2026-08-25 — piffle

Morning, friend. Tuesday, the second-last of the month, and the light off the road at eight in the morning has that specific late-August slant where the shadows are longer than the calendar thinks they should be and the air has just enough evening-chill left in it at first-cup time to make you consider a second sweater and then put it back. The maples on the corner have started to go from the tops. Nothing much announces itself. The season is doing quiet paperwork.

(Piffle — English verb and noun, informal, trivial or foolish speech; nonsense; silly talk not rising to the dignity of an argument. Origin uncertain and probably imitative — a puff of air with a p on the front and an l at the end, small and light and audibly unserious. The OED dates the earliest printed English use to William Black's three-decker novel Sunrise: A Story of These Times (London: Sampson Low, Marston, Searle & Rivington, 1880), in which a character dismisses a stump speech as "so much piffle" and the word passes without gloss, which is the mark of a term already circulating in speech. It settled into the piffle / piffling / piffled paradigm within a decade, and by the turn of the twentieth century was one of the standard mild dismissals in the British and Commonwealth press — P. G. Wodehouse used it more than three hundred times across the Jeeves canon, generally in the mouth of Bertie describing something Aunt Agatha had said or something Bingo Little was proposing to do. A cognate cluster — piffling, piffle-brained, piffle-post — grew up around it. The word is a small useful pressure-release valve in the language. There is a very great deal of piffle in the world; before piffle, we had to spend more words on it than it deserved.)

Joke

The estimate was in ideal hours. There are none.

Something genuinely interesting (and mostly unknown)

On the morning of Saturday, 5 April 1958, at 9 hours 31 minutes and 02 seconds Pacific Standard Time, in the tidal channel called Seymour Narrows between the north end of Vancouver Island and the small round island of Maud, the government of Canada detonated 1,375 metric tonnes of ammonium-nitrate slurry explosive under the twin-peaked submerged mountain called Ripple Rock and threw seven hundred thousand tonnes of rock, water, and mud approximately three hundred metres into the air. It was, at the time, the largest planned non-nuclear explosion in the history of the world. The Canadian Broadcasting Corporation carried it live. A national television audience watched a mountain leave the sea.

The context is the geography of the Inside Passage. Every commercial vessel passing between Vancouver and Alaska through the sheltered inner route, from small halibut boats to the Princess-class steamers of the Canadian Pacific coastal service, had to run Seymour Narrows — a kilometre-wide constriction in the Discovery Passage where the tide rips through at up to fifteen knots on the flood and fourteen on the ebb. In the middle of the narrows, almost dead centre in the fairway, sat Ripple Rock: a two-peaked underwater mountain whose north summit came to within about 2.7 metres of the surface at low tide and whose south summit came to within about 6.4 metres. Between the summits and around them the current tore itself into standing waves, whirlpools, and a permanent white overfall visible from shore. Captain George Vancouver had passed through in 1792 and described the narrows in his journal as "one of the vilest stretches of water in the world," which for a man whose day job included charting the North Pacific was a considered assessment.

Between the beginning of maritime records for the coast and the day of the explosion, Ripple Rock is credited with sinking or seriously damaging 119 vessels and killing 114 people. The list included the Union Steamship Cheslakee (1913, thirty lost), a US Navy destroyer, several logging tugs, a Salvation Army mission boat, and — with grim regularity for eight decades — the small halibut and salmon schooners of the coast whose captains had misjudged the slack or been caught trying to make the tide. The Royal Canadian Navy stationed a full-time signal boat at Maud Island to warn traffic when the current was running foul. The signal boat was not enough. The proposal to remove the rock had been raised in the Canadian Parliament as early as 1931 and had been argued about, in one form or another, ever since.

The engineering history of the removal is where the story becomes specifically interesting. The first two attempts were surface-based and both failed lethally. In 1943 and again in 1945, contractors under commission to the federal Department of Public Works attempted to drill into the rock from a floating barge held in position over the summits by a network of six-inch wire cables strung shore-to-shore and tensioned against the current. The current broke the cables. It broke them repeatedly. It broke them in weather that had been forecast as calm. Nine men were killed across the two attempts, most drowned when the drill barges parted their moorings and were carried down-channel into the boils below. Both attempts were abandoned. It became clear to the Public Works engineers by the late 1940s that Ripple Rock could not be worked from above. It would have to be worked from below.

