Vale Brumadinho: how a stability certificate became a substitute for safety

Here is an uncomfortable observation from two decades of auditing: nobody ever signs a certificate for a disaster. They sign it for an ordinary Tuesday, when everything reads tolerable – and then the certificate quietly starts doing the job of the control. Brumadinho is the largest-scale version of that substitution I know of. A dam holding a current stability declaration while its drainage failed beneath it. Paperwork substituting for physics, at the cost of 270 lives.

The situation

Córrego do Feijão was an iron ore mine in Minas Gerais. Its waste – tailings, a saturated slurry of ground rock – sat behind Dam I, built by the upstream method: a starter dike, then successive raises stacked inward over the dam's own settled slimes. Read that again. The wall is made of the material most prone to liquefy. It is the cheapest way to store tailings, and it survives only as long as drainage keeps water out of the structure.

By 2019 the dam was no longer receiving waste, but it still stood above the valley holding the plant cafeteria and offices. It held a valid stability declaration. Its drainage and stability problems had been documented – internally and by outside specialists – well before the collapse. And less than four years earlier, Samarco's Fundão dam had failed and killed 19 people, with Vale as co-owner. Same state. Same shareholder. Same construction method.

How it unfolded

25 January 2019, lunchtime. The tailings mass underwent static liquefaction – lost shear strength abruptly – and the dam disgorged its contents in minutes. The flow reached the cafeteria and administrative area fast enough that there was no meaningful evacuation. Of the 270 dead, a large share were Vale's own people, sitting down to eat. Some families waited years for remains to be identified.

The aftermath ran on for years too. External audits during 2018 had declared the dam stable; prosecutors later alleged pressure around the certification process, and recordings made public suggested the company sought to influence the verdicts. In 2022, Brazilian courts convicted former Vale executives in connection with the disaster. The industry's answer – the Global Industry Standard on Tailings Management, with independent auditing at its core – arrived in 2020. Read that as an admission, implicit but unmistakable: self-declared stability had been the problem.

Root-cause anatomy

Technically, nothing about the failure mode was mysterious. Upstream dams fail by static liquefaction: brittle, fast, little visible warning. The defences are unglamorous – working drains, a dry beach, dense material, instruments that genuinely measure water pressure inside the mass. Public investigations described compromised drainage, accumulated water and sparse instrumentation with long data gaps. Every layer of technical defence existed on paper. Several did not exist in the ground.

Organisationally, the root cause is the substitution itself. The operative question in the management system became "do we hold a current declaration?" instead of "is the dam draining?" Knowledge was not missing – the concerns had been raised. What was missing was a mechanism forcing physical evidence to outrank a signed document. Add a business that wanted the answer to be "stable" and a certification process that could be squeezed, and collapse becomes a matter of time, not luck.

Where the quality system failed

Name the disciplines and they line up like dominoes. PFMEA first, because detection ratings assume detection exists. The system credited monitoring that was partly notional: thin instrumentation, quiet gaps, no automatic consequence when readings went missing. A detection score is a promise the hardware has to keep.

Then audit – signature drift. Every recertification leans on the previous one, and the signature migrates from physical evidence to prior paperwork until a chain of clean reports certifies itself. The binder was immaculate. The drainage was not. And CAPA: Samarco was the same failure mode under the same shareholder, less than four years earlier. A repeat failure means the original root cause was never closed; the corrective actions produced documents, not verified physical change across the fleet of dams. Change control finished the job – deposition had stopped, decommissioning approached, and nobody re-validated stability in the dam's new condition. Change is not only a new part; it is a new state of an old asset.

When the certificate becomes the control, physics becomes the auditor.

What would have caught it

Audit the physics, not the binder. Recertification that must walk the asset, pull raw instrument data on the spot and reconcile it against the declaration: how many piezometers are live, what the trend says, who reads it, what action fires. Hard triggers, no negotiation – thresholds on internal water level and drainage flow that mandate predefined steps regardless of certificate status, escalation that cannot be signed away.

Effectiveness verification with read-across. After Samarco, no 8D closes without field evidence at every asset sharing the failure mode; one sister dam still exposed means the file stays open. And separate the verdict from the payer: rotate certifiers, fund them independently of the outcome, protect dissenting engineers. A declaration is the output of a stable dam, never an input to one.

My take

I was not there, and I have never audited a tailings dam. My reference points are assembly lines and audit rooms – but I recognise the mechanism instantly. Under VDA 6.3 and AS9100 I have sat across from binders so tidy they were suspicious, and I once found a control marked "passed" by three successive internal audits that was, physically, bypassed. The day I stopped trusting last year's result and began tracing one control end-to-end, to the device itself, my findings changed overnight.

At SNOP, most of our 70% defect-cost reduction came from refusing to let 8Ds stay closed until the floor confirmed it – re-verification, layered audits, reading the instrument instead of the closure memo. Brumadinho is that discipline scaled until the cost of failure stopped being euros per part and became criminal convictions. Prevention deferred is not money saved. It is debt unbooked, and the interest is paid in the worst currency there is.

By January 2019 that dam held two answers: a certificate saying stable, and drainage saying otherwise. The organisation believed the paper. The people who paid were 270 men and women, most of them its own employees, with lunch trays in their hands. Whenever your documentation and your physics disagree, believe the physics – then fix the system that taught your people to prefer the paper.