Industrial Safety and Utopia: Insights from the Fukushima Daiichi Accident

Feedback from industrial accidents is provided by various state or even international, institutions, and lessons learned can be controversial. However, there has been little research into organizational learning at the international level. This article helps to fill the gap through an in‐depth review of official reports of the Fukushima Daiichi accident published shortly after the event. We present a new method to analyze the arguments contained in these voluminous documents. Taking an intertextual perspective, the method focuses on the accident narratives, their rationale, and links between “facts,” “causes,” and “recommendations.” The aim is to evaluate how the findings of the various reports are consistent with (or contradict) “institutionalized knowledge,” and identify the social representations that underpin them. We find that although the scientific controversy surrounding the results of the various inquiries reflects different ethical perspectives, they are integrated into the same utopian ideal. The involvement of multiple actors in this controversy raises questions about the public construction of epistemic authority, and we highlight the special status given to the International Atomic Energy Agency in this regard.


INTRODUCTION
The complex "co-production" of knowledge and social order (1) has been highlighted in the study of judicial decisions, (2) regulatory science, (3)(4)(5) and policy debates. (6,7) Accordingly, the notion of "scientific governance" has undergone significant transformation in several institutional contexts (8) -with the exception of high-risk industries, where the trend has yet to manifest. Here, normative changes are primarily driven by a "scientific" response to accidents, within the conceptual framework of feedback from experience. (9) The perspective of accumulating "objective" knowledge has legitimized a curious twist: the accident creates a "unique opportunity" to "seek in highly regulated industries, feedback from experience implies the simultaneous participation of various state, and even international institutions. The lessons learned are a function of the controversies that develop between such bodies, while learning on the international scale remains relatively poorly understood. (21) In order to fill the gap, here we focus on the Fukushima Daiichi accident that occurred on March 11, 2011. Although the accident created social disorder, it did not prevent the production of institutional knowledge.
Between 2011 and 2012 (i.e., shortly after the accident, when social pressure to learn appropriate lessons was greatest) a commission appointed by the Japanese government (22,23) and another created by the Diet (24) published their official findings. At the same time, in the context of international assistance, the International Atomic Energy Agency (IAEA) published its expert findings. (10) These publications fueled a scientific controversy over the interpretation of the data. Following Glenna (25) in the case of environmental issues, our purpose here is to demonstrate that the scientific controversy reflected an ethical conflict. Moreover, the multiplicity of actors leads us to address the question of their legitimacy in the development of arguments.
We therefore analyze the narrative of these voluminous accident reports, which seek to convince both experts and the general public. Taking an "intertextual" perspective, (26) we examine the arguments that are deployed, and the links between "facts," "causes," and "recommendations." In line with Toulmin, (27) we consider that the primary function of arguments is to provide a formal defense for an assertion. Thus, we examine the claims made by investigation bodies, together with the grounds for these claims-in other words, the cases the commissions present in defense of their conclusions.
We are not interested in the potential biases that are inherent in the inquiry process, nor in the conclusions that can be drawn in terms of safety. (28,29) Nor, unlike other in-depth accident investigations, (12,(30)(31)(32)(33) do we seek to study the various possible conclusions with respect to the causes of the event, depending on whether the point of view adopted by the investigator is objectivist or constructivist. Nor do we focus on the recurrent "patterns" in the public debate on the accident, (34) or the general framing of technical conclusions or those of the general public. (14) Rather, the focus is on the internal organization of the arguments that are set out in these reports, and that are used to support their conclusions. Thus, we are not interested in the conclusions as such, but in how they are arrived at-based on the supporting arguments. By doing so, we seek to determine the extent to which they are consistent with (or contradict) the corpus of "institutionalized knowledge"-that is, the scientific and technical knowledge that serves as the justification for nuclear safety standardsand identify the social representations that underpin them. It is through the structure of these arguments that the controversy at a technical level can be linked to an ethical conflict.
It should be noted that, to the best of our knowledge, the architecture of the arguments used in reports of technological disasters has not been studied; this contrasts with homicide reports (35) or accounts of natural phenomena. (36) We begin with a brief reminder of the accident and the context. Then we present our conceptual framework. Our analysis highlights how scientific controversy is associated with an ethical debate, which is itself circumscribed by epistemic authority.