The scheme that succeeded, commissioned in 1954 and executed between 1955 and 1958 by the Vancouver firm of Dolmage Mason and Associates in partnership with the mining contractor Northwest Construction, was audacious in the manner of the Anderton Boat Lift and audacious in a way that could only have been proposed in a decade with a functioning postwar mining industry and a very great deal of confidence in high explosives. From the shore of Maud Island, a vertical shaft was sunk 174 metres straight down into the granite bedrock. From the bottom of that shaft, a horizontal tunnel was driven 762 metres out under the seabed of the narrows until it lay directly beneath Ripple Rock. From the roof of the horizontal tunnel, two branching vertical shafts were driven upwards 91 metres into the interior of the mountain itself, one into each peak. From the top of each branching shaft, a lateral network of coyote chambers was mined outward and packed with the charge. The engineers, working in dry rock beneath a hundred metres of sea, were building a purpose-shaped bomb inside the target.

The charge was 1,375 tonnes of Nitramex 2H, an ammonium-nitrate–based slurry blasting agent developed for large-scale mining work in the 1950s, packaged in polyethylene bags and loaded through the shafts by conveyor over a period of eleven days. On the morning of the detonation the Canadian Coast Guard cleared the channel from Menzies Bay to Discovery Cove of every vessel; the Royal Canadian Air Force flew a spotter over the site; and the Canadian Broadcasting Corporation set up two cameras on the shore of Maud Island wired back through the mainland microwave relay to network television across the country. The countdown was carried in real time. At 9:31:02 the detonating current closed. There was, before any sound, a brief lift of the sea surface over the target — a low rounded dome perhaps forty metres high, visible for less than a second — and then a column of water and rock some three hundred metres tall, opening at the top into a mushroom that hung over the narrows for the better part of a minute before returning to the sea. The soundtrack of the CBC broadcast records the boom arriving at the camera position about seven seconds after the flash. When the water cleared, the north peak of Ripple Rock had been reduced by approximately fourteen metres and the south peak by approximately eight. Minimum clearance over the site at low tide went from 2.7 metres to somewhere around 15 metres, comfortably navigable by any vessel expected to use the passage.

The total cost of the shaft, the tunnels, the charge, and the demolition was approximately three million Canadian dollars. Since April 1958 no vessel has been lost on Ripple Rock. The bones of the mountain are still down there — the explosion did not remove it, only shortened it — and on a slack tide, in still weather, a boat with a sounder over the site can still see the twin peaks on the trace, forty metres below the keel, reduced but not gone. The demolition was watched live, per the CBC's own audience-metering figures from the following week, by something on the order of two million Canadians. In 1958 that was one Canadian in eight. It remains one of the largest planned non-nuclear detonations ever carried out on the surface of the earth, and it was carried out to remove a hazard that had killed 114 people over eight decades and had inconvenienced perhaps four decades of coastal shipping. The ratio of the effort to the purpose is not favourable. The purpose was worth it.

Primary sources:

• Dolmage, Victor. "The Removal of Ripple Rock." Bulletin of the Canadian Institute of Mining and Metallurgy, vol. 52, no. 566, June 1959, pp. 375–388. The consulting engineer's own account, delivered to the CIM in Vancouver in the winter following the explosion, with the shaft-and-drift diagram, the loading schedule for the eleven days of charging, and the seismograph traces of the detonation as recorded at four Vancouver Island stations.
• Hacking, Norman R. Ripple Rock: The Blast That Rocked a Continent. Vancouver: Mitchell Press, 1958. Contemporary journalistic account by the marine editor of the Vancouver Province, published within six months of the event. Includes verbatim transcripts of the CBC broadcast commentary by Larry Henderson and photographs from the RCAF spotter aircraft.
• Canadian Broadcasting Corporation. The Ripple Rock Explosion — Live Coast-to-Coast Broadcast. Kinescope recording, 5 April 1958. Preserved in the CBC Digital Archives, catalogue reference IDC-1958-04-05-RIPPLE. Runs approximately fifty minutes. Includes the full countdown, the detonation, the eight-second gap before the arrival of the acoustic wave at the camera, and the on-air interview with Victor Dolmage in the minutes following the blast.
• Wilson, Ron. "Ripple Rock: 40 Years Later." Western Mariner Magazine, April 1998, pp. 22–29. Fortieth-anniversary retrospective drawing on the Public Works archives at Library and Archives Canada, with the final casualty list of the 1943 and 1945 attempts and a modern sounder trace of the post-blast bottom profile.

A dev fact for the back pocket

In November 1974, in a rented office above a laundromat in Cupertino, California, four engineers who had recently left Hewlett-Packard — James G. Treybig, Michael D. Green, James A. Katzman, and Jack C. Loustaunou — began building a computer that could not be brought down by the failure of any single one of its parts. The company was Tandem Computers, Incorporated. The design principle was that every processor, every memory bus, every I/O channel, every power supply, and every disk controller in the machine had to have a functional twin somewhere else in the same cabinet, and that when a component failed — not "if," when — the twin had to pick up the exact in-flight work of the failed part without loss and without the outside world noticing. The first machine, the NonStop I, shipped in May 1976. In the fifty years since, its architectural descendants have run the majority of the world's ATM transactions, credit-card authorizations, and stock-exchange order books. If you have ever swiped a card at a gas pump, you have almost certainly, within the last five years, transited a machine descended from that laundromat.

