every one coming off the line is different. They are constantly being improved. Every part on the airplane is carefully tracked, from manufacturing lot to which airplane each is installed on. Everything is designed by engineers, not custom made on the spot by a mechanic.
    - natmaka 6y ago
      Yes, French nuclear powerplants were standardized and built in batches ("séries", in French). This does not magically creates conditions for a perfect design and building process. See for example https://theecologist.org/2016/sep/29/sizewell-b-and-27-other-edf-nuclear-plants-risk-catastrophic-failure https://theecologist.org/2016/sep/29/sizewell-b-and-27-other... Planes aren't perfectly safe (my brother was killed when SR111 crashed in 1998 after failures). Anyone preferring not being exposed to a plane crash can abstain to travel in planes. Anyone preferring not being exposed to nuclear reactors boo-boos and hot waste has no real way to do so.
    - interestica 6y ago
      The failure points aren't always the aspects engineered by anyone related to airplane manufacture. Swiss Air 111 may have come down due to a fault/failure in wiring for its add-on entertainment system. https://www.swissinfo.ch/eng/electrical-fire-downed-swissair-flight-111/3238752 https://www.swissinfo.ch/eng/electrical-fire-downed-swissair...
baq 6y ago
Complex systems should be assumed to run in a partially broken state. Accidents are more things getting broken quicker than failsafes and operators can react to. That’s not to say I like nuclear power - IMHO opportunity cost is too high. I could build, operate and decommission a renewable solar or wind plant in the time it takes to plan a new nuclear plant.
willyt 6y ago
I think we need to look at what France is doing. They seem to have a good safety culture as a society, 90% of their power is nuclear and has been for decades they’ve never had a serious accident. Other examples, they have also never had a serious high speed train accident. They seem to be able to build these things considerably cheaper than we are able to in Britain and way cheaper than you can in America. They are a first world country with equivalent living conditions to the UK so unlike comparisons with China where many people blame poor working conditions and under regulation for cheapness, you can’t make the same argument against France. By the way I don’t know if that’s true about regulations in China (who does) but it is an argument that many people make that is a lot more easily refuted by just comparing with France instead.

WalterBright 6y ago

> The problem with fault tolerance is that it allows We do that with airplanes. Think about it - you're flying at 30,000 feet, 500 mph, 50 degrees below zero, no land in sight over the North Atlantic, in a tin balloon loaded to the gills with fuel and two flaming engines. And yet you're perfectly safe. How did that come about? Tolerance of failure.

