I'm not sure, if you look back at Biosphere 2 for example a large number of the failure modes were identified fairly early on. In my experience there are two things that cause unexpected failure modes, scale and duration. i.e. running something at a larger scale than was previously tested can often reveal unintuitive failure modes and running something for longer that previous can reveal failure modes. 

I get what your saying that running a service in a different environment to what it was tested in can cause unforseen issues, but I think with simulation and testing like they did for bejing airport or the kind of testing they do at SpaceX - we should be aiming to test these things to failure points. 

If I take the power plant for example, let's imagine you want to build a hardened geothermal power plant in some kind of significantly sheltered  (maybe underground) environment as part of the citadelle concept. So you want a 40mwh power plant to support @30k people in the refuge. Well in normal times - that power goes straight into the grid and earns back revenue. Yes, it's probably cheaper to build a field of solar, but not that much cheaper, Dinorwig Power Station was built in the 70's in a mountain and that's still cost effective today even though it's slightly harder to build. 
This is where the paradox of scale economics comes into play, the more you do something at scale, actually the lower it costs and the more simple it becomes. It's like using rare minerals - the more you use, the greater the demand, the more get's found in new reserves.

I do agree that you have a valid point regarding the mobile phone vs. simple radio analogy. I wonder if there's principle that could be adopted to beat this complexity problem though - what your essentially saying is the goods produced by the modern world value chain are ill suited to a disaster scenario due to their dependency on components that could be impossible to source in a different context. Maybe a principle along the lines that any goods used in the refuge must be able to be 100% fabricated in the refuge by materials available to the refuge. The Mormons have been doing something fairly similar for decades and it seems to work quite well for them.

If we look at moon & mars colonization - radiation is a large risk, earth's magnetic field means we don't need to care about solar radiation so much, but there's no reason that's permanent, Mars also used to have a magnetic field. I think there's something to be said for physical isolation, the more physical material you can put between yourself and other environments the smaller the chance that bad stuff get's through your barrier and get's to you.

Cost effective is another interesting question - if the cost of subterranean building decreases rapidly, it may be the most cost effective solution - certainly on paper it will probably cost less than space colonization as the materials are readily available along with an advanced value chain of goods and services. 

> it won't be pressure tested until the world collapses.

- so I'm saying it should not only be pressure tested but be in continuous operation in order to flush out failure modes before a catastrophic scenario plays out, it needs to be providing value way before an extinction level event plays out. 

- I agree about your point with the bio/virus with a long incubation time, I think the only way round this would be to have shifts like on an oil platform or mine, where different groups spend a period of time (say 1-3 months) working in isolation from the general population.

> I don't see how digging underground is going it make it better at water treatment, electricity generation etc than the equivalent aboveground services.

- it may not make it better but would make it more resilient, an open water treatment plant for example is going to become immediately polluted with nuclear dust if is built in standard outdoor settings, where as an isolated underground facility would be protected from that risk. A geothermal power plant may not be more efficient than a wind turbine or solar panels, but again is more resilient to hurricanes or nuclear winter.

> Fwiw my take is that offworld bases have much better longterm prospects - they're pressure tested every moment of every day;

- I agree they are better as they are pressure tested by necessity, to do this on-world we have to simulate the necessity, in my mind it's good to have 3 options, 1) Don't destroy earth's ecosystem 2) Have off-world bases 3) Have Citadelles or something similar  - They each address different needs, 1) Addresses Reliability, 2) Redundancy 3) Disaster recovery.


 

> But on the other hand, it sounds expensive to build a whole city (and would you or I really want to uproot our lives and move to a random tiny town in the middle of nowhere just to help be the backup plan in case of nuclear war?)

- I agree, it seems the obvious solution would be to build the citadelle on existing infrastructure and an existing town so no one need to move to the middle of nowhere. A sensible approach might be to pick towns with one existing relatively well established educational facility, and then start progressively constructing services underground to replace aging infrastructure above ground of the town like water recycling, power generation, food production, slowly making the town infrastructure more resilient and incrementally adding the extra capabiliites in as it becomes prudent.

 > even most nuclear wars probably wouldn't result in the comically barren and devastated world of the Fallout videogames

- That's probably true, but as I understand it even a nuclear war between India and Pakistan would cause a nuclear winter large enough to cause a famine that would kill 1/3rd of the worlds population - in which case underground vertical farming - would be pretty helpful...