Fail Safe

Acts of God And Risk

I've been pondering the issue of nuclear power in light of the Fukushima crisis, and I have to say the problems of how things got to this point are so complicated that it's impossible to pin the blame on any one thing. The Fukushima plant was designed with earthquakes and tsunami threats in mind. They set the bar for earthquakes at 8.0 or so which was the magnitude of the quake in Tokyo, 1923. The tsunami threat was set for waves that were 6m high. In reality, what brought Fukushima undone was a 9.0 earthquake that unleashed 1500 times more energy than the 1995 Kobe quake, and a tsunami that was 12m high. In both instances, the spec the plant had to withstand was much larger than anything in recent record.

And there's crux number one. How far back would one have to go to fin the maximum threat, and how much more redundancy would one have to add on top? Even if they had added 20% to the largest threat recorded, the plant would have been built to 8.4 magnitude and 7.2m high waves. The unforeseen is by definition is unforeseen.

Subsequent to the two overpowering threats that manifested were 2 diesel generators for back up that failed, as well as a third battery system that also failed to kick in. All the fail-safes and redundancies were overwhelmed.  The fact that the system didn't go into immediate meltdown is some kind of testament to the engineering. Can all of this really be ascribed to the fault of the engineers? Isn't this more like what insurers call 'An Act of God'?

I'm not trying to redeem the nuclear power industry or Japanese engineering here, because at the end of the day there is an ongoing crisis that is threatening all of Fukushima prefecture and possible North-East Japan. What I do want to bring up is the nature of risk. Every time we drive a car we take a risk, every time we take the train we take a risk; society is actually built up on managed risks and underlying them all are assumptions on what is manageable and safe. For the better part of 40years, the nuclear plant in Fukushima ran without having a major hiccup until a series of overwhelming events. A rational person has to put that into the equation of benefits to balance against the risks.

So now I'm thinking aloud here, wondering if the case for nuclear is legitimately dead. Here's an intellectual exercise: Let's say the same plant was built in Australia and run with equal effectiveness. If it were away from the coast and rivers, chances are it's not going to be subjected to magnitude 9.0 earthquakes and tsunamis. What could possibly happen?

About the only thing I can think of off-hand are bushfires. But what if it had an exclusion zone around it? Again the question comes up as to what would be a legitimately safe exclusion zone to counter all bushfires? We could only figure out the worst bushfire and then calculate a 20% redundancy on top of the worst case scenario we know. But what if the disaster that strikes is twice the size of the previous worst?

The same problem is in fact what struck Brisbane and the Wivenhoe in the recent flood. The Wivenhoe dam was designed with the worst case on record in mind. The flood that eventually came had twice as much water as the previous recorded worst case.

I guess actuaries are busy doing their sums on this kind of thing, and doubtless there are mathematical formulae that address these things, and even then I'm guessing they will be found out to be faulty by the next disaster. Which leads me to think there's a structural problem with all of projection of worst case scenarios. Stock traders and commodity traders are always quick to point out that past performance is no promise of future performance. This is at its core the same problem with inductive reasoning.

The problem of induction is the philosophical question of whether inductive reasoning leads to knowledge. That is, what is the justification for either:

• generalizing about the properties of a class of objects based on some number of observations of particular instances of that class (for example, the inference that "all swans we have seen are white, and therefore all swans are white," before the discovery of black swans) or


• presupposing that a sequence of events in the future will occur as it always has in the past (for example, that the laws of physics will hold as they have always been observed to hold). Hume called this the Principle of Uniformity of Nature.

The problem calls into question all empirical claims made in everyday life or through the scientific method. Although the problem arguably dates back to the Pyrrhonism of ancient philosophy, David Hume introduced it in the mid-18th century, with the most notable response provided by Karl Popper two centuries later. A more recent, probability-based extension is the "no-free-lunch theorem for supervised learning" of Wolpert and Macready.

Philosopher John Vickers concluded that we should use induction, not because it yields certainties, like deduction, but because it is a method that can correct itself - and is thus more likely to bring us closer to truth than other methods.[1].

Now this ultimately goes to Karl Popper and falsifiablity:

According to Popper, the problem of induction as usually conceived is asking the wrong question: it is asking how to justify theories given they cannot be justified by induction. Popper argued that justification is not needed at all, and seeking justification "begs for an authoritarian answer". Instead, Popper said, what should be done is to look to find and correct errors.[20] Popper regarded theories that have survived criticism as better corroborated in proportion to the amount and stringency of the criticism, but, in sharp contrast to the inductivist theories of knowledge, emphatically as less[21] likely to be true. Popper held that seeking for theories with a high probability of being true was a false goal that is in conflict with the search for knowledge. Science should seek for theories that are most probably false on the one hand (which is the same as saying that they are highly falsifiable and so there are lots of ways that they could turn out to be wrong), but still all actual attempts to falsify them have failed so far (that they are highly corroborated).

That's all well and good for knowledge, but for design and engineering, this has practical, real world problems. And I don't mean this lightly. The main problem we're seeing is that the critique comes in the guise of out of control, super-scale disasters. We only get to see the failure point of designs when a sufficiently large disaster strikes. On that scale, the trials of the Fukushima plant are inordinate challenges. They are beyond what could have been reasonably expected; the unreasonable-ness if you like, of the challenge is in a sense falsifying the design.

Was it reasonable to design for 8.0magnitude earthquakes when there are 9.0 magnitude earthquakes? Was it reasonable to design for 6m tsunamis when 5m was the highest that had been seen? I'd like to see one argument that is mounted without being post-hoc. It's the post-hoc arguments that are clouding the issue as to whether we can realistically look at any piece of design and find it acceptable.

Anyway, I've been racking my brain in the aftermath of the quake off Sendai, and that's all I've got for you. Some of you are better philosophers. You tell me if we can actually learn anything useful about the risks for which we can and can't design. It seems to me, we're all at a loss, and the triumphal "told you so" heard from our Green friends about nuclear power are actually nothing much more than opportunistic cat calls. And I'm saying this as somebody who is not even pro-nuclear. I just want some truth.