Tailings dams are earth embankments used to store waste materials, known as tailings, from mining operations. They can be more than 100 m high and in some cases several kilometres long (Kossoff et al., 2014). Tailings dams are often constructed from readily available materials, and over their operating life they are frequently raised as the quantity of stored tailings increases (Lumbroso et al., 2019).

Tailings dams are long-lived infrastructure which are often required to be in place in perpetuity (Lumbroso et al., 2019). In the context of long-lived infrastructure the rate of failure of tailings dams is high, owing to inadequate design regulations, as well as less rigorous construction and supervision methods than for normal water-retaining dams, especially in low-income countries (Bowker and Chambers, 2017). There are three principal methods via which tailings dams are constructed: upstream, downstream and centreline. These are shown in Fig. 1. The upstream method has the lowest initial cost, owing to the minimal amount of fill material required for the initial construction and subsequent raising, which normally consists entirely of the coarse fraction of the tailings (Martin and McRoberts, 1999). Martin and McRoberts (1999) describe upstream tailings dams as “unforgiving structures” with any one or a combination of improper design, construction and operation resulting in a catastrophic failure (Martin and McRoberts, 1999).

In recent years the number of tailings dam failures has increased. Around half of the significant tailings dam failures in the last 70 years occurred between 1990 and 2010 (Azam and Li, 2010). In South America there are around 1200 mines currently in operation which have tailings dams and many thousands of tailings dams which have been abandoned and/or which are no longer operational (Azam and Li, 2010). In 2001 the International Commission On Large Dams (ICOLD) stated that “the mining industry has a less than perfect record when tailings dam failures are reviewed” (ICOLD, 2001). Although this statement was made almost 20 years ago, the probability of a tailings dam failing is still high in the context of long-lived infrastructure (Bowker and Chambers, 2017; Lyu et al., 2019). In Brazil there have been 12 major tailings dam failures since 1986, which have resulted in over 1000 deaths and adversely affected the livelihoods of millions of people, as well as causing environmental damage to thousands of kilometres of rivers (Palú and Julien, 2019).

Dam “B1” of the Córrego do Feijão mine, referred to in this paper as the Brumadinho tailings dam, was a tailings dam 86 m high with a crest length of 700 m and storage volume of approximately 12×106 m3, located 9 km north-east of the town of Brumadinho in the state of Minas Gerais in Brazil (Palú and Julien, 2019; Robertson et al., 2019). The dam was built using the upstream construction method over a period of 37 years in 10 raises (Robertson et al., 2019). A cross section through Brumadinho tailings dam is shown in Fig. 2. The last time the dam was raised was in 2013, and tailings disposal ceased in July 2016 (Robertson et al., 2019). The Brazilian Institute of Water Management of Mines (Instituto Mineiro de Gestão das Águas) and the National Mining Agency (Agência Nacional de Mineração) had evaluated and classified the dams probability of failure as being “low” (Porsani et al., 2019).

At 12:28 LT (local time) on 25 January 2019, the Brumadinho tailings dam suffered a sudden failure, releasing a mudflow over 10 m deep which moved rapidly downstream (Robertson et al., 2019). The failure extended across much of the face of the dam, and its collapse was complete in less than 10 s. Around 9.7×106 m3 of material were released, approximately 75 % of the stored tailings (Robertson et al., 2019). The ∼107 m3 of tailings material flowed out of the Brumadinho tailings dam within about 5 min (Robertson et al., 2019). Information derived from a YouTube video of the event indicates that the maximum velocity of the mudflow may have been as high as 33 m s-1 (Petley, 2019). Three stills from the YouTube video of the dam failure, together with the local time at which they were taken, are shown in Fig. 3.

The official report on the Brumadinho tailings dam failure found that it occurred as a result of static liquefaction (Robertson et al., 2019). The investigation deduced that the failure initiated close to the crest of the dam but very rapidly progressed through the entire structure, allowing a comparatively shallow failure to develop (Robertson et al., 2019). This was then followed by a series of retrogressive failures that released the large volume of mine waste (Robertson et al., 2019).

The failure of the Brumadinho tailings dam led to hundreds of people losing their lives and immense damage to the environment, as well as people's livelihoods. There is some anecdotal evidence to suggest that it took the mudflow between 1.5 and 2 h to reach the Paraopeba River some 10 km downstream of the tailings dam (Xinhua, 2020). The location of the Brumadinho tailings dam and the extent of the mudflow, as well as other key locations related to the event, are shown in Fig. 4. A photograph of the aftermath of the failure taken on 1 February 2019 is shown in Fig. 5.

Mining developments, including tailings dams, often grow gradually over long periods of time, and as a result the responsibility for the direct and indirect risks posed by these operations to downstream communities and the environment is often avoided (Downing, 2014; Owen et al., 2020). Following recent tailings dam failures there has been a renewed sense of urgency from industry, civil society and the investor community to understand the types of risks posed by tailings dams (Owen et al., 2020).

The main objectives of this work were to:

highlight the use of an agent-based model and other modelling tools to estimate the risk to people downstream of the Brumadinho tailings dam;

A two-fluid dam breach model, known as EMBREA-MUD, was initially used to model the Brumadinho tailings dam failure. EMBREA-MUD models water and tailings and provides times series of water and tailings outflows in the form of hydrographs which can be used as the input to a downstream model of the subsequent mudflow. EMBREA-MUD is based on the EMBREA model, developed over a 20-year period by HR Wallingford, which simulates embankment dam breaches and was first developed by Mohamed et al. (2002) under the name HR BREACH and validated against a number of dam failures case studies including the Orós dam in Brazil in 1961, the Banqiao dam in China in 1975 (Morris, 2011) and the Teton dam in USA in 1976 (Mohamed et al., 2002).

EMBREA-MUD predicts the growth of a breach in tailings dams via a range of processes, as well as the quantity of water and tailings released from the dam in the form of a hydrograph (Mohamed et al., 2002; Petkovšek et al., 2020). Both processes, breaching and outflowing, are simulated simultaneously based on the characteristics of the dam material, predicting the evolution of a breach opening without the need to make assumptions regarding the dimensions of the breach. EMBREA-MUD has been validated against two tailings dams failures, the Merriespruit tailings dam failure in South Africa in 1994 and the Mount Polley tailings dam failure in British Columbia in Canada in August 2014 (Petkovšek et al., 2020).

The EMBREA-MUD breach model of the Brumadinho tailings dam comprised three layers as follows:

water layer including eroded tailings and dam material in suspension, which behaves as a Newtonian fluid

A Newtonian fluid is a fluid in which the viscous stresses arising from its flow, at every point, are linearly correlated to the local strain rate, the rate of change of its deformation over time.

Utilizing the information in the expert panel report a breach hydrograph was developed based on the simplified shape of the extreme scenario modelled using EMBREA-MUD but using the mobilized material volume specified in the expert report and representing the progressive failure of the dam. The maximum mudflow discharge of 90 000 m3 s-1 is reached within 5 s. The discharges produced by the sudden failure of tailings dams tend to be very high. Studies carried out for the failure of various tailings dams have estimated that the peak discharges can be between 25 000 and 500 000 m3 s-1, depending on their size, shape and how quickly the dam fails (Martin and Akkerman, 2017; Milanović, 2019). The shape of the outflow hydrograph, shown in Fig. 6, was based on information in the expert panel report, which stated that the dam failed progressively and also the velocity at which the mudflow travelled based on a high-quality YouTube video of the incident (see YouTube, 2020).

Outflow from the Brumadinho tailings dam was a mixture of the dam itself, tailings and water (Robertson et al., 2019). This mixture did not behave in the same manner as floodwater; it behaved as a rheological material. Rheological flows are gravity-driven mass flows whose dynamic behaviour is akin to a non-Newtonian fluid (De Blasio, 2011) and which are characterized by changes in viscosity in response to the strain rates within the fluid. The use of a method, which uses the Bingham plastic rheological model, has been shown to be a good approximation for the flow of liquefied tailings (Jeyapalan et al., 1983).

The mudflow generated by the Brumadinho tailings dam failure was modelled using MIKE 21. MIKE 21 is a two-dimensional hydrodynamic model which can model mudflows. The mudflow flow model extended from the location of the Brumadinho tailings dam (location A in Fig. 4) to the confluence with the Paraopeba River (location E in Fig. 4), a distance of some 10 km in total. MIKE 21 uses the full Bingham model (Bingham, 1916), which is based on the 2006 work by Naef et al. (2016). The model determines the flow resistance term τ0/ρgh from the following equation (Naef et al., 2006): 12τ03-3τy+2μBqh2τ02+τy3=0, where q is the flux in terms of discharge per unit width, h is the fluid depth, μB is the Bingham fluid viscosity, τy is the yield stress and τ0 is the shear stress

MIKE 21 solves the equation numerically to give τ0 as a function of τy (the yield stress), τB (the Bingham viscosity), h and q. The three inputs to the MIKE 21 model are fluid density in kg m-3, yield stress in N m-2 and the dynamic viscosity in kg m-1 s-1. There were no field or laboratory measurements available for the Brumadinho mudflow, so the rheological properties of mudflows were derived using information from the expert panel report (Robertson et al., 2019), a high-quality video of the event and remote sensing information which showed the maximum extent of the mudflow.

The selection of the three key parameters for the MIKE 21 mudflow model are discussed below:

Fluid density. MIKE 21 only allows a single fluid density to be used. A value of 1800 kg m-3 was found to be appropriate because this density reflects the combination of the tailings, the embankment and the fluids within the tailings dam. Values were derived from the expert panel into the dam failure (Robertson et al., 2019), as well as the work done by Rickenmann (1999) and Rickenmann et al. (2006).

The roughness values in Table 1 are based on those in standard texts such as Chow (1959).

The Airbus WorldDEM Digital Terrain Model (DTM) which represents a bare-earth surface on a 0.4 arcsec grid (approximately 12 m) was used to represent the topography of the downstream valley. The accuracy of this earth-observation-based DTM surpasses that of any global satellite-based elevation model available. Previous modelling of the Brumadinho mudflow used the HEC-RAS (Hydrologic Engineering Center's River Analysis Stream) hydrodynamic modelling software, which can only model Newtonian flows and used a less accurate 30 m grid DTM (see Raman and Liu, 2019). In the MIKE 21 mudflow model, a flexible triangular mesh was used with a maximum element area of 150 m2. The mesh comprised a total of some 169 000 elements, which covered the area from the toe of the Brumadinho tailings dam (location A in Fig. 4) to the Paraopeba River (location E in Fig. 4). The inflows to the two-dimensional mudflow model were applied at the base of Brumadinho tailings dam (location A in Fig. 4).

This Brumadinho tailings dam failure was a rarity in that there are high-quality video images of the event, which provide an insight into the failure mechanism, the speed at which the mudflow initially moved downstream and the approximate time at which some of the buildings were destroyed. The results of the mudflow modelling showed that the outputs provided a good representation of the actual event both in terms of reproducing the maximum mudflow envelope and the velocity at which the flow moved based on the video of the event and other evidence available.

Figure 7 shows a comparison between the maximum modelled mudflow and the maximum extent estimated from remote sensing data, and Table 2 provides the modelled mudflow depths and arrival times at key locations. The mudflow maximum extent agreed well with the observed extent from the remote sensing data. Where there are differences these are mainly a result of the DTM and the challenges in estimating the exact maximum mudflow extent from the remote sensing data available at the time of the disaster. The mudflow model was run using a 5 s time step which provides a suitable fine temporal resolution for the loss-of-life and evacuation modelling carried out as part of this work.

The probability of a tailings dam failing is relatively high compared to other pieces of infrastructure that pose similar risks to people and for which the consequences of a failure are also high. In addition, even if there are no people directly at risk, the pollutants released into the environment can have health implications for those living further downstream, as well as impact the environment and people's livelihoods. For example, in 1998 the failure of a tailings dam at Boliden Apirsa's mine in southern Spain led to over 40 km river being polluted and 2600 ha of agricultural land being covered with tailings (Emery, 2005). The lack of an emergency plan addressing this particular situation meant that the clean-up operation was not effective as it could have been because responsibilities and objectives were established after the event (Emery, 2005). The lack of a coherent plan led directly to five fatalities on public roads during the clean-up operation (Emery, 2005).

It is often not possible to reduce the risk posed by a tailings dam to zero. In many countries the philosophy adopted to risk is reducing risks to as low as reasonably practicable (ALARP). The ALARP principle is founded on the obligation of tailings dam owners to reduce risks to the point that additional risk reduction would “cost” “disproportionally” more than the risk reduction (i.e. benefit) achieved (Bowles, 2003). To evaluate if the ALARP principle has been met for a tailings dam it is necessary to firstly quantify the risk and then to assess any “physically possible” structural or non-structural options that could further reduce the risk (Bowles, 2003). The ALARP principle is an important consideration in the US Bureau of Reclamation's Public Protection Guidelines (USBR, 2003) and an important factor in the UK's Health and Safety Executive's decision-making process (HSE, 2001) with respect to societal risk.

Societal risk is defined as the relationship between frequency (or probability) of an event occurring and the number of people suffering from a specified level of harm in a given population from the realization of specified hazards (Jones, 1992). The assessment of societal risk is concerned with the estimation of the probabilities of more than one individual being harmed simultaneously by an incident (HSE, 2009). Societal risk can be represented by “F–N curves”, which are plots of the cumulative frequency (F) or probability of various accident scenarios occurring against the number (N) of fatalities associated with the modelled incidents (HSE, 2009). Figure 12 shows four F–N curves for the acceptable societal risk for dam failures and major accidents in Australia, the UK and the USA. Given that the annual probability of failure of a tailings dam is approximately 1×10-2 and that when these structures do fail they often lead to at least one direct or indirect fatality, it can be seen that the risks they pose to society are “unacceptable” and ”intolerable”.

Effective emergency plans can help to reduce the risks posed by tailings dam failures. The effectiveness of an emergency plan depends on the scenarios studied and how well the plan is disseminated. Dam owners in Brazil are responsible for preparing the emergency action plans; however, these are often not checked by the relevant government authorities (Sampaio, 2016). It is important that an emergency plan is based on evidence-based dam break scenarios and inundation maps of possible extents of the mudflow, as well as the social, economic and environmental impacts (Sampaio, 2016). Plans need to be revised periodically, and procedures should be established so that if a failure is likely to or has occurred, a warning can be effectively disseminated to the people affected and the area can be evacuated to minimize the number of victims. In Brazil a federal law related to emergency planning for dams only came into effect in 2010 (Sampaio, 2016). This law established a National Dam Safety Policy and created the National Dam Safety Information System (Sampaio, 2016). Tailings dam owners in Brazil have to produce an Emergency Action Plan for each of their dams (Sampaio, 2016).

There is a real danger that emergency plans for tailings dams are not realistic or effective. In his book Mission improbable: Using fantasy documents to tame disasters, Lee Clarke points out that for many emergency planners, it can be easier to produce symbolic, “fantasy” documents than to engage in forthright admissions of the real dangers and the uncertainties that they create (Clarke, 1999). Fantasy emergency planning documents are characterized by the following:

they make statements or promises which will never be fulfilled;

The production of ineffective emergency plans is not something that is unique to Brazil, as numerous disasters worldwide have shown. For emergency plans for tailings dams to be effective they need to be realistic and meaningful to regulators and stakeholders. In preparing emergency plans there is sometimes a philosophy of “this will never happen, so why do we need to care?”. This is especially true for events that are perceived to have a low probability of occurrence. This can lead to some organizations suffering from a “it can't happen here” mentality (McConnell and Drennan, 2006) and for the “worst-case scenarios” not to be considered because they are perceived to be purely “hypothetical” (Clarke, 2006). However, things that have never happened before happen all the time (Sagan, 1993).

Research has found that in France and the UK tools to assess evacuation times and loss of life for floods appear to be rarely used by emergency planners (Lumbroso and Vinet, 2012). This means that these risks and the way they can be reduced are rarely evaluated in a quantitative manner using a phenological, rather than empirical, approach that provides a transparent basis for making and interpreting the various outcomes. In Brazil and in many other countries emergency plans for tailings dam are often not a high priority. The inadequate planning for the 2015 Bento Rodrigues tailings dam disaster, included the absence of response planning and the lack of an effective alarm system, as well as no quantitative or qualitative description of the worst-case scenarios (De Carvalho, 2019). In Brazil there has been a lack of clarity about the minimum contents required for emergency plans, and rather than being an essential tool for risk management and response planning they end up being “a mere bureaucratic formality” (De Carvalho, 2019).

The level of detail and aspects addressed in an emergency plan for a tailings dam need to be commensurate with the potential consequences if an emergency occurs. For tailings dams with potentially large consequences, such as ones constructed using the upstream method, the risks should be comprehensively assessed in a transparent manner via active engagement with the potentially affected stakeholders. The ICOLD Bulletin 139 on improving the safety of tailings dams states that the “the consequential damage from a tailings dam failure [should be] generally assessed in terms of its potential effect on the four categories of: 1. Loss of life; 2. Environmental damage; 3. Cost of physical damage; and 4. Social impact including public perception” (ICOLD, 2011).

The employment of models of breach, inundation and agent-based risk to people (i.e. the Life Safety Model – LSM) allow for the risks to people from tailings dam failures to be quantified and, more importantly, strategies for reducing this risk to be evaluated in an evidence-based manner. Work on tsunamis has shown that, despite the short lead time for a near-field tsunami, there is still value in providing rapid warnings to the people at risk providing that people know where to evacuate to (National Research Council, 2011), and these are useful for saving lives. This research has shown that this is also the case for tailings dam.

The sirens designed to warn nearby communities and workers of any problems with the Brumadinho dam did not sound. However, if they had sounded as the dam failed, this research has shown that even a warning just as the dam was failing could have saved between 100 and 150 lives. On the morning of 27 January 2019, 2 d after the disaster, sirens were sounded at the site because there were concerns regarding the stability of Dam VI (location B in Fig. 4), a process water reservoir, adjacent to the structure which had failed, owing to the detection of increased water levels. As a result of the risk posed by this structure, approximately 24 000 residents downstream of the site were successfully evacuated (Vale, 2020). There is a large body of evidence showing that sirens are an effective method of warning of possible dam failures provided that they are tested regularly, that the test soundings are different from the emergency signal and that people know where to evacuate to when they hear them (Graham, 2008; Tudor et al., 2012).

For emergency plans to be effective it is important that they incorporate foresight about the changing nature of risk and facilitate evidence-based action, before people are harmed. There have been a number of models and frameworks developed (see Tagg et al., 2012) that can be employed to estimate risks to people from dam failures. For example, there are some simple, empirically based equations which allow elementary estimates of the risks to people from tailings dam failures to be made. Although these equations may be suitable for simple risk-screening exercises, they do not provide the ability to model each individual person, how they interact with the mudflow and the effects of measures such as improvements in early warnings, as well as improvements to evacuation routes. Agent-based models, such as the LSM, provide the ability to simulate each person, building and vehicle at risk and their interaction with the mudflow based on fundamental physical equations. Often agent-based models are seen by government regulators and mine owners as being “expensive” to implement compared to simple empirical methods. However, agent-based models can be an effective tool in helping to reduce the loss of life and injuries to people caused by tailings dams by making evidence-based contributions to emergency plans, especially with respect to evacuation planning and risk management. The LSM agent-based model provides a useful tool via which this can be done and provides an evidence-based way of exploring ways of reducing risks to people and improving emergency planning. Recent tailings dam tragedies, such as Brumadinho, have prompted institutional investors active in extractive industries, including major asset owners and asset managers, to call for an improvement in the safety of tailings dams (Church of England, 2020). As part of a review, led by institutional investors, a new independent and publicly accessible international standard for tailings dams, based upon the consequences of failure, has been called for (Church of England, 2020). In the future, for high-risk tailings dams, it is recommended that agent-based models, such as the LSM, should be used to gain a better understanding of how the dangers posed by these facilities to downstream communities can be reduced.