Brumadinho — a Tailings Dam That Liquefied in Seconds and Killed 270

Summary

At 12:28 on 25 January 2019, Dam I of Vale's Córrego do Feijão iron-ore mine, near Brumadinho in the Brazilian state of Minas Gerais, collapsed without warning and released roughly 9.7 million cubic metres of saturated mine tailings as a fast-moving mudflow. The wave swept over the mine's own administrative complex and a canteen where workers were eating lunch, then ran more than five kilometres to the Paraopeba River. It killed 270 people, most of them Vale employees and contractors. The cause was static liquefaction: a loose, water-saturated, brittle deposit of iron tailings lost almost all of its strength in an instant and flowed like a heavy liquid. No earthquake, no overtopping and no rainstorm on the day triggered it. The dam failed under its own static weight.

Dam I was an upstream-raised tailings dam, about 86 metres high, built and raised in stages from 1976 onward and last fed tailings in 2014. The upstream method is the cheapest way to raise a tailings impoundment and the most dangerous: each lift is founded partly on the soft, previously deposited slimes behind the wall, so the embankment is built on the very material it must retain. At Brumadinho that retained material was fine iron tailings, deposited loose and kept saturated by a high internal water table, with no functioning drainage to draw the water down. Loose saturated tailings are metastable. They can stand for years at a factor of safety barely above one, then collapse catastrophically when a small disturbance pushes them past their brittle strength.

The collapse was filmed by the mine's own surveillance cameras. The footage shows the downstream face bulging and then disintegrating across roughly 80 percent of its width in about five seconds, with no slumping or cracking beforehand. The Expert Panel commissioned to investigate found that internal creep deformations under sustained load, combined with a loss of soil suction as a wet 2018 rainy season raised pore pressures in the upper tailings, drove the deposit past its peak strength. Once a sliver near the crest liquefied, the failure ran backward through the impoundment in a retrogressive chain, each liquefying block undermining the next, until the whole face had flowed out.

The investigation, led by the geotechnical engineer Peter Robertson and released in December 2019, concluded that the failure occurred by static liquefaction with no detectable warning, despite extensive instrumentation. That finding is the indictment. The hazard was inherent in the structure — a brittle, saturated, upstream-raised deposit with no drainage and almost no reserve of strength — and the monitoring regime was watching for movement that, in a brittle flow failure, never comes. Brumadinho, four years after the same company's Fundão failure at Mariana, became the disaster that ended upstream tailings dams in Brazil and forced the global mining industry to confront a failure mode it had treated as theoretical.

---

Timeline

1976

Dam I built

The structure is constructed by Ferteco Mineração as a starter dam to impound iron tailings at the Córrego do Feijão mine. It will be raised in stages over the following decades by the upstream method, each lift founded partly on previously deposited tailings.

2001

Vale acquires the mine

Vale S.A. takes ownership of Córrego do Feijão and its tailings dams as part of its expansion in Minas Gerais. Raising of Dam I continues.

2013

Dam reaches final height

Dam I reaches roughly 86 m in height across ten raises, retaining about 11.7 million m³ of tailings. The upstream construction leaves loose, saturated tailings beneath and behind the embankment crest.

2014–2016

Deposition ceases

Dam I stops receiving tailings around 2014 and is effectively inactive. Decommissioning planning begins, but the impoundment is never drained; the internal water table remains high and the tailings stay saturated.

2016 onward

Stability concerns documented

Internal and consultant reviews repeatedly find the dam's calculated factor of safety below Brazilian and international norms. Drainage and buttressing are studied but the deposit is never reinforced or de-watered to a safe state.

2017

Auditor declarations of stability

The German firm TÜV SÜD issues declarations of stability for Dam I, later central to the criminal case, despite documented marginal safety factors.

Oct 2018 – Jan 2019

Wet season raises pore pressures

A heavier-than-usual rainy season infiltrates the upper tailings, reducing soil suction and raising pore-water pressure near the crest, eroding what little margin remained.

25 Jan 2019, ~12:28

Catastrophic flow failure

Without prior cracking or movement, the downstream face liquefies and disintegrates across about 80% of its width in roughly five seconds. The failure runs retrogressively back into the impoundment.

25 Jan 2019, ~12:28–12:32

Mudflow strikes the mine

Some 9.7 million m³ of liquefied tailings surge over the mine's administrative buildings, railway yard and canteen, burying hundreds of workers during the lunch break and destroying locomotives and rail wagons.

25 Jan 2019, ~15:50

Tailings reach the Paraopeba

The mudflow travels more than 5 km in under four hours and enters the Paraopeba River, contaminating the watershed and forcing water-supply shutdowns across downstream municipalities.

Dec 2019

Expert Panel report released

The independent panel chaired by Peter Robertson concludes the dam failed by static liquefaction, driven by internal creep and loss of suction, with no observable precursor in the monitoring data.