THE FUKUSHIMA DAIICHI ACCIDENT AND SUBSEQUENT INVESTIGATIONS
On March 11, 2011, an earthquake stuck northeast Japan, followed about 50 minutes later by a tsunami, both of an unprecedented magnitude and dynamics. Damage was on a regional scale. At TEPCO's Fukushima Daiichi nuclear power plant, most of sources of electrical power were destroyed. The facility was plunged into darkness, and all instruments failed. Operators were faced with a combination of overwhelming forces; the scene resembled a battlefield, characterized by extreme temperatures, high levels of radioactivity, aftershocks, floods, and piles of debris. It was very difficult to share information and, in a situation that was beyond belief, action focused on cooling the reactors and restoring monitoring instrumentation. Achieving these goals required a series of complex operations that were both far-reaching (e.g., implementing cooling systems through the transportation of sea water) and ingenious (e.g., the use of car batteries to provide power). The unfolding events nevertheless led to the simultaneous heating of three reactors and the explosion of two buildings between March 11 and 15. The seriousness of the accident was classified by the Japanese authorities at level "7"-the maximum on the International Nuclear Event Scale.
We focus on the inquiry reports published by Japanese authorities and the IAEA between 2011 and 2012 (see Table I). They have been published in English. These documents were selected because we are interested in knowledge creation in the turmoil that immediately followed the accident. Other official reports were only published several years after the event, including that of the Director General of the IAEA. (37) The members of the ICANPS Commission were appointed by the Prime Minister's Office. Most were academics working in the field of nuclear engineering, supported by a writer, two lawyers, the Mayor of Kawamata (Fukushima Prefecture), and an engineering consultant. The Commission was assisted by academic experts in the fields of civil engineering, political science, crisis management, psychology, and sociology applied to disasters. The NAIIC Commission was created by an Act of Parliament. It was headed by a physician, the former President of the Science Council of Japan, and included a seismologist, a chemist, a physician specializing in radiation, a social system designer, two lawyers, two politicians, and a science journalist. It was supported by consultants specialized in nuclear engineering, biology, and political science. The IAEA team of experts that carried out an inspection between May 24, 2011 and June 2, 2011 was composed of personnel from the IAEA and nuclear experts from the regulatory authorities of 12 countries.
The four reports published by these bodies were not developed separately. The NAIIC's work was designed to be independent of the investigations carried out by the Japanese government and TEPCO, as the latter were involved in regulatory activities and crisis management. (24) The ICANPS asked some members of the IAEA mission to comment on its interim report. (38) These exchanges necessarily influenced how the inquiries unfolded.
The terms of reference of the two Japanese commissions were comparable. They were tasked with determining the technical, organizational, and social causes of the accident, with particular emphasis on oversight. The scope of the investigations specifically excluded the attribution of responsibility. The ICANPS stated that the process would be conducted "in an open and neutral manner, accountable to the public," (22) whereas the NAIIC said it would be "conducted thoroughly by experts from a logical, objective and scientific perspective, without bias for or against nuclear power." (24) These terms of reference are consistent with an objectivist interpretation of the failure of sociotechnical systems, which is frequently found in accident investigations. (30) The investigators collected hundreds of hours of testimony from thousands of witnesses, experts, and actors in the crisis. They sent thousands of document requests to the operator and other institutions, and analyzed this information in specialized committees. Throughout the public hearings, the symbolism of the judiciary and a logic of expertise legitimized the work. Reports frequently include accounts from named witnesses, whose functions are identified. These solemn statements tend to turn affirmations into "facts." Conclusions and recommendations are presented as the natural outcome of an objective comparison of points of view, rather than a dialectical process.
However, the investigations were not value free. This is particularly clear in the introductory words of their chairmen. The NAIIC asks: "How could such an accident occur in Japan, a nation that takes such great pride in its global reputation for excellence in engineering and technology?" (39) This question suggests a feeling of shame, shared at a national level, which calls for the attribution of blame. This is seen again in the following sentence: "For all the extensive detail it provides, what this report cannot fully convey-especially to a global audienceis the mindset that supported the negligence behind this disaster." (39) Similarly, the ICANPS states:"Considering the responsibility we have to our descendants, the investigation results should stand up to critical evaluation even in 100 years' time"; the aim is to "adequately answer all questions of the Japanese people." (23) By referring to such "responsibility," the government commissions suggest that the investigation may depart from the standard of formal logic-that is, the positivism called upon in their claim of robust reasoning-and become more of a moral assessment.
Through these striking introductory remarks, the commissioners present their action as a landmark in the current of history, as they bear the burden of introspecting Japan society to respond to the huge expectations of an incredulous population. Later, in their findings, investigators typify the accident by reference to social roles and the expectations of institutions.
In the following, we demonstrate that in fact, in these reports, "logical" arguments correspond to ethical judgments. To this end, we discuss the narrative in depth, in the context of a theoretical framework that highlights the social representations underlying causal relationships.

THE INQUIRY REPORTS AS TECHNO-SCIENTIFIC LITERATURE
In theory, an inquiry combines two objectives: it retraces a particular outcome on the basis of the available data and knowledge, and infers general conclusions from this historical reconstruction. To make sense, such an approach must be based on a representation of "normal" events. However, this requirement does not presage the view of causation adopted by investigators. Simply put, the objectivist perspective argues for an extrinsic reality that is knowable and controllable, (40) in order that causation can be tested empirically. On the other hand, a constructivist approach suggests that the environment is "enacted" continuously by the actors themselves; (41) in this case, causes cannot be isolated, and the focus should be on the way actors make sense of their situation.
In the end, there is no consensus on an acceptable justification of a causal relationship. (42) The isolation of a specific event negates the historical perspective, while claiming to focus on "factual" relationships, "yet, there are different classes of possible empirical connections: there are different levels of causation." (20) So-called nonempirical associations suggest great complexity and an inability to translate it into empirical terms. Thus, according to Wynne, (20) "conflicting tendencies exist between an extensive framework, which vainly attempts comprehensiveness but finds infinite complexity, and an intensive framework which creates false simplicity. There are no rules to say where a balance should be struck between these unacceptable extremes." Wynne argues that these differences in rationality are embedded in the social relations of decision making. For those who have no power to influence history, causal networks tend to be predetermined and extensive: causal associations "incorporate social processes which appear just as much beyond their participation as 'objective' natural or historical laws." (20) Unlike decision-making elites, these alienated people view evidence of official arrogance or incompetence as relevant to current, supposedly isolable, issues.
Furthermore, in practice, investigators have to reconcile conflicting data, speculate about the evidence provided by technical specialists, and sometimes overcome a lack of key information in order to make sense of an event. (17) These potential biases have led to an extensive literature on the distortion of the "truth" by the inquiry process. (43,44) Investigation is seen as an artisanal activity that "involves the skills of the bricoleur . . . not the deductive logic of the laboratory chemist." (13) However, the boundary between scientific activity and technical investigation vanishes as soon as scientific activity is situated in its material and social context. (45)(46)(47) In many respects, scientific "discovery" is a sociohistorical process of rearranging the meaning attributed to disparate elements in response to an event. The conclusions reached by scientists can resemble social negotiations that are based on extrapolated data, arbitrary assumptions, the political context, etc. (48)(49)(50) Therefore, like Toulmin, (27) we do not consider that an argument should be evaluated by exclusive reference to the rules of formal logic-those of syllogisms-but that its purpose is to justify an assertion, or defend a conclusion. Rather than attempt to analyze the commissions' reports in terms of the extent to which the argumentation follows "ideal" rules, we study how, from the infinite number of possibilities, the narrative sequence takes a succession of deductive paths that resemble scientific or technical rhetoric. (51) Latour (46) reminds us that literature is termed "technical" or "scientific" when it alienates the reader through external resources: references that are more or less clear, stratification that meets various objections, figures and images that "show" what is asserted. Different interpretations are lined up to create a "logical" line of argument that the reader is forced to go along with.
The attribution of "causes" and "effects" is the outcome of the sometimes unpredictable association (from the perspective of the observer) of heterogeneous elements: standards, reports, accounts, statistics, graphs, etc. The idea can be extended to all knowledge: our concepts are linked together in a network of generalizations. (45,52) In order to convince their audience, authors present themselves as a "reporter," relying in particular on images. "Pictures tend to have an unwritten, implicit heading along the following lines: '[ . . . ] what I have been saying [ . . . ] looks basically like this'." (53) The credibility of causal attribution therefore depends on "What points are linked to which other; What size and strength these links have; Who the most legitimate spokespersons are; And how all these elements are modified during the controversy." (46) The "root causes" of an accident are those points in the network that are summarized into conclusions and that, in turn, support recommendations for corrective action. Arguments are therefore neither logical nor illogical (is it a straight or a distorted path?), but "sociological" (is it a weaker or a stronger association?). (46) Reasoning is "scientific" when it weaves a dense and complex web of associations that is difficult to disentangle. However, this view is a matter of degree and, in extreme cases, links may be the outcome of simple statements by a third party. In this case, it is the epistemic authority of the speaker that lends weight.
The "causal" nature of a link can be inferred from the results of reproducible experiments, or derived from hypotheses underlying a mode of reasoning, as in the "ideal type" method. (54) For example, in an objectivist approach, such as the failure of foresight model, 1 there is an implicit assumption of an understandable reality that can prevent disasters. (55) A departure from this ideal leads to "irrational" behavior, which requires an explanation. (46) There is a shift towards a value judgment or dogma, when a statement is said to be nonnegotiable, and departures from this standard are put forward, in and of themselves, as the cause of failure.
In unraveling the threads that make up the network of justifications presented in the reports on the Fukushima Daiichi accident, we aim to highlight the doctrines that provide the framework through which knowledge is constituted and made to make sense.

METHOD
A detailed reading of the reports showed that it was necessary to specify the time period and purpose of the statements that were the focus of the study. The reports address events at the Fukushima Daiichi nuclear facility and, to a lesser extent, other plants. We focused on Daiichi as it was the only plant that suffered an "accident" within the meaning of the IAEA; material related to the other facilities was used when it provided a useful comparison. There were differences in emphasis regarding the events that happened in the reactors, the evacuation of residents, etc. As a lowest common denominator, we selected passages that described the situation at the site on March 11-15, 2011. After these dates, the reactors were considered stable. These passages make up the majority of the text and we took care to ensure that no important information was lost.
We then identified passages that constituted "proof" for these statements, in line with the theoretical framework discussed above, and inspired by Latour. (46) We therefore examined attributions of cause and effect based on a systematic inventory of the narrative elements that linked points together, reinforced these links, or fueled controversy. The unit of analysis was the sentence; we carefully examined every sentence in order to identify the associations they created.
It must not be forgotten that each report tells a story. The reader can be drawn in by stylistic dramatizations that spice up the text without adding any further links. Therefore, we also extracted rhetorical elements that were designed to convince, notably those that attempted to influence the opinion of the reader.
The following extract the from NAIIC's report (24) shows how the data were processed. It discusses the time when the tsunami hit the plant: It is also likely that the seawater pumps [153] in Units 1 to 4 did not stop due to flood damage from the first tsunami wave. The series of photographs taken at the time of the first tsunami wave [154] shows that the bottom part of the wall of the Unit 4 building on the 4m-high platform was still visible. According to a crewman on a ship that was in the harbor, and workers who sought refuge by moving from the eastern side of Unit 3 towards Unit 1, the wave did not completely pass over the breakwater from the eastern side.
The tsunami was, therefore, not the cause of the loss of the power in system A of Unit 1 . . .
[153] During the NAIIC hearings, someone said that he/she saw his/her PHS reading 15:39 at the parking lot underneath Shiomizaka on the north side of Unit 1, and that he/she went up Shiomizaka to escape from the second tsunami wave, which was 10 meters high.
[154] A series of 44 pictures released by TEPCO on May 19, including 11 pictures taken from the central waste treatment building located on the south side of Unit 4.
Here, the footnotes are the source of information used in the argument and were coded as "references," labeled respectively "Hearing with workers" and "Site pictures (TEPCO report)." In the main text, the testimony of the crewman is used to support the argument, and is coded as well as a reference (labeled "Hearing with crewman"). These references provide support for the claim, "the first wave did not stop the pumps," which corresponds to the first sentence in the extract (highlighted in bold). This claim, together with the conclusion held in previous paragraphs that the second wave hit the plant after the loss of alternating current, supports the conclusion, "the tsunami did not cause the station blackout" and corresponds to the last sentence of the extract (also shown in bold).
These associations were systematically recorded for all reports using NVivo software. This qualitative data analysis software makes it possible to examine, and manually label, a huge volume of documents.
Our data set is therefore very specific: it consists of sentences written by humans in order to convey a message, although we cannot be certain about the meaning of this message. Words often have many meanings; they can be ambiguous and contextdependent, even in official reports that are written for a broad audience rather than a limited linguistic community. Coding therefore involved a multidisciplinary team. This strategy was based on the assumption that the comparison of different points of view would lead to a shared understanding of an assertion that was closest to the meaning intended by the writer. Ultimately, a qualitative researcher can be characterized as a "critical bricoleur" who "stresses the dialectical and hermeneutic kind of interdisciplinary inquiry." (56) This inventory enabled us to draw up maps of chains of associations ( Figs. 1 and 2) that represented cause-effect statements within the network of points that they are linked to, and that constitute proof. We designate them as "sociological maps." As the IAEA report only presents the results of its audits, and does not look at the accident scenario, it was not mapped. However, its analysis, using the method described above, shed light on the work of Japanese commissions that explicitly refer to it.
To facilitate the presentation of the results, the sociological maps indicate the nature of the link. Following Goldberg, (35) we distinguished two types of causal links that were particularly apparent in the narrative. The first concerns links that are supported by academic knowledge or common experience. These links apply to circumstances that are limited in time and space and put actors (nonhuman) into direct relation through a "tight" narrative. The second concerns links between generic, institutional objects that are a timeless intermediary in the relations between actors. For clarity, we highlighted both causal links that are characteristic of an objectivist perspective (failure of foresight), and others that reflect a departure from moral standards. Details of the types of links are given in Table II.
We also ensured that the conclusions of the reports were consistent with elements presented in the maps, and that the recommendations were based explicitly on these conclusions.
The maps make it possible to visualize the architecture of the arguments that were deployed, and identify controversial points. A comparison of the maps highlighted the different weightings given to the available data, and the implied inflections in the line of reasoning. Differences in these chains of association create different connections between the sequences of "physical" damage and "organizational" considerations. We then paid particular attention to sections that summarized arguments (chapter summaries, conclusions, etc.). These passages bypass step-by-step argumentation, and juxtapose statements about the organization (notably managerial decisions) alongside others that relate to damage. In effect, they present a bet about the future alongside a posteriori observations that necessarily refer to the societal significance of the accident. Such statements are likely to be value judgments, (57) manifested in stylistic effects.
The approach allowed us to demonstrate the correspondence between the causal pathways described by the investigators, and their moral interpretation of the accident, which added an ethical element to the scientific controversy.

RESULTS
The ICANPS and NAIIC "sociological maps" of the explosion in reactor building 1 are presented in Figs. 1 and 2, respectively (some references were summarized). The maps show all of the causes of the accident put forward by the two commissions. Subsequent events were largely due to the difficulties created by the initial explosion of building 1.
Assertions that show the progression of the argument as a function of cause-and-effect relationships appear in boxes, while the supporting references are directly linked to them. Abbreviations related to the links are listed in Table II; the remainder are listed in Table III. The density of references reflects the emphasis that a commission sought to give to an assertion. Controversial elements are shown in bold. A striking property of the arguments shown in these diagrams is the existence, in both cases, of a "central node," towards which most of the "organizational" causes converge, and that is the origin of the damage. These nodes are highlighted.

Scientific and Technical Controversy
According to the government commission (ICANPS), the accident was caused by an earthquake and tsunami that were "beyond assumptions," an assertion that corresponds to the central node in Fig. 1. The earthquake destroyed external power sources and internal generators took over. From the recorded parameters, and in the absence of any evidence to the contrary, the investigators concluded that backup equipment operated nominally. Next, the tsunami swamped the seawall and flooded the plant's buildings. Emergency power generators were flooded and most of them became inoperative, resulting, by design, in valve closures in the isolation condenser (IC) cooling system in reactor 1. Core fusion quickly followed. Using a fault tree analysis, the investigators concluded that the hydrogen generated by the fusion flowed into damaged pipes, then exploded. This sequence of damage is outlined horizontally in the top-right part of Fig. 1. The commissioners compared this sequence to the events that unfolded at Fukushima Daini. 2 They concluded that Daiichi operators were insufficiently prepared to manage a station blackout of such a magnitude and were unable to contain the unfolding accident; a situation that contributed to the progression of the sequence of damage, as shown in the vertical causal tree starting from the bottom-right part of Fig. 1.
Furthermore, regarding causal factors upstream of the central node (the left-hand side of Fig. 1), the government commission considered that the situation was not "unplannable" but "poorly planned," According to the ICANPS Commission, TEPCO and government authorities had based their safety hypotheses on overly restrictive assumptions when evaluating protection measures, the location of critical equipment, and operator training, notably regarding the risk of a tsunami. Safety tradeoffs had been justified by rational cost considerations. Their calculations had relied exclusively on quantifiable elements that were the subject of a consensus in order to reach a decision-despite the debate in the scientific community that had started in 2002 regarding a potential tsunami off the coast of Fukushima. The Commission attributed the failure to the operator's lack of "safety culture." Finally, oversight authorities had limited resources and were urged to enforce the standards that were implemented following the 2007 earthquake. The Commission concluded that authorities were unable to incorporate new IAEA standards for the management of severe accidents, 3 and that their directives were de facto insufficiently rigorous with respect to the industry.
For its part, the NAIIC Commission broke the tsunami-station blackout-accident link (shown in bold in Fig. 1), suggesting that the ICANPS arguments were irrational. The Commission compared records of reactor parameters with the arrival time of the tsunami, and concluded that backup generators were already inoperative before the tsunami hit. They argued that the ICANPS Commission had failed to take into account the distance from the coast of sensors at sea level in their estimate of when the wave arrived. In its alternative scenario, the NAIIC emphasizes the damage caused by the earthquake. The Diet's Commission claimed that on-site seismic sensors did not record any beyond-design stresses; however, there were no measurements from building 1 from the time shortly after the earthquake began. The possibility could not therefore be excluded that subsequent aftershocks were beyond-design, causing small cracks in the pipes of emergency cooling equipment.
The Commission drew upon the lessons learned from the accident at Browns Ferry (59) -which involved the same type of reactor-to suggest that the IC pipes of reactor 1 burst, which would have caused the irremediable loss of coolant (a loss of coolant accident; LOCA) and core fusion. The corresponding sequence of damage is shown horizontally in the bottom-right of Fig. 2. In order to bolster support for the scenario of the rupture of the emergency IC cooling pipeline, the NAIIC developed a two-fold argument. First, the Commission outlined the results of a simulation of seismic activity, which showed that the frequency of aftershocks at building 1 was beyonddesign. Second, using a simulation of reactor parameters based on several types of IC pipeline leaks, the investigators noted that there was no evidence to contradict the hypothesis of a small crack caused by the earthquake. They therefore concluded that the root causes of the event were linked to a failure to strengthen the infrastructure in the light of new scientific knowledge about earthquakes published in 2006. This assertion is expressed in the central node of Fig. 2. Echoing the conclusions of the accident at Three Mile Island, (60) the commissioners linked their analysis of the "causes" of this situation to the operator's attitude, its denial of the real level of risk, and the complacent supervision of incompetent authorities (see the tree structure on the left-hand side of Fig. 2, upstream of the central node). NAIIC therefore concluded that it was a "man-made disaster." In response, in its final report, (22) the ICANPS Commission weakened the conclusions of the Japanese Diet by referring to the intrinsic limitations of simulations and their sensitivity to initial conditions.

An Ethical Conflict
The reasoning found in these reports combines two types of arguments. On the one hand, a meticulous examination of the "facts" addresses isolated technical issues relating to circumscribed situations in time and space. These are shown on the righthand side of Figs. 1 and 2. On the other hand, the commissioners attempt to take a broader perspective and link the ramifications of technical issues to an institutional machinery that took poor decisions. These arguments are shown on the left-hand side of Figs. 1 and 2. The scientific controversy concerns principally the "central nodes" of these arguments (highlighted in each figure), which form the transition between the two sets of explanations, and can be expressed as "prevention measures were insufficient given the risks highlighted by the available knowledge." In both cases, the investigators emphasize, as principal driver for the sequence of damage, the lack of foresight of a risk for which scientific knowledge was available, suggesting that the appropriate handling of this risk could have prevented the accident. However, the two commissions diverge regarding the nature of the principal risk that should have been taken into account. According to ICANPS, the main challenge was to estimate the risk of a tsunami; for the NAIIC, it was an earthquake.
The accident is therefore understood through an objective, failure of foresight type representation, which both gives a sense of control (30) and immediately excludes the sociohistorical processes that governed decisions and subsequent developments. (20,28) 4 Naturally, once it had been demonstrated that the earthquake and/ or tsunami rendered emergency equipment inoperative, and given that research did not exclude such a risk, it became "logical" to conclude that if greater weight had been given to strengthening the infrastructure, the accident could have been prevented.
However, it was impossible to know when such an earthquake might occur. What would the conclusions have been if it had occurred in 2000, when the results of research into a potential natural phenomenon of a magnitude of that of March 11, 2011, were not available? Had this happened, it would no longer be possible to claim that the "cause" of the accident was the failure of the operator or authorities to take into account scientific knowledge. But does the same type of argument not lead to the conclusion that, in this case, scientists were to blame, in that they did not provide the knowledge necessary to understand a major risk that, moreover, could be studied? In reality, this type of argument cannot "explain" the accident as it does not hold if the time window is changed. 5 This highlights its "sociological" nature. (46) It then becomes necessary to identify the social issues that underlie the technical controversy, which is anchored in the central nodes of the arguments.
The incomplete state of knowledge about tsunamis inevitably opens up a debate about the uncertainty of probabilistic calculations of safety in general and, in particular, the predictability of the tsunami-station blackout-accident sequence put forward by the ICANPS. It raises the question of the extent to which risk assessments, ostensibly based on "objective" elements that rationalize prevention investments, are acceptable. The problem is formulated by the ICANPS in the following question in its conclusions: The process of the government's decision-making . . . was reasonable to a certain extent when the logical framework of government administration is taken into account. However, faced with the reality that well over 100,000 people were forced to evacuate . . . , can the government walk away simply by saying that . . . there was nothing they could have done more because this major earthquake and tsunami were "beyond assumptions"? If so, no lesson useful to create a safe society can be learned. (22) Although the ICANPS does not exclude economic rationalization in its conclusions, it recommends adopting a critical perspective that takes into account potential victims. The NAIIC circumvents the problem by suggesting that the sequence of events was determined by the earthquake. It is clear that scientists knew more about earthquakes than tsunamis at the time of the accident. Although an earthquake of the magnitude of the one that hit in 2011 had not been considered in northeast Japan, resistance thresholds had been defined, then reassessed (in 2006), and the facility's compliance was due to be audited. The NAIIC criticized both the limited scope and the length of time needed to implement these measures (notably for reactor 1). It argued that the inescapable link between the failure to strengthen the infrastructure, the earthquake, and the rupture of the IC pipeline that led to the nuclear accident was a dramatic demonstration of the incompetence of the operator and its management, who failed to take action in the face of risk. This is reflected in its conclusion: There were many opportunities to take preventive measures prior to 3.11. The accident eventually occurred sible by at least one of these means: . . . Retell the same story but frame it differently by letting it go longer. This reframing usually renders most of the 'explanations' unusable because, given the right time scale, these explanations are offered for contrary examples as well." before the implementation of any such safety measures because the successive regulatory authorities as well as TEPCO management teams intentionally postponed, failed to act and made decisions in the self-interest of their organizations. (24) The scientific controversy therefore revolves around a posteriori differences in the assessment of prevention measures prior to March 11, 2011, i.e., the social acceptability of the accident. The central nodes in these arguments therefore form the keystones for an ethical interpretation of the event.
In terms of reasoning, the central nodes "translate" failures that can be explained by the laws of nature into a departure from a management ideal. Organizations are analyzed by reference to this ideal. The psychosocial mechanisms underlying decisions are hidden and the relationships between actors are mediated by the institution. The testimony of senior managers is said to be indicative of the values that guided the institution, while their words highlight how such values are inconsistent with others deemed to ensure safety (subsumed into the concept of "safety culture"). Moral disapproval of this inconsistency finds its strength in the force of its relationship to the damage as established by the "logical" sequence of the arguments. From this point of view, the measured style of the ICANPS Commission can be compared to the vehement rhetoric of the NAIIC, which repeatedly and severely admonishes TEPCO and the authorities. 6

Epilogue: the Epistemic Authority of the IAEA
Despite their differences, the two commissions concluded that there were similar organizational causes. They agreed that there was a "poor level of safety culture" at the operator and that authorities lacked resources, independence, and transparency (the result of poor compliance with international safety standards). All of their recommendations for corrective action (except one, see below), are based on causal patterns described in their reports, and most aim to reform the system in order to implement international standards.
This reflects the epistemic authority of the IAEA, custodian of fundamental safety standards. For instance, both commissions explicitly refer to the 2011 audit by IAEA experts, which concluded that "the IAEA Fundamental Safety Principles provide a robust basis in relation to the circumstances of the Fukushima accident and cover all the areas of lessons learned from the accident." (10) It should be noted, however, that at the time these experts did not know the details of how the accident unfolded. The IAEA therefore appears to be an "international knowledge institution" (61) of the first degree.
We note here that the NAIIC recommended that it was appointed as guarantor of the new system. This recommendation cannot be deduced directly from the report. However, it is echoed in the introductory remarks in which the Commission emphasizes the value of its independent approach under the aegis of the Diet. The NAIIC thus bases its legitimacy on an inquiry that found a new interpretation for the accident (which "proves" its independence) and discredited the government institution as a whole. The parliamentary commission thus underlines that only a representative body can ensure the foundations of the societal order, that is, prevent the unacceptable.

DISCUSSION AND CONCLUSION
We have shown that: (1) postaccident reports are based on the assertion that the risks associated with tsunamis and earthquakes were underestimated; (2) however, successive reports fed a technical controversy about what was the principal risk, which had, moreover, been underestimated. For the ICANPS, the accident was the direct result of the flooding of the facility by the tsunami, while for the NAIIC, the earthquake damaged the facility to the point that the fusion of reactor 1 was inevitable; (3) this technical controversy reflects the different in emphasis that was given to arguments that linked damage to the various prevention measures that could be foreseen prior to March 11, 2011;(4) the outcome was that the controversy masked an ethical difference in the assessment of the social acceptability of the accident, given the need to anticipate risks as a function of the costs and available knowledge; (5) however, neither commission provided a detailed analysis of organizational mechanisms that determined safety management, while both recommended the application of IAEA standards; and finally (6) the Diet used the discred-ited ICANPS Commission to position itself as the guarantor of social order.
The argument that technical failure could have been anticipated corresponds to an objectivist perspective. Since it relies on a sense of control, this point of view is conducive to moving the focus from a technical analysis towards a moral assessment of the decisions taken by the authorities or the operator. Such a shift is unsurprising in the circumstances immediately following the accident, as research has shown that the Fukushima accident resulted in moral judgments and scapegoating mechanisms. (62) Whatever is the case, this construction is notable for its robustness. If it is believed that mankind can correctly formalize problems that may otherwise thwart action, and consequently respond "rationally," in the case of failure it is normal to invoke the lack of such a formulation. The correct formulation of risk is raised to the status of a dogma that, it if is not followed, becomes socially unacceptable in the case of an accident.
