Site Logo
ISSN (Impresso) 1679-4435 - ISSN Online 2447-0147
Acesso aberto Revisado por Pares

Historical and organizational sources of Córrego do Feijão dam disaster

Origens históricas e organizacionais do desastre da barragem do Córrego do Feijão

Ildeberto Muniz de Almeida1; José Marçal Jackson Filho2; Rodolfo Andrade Gouveia Vilela3´

DOI: 10.5327/Z1679443520190415


Man-made disasters, such as tailings dam failures, raise countless questions. Such is the case of the Vale S.A. dam in Brumadinho, which failed on 25 January 2019. Based on the Accident Analysis and Prevention Model (AAPM), in the present essay we raise some issues deserving of consideration in an in-depth analysis of this disaster. Following AAPM four axes — analysis of the normal operation, barrier analysis, change analysis and conceptual broadening — we sought to contribute to the understanding of the human, technological and organizational dimensions of the disaster. Investigations restricted to technical explanations of the dam failure do not seem to be acceptable. In the present case, analysis should elucidate decision making at several levels of the company management that possibly culminated in normalization of deviance and migration of the system toward accidents. The company’s influence on control and overseeing agencies evidences the weaknesses of the Brazilian disaster prevention model.

Keywords: public health; man-made disasters; accidents, occupational; mining.


A ocorrência de desastres feitos pelo homem, como as rupturas de barragens de rejeitos de empresas mineradoras, levanta inúmeros questionamentos. É o caso da barragem de Brumadinho, operada pela Vale, que se rompeu em 25 de janeiro de 2019. Pretende-se neste ensaio, apoiados no Modelo de Análise e Prevenção de Acidentes (MAPA), elencar questões que merecem ser consideradas na investigação em profundidade do desastre. Seguindo os quatro eixos do método — análise do funcionamento normal, análise de barreiras, análise de mudanças e ampliação conceitual —, pretende-se buscar entender as dimensões humanas, tecnológicas e organizacionais do desastre. Não parece aceitável investigação que se restrinja às explicações técnicas para a ocorrência da ruptura da barragem. Neste caso, a análise precisa esclarecer os processos de decisão tomada em diversos níveis da empresa que culminaram com a possível normalização de desvios e migração do sistema para acidentes. A influência da empresa sobre os órgãos de controle e fiscalização demonstra a fragilidade do modelo brasileiro de prevenção de desastres.

Palavras-chave: saúde pública; desastres provocados pelo homem; acidentes de trabalho; mineração.


Man-made disasters, such as failures of dams built by major global mining companies, raise many questions1-4. In-depth analysis of this type incidents is even more challenging in times of globalization5. The aspects considered to be potentially associated with the origins of disasters and their immediate, long-lasting and late effects are so many and diversified that analysis demands combining several methods and techniques.

The Accident Analysis and Prevention Model (AAPM), designed in Brazil as an innovative contribution to accident investigation, is based on the notion of “accident” as an event with human, technical and organizational dimensions6. In addition to other notions and methods used in studies of disasters and accidents, AAPM comprises four axes of data collection and interpretation to construct narratives and explanations for incidents. The origins of disasters can be found within a network of multiple factors which interact with each other and also with their physical, organizational, political and economic environment. This network has its roots in the history of the corresponding system6.

Ideally, all incidents should be described according to three dimensions: first, that of causes, which includes the decisions which resulted in hazards and risks and their regulatory mechanisms; the second, the dimension of exposures, which are the target of control actions by health and safety at work (HSW) management teams and external audit and/or surveillance agencies; finally, the dimension of immediate and late consequences, which are analyzed by company teams, the Unified Health System (Sistema Único de Saúde — SUS), other actors involved in the response to emergencies, and sectors other than healthcare, such as social security, justice and so forth.

With the help of AAPM, in the present essay we discuss possible paths for the analysis of the latest disaster caused by the mining company Vale S.A. Our interest is in establishing how much AAPM can help to elucidate incidents and identify unforeseen paths for prevention.