Jan 2020 / Feb 2021

Charges and settlement

Brazilian prosecutors charge Vale, TÜV SÜD and sixteen individuals, including a former Vale president, with homicide and environmental crimes. In February 2021 Vale agrees to a reparations settlement of about US$7 billion.

The Build: An Upstream Dam Standing on the Mud It Was Meant to Hold

Dam I was not a water dam but a tailings dam — a containment for the fine, wet waste left after iron ore is crushed and the metal extracted. Begun in 1976 and raised repeatedly until it reached about 86 metres, it was built by the upstream method, the oldest and cheapest way to grow such a structure. In upstream raising, each new lift of the embankment is placed partly on top of the soft tailings already deposited behind the previous crest. The wall therefore advances inward over the impoundment, and a large part of its foundation is the very slime it is supposed to retain. The method works only if those underlying tailings are dense and well drained. When they are loose and saturated, the dam is founded on material that can turn to liquid.

At Brumadinho the retained tailings were fine iron-mining residues, hydraulically deposited so that they settled loose, and they were kept saturated by a high phreatic surface inside the impoundment. The internal drainage that should have drawn that water down — blanket drains, finger drains, a low water table — was inadequate or non-functional, so the deposit remained wet to near the crest. Loose, saturated, fine tailings are contractive: when sheared, they want to compress, but the trapped pore water cannot escape quickly, so the load transfers to the water and the grain-to-grain contact stress collapses. Such a soil is also brittle. It holds a peak strength only until it is disturbed, then drops abruptly to a much lower residual, liquefied strength. Dam I held a calculated factor of safety only marginally above one — barely standing — across years in which reviews repeatedly flagged it as below the required margin, yet it was never buttressed or de-watered.

Worse, the dam had been inactive since around 2014 and was nominally being prepared for decommissioning. The intuition that an idle, no-longer-loaded dam is a safer dam is exactly backwards for a brittle saturated deposit. Time under sustained static load does not relax such a structure; it allows slow creep deformation to accumulate, nudging the metastable tailings ever closer to the strain at which their strength breaks down. The most heavily monitored, supposedly dormant structure on the site was quietly walking toward collapse.

The Failure Sequence: Five Seconds From Standing to a Flood of Liquid Earth

For all the instrumentation on Dam I — piezometers, survey markers, radar — the failure gave essentially no notice, because the mechanism that destroyed it does not produce the slow movement that monitoring is designed to catch. Through the wet season of late 2018 and into January 2019, rainwater infiltrated the upper tailings. This did two things. It raised pore-water pressures near the crest, and it removed the soil suction — the small negative pore pressure in partly unsaturated material — that had been lending the upper deposit extra apparent strength. As suction vanished and pore pressure rose, the effective stress holding the loose tailings together fell. Combined with the creep strains accumulated over years of static loading, the deposit was pushed past its brittle peak.

The collapse initiated near the crest of the dam and then, in the discipline's terms, ran retrogressively. A first sliver of tailings liquefied and flowed out; its departure removed the support that had been confining the material immediately behind it, so that block in turn liquefied and flowed, and the chain propagated backward into the impoundment. Each step took fractions of a second. The mine's surveillance cameras recorded the whole event: the downstream face shows no cracking, no slumping, no warning bulge of the kind that precedes a conventional slope slide, and then in about five seconds roughly 80 percent of the face simply disintegrates and pours downhill. A solid embankment became a moving liquid in the time it takes to read this sentence.

About 9.7 million cubic metres of liquefied tailings burst out and ran downstream as a dense mudflow. The first thing in its path was Vale's own infrastructure: the administrative offices, the rail loading yard and a canteen where workers were taking the midday meal. The flow buried them, which is why the great majority of the 270 dead were employees and contractors of the company that owned the dam. The mud travelled more than five kilometres in under four hours and reached the Paraopeba River by mid-afternoon, carrying iron tailings and elevated metals into a watershed that supplied drinking water to communities far downstream.

The Reckoning: A Hazard Built In, and a Method Finally Banned

Vale convened an independent Expert Panel of four geotechnical engineers, chaired by Peter Robertson, and gave it the dam's design records, instrumentation data, materials testing and the failure videos. The panel's report, published in December 2019, was unambiguous: Dam I failed by static liquefaction. There had been no external trigger — no earthquake, no blasting, no overtopping, no failure of a pipe or conduit. The dam collapsed under the loads it carried every day, because the tailings it was built from and the tailings it retained were loose, saturated, contractive and brittle, and the wet season had eroded the last increment of strength holding them. The panel emphasised that the failure left almost no precursor in the monitoring data, precisely because a brittle flow failure produces little deformation before it goes. Watching for movement is the wrong defence against a soil that does not move until it liquefies.

