This "what if this goes wrong" thinking is vital for large scale systems we use DevOps for. (After reading this, if I ever designed a submarine, I'd try to make sure that such spills wouldn't get into the battery.) That said, I bet a large amount of such "thinking" actually happens by investigating what goes wrong after the fact.

The same sometimes goes for exception handling code.

I don't necessarily disagree with your theory on design, but every complex war machine ... has some level of controls that if used improperly could be fatal. They are inherently dangerous systems.

Designing fail safes for such things has to be a sort of balance between added complexity / options for failure, and safety.

In the military there are plenty of "don't touch that, let the person who knows how to do it touch it" and I suspect that is often the right design.

> I don't necessarily disagree with your theory on design, but every complex war machine ... has some level of controls that if used improperly could be fatal. They are inherently dangerous systems.

I would also imagine that if you make a weapon too safe - then it either can cease to be a weapon, or by the time you remove the controls which turns it from "safe" to "unsafe" - you might already be captured/dead.

It's kinda like some initiatives out there to make it so that owners of guns have to store their guns unloaded in gun safes, with trigger locks, and ammo in separate locked containers.

In the (hopefully low probability) event that you need that weapon (perhaps a home invasion or such), by the time you are able to get to it and go through all the steps to make the gun usable - you're probably already dead.

Of course, I understand the logic and want behind such protections (to protect children, curious adults, to potentially keep the weapons out of thieves hands, etc) - but at the same time, I also understand and sympathize with the arguments against such controls.

There needs to be a balance between making such weapons safe, while also letting them become unsafe quickly when needed. In the case of military hardware, this balance also requires thoughtfulness about the destructive capability of the weapons involved; for instance, safety vs usability will be different for a rocket launcher, versus a nuclear missile.

A valid explanation of the trade-offs between safety and usability. But it seems like HN doesn’t like guns or gun analogies. Too bad.

> don’t touch that, let the person who knows how to touch it

Practically, how would that work for a toilet?

"So what did you do in the South Sea conflict?"

"I was a submarine toilet operator, first class, serving aboard the USS Deuce"

It could be designed in such a way that multiple people could use it with reasonable comfort with a small holding tank and then periodically someone comes along and flushes it.

Indeed, that's more or less the current system!

I have to disagree to an extent about the "war machine" bit. This is about a toilet, not a torpedo. Every boat at sea needs a toilet; this is a basic need for supporting human life unless you want to have people relieving themselves over the deck railings (which of course isn't even possible on a submarine).

If you have to have a specialist flush a toilet for you, the design is bad.

It's a new toilet on a complex machine that can't just dump stuff out in the open ocean all the time.

It's not "just a toilet" anymore than a sub should work like a video game.

It's not new: Germany had toilets on submarines for many years before this. Germany had U-boats back in WWI. Did they have toilet problems like this before? If not, then this is a bad design.

See the comment elsewhere in the thread about how (according to the German-language article) Schlitt ignored the requirement that the specialist flush the toilet, causing the incident: https://news.ycombinator.com/item?id=20410849

I'm sure all submarines have certain processes that can cause leaks if there's an operator error - diving with the hatch open, for example - but are there any that happen as often as toilet flushing?

Per [1], it was a special toilet designed to support flushing at depth (I guess it makes sense that it's a tough problem to solve when the sub is under pressure). I guess previous iterations of U-boats had to surface to flush. It does seem like keeping it in a tank until the next surface would be a better solution though. I mean, they have to surface for other reasons too, right?

[1] https://warisboring.com/the-high-tech-toilet-that-destroyed-...

bro you got somethig wrong info actually it had an accident near scotland and that's why it got sunk