J Larouzée

F Guarnieri

From theory to practice: itinerary of Reasons' Swiss Cheese Model

From theory to practice: itinerary of Reasons' Swiss Cheese Model

Justin Larouzée, Franck

INTRODUCTION

Since the early 1990, the Swiss cheese Model (SCM) of the psychologist James Reason has established itself as a reference model in the etiology, investigation or prevention of industrial accidents. Its success in many areas (see table 1) has made it the vector of a new paradigm of Safety Science: the organizational accident.

Table 1. Non exhaustive list of sectors applying Reason's work (Larouzée et al., 2014). articles, books and book chapters, conferences and industrial reports. It has been completed by the interview of Professor James Reason in January 2014 and John Wreathall in October 2014. Thanks to the use of both published work and interviews to study the history and genesis of the SCM, we tried to keep from retrospective bias (that tends to smooth and simplify facts). The section 2 of the paper is dedicated to the history of the SCM. First, we briefly present James Reason's academic background through his main topics of interest (2.1) and John Wreathall (2.2). Second, we focus on the social and historical context in which the two fathers of the SCM met and were able to collaborate (2.3). In the section 3, we focus more specifically on the shift of Reason from theoretical to applied work on human error. This change is argued to be due to collaboration between the psychologist and the nuclear world (3.1). Becoming familiar with the industry and collaborating with Wreathall gave Reason the opportunity to attach his theory to an empirical and functional view of organizations (3.2). Reason's work also benefits of the defense-in-depth theory inherited from nuclear safety (3.3). The section 3 finally considers the effects of a long lasting collaboration between the psychologist and the engineer that gave the model opportunity to evolve (3.4).

Sector

HISTORY OF A MODEL

This section presents the two fathers of the SCM. Reason a psychologist of human error and Wreathall a nuclear engineer. After presenting their backgrounds (subsection 1 and 2), we present the social and industrial context in which they were brought to meet and work to create the first version of the SCM (subsection 3).

James Reason, psychologist

Reason gets a degree in psychology at Manchester University in 1962. He then works on aircraft cockpit ergonomics for the (UK) Royal Air Force and the US Navy before defending a thesis on motion sickness at Leicester University in 1967. Until 1976, he works on sensory disorientation and motion sickness. In 1977 he becomes professor of psychology at Manchester University. In 1977, Reason makes a little action slip that will impact his scientific career. While preparing tea, he began to feed his cat (screaming with hunger). The psychologist confused the bowl and teapot. This was of great interest to him and he started a daily errors diary. With applied cognitive psychology methodologies, he began his research on human error. Reason defines human error as "a generic term to encompass all those occasions in which a planned sequence of mental or physical activities fails to achieve its intended outcome, and when these failures cannot be attributed to the intervention of some chance agency" [START_REF] Reason | Human error[END_REF], p.9) from there, he differentiates between the miss-application of a well planned action (slips and lapses) and the good application of a missplanned action (mistakes). After ten years working on the topic of everyday errors, Reason ended with a taxonomy of unsafe acts (1987).

After he became a referent on the issue, he has been a keynote speaker in various international conferences on human error. During these conferences, he met John Wreathall, nuclear engineer, with whom Reason built working relationship and "strong intellectual communion" (in his words). On their collaboration will be drawn the first version of the SCM. After publishing the first version of the model in the book Human Error [START_REF] Reason | Human error[END_REF]), Reason kept working on human and organizational factors in practical ways, applied to many industrial fields, for the next ten years. In 2000, he started working on human error prevention in the British healthcare system. In 2003 thanks to the efficiency of his work, he was appointed Commander of the British Empire.

Most of the users of the SCM including the safety science researchers do only know the post-SCM James Reason. This very short biography (see Larouzée et al., 2014 for an extended one) shows his trajectory from laboratory experiments on motion sickness to a comprehensive and innovative view on organizational accidents (table 2). His interest in the human factor brought him to several leading functions where he worked on human factor. Most of his works also were funded by the nuclear industries in the USA, Japan, Sweden, the UK and Taiwan, and by the US Nuclear Regulatory Commission.

Meeting and collaboration, a particular context

Industrial and research community's interest for human factors is nothing new in the mid-1980s. By the 1960s, development of the nuclear industry and modernization of air transport stimulates many research programs (e.g. Swain, 1963;Newell, Simon, 1972;[START_REF] Rasmussen | Skills, rules, and knowledge; signals, signs, and symbols, and other distinctions in human performance models[END_REF]; quoted by [START_REF] Reason | Human error[END_REF]. Researches then were mostly conducted under the 'human error' paradigm. The 1980s were marked by a series of industrial accidents (Three Mile Island, 1979;Bhopal, 1984, Chernobyl andChallenger, 1986; Herald of Free Enterprise and King's Cross Station 1987; Piper Alpha, 1988). Investigations following these accidents brought the Safety community to question the understanding of accidents solely based on operator error. In this scientific, industrial and social context, NATO and the World Bank funded many multidisciplinary workshops on accidents. The first one was held in Bellagio, Italy, 1981. It received the name of "first human error clambake". At Bellagio's Clambake, Reason and Wreathall met. This fortuitous meeting led them to become (in Wreathall words) "social friends". Indeed, according to Wreathall, "intellectual communion was quick with Reason but also with other researchers in vogue on the issues of human error at the time. Swain, Moray, Norman". Reason and Wreathall started corresponding and met at different conferences during the 1980s. Both took commercial projects for industrial groups such as British Airways and US NRC in which they employed each other as professional colleagues. At that time Reason was ending his taxonomy of unsafe acts. He started writing a book on human error aimed to his cognitive psychologist peers. The Safety Culture Decade context and choice of reducing first chapter's size brought him into writing a chapter on industrial accidents. Therefore, he intended his book to both the research and the industrial world (he progressively became familiar with thanks to his Wreathall & Co's joint missions as well as others). To communicate his new vision of organizational accidents, Reason called on his friend Wreathall to help to design a simple but effective model that would be included in the 7th chapter of Human Error. This model was to become, ten years later, the famous SCM.

The second section has presented the two SCM's fathers, their backgrounds and the context in which they were brought to meet. This section focuses on their collaboration from 1987 (when the writing of Human Error begun) to 2000 (publication of the latest SCM version). We first look back at the discovery and exploitation by Reason of the nuclear field (3.1). We then explicit the shift that the psychologist made from fundamental to applied research (3.2). The next part of the section is devoted to the percolation of defense in depth into the SCM (3.3). Finally, we look at the developments which led the Wreathall and Reason's early accident model, to become, in 2000 the famous and widely used SCM (4.4).

