April 1, 1979 APR SO Letter to the Editor of American Scientist Aaron Wildavsky Trial Without Error Does the breakdown at the Three mile Island reactor in Pennsylvania > invalidate the thesis that "No Risk is the Highest Risk of All"? I think not. The article is about recent reluctance to face risks in almost all realms of human life, whether these come by land or sea or air. Energy is only part of it. Though risks may be real in same respects, risk is unlikely to have risen rapidly in so many so soon. Hence the hypothesis that perception of risk should be sought not so much in what is out there but rather more in what is in us. The revelation that mistakes occur and accidents happen suggests that risk is part of life rather than the reverse. Nevertheless, my suggestion that the effort to eliminate risk is not only futile but counterproductive may be challenged on the grounds that insufficient effort to remove risk was evidently made, for otherwise the reactor would not have overheated and spewed out radioactive gases. Since what is self-evident to som people is not to me, T welcame the opportunity to say why I re eject “trial without error" as a 1 criterion of decision: Without error there is no - learning. ‘Science, its historians say, is more about rejecting than accepting hypotheses. Knowledge grows by criticizing the failure of existing theory to explain or predict events in its domain of applicability. Democracy says little about what one does in office but much more about getting officials out of office. “Throwing the rascals out," eliminating error, is the essence of democracy. -2- < Similarly, in social life, it is not the ability to avoid error (even Goncharov's Oblomov, who spends his life in bed, cannot do that), but learning how to overcome it that is prized. This mode of learning has seeped so far into collective consciousness that it has become a stock phrase —- trial and error. At stake in the debate advocate on risk is nothing less than a radical revision of this practice to/"No trials without guarantees against error". ‘The implication is obvious: If you can't do anything without knowing how it will turn out, you can't do anything new at all. There is a difference between safety and stultification, which Herbert Simon put about as well as can be in 1968: The dream of thinking everything out before we act, of making certain we have all the facts and know all the consequences, is a sick Hamlet's dream. It is the dream of someone with no appreciation of the seamless web of causation, the limits of human thinking, or the scarcity of human attention..., The. world outside is itself the greatest storehouse of knowledge. Human reason, drawing upon the pattern and redundancy of nature, can predict some of the consequences of human action. But the world — will always remain the largest laboratory, the largest information Store, from which we will learn the outcomes, good and bad, of what we have done. Of course it is costly to learn from experience; but it is also costly, and frequently much less reliable, to try through research and analysis to anticipate experience. Inaction is also action, and experimentation on the real world is. not as risky as it sounds, at least no more risky than that form of experimentation which consists of doing nothing new or different until all the facts are in. Life requires us to balance risks; it does not permit us to avoid them altogether. } -3- Trial without error is no trial at all; it is a Kangaroo Court declaring modern technology guilty as charged. Imposing this standard would not only stop nuclear power, which it is intended to do, but also all other new activities (and not a few older ones as well). Certainly the steam engine would never have survived such a test. That nuclear power should be prohibited is not a conclusion based on events but the premise on which a stultifying standard is applied. Relative safety is not a static but rather a dynamic product of learning fram error over time. Pioneers pay the costs of premature development; first models are rarely reliable; as experience accumulates, bugs are eliminated and incompatibles alleviated. Were history halted, .development deterred, so to speak, risks for innovators would be markedly increased. The fewer the trials, so there are less mistakes to learn from, the more error remains uncorrected. As development continues into the second and succeeding generations, moreover, the costs of error detection and correction are shared to some extent with future practitioners, and the benefits passed back down to the originators. By following rules that tell us there will be no tomorrow, few would be willing to start up something new today. It may be that no one wants to be the first to face risks. Needless to Say, the second generation can not learn fram the first if there isn't | one. Attempting to prove a negative -- that no harm will occur -—- is extremely expensive as one hypothetical alternative after another has to be ruled out. Refusing risk is like a parody of the gangster movies of the 1930's: “Louse this up, Loui@é, and your first mistake will be your last." -4— Risks may be rationed, it turns out, but there is no way, including inaction, to avoid them altogether. Like the old Yiddish story ("Harry, how's your wife? Compared to who?" he says) the relevant question is not whether but "who" will bear what kind of risks. Compared to what other sources of energy likely to be available in the next decade at costs people are willing to pay is nuclear energy less safe? Paying a premium for alternatives disadvantages poor people who need new resources to