Modelling the Brumadinho tailings dam failure, the subsequent loss of life and how it could have been reduced

In recent years the number of tailings dams failures has increased. On 25 January 2019, the Brumadinho tailings dam in Brazil suddenly failed, releasing a mudflow over 10 m deep comprising some 107 m3 of mining waste which killed between 270 and 320 people. This paper details the use of an agent-based model, known as the Life Safety Model (LSM), to estimate the risk to people downstream of the Brumadinho tailings dam and to assess if the number of fatalities could have been reduced if a warning had been received prior to or at time the dam failed. The LSM modelling indicates that even if a warning had been issued as the dam failed, the number of fatalities could have been reduced. Agent-based modelling tools such as the LSM can help to inform and improve emergency plans for tailings dams, which will help to reduce the risks posed by them in the future.


Introduction
Tailings dams are earth embankments used to store waste materials, known as tailings, from mining operations. They can be more than 100 m high and in some cases several kilometres long (Kossoff et al., 2014). Tailings dams are often constructed from readily available materials, and over their operating life they are frequently raised as the quantity of stored tailings increases (Lumbroso et al., 2019).
Tailings dams are long-lived infrastructure which are often required to be in place in perpetuity (Lumbroso et al., 2019). In the context of long-lived infrastructure the rate of failure of tailings dams is high, owing to inadequate design regulations, as well as less rigorous construction and supervision methods than for normal water-retaining dams, especially in low-income countries (Bowker and Chambers, 2017). There are three principal methods via which tailings dams are constructed: upstream, downstream and centreline. These are shown in Fig. 1. The upstream method has the lowest initial cost, owing to the minimal amount of fill material required for the initial construction and subsequent raising, which normally consists entirely of the coarse fraction of the tailings (Martin and McRoberts, 1999). Martin and McRoberts (1999) describe upstream tailings dams as "unforgiving structures" with any one or a combination of improper design, construction and operation resulting in a catastrophic failure (Martin and McRoberts, 1999).
In recent years the number of tailings dam failures has increased. Around half of the significant tailings dam failures in the last 70 years occurred between 1990 and 2010 (Azam and Li, 2010). In South America there are around 1200 mines currently in operation which have tailings dams and many thousands of tailings dams which have been abandoned and/or which are no longer operational (Azam and Li, 2010). In 2001 the International Commission On Large Dams (ICOLD) stated that "the mining industry has a less than perfect record when tailings dam failures are reviewed" (ICOLD, 2001). Although this statement was made almost 20 years ago, the probability of a tailings dam failing is still high in the context of long-lived infrastructure (Bowker and Chambers, 2017;Lyu et al., 2019). In Brazil there have been 12 major tailings dam failures since 1986, which have resulted in over 1000 deaths and adversely affected the livelihoods of millions of people, as well as causing environmental damage to thousands of kilometres of rivers (Palú and Julien, 2019).
Dam "B1" of the Córrego do Feijão mine, referred to in this paper as the Brumadinho tailings dam, was a tailings dam 86 m high with a crest length of 700 m and storage vol-  Vick, 1990).
ume of approximately 12×10 6 m 3 , located 9 km north-east of the town of Brumadinho in the state of Minas Gerais in Brazil (Palú and Julien, 2019;Robertson et al., 2019). The dam was built using the upstream construction method over a period of 37 years in 10 raises (Robertson et al., 2019). A cross section through Brumadinho tailings dam is shown in Fig. 2. The last time the dam was raised was in 2013, and tailings disposal ceased in July 2016 (Robertson et al., 2019). The Brazilian Institute of Water Management of Mines (Instituto Mineiro de Gestão das Águas) and the National Mining Agency (Agência Nacional de Mineração) had evaluated and classified the dams probability of failure as being "low" (Porsani et al., 2019).
At 12:28 LT (local time) on 25 January 2019, the Brumadinho tailings dam suffered a sudden failure, releasing a mudflow over 10 m deep which moved rapidly downstream (Robertson et al., 2019). The failure extended across much of the face of the dam, and its collapse was complete in less than 10 s. Around 9.7×10 6 m 3 of material were released, approximately 75 % of the stored tailings (Robertson et al., 2019). The ∼ 10 7 m 3 of tailings material flowed out of the Brumadinho tailings dam within about 5 min (Robertson et al., 2019). Information derived from a YouTube video of the event indicates that the maximum velocity of the mudflow may have been as high as 33 m s −1 (Petley, 2019). Three stills from the YouTube video of the dam failure, together with the local time at which they were taken, are shown in Fig. 3.
