P Duffaut
email: pierre.duffaut@gmail.com

J Larouzée

Keywords: Malpasset dam failure, Case history, Field tests, Human and organizational factors, Lessons

On December 2, 1959, the Malpasset arch dam in southeast France suddenly failed, flooding the valley down to the sea, causing huge destruction and more than 400 casualties. Built from 1952 to 1954 for water supply and irrigation, filling of the reservoir was delayed five years and the failure occurred following a flash flood of the river the dam was closing. Post failure studies and expertise during a trial revealed poor field investigations on a micaschist rock foundation crisscrossed by faults, and poor management of construction of the structure. The failure was ascribed to uplift, moving a rock dihedron defined by a conspicuous fault and a tear along foliation. This paper shows that, in addition to the many traps listed by previous investigations (mostly geological and geotechnical), the human and organizational factors can also shed a new light on this catastrophe. Keeping lessons from Malpasset alive and increasing the knowledge about this

case is relevant since worldwide, after the catastrophe, not only did new regulations on dams appear but also both fields of geological engineering and rock mechanics were developed. Thus, consciously or not, every geological engineer or rock mechanics specialists is somehow, a descendant of this case.

A C C E P T E D

M A N U S C R I P T "If anyone be too lazy to keep his dam in proper condition, and does not so keep it; if then the dam breaks and all the fields be flooded, then shall he pay for any damages" (Hammurabi Code, 1750 BC).

After World War II, cities and resorts of the celebrated "Côte d"Azur", along the Mediterranean Sea, developed very rapidly thus requiring ever more water. The Var Department, located in this area, searched for reservoir site able to store enough winter rain to cover summer needs, including agricultural ones. Var was to become the owner of Malpasset arch dam near the city of Fréjus. Five years after its construction, on December 2, 1959, the Malpasset dam failed and a huge wave swept down the valley to the Mediterranean Sea, causing more than 400 casualties. This catastrophic event led governments worldwide to introduce new regulations on dam safety and can be considered as one of the main initiators of two new disciplines: geological engineering and rock mechanics. Well known by the members of the dam community, lessons of this case are worth sharing to a wider audience since they show several traps can interact, as will be demonstrated in this paper. The Malpasset dam failure has long been regarded a technical failure and predominantly along geological and engineering issues. Although partly true, this statement ignores some important aspects of the catastrophe. In fact, whilst the failure mechanism may have been technical, most of the root causes must be sought in the human and organizational aspects of the project. Therefore, this paper explores the relevance of reading the case through the organizational accidents theory developed in the 1980s and 1990s (e.g. [START_REF] Reason | Managing the Risks of Organizational Accidents[END_REF]. The first part of the paper describes the site, the project and the operation of the reservoir up to the failure; the second part details the post failure observations, measurements, testing and analyses and the proposed mode of failure, and the third briefly presents the organizational accidents theory and details the human and organizational failures that eventually led to the collapse of the dam.

A C C E P T E D

M A N U S C R I P T

DAM SITE AND DAM PROJECT

De tous les ouvrages faits de main d'homme, les grands barrages sont parmi les plus meurtriers, lorsqu'ils se retournent contre lui (André Coyne, 1943) 1 This section provides some elements of the construction site and the reasons why it was chosen (1.1), it then reflects the genesis of the Malpasset dam project (1.2) and its construction phase (1.3). It finally describes the reservoir filling from 1954 until the dam failure in 1959 (1.4).

Site

The Reyran is a small river flowing in a rather wide valley carved in a sand and siltstone syncline (coal measures) inside gneissic hills. At 12 km upstream of Fréjus city (formerly a harbour founded by the Romans), the valley narrows when crossing a small gneiss horst. This section looked convenient for siting a rather economical dam retaining a useful reservoir.

Dam project

Geological investigations established the water-tightness of the reservoir site; a few boreholes checked the alluvium thickness below the river bed which was less than 4 metres; on both valley sides the rock appeared throughout the site to be a gneiss crisscrossed with pegmatite lenses and dykes, which was thought to be strong enough to form a dam foundation. The design was contracted with prominent dam engineer André Coyne together with his Bureau.

Coyne had a long experience and expertise in dam design since his involvement with the Marèges dam in central France, 20 years before; then the Castillon and Tignes dams, each being one after the other the highest arch dams in Europe. Between 1946 and1952 he had 1 This quote is taken from Coyne"s lesson on dams at the French Ecole Nationale des Ponts et Chaussées in 1943 ( personal documentation); it could be translated as follows "Among all manmade works, dams are the most deadly when they turn against mankind" (André Coyne, 1943). [START_REF] Coyne | Arch dams, their philosophy[END_REF] he stressed the fact that no failure of an arch dam had ever been reported, contrary to all other dam types which had suffered many failures.

Instead of the gravity dam first considered, Coyne designed a thin double curvature arch dam (Fig. 1-2-3 andTable 1), looking like lots of similar dams built at this time. He chose the exact position of it based on an examination of minute topographic details of the valley sides; for example, on the left side the crest abutted on a thrust block that was protected from water thrust by a wing wall.

Dam construction

The construction was awarded to a renowned dam contractor, Entreprise Léon Ballot, which had built the Marèges dam with André Coyne 20 years before and many other dams since. It was built in partnership with a local contractor. All grouting works were awarded to Bachy 2 , a well-known specialist for boring and grouting dam foundations. As happens on most dam sites, the excavations were to be deepened at some places 3 .

The dam was made of 16 cantilevers separated by 15 joints. The thrust block was comprised of two more monoliths. In order to leave a passage for the river flow during the construction works, the base of a joint was widened; a bottom valve was provided to control the reservoir"s level through the central cantilever (Fig. 4).

The concrete used a crushed aggregate from a nearby rhyolite quarry, and the quality was regularly inspected by the laboratory of Toulon Marine Arsenal. The construction works proceeded for two years without any problem.

During the summer 1954, the stilling basin under the spillway chute was concreted and the tower cranes were removed. Probably for budgetary reasons (lack of funds or search for savings), the designer was not entrusted with any other contracts for survey or maintenance 2 That later became (and is still) Solétanche-Bachy. 3 Excavations have the function of finding the right foundation rock. Since the initial estimate of depth is often optimistic, further digging is necessary.