pull themselves up, disadvantages that are injurious to their mental and physical health as well as to their income. Using the future as a current constituency, where even a single person's preference, extended forever, has to have infinite value, penalizes the present. Using up . resources in vast profusion to prevent risks from occuring is a power grab of the present at the expense of the future, which has to accept the specific life forms and precise techologies passed up to it, because there are no surplus resources in society to do otherwise. The alternative, an article of faith while there was still belief in progress, was for each generation to leave the next better off in terms of total resources, so it was |. left with an enhanced general capability. Allowing the future to decide for itself is preempted by over-—consuming "safety" in the present. Here we have a conflict of conceptions about how to cope with ‘risk, a conflict between anticipation and resilience. As always, the choice is not so much one or the other but the balance between them. Resilience is the capacity to respond to the unexpected by overcoming difficulties after they occur. Obviously, if evils could be anticipated and exterminated before they occur, there would be no need for resilience. Obviously, also, leaving everything to resilience would overload capability for response. Not so evident are the principles through which to rationalize a -5- relationship between anticipation and resilience. The more we trust future generations to choose wisely (or, at least, no worse than we would), the greater our reliance on resilience, the less we need to anticipate. Conversely, the cost of anticipation rises exponentially with lack of confidence in the future, so that as many evils as possible have to be prevented from reaching them. Applied in the current energy context, resilience would rely on variety. Instead of attempting to guard against every evil, only the most likely or | most dangerous would be covered, fully expecting that whatever was missed would be countered as and after it occurred. The implication for energy policy would be not to rely exclusively on any single source or mode of generation’ SO that, whatever happened to supplies or technology, we would be able to respond effectively. Solar energy,with its small size and independence of central coordination, is highly desirable to develop but it might prove vulnerable to climatic change or an unforeseen demand for continuous high bursts, capacities contained by nuclear power. If there were aa prospect of nuclear dominating the energy industry, I would want to limit it. On present evidence, there is little danger of that. If nuclear energy proves more costly or more dangerous at comparable cost, I would expect it to lose out to campetition. But I would not favor leaving the nation less capable in the future in order to prevent risk in the present. ; Anticipating risk depends on experience or theory. If experience is unsafe, only theory is left. Now the evils that might occur are endless compared to those that have actually manifested themselves. The risk of guarding against all conceivable risks is that the costs are raised to such _ a high level that ability of small scale units to compete decline and with it the rate of innovation. Instead of > diversification, there is unification of risk in large : scale “public « and private organizations. Hence both the probability that significant risk will not occur (because of experimental anticipation) and the probability that, if the _6— unexpected does happen, it will prove catastrophic (because response to risk has been concentrated, because the uniform response promoted by large organizations is likely to be as wrong as it is late, because resources required for resilience have been sacrificed to anticipation) go way up. I would prefer to diversify rather than unify risks; readers may have other preferences. But I hope to have shown that avoiding risk implies choice just as much as assuming it. As a last resort, why can't we quell our umeasiness by acting conservatively? Surely. the prudent person would rank risks , choosing to avoid the worst, especially if the consequences would be serious. surely, bomervative behavior seems reasonable on the surface but deep down it is the opposite. Sequences of calculation that should be joined are kept separate without realizing that, like the song says about love and marriage, you can't have one without the other. How are risk assessments of any kind made? Badly, no doubt, but, if they are made, it must be according to sare theory of decision in which, using whatever information is available, the probabilities of _consequences occuring are discounted by a ranking of the S a 4 relative awfulness of the contemplated events. In a word, risk aversion is already contained in risk assessment. What is the point, then, of going through this exercise, which is necessarily laden with preferences and probabilities, only to stop and say "Let's be conservative"? What is being conserved is whatever policy preference the assessor was determined to pursue before. I hold no brief for nuclear power. It requires no defense from me apart fram whatever criteria I would use to evaluate any other source of energy. Just as I would not recommend "trial without error" for solar or wind energy, for instance, I would not impose that rule on nuclear. To explain why that extraordinary rule is proposed, I believe, to return to "No Risk Is the Highest Risk of All,! it is necessary to look at what is happening in American society and not merely to arguments about energy.