The official report on the Brumadinho tailings dam failure found that it occurred as a result of static liquefaction (Robertson et al., 2019). The investigation deduced that the failure initiated close to the crest of the dam but very rapidly progressed through the entire structure, allowing a compar-atively shallow failure to develop (Robertson et al., 2019). This was then followed by a series of retrogressive failures that released the large volume of mine waste (Robertson et al., 2019).
The failure of the Brumadinho tailings dam led to hundreds of people losing their lives and immense damage to the environment, as well as people's livelihoods. There is some anecdotal evidence to suggest that it took the mudflow between 1.5 and 2 h to reach the Paraopeba River some 10 km downstream of the tailings dam (Xinhua, 2020). The location of the Brumadinho tailings dam and the extent of the mudflow, as well as other key locations related to the event, are shown in Fig. 4. A photograph of the aftermath of the failure taken on 1 February 2019 is shown in Fig. 5.
Mining developments, including tailings dams, often grow gradually over long periods of time, and as a result the responsibility for the direct and indirect risks posed by these operations to downstream communities and the environment is often avoided (Downing, 2014;Owen et al., 2020). Following recent tailings dam failures there has been a renewed sense of urgency from industry, civil society and the investor community to understand the types of risks posed by tailings dams (Owen et al., 2020).
The main objectives of this work were to: highlight the use of an agent-based model and other modelling tools to estimate the risk to people downstream of the Brumadinho tailings dam; assess if the number of fatalities could have been reduced if a warning had been received prior to or at time the dam failed, albeit one with a short lead time 1 ; demonstrate how these modelling tools can help to inform emergency plans for tailings dams.
Three separate models were used in this research as follows: a dam breach model known as EMBREA-MUD, specially developed to model tailings dam breaches, which was used to help to generate an outflow hydrograph of the tailings; a two-dimensional hydrodynamic model of the non-Newtonian mudflow which provided depths and velocities of the mudflow at 5 s intervals; an agent-based model of people and vehicles, called the Life Safety Model (LSM), which was used to assess the loss of life and how warnings of the imminent failure could have reduced the death toll.

Modelling of the Brumadinho tailings dam failure
A two-fluid dam breach model, known as EMBREA-MUD, was initially used to model the Brumadinho tailings dam  failure. EMBREA-MUD models water and tailings and provides times series of water and tailings outflows in the form of hydrographs which can be used as the input to a downstream model of the subsequent mudflow. EMBREA-MUD is based on the EMBREA model, developed over a 20year period by HR Wallingford, which simulates embankment dam breaches and was first developed by Mohamed et al. (2002) (Mohamed et al., 2002). EMBREA-MUD predicts the growth of a breach in tailings dams via a range of processes, as well as the quantity of water and tailings released from the dam in the form of a hydrograph (Mohamed et al., 2002;Petkovšek et al., 2020). Both processes, breaching and outflowing, are simulated simultaneously based on the characteristics of the dam material, predicting the evolution of a breach opening without the need to make assumptions regarding the dimensions of the breach. EMBREA-MUD has been validated against two tailings dams failures, the Merriespruit tailings dam failure in South Africa in 1994 and the Mount Polley tailings dam failure in British Columbia in Canada in August 2014 .
The EMBREA-MUD breach model of the Brumadinho tailings dam comprised three layers as follows: water layer including eroded tailings and dam material in suspension, which behaves as a Newtonian fluid 2 ; mud layer with a viscoplastic non-Newtonian behaviour representing the liquefied tailings; solid comprising material making up the tailings dam.