That conclusion turned the disaster from an accident into an indictment of a method. Brazilian prosecutors charged Vale, the auditing firm TÜV SÜD and sixteen individuals — including a former Vale president — with homicide and environmental crimes, alleging that declarations of stability had been signed for a dam known to be marginal. In February 2021 Vale agreed to a reparations settlement of roughly US$7 billion, among the largest in the history of mining disasters. The deeper legacy was regulatory. Coming only four years after the Fundão tailings failure at Mariana, also involving Vale, Brumadinho forced Brazil to ban the construction of new upstream tailings dams and to order the decommissioning of existing ones, and it pushed the global mining industry to write, for the first time, a binding standard for how tailings facilities must be designed, monitored and governed.

---

Contributing Factors

01

Upstream construction over loose, saturated tailings

Dam I was raised by the upstream method, with each lift founded partly on soft, previously deposited slimes. The embankment therefore stood on the very material it was meant to retain — fine iron tailings, deposited loose and contractive. That foundation could lose its strength under static load, a vulnerability inherent in the method itself and absent from downstream or centreline construction, where the wall sits on compacted fill rather than on its own waste.

02

A high water table and absent drainage

The impoundment was kept saturated to near the crest because the internal drainage that should have drawn the phreatic surface down was inadequate or non-functional. Saturation is the precondition for liquefaction: only when the pore space is full of water can shearing transfer load to that water and collapse the effective stress. A drained, de-watered deposit could not have flowed. The single most effective safeguard against the failure mode was missing.

03

A brittle, contractive material with no strength reserve

The loose fine tailings held a peak strength only until disturbed, then dropped abruptly to a low liquefied residual. The dam's factor of safety sat marginally above one for years, flagged repeatedly as below norm, yet it was never buttressed or de-watered. A brittle soil at a factor of safety near unity has no margin: it does not yield gradually and warn, it breaks and flows. The design relied on a strength that vanished the moment it was needed most.

04

Creep and loss of suction as the silent trigger

No earthquake or storm struck the dam on the day. Instead, years of slow creep deformation under sustained static load drove the metastable tailings toward their failure strain, while a wet 2018 rainy season raised pore pressures and stripped away the soil suction that had lent the upper deposit extra apparent strength. The combination pushed the deposit past its brittle peak with no external blow — the load that destroyed it was the load it carried every day.

05

Monitoring blind to a no-warning failure mode

Dam I was extensively instrumented with piezometers, survey markers and radar, yet the collapse gave essentially no notice. A brittle static-liquefaction flow failure produces almost no pre-failure movement, so a regime tuned to detect creep and displacement was watching for a signal the mechanism does not generate. The instrumentation created a false sense of control over a hazard it was structurally incapable of catching in time. ---

Aftermath

Brumadinho killed 270 people, most of them Vale's own workers and contractors, and released about 9.7 million cubic metres of tailings into the Paraopeba watershed, poisoning a river that supplied downstream communities. It was the deadliest tailings-dam failure in modern history and the second catastrophic Vale-linked failure in four years, after Fundão at Mariana in 2015. The Expert Panel's verdict of static liquefaction with no detectable warning made plain that the danger was built into the structure, not introduced by an outside event. In response, Brazil banned the construction of new upstream tailings dams and mandated the removal of existing ones, and the disaster became the catalyst for the first Global Industry Standard on Tailings Management, which obliges operators to engineer against brittle flow failure, lower phreatic surfaces, appoint accountable engineers of record and plan for the consequences of failure. Vale agreed to a reparations settlement of roughly US$7 billion in 2021, and the company, its former president and its auditor faced criminal charges. In the discipline, Brumadinho is now the byword for a single hard truth: an upstream-raised, saturated, loose tailings deposit is a brittle structure that can liquefy under its own weight, with no warning, and the failure mode you cannot see coming is the one your instruments will never catch.

---

Lessons

Never build or leave a tailings dam on loose, saturated, contractive material: densify it, drain it, or buttress it — an upstream embankment founded on its own slimes is standing on a soil that can become a liquid.
Treat a high phreatic surface as the failure waiting to happen, and lower it: functioning drainage that de-waters the deposit is the surest defence against liquefaction, because a soil that is not saturated cannot flow.
Demand a real strength margin from brittle soils, not a factor of safety near one: a contractive material gives no gradual warning, so design to its low liquefied residual strength and assume the peak will vanish when you most need it.
Do not trust instrumentation to warn you of a brittle flow failure: monitoring detects movement, and static liquefaction produces almost none before it goes — manage the hazard out of the structure rather than watching for a signal that never arrives.
Distrust the idea that a dormant, unloaded dam is a safe dam: sustained static load lets a metastable deposit creep toward collapse, so decommission by de-watering and reinforcing, not by walking away and waiting. ---