A C C E P T E D M A N U S C R I P T
of the project. A concrete irrigation pipe was laid towards Fréjus, but due to the lack of money, the distribution network was never completed (more on that point in section 4.3.2).

Reservoir filling and dam failure

The widened joint was closed on April 22, 1954, thus starting the filling of the dam. Fig. 5 shows the evolution of the reservoir level from this time. Delays in buying some upstream land and the torrential regime of the Reyran prevented a total fill up of the reservoir, thus only a temporary reception was made in August 1956. The reservoir level rose a little every autumn, up to November 1959 when huge exceptional rains made it rise dramatically fast. In mid-November leaks appeared in the right bank (7 metres below the operating level); the bottom valve was kept closed, not to disturb the building site of a motorway bridge on the river that was located about 1 km downstream of the dam. The last 3 metres of the reservoir were filled in less than a day. At around 6 pm on December the 2 nd , the bottom valve was finally opened after due discussion between the people in charge of the dam and of the bridge, just before the dam overtopped; but it was too late and the dam broke at 9:14 pm.

The human toll of the disaster was 423 fatalities and many missing, with about the same number wounded. In addition to the human victims there were about a thousand heads of cattle lost, and thousands damaged or destroyed buildings, cars and trucks. The Malpasset dam failure is the most deadly industrial accident in France in the twentieth century, after the dust explosion in the Courrières coal mine, 1902. (André Coyne, 1933) 4 This section is dedicated to the post-failure observations (2.1), measurements and tests (2.2) that helped the birth of rock mechanics as an autonomous field of expertise and research (2.3) and allowed the experts to understand the technical contingencies that led to the ruin of the dam (2.4).

POST-FAILURE ANALYSES: TOWARDS AN ACCEPTED FAILURE MODE

On site observations

Dam site

Today, only a part of the dam remains standing on the right bank, up to half of the cantilever JK, as a giant stairs, cut along vertical construction joints and horizontal concrete layers (Fig. 6) conversely, on the left bank only one half of the thrust block remains and a deep excavation was open in the rock at the foot of what had been the dam foundation (Fig. 6) 5 . This excavation is in the form of a dihedron (Fig. 7) between a downstream face along a fault (see below 2.1.3), and an upstream face torn off along foliation surfaces. At the downstream foot of the dam the concrete apron of the stilling basin has entirely disappeared.

On the right bank (Fig. 8), a wide crevice appeared between the concrete foundation and the rock mass behind the dam, making clear a displacement of the dam of up to 50 cm downstream (see below 2.2). Such a feature had never been reported before anywhere, even though it is mechanically necessary: the dam structure moves forward under the water thrust and the rock mass upstream does not follow. The crevice"s width depends on the modulus of the rock downstream. It will be measured few years later at Vouglans dam only a few 4 This quote is taken from the opening course on dams given by André Coyne at the French École Nationale des Ponts et Chaussées (Paris) in 1933, it could be translated as follows: "There is no work holding more on the ground than a dam; it holds by the bottom and the flanks. In other words, a dam consists of two parts, the man-made artificial structure, and the natural dam which extends it, which surrounds it, and on which it is founded; the most important of the two is the later, the one nobody notice." 5 Father of the first author, Joseph Duffaut was head of the Dams and Electricity department in the French ministry of public works; he worked on the catastrophe from the next day.

Valley banks and floor

Up to the previous reservoir level upstream of the dam and a little less downstream, the banks are deprived of any vegetation, any loose soil, talus and weathered rock, so providing excellent conditions to see the rock mass after the incident, by far better than at any time before. The valley floor appears to have been completely modified, with alternating highs and lows looking like giant ripple marks. Most of the material on the valley floor was sand and gravel from the washed valley sides, with concrete blocks gathered in three main groups just before each bend of the valley.

It was easy to recognize where in the dam the biggest blocks came from: the first heap was about 300 metres from the dam and it comprised concrete blocks from the left cantilevers and a few smaller rock blocks (of the large dihedron volume, about 30 000 m 3 , only a few small blocks had survived, a proof of its low strength). Before the second bend in the valley, the bases of cantilevers KL and LM are the biggest blocks present with volumes of about 700 m 3 that is weighing close to 2 000 t (Fig. 9). Two huge blocks went over the motorway crossing and smaller ones went farther downstream. This distribution testifies to the power of the first flow under the maximum water head.

One critical observation was made on the foundation blocks: their lower surface was coated with a slice of rock, proving a failure had happened within the rock mass, just below the concrete structure and not at the interface or within the concrete .

The main fault

Revealed by the dihedron, the main fault had never been suspected before; only when one knows it, the contours on figure 1 may suggest its path on the left valley side (Fig. 5). Its fresh surface was described as very characteristic of a fault and a cross section of it appeared at the

A C C E P T E D M A N U S C R I P T
lower part of the right bank and below the overturned concrete block. Its strike being perpendicular to the river, it was easy to find it on the opposite bank although there no topographic indication appeared on the contour lines but the cross section was made visible thanks to the stripping effect of the flow. Its dip, at about 45° north, makes it cross the valley below the stilling basin and pass about 15 metres below the dam foundation. Its thickness was about 1 meter. It comprises two bands of finely crushed rock on either side, 3-5 cm thick, and less crushed material in between (Fig. 10). On the left side of the valley, at the foot of the dihedron, the borders had been eroded and the core looked more like a kind of conglomerate, preserving cobble size pieces of rock.

Geology

The first experts commissioned by the ministry called for a geological survey by Jean Goguel (report published in 2010). Goguel spent a few days on site and chose samples for accurate petrological description. A few of the sample close to the dihedron, showed sericite, a kind of mica suspected to cause the rock to have a higher deformability and lower strength. Goguel stressed the high heterogeneity, from massive augen gneisses to very micaceous ones, and the anisotropies through schistosity and foliation. Goguel described fissures, fractures and faults, mentioning that the scatter of their attitudes defied any statistical presentation: "The examination of the rock cleaned by the flow (and of the highway trenches) brought to light an extraordinary density of faults and diaclases in any scale, challenging the structural description, and confirmed by the fact that the digging of the gallery on left bank did not supply blocks of considerable size" (Goguel, 2010).

