One thing I love to play with in worldbuilding is the dialectic of centralisation-decentralisation.

Decentralisation has many advantages: when something (e.g. food) is produced decentrally, distribution is already done, there's no extra "now distribute it" step.

Decentralisation is also more resilient: a single tornado can bring a country's power if it's all dependent on one huge nuclear plant or something. And that's what my question is about.

Given a society that generally favours centralisation, but is aware of the vulnerability that it brings, how many power plants would it need to have? Ten? Five? It's not going to distribute power generation into 1,000,000 rooftop solar arrays; it's just trying to provide the minimum necessary amount of redundancy to be resilient to natural disasters, failure, etc.

I can think of some different ways of calculating this: we could want the entire system to maintain 90% functionality on all but 6σ days (which basically never happen). Then the chance P of one plant failing one day, and the number n of plants, would be multiplied to get the chance of widespread failure. e.g. if you have two plants and they have a 1% chance of being down any given day, the whole system has 1 chance in 10,000 of failing. If you add a third plant, there's 1 chance in 1,000,000 of total failure, 1 chance in 10,000 of two-thirds failure, etc.

I'm using power plants as one example, but it could be any big industry: alumnium smelting, cement manufacture, etc.

I'm sure this has been worked out by some mathematician or tactician or logistician or dietitian that I haven't read, as it's an important thing to consider.
Thank you.

  • 8
    $\begingroup$ What's your threat model? Natural disasters, mechanical failure, operator error, brownouts, sabotage? Each of these will bring certain factors that may favor centralization or decentralization. $\endgroup$
    – Cadence
    Feb 11 at 12:25
  • 2
    $\begingroup$ What @Cadence said. In general, one can say nothing about how to solve a problem unless the problem is specified. (For example, the approach that decentralized food production eliminates the need for a distribution network is that there is no distribution network, so that local failures are locally deadly. If something makes local food production unavailable, there is no way to get the food there, and people starve.) $\endgroup$
    – AlexP
    Feb 11 at 12:27
  • $\begingroup$ P.S. "Maintain 90% functionality" are weasel words, not a well-defined engineering goal. When the Texas power grid failed in 2021, it failed. Yes, the worldwide power production and distribution system remained more than 99% functional; that did not help the Texans any little bit. (And aluminium smelting as an example is very bad; more than 50% of this world's aluminium is made in China, with India and Russia very distant 2nd and 3rd. There is no redundancy in aluminium smelting.) $\endgroup$
    – AlexP
    Feb 11 at 12:35
  • $\begingroup$ I agree that "Maintain 90% functionality" are weasel words, not a well-defined engineering goal. That's what my question is: how do we get more rigorous on this? Aluminum smelting is a good example of modern vulnerability, yes. Manufacturing the machines that make microchips is another; if Zeiss or ASML failed, the whole global industry would be logjammed. $\endgroup$
    – wokopa
    Feb 11 at 12:42
  • 1
    $\begingroup$ Reliability engineering. Reliability theory. System availability. In general, you should start with defining a specific goal, what specifically you want to achieve when confronted with a set of specific threat scenarios. Then you should estimate the cost of mitigating the risks as compared to the cost of accepting them. For example, power plants are expensive to build and maintain; just how much is an acceptable cost? $\endgroup$
    – AlexP
    Feb 11 at 12:45

1 Answer 1


I think we need to separate redundancy from resiliency. Having a second phone gives you redundancy, but if both models break just by looking at them you do not have resiliency. Resiliency can reduce the need for redundancy.

If you were to bury your electrical cables instead of hanging them from electric poles, they would be protected from high winds and storm damage. The initial cost of digging up so much earth is high, but over the long term it will reduce the chances of line failure. Over-engineering a building can allow it to survive disasters which would otherwise negatively impact it. You can design a system which will statistically never fully fail, but the cost of such a system would likely be beyond affordable. Building resilient products tends to be cheaper than attaining a redundancy. A backup generator is cheaper than a second power plant. Doubling the thickness of a hydroelectric dam is cheaper than building two dams.

The biggest issue with redundancy is the cost. A pro of centralization is that you concentrate your issue resolution at a single point. While a million solar arrays might be extremely reliable, if 10% are damaged, it would take a long time to repair/replace them all. Damage to a single nuclear reactor can speed up recovery time. A backup nuclear reactor would need to be capable of producing the same level of power as the primary. This means it would cost just as much to build. If you want it to be capable of operating at moment’s notice, it will need to be a “hot” site. This means that it would contain everything the primary site has except the personnel. That being said, a good redundant system design is to have your primary, a backup, and a secondary backup. The odds of both the primary and first backup failing at the same time are remote at best, but there will eventually be a situation where the secondary backup comes into play.

Risk tolerance falls into four categories: Avoid, Transfer, Mitigate, or Accept. Avoidance can be something like refusing to build a city in a flood zone. Transferring would be getting flood insurance so that any damage is covered. Mitigation might involve increasing drainage in the area, flood barriers, and raised foundations. Acceptance is just what it sounds like. You just accept that a flood will happen, and buildings will be damaged. You can use these categories when determining how your civilization will react to risks.

Much risk can be mitigated by adopting a longer-term outlook on life. For example, food production can fluctuate from year to year. A risk-averse society would preserve food during normal production yields and maintain a backup supply of preserved food capable of lasting for the maximum estimated length of low yields. If this is determined to be five years, the civilization would not need to worry about famine for quite a while even if they lost crops to multiple natural disasters. The same could be said for aluminum or cement production. A five-year stockpile would prevent any disruption of goods while repairs were completed on the only production facility. Although, for this type of non-critical construction good you would want to calculate the time it would take to completely rebuild the production facility and get it fully functioning and ensure your stockpile would last beyond that point in time. If it will take two years to rebuild a cement factory, then stockpile enough cement to last three years of average construction demand. Push comes to shove, construction projects can be delayed or prioritized to ensure the supply does not run out before production resumes.

Battery backup and emergency generators for uninterrupted power can provide resiliency. Battery power can be used until the population can transition to a reduced power usage plan. The backup generators could then support the reduced power demand until the primary power plant is brought back to full operation. Critical services would be prioritized over non-critical. There will still be a negative impact, but it will be mild in comparison to not preparing for such a situation.

Another method of adding redundancy in a power grid is to have smaller reactors which are not operating at full capacity. A dozen smaller reactors capable of producing 150% of the power needed will allow for several reactor failures before power production capability falls below what is needed. This type of system would also allow reactors to be taken offline for maintenance without negatively impacting power availability. I would say that a good number of reactors is one which allows you to lose more than 25% before there is a negative impact, but you might also want the primary and secondary backup mentality. Meaning that the bare minimum number of reactors is 8 (capable of cumulatively producing 150% of needed power), as it would take the failure of three reactors to drop power below minimum levels.

P.S. I would argue that decentralized food production still requires distribution, especially when cities are involved. Farming takes a lot of land. While some foodstuffs are ready to eat when harvested, others require processing to become edible (Wheat -> Flour -> Bread), and all of it needs to get to the people consuming it.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .