What to Do After a Tailings Dam Risk Assessment

After a tailings dam risk assessment, and before anyone relies on the stability sign-off, write down which changes in conditions would make it wrong and name who watches for them.

In September 2018, TÜV SÜD's Brazilian unit signed a declaration that Vale's Dam I at Brumadinho was stable. On 25 January 2019 the dam collapsed and killed 270 people.

A tailings dam risk assessment estimates how likely an embankment is to fail and what it would release, expressed through stability analyses, factors of safety and a stability declaration.

Vale's Dam I carried its September declaration into a heavier wet season

Dam I sat above the Córrego do Feijão iron ore mine near Brumadinho, in Minas Gerais. It was built by the upstream method over 37 years in ten raises. No raise was added after 2013, and tailings deposition stopped in July 2016. By 2018 it was an inactive structure holding loose, saturated tailings behind a steep face.

TÜV SÜD signed stability declarations for the dam during 2018, the last dated September. The state parliamentary inquiry in Minas Gerais later reported that the analysis behind them gave a factor of safety of 1.09, against the 1.3 that Vale applied at its other dams and that the inquiry called the international recommendation. Reuters separately reported an internal Vale document from October 2018 that placed the dam in an "attention zone", with an estimated failure probability twice the company's tolerable maximum.

The declaration also sat alongside a drainage plan. From March 2018, deep horizontal drains were installed to lower the water level inside the embankment. On 11 June 2018, drilling for the fifteenth drain lost pressure, mud flowed from the borehole and seepage appeared nearby; piezometers close by rose by up to 3.5 metres. Drain installation stopped. The Expert Panel report records the incident. The state inquiry found that Vale did not correctly inform the national mining agency of its scale.

From October 2018 the wet season brought rain the Expert Panel described as higher and more intense than in the previous several years. Over the same months nine boreholes were drilled in the central and upper dam to install instruments, and a rig was drilling in the upper part of the dam when the dam failed at about 12:28 pm. The slope collapsed in less than ten seconds. About 9.7 million cubic metres of tailings left the impoundment in under five minutes.

The panel, commissioned by Vale and reporting in December 2019, found flow liquefaction of brittle tailings in a marginally stable dam. It attributed the trigger to a critical combination of internal creep and loss of suction from the late-2018 rain, and concluded that the drilling on the day would not have triggered the global failure. A declaration signed in September could not describe the rain of December.

The monitoring record is where sources part. The Expert Panel reported that survey monuments, inclinometers, ground-based radar and piezometers detected no significant deformation or change before the failure, and that small movements seen later in satellite images were consistent with settlement. Grebby et al. (2021) reanalysed satellite radar data and found deformation in parts of the dam wall and tailings that was inconsistent with settlement, with a sudden acceleration in the final two months. The state inquiry went further and found that Vale disregarded alerts from automated piezometers and radar.

The disagreement is instructive for anyone holding a signed assessment. Whether a reading counts as a warning depends on a threshold agreed before the reading arrives. Agreed afterwards, the same numbers become an argument among experts. Naming those thresholds is the same work as surfacing the assumptions behind a decision before it is taken.

Find the water level your factor of safety was calculated on, and write down the piezometer reading that would send the dam back for reassessment. Start the Walk →

What does a stability declaration actually certify about a tailings dam?

A tailings dam risk assessment does real work. Site investigation, cone penetration tests, piezometer records and stability analyses turn a mound of saturated waste into numbers an engineer can defend. The factor of safety compresses that work into one figure, and the declaration turns the figure into a yes or no a regulator can file. At Dam I the pre-failure investigations were detailed enough for the Expert Panel to rebuild the dam's internal layers in three dimensions.

That precision is also the limit. A factor of safety holds for the water level, strengths and loads assumed in the analysis. The declaration inherits those assumptions without restating them. It certifies the dam as analysed, then travels into board papers and regulatory files as a statement about the dam as it is. The same slippage follows a structural risk assessment, where an engineer's rating gets read as a deadline it never set.

Four assumptions carry most of the weight in an upstream dam: the phreatic level inside the embankment, the drainage expected to hold it there, the rainfall case analysed, and the absence of disturbing works on the slope. Deformation rates treated as normal are a fifth. At Dam I, the drain program meant to lower the water level had stopped in June, months before the September declaration was signed.

None of this makes the assessment worthless. It makes it dated. Most of what the risk assessment discipline produces has the same property, and a certificate issued on audit day carries the same risk. An assessment that cannot say what would change its answer has no way to expire.

Writing the reopening triggers before the next declaration is signed

The artefact to check is the trigger list attached to the stability declaration, or the trigger-action-response plan (TARP) behind it. If neither exists, start from the assessment's stated assumptions: the phreatic level used in the analysis, the drainage it counted on, the rainfall case, the loads on the embankment and the deformation rates treated as normal. Each assumption needs a number beyond which the declaration is treated as open.

The Global Industry Standard on Tailings Management, published in August 2020 by ICMM, UNEP and PRI, now asks for this. Requirement 7.4 says performance outside expected ranges "shall be addressed promptly through Trigger Action Response Plans (TARPs) or critical controls". Requirement 6.5 calls for a change management system that triggers review of changes to design, construction, operation or monitoring.

Requirement 7.2 draws a line that fits Dam I. The observational method applies to non-brittle failure modes; brittle modes are addressed by conservative design criteria. For a brittle dam, the useful triggers sit upstream of any deformation reading. A factor of safety below the design criterion, a drain program abandoned, a water level that does not fall: those readings reopen the question before the slope has anything to show.

That figure, reported by Al Jazeera as about US$7 billion, came on top of 270 deaths. Check the trigger list at two points: before the next stability declaration is signed, and before any drilling, drain installation or other works on the embankment are approved. Both are moments when someone is about to rely on the old answer. The question at each is plain: has any assumption behind the last analysis moved past its trigger, and who has authority to hold the signature?

A risk register entry reading "dam stable, next review due" answers neither. The method treats monitoring as part of the decision, set before it is taken rather than bolted on after. Decide what would change the answer before relying on it.

Grant Purdy is the co-author, with Roger Estall, of Deciding (2020), and the architect of the Universal Decision-Making Method.