Late observations

Thanks to a very dry spring in 1962, the water ponds around the dam base dried, giving access to the very foot of the shell; it was possible to bore a small gallery under cantilever FG (Fig. 11). Indeed a water flow below the dam had been suspected from bubbles on the day after the failure and a debris sill formed below the water level by a large discharge during the

A C C E P T E D M A N U S C R I P T
first days (Fig. 12). The gallery showed a wide crevice inside the rock mass, which explained the flow.

Measurements and tests

Geodetic measurements

The experts led by Goguel also asked for a geodetic check of the position of the dam"s remains. Geodetic measurements confirmed the movement first developed from the crevice (Fig. 9). The whole concrete arch had rotated as one piece around the fixed right end of the dam, with displacements up to 60 cm, without any apparent disturbance inside the rock foundation. An exception was that the thrust block had moved about 2 metres, two times more than that explained by the rotation.

A significant discovery also was made by a close examination of the results of the four geodetic surveys carried out during the construction of the dam (see Fig. 5 for dates of measurements and height of the reservoir). On Fig. 13, segments AB show the displacements between the two first surveys (with a one year interval and a reservoir level 4 metres higher), segments BC, those between the next two years (with a reservoir level 3.5 metres higher), and segments CD, those of the last year (with a reservoir level 6.5 metres higher). Although it seems normal that segments CD are far longer, apparently nobody noticed that segments CD also showed a clear tendency to move towards the left bank.

Field tests

EDF sent its Rock mechanics expert, Joseph Talobre, whose team were used to making jack tests for assessing the rock elastic modulus around underground penstocks. On dam sites, this practice had been reserved for soft rocks or conversely very hard ones but never to standard foundations. Some short shafts and a 30 metres gallery were dug to perform the tests. As no basis was available for comparison, EDF ordered the same tests to be performed on seven dam sites at design or construction stage. The Malpasset site results were the lowest of all sites tested, around 1000 MPa, ten times lower than many of the other sites.

A C C E P T E D M A N U S C R I P T

A seismic survey was performed through parallel refraction profiles on the whole left bank, showing a high wave velocity at a depth over 10 metres (5 to 6 000 m/s), but cut by half closer to the surface. Unfortunately no data were available on the dihedron rock.

Lab tests

Rock samples were dispatched to a lot of labs for mechanical tests. Standard testing methods were applied to concrete samples for deformability and strength. Creep had been suspected but was not found. The most comprehensive tests were made at École Polytechnique (LMS, lab of solid mechanics) under the supervision of Pierre Habib, and reported by [START_REF] Bernaix | Etude géotechnique de la roche de Malpasset[END_REF]. Though modal figures could apply to a sound rock, the very large scatter and scale effect were signs of intense fracturing (see more details below in 3.2).

Pierre Habib suspected the permeability of this rock could be sensitive to compression by the thrust of the dam. He tested the radial permeability and found its variation with stress was very high, far more than for any other rock tested the same way [START_REF] Habib | La fissuration des gneiss de Malpasset[END_REF]. Immediately, this unsuspected property was ascribed as the main cause for the failure, as it could build a deep underground barrier below the dam, upon which an extended water head could push upwards the dihedron (see below, Fig. 14 &17).

The stress distribution in the dam shell had been analysed through a simplified "Trial load" method, and six years later it was checked by the newly available FEM which fully confirmed the first analysis.

Research in rock mechanics

André Coyne having died a few months after the failure, the task of researching deeper and deeper on dam foundations is taken by Pierre Londe, a clever engineer of the Bureau Coyne & Bellier who was later to chair the International Commission of large dams. Londe began to discuss the position of classical drainage and grout curtains (Fig. 14, [START_REF] Londe | La distribution des perméabilités dans la fondation des barrages voûtes en fonction du champ de contraintes[END_REF] and devised a method to check the stability of mega blocks just under the dam (Fig. 15, Londe, 1973). Iogether with Pierre Habib, he launched four PhD in connexion with Ecole Prof. Mueller, on water flow in rock mass fissures [START_REF] Louis | Etude des écoulements d'eau dans les roches fissurées et leur influence sur la stabilité des massifs rocheux[END_REF]): Bernard Schneider worked at Grenoble on analysis o seisic signal (so called method "petite sismlque", 1967); Jean [START_REF] Bernaix | Etude géotechnique de la roche de Malpasset[END_REF] and Vincent Maury (1973) worked at Polytechnique, on laboratory and model tests, the latter through photoelasticity (Fig. 16). Within less than 10 years Rock Mechanics had made tremendous progress!

Understanding the failure mechanism

Three different enquiry commissions have worked on the trial, the first one commissioned by the government, both others by the tribunal, altogether involving 18 experts. The third commission was named because the first two could not agree on the issue of the failure"s predictability. The new investigations in spring 1962 helped to make progress: Jean Bellier (1967) and Marcel [START_REF] Mary | Les barrages voûtes, incidents et accidents[END_REF] proposed the following mechanism (schematized Fig. 17 and 18), compatible with all investigations: i.

Due to the thrust of the dam, the permeability of the foundation rock was reduced by a factor of ten or even much more, so building a true underground dam.

ii. Such thrust may move the dihedron along the fault, both upwards and towards left;

the cantilevers on the left bank could no longer take support from the dihedron and the whole shell tried to obtain support from the thrust block.

iii.

Since the thrust block had not enough weight, it gave up after a 2 metres displacement, which ended any arch effect.

iv.

The whole dam shell burst, some parts in horizontal bending some other ones in vertical bending.

Of course the great deformability of the rock mass, the more on the left bank, helped open a fissure along the heel of the shell (still visible on the right bank); it was easily propagated in depth on the left bank thanks to foliation of the gneiss; so the water thrust on the dam structure and its foundation rock increased (as the square of the head). Views may differ in

A C C E P T E D M A N U S C R I P T
weighing the relative influence of the deformability or the sensitivity to stress of the rock mass; however, both played in the same direction and were unknown at the time.

Some years later, in 1982, professor [START_REF] Leonards | Proc. Intern. Symposium on dam failures[END_REF] invited at his Purdue University, Lafayette, Indiana, a colloquium on four recent dam accidents (Malpasset in 1959, Vajont, Italy in 1963, Baldwin Hills, California, in 1973and Teton, Idaho, in 1976 -these two last being fill dams). Among international experts, P. However, whilst the scientific rigor of the experts allowed identifying the technical and natural traps and failures we have described so far, there is a phenomenon whose importance has been neglected or at least underestimated: This phenomenon is the capacity of human organizations to create intrinsic conditions for failures and accidents within themselves.

THE ORGANIZATIONAL ACCIDENT THEORY

"We cannot change the human condition but we can change the conditions under which humans work". [START_REF] Reason | Human Error: models and management[END_REF]p 394) An exclusively technical analysis of any accident neglects a set of aspects likely to explain it. After the war, engineers and ergonomists, become interested in the man and his interaction with the machine (it is the birth of the concept of Human-Machine Interface), In 1958 the Human Factor and Ergonomic Society was created in the United States. At the time, variability and human errors were studied to prevent accidents that affected productivity. The first methods of quantifying and predicting human errors were born [START_REF] Swain | Method for performing a human-factors reliability analysis[END_REF].

A series of accidents from the late 1970s to the late 1980s (including the Three Mile Island, 1979 and Chernobyl nuclear accidents, 1986) initiated a paradigm shift: the human factor focusing exclusively on the operator's actions and errors turned into a broader organizational approach. The concept of organizational accident, proposed by the British psychologist James [START_REF] Reason | Human Error[END_REF][START_REF] Reason | Managing the Risks of Organizational Accidents[END_REF] is gradually (but widely) being adopted during the 1990s.

The organizational accident theory no longer considers the operator error as the root cause of the accident but as the consequence of a set of systemic factors (ranging from the organization itself to the local work environment and of course cognitive process, see 3.2 below). It thus opens up the field of investigation from psychology towards other human sciences such as sociology, anthropology; new concepts appeared (e.g. resilience engineering, safety culture, highly reliable organizations). For more details on the evolution of thinking and studying accidents, see [START_REF] Guarnieri | De l'erreur humaine à la défaillance organisationnelle : Essai de mise en perspective historique[END_REF]. In the next section, we present in more detail James

The Swiss cheese model of accidents

"Major disasters in defended systems are rarely if ever caused by any one factor, either mechanical or human" [START_REF] Reason | Human Error[END_REF]p 768) James Reason is a psychologist who specialized in the 1970s on the study of everyday errors (e.g. absent-mindness, slips of the tongue, attentional failure). His work leads him to propose a taxonomy that distinguishes active and latent errors 6 [START_REF] Reason | Human Error[END_REF]. In order to demonstrate the respective roles of the two types of errors in the etiology of accidents, (3) these "local conditions" not only increase the probability of errors, but also affect the integrity and efficiency of the system's defenses.

Trying to capture this understanding of the complex accident phenomenon in a drawing,

Reason published a quite simple model in 2000 that quickly became the most widely used, commented and cited accident model in the safety studies community [START_REF] Larouzée | From theory to practice: itinerary of Reasons' Swiss Cheese Model[END_REF]. This model was based on a new analogy: Swiss cheese (see Fig. 20) and has thus been 6 The term "latent error" would later be replaced by the broader one "latent conditions". (one must imagine the holes being "dynamic": moving, opening or closing depending of managerial arbitrations, audits, maintenance plans). These holes can be created by latent conditions or operator"s active errors. This model shows that an accident only occurs when the holes are lined up by an (often) improbable combination of several factors.

In the next section, we will try to show that the Malpasset accident was a genuine organizational accident. We have already detailed its technical causes (section 2.), we will now turn to its human and organizational causes.

A NON-TECHNICAL STORY OF MALPASSET DAM FAILURE

This section focuses on a set of non-technical facts (organizational factors) that have been in play in the collapse of Malpasset (each necessary but not sufficient). [START_REF] Reason | Managing the Risks of Organizational Accidents[END_REF] amongst others have warned of the risk of going ever further in the quest for latent conditions, so we start by explaining the time bounds we have set for our approach (4.1). The rupture of the dam was not a consequence of any individual human action (active error) and the final judgment stated that "no fault has been committed, at any stage"; so far it seems reductive and misleading to attribute the catastrophe to fate or solely to the limits of technical knowledge at the time. The organizational factors of the accident were not recognized, or at least not named as such, during the commissions of inquiry (4.2), but it is now possible to highlight many of them (4.3). Our approach doesn"t intend to discuss the judgment that has been made; it aims rather to discuss the role of these organizational factors in order to contribute to the prevention of such accidents in the future (4.4).

How far to dig?

James Reason gave two precious guidelines in order to conduct post-accident investigations.

(1) First he warned that "the pendulum may have swung too far in [the] attempts to track

A C C E P T E D M A N U S C R I P T
down possible errors and accident contributions that are widely separated in both time and place from the events themselves" [START_REF] Reason | Managing the Risks of Organizational Accidents[END_REF]p. 234). ( 2 In response to the first guideline, we defined a priori the time boundaries of our approach.

The starting point is the 1954 decision of the Conseil Général du Var to collect and study projects to address the needs of water supply in Fréjus area. The ending point is December 2, 1959 at the moment where the front of the submersion wave had reached the Mediterranean Sea, 20 minutes after the dam failure; indeed, during those 20 minutes it was still theoretically possible to activate protective barriers 7 to reduce the impact of dangerous phenomenon (e.g. alert or displacement of populations). We already stress that no such protective barrier was activated at Malpasset and that no of such barriers (alert plan, or plan of evacuation) existed at the time.

In response to the second guideline, we propose to distinguish the organizational factors that we present as causes of the accident (1) the fortuitous causes and (2) the induced causes. This distinction directly questions the 'opportunity to act rather than the 'merits' of an action, a non-action or a decision (Table 2).

Experts commissions

Several experts, engineers and academics, including geologists have worked, from the first days after the disaster and for many years later, to establish explanatory scenarios. A first college of six high level engineers from ministries (and one representative of contractors) was appointed by the ministries to search any causes of the failure; they verified no earthquake occurred and discarded any effect of explosives use on the rock cuts along the motorway, a short distance of the site (Fig. 21). They called one geologist, Jean Goguel, who spent about five days on the site it provided and provided a report to the first commission (Goguel, 2010).

7 'Protection' or 'mitigation' barriers are activated after the event and must be distinguished from 'prevention' barriers intended to prevent its occurrence. A counter-expertise was requested by their lawyers. A new panel of six experts, two from Académie des Sciences level, and with a younger soil mechanics professor, the only one to fully understand uplift, then confirmed the role of circulation of water under the dam but contradicted the other conclusions, arguing that this phenomenon was unknown at the time of the construction of the dam and escaped direct investigation (it was only discovered with the benefit of methods and techniques developed during the lengthy trial proceedings). The second panel of experts also stressed that the standards did not require geotechnical investigations at that time.