The procedures we applied correspond the to AAPM guidelines and thus begin with a short description of the incident, followed by four steps, all of them based on the question “How x (AAPM step) might contribute to the case investigation?”, to conclude with some final considerations.



This disaster followed that at the Samarco Fundão dam in Mariana, in 2015, during an unfavorable time for the iron ore market2. Differently, in the case of the Brumadinho incident, the iron prices were rising and the enterprise became highly profitable. The Vale S.A. management decided to maximize the shareholder value at the expense of the investment in safety, operations, research and development, which budget was considerably reduced in recent years7.

The dam that failed at Vale S.A. Feijão mine in Brumadinho had been established in 1976, and by the time of the incident it had been raised ten times. Although it had been disactivated the last three years, in December 2018 state licenses were granted from several purposes, including decommission, which involved the removal and processing of tailings from the Feijão pit to take profit of the ore it contained. Some video images point to the occurrence of classic dam wall liquefaction, resulting in the release of thousands of tons of tailings, which in less than two minutes hit the downstream administration buildings and company restaurant and spread across the region, hitting hotels, farms, rivers and a large section of the Atlantic Forest, destroying everything in their path. While the area hit by the tailings and the corresponding impacts are still being analyzed, it could be established — based on the number of deaths and missing people — that this was the major work accident in the history of Brazil1. In the period before the accident, the manual piezometers, which make narrow-focused measurements, were being replaced by automatic equipment, which performs continuous measurement. The dam stability had been assessed by a third party, which although indicated some corrections, considered that the situation was overall safe.



The analysis we propose here poses many challenges. According to AAMP, we should begin describing the activities performed at the deactivated dam and also those related to the new license. Here is also the place to attempt an explanation for the uncommonly high number of victims and to establish how much Vale S.A. business and safety management practices — even after the warning represented by the disaster in Mariana — contributed to cause the incident.

Let us, then, proceed to the method steps.



The first axis of analysis in AAPM is based on notions from activity-centered ergonomics; just to illustrate, some examples of the main suggested questions are:

• What activities were simultaneously performed immediately before the accident? What were the system activities potentially involved in the incident origin and outcomes, including those carried out long before?

The answers to these questions require considering aspects such as:

• Activity of the staff responsible for the original dam and later raising projects. If designed by different firms, the main differences between projects and foreseen safety implications should be identified.

• How many dam raising projects were foreseen in the original project? To what height and under which conditions? Was the original project considered in the later ones?

• Construction activities for each dam/raising project, planned drainage and monitoring.

• History of the operational activities until 2016 (stored tailings unloading).

• Activity of project managers at each step, including recorded differences between the planned and effective constructions. Who was involved in the decisions concerning such differences and how? How the structure safety aspects included in the original project were considered in decision making?

• Activities planned for the deactivated dam and records of the remaining activities at the Feijão mine. Were some of the planned activities not executed? How decisions were made in such case?

• What were the reasons to implement automatic piezometers following the execution of the tenth rising project? Who participated in decision making and how?

• Activities of dam maintenance managers. What were they and in what they consisted? Survey reports and effectively performed and/or postponed adjustments.

• Dam stability monitoring activities. History of evaluations and recommended adjustments and whether they were performed or not, deadlines and eventual delays, with the corresponding reasons. Who received these reports? Who was responsible for decision making relative to recommendations? Were some recommendations not met? How decisions were made?

• When (before and after the Fundao dam failure) the inadequate — downstream — location of the administration buildings and company restaurant was discussed? Who participated in this discussion? What arguments were adduced to keep these buildings in operation?

• Dam licensing activities. Who appointed the heads of the licensing agencies? What studies were used to ground decisions? How did budget allotments, composition and training of teams and policies and practices relative to the criteria to improve the quality of services evolve?

• How routine activities were developed in the accident-free system? The point here is to establish whether problems such cracks, drainage malfunction, wall moisture, delay to comply with improvements recommendations were part of the staff ’s daily work routine. If they were, how did they deal with them? What values and criteria guided decision making?

• What is the company’s managerial structure? How did it evolve in times of globalization and financialization? How did decision making on shareholder value, investment in maintenance, cost of “tailings dams” and “health and safety” at the organization and the Feijão mine evolve over time6?

The attempts at retracing the system’s history are facilitated by techniques such as drawing timelines describing the main events and facts along the historical progression of an organization and the actors with which it establishes the most significant interactions.



Barrier analysis (BA) begins by identifying the dangers and risks to be controlled in a system, including the barriers to be implemented for prevention (avoiding disasters), monitoring (working conditions and operational status) and protection against or attenuation of impacts.

In the present case, dam failure is the main danger to be considered. The fact that the high-risk downstream location of the administration buildings and company restaurant was not changed — leading to the final tragedy — is noteworthy. BA goes beyond the mere identification of this grotesque management flaw, but seeks to establish how the corresponding decision was made. What values and criteria guided it? If analysis does not contribute to put such values and criteria into question nor does it point to the need to change them, new safety problems will certainly occur.

Being the safety problems posed by upstream dams well known, what preventive measures should be established, according to the legislation and the latest information, to avoid failures? What measures were effectively implemented at the Feijão dam? What problems (piezometer deactivation, drainage obstructions, etc.) were rated as not posing any danger of dam failure? What was the actual operation of barriers at the mine when in activity and after deactivation?

Danger could have been avoided were the companies to have selected safer construction techniques than the upstream raised method, as e.g. the downstream raised method and dry tailings storage, among others.

The upstream raised method is considered less safe, and despite being banned in several countries, it is still taught and advocated by engineers in Brazil, who rate it acceptable provided due maintenance is assured. This is the admittedly less expensive method. However, it is not clear how the human, social, financial, cultural and image costs, among others, of disasters such as Vale S.A.’s in Mariana and Brumadinho enter the calculations. It is time to abandon this method once and for all!

In our view, “analysis should make organizations confront their decisions and [corresponding] implications”1. This is to say, reviewing and re-discussing decisions like the ones made in the case we discuss here and the values and criteria which were prioritized in each particular situation.

A second line of barriers against this type of disasters involves reducing the potential energy of the system. In other words, to set limits to the amount of tailings that is considered to be safe. How many thousands of tons might or should be considered “safe” or “acceptable”? Who was responsible for decision making in this regard? Was this a technical issue, to be settled by allegedly unbiased bureaucrats indicated by lobbies of the interested companies or politicians whose campaigns were funded by mining firms? Or should the residents of the areas potentially affected — by disasters or mining operations — have opinion and/or voting rights?

Analysis should further focus on the detail of the dam raising projects. Which voices were heard and which ones were not? What studies were made available to the decision-making authorities? Who conducted such studies? Who funded such studies? Were any checking procedures performed independently from the company’s interests?

The third line of questions relative to barriers follows at least three directions, all of them collective: what do investigators, workers (operation, maintenance, monitoring, etc.) and experts in safety and in the design and construction of upstream dams say about the barriers to the established to prevent, monitor and mitigate the impacts of disasters involving these constructions? What are the recommended and the effectively implemented measures?

As is known, the answers to these questions require analyzing the dam history, including aspects such as:

• What barriers could have contributed to avoid the disaster and/or minimize its impacts? What are the reasons for the absence of or flaws in such barriers?

• The construction project was effectively executed as designed? If it was not, who made the decisions about the changes made?

• Did the dam operation — also along the period it was deactivated — correspond to that projected or expected?

• Besides the — manual — alerts, what other barriers did not work as expected in Brumadinho? What are the reasons which explain the failure of this barrier?

• Before and after the Fundão dam failure in Mariana, were there any internal discussions on the available alert system? Was the possibility of the alert system being destroyed before it could be activated ever considered? Were recommendations made to include redundant and/or diversity alert systems?

• Who calculated the flooding area included in the mine emergency plan and how? When and for which dam raising conditions was it calculated? How can the enormous gap between plans and reality be explained?

• Was any personnel evacuation training provided considering the dam failure time? Was the time for selfrescue in case of dam failure calculated? Since there was not sufficient time for self-rescue, how was this problem addressed?

