Hacker News Reader

Comment by noonespecial | Hacker News Reader

With apologies to the late Mitch Hedberg, always design your device to fail like an escalator, not an elevator. When an escalator fails, it becomes stairs. When an elevator fails, it becomes jail.

Don't design a computer that is a smoke detector, design a smoke detector that happens to also have a computer. A kernel panic or complete loss of computing should leave behind a traditional smoke detector in a fancy looking case.

View on HN

As an exercise of the limits of this advice, how does this apply to designing elevators, short of "never design elevators"?

hard brakes that apply when doors are opened manually, and an emergency panel behind which a small ladder is located.

The costing difference between an elevator and stairs is substantial. Especially when you have to have stairs when you get an elevator by building code.

By having a manual fail safe that operates mechanically. i.e., without power.

Controlled descent to the next (lowest) floor, at which the properly aligned doors can be manually opened.

I agree (of course). It's even a bigger problem for me with the Nest thermostat. Living somewhere that gets cold in the winter I absolutely won't tolerate an added failure mode in my heating system. And I have other ways to monitor temperature that happen out-of-band of my furnace control.

A couple of years ago I had a 'failure mode' problem with my heating system. A winter storm knocked out power in my area. My heating system was a natural-gas-fired boiler that produced steam, which thanks to gravity would rise up through my radiators, condense to water, and flow back to the boiler. The power outage didn't stop the gas, so the only thing that kept my furnace from running was the electric thermostat that sent on/off signals to the electric device that controlled the gas valve and sparked an ignitor.

The thermostat itself had a battery backup, so it was trying to turn the heat on as my house cooled off. But the controller and ignitor had no backup. I couldn't even use a match to light the thing manually, because there was no way to open the gas valve.

I understand the safety implications of adding a manual valve and spark ignitor to a furnace, but letting my pipes freeze (and me too) also has safety implications. Besides, there's probably already a thermo-mechanical safety mechanism that would slam the valve shut if the furnace gets too hot.

Luckily, the power came back on in a few days, before my house got colder than light-jacket conditions. No frozen pipes.

Unfortunately the ones that were immune to this employed Mercury switches, which I don't believe are sold any more. We had an older gas heating stove which had this and worked even when the electricity was out (particularly good in the winter when heating with electricity). Eventually that part failed and being an older model, that part was discontinued by the manufacturer. This forced us to get a "new" stove which now uses an electrical system to control it, and which doesn't have a battery backup integrated. Technically one could add a UPS, but since it also uses an electrical fan it would probably empty that ups within a few hours.

I don't know if these are available for boilers, but many natural-gas-fired water heater controllers are powered by a peltier device, which is heated by a small pilot flame.

I have an electric heatpump for heating and hot water. The first thing I did when moving in to the house was install a reasonably efficient, manual wood burning stove, with 2 m3 of wood in the basement. I have had the heat pump fail in the middle of the winter, but the wood burning avoided any freezing disaster.

Of course, that assumes you're at home. I added a wood stove (in addition to a fireplace that I already had) partly as a backup. But I also travel a fair bit.

Any reason you didn't have a backup generator? I would think if you were at risk of frozen pipes without electricity, it would be a wise investment.

That's the situation for pretty much everyone in northern states. A generator that's wired in with propane tanks is a pretty significant expense and I'm still not sure how reliable it all is if no one is at home.

And so a problem caused by having a more complicated than necessary system is mitigated by adding in another very complex system for redundancy.

Now this can work, indeed as a engineer in SaaS, it's my job to make it work. But see how to make it work you have to hire engineers to nurse the all those systems along.

If the control line for your furnace is just a 24V loop (or a dry loop), a good hint is that you can keep a traditional thermostat in parallel with your 'smart" one - so that if either closes the loop, the furnace fires.

Then you can aim for "comfortable" with your "smart" one and "safe" with your real one.

That's probably true. And should also be part of the "smart" thermostat's design.

A nest failure in brutal New Orleans heat while I am out for a few days might spell death for one of my cats. I don't feel like Google takes their products seriously enough to trust them with the life of my pets.

This is a good point, but if I had pets, I don't think I would trust any air condition system at all to keep them alive for a few days.

But then I don't really know what it's like to own pets, and I don't know how housing in New Orleans works either.

I wonder how modern cars assisted steering and brakes fail when they do.

You can still steer and stop a car w/out power. It just takes a lot more force than you're used to.

Also, in an ICE car, the pump that pressurizes the power steering/breaking system is directly powered by belts off the engine. It's not electric and a computer does not mediate the power transfer.

Which really makes me think what happens in a Tesla when the computer shits the bed...

Escalators have bad failure modes too. An escalator can function as stairs because it has a set of brakes. If those brakes fail, gravity will send everyone on the belt into a high speed collision with the floor.

There has to be way to much friction in the mechanics for that to happen. No?

Mitch. One of the greats. Uncopyable.

Nope - Elevator failure in Hong Kong

https://www.youtube.com/watch?v=ADb57ysvCbU

Do escalators not come with a ratcheting mechanism to prevent exactly that from happening? Seems to me like a serious design error if not..

I guess they were designed to run in both directions, meaning you can't mechanically lock the "down" direction.

I mean, it's probably a Chinese escalator. We didn't get the term "Shenzhen Quality" out of thin air.

That seems a bit of a misnomer when everything is made in Shenzen.

Funny, it seems increasingly apt to me.

Most escalators used outside of China are not made in Shenzhen.

/s/Elevator/Escalator/

Just sayin', if I were building an escalator I would definitely use a wormdrive (or similar) gearbox, which physically cannot be backdriven.

Why does there always have to be one bikeshedder in every HN thread who reads too much into another's analogy and comments about how it's flawed/wrong/inaccurate, thereby completely missing the analogy's point?

Being pedantic can have it's merits but yes, it can get old.

Just wanted to thank you for adding the term "bikeshedder" to my vocabulary.

Because those people haven't internalized the idea of an analogy. An analogy is necessarily an imperfect abstraction, and some people think finding out those imperfections means you somehow found a flaw somewhere. Their brain (not singling out our friend here, just people in general) goes towards the exceptions in a model, because its far easier to find superficial flaws than it is to realize deeper meaning.

This is a wonderful observation. It is a lesson that I took far too long to learn as a young and somewhat insecure programmer, thereby becoming entangled in many unproductive arguments.

Perhaps not this case, but analogies when used as persuasion devices, can get quite dangerous. It's important to realize when they are false, or misleading, or overly reductionist, in order not to fall for them.

I certainly fell for a few false ones in the past. Sometimes only deeper meaning is that someone's trying to manipulate you.

I also was just thinking about those poor woman who got killed in a Chinese escalator accident a few years ago, totally missing the analogy's point.

But that's just a problem with analogies, they trigger different ideas in different people's heads.

The same is true of elevators, though, is it not? If we're postulating motor failure and brake failure, I'd still rather take my chances with a broken escalator.

I'll bite. The analogy has a failing elevator becoming a jail. That sounds like motor but not brake failure, i.e. the elevator getting stuck. If both motors and brakes failed, an elevator becomes a coffin not a jail.

Reply on news.ycombinator.com