After two successive judgments, the court finally declared no malpractice, exempting the builders of the dam whose work was considered "technically flawless" (CASS, 1967).

However, there is no such thing as fate to explain the Malpasset tragedy; this judgment simply reflects the fact that incompetence is not a crime. One can imagine that today, such a trial would involve an investigation of the organizational mechanics (mainly in search of responsibilities). Let it be understood that this article is not anyhow intended to discuss the 1967 Court of Cassation"s conclusions. It does not address the legal study of responsibilities;

it proposes a scientific study of the organizational mechanisms, in the light of newer theories from the field of safety studies and humanities. We assume that, even if there is no analysis of organizational factors in the Malpasset trial, their discussion is nonetheless essential to the global understanding of this disaster in order to avoid its recurrence.

A C C E P T E D

M A N U S C R I P T

Malpasset: an organizational failure

In the following, we do not intend delivering another detailed chronological account of the facts (for this, the reader may refer to [START_REF] Foucou | Malpasset : Naissance, vie, mort d'un barrage[END_REF]. This section aims to isolate, characterize and comment on human actions or decisions that contributed to the disaster.

Each element described below represents either a hole in a slice of Swiss cheese, or at the worst the total absence of a slice (i.e. a defense, see Fig. 20). Note that all the failures presented below are "human failures" (which are not, for example, the fault or the compressive sensitivity of rock"s permeability) but it doesn"t mean that they all are individual failures. Some may be but others may come from the organization or even the social or economic context. The main sources used in this part are [START_REF] Foucou | Malpasset : Naissance, vie, mort d'un barrage[END_REF], [START_REF] Valenti | Barrage de Malpasset: de sa conception à sa rupture[END_REF], [START_REF] Moine | Le barrage de Malpasset[END_REF], Duffaut (2010a[START_REF] Duffaut | Cinquantenaire de la rupture des fondations du barrage de Malpasset[END_REF][START_REF] Duffaut | What Modern Rock Mechanics owe to the Malpasset Arch Dam Failure[END_REF]), Boudou (2015) and also, direct knowledge of the accident gained by the first author.

Geological studies: Geologist are humans after all

The geologist who was consulted for the pre-project studies is Professor Corroy from the University of Marseille (France); expert in Mediterranean geology but with no experience in dams. He was probably chosen because of his geographical proximity with the dam site. It follows that (1) his study was based on a reasoning in terms of the tightness of the reservoir and risks of instability of the structure; (2) for the abutments he simply reasoned in compression;

(3) the surface faults were appreciated only in terms of water-tightness, so thought to be without impact. Somehow, the geologist only reasoned on a part of the problem (as he was lacking a necessary experience with dams).

In 1949, the original dam project was modified by Coyne & Bellier (see 1.2). Consulted only by mail, Professor Corroy gave, in 1950, his written agreement to move the project"s site 200 meter downstream, considering that anchoring would "a priori" not present any other difficulty (quoted by [START_REF] Foucou | Malpasset : Naissance, vie, mort d'un barrage[END_REF]. The decision to move the structure and change its type was technically and financially motivated, it allowed an arch dam to be built instead of a

A C C E P T E D M A N U S C R I P T
gravity dam (this being more aesthetic and less expensive) and increased the volume of the reservoir. But, taken without further geological studies, it led the designers to blindly locating the dam just over one of the "natural traps" (the dihedron).

Finally, even if it was noted that the left bank abutment rocks were much degraded, nothing was done to consolidate them. During the rock excavation, it was found that the gneisses were much degraded but again no corrective action were undertaken. Overall, the geological monitoring has never allowed to "sound the alarm" (Table 3).

In summary, it can be observed that if the geological analysis was incomplete and although the knowledge of the time was limited, it was subject to "technical" insufficiencies. But, moving the dam without any real coordination dialogue between the project engineer and geologist, nor any field investigation, and starting construction without strengthening-work, these are decisions made without a safety net. Such decisions also imply the acceptance to operate blindly. Here, we note poor communication between the project engineer and the geologist and globally a poor appreciation of the risks (due to a lack of specific experience of the geologist and possibly to an excessive confidence in arch-dams from the project engineer).

Budget: an external factor with internal effects

The lack of attention to geological studies appears even more clearly when given that of the 27 million Francs originally planned for geological surveys, only 8 million were spent.

Economic pressure is, therefore, what can (directly) explain the facts listed before (4.3.1) and budgetary considerations will certainly have weighed on the project.

The total cost of the dam, its main water-supply networks for drinking and irrigation water was a significant financial effort for the Var department. In the context of post-war reconstruction 8 , the project was part of an ambitious financial plan from the Commissariat Général au Plan, so the department should receive subsidies from the Ministry of Agriculture Financial resources also fell after the construction of the dam because the financing from the Ministries of Defense and Interior was not obtained. As a result, the irrigation network was never operational (the main branch of the water supply system, was received too late during 1959 -Table 4).

Although mostly fortuitous, it is important to note that ecosystem and context factors (in this case the national context of economic recovery and then money inflation) exert a nonnegligible influence on the project (through the choices and arbitration of its actors).

A project made of humans

We have already mentioned that this or that might have "influenced the project', of course a project doesn"t think or act by itself. But, while this may seem trivial, it is important to keep in mind that a project, an administration, or any other human organization is in the end only made up of humans. As [START_REF] Douglas | How institutions think[END_REF] demonstrates there is a mutual influence between the thought of institutions and the thoughts of individuals that composes the given institution.

