Brittle Power- PARTS 1-3 (+Notes) - Natural Capitalism Solutions

192National Energy SecurityFine-grained, modular structure Any system is made of parts. We define a“module” to be a part which is a unit of operation or failure: it is the smallestunit that either works or doesn’t work. (Not working may mean doing thewrong thing or doing nothing at all; or these may be synonymous.) Modulescan also be the unit of inventory or of growth. A module can be, for example,an organism in a food chain, or a device performing operations within acomputer. It can be a device supplying electricity to a grid, or an “island”within that grid, or a city grid which such “islands” make up, or the grid ofone utility company, or an entire regional or national grid—depending on thecontext of the discussion, the level at which one is considering failure.Modules are connected with each other in some pattern to make up a system.The lines of connection, or links, are also possible sources of failure. Soare the nodes at which links join with each other or with modules. In a powergrid, for example, electrical transmission and distribution lines are links; theswitchgear, substations, and transformers that join the lines to each other arenodes. Any link or any node can fail, just like any module. (We refer genericallyto all three of these devices as “components.”)Other things being equal, failures are less serious in small modules than inlarge modules. That is, a finer-grained structure of modules permits a smallerfraction of the total capacity of a system to fail at one time, so the total functioningof the system is less affected. (Other design properties, discussedbelow, can isolate the failure of an individual module before it can propagate.)Smaller modules also make repairs easier, spare parts cheaper, and so forth,than if the units were larger and “lumpier.” The size of individual modulesalso affects their cost and performance in many important ways which are discussedin detail in Appendix One.Early fault detection Individual modules, links, and nodes can fail withoutserious consequences if the failure is promptly detected, isolated, and fixed. Promptdetection is easiest with “fail-safe” design—that is, if a component either worksright or conspicuously does nothing at all, but at least does not work wrong.This in itself helps to isolate the failure before it can propagate wider failures—in the same spirit as the “dead man’s hand” throttle which stops a train if itsdriver collapses. It is, of course, possible to make a design error which makesa supposedly fail-safe design fail dangerously: in Gall’s phrase, “A fail-safe systemfails by failing to fail safe.” 54 A possible precaution is to back up a fail-safecomponent with independent means of detecting failures early. That is why,for example, a nuclear reactor will shut down if any of several signals (suchas temperature, neutron flux, or the period of the chain reaction) exceeds prescribedlimits. The more complex is the equipment for detecting faults, the