Malpasset: The Best Engineer In Europe Was Wrong, And Nobody Could Tell Him

At 9:13 in the evening on December 2, 1959, the Malpasset Dam in the south of France gave way. It was a thin double-curvature arch dam, one hundred and ninety-five feet tall, holding back a reservoir on the Reyran River above the city of Fréjus. When it broke, the entire reservoir released within minutes. A wall of water more than a hundred feet tall reached Fréjus in twenty-one minutes. Four hundred and twenty-three people died. One hundred and thirty-five of them were children under fifteen.

The engineering verdict came in over the following decade. The dam itself was a remarkable piece of design. The failure was in the foundation: the schist below the left abutment had a layered structure that allowed water pressure, under load, to wedge open a sliding plane no one had identified during the geological investigation. The dam did not break. The mountain underneath the dam broke. The dam came with it.

That is the engineering story. It is true. And like every story in this series, it is beside the point.

The man who designed Malpasset was André Coyne. He was, by 1959, the most respected dam engineer in Europe. His thin arch designs were studied in every engineering school on the continent. He had built dozens of dams on three continents, none of which had failed. He was sixty-eight years old, the president of the International Commission on Large Dams, and at the absolute peak of a long and brilliant career.

He died nine months after Malpasset failed.

The Failure Mode That Has No Name.

There is a failure mode that runs through one engineering organization after another. It does not appear in the dam safety textbooks because the profession has not given it a name.

Call it track record bias. When an engineer, or a firm, or a regulator, or an entire national engineering tradition, has built many things successfully, the next thing they build inherits an unspoken assumption: we know how to do this. The investigation gets a little shorter. The geological scope gets a little narrower. The reviewer pushes back a little less, because pushing back on the most successful designer in the field looks, from the inside, less like rigor and more like impertinence.

Coyne's arch dams had worked. They had worked beautifully, for decades, on foundations that were sometimes worse than Malpasset's. There was no specific moment when anyone decided to do less geological investigation than the project deserved. There was a slow, accumulating institutional confidence that the design philosophy itself was the safety case. The schist did not care about the design philosophy.

I want to put this as plainly as I can, because it is the most counterintuitive lesson in dam safety and also the most important: a great engineer is more dangerous to the system around him than a mediocre one. Not because the great engineer is wrong more often. Because the people around the great engineer challenge him less. The mediocre engineer has reviewers reading every page. The great engineer has reviewers signing the cover sheet.

The Inability To Hear Bad News About Your Own Work.

Here is the part of this that the profession does not like to talk about. Any firm with a long enough run of project successes will, sooner or later, develop a quiet allergy to critical feedback at its top. Not from arrogance. From data. Every quarter the numbers say what we are doing is working. The cost of taking criticism seriously is real, it slows you down, it forces rework, it costs money. When the track record is good, that cost feels less and less justified.

The firms that avoid their own Malpasset moment do so for the same reason. Someone in the organization is willing, at least twice a decade, to put a piece of paper in front of the most senior engineer in the room that says this one is different, and you are not seeing it. And the senior engineer reads it instead of waving it off.

This is what is missing in the standard recounting of Malpasset. We say Coyne's investigation was insufficient. That is true. The harder question, the question the profession does not like, is why the system around the most accomplished dam engineer in Europe did not produce a person willing to look him in the face and say I think you are wrong about this site. The answer is that systems do not produce such people by accident. They produce them only when an organization, deliberately, makes it survivable to be that person.

Three Questions.

For owners: think about your most senior engineer, the one whose judgment you most trust. When was the last time their judgment was directly challenged in writing by someone in your organization? If the answer is "never," your most senior engineer is your highest-risk asset, not your lowest.

For engineers: think about the project of yours you are proudest of. Now imagine it is wrong in some way you have not yet seen. What kind of person, in your organization, would notice that, and what is their professional incentive to tell you? If you cannot answer, you are André Coyne, and your career has not yet hit Malpasset.

For regulators: when you review a design from a firm with an unblemished track record, is the depth of your review the same as it would be from a firm you had never heard of? Honest answer. The schist did not check Coyne's credentials.

The Good News.

Here is the good news, because this is DamNews. The thing that failed at Malpasset is the thing that fails the very best engineers, not the worst. That is, paradoxically, a hopeful piece of information. Bad engineering is rare in our profession; we have screened it out reasonably well over the last century. What we have not screened out, what we are not even, most days, designed to screen out, is the slow erosion of the assumption that we might be wrong about the things we know best.

You can install that capability in a small organization, on a Tuesday, by promoting the practice of telling senior engineers they are wrong and noticing what happens to the careers of the people who do it. If the careers go up, you have a Malpasset-resistant organization. If they go sideways or down, you have a Malpasset-vulnerable one. The schist will come, eventually, on some project. The only variable is whether anyone in your organization will be in a position to see it before it moves.

Coyne deserved his reputation. The system around him did not deserve the trust he was given. Both things are true. And only one of them is something we can change this week.