Meeting the nuclear world

In the late 1970s Reason is still far from the nuclear power plant (NPP) control rooms. Yet this industrial field will be one of the most influential for his work. In 1979, the TMI incident operates an awareness of the influence of local workplace conditions on the operator's performance. If Charles Perrow sees in TMI the advent of a normal accident, Reason finds the first level of his taxonomy: distinction between active and latent errors 1 . In 1985, Reason and Embrey publishes an article dedicated to human factors in abnormal conditions of NPPs [START_REF] Reason | Principles Human factors relating to the modeling of human errors in abnormal condition of nuclear power plants and major hazardous installations[END_REF]. One year later, the Chernobyl disaster provides an unfortunate case study. Reason introduces a new distinction between errors and violations in his taxonomy. In 1987, he publishes an article in British Psychological Society bulletin devoted to Chernobyl errors' study from a theoretical perspective. In 1988, he publishes modeling the basic tendencies of human operator error, thus introducing an error model which allows modeling the human behaviour of problem solving (the Generic Error Modeling System, GEMS). Reason's cognitive models were then based on observations in NPPs control rooms as case study of human behavior.

The development of distinction between accidents theories based on active or latent errors and violations, is strongly linked to the development of nuclear energy and its safety culture. From 1979 to 1988, Reason uses accident investigations and gets used to the field and its culture. For all that, his productions remains designed to his peers. A turning point is met when the observation process becomes a collaborative one and that Reason's psychologist work mingles with the engineering one of Wreathall.

From theory to practice

1987 represents a break in Reason's work (Larouzée et al., 2014). After studying everyday errors for ten years, Reason holds a major contribution to his discipline with the taxonomy of unsafe acts (Reason, 1990, p. 207). He publishes the Generic Error Modelling System [START_REF] Reason | Generic error-modelling system (GEMS): A cognitive framework for locating common human error forms[END_REF]; Fig. 1), a combination of his classification with the Skill, Rule, Knowledge (SRK) model of Danish psychologist [START_REF] Rasmussen | Skills, rules, and knowledge; signals, signs, and symbols, and other distinctions in human performance models[END_REF]. It presents the types of human failures linked with the specificities of a given activity. This theoretical cognitive model still belongs to the field of psychological research (model quoted 192 times).

The same year, Reason works on a chapter of Human Error dedicated to industrial accidents and designed for security practitioners. He has the backing of his friend Wreathall. Reason says he looked for a manner of "showing people what our work was about". Wreathall talks in these terms of the genesis of the first model "during an exchange in a pub the Ram's Head in Reason's home town (Disley Cheshire, England), we have drawn the very first SCM on paper napkin. Initially, James saw the organizational accident as a series of "sash" windows opening or closing thus creating accident opportunity". Wreathall literally allowed the psychologist combining his accident theory (resident pathogens metaphor; [START_REF] Reason | Resident pathogens and risk management[END_REF] and his error taxonomy with a pragmatic model of any productive system.

The defense in depth contributions

The engineer's contribution goes beyond the pragmatic modeling of a productive system. Wreathall's training and experiences with the British submarines nuclear reactor and CEGB NPPs safety gave him specific defense in depth 2 thinking. When he designed the first SCM, Wreathall chose a representation of superimposed plates. These plates evokes defense in depth's levels of protection. Reason then explains each plate's failure using his taxonomy and understanding of organizational accidents. The Swiss cheese nickname and representation is late. Still it's rooted in the first graphical choice. Wreathall's contribution overtakes engineering understanding of a system: it carries the defense in depth thinking. Defense in depth is clearly mentioned in an early SCM version (Reason, 1990, p.208; Fig. 3) 3 . It incorporates an accidental trajectory of accident opportunity which provides information on respective contributions of the psychologist and the engineer. On the left hand side, the white plates represent the organizational (managerial level) and human failures (unsafe acts): contribution of the psychologist. On the right hand side, gray plates represent defense in depth as a block (set of defenses ensuring the system's integrity): it's the engineer contribution.

Human variability may confuse the engineers (this partly explains the historical human error understanding of accidents). On the other hand, technical and organizational sides of safety often confuse academic researchers. In the SCM case, the collaboration of two disciplines (engineering science and psychology) has the effect of two eyes in binocular vision: close an eye and you lose the perception of reliefs. Collaboration gave to Reason and Wreathall insights on the complex interactions between humans and technology and therefore, emergent properties of system's security. In a way, Reason's work as a whole proposes an early systemic vision of the accident, considering retroaction (feedback loops) and interactive effects.

The SCM is sometimes considered as a linear causal model (surprisingly often by researchers who come out with their own non-linear, non-causal models). Reviewing the published critics of the SCM, we haven't find so far arguments based on something that would not be the simple, empirical, representation of the organizational accident theory (Fig 4 .). If there are differences in graphical complexity between theoretical and empirical models that are to be noted the epistemological posture of a theory cannot be determinate only on its graphic representation. 2 Early 1960, the military defense in depth concept is introduced into the US nuclear safety policies. It concerns the hardware and construction design (fuel and reactor independent physical barriers containment). The TMI incident extends it to human and organizational dimensions. In 1988, an International Atomic Energy Agency working group publishes an issue entitled Defense in depth in nuclear safety (INSAG, 1988) which establishes defense in depth as a doctrine of nuclear safety. Doctrine based on three concepts: barriers (implementation of physical protection systems), defensive lines (structural resources and organizational security), and levels of protection (arrangement of barriers and defensive lines according to structured objective regarding the potential event's gravity). 3 If the original version labels defense in depth (Fig. 2.), the 1993 French translation (by an academic) changes the label for « défenses en série » (literally serial defenses). Loss of sense due to field sensitivities' manifestation.

A long term collaboration

Reason and Wreathall kept working together and using the SCM within Wreathall & Co's reports. A little after 1993 Wreathall suggests replacing "latent error" (referring to organizational failures) by "latent failures" that later became "latent conditions". These changes acknowledge the fact that efficient decision at a given time may have negative outcomes another time or place in the system. Such decisions may not be wrongthey are just made under uncertainty -and thus may not be qualified a priori as errors but can still turn out to have adverse consequences in any other place or time. In addition to these semantic changes, SCM graphically evolves (over 4 times in the 1990s). Its use reached many sectors such as energy or transportation (Larouzée et al., 2014). During 1990s, Rob Lee, director of the Australian Bureau of Air Safety Investigation, suggested representing gaped barriers as Swiss cheese slices [START_REF] Reason | Revisiting the "Swiss Cheese" Model of accidents[END_REF]. The idea attracted Reason, then working on a new SCM version for the British Medical Journal [START_REF] Reason | Human error: models and management[END_REF]Fig 4). This was a landmark article (quoted 3442 times) and in 2003 Reason was appointed Commander of the British Empire for his work on patient safety. The SCM was born. Its simplicity and empirical pragmatism made it the vector of a new paradigm of Safety: the organizational accident. . SCM version where the cheese slices represent a system's defenses [START_REF] Reason | Human error: models and management[END_REF].