The specific mechanism is worth walking through, because the design decision at the centre of it is one of the few genuinely load-bearing ideas in commercial computing and it is almost never taught at the undergraduate level. The Tandem NonStop I contained two processors, but they did not share memory. In the mainframe world of 1976 (and in most fault-tolerant designs proposed before Tandem) the standard scheme for redundancy was lock-step: two or more processors executed the same instruction stream on the same shared memory, and a voting circuit compared their outputs bit-for-bit on every cycle. Lock-step schemes are conceptually clean but have a catastrophic failure mode — a fault in the shared memory takes down both processors simultaneously, and a fault in the voting circuit itself has no independent check. Katzman's contribution to the Tandem design, arrived at during the four founders' initial whiteboard sessions in the summer of 1974, was to reject shared memory entirely. Each processor in a Tandem machine had its own private memory. Processors communicated only by explicit message-passing over a redundant inter-processor bus called the Dynabus. A process running on processor A could send a message to a process running on processor B, and if processor A subsequently failed, processor B could take over — because it had never depended on processor A's memory in the first place.

This gave Tandem its second design idea, which was process pairs. Every long-running application on a NonStop system ran as two copies of itself: a primary on one processor and a backup on another. The primary did the real work. At every state change — every write to disk, every message sent, every checkpoint boundary — the primary sent a message to the backup summarising its new state. The backup listened, ran the same code path against the summary, and confirmed. If the primary process (or its entire processor) died, the backup detected the missing heartbeat within milliseconds, promoted itself to primary, and continued the in-flight transaction from the last checkpointed state without dropping it. The database layer, Tandem's ENSCRIBE (later NonStop SQL), was written from the ground up to be process-pair-aware; every transaction, from the moment of its BEGIN to its COMMIT, had a checkpoint on the other side of the machine. The commercial promise Tandem could make in 1976 — and the promise the descendants of the NonStop I still make in 2026 — was that a customer's OLTP workload would survive the arbitrary failure of any single processor, any single memory board, any single bus, any single disk, or any single power supply, without loss of a transaction and without visible outage. This is what the trade press meant by "NonStop."

The economics were unusual and the marketing was more so. Treybig, who had run marketing at HP's computer division before leaving, priced the NonStop I at a level that would have looked expensive against a comparable single-processor DEC PDP-11/70 but was cheap against the mainframe redundancy schemes the customer's alternative was. The pitch was "your ATM network cannot go down." It worked on precisely the market segment Treybig had identified before founding the company: any commercial customer whose downtime cost more than the price of a Tandem, which by 1980 included every major money-centre bank in North America and most of the world's stock exchanges. The New York Stock Exchange ran on Tandem. NASDAQ ran on Tandem. The Bank of America ATM network ran on Tandem. The airline reservation systems SABRE and Apollo did not run on Tandem (they were IBM shops from the 1960s) but the credit-card authorisation network that settled the fares did. Between the shipment of the NonStop I in 1976 and the end of the decade the company grew from four people to eight hundred and from zero revenue to a hundred million dollars a year. Between 1980 and its acquisition by Compaq in 1997 for three billion dollars in stock, Tandem shipped machines to essentially every major financial-services customer in the world.

The processor lineage is where the architectural sturdiness of the original design became visible. The NonStop I used a custom 16-bit stack-based CPU designed by Katzman and his team, whose instruction set was chosen specifically for compact code and fast context switching between process pairs. The NonStop II (1981), TXP (1983), VLX (1986), and Cyclone (1989) were all custom Tandem CPUs of the same family. In 1991, with the Cyclone/R, Tandem abandoned its own silicon and moved to the MIPS R3000 and later R4400 RISC processors — a wholesale hardware architecture change. In 2005, under Hewlett-Packard's ownership, the line moved again, this time to Intel Itanium. In 2014, it moved a third time, to Intel x86-64 on the NonStop X series. Through three processor architecture transitions across four decades, the software stack — Guardian, ENSCRIBE, NonStop SQL, and the enormous body of customer OLTP application code — was carried forward substantially unchanged, because the process-pair-and-message-passing architecture was defined at a level of abstraction above the CPU. A COBOL banking application first compiled for the NonStop II in 1982 will still compile and run on a HPE NonStop X in 2026, on Intel silicon Katzman had never heard of, because the state-checkpoint-and-recover contract between primary and backup does not care what instructions the CPU is executing between checkpoints.