Soon after the Brumadinho tailings dam failed in January 2019, EMBREA-MUD was used to develop two breach scenarios: a "base" scenario and an "extreme" scenario. Both these scenarios were based on a total mobilized volume of material of ∼ 7.2 × 10 6 m 3 . Both breach scenarios were assumed to have taken place over 2 min. The base scenario had a peak flow of 160 000 m 3 s −1 , and the extreme scenario   of material was about 35 % higher than had originally been assumed in the EMBREA-MUD model (i.e. ∼ 9.7 × 10 6 m 3 ) and that it took around 5 rather than 2 min for all the mobilized material to leave the location of the failure (location A in Fig. 4). In terms of the fully formed breach geometry, the whole of the tailings dam failed so this was assumed to be the same as the sides of the valley Utilizing the information in the expert panel report a breach hydrograph was developed based on the simplified shape of the extreme scenario modelled using EMBREA-MUD but using the mobilized material volume specified in the expert report and representing the progressive failure of the dam. The maximum mudflow discharge of 90 000 m 3 s −1 is reached within 5 s. The discharges produced by the sudden failure of tailings dams tend to be very high. Studies carried out for the failure of various tailings dams have estimated that the peak discharges can be between 25 000 and 500 000 m 3 s −1 , depending on their size, shape and how quickly the dam fails (Martin and Akkerman, 2017;Milanović, 2019). The shape of the outflow hydrograph, shown in Fig. 6, was based on information in the expert panel report, which stated that the dam failed progressively and also the velocity at which the mudflow travelled based on a highquality YouTube video of the incident (see YouTube, 2020).

Modelling of the mudflow resulting from the Brumadinho tailings dam failure
Outflow from the Brumadinho tailings dam was a mixture of the dam itself, tailings and water (Robertson et al., 2019). This mixture did not behave in the same manner as floodwater; it behaved as a rheological material. Rheological flows are gravity-driven mass flows whose dynamic behaviour is akin to a non-Newtonian fluid (De Blasio, 2011) and which are characterized by changes in viscosity in response to the strain rates within the fluid. The use of a method, which uses the Bingham plastic rheological model, has been shown to be a good approximation for the flow of liquefied tailings (Jeyapalan et al., 1983). The mudflow generated by the Brumadinho tailings dam failure was modelled using MIKE 21. MIKE 21 is a twodimensional hydrodynamic model which can model mudflows. The mudflow flow model extended from the location of the Brumadinho tailings dam (location A in Fig. 4) to the confluence with the Paraopeba River (location E in Fig. 4), a distance of some 10 km in total. MIKE 21 uses the full Bingham model (Bingham, 1916), which is based on the 2006 work by Naef et al. (2016). The model determines the flow resistance term τ 0 /ρgh from the following equation (Naef et al., 2006): where q is the flux in terms of discharge per unit width, h is the fluid depth, µ B is the Bingham fluid viscosity, τ y is the yield stress and τ 0 is the shear stress MIKE 21 solves the equation numerically to give τ 0 as a function of τ y (the yield stress), τ B (the Bingham viscosity), h and q. The three inputs to the MIKE 21 model are fluid density in kg m −3 , yield stress in N m −2 and the dynamic viscosity in kg m −1 s −1 . There were no field or laboratory measurements available for the Brumadinho mudflow, so the rheological properties of mudflows were derived using information from the expert panel report (Robertson et al., 2019), a high-quality video of the event and remote sensing information which showed the maximum extent of the mudflow.
The selection of the three key parameters for the MIKE 21 mudflow model are discussed below: 1. Fluid density. MIKE 21 only allows a single fluid density to be used. A value of 1800 kg m −3 was found to be appropriate because this density reflects the combination of the tailings, the embankment and the fluids within the tailings dam. Values were derived from the expert panel into the dam failure (Robertson et al., 2019), as well as the work done by Rickenmann (1999) and Rickenmann et al. (2006).
2. Yield stress. The mudflow model was tested using a range of yield stresses between 400 and 4000 N m −2 . The mudflow model results showed that using high The results showed that the higher value gave a better match between the observed and modelled mudflow extents.
In addition to the above parameters the roughness of the floodplain needed to be set. The MIKE 21 mudflow model uses "Manning's M" as an input parameter for roughness. Manning's M is the inverse of Manning's n roughness coefficient (i.e. 1 n ). The values of Manning's M and their equivalent n values used in the model are given in Table 1.
The roughness values in Table 1 are based on those in standard texts such as Chow (1959).
The Airbus WorldDEM Digital Terrain Model (DTM) which represents a bare-earth surface on a 0.4 arcsec grid (approximately 12 m) was used to represent the topography of the downstream valley. The accuracy of this earth-observation-based DTM surpasses that of any global satellite-based elevation model available. Previous modelling of the Brumadinho mudflow used the HEC-RAS (Hydrologic Engineering Center's River Analysis Stream) hydrodynamic modelling software, which can only model Newtonian flows and used a less accurate 30 m grid DTM (see Raman and Liu, 2019). In the MIKE 21 mudflow model, a flexible triangular mesh was used with a maximum element area of 150 m 2 . The mesh comprised a total of some 169 000 elements, which covered the area from the toe of the Brumadinho tailings dam (location A in Fig. 4) to the Paraopeba River (location E in Fig. 4). The inflows to the two-dimensional mudflow model were applied at the base of Brumadinho tailings dam (location A in Fig. 4).
This Brumadinho tailings dam failure was a rarity in that there are high-quality video images of the event, which provide an insight into the failure mechanism, the speed at which the mudflow initially moved downstream and the approximate time at which some of the buildings were destroyed. The results of the mudflow modelling showed that the out-  puts provided a good representation of the actual event both in terms of reproducing the maximum mudflow envelope and the velocity at which the flow moved based on the video of the event and other evidence available. Figure 7 shows a comparison between the maximum modelled mudflow and the maximum extent estimated from remote sensing data, and Table 2 provides the modelled mudflow depths and arrival times at key locations. The mudflow maximum extent agreed well with the observed extent from the remote sensing data. Where there are differences these are mainly a result of the DTM and the challenges in estimating the exact maximum mudflow extent from the remote sensing data available at the time of the disaster. The mudflow model was run using a 5 s time step which provides a suitable fine temporal resolution for the loss-of-life and evacuation modelling carried out as part of this work.

Introduction
At least 270 people perished as a result of the collapse, most of them employees of the mine. The mine's canteen and administrative offices, as well as three locomotives and some 130 wagons, were buried in the mine plant area (Porsani, 2019). The mudflow destroyed some parts of the Córrego do Feijão district, including a nearby inn and several rural properties, as well as sections of a railway bridge and about 100 m of railway track. Agricultural areas in the valley below the dam were also damaged by the failure (Porsani, 2019). It is essential that the risks to people associated with tailings dams be evaluated rigorously and managed proactively at all stages of their lives so that the risks posed by a failure remains "as low as reasonably practicable" (ALARP) (Bowles, 2003). This section of the paper describes the modelling of the risk to people using an agent-based model and investigates if the risk to people could have been reduced via the use of warnings and designated evacuation routes.

Background to the Life Safety Model (LSM) and
people at risk modelling  Graham, 1999;USBR, 2014), were mainly used to assess the risk to people from dams. These models are based on limited data sets, include few large dams (i.e. greater than 15 m high) and also have a mix cases of where warnings were and were not received (Assaf and Hartford, 2001), and, although commonly used, owing to their limitations they are not particularly helpful in formulating emergency plans; however, they are useful as a screening tool to prioritize structures which pose the greatest risk. The LSM simulates the interaction of people with the modelled flood or mudflow. This allows for various scenarios to be investigated that could help to reduce the risk to people (e.g. improvements in warnings, development of new evacuation routes and sensitivity of people's response times to warnings). The LSM has been validated for a number of historical dam failures (see Lumbroso et al., 2011;Johnstone and Garret, 2014) and used to assess the risks to people and improve emergency planning in 12 countries worldwide Lumbroso et al., 2010;Lumbroso and Davison, 2018).
The number of people at risk before the Brumadinho tailings dam collapsed was estimated to be 502. This number included the number of people working in the mine's buildings including the canteen directly downstream of the dam, as well as people residing in houses in villages further downstream. The number of people at risk was an estimate based on the best available information from media reports. It is important to note that there is likely to be a relatively high degree of uncertainty in the estimated number of people at risk (e.g. ±25 %). However, the objective of this work was not to predict the actual number of fatalities to within ±10 % but to investigate how the loss of life could have been significantly reduced.
The number of people at risk was built up as follows: -The dam failed at lunchtime, and many of the workers were eating in the staff canteen. It was assumed that there were 200 people in the canteen at the time of the incident. Media reports point to the canteen being the worst hit in terms of fatalities.
-In addition, it was assumed that there were 10 people in each of the other site buildings, most of which were located near to the canteen, giving a total of 400 people on the site.
-The number and location of residential buildings at risk was estimated from remote sensing data and the maximum observed mudflow extent. It was estimated that there were 51 houses at risk and that at the time of the dam collapse each house was assumed to have had two people in it.