CONCLUSIONS

A detailed study of the SCM is both simple and complex. Simplicity comes from the abundance of sources. This model has been widely quoted and Reason is a prolific author (135 publications; Larouzée & Guarnieri, 2015). Thus, it is possible to trace the evolutions of the model and to harvest insights on the motivations of the changes. Once the right publications selected and compared, one can observe and follow the evolutions in the thought of the authors. By devoting attention to the prefaces and bibliographic references used, it is also possible to create a mapping of collaborators and networks of influences on the SCM. Finally, Reason and Wreathall played relatively distinct roles (one dedicated to academic publications of the SCM evolution, the other to its industrial applications). This duality prevents the theoretical reflections from being covered by confidentiality that often falls on industrial reports. On the other hand, complexity arises from the nature of the model's origin: a collaborative and poorly documented work between distinct but interactive worlds, research and industry. Meeting the two fathers of the SCM was, in this regard, a great help. If it helps preventing from retroactive bias regarding the overall study, it also provides the opportunity to access new perspectives on their respective roles; new elements that can help to understand the success factors of their collaboration. Indeed, based on the fact that the SCM has been (for at least 15 years) at the industrial agendas, this study wondered [START_REF] Larouzee | Le modèle de l'erreur humaine de James Reason[END_REF] why is this model more than any others used in the industrial community at large and (2) is this model, conceptualized in the 1980s, still able to explain the accidents in 2015?

A tempting explanation of the SCM's success is its simple graphical representation. If it is undeniable that Swiss cheese representation has played a role in the socialization process of Reason's work, it actually seems it has mostly caused theoretical and methodological pitfalls (Larouzée & Guarnieri, 2014). A second hypothesis was that success of the model was the result of the appropriation of research findings by industry. It emerges that it is more the appropriation of industrial experience by the academics and long term collaboration that gave the SCM its empirical pragmatism, likely to encourage its use and spread. Working with the nuclear industry, James Reason became familiar with the engineer's world. Faced with irreducible epistemological and ontological duality, the psychologist found the help of an engineer to coproduce the first model. Their meeting was helped by a favorable social and industrial context (Safety Culture decade and human error clambakes), their collaboration stood thanks to a mutual will of convergence. Let us note the importance of backgrounds and early life experiences that led Reason working in aviation community and Wreathall meeting systemic thoughts and human factors early in his studies. This shared background guaranteed sensitivity and brought a common language to the two: a collaboration prerequisite. Finally, more than causing their meeting, the social demand at that time (industry funding many research programs) allowed the evolutions of the model. Through various research programs the SCM was used and shaped to ensure its pragmatic rationality: that's how it became, along the 1990s, the vector of a paradigm shift in the safety science and industrial community.

This leaves us with one last question: is this theory (hardly changed since 2000), still able to explain today's accidents? The question is complex and maybe takes both a "no" and a "yes". Technologies have changed. Computers and technology at large is getting more and more involved in operating and even maintaining systems and some process are only ran by computers. Somehow, without having to call the SCM "linear" (which it isn't), one could consider it obsolete for highly automated systems. "No", the SCM doesn't explain how highly automated systems fail, to have a precise understanding of this kind of failure, one should turn to control based models such as STAMP [START_REF] Leveson | Engineering a safer world: Systems thinking applied to safety[END_REF]. On the other hand, humans haven't changed in a significant way in fifteen years. There are still pilots in airplanes cockpits, boats and train; there are still IT engineers designing machines; there are still top managers allocating budgets amongst departments; there are still operators in NPP rooms and surgeons in hospitals. Then "Yes", a simple and effective mean to understand what went wrong; to communicate about risks or to prevent adverse events may still be useful. Finally, let us remind that the SCM is nothing but a theoretical model. Tools have been made based on this theory (TRIPOD-B, TRIPOD-D, HFACS; see Larouzée et al., 2014), the tools may need to be redesigned to match the evolution of our technologies: it doesn't mean the theory is obsolete. Accident still occurs because of the unwanted combination of technological failures (at some time and some degree), human failures (even if we should acknowledge here the heroic ability of humans to take control over a failed technical system; [START_REF] Reason | The human contribution[END_REF] and organizational failures. As long as the society as a whole (politics, economics, Scientifics, engineers and so on) will keep buying news papers titling "Investigators follow the lead of HUMAN ERROR" the SCM will somehow have a contemporary interest.

DISCUSSION

Could similar collaboration between different researchers or disciplines bring the safety research further steps forward?

The Safety Science community seems to be in conceptual tension. The "active errors / latent conditions" paradigm on which is based today's accident prevention and analysis practices is challenged by the formulation of new theories (control, resonance, resilience, safety II ...). According to Kuhn's framework (1962), the safety science community, thus, goes through a period of scientific revolution. According to literature's reviews (e.g. Hollnagel & Speziali, 2008;[START_REF] Toft | Models of causation: safety[END_REF] one can highlight two perspectives when it comes to further development of theories and models accidents. To answer our discussion's question, we'll first try to characterize them and reflect on their respective implications.

First their shared statements should be exposed. ( 1) Accidents still happen, some are even recurring. (2) Theories and models available to professionals (therefore) haven't achieved the (theoretical) goal of accidents elimination or consequences reduction (the later would even tend to increase). ( 3) There is no model or specific method that can claim to be "the best" in all conditions. From that statements, two different research perspective seems to emerge.

A first logic is to assert that investigation methods (or models) do not represent the reality (complexity) of socio-technical systems "Accident investigation methods [...] typically lag behind the socio-technological developments by 20 years or more." (Hollnagel & Speziali, 2012). Assuming that the nature of accidents depends on the nature of socio-technical systems (which remain to be demonstrated), this logic has assumed that the obsolescence of methods is related to the changing nature of socio-technical systems and therefore accidents: "we must expect that the methods developed today will [be] partly obsolete, not because the methods change but because the nature of socio-technical systems, and therefore the nature of accidents, do." (Ibid.). This view follows Charles Perrow's Normal Accident Theory, popularized in his 1884 book. I will group researchers using this logic under the label of "socio-technical gap school" (SG School). On the opposite, another logic argues that despite an increase in organizational and technical complexity, the nature of front-line operators' activities has not fundamentally changed (Hovden et al., 2010). Moreover, as acknowledged by Hollnagel & Speziali (2008) "in terms of frequency or numbers, most systems are loosely coupled and [simple to describe] even today" (p. 25). Thus, the evolution of accident models (from simple linear to complex and non-linear) is to be linked to the natural process of successive approximations used, over years, in accident modelling. Approximations being increasingly thin, models are being more complex (independently of systems evolutions). I will group researchers using this logic under the label of "conceptual gap school" (CG School).