One of the factors of failure (which can only be described as such a posteriori) was the tremendous authority of André Coyne. Coyne was a recognized personality in the dam community, he was also known for his quick wit, his great intelligence but also for his dry character and his authority (it was said of him that he frightened some of his younger collaborators). These traits had undoubtedly been a strength that allowed him to achieve his Corroy explained the confidence he had in André Coyne who already built many dams. He thus explained he was "subjugated" by Coyne to whom he attributed "the soul of geologist, who admirably knows the rock". Corroy also said that he had referred to the project manager (Coyne) for decisions regarding in-depth ground investigations and had preferred to gradually withdraw from the project. Another example of the great confidence inspired by Excess of confidence mixed with poor communication amongst stakeholders and lack of skills or experience led "the project" to another critical decision regarding the sizing of the bottomvalve. We have already mentioned the torrential regime of the Reyran and that the filling of Malpasset was marked by a dry period of 5 years followed by long and heavy rains in late 1959. It has been estimated [START_REF] Moine | Le barrage de Malpasset[END_REF] that the maximum filling rate (reached during the last 24 hours) was approximately 150 m 3 /s. In the absence of a diversion tunnel, the only way to control the first filling would have been to have a bottom-valve capable of evacuating such a flow. However, the valve of Malpasset was sized for a flow three times lower (50 m 3 /s). It was considered that the bottom-valve was dimensioned according to the state of the art.

However, taking into account the absence of a diversion gallery and the torrential regime could have alerted the owner on a control issue regarding the first filling. We note here a double phenomenon: (1) overconfidence in the standards and state of the art preventing any questioning of the evidence that showed deviation from these; and (2) partial consideration 9 Respond published in the newspaper "La France' February, 5 1957.

A C C E P T E D M A N U S C R I P T
of the first filling problem: the fear was not being able to fill reservoir behind the dam quickly and not that its filling may go out of control.

Finally, due to the lack of a first full filling, only temporary hand-over of the dam took place on February 9, 1955 and August 1, 1956. This induced fuzzy responsibilities amongst the builder and the owner; the effects of which weighted on the surveillance plan (see 4.3.4 below and Table 5).

Although of various origins, the human failures in connection with the project are all induced. We can note the deleterious effects of overconfidence, both in the expertise and decisions of André Coyne and in the technical state of the art. Blind confidence can become a danger. Indeed, it alters the vigilance, the critical spirit as much as the possibility of contradictory exchanges, of questioning one"s opinions, etc. As the saying goes "trust but verify" and control has failed on many levels in the Malpasset case. Lastly, we note that the relation to time, perceived as a constraint (delays in the expropriation of old mines, economic context pressing the final hand-over of the work), influenced decisions and practices.

Technical controls but human planning of the controls

We have mentioned the work of Douglas on how institutions think, to understand the facts described below one must bear in mind the effects produced by what must be called technocracy ', which was important during the 1950s and 1960s. The Corps des Ponts et Chaussées was (and still is) a very prestigious state body, way more prestigious than the Génie Rural. This state of affairs contributed to giving more weight to the opinions of engineers from one state body than the other; in particular in the matter of technical decisions concerning the surveillance of the dam. We also mentioned that the irrigation system had never been operational due to delay in delivery of certain parts. This had the effect of depriving the dam of its utility; thus becoming an almost useless concrete wall, and this possibly made its monitoring less urgent.

A C C E P T E D M A N U S C R I P T
In 1952, the Var department mandated the Génie Rural to be responsible for the surveillance of the dam but without issuing any specifications 10 . Mr. Dargeou, Génie Rural engineer asked the Prefect several times to specify and organize the general survey and monitoring (including its development of the structure"s deformations and their interpretation). On January 7th, 1955, the Departmental Commission authorized the signature of an agreement 11 entrusting the Société de Photo-topographie to undertake the topographical surveys of the dam, but still no expert was mandated for interpretation of the measurements. Most importantly, no action was taken between the completion of the work and the start of dam reservoir filling (see Fig. 5). This lack of reference measurement inevitably altered the interpretation of future campaigns (there is no record during the filling of the first 40 metres). A check in 1958, communicated to the Coyne office does not show any irregularity.

In the summer 1959, the last measurements are made, their results only reached the Coyne office shortly before the dam break; they were also transmitted (four months later, in November 1959) to the Génie Rural who forwarded them to the prefect and the Conseil Général du Var for simple archiving: The question arises, "who monitors what? The client sends the measures to the prefect and no one is able to interpret them" [START_REF] Duffaut | Malpasset, la seule rupture totale d'un barrage-voûte[END_REF].

However, these measurements reveal the presence of non-negligible deformations 12 .

In terms of survey, the presence of a guard on site must be mentioned. This guard, Mr. André Ferro, was responsible for making visual observations of the terrain and structure during filling. He is the one who first noticed seepages in the dam"s structure in November 1959, along with the appearance of springs on the right bank. He also noted the appearance of cracks in the stilling basin, always on the right side [START_REF] Duffaut | Malpasset, la seule rupture totale d'un barrage-voûte[END_REF].

The observations of André Ferro gave rise to the first concerns. On November 30, a request for preventive drawdown was made by the Génie Rural but it was refused by the Ponts et Chaussées so as not to damage the construction site of a highway bridge, the formwork of the 10 In fact, i twill be the ACJB office that will ensure it until the end of the construction work in 1954 before passing the baton to the Génie Rural.

11 Agreement that will only be signed more than a year later on February the 15 th , 1956.

12 Without being alarming (maximum deformation of 17 mm on the deep part of the left wing) they indicate a work in rotation of the structure.

A C C E P T E D M A N U S C R I P T
piers being still in place (Duffaut , 2009). The operating level of the reservoir (98.5 m NGF)

was eventually exceeded on the morning of December 2 (reaching level 100.00 m NGF) but the bottom valve was kept closed. In the afternoon, an onsite crisis meeting of the engineers of both the Ponts-et-Chaussées and the Génie Rural finally leads to the decision to open the bottom valve (actually opened at 6 pm, 3 hours before the rupture; [START_REF] Valenti | Barrage de Malpasset: de sa conception à sa rupture[END_REF].

The existence of hierarchical relationships between institutions is outside the field of action of most actors in a system. However, it is interesting to keep in mind the difference between an organization chart (the organization as it is ideally thought) and a sociogram (the organization as it actually exists). Within the actor"s field of action this time, let us note the negative effects of the administrative slowness demonstrated by the Conseil Général du Var (concerning the implementation of an adapted monitoring plan) and a relative recklessness of the services of the prefecture as to the existence of a potentially dangerous dam on their territory and the skills of the people in charge of its integrity.