silvestrov 6y ago
https://en.wikipedia.org/wiki/List_of_missing_aircraft#2001–2019 https://en.wikipedia.org/wiki/List_of_missing_aircraft#2001–...
- WalterBright 6y ago
  Look at how few of them there are, despite millions and millions of flights. It's an absolutely incredibly good safety record. You're much safer flying across the Atlantic than driving to the airport.
  - aYsY4dDQ2NrcNzA 6y ago
    Hundreds of millions in the U.S. alone, over that 18-year span.
earthboundkid 6y ago
The machines are designed to tolerate fault, but the FAA is designed to not let you take off unless you do a checklist that proves all the engines are working, not just the one you need for a crippled landing. So the system as a whole requires that the FAA not give in to the pressure from industry to sign off on less fault tolerance. It's a difficult issue for systemantics.
- WalterBright 6y ago
  Um, there isn't a backup if the backup isn't operable before you take off.
  - AdamN 6y ago
    That's their point. If the FAA didn't mandate it you can be sure budget airlines would be taking off and doing routes with one engine broken :-)
    - WalterBright 6y ago
      That's not a fault of the airliner design. > you can be sure Not likely. Who you gonna get to fly it? Who you gonna get to pay to fly in it?
      - andrekandre 6y ago
        > Who you gonna get to fly it? Who you gonna get to pay to fly in it? a. people in less developed countries b. people in said countries with less money to spend than others this has happened before (south america in the 70s, etc), which is why the aviation industry has the regulatory system it has today
        WalterBright 6y ago
        Really? You know of examples of passenger planes taking off with only one engine turning? Or of any twin engine airplane doing this deliberately (other than a test flight or desperate emergency, like the volcano is gonna blow any moment).
lmm 6y ago
Not just tolerance of failure. Also strict incident investigations and reporting requirements, including for "near misses"; also a strong safety culture made possible by strong unions and strict seniority-based promotion rules; also...
- WalterBright 6y ago
  > a strong safety culture made possible by strong unions and strict seniority-based promotion rules ??
  - lmm 6y ago
    Pilots can't get ahead by cutting corners, and (to a somewhat lesser extent) it's hard for maintenance people to be pressurised to sign off on unsafe work.
    - WalterBright 6y ago
      Strict seniority rules means no incentive for doing quality work above the minimum.
      - lmm 6y ago
        Indeed, but also no incentive for bypassing safety checks that are redundant most of the time (which is how you get the normalisation of deviance that eventually leads to catastrophe). Sometimes that's the right tradeoff.
        jmcdl 6y ago
        Could nuclear power plant operators be incentivised by using "proactive risk detection" metrics or something along those lines? I suppose there will then be incentives to exaggerate or "invent" new risks for career advancement, but is that not preferable to the alternative?
        6y ago
nine_k 6y ago
Airplanes are highly standardized. Dozens and hundreds of essentially the same model are built. A few of them are built specifically to test in various ways and even crash and burn, and make sure they behave reasonably in such situations. Civilian nuclear reactors are mostly built by a handful, rarely by a dozen. This makes learning from past mistakes and taking preventative measures across the fleet hard. I think France has partly solved it exactly by having a small number of standardized reactors, and a number of nuclear plants which can be run in a reasonably uniform way.
- WalterBright 6y ago
  > Airplanes are highly standardized. Not really. Every one coming off the line is different. They are constantly being improved. Every part on the airplane is carefully tracked, from manufacturing lot to which airplane each is installed on. Everything is designed by engineers, not custom made on the spot by a mechanic.
  - natmaka 6y ago
    Yes, French nuclear powerplants were standardized and built in batches ("séries", in French). This does not magically creates conditions for a perfect design and building process. See for example https://theecologist.org/2016/sep/29/sizewell-b-and-27-other-edf-nuclear-plants-risk-catastrophic-failure https://theecologist.org/2016/sep/29/sizewell-b-and-27-other... Planes aren't perfectly safe (my brother was killed when SR111 crashed in 1998 after failures). Anyone preferring not being exposed to a plane crash can abstain to travel in planes. Anyone preferring not being exposed to nuclear reactors boo-boos and hot waste has no real way to do so.
  - interestica 6y ago
    The failure points aren't always the aspects engineered by anyone related to airplane manufacture. Swiss Air 111 may have come down due to a fault/failure in wiring for its add-on entertainment system. https://www.swissinfo.ch/eng/electrical-fire-downed-swissair-flight-111/3238752 https://www.swissinfo.ch/eng/electrical-fire-downed-swissair...

baq 6y ago

Complex systems should be assumed to run in a partially broken state. Accidents are more things getting broken quicker than failsafes and operators can react to. That’s not to say I like nuclear power - IMHO opportunity cost is too high. I could build, operate and decommission a renewable solar or wind plant in the time it takes to plan a new nuclear plant.

willyt 6y ago

I think we need to look at what France is doing. They seem to have a good safety culture as a society, 90% of their power is nuclear and has been for decades they’ve never had a serious accident. Other examples, they have also never had a serious high speed train accident. They seem to be able to build these things considerably cheaper than we are able to in Britain and way cheaper than you can in America. They are a first world country with equivalent living conditions to the UK so unlike comparisons with China where many people blame poor working conditions and under regulation for cheapness, you can’t make the same argument against France. By the way I don’t know if that’s true about regulations in China (who does) but it is an argument that many people make that is a lot more easily refuted by just comparing with France instead.