The theories of these schools are incompatible and incomparable. Incomparable because there is disagreement among researchers about the issues to consider, possible solutions and definitions (which does not exclude conceptual or practical borrowings but for different uses). Working in different worlds, researchers see "different things when they look in the same direction from the same point" [START_REF] Willett | Paradigme, théorie, modèle, schéma: qu'est-ce donc? Communication et organisation[END_REF]. Thus the SG school is working on the production of models that would explain a new world and will consider fashionable theories (including the SCM) as unable to grasp contemporary reality. The CG school's community works on the production of models that would continue to improve the understanding of a permanent phenomenon (accidents) and claim that SG school's productions are futile because too complex or, too far from the practices of safety professionals (including data collection and analysis; Roelen, Lin & Hale, 2011).

The ST school must be recognized that the effectiveness of dominant models can be questioned as accidents continue to happen. On the other hand, the CG school must be recognized that "new" and "efficient" are a non-correlated variable. Comprehensive studies show that systemic accident analysis models and methods are considered to be time-consuming and hard to understand by practitioners (e.g. [START_REF] Underwood | Systemic accident analysis: Examining the gap between research and practice[END_REF]. This may partly explains that the SCM is still widely accepted and used in many industries, 25 years after its formulation. Moreover one should note that there is no neutral corpus of observations that would help choosing between two paradigms (hence the incommensurability and incompatibility of these). It is also necessary to keep in mind that the formulation of theories is a process adapted to the restrictive conditions of its production context (although this process can be systematic and controlled). De facto, theories are always partial, they emphasize a part of reality and therefore ignore everything else. "A theory is not reality nor mean to reveal the truth [but] creates a reality that allows to design, perceive, understand and explain an aspect of the real in a logical and formal way. It is more fruitful to ask whether a theory is helpful rather than wondering whether it is true" (Willett, op. cit.).

The recognition of the partial nature of a theory, of the complexity of accidents, the epistemological4 weaknesses on which a "safety sciences" scientific community tries to build itself, lead us to positively answer the discussion question. Yes, similar collaboration (as we have characterized it, namely, (1) between engineering sciences and human sciences, (2) research and industry and (3) inscribed in duration) could bring the safety research further steps forward. More than an opportunity, such collaborations today seem a necessity in safety science research.

The accident is a phenomenon whose complexity involves convergence and collaborative approach. Failing in this collaborative effort might aggravate a damaging opposition between engineering and human sciences. Indeed, a paradigm is rarely questioned by experts who are followers. Nevertheless, "some models, or a series of models, can perpetuate and conceal errors or fundamental inaccuracies, delaying the development of knowledge. Only by confronting these models with systematic observations and competing models can we get to detect these errors" (Willett, op. Cit.). A theoretical rivalry that would seek to enforce "new models" over "old" one would be a waste of time in the development of knowledge for the prevention of accidents and live saving. A "double collaboration" between disciplines (to fill the partial nature of theories) and between research and industry (to confront models to reality and needs) seems to be able to serve this ethical and moral purpose.

This type of collaboration between disciplines and activities has been illustrated through the design and evolution of Reason's theory and SCM. It remains to refine our understanding of its success factors through the search and study of sufficient similar cases in order to ensure the development of such collaborations in the safety sciences.

Figure 1 .

 1 Figure 1. Reason's taxonomy backed at the cognitive SRK model of Jens Rasmussen produces a theoretical cognitive model.

Figure 2 .

 2 Figure 2. Reason's taxonomy backed at the productive system model, drawn by Wreathall, produces an effective descriptive and empirical model.

Figure 3 .

 3 Figure 3. This version of Reason's accident causation model (published in HumanError, 1990) explicitly introduced the "defense in depth" concept as a label.

Figure 4

 4 Figure 4. SCM version where the cheese slices represent a system's defenses[START_REF] Reason | Human error: models and management[END_REF].

Table 2 .

 2 James Reason's main research topics. Systems Practice" based on Pete Checkland's models of systems. This option brings the young engineer to human factors and systems thinking. From 1972 to 1974 he works on the British nuclear submarine design which allows him to access confidential reports on HRA by Swain. From 1976 to 1981, Wreathall works for the CEGB (English Electric Company), first as design reviewer for control systems then as an engineer on human factors in nuclear safety. As an acknowledged expert he was brought to participate in conferences organized by NATO and the World Bank called Human Error (book "Human Error" by Senders & Moray is the only published product from the 1981 conference of the same name). After meeting Reason there, they both started professional collaborations on accident prevention models (including SCM).

	Topic	Period	Main publication
	Motion Sickness	1967-1981	Motion Sickness (1975)
	and disorientation
	Everyday errors,	1977-1987	Absent-Minded? (1982)
	inattention
	Error taxonomy	1987-1990	Human Error (1990)
	Organizational	1990-2000	Managing the risk of
	accidents, Safety		organizational accidents
	culture,		(1997)
	Violations
	Applied work for	2000-2013	Human error : model
	healthcare system		and management (2000)
	2.2 John Wreathall, the engineer
	John Wreathall studies nuclear engineering at London University, undergraduate in 1969; he gets a
	masters' degree in systems engineering in 1971. Later he studies an Open University course "Systems
	Thinking,

Where active errors, often committed by the front-line operators, have almost immediate effects and latent errors, committed by actors whose activities are removed in time and space form the direct control interface, have adverse consequences likely to remain dormant within the system for a long time (only becoming evident when they combine with other factors to breach the system's defenses). (See[START_REF] Reason | Human error[END_REF]; p. 173).

Fundamental questions have probably not been detailed enough claiming a necessary "pragmatic empiricism". If conceptualization is nothing but a prerequisite to action and cannot be a finality in itself, overcoming it is risky. The formulation of a theory involves the statement of a chain of interrelated proposals from deductions and using the intuitive logic. These proposals are then used to formulate testable hypotheses using the "scientific method" (strict measures whose results are a source of prediction or generate new observations or assumptions). But theories are based on concepts and explanations. Concepts must be clear, accurate, and unequivocal. This does not seem to be the case for "concepts" such as accidents, safety, or even complexity.

ACKNOWLEDGMENTS

The authors would like to warmly thank Professor James Reason for his hospitality, January the 7 th , 2014, and to Mr. John Wreathall for coming and meeting us at MINES ParisTech Centre of Research on Risk and Crisis, October the 10 th , 2014. Thank you to the anonym reviewers for their useful advices and the suggested discussion topic.


Aissame Afrouss

Franck Aurélien Portelli

come     What can we learn about "engineering thinking in extreme situations" from the testimony by the Fukushima Dai Ichi plant manager?

INTRODUCTION

The nuclear accident at Fukushima Dai Ichi is considered to be one of the most important in history, together with those at Three Mile Island and Chernobyl. However, institutional investigations of the accident do not capture the complexity of the situation that the plant's operators faced. To remedy this, the concept of engineering thinking in emergency situations had been developed [START_REF] Guarnieri | Engineering thinking in emergency situations: A new nuclear safety concept[END_REF]; the concept will be defined later.