The specific dev-lesson is the one Katzman got right and most subsequent distributed-systems designers have had to re-derive: do not share state between the units you plan to fail independently. Every fault-tolerant design that has tried to combine shared memory with independent failure — every dual-attached-disk cluster, every dual-controller SAN with a shared cache, every "active-active" pair with a shared session store — has eventually discovered that the shared component is the failure domain, and the redundancy was theatre. The reason process pairs on Tandem worked, and continue to work, is that when processor A fails, processor B has already been living an independent life with its own memory and its own copy of the state. The failover is not "share the memory with the survivor" — it is "the survivor never depended on the memory in the first place." That is a distributed-systems axiom in modern dress. Katzman wrote it into silicon in 1974, over a laundromat, three years before the word "distributed" had settled into the sense the industry now uses it.

Primary sources:

• Katzman, James A. "A Fault-Tolerant Computing System." Proceedings of the Eleventh Hawaii International Conference on System Sciences (HICSS-11), vol. III, Honolulu, January 1978, pp. 85–102. The founding technical paper by the NonStop I's lead architect, presented eighteen months after first-customer-ship, with the Dynabus specification, the process-pair message protocol, and the failure-mode analysis Tandem had by then accumulated from the first thirty machines in the field.
• Bartlett, Joel F. "A NonStop Kernel." Proceedings of the Eighth ACM Symposium on Operating Systems Principles (SOSP), Pacific Grove, CA, December 1981, pp. 22–29. The Guardian OS internals paper by the operating-system architect, covering the primary-backup message dispatcher, the checkpoint boundary semantics, and the specific interaction between process-pair failover and the transaction manager. Widely cited in the subsequent distributed-systems literature.
• Gray, Jim. "Why Do Computers Stop and What Can Be Done About It?" Tandem Technical Report 85.7, Cupertino, CA, June 1985. The classic paper by the database researcher who joined Tandem in 1980 and later won the Turing Award. Gray's field-failure statistics from the Tandem installed base — an analysis of the causes of outage in real production systems, distinguishing hardware faults from software faults from operator error — was the first serious empirical treatment of the subject in the literature and is still cited.
• Bartlett, Wendy, and Lisa Spainhower. "Commercial Fault Tolerance: A Tale of Two Systems." IEEE Transactions on Dependable and Secure Computing, vol. 1, no. 1, January–March 2004, pp. 87–96. Comparative retrospective on the Tandem NonStop line and IBM's mainframe fault-tolerance architecture, written by senior engineers from both camps, covering the thirty years of field experience each design had by then accumulated and the specific design choices that had aged well or badly in each.

Today's goal

Write something you are about to say. Then don't say it. Read it back once, and if it was piffle, delete it. If it wasn't, decide whether the person needs to hear it or whether friend needs to have said it, and act accordingly.

The word makes a small useful distinction the language spends a lot of energy avoiding. There is talk that carries information, and there is talk that carries the fact of the speaker; the first is what the listener needs and the second is what the speaker needs to be seen doing. Piffle is the second thing wearing the clothes of the first. Most of it is harmless. A great deal of it is filler between people who like each other and don't need to be doing anything else. Some of it is not harmless — the corporate all-hands, the family text thread that has been running for eleven years about nothing, the Slack channel where the joke is louder than the work — and the specific harm is that the piffle displaces the not-piffle in the listener's attention. The person on the receiving end cannot always tell which is which in real time, and after a while learns to route both to the same low-attention channel, and then the not-piffle arrives and is not heard.

The exercise is not "say less." It is "notice what you were about to say, and check it." A sentence written down and read back once, before it is sent or spoken, will fail its own smell test one time in three. That one in three is the piffle. Cutting it costs nothing and gets the signal-to-noise back on the channel with the person you're addressing, which is a small favour to them and a larger one to yourself.

The engineering framing is the one everybody knows and few practice: the log line you didn't write is the log line you don't have to grep past at three in the morning. Every unnecessary sentence in your codebase, your commit messages, your PR descriptions, your one-on-one notes, your team channels, and your own head is a small tax on every reader who follows. Charge less tax. Say the useful thing. Trust the rest to silence.

Today's toy is the piffle press — a small nineteenth-century broadside printer, sitting on a compositor's bench in a browser tab, that produces one complete piece of period-flavour piffle every time you pull the crank. A proclamation on the proper carriage of an umbrella in a high wind. A discourse concerning the merits of the lozenge against the pastille. A late and diverting account of the cat of Dunblane. Each broadside is set in the manner of an 1840s handbill: an ornamental border, a title in the largest available face, three paragraphs of confident nonsense, and a small woodcut of something loosely relevant. You can pin the ones that come out well to the shelf, which the browser remembers for next time. It lives in the corner.

Go cut a sentence, friend.

— C