However, the mere possibility of such a formulation is not straightforward. The Fukushima accident raised questions about policy based on a scientific assessment of the facts. The fragmented state of knowledge about earthquakes and tsunamis created a gap between what it was possible to calculate from objective data, and the actual risk that was made tangible by the event. The probability distribution of an earthquake or tsunami off the coast of Fukushima can now be calculated in order to predict the next occurrence of a similar event. But the situation that the operator and authorities faced before the accident was different. The very existence of a probability distribution for such phenomena was in question. A similar issue is raised in the work of Weinberg, (63) who studied probabilistic calculations of nuclear safety. Statistics, he argued, are classed as "science" when they rely on past experience, while calculations associated with an event that has not yet been observed are relegated to the domain of "trans-science." The Fukushima accident reminds us that this dichotomy lacks foundations: (64) by becoming actual, an event of the kind that happened on March 11 literally wiped out all previous safety calculations.
The commissions put forward various solutions to address these problems. According to the ICANPS, authorities and the operator would have had a clearer perspective if they had taken into account the potential victims of their decisions, in order to assess the uncertainty of their predictions. However, probabilities are devoid of human value; all possibilities are understood to be equal and anything that cannot be assigned a number is simply "out of scope." (57) It is only a posteriori that a decision may seem unacceptable. In contrast, the adoption of precautionary measures in response to uncertainty assumes that there is a reference point from which issues are prioritized. Therefore, the ICANPS report mixes two epistemologically irreconcilable dimensions, namely, a probabilistic assessment of the future, and value judgments. On the other hand, the NAIIC bases its analysis on a purely deterministic description of the sequence of events, and thereby avoids the question of the role of science in risk governance. The risk was, it said, "obvious." The controversy seems sterile; it does not lead to a clear statement of the fundamental problem. The debate is rooted in technical considerations that are circumscribed by the scope of international standards. For example, both commissions recommend adopting the IAEA's severe accident management guidelines, but neither addresses the question of how to begin thinking about such measures; managing an accident that is "beyond-design" means, effectively, considering all scenarios, even unthinkable ones.
Other authors have already underlined that the Fukushima debate has not shaken the foundations of risk management standards. Downer, for example, argues that "[p]roponents of nuclear reliability calculations . . . have routinely found ways to 'escape' from being tarred by evidence of their apparent failures-ways to maintain their credibility . . . ." (14) These legitimation mechanisms include a discourse that rationalizes the accident as an exceptional event, notably due to specific geographic characteristics, or a laxity in complying with standards.
If such narrative frameworks are found in the conclusions of the reports of the ICANPS and the NAIIC, reducing the investigations to an exercise in the legitimization of experts appears reductive. On the one hand, the Japanese commissions were composed of various prominent actors in civil society (although naturally, this does not guarantee their integrity). On the other hand, and more importantly, the interpretation of the accident gave rise to a controversy that very clearly revealed the limits of expertise in nuclear safety. As we have seen, the ICANPS acknowledged the uncertainty of probabilistic estimates. The Commission proposes a compromise between expert evaluations and societal requirements, even if it does not go so far as to question the possibility of implementing severe accident prevention measures, in other words, accidents that "cannot be calculated." This controversy has stigmatized the entire Japanese nuclear industry. Moreover, even if other countries may be able to use Japanese cultural or geographical exceptionalism as a way to reassure their populations, it is difficult to see how this argument could be applied in Japan itself. To carry any weight, the argument must be based on an external standard that Japanese society aspires to comply with. In the end, giving experts the inordinate power of framing the accident after it happened and containing any societal questioning of the fundamentals of risk management seems to suggest an instrumental form of reasoning that resembles that which the authors of such arguments intend to discredit.
To shed better light on the dynamics at work, we refer to the social ontology of Castoriadis, (65) who argues that social significations embodied by institutions find their origin in the imaginary and socialization mechanisms. These "social imaginary significations" are expected be able to anticipate all of the circumstances in which society might encounter a radically different reality, in such a way that the question of their "validity" cannot be posed. "The exclusion of such a question is ensured by the position of a transcendent, extrasocial, source of the institutions and significations." (65) In this way, "human beings can project themselves, go beyond themselves, as it were, in order to exert a power over themselves." (66) We argue that the social position of the IAEA is an example of such auto-exteriorization. The IAEA puts forwards its recommendations and establishes safety standards from an "extraterritorial" point of view, and these standards serve as a framework for national bodies to study the accident and learn lessons. Moreover, according to Jasanoff and Kim, the introduction of the IAEA contributed to the construction of a "sociotechnical imaginary" designed to contain fear, and based on what appears to be a form of auto-exteriorization: in his speech to the United Nations in 1953, U.S. President Eisenhower said: "Looking outward to the General Assembly, he invited support for multilateral supervision of the peaceful uses of fissionable materials, through a new International Atomic Energy Agency." (67) Hamblin (34) goes further, underlining the "exterior" position that the IAEA was keen to defend; its Director General declared, after Fukushima, "I explained that we are not a 'nuclear safety watchdog' and that responsibility for nuclear safety lies with our Member States."