The LSM has a function which relates the damage and possible collapse of buildings to the velocity and depth of the flow. The majority of buildings in the LSM model were considered to be of an average masonry construction, which means that significant damage and collapse will only commence after the combination of the maximum velocity and depth of the flow exceeds 10 m 2 s −1 . The mine buildings were assumed to be constructed of "average concrete", which means that significant damage and failure will commence after the combination of the maximum velocity and depth of the flow exceeds 20 m 2 s −1 . At the location of the mine buildings, the maximum combination of mudflow depth and velocity was in excess of 50 m 2 s −1 , meaning that all the buildings would have collapsed. In the LSM it is assumed that when a building collapses, anybody still inside it dies instantaneously. The LSM modelling considered evacuation routes both by vehicle and on foot. These possible evacuation routes were digitized from remote sensing data. The pathways and trails were set up in the LSM to only allow pedestrian access, and only existing roads were set up to take vehicles. The evacuation routes used in the LSM were based on existing paths and roads. In the LSM the evacuation route from each building is determined by the shortest route to a safe location (i.e. the "least-cost path"). However, the LSM is dynamic, and so when evacuation routes are inundated and become impassable, this leads to a recalculation of the least-cost path. People evacuating are then directed to the next-closest safe location.
Safe locations were placed at heights above the maximum flood depth at the end of each evacuation route. The location of the buildings, evacuation routes and safe locations are shown in Fig. 8. More information on the technical details of the LSM are available in Lumbroso and Davison (2018) together with various other publications available at http://www.lifesafetymodel.net/publications.html (last access: 4 January 2021).
Two evacuation scenarios were considered in the modelling as follows: -Everybody at risk evacuates from the area at risk on foot.
-Half of the 400 mine workers evacuate by vehicle and half by foot, with villagers downstream evacuating on foot. In this scenario it was assumed that there were 40 pickup trucks available and that each one had the capacity for five mine workers.
Velocities and depths from the two-dimensional mudflow model were used to provide the hazard posed to the modelled  When developing the two-dimensional mudflow model and the LSM, both models need to be discretized at suitable, regular temporal ( t) and spatial intervals ( x), as shown in Fig. 9. This is because as the mudflow evolves, the interaction of people and vehicles with the mudflow at each time step affects the loss of life and the evacuation times. For this modelling a time step of 5 s was used. This is considerably smaller than the time step to meet the mudflow modelling stability criteria; however, a time step that is too large (e.g. 5 min) will result in people moving a large distance (e.g. ∼ 250 to ∼ 500 m on foot and several kilometres in a vehicle) during each temporal interval, thus escaping the advancing mudflow, which may not be the case if a shorter time step is used. Similarly if the spatial discretization ( x) of the mudflow model is too large (e.g. > 15 m), then the velocities and depths at each time step are averaged over a large area leading to a loss of resolution of the hazard, which also adversely impacts the accuracy of the results (Lumbroso and Davison, 2018).
Each person (i.e. agent) in the LSM can have six states as follows: -"unaware" -the person does not know that the mudflow is happening either because it has not reached them or because they have not received a warning; -"aware" -the person is conscious that the dam break has occurred either because they have received a warning in advance or the mudflow has reached them; -"evacuating" -the person is making a conscious effort to reach safety (i.e. a defined location outside the area at risk) by a designated evacuation route; -"safe" -the person has reached safety and is no longer at risk; -"injured" -the person has been knocked over by the flow but is not fatally injured; however, they are immobile; -"deceased" -the person has died as a result of the mudflow.
Further details on the LSM model can be found in Lumbroso and Davison (2018), Lumbroso et al. (2011), Di , and Johnstone (2012). Figure 10 shows an example of the output from one time step of the Brumadinho LSM modelling. Table 3 provides the results of the LSM modelling showing people's different states. Five scenarios were modelled, including the actual event together with scenarios where warnings were exactly at the point of failure and 5, 10 and 15 min before the dam failed. Animations of the LSM modelling for three of the modelled scenarios and some of the GIS (geographic information system) files used in the modelling are available to download (see Lumbroso, 2020). Two methods of evacuation were considered, (i) on foot only and (ii) a combination of vehicles and on foot.
The reported number of fatalities as a result of the Brumadinho tailings dam failure was probably between ∼ 270 and ∼ 310 (Mining Journal, 2020;Keaveny, 2019). The results of the LSM model indicated that with no warning there would 456 fatalities out of the 502 people assumed to be at risk, a 91 % fatality rate; with a warning at the exact time the dam failed there would have been 354 fatalities. Figure 11 shows the distribution of the fatalities and the status of the people at risk for the representation of the January 2019 disaster with no warning. The diameter of each circle in Fig. 11 is in proportion to the number of people at each of the specific locations. The actual event is probably best represented by a combination of a no-warning scenario on the mining site and a warning at the time of breach because the people in the villages further downstream became aware of the disaster without an official warning, and many of them escaped the mudflow. There is some indication from media that there were between 5 and 20 deaths in the village of Parque da  Producing "accurate" estimates of fatalities caused by tailings dam failures is challenging to achieve given the uncertainty associated with natural variability, dependent on chance (US Department of Homeland Security, 2011), together with the spatial location of people when the event occurs. In the case of the Brumadinho event there was only anecdotal evidence available with respect to the number of mine workers in the canteen and other buildings, as well as the number of people in houses downstream that were at risk. The value of using complex loss-of-life models is not to estimate the exact number of deaths but to assess if emergency management interventions can make a significant difference in reducing the likely fatalities should the worst happen (Lumbroso and Davison, 2018). This information can then be used to inform emergency plans to make them more effective.
If a warning had been received at the exact time the dam failed and assuming that people took 1 min to react and knew where to evacuate to, the number of fatalities could have been reduced from a total of 456 to 354 or 299 depending on the method via which people were assumed to have evacuated. This is a reduction in the death toll of between 102 to 157. A warning 5 min before the dam failed could have reduced the number of fatalities by between 200 and 270, and a warning received 15 min before the failure could have reduced the number of deaths to zero. The Brumadinho tailings dam was monitored using in situ instruments. Whether additional instrumentation of the dam could have provided a 15 min warning time is debatable. However, Rotta et al. (2020) in a paper entitled "The Brumadinho tailings dam collapse: Possible cause and impacts of the worst human and environmental disaster in Brazil" published in April 2020 found that "A time series analysis of satellite-driven soil moisture index showed that the water accumulated over the Brumadinho dam surface during a protracted period increased its moisture contents and accelerated seepage erosion (piping) through the fill. We provide solid evidence of the seepage erosion from the top through the fill, which chronically weakened the structure and likely led to the collapse of the dam". Remote sensing data could have potentially flagged up issues with the structure several weeks or even months in advance of the failure (see Lumbroso et al., 2019Lumbroso et al., , 2020, allowing people to have been put on a high state of alert or to be moved out of the danger zone. However, the main reason for running the LSM with a 15 min warning time was to find the warning time required in order for there to be no fatalities. As part of the research a sensitivity analysis was undertaken of the time it takes people to respond to a warning. The results of this sensitivity analysis are shown in Table 4. Although the results in Table 4 are intuitively obvious (i.e. the longer it takes people to respond to a warning, the higher the number of fatalities) they are useful to formulate emergency management plans. For example, people in the village of Parque da Cachoeira could have delayed their response for over 45 min after the dam had failed and avoided any fatalities. The number of people at risk in the village of Parque da Cachoeira is relatively low; however, there are many cases worldwide where there are tailings dams with a significant number of people at risk living 5 to 10 km downstream. The richness in the data output from the LSM means that they can help to inform and improve emergency plans.

Discussion
The probability of a tailings dam failing is relatively high compared to other pieces of infrastructure that pose similar risks to people and for which the consequences of a failure are also high. In addition, even if there are no people directly at risk, the pollutants released into the environment can have health implications for those living further downstream, as well as impact the environment and people's livelihoods. For example, in 1998 the failure of a tailings dam at Boliden Apirsa's mine in southern Spain led to over 40 km river being polluted and 2600 ha of agricultural land being covered with tailings (Emery, 2005). The lack of an emergency plan addressing this particular situation meant that the clean-up operation was not effective as it could have been because responsibilities and objectives were established after the event (Emery, 2005). The lack of a coherent plan led directly to five fatalities on public roads during the clean-up operation (Emery, 2005).
It is often not possible to reduce the risk posed by a tailings dam to zero. In many countries the philosophy adopted to risk is reducing risks to as low as reasonably practicable (ALARP). The ALARP principle is founded on the obligation of tailings dam owners to reduce risks to the point that additional risk reduction would "cost" "disproportionally" more than the risk reduction (i.e. benefit) achieved (Bowles, 2003). To evaluate if the ALARP principle has been met for a tailings dam it is necessary to firstly quantify the risk and then to assess any "physically possible" structural or non-structural options that could further reduce the risk (Bowles, 2003). The ALARP principle is an important consideration in the US Bureau of Reclamation's Public Protec-D. Lumbroso et al.: Modelling the Brumadinho tailings dam failure and the subsequent loss of life tion Guidelines (USBR, 2003) and an important factor in the UK's Health and Safety Executive's decision-making process  with respect to societal risk.