Following the accident, the plant's director Masao Yoshida testified to the Japanese government's Investigation Committee. The transcript of the hearing was released to the public. The hearings of 22 and 29 July 2011, has been available in French since March 2015 [START_REF] Guarnieri | L'accident de Fukushima Dai Ichi : le récit du directeur de la centrale[END_REF]. The following hearings will form volumes 2 and 3. The fourth volume will be devoted to the analysis of the corpus.

The director's testimony not only allows us to fill in the gaps in institutional reports, but also to gain a better understanding of the factors influencing decision-making and action in extreme situations.

This article demonstrates the value of Yoshida's testimony in thinking about engineering thinking in emergency situations. The first section analyses how the Fukushima Dai Ichi accident was presented in the principal investigation reports. The second section highlights the similarities between Yoshida's testimony and the narrative form of the story. Finally, the third section is a detailed examination of his testimony, and shows the usefulness of the contribu-tion to the development of engineering in extreme situations.

ACCIDENT INVESTIGATION REPORTS

This first section outlines the four institutional reports selected for this study, and the organizations that prepared them. The content of these reports is briefly summarized and analysed in terms of their representation of the accident.

Institutional reports

After the Fukushima accident, many institutions analysed the causes of the accident in order to draw out the main lessons and improve the safety of nuclear installations. Here we examine the reports of: the Investigation Committee on the Accident at the Fukushima Nuclear Power Stations, appointed by the Japanese government (ICANPS, 2012); the Independent Investigation Commission of the Japanese Diet (NAIIC, 2012); the Nuclear Energy Agency (NEA, 2013); and the United States National Academy of Sciences (NAS, 2014). These documents come from four agencies: two are Japanese, one is international and one is American, and they have different goals, draw different conclusions and propose different recommendations.

The Investigation Committee on the Accident at the Fukushima Nuclear Power Stations (ICANPS) was created following a decision of the Japanese government on 24 May, 2011. Yotaro Hatamura, What can we learn about "engineering thinking in extreme situations" from the testimony by the Fukushima Dai Ichi plant manager?

A. Afrouss 1 , A. Portelli 1&2 , F. Guarnieri 1 1 CRC -MINES ParisTech, Sophia Antipolis, France 2 ESAIP, Grasse, France ABSTRACT: The concept of engineering thinking in emergency situations addresses an epistemological gap in the field of safety sciences, following the accident at Fukushima Dai Ichi. Institutional bodies have not grasped the need to study the conditions in which the plant's teams had to work to maintain the integrity of the facilities. However, an understanding of the situation as it unfolded is crucial to understanding the decisions taken by the actors during the crisis. It is clear that the description of the accident and its representation, as it is presented in reports prepared by various official agencies fails in this respect. The testimony of Masao Yoshida, director of the plant, helps to fill in some gaps. Transcripts of his testimony provide detailed information that is key to understanding the sequence of events triggered by the earthquake and tsunami of 11 March, 2011. This article shows the importance of the study of his testimony and highlights the relationship between the management of the nuclear accident and the concept of engineering thinking in emergency situations.

Professor Emeritus of the University of Tokyo, chaired the ten-member committee. The other members were researchers and judges, assisted by eight technical and policy experts. The purpose of the Committee was to make recommendations to prevent the spread of the damage caused by the accident and the recurrence of similar accidents. Therefore, the investigation sought to identify the causes of the accident and the damage that it created. Its members were given the responsibility of conducting a thorough investigation that would produce satisfactory answers to all questions related to the accident, which would be valid for at least a century. The Committee undertook tours of the nuclear power plants at Fukushima Dai Ichi and Dai Ni, held hearings with the directors of local government authorities and others involved in the management of the accident. An interim report was published on 26 December 2011. The final report was presented to the Prime Minister on 23 July, 2012. The Committee was dissolved by order of the Prime Minister's Office on 28 September, 2012.

The Nuclear Accident Independent Investigation Commission (NAIIC) was set up by the Japanese Diet, under Article 10 of the law enacted on 30 October, 2011. On 8 December, 2011, the ten members of the Commission were appointed by the President of the Diet. It was headed by Kiyoshi Kurokawa, a doctor and former president of the Scientific Council of Japan. The Commission's nine other members consisted of scientists, lawyers and political actors. The NAIIC investigation analysed the causes of the accident and the damage it produced. It also looked at the reaction of stakeholders and the effectiveness of their management of the emergency. Finally, it proposed measures that could be applied in order to prevent another nuclear accident in Japan or limit its consequences. Both chambers of the Japanese Parliament insisted on the need to conduct this expert investigation, from both a theoretical and scientific viewpoint. It was tasked with producing recommendations to strengthen the legislative framework in Japan and benefit the nation in the future. Moreover, their recommendations were required to be formulated so that the whole world might benefit, and would therefore help to prevent another nuclear accident. Members of the Committee visited the five plants affected by the tsunami and interviewed more than a thousand people. Public meetings were held with residents who had been evacuated and workers at the plant. The results of the investigation were made public in a report published in September 2012.

One of the missions of the Nuclear Energy Agency (NEA) is to strengthen the legislative, scientific and technological foundations of nuclear safety within the Organisation for Economic Cooperation and Development (OECD). The report prepared by the Committee on Regulatory Nuclear Activities (CRNA), the Committee on the Safety of Nuclear Installations (CSNI) and the Committee on Radiation Protection and Public Health (CRPPH) was published in September 2013. Written under the leadership of Director General Luis Echávarri, this document enumerates the efforts of OECD member states to improve the management of safety in the wake of the accident, and offers some recommendations based on the key lessons learned. The report expresses the desire of the NEA to regularly to revise nuclear safety standards and to circulate the lessons learned to its members.

The United States National Academy of Sciences (NAS) finally published a report commissioned by the United States Nuclear Regulatory Commission in July 2014. The study was conducted by a committee of scientists and engineers with various skills. The committee, composed of twenty-one experts, was placed under the direction of Dr Norman P. Neureiter. Thirty-nine meetings were held in order to collect and exchange information. Visits to Japanese plants -including Fukushima Dai Ichi -and American plants with the same design took place. The purpose of the report was to summarize the various causes of the nuclear accident at Fukushima Dai Ichi, with a particular focus on the response of the operator. It also proposed recommendations to improve the safety of United States' nuclear facilities, from an operational and regulatory point of view.

The representation of the accident in official reports

An examination of the recommendations put forward in these reports shows the vulnerabilities that were identified by investigators and helps us to understand their representation of the accident. In this article, the concept of the representation refers to the mental map of subjects, related to the causal, proximal and influential relations "that an individual (or by extension a group of individuals) sees as a problem or a problematic issue" [START_REF] Chaxel | Les récits de vie : outils pour la compréhension et catalyseurs pour l'action, ¿Interrogations?[END_REF].