Most failures in monitoring and control aren"t fortuitous. They were induced by poor risk assessment or perception (e.g. regarding the alerts of the guard, the decision to save the piers of the motorway-bridge) and bad appreciation of "weak signals" (e.g. lack of early concerns with the deformations observed by the geodesics) 13 . Of course, all the elements analyzed above also came into play in a systemic manner: Coyne's authority and accorded trust, the overconfidence in the arch-dam (none of which had ever failed before), the imperative to complete the reservoir filling in order to achieve the final-delivery (partly for economic reasons dictated by the economic background of the French society), all these factors somehow contributed to shaping the risk perception. This risk perception itself impacted the relationship to time in the decisions (e.g. delay of valve opening, crisis meeting with Coyne convened too late), and so on up to the failure. 13 One could also consider a (very) weak signal the toponymy of the selected site: the pronunciation of "Malpasset" in French is the same as "mal passé" meaning "(it) went wrong"; in fact Malpasset would mean "bad track" because of the danger of malandrins) Although very short, this delay could nevertheless have made it possible to shelter a part of the population and thus limit the number of victims. However, and this was emphasized during the trial, there were no such emergency plans at the time. Moreover, after 6:30 pm there was no direct telephone connection between the emergency management officer (an army squad leader) and the Var prefecture. More surprisingly, and witnessing the low awareness of risks and the interest of a potential warning chain, the guard André Ferro did not have a phone in his house and had to use the one at the work-site. However, even assuming he had a phone, since his house was one of the first destroyed by the wave, he could not have used it. The weakness of the alert management will not be retained as determining factor during the trial.

The Malpasset dam failure was accompanied by several aggravating factors (all absolutely fortuitous but also unconnected and unlucky) that contributed to an increase in the number of victims of the disaster. The failure occurred at night, when most people were at home and younger children asleep; it was a total and instantaneous failure and the localities that were most impacted were mainly located very close downstream of the dam. These aggravating factors were also present in the 1963 Vajont dam disaster in Italy (failure at night, instantaneous phenomenon, and immediate proximity downstream of the most impacted localities). The Vajont dam disaster caused more than 2000 casualties. On the other hand, and as an illustration rather than a comparison, the Grand Teton dam failure in the United-

14 Consulted online at: http://frejus59.fr/Malpasset_chronologie (March 2019). 15 A meteorologist who remained at the observation post on the night of December 2 (Dubois, 2011). States took place in the daytime and in a progressive manner (albeit rather quick) that allowed an emergency plan to be activated (still 14 people died).

Discussion

« La complexité provient de la quasi impossibilité de maitriser les phénomènes vivants […] instables par définition » (Fiévet, 1992) 16 Reviewing a disaster entered into the history of a scientific community in the light of contemporary theories allows a long and meticulous search for explanations to be fulfilled.. It is impossible (in essence) to foresee all the forms that an accident could take (lack of visibility) yet the moral judgment (which will be that of the expert, the politician or the judge) could qualify as improvident the organization who initiated the accident by its activities (lack of vision); considering it has not sufficiently sought, and used the advice of dedicated teams, managers, control services, to prevent its occurrence. Amongst the initiator of the Fukushima"s Nuclear disaster is a sea dike that wasn"t designed and built (planned > vision)

high enough to stop the tsunami wave (e.g. [START_REF] Guarnieri | Un récit de Fukushima[END_REF]. Was the wave The "state of the art" question seems central because it is this which often discriminates the culprit of improvidence (the one who did not foresee > lack of vision in relation to what was known) from the victim of an unforeseeable event (also called a Black Swan). However, this reference to the state of the art cannot be more than a legal attempt to rationalize a philosophical (even metaphysical) problem: the accident is, by definition, the break with a state we are used to. It is an integral part of normality, except that its frequency or intensity makes it remarkable. For example, the awakening of a volcano only represents an accident on the temporal and spatial scale of a given human community.

The question of the lack of visibility and/or vision places us in the face of our responsibilities, in the realm of the possible but perhaps, above all, of the impossible. Should we stop building some types of works? Or stop building in some given areas? Shall we return to questions of destiny? Turn to a metaphysical determinism to validate the fact that mankind is fallible?

That it only has a limited control over the vast system of nature?

As true as an engineer is technically and morally responsible for the quality of his/her studies and achievements; a society is responsible for its technical and scientific choices.

CONCLUSIONS: Lessons to be kept alive

Malpasset is the only known total failure of an arch dam. This disaster has deeply marked the French spirits, as well as the spirits of a whole community of practice (that of the builders and operators of dams, of course, but more broadly that of builders and operators of engineering structures). During post-accident analyses, many technical and organizational aspects appeared to have failed or lacked and were to be (re)invented, modified and/or imposed by state regulations. Time going by, there is a risk that one may forget the origins First lessons are related to geological investigations. Geological history of the massif (far older than granitic rocks in other reliefs) has been neglected, so were informations from the shape of contours, and the general foliation of the rock (preventing the discovery of the main fault). Knowledge of Geology, "Anatomy" of the ground, say materials and structures, is always the first prerequisite of any dam project and also "Physiology" (what is moving inside).

Only experienced geologists have a chance of discovering all defects and traps (hazards) of a site.

Second, come lessons regarding engineering. We have pointed out the lack of foundation drainage, the lack of knowledge of extreme rains and flash floods (likely to fill up the dam remnants), poor survey and monitoring. Only dam engineers fully understand the power of water, including groundwater, behind a dam, under a dam, inside a dam, and all around it, just like inside any natural relief or any heap of sand or other material: standard hydrogeology usually applies to water resources, here water plays through its power, and have thus been compared with the libido in human life [START_REF] Duffaut | Le rôle de l'eau dans le terrain, c'est celui de la libido sur le comportement humain[END_REF]. Any engineer/architect in earthworks and construction (upon or under the soil surface), needs geology, exactly as any surgeon needs to know the anatomy and physiology of his patients! Finally, in the Malpasset case, there is much to say regarding human sciences. The case is made of many wrong decisions induced by excessive confidence, lack of trust or competencies, poor communication and so on. If each single human or organizational failure is necessary but not sufficient to explain the catastrophe, one can note that amongst the 21 "human failures" (Tables 3 to 7), 75% are "induced" failure (N = 16). This suggests that nothing was liked to fatalism, inevitable. Without trying to designate any culprit, it is nevertheless

  been ICOLD president (International Commission on Large Dams). When opening aSymposium on arch dams

  Il n'y a pas d'ouvrage qui tienne davantage au sol qu'un barrage ; il y tient par le fond et par les flancs. Autrement dit, un barrage se compose de deux parties, le barrage artificiel, fait de main d'homme, et le barrage naturel qui le prolonge, qui l'entoure, et sur lequel il est plus important des deux, c'est le second, celui qu'on ne remarque pas.

  decimetres, within a far stronger rock mass. Thus Fig.8appears even more important than Fig.7, as it defines the upstream face of the dihedron.