Societal risk is defined as the relationship between frequency (or probability) of an event occurring and the number of people suffering from a specified level of harm in a given population from the realization of specified hazards (Jones, 1992). The assessment of societal risk is concerned with the estimation of the probabilities of more than one individual being harmed simultaneously by an incident (HSE, 2009). Societal risk can be represented by "F -N curves", which are plots of the cumulative frequency (F ) or probability of various accident scenarios occurring against the number (N) of fatalities associated with the modelled incidents (HSE, 2009). Figure 12 shows four F -N curves for the acceptable societal risk for dam failures and major accidents in Australia, the UK and the USA. Given that the annual probability of failure of a tailings dam is approximately 1 × 10 −2 and that when these structures do fail they often lead to at least one direct or indirect fatality, it can be seen that the risks they pose to society are "unacceptable" and "intolerable".
Effective emergency plans can help to reduce the risks posed by tailings dam failures. The effectiveness of an emergency plan depends on the scenarios studied and how well the plan is disseminated. Dam owners in Brazil are responsible for preparing the emergency action plans; however, these are often not checked by the relevant government authorities (Sampaio, 2016). It is important that an emergency plan is based on evidence-based dam break scenarios and inundation maps of possible extents of the mudflow, as well as the social, economic and environmental impacts (Sampaio, 2016). Plans need to be revised periodically, and procedures should be established so that if a failure is likely to or has occurred, a warning can be effectively disseminated to the people affected and the area can be evacuated to minimize the number of victims. In Brazil a federal law related to emergency planning for dams only came into effect in 2010 (Sampaio, 2016). This law established a National Dam Safety Policy and created the National Dam Safety Information System (Sampaio, 2016). Tailings dam owners in Brazil have to produce an Emergency Action Plan for each of their dams (Sampaio, 2016).
There is a real danger that emergency plans for tailings dams are not realistic or effective. In his book Mission improbable: Using fantasy documents to tame disasters, Lee Clarke points out that for many emergency planners, it can be easier to produce symbolic, "fantasy" documents than to engage in forthright admissions of the real dangers and the uncertainties that they create (Clarke, 1999). Fantasy emergency planning documents are characterized by the following: they make statements or promises which will never be fulfilled; they make claims that the event being planned for is understood and can be controlled; there is a failure to consider human factors, for example how age, gender, culture, disability and socio-economic status affect people's response to different emergencies; the risks are not fully or sufficiently well assessed and described; the coherence of the organizational coordination and the simplicity of society are often overstated; the plan describes a rational sequence of events during a disaster which is not necessarily the case.
In November 2015 a tailings dam near the town of Bento Rodrigues in the state of Minas Gerais in Brazil failed, releasing more than 30×10 6 m 3 of water and mine waste, killing 19 people and polluting water for hundreds of kilometres (Agurto-Detzel et al., 2016). An emergency plan had been developed for the dam. However, the risks that were incorporated in the plan were not sufficiently assessed. The emergency plan for the dam, submitted to the Brazilian environmental authorities, stated that in the event of a failure the mudflow would only reach the town of Bento Rodrigues 2.5 km downstream of the dam (De Carvalho, 2019). In reality the tailings released from the dam polluted some 700 km of watercourses downstream of the mine (De Carvalho, 2019). The production of ineffective emergency plans is not something that is unique to Brazil, as numerous disasters worldwide have shown. For emergency plans for tailings dams to be effective they need to be realistic and meaningful to regulators and stakeholders. In preparing emergency plans there is sometimes a philosophy of "this will never happen, so why do we need to care?". This is especially true for events that are perceived to have a low probability of occurrence. This can lead to some organizations suffering from a "it can't happen here" mentality (McConnell and Drennan, 2006) and for the "worst-case scenarios" not to be considered because they are perceived to be purely "hypothetical" (Clarke, 2006). However, things that have never happened before happen all the time (Sagan, 1993).
Research has found that in France and the UK tools to assess evacuation times and loss of life for floods appear to be rarely used by emergency planners . This means that these risks and the way they can be reduced are rarely evaluated in a quantitative manner using a phenological, rather than empirical, approach that provides a transparent basis for making and interpreting the various outcomes. In Brazil and in many other countries emergency plans for tailings dam are often not a high priority. The inadequate planning for the 2015 Bento Rodrigues tailings dam disaster, included the absence of response planning and the lack of an effective alarm system, as well as no quantitative or qualitative description of the worst-case scenarios (De Carvalho, 2019). In Brazil there has been a lack of clarity about the minimum contents required for emergency plans, and rather than being an essential tool for risk management and response planning they end up being "a mere bureaucratic formality" (De Carvalho, 2019).