• Did the effective stability monitoring comply with the periodicity defined as best practice?

• Were recommendations for adjustments included in the formal reports to the company? Were there any delays in this regard? What decisions contributed to cause delays?

• How the Health and Safety at Work Management System (HSWMS) participated in the dam failure prevention actions? Were findings relative to other dam failures in Brazil and worldwide included in HSW management?

According to BA, the explanation for the dam failure and its magnitude essentially depends on flaws in the existing barrier system implemented to control this risk. Considering the potential dimensions of this type of disasters, HSWMS is expected to duly design, implement and monitor the execution and outcomes of the suggested control measures8. It is also expected that management systems include mechanisms for improvements and updates in constant interaction with the progression of the knowledge on the safety of this and similar activities. Efforts toward organizational learning based on case studies of previous dam failures and other types of disasters are crucial for this purpose.

For this reason, analysis further considers “lifecycle” issues and whether the existing barriers are the ideal or not. Within the lifecycle approach, barriers are analyzed from the stage of conception to those of construction, operation and maintenance. Ideal barriers are those able to detect signals, diagnose situations, act and self-monitor themselves. On these grounds, the barriers at the Feijão mine dam did not meet the ideal requirements9.



The main change associated with the disaster was the dam failure. Such change was partly due to the absence or failure of barriers, which origins were mentioned above. The next task of the analysis team is to investigate the degree in which several changes contributed to the origins the dam failure.

The answer to this question requires reconstructing the dam history, particularly the successive raising of its height and other structural changes:

• Is it true that just as in Mariana, also the Feijão dam underwent reform that changed its structural axis? What are the safety implications of these adjustments?

• What were the main changes along the dam history? Who decided what was to be done and how? Was the raising work done according to what was established in the projects? Were the construction and/or safety management practices different than those most frequently adopted in any stage of construction work?

• Were there substantial iron production fluctuations at the Feijão mine? Was there any overlapping between iron-ore price hikes in the international market and faster granting of licenses or increased extraction? When the prices fell, was production increased to compensate for losses, thus increasing the tailings production rate? Was the investment in maintenance and/or safety cut?

• Was there a history of cracks and defects in the dam walls? Of chronic or hard-to-solve problems involving the drainage system or the auscultation equipment? Were there problems which led, or should have lead, to immediately interrupt operations, or requiring the management to implement urgent measures? If so, how were such situations dealt with? What adjustments were made and what were the deadlines? What were the values and criteria which guided decision making?

• Are there records of disagreement against the prevailing opinion? How was it approached?

• Did the upper management change the production plans and priorities at any time along the history of the Feijão mine as a function of recommendations made in reports prepared by third parties or of opinions of external agencies, especially in regard to the dam safety?

• How did the legal basis, structures, budget and installed capacity (human and material) of the agencies charged of licensing and overseeing mining companies in Brazil evolve along the past decades?

Change analysis is based on the idea that the origins of disasters involve facts or aspects absent in the accident-free system operation, such as incidents, flaws or sudden occurrences. A better structured and efficient SHW management system is able to stand changes better. Given such conditions, disasters tend to happen when the accumulated changes surpass the recovery capacity of the system6.

Analysis often shows that an incident was triggered by the implementation of strategies or practices used successfully in the past. Under such circumstances, the analysis team should look for the reasons for the failure of such measures in that particular instance. This approach leads to the investigation of aspects of the organization of work and the safety and organizational culture and how they interfere with the strategies to deal with variations in the system performance.

Given the difficulties associated with the investigation of these aspects, the analysis team should begin by making agreements with the involved actors in regard to the access to documents and individuals willing to collaborate. Analysis should be understood as a collective and collaborative process that seeks to redefine the meaning of the notions of accident and responsibility within the system to contribute to its continuous improvement.



Within the AAPM framework, conceptual broadening consists in reviewing some aspects with the help of notions borrowed from many different fields of knowledge, particularly those previously used in studies of accidents and/or disasters.

In regard to the case of the dam failure in Brumadinho, normalization of deviance10 and migration toward accidents11 stand out among several potentially useful notions. How? The starting point is to select the aspect to be reviewed from such broader conceptual perspective. In the present case, the selected aspect was the company’s “attachment” to the argument that the dam was stable and safe.

Detecting problems which require a solution is common in the routine of companies. Normalization of deviance was described as a process that includes10:

• Official recognition of hints indicative of increased danger;

• Reviews based on engineering analysis, additional tests, risk quantification;

• An official conclusion that normalizes deviance by rating risk acceptable (or a threat that requires interrupting activities until the problem is solved);

• The decision to decommission a system with known risks.

In regard to migration toward accidents, a similar process develops with managers and operators involved in crisis or conflicting objectives management. Upon choosing to restart the dam decommission procedures — even when aware of the delays in the interventions needed to solve the draining system problems and those associated with the inactivated piezometers — the decision makers pushed the system toward such “migration”11.

It seems that in such cases, decisions are not made systematically or grounded on objective criteria. However, repeating a previous and successful decision pushes the system close to the point of no return, which once reached triggers a disaster even when “anodyne decisions” are made.

The key-aspect to elucidate, then, is: did the safety management consider the existence of a cut-off point between success and failure in such cases?

The path of analysis requires elucidating what the routine work of the involved actors was. Who was charged of decision making? A person or a group? Were decisions made onsite or remotely? How the opinions of outsourced workers were considered? What did the analyses which concluded that the detected problems did not pose any immediate threat to the dam include? The safety of any system decreases with each decision made. Migration toward disasters emerges as a side effect of decision making from the perspective of decision makers, who reach their conclusions within a context characterized by simultaneous activities, while dismissing the impacts of possible interactions with the decisions made by other actors within the system.

The arguments adduced by companies to defend their criteria for risk assessment resist even after the occurrence of disasters evidence their inadequacy. Beck’s12 criticism of the controllability of the risk recognition process by means of the “validity criteria” of the “proof of causality” helps one understand this situation:

The higher these [validity] criteria, the smaller is the circle of recognized risks, and the larger becomes the accumulation of unrecognized risks. Of course, it is also true that the walls of recognition in front of the risks only grow higher.

Normalization of deviance and migration toward accidents further reveal the deficiencies of the objectivism companies adduce to justify the unjustifiable.



Although our analysis in the present study is preliminary, it enables us raise some issues which contribute to reveal the weaknesses of the Brazilian disaster prevention system. The mining activity involves a large network of actors, including permanent and temporary employees, environmental licensing agencies, environment and labor surveillance agencies, civil defense and firefighters, among others, which actions were found to be disjointed and uncoordinated.

The dam failure thus emerges as the result of a network of multiple interacting aspects. Investigations should establish the role of the active — deactivated — under decommission dam dynamics in the origins of the disaster by way of the choice of construction methods known to be less safe combined with the decision to assume some risks, such as maintaining the administration buildings downstream, made on the basis of values and criteria which safety implications still need to be made explicit and discussed. This last decision seems to have been influenced by Vale S.A.’s place within the process of globalization and financialization, including market fluctuations, and how all of this influenced decision making on the investments to maintain operations, the dam safety and shareholder value, with the consequent reflection on the Feijão mine.

Within the AAPM framework, this disaster cannot be reduced to technical explanations of the dam liquefaction1. The values and criteria which underlay the company decisions fully disrespect the notions of safety culture and corporate social and ethical responsibility.

The main limitation to the path of analysis described here is its evident incompleteness, also regarding some outstanding aspects of AAPM, such as the need for studies to investigate the long-term and late consequences of disasters for the affected area and the role of licensing and overseeing institutions1. The contribution of the disaggregation of governmental devices and the company’s influence on the public sector still need to be investigated to shed light on this dark side that caused the “failure” of the Brazilian disaster prevention system.



The authors thank the Labor Auditor of Minas Gerais, Mário Parreiras de Fatias, for his presentation of the case investigation at the Accident Analysis Course, School of Public Health, in February 2019.



1. Almeida IