Tailings Dam Safety
Management and Regulations

Before getting into regulation and governance and all the rest of it, the technical problem needs to be understood on its own terms, because the technical problem is strange and specific and it explains why regulation has been so difficult.

A water dam holds water. Predictable load. A tailings dam holds a slurry mixture whose geotechnical properties change as the mine operates. The orebody composition shifts quarter to quarter. The processing plant adjusts reagent dosing. Deposited material consolidates under its own weight at rates depending on drainage conditions depending on where the pond sits, which depends on how operators managed spigotting last year. Everything couples to everything else. A dam designed correctly at year one can be operating outside its design envelope at year ten because the material put into it by year seven bore little resemblance to what the designers assumed.

And the number that governs whether any of this ends in catastrophe is the undrained shear strength of the tailings adjacent to the embankment face. That number comes from borehole samples. Thirty or forty boreholes across an impoundment covering hundreds of hectares. The tested volume relative to the total volume that the stability analysis purports to describe is absurdly small. When deposition has been uneven, when spigot locations have moved, when the pond has wandered around the impoundment because of operational convenience, the strength assigned to the critical zone is an interpolation across gaps large enough to hide a completely different material. The stability report shows a factor of safety of 1.5, calculated to two decimal places. The input that controls whether that number means anything was estimated from data points separated by hundreds of meters.

The compliance framework measures the process. The dam responds to physics. The two are connected only to the extent that the process captures the physics, and the process has large blind spots that the regulations do not acknowledge.

Sulfide-bearing tailings add a time dimension to the problem that makes it worse in a way most engineers outside the tailings specialty do not fully appreciate. Sulfide oxidation generates acid. Acid dissolves cementing bonds between particles. A tailings mass that tested as stiff at year five loses cohesion at the microstructural level over the following decades. Stability analyses done at closure rely on strength parameters that may not hold twenty years later because the chemistry has changed. Modeling this coupling over multi-decadal timescales is rare. The tools are immature. Running the analysis might produce answers requiring expensive interventions.

Most regulatory frameworks treat tailings dams as a subspecies of water dams. Mining ministries handle permits. Environmental agencies handle discharge. Occupational safety bodies handle worker protection. Post-closure responsibility lands with another department, or no department. A single dam can fall under four agencies, none of which sees the full picture.

The Global Industry Standard on Tailings Management, published in 2020, tried to fix this at the corporate level. It introduced the Accountable Executive, required independent review boards, mandated closure planning from day one. It is voluntary. The mid-tier operators mining in jurisdictions with weak enforcement, the ones where risk concentrates, have been slow to adopt it.

Here is the part that usually gets left out of articles about tailings regulation. A regulator can have excellent laws on the books and accomplish nothing with them if the inspectorate cannot evaluate what the operator submits. In many jurisdictions the mining inspector understands pit slope stability or ventilation design. That inspector has never run a three-dimensional limit equilibrium analysis with anisotropic shear strength and pore pressure fields from sparse piezometric data. The operator submits a stability assessment. The inspector receives it. Files it. Cannot question it.

Brazil moved toward personal criminal liability after Brumadinho. When the person who signed the stability certification faces prosecution, behavior changes upstream of the signature in ways that corporate fines never achieve. Whether other jurisdictions follow depends on their politics.

In January 2019, an upstream-raised dam operated by Vale S.A. collapsed without warning. Approximately 12 million cubic meters of tailings released in a flow reaching Vale's own cafeteria and administrative buildings within seconds. Two hundred and seventy dead. The dam had been inactive, receiving no new tailings. It was being monitored. Internal documents that emerged during the criminal investigation showed Vale personnel knew about elevated pore pressures and drainage deficiencies. The stability certification, required by law, had become contested among the consultants involved. TÜV SÜD issued it. Brazilian prosecutors charged TÜV SÜD employees with fraud, alleging the certification was issued despite knowledge the dam did not meet criteria.

The organizational mechanism at Brumadinho repays detailed examination because the same mechanism is operating at facilities right now.