  Polytechnique and various universities; Claude Louis worked at Karlsruhe, Germany, under

  Unrecognized in the 1950s and 1960s, Human and Organizational Factors (HOF) have since been subject of numerous works in the field of safety studies. This section offers a brief history of the HOF studies (3.1) and presents one of the most popular accident causation models brief history of safety studies Since the industrial revolution, safety has mainly been a technical issue: efforts of design engineers and maintenance ensuring the technical reliability of the systems. The variability of individuals was identified early as a risk factor(Heinrich, 1936) but back then, efforts to improve matters focused on how to rationalize and constrain behaviors ("one best way"). It wasn"t until the aftermath of World War II that the "human factor" became a specific field of scientific investigations. The war effort indeed made technical or organizational change difficult, by guiding the optimization efforts towards the operator's performance and training.

  organizational accident theory and its most popular accident model: the Swiss cheese model.

  "the Swiss cheese model". Each slice of cheese represents a defense of the system (being technical, human or organizational). The holes represent weaknesses of these defenses

  ) He thus reminds us of the necessity to focus on what one can manage and/or change.

A

  Few days later, the court of Draguignan appointed six academics to establish responsibilities: they pointed out many faults and concluded that the Génie Rural bore the whole responsibility (André Coyne the designer had passed away before any trial, recognizing his entire and sole responsibility). The cause of the dam failure was for them directly related to the water pressure under the left bank of the dam. Uplift was known about since it was responsible for previous dam failures atBouzey, France (Lévy, 1895). Finally, they noted the absence of studies, geotechnical tests and controls of the first filling. This established the liability of the builders and the dam operator.

8A

  The Marshall plan was launched in 1947 dam, and the irrigation network) from the Ministry of Defense (for the water supply of the Fréjus Saint-Raphaël military base) and the Ministry of the Interior and Reconstruction (for the drinking water network). However, during the 1950s, a period of monetary inflation caused the Franc to lose about 10% of its value per year. This devaluation of the currency has undoubtedly pushed the project stakeholders, especially the ACJB office to complete the work as soon as possible. This economic pressure helps to explain the choice of a more economical arch-dam and the non-occurrence of certain studies or work.

  all of which he received the prestigious grand prize of architecture in 1953), but they somehow played against him in the Malpasset case. During the 1964 trial, geologist George

  It has been possible to draw a very precise chronology of the events following the rupture thanks to testimonies and recordings of tension drops on the electric network indicating the fall of pylons or the destruction of transformers by the flood wave (such a chronology can be consulted online 14 ). It was thus possible to establish that it took 26 minutes for the wave to reach the town of Fréjus and 10 more minutes before reaching the sea, flooding the aeronaval base and killing the last victim 15 .

  This contemporary reading is also intended to keep these lessons alive, either by bringing them to the knowledge of new people or by subjecting them to debate from a new angle. It is in such a spirit that the authors of this article were invited to give a keynote lecture on the Malpasset dam failure to the 2018 Engineering Group of the Geological Society (EGGS) annual conference 2018 themed "Keeping Lessons Alive" held at Christ"s College, Cambridge. Reviewing the Malpasset dam failure in the light of the study of the humanities also invites an ethical and moral reflection on the articulation what of we know, what we can do, and what we must do. Thus, the distinction we have proposed between induced and fortuitous failures could be supplemented by a reflection on the difference between the lack of visibility (characteristic of a phenomenon) and the lack of vision (characteristic of the observer or analyst of a phenomenon).

  16 "The complexity comes from the almost impossibility of mastering living phenomena[...] unstable by definition". of visibility) or has the Japanese society been improvident (lack of vision)? Answering such questions is a prerequisite for a society to (1) the establishment of liability that allow a form of compensation (legal aspect); (2) the calling of technical or practical state of the art into question when needed.

  sense of some norms or good practices. Therefore, as a conclusion of this paper, we would like to sum up the most important lessons of the Malpasset dam failure, which must be kept alive. Such lessons are tentatively listed below along three scientific fields (which always interconnect): geology (natural sciences), engineering (technical sciences) and sociology (human sciences).

Fig. 1 .Fig. 2 .Fig. 3 .Fig. 4 .Fig. 5 .Fig. 6 .Fig. 7 .Fig. 8 .Fig. 9 .Fig. 10 .Fig. 11 .Fig. 12 .Fig. 13 .Fig. 14 .Fig. 15 .Fig. 18 .Fig. 19 .

 1234567891011121314151819 Fig. 1. Downstream view of Malpasset dam close to end of construction: the thrust block appears at right (on the left bank), the spillway weir in the centre(photo COB, summer 1954)

  Habib, P. Londe, G. Post and D. Bonazzi for France, Laginha Serafim for Portugal and W. Wittke for Germany all agreed with the mechanism first proposed by Mary and Bellier. Among more recent papers, C. Fairhurst and Damjanak (2003) checked the role of water pressure inside the rock mass using novel programs.

  Coyne can be found in the response made by Fréjus" mayor Henri Giraud to catastrophist statements published in a local newspaper (Nice-Matin): "What you cannot ignore is that the author of the project is Mr.Coyne, Inspector General and General Chairman of the Société

d'étude des barrages de France. To date, Mr. Coyne has built more than eighty dams on wadis, on rivers, and torrents. Mr. Coyne has just been appointed by the Government of Southern Africa to study a dam on the Zambezi River, dam that will retain one billion 600,000 m3, or thirty-five times more than Malpasset dam [...]" 9 .

by guest on June 13, 2019 https://qjegh.lyellcollection.org/ Downloaded from

Definition

Generic exemple

Fortuitous

Events located outside the field of action of the actors involved and independent of their decisions.

A fortuitous failure is independent of the actors involved.

Heavy rain, political decisions (for the sharpend), …

Induced

Events located inside the field of action. Notion of free will, possibility to do differently.

An induced failure is the cause of a choice, an act.

Over