According to these four reports, the accident at Fukushima Dai Ichi highlights a lack of preparation on the part of the operator (TEPCO), and Japanese institutions in dealing with such an event. They state that TEPCO staff lacked adequate training and appropriate skills to respond to emergencies, and go on to say that communication between workers and decision-makers, as well as poor coordination between the various emergency response centres made it difficult to react effectively to the accident.

They also suggest that the accident was due to a failure to take into account global, state-of-the-art advances and new safety approaches, notably the defence-in-depth concept. They claim that TEPCO and Japanese institutions had not taken the steps necessary to bring the safety of their facilities up to international standards. Consequently, they emphasize the need to strengthen defence-in-depth measures and examine the possibility of beyond design-basis accidents or simultaneous accidents at multiple sites.

Another recommendation concerns the independence of the Japanese Nuclear and Industrial Safety Agency (NISA). Although this agency knew about TEPCO's safety weaknesses, it did not seek to rectify the situation. The skills, commitment and transparency of NISA were thus called into question, and the reform of the monitoring and regulatory system for Japanese nuclear facilities was identified as another key point to be addressed.

These accident analyses offer no innovative sights in nuclear safety. They focus on the need to strengthen the application of known concepts and to set higher safety margins to prevent further accidents. They advocate new standards and encourage the inclusion of overwhelming, multiple accidents. For the bodies concerned, the transparency and independence of the nuclear regulator, and the promotion of safety culture by the operator, are fundamental to ensuring safety at installations. The management of a major accident is therefore only represented in terms of the existing organisation and resources.

However, in such an accident, operators are faced with a scenario that goes far beyond anything previously considered. The lack of electricity and the worsening of the situation at Fukushima highlight the need to adapt to new and unforeseen conditions. Furthermore, the earthquake and tsunami damaged the country's infrastructure, hampering the delivery of both human and material resources to the plant.

To better understand what has to be done in such conditions, the concept of engineering thinking in emergency situations has been defined as "engineering activities that are significantly impeded due to a lack of resources in the face of a societal emergency" [START_REF] Guarnieri | Engineering thinking in emergency situations: A new nuclear safety concept[END_REF]. Engineering thinking in emergency situations denotes engineering activities that are hampered by emergency conditions. Engineering takes places in a state of pronounced uncertainty, where this is a lack of human and material resources and high societal expectations.

Engineers must therefore adapt to the context and seek innovative solutions in order to overcome the lack of appropriate and available resources. Here, the organization corresponds to "a structure that results from a decision and takes the minimal form of a hierarchy, rules, a group ('members'), and supervisory and sanction instruments that are applicable to a specific activity with a particular goal" [START_REF] Guarnieri | Engineering thinking in emergency situations: A new nuclear safety concept[END_REF].

In contrast to the official reports, Yoshida's testimony provides another perspective on the accident. It clarifies points that were not fully addressed and demonstrates engineering thinking in emergency situations in action at Fukushima Dai Ichi in the aftermath of the earthquake and tsunami. In his account, the director explains his decisions and the actions that were carried out in an attempt to maintain the integrity of the reactors and limit damage to the facilities. He also reminds us of the difficult conditions in which these actions had to be undertaken.

MASAO YOSHIDA'S TESTIMONY

This section looks at the hearings where Masao Yoshida gave his testimony and highlights the similarities with the narrative story form. His account is then compared with the content of institutional reports, by highlighting parallels between this information and the concept of engineering thinking in emergency situations.

Yoshida's testimony: a story of an accident

The hearings that Masao Yoshida took part in were conducted by the ICANPS. The Committee interviewed several political and technical actors who participated in the management of the accident and its consequences. The director was convened to appear five times between 22 July and 6 November, 2011. These interviews lasted twenty-eight hours in total and primarily addressed the actions that were carried out in response to the accident. The transcript of the hearing was made public by the Japanese government on 11 September 2014 in the form of eleven documents.

Their content can be seen as a narrative of the nuclear accident. A narrative is an oral, written, drawn or ritualized representation of real or fictional events, arranged in chronological order and forming a coherent whole [START_REF] Adam | La "présentation de soi": cadre pour aborder l'analyse de récits de vie, ¿Interrogations[END_REF]. A life history is defined as "a generic expression where one person tells their life or a part of their life to one or more interlocutors. This narrative may lead to a book, a recording or a film" (Legrand, cited in Burrick 2010).

In this case, the transcripts of the first two hearings correspond to a life history as they describe the fragment of Yoshida's life that unfolded at the Fukushima plant. His professional relations provide a better understanding of the organization that was in place at the time of the nuclear accident.

However, the two transcripts omit certain dimensions -notably, family and economic -found in the life stories usually studied by sociologists. The director did not have complete freedom to narrate his experience, as the format of the hearings followed a set of questions prepared by the investigators. Notwithstanding such 'limitations', there is still value for researchers in the question and answer format.

In practice, this testimony is the product of a 'semi-structured' interview, i.e. "a form of interaction similar to that of the conversation, through the ongoing adaptation of the researcher's questions and interventions as the exchange develops" [START_REF] Nossik | Les récits de vie comme corpus sociolinguistique : une approche discursive et interactionnelle[END_REF]. In this story form, the interviewee (here Yoshida), orient their responses according to their understanding of the expectations of the questioner(s) [START_REF] Brun P | Le récit de vie dans les sciences sociales[END_REF]. The interview is therefore an intersubjective construction created by its participants, who are in constant dialogue with the cultural, social and political context in which it takes place [START_REF] Van Boeschoten | Entre témoignages et récits de vie : Quels rapports ? Témoins et témoignages[END_REF]. This form of interview also facilitates digression and provides opportunities for the narrator to relate anecdotes [START_REF] Adam | La "présentation de soi": cadre pour aborder l'analyse de récits de vie, ¿Interrogations[END_REF].

The story form allows the researcher to identify the thoughts and feelings of the narrator, who reconstructs the story as they remember it. Here, it makes it possible to examine Yoshida's relationship with the story, the protagonists, and his interlocutors, i.e. the ICANPS investigators.

Deviations from the main thread of the story serve to make sense of the story, through recourse to explanations or comparisons. Additional details or information are provided to justify how the story unfolds and explain how events relate to each other: they serve to guarantee coherence and intelligibility. Yoshida therefore selects the events that he believes are significant and establishes "the connections that are necessary to make it coherent" [START_REF] Bourdieu | L'illusion biographique[END_REF]).

Yoshida's testimony is based on his personal memories. Facts are therefore reconstructed according to a -necessarily subjective -point of view. Although the main lines of the story are dictated by the investigator's questions, its overall meaning comes to life through the eyes of the person who is providing the testimony. This person uses their own representational system to establish consistency between the statements they make; therefore the story told at the hearing was necessarily "artificial, variable and partial" [START_REF] Van Boeschoten | Entre témoignages et récits de vie : Quels rapports ? Témoins et témoignages[END_REF].

These subjective biases only add value to personal testimony. Not only do these accounts contribute hitherto unpublished information to the recorded history of the event, they also make it possible to measure the orientation and the weight assigned to the event by the person giving the testimony (Ibid.).

The director chooses some striking metaphors: the damaged reactor is compared to "a living being that struggled in every way possible" [START_REF] Guarnieri | L'accident de Fukushima Dai Ichi : le récit du directeur de la centrale[END_REF]; or, realizing that forty of his staff might have died in the field, "I had decided to commit hara-kiri" (Ibid.). These statements demonstrate particularly clearly the huge difficulty and complexities that had to be taken into account in any decisions made in such an uncertain situation. His divergences from the main thread are particularly interesting, as they help in understanding the 'gaps' in official reports, where anything related to the emotions of the plant's director or its workforce was likely to be considered irrelevant. However, this information has a determining role in decision making, especially in extreme situations [START_REF] Travadel | L'agir en situation extreme[END_REF].

Yoshida's account

The study of Yoshida's narrative reveals connections between the management of the accident and the concept of engineering thinking in emergency situations. Some of the information it contains is new, and can be classified into three categories: factual, representational and technical.

Institutional reports tell the story of Fukushima Dai Ichi a posteriori. For the sake of completeness, they provide an exhaustive description of all phenomena, notably technical. This approach encourages the authors to relate as facts certain elements that can only have been deduced through simulation, notably the chronology of events established by TEPCO. Certain phenomena were presumed to have happened only after the event, for example that a high concentration of hydrogen was the reason for the explosion of the reactor buildings. Furthermore, the director does not know or does not remember certain facts and details that the investigators tell him. This point is important, in particular to understand the uncertainty that reigned at the Fukushima site after the tsunami hit. It means that decisions must have been taken in the absence of knowledge about certain reactor parameters. Furthermore, the emergency response centre had to coordinate multiple tasks simultaneously, which cannot be effectively represented by a classic schema where events follow each other in chronological succession. The decisions and the actions that were taken, with a notable lack of resources, depended on one another. Many important factors came into play, including slow progress in completing tasks, the impact of events on the viability of the site, lessons learned from interventions at other plants, and the mobilization of resources for other activities.

From a representational point of view, some reports (e.g. the NAS document), describe one after another the plant's reactors and the evolution of their states. However, Yoshida's testimony shows that the emergency response centre had to manage the entire site, and try to mitigate the degradation of various facilities at the same time. In addition, his account highlights the extreme complexity of managing the nuclear crisis.

Immediately following the earthquake, the workforce assembled in an anti-seismic building and formed an unofficial emergency response centre. They foresaw, based on the tsunami warning, a potential problem in the reactor cooling system. However, it was the loss of electricity following the tsunami that threw the unit into disarray, "We were all so floored that we were speechless. All we could do was remain calm and get on with administrative tasks, this is what we should do if there is a loss of all AC power, the famous Article 10. But, as I told you earlier, while we carried out these administrative tasks, emotionally, we were annihilated." The team found themselves, from that point on, "faced with a catastrophe" [START_REF] Guarnieri | L'accident de Fukushima Dai Ichi : le récit du directeur de la centrale[END_REF].

In an accident situation, frustration, nervousness and fear translate into emotional tension that in turn, plays a role in decision making and the actions that are taken. The third dimension, which complements the others, relates to actions taken in the field. The director repeatedly emphasizes the difficulty that workers had in carrying out their tasks. This inability to take effective action, coupled with the incomprehension and impatience of TEPCO executives who were not actually at the site, contributed to the extreme situation experienced by workers (Guarnieri et al., 2015).

Attempts to vent reactor 2, which are only mentioned in a few reports, perfectly illustrate the gap between what was happening in the field and at headquarters. TEPCO headquarters repeatedly issued orders to proceed with venting; although teams worked through the night, no workable solution could be found due to lack of suitable resources. Yo-shida states his annoyance with this lack of understanding, which was perceived by the emergency response centre as a failure to acknowledge the work they were doing, and their ongoing efforts. This only served to increase the frustration of teams who could not make the unit respond to their actions. These strong emotions and the role they play in decision making must be taken into account, if we are to have a better understanding of how the accident was managed.

The analysis of Yoshida's testimony therefore helps to incorporate certain factors that are inherent in the concept of extreme situations. In this context, it is particularly important to note: the uncertain situation at the site; the lack of available resources; hierarchical and social pressure; and the feeling of helplessness in the face of the progressive degradation of the facilities.

Missing facts and the reconstruction of events presented in reports means that there is no accurate representation of the complexity and the challenges experienced by the workforce and the emergency response centre. At the same time, it must be noted that the director's testimony of how events unfolded are a subjective account of what happened. The transcript of his testimony does not necessarily correspond to an objective description of the succession of events as they unfolded at the Fukushima site once the tsunami had hit.

THE RELATIONSHIP BETWEEN ENGINEERING THINKING IN EMERGENCY SITUATIONS AND THE MANAGEMENT OF THE ACCIDENT

This section demonstrates the usefulness of Yoshida's account of events, based on the analysis of an extract of his testimony. It first briefly contextualises the events that are related in the narrative framework of the management of the crisis, and then highlights the similarities between the director's account of events and certain markers of engineering thinking in emergency situations.

Contextualisation of the extract

The selected extract (Guarnieri et al., 2015: 207-224) highlights the three categories of information (factual, technical and representational) described in the previous section.

The excerpt is from the morning of the second day of the hearing, 29 July 2011. It follows a series of questions about the state of the emergency cooling systems of reactors 2 and 3, in particular, the decision to inject water into the reactors.

The excerpt begins with a question from the investigators about the management of the accident following the explosion of reactor 1. Several questions relate to planned interventions on reactors 2 and 3, as the investigators try to understand the decisions that were taken given the record of the reactors' parameters and the chronology of events. Yoshida is faced with a long series of questions about the course of the accident (based on the chronology provided by TEPCO), and he either answers succinctly, or asks for clarification. Some of his responses are longer, especially when he explains the sequence of events and why decisions were taken. He partially corrects some of the facts stated by the investigators with explanations, from an operational or technical point of view, that justify the actions that were carried out.

He also expresses his personal convictions at the time of the accident, and his feelings about what was happening. He refers to the atmosphere in the emergency response centre ("we were very annoyed"), and the interventions from TEPCO headquarters. The excerpt ends with a break, when the investigators suspend the hearing.

The investigators were interested in the period from 12-13 March. On 11 March, the earthquake and the tsunami had hit the east coast of Japan. While the subsequent loss of electricity prevented the normal functioning of many of the safety devices at the reactor, auxiliary cooling systems kicked in. In accordance with Japanese law on nuclear emergencies, the director set up an on-site emergency response centre. The unit is required to notify TEPCO of any changes in the status of the facilities; TEPCO in turn, informs the Japanese government. Shift teams remained in place and continued to carry out interventions on the nuclear units. They reported back any information they considered necessary to the emergency response centre, which coordinated the various teams.

On the morning of 12 March, the building of reactor 1 exploded. At the same time, the emergency response centre discovered that reactor 3's emergency core cooling systems no longer worked. This meant that they had to find a way to inject water in order to lower the temperature and pressure in the vessel. This manoeuvre was intended to prevent fuel rod damage, given their inability to activate the tank's pressure relief valves.

This work was hampered by both the degraded conditions created by the explosion of reactor 1 and their inability to obtain reliable measurements of the state of reactor 3. The high pressure in reactor 3 prevented the injection of water into fire prevention circuits; consequently the water level began to fall, while the pressure increased. As preparations were put in place for the injection of water through a makeshift circuit, venting of the containment vessel gradually became inevitable. Venting is the deliberate and controlled release of radioactive steam from the containment vessel of a nuclear reactor; it aims to lower its pressure and temperature and is usually accomplished by opening motor or air operated valves. While the order to begin the manoeuvre was finally issued on the night of 12-13 March, teams in the field were unable to open any valves due to a lack of suitable equipment; their problems were compounded by their inability to measure the reactor's various parameters. Finally, water injection began on the morning of 13 March.

During these many and various attempts to both vent and inject water, TEPCO headquarters continued to interfere with the decisions taken by the emergency response centre. They initially criticized workers for their slowness in carrying out the water injection and prohibited them from using sea water in reactor 1. Moreover, they ordered them to stop spraying water on the containment vessel in order to prepare for venting.

This excerpt sheds light on the management of the accident by Fukushima workers. It highlights the conditions they had to work in and makes it possible to identify the characteristics of engineering thinking in emergency situations in action.

The markers of engineering thinking in emergency situations

The value of this extract is that contains several elements that are not fully reflected in the official reports. It highlights the difficulty experienced by teams in managing multiple events with limited human and material resources, in very hostile conditions and an uncertain situation. Furthermore, it demonstrates the progressive divide that developed between workers and the on-site emergency response centre on the one hand, and TEPCO headquarters on the other.

In such circumstances, individuals find themselves in what can be called an 'extreme' situation that affects decision-making processes and actions [START_REF] Travadel | L'agir en situation extreme[END_REF]. In such a situation, the actions that are taken fail to "regain control of the production unit, [and] are viewed by society as being responsible for an imminent danger with irrevocable consequences" (Ibid.).

At the hearing, Yoshida challenges some of the figures put forward by the investigators. He states that certain data could never have been collected and that it must have been deduced at a later date, or that he does not remember. For example, regarding the pressure in reactor 3, Yoshida states that it was not measured. No-one on the site knew what it was at the time of the accident. It was therefore added at a later date. Whether this data was available or not biases the reading of events, as the inability to access certain data played a fundamental role in the management of the accident, "I would like you to keep in mind the possibility that while we were unable to observe the data; it was possible, later, to insert figures that came from somewhere else. In fact, when we checked the instruments in the emergency response centre, most of the time there were no numbers, collecting data was impossible." (Guarnieri et al., 2015).

In this statement, Yoshida tries to correct the representation that the investigators may have had of how events unfolded. The chronology provided by TEPCO was established a posteriori. Figures that "came from somewhere (and were not collected locally) totally distort the sequence of events. The director's description of being "unable to observe the data", saying that "collecting data was impossible" demonstrates their lack of anything that would them to understand the actual state of the plant.

This lack of data highlights the uncertainty of the situation. At times teams had to enter the units with no knowledge at all of their state, "The thing is that we had to manoeuvre without being able to see anything. None of the parameters that we would normally monitor were available. So, when you ask if the venting was successful, I can only say that I do not know. If you need a simple answer, I would say I do not know. If I look at the circumstantial evidence, I would say that it seemed that it was done at one time or another. I can't be any surer. So when people talk as if it was venting under normal conditions in units that were working perfectly, that annoys me as well" (Ibid.,221).

Yoshida once again emphasizes the inaccuracy of the representation created by the chronological timeline, which provides a version of events that is very different to the situation actually experienced by workers. TEPCO, which wanted to establish an exhaustive chronology, provided inaccurate data that led to inaccurate conclusions, such as that venting operations ran smoothly. However, Yoshida insists that understanding his representation of the accident, including the visibility of actors, offers a contextual overview of the decisions that were taken. The diffi-culty in carrying out certain tasks and the frustration of workers are put forward as other key elements in the management of the crisis.

In addition to the very hostile working conditions, a lack of personnel and suitable equipment hampered the work. Furthermore, teams had to perform several tasks simultaneously. The extract highlights the distance that separated the on-site teams and TEPCO headquarters at the representational level. It is seen in the injunctions that are handed down to the emergency response centre by TEPCO, which reinforce the divide between them, "You have three nuclear units that are falling apart, right before your eyes, you're doing the impossible with the few staff you have, and they dare to say that we are too slow? I cannot forgive those people." (Ibid.).

In this quote, Yoshida reminds us of the difficulty of managing the situation with such limited resources. TEPCO's criticism of the slow pace of operations horrified him, and he found it unforgivable. The words reveal the divide between TEPCO and the staff at Fukushima. In general, Yoshida's testimony demonstrates his loyalty to his workforce, to the difficulty that all experienced; the sacrifice of some and the suffering of others. At the same time, he refuses to accept the accusations levelled at them by people who were remote from any immediate danger and the tensions generated by the unfolding events. "Those people" did not understand the challenges of managing the accident and seemed to consider the workforce as either the guilty party, or incompetent.

Teams on the ground had to simultaneously find alternatives to conventional systems, and repair damaged resources (such as the various water supply and storage systems). Workers sought alternative solutions. An important example is the use of car batteries to provide power to instrumentation. As there was no electricity, batteries or generators, workers came up with the idea of using the batteries from their own cars. This initiative was taken despite the state of the roads, the lack of lighting, the risk of seismic shock, the lack of staff and time. Furthermore, the batteries then had to be delivered to the control room to be connected.

CONCLUSION

This analysis illustrates the value of looking in detail at the testimony of a principal player in the management of the accident. Yoshida's account of events provides valuable material for understanding the management of the post-tsunami situation at Fu-kushima Dai Ichi. His testimony helps to fill in gaps and correct factual inaccuracies present in investigation reports. Finally, it provides an opportunity to identify several markers of extreme situations and indicators of engineering thinking in emergency situations in action.

Further work could use speech or textual analysis tools to look in more detail at the testimony and expand our knowledge of Yoshida's representation of the accident. Specific themes could be selected (such as his relationship with time, or his memory of events) that would improve our understanding of the mechanisms that come into play such a situation. Their impact on decision making, actions, and engineering organizations, could therefore be identified.