Information about the dam's condition moved upward through a chain where each level had reasons to dampen the signal. Site-level personnel flagged anomalies in technical reports. Regional management was managing costs. Corporate was managing Vale's reputation and share price after Samarco, in which Vale was co-owner. Each level summarized, contextualized, softened. Not falsified. Softened. By the time information reached decision-makers with the authority to halt operations, it no longer sounded like an emergency. It sounded like a technical matter being handled.

The design is good. It works only if "unfiltered" is enforced. If site management summarizes before passing data upward, if technical reports are translated into management-friendly language that strips out the specifics that would alarm a geotechnical specialist, the filtering is where the problem migrates and the Accountable Executive becomes a title holder rather than a safety mechanism.

Mount Polley in British Columbia, 2014. A downstream-raised dam. The upstream bans enacted after Brumadinho would not have prevented this one. The independent review panel found a weak glaciolacustrine layer in the foundation that had not been adequately identified during original site investigation. Limited boreholes. The design assumed the foundation was stronger than it was. Successive raises proceeded over years without anyone going back to re-examine whether the original foundation model still held under the increased loading.

No one person was negligent. The failure accumulated. Each raise relied on the adequacy of the previous design basis. Each consultant who worked on a phase inherited the assumptions of the previous phase. The chain of dependency grew longer and more fragile, and it grew invisibly, because each individual link was defensible in isolation.

The Engineer of Record concept exists to catch this. One engineer or firm maintains involvement throughout the dam's life, holding institutional memory. In practice, Engineers of Record get replaced. An unfavorable geotechnical opinion is followed by the engagement of a different consultant. The new firm reviews data without the longitudinal context the previous one had. Three or four firms cycle through a facility over its life. Each produces competent work. None holds the thread.

For the concept to work, the appointment must be a governance decision at board level. Replacement must require regulatory approval. Treated as a procurement decision, which it usually is, it has no force at all.

Vibrating wire piezometers are the workhorses of tailings dam monitoring. They have a service life. After ten to fifteen years, failure rates climb steeply. On a twenty-five-year-old facility, half the original array may be dead.

The monitoring network loses its eyes in the zones that matter while continuing to see clearly in the zones that do not. A report saying all operating piezometers read normal can be accurate and misleading at the same time.

Dry season bias compounds this. Inspections happen when weather is good, the dam face is accessible, everything looks presentable. Seepage anomalies, soft spots, wet patches are wet-season phenomena. An annual inspection conducted in the dry season is examining the dam under the conditions least likely to reveal distress. The regulatory requirement says "annual." It does not say "during or immediately after peak hydrological loading." That omission is not trivial.

A Trigger Action Response Plan organized around failure modes can bridge the gap between data and decisions. For each credible failure mode, what precursors develop, what instruments detect them, what thresholds trigger what actions. The other kind of TARP, a spreadsheet of thresholds without the failure-mode logic, leads to situations where a threshold exceedance generates a phone call and the person on the other end of the phone does not know whether they are looking at seasonal variation or the onset of collapse. In a compliance audit, both kinds of TARP look identical.

Upstream-raised dams are cheap. They fail. Chile, Brazil, Peru, parts of Canada have banned or restricted them.

Downstream and centerline methods build each lift on compacted fill independent of the stored tailings. They cost more and produce more stable structures. They can still fail. Mount Polley was not upstream-raised.

Filtered tailings, dewatered to a moisture content allowing compaction, cannot liquefy and do not impound water. The failure mode that killed 270 people at Brumadinho is physically eliminated. The cost premium is significant. Operations in tropical climates have difficulty maintaining moisture content during wet seasons. This has been solved at operations in West Africa and Southeast Asia with underdrainage, water management, and scheduling.

The real barrier is not technical. The feasibility study gets completed with a conventional impoundment in the cost model. The project gets financed on that basis. Permits get issued. By then the construction method is locked in by economic commitments made years before the first ore is processed. If a regulator wants to require filtered tailings at high-consequence sites, the requirement must exist at the permitting stage. Once financing closes on a conventional impoundment, converting is a capital restructuring exercise that neither operator nor lender will willingly undertake.

This is the part of tailings dam safety management that exposes the limits of everything else discussed above.

A tailings dam operates for twenty or thirty years and has to remain stable forever. The word "forever" is doing real work in that sentence. The Rum Jungle uranium mine in Australia's Northern Territory closed in 1971. Minimal rehabilitation. Tailings and waste rock discharged acid mine drainage into the Finniss River for decades. In the 2020s, more than fifty years later, the Australian and Northern Territory governments were spending hundreds of millions on remediation. The original operator was gone. The cost was public.

Stability under the probable maximum precipitation and the maximum credible earthquake, in perpetuity, without any of the monitoring or intervention that the dam required during its operational life.

For a large facility in a seismically active or hydrologically extreme environment, meeting this standard may require re-engineering at closure to a level far exceeding the operational design. The cost falls when the orebody is exhausted and revenue has stopped. Operators know this is coming and have every incentive to defer it, to keep the mine "in care and maintenance" rather than formally closed, to underestimate the closure liability on the balance sheet, to sell the asset to a smaller company that may or may not have the resources to close it properly.

Mines change hands. Junior companies acquire assets at prices reflecting optimistic closure assumptions. Financial assurance mechanisms are supposed to cover the gap, and they work only when the assurance amount reflects the cost. A regulator accepting the operator's cost estimate without independent verification is approving a number the operator had every incentive to minimize.

The oldest closed tailings facilities are roughly a century old. Erosion, vegetation change, geochemical evolution, climate shift operate over millennia. Every closure plan is a projection into timescales that dwarf the available experience base.

At Brumadinho, the tailings wave reached Vale's cafeteria in seconds. The 270 dead included employees eating lunch. The downstream infrastructure was inside the immediate runout zone of a dam whose failure mode was instantaneous liquefaction. No warning system of any design could have provided a survivable evacuation window. These were people who died because occupied buildings were placed where failure physics said they should not be.

Emergency exercises tend to be tabletop sessions. Participants discuss what they would do. The distance between discussion and execution under time pressure with ambiguous data is the distance where preparedness succeeds or fails. When a dam shows signs of imminent failure, the person who has to decide whether to activate evacuation is weighing the possibility of hundreds of deaths against the certainty of lawsuits, political fallout, and public anger if the alarm turns out to be false. Under stress, with incomplete data, with a phone ringing and someone arguing the readings are probably seasonal, that decision is not what it looks like in a conference room.

The independent tailings review board is advisory. When recommendations are ignored, the board documents its concern. Documentation and action are not equivalent, and this has been demonstrated. The Brazilian investigation into Brumadinho found that external advisors raised concerns about drainage deficiencies. The record contains the concerns. The operations do not reflect them. Governance frameworks requiring the Accountable Executive to formally respond to rejected recommendations create a paper trail. A paper trail with no escalation mechanism leading to someone whose career does not depend on production continuity is a paper trail and nothing more.

The same names appear on multiple boards for multiple operators across multiple continents.

Tailings dam engineering competes poorly for young talent. The pay is lower than other geotechnical specializations. The work happens at remote mine sites. University geotechnical programs teach soil mechanics and foundation engineering and slope stability. Tailings-specific topics, the geochemistry, the operational variability, the governance dimensions, are not in standard curricula. A graduate entering tailings work learns the domain through practice and mentorship over years. The pipeline is narrow.

Following Brumadinho, the Investor Mining and Tailings Safety Initiative, co-convened by the Church of England Pensions Board and the Swedish Council on Ethics for the AP Funds, built a global database of tailings facilities. More than 1,700. Hundreds using upstream construction. Many at the highest consequence classification. First time this information existed in any accessible form.

When construction method and consequence classification are visible to investors and insurers, the economics shift. Capital gets more expensive for operators with high-risk facilities. Insurance premiums rise. This motivates investment in safety through a mechanism that regulatory fines have not matched.

The next step being discussed is mandatory independent certification against a recognized standard, along the lines of what exists for pressure vessels and aircraft. The industry has resisted this.

The disclosure movement and investor-led accountability raise the possibility of breaking this cycle by making the economics of poor tailings management visible before a dam fails rather than after. Whether this works for the operators where risk actually concentrates, the mid-tier and junior companies operating in jurisdictions where investor pressure does not reach and regulatory capacity is thin, is the open question. It is a harder question than any of the technical ones.