The level of detail and aspects addressed in an emergency plan for a tailings dam need to be commensurate with the potential consequences if an emergency occurs. For tailings dams with potentially large consequences, such as ones constructed using the upstream method, the risks should be comprehensively assessed in a transparent manner via active engagement with the potentially affected stakeholders. The ICOLD Bulletin 139 on improving the safety of tailings dams states that the "the consequential damage from a tailings dam failure [should be] generally assessed in terms of its potential effect on the four categories of: 1. Loss of life; 2. Environ-mental damage; 3. Cost of physical damage; and 4. Social impact including public perception" (ICOLD, 2011).
The employment of models of breach, inundation and agent-based risk to people (i.e. the Life Safety Model -LSM) allow for the risks to people from tailings dam failures to be quantified and, more importantly, strategies for reducing this risk to be evaluated in an evidence-based manner. Work on tsunamis has shown that, despite the short lead time for a near-field tsunami, there is still value in providing rapid warnings to the people at risk providing that people know where to evacuate to (National Research Council, 2011), and these are useful for saving lives. This research has shown that this is also the case for tailings dam.
The sirens designed to warn nearby communities and workers of any problems with the Brumadinho dam did not sound. However, if they had sounded as the dam failed, this research has shown that even a warning just as the dam was failing could have saved between 100 and 150 lives. On the morning of 27 January 2019, 2 d after the disaster, sirens were sounded at the site because there were concerns regarding the stability of Dam VI (location B in Fig. 4), a process water reservoir, adjacent to the structure which had failed, owing to the detection of increased water levels. As a result of the risk posed by this structure, approximately 24 000 residents downstream of the site were successfully evacuated (Vale, 2020). There is a large body of evidence showing that sirens are an effective method of warning of possible dam failures provided that they are tested regularly, that the test soundings are different from the emergency signal and that people know where to evacuate to when they hear them (Graham, 2008;Tudor et al., 2012).

Conclusions and recommendations
For emergency plans to be effective it is important that they incorporate foresight about the changing nature of risk and facilitate evidence-based action, before people are harmed. There have been a number of models and frameworks developed (see Tagg et al., 2012) that can be employed to estimate risks to people from dam failures. For example, there are some simple, empirically based equations which allow elementary estimates of the risks to people from tailings dam failures to be made. Although these equations may be suitable for simple risk-screening exercises, they do not provide the ability to model each individual person, how they interact with the mudflow and the effects of measures such as improvements in early warnings, as well as improvements to evacuation routes. Agent-based models, such as the LSM, provide the ability to simulate each person, building and vehicle at risk and their interaction with the mudflow based on fundamental physical equations. Often agent-based models are seen by government regulators and mine owners as being "expensive" to implement compared to simple empirical methods. However, agent-based models can be an effective tool in helping to reduce the loss of life and injuries to people caused by tailings dams by making evidence-based contributions to emergency plans, especially with respect to evacuation planning and risk management. The LSM agentbased model provides a useful tool via which this can be done and provides an evidence-based way of exploring ways of reducing risks to people and improving emergency planning. Recent tailings dam tragedies, such as Brumadinho, have prompted institutional investors active in extractive industries, including major asset owners and asset managers, to call for an improvement in the safety of tailings dams (Church of England, 2020). As part of a review, led by institutional investors, a new independent and publicly accessible international standard for tailings dams, based upon the consequences of failure, has been called for (Church of England, 2020). In the future, for high-risk tailings dams, it is recommended that agent-based models, such as the LSM, should be used to gain a better understanding of how the dangers posed by these facilities to downstream communities can be reduced.
Data availability. Animations of the LSM and mudflow modelling outputs, together with GIS files of the mudflow extent and files used in the LSM modelling such as roads and building locations can be downloaded from https://doi.org/10.5281/zenodo.3872788 (see Lumbroso, 2020).
Author contributions. All authors contributed to the research carried out as part of this study. MD developed and ran the Life Safety Model. RB developed and ran the mudflow model. GP provided advice on tailings dam breaching and ran the EMBREA-MUD model. DL co-ordinated the research, provided advice on loss-of-life and hydraulic modelling, and wrote the text.
Competing interests. The authors declare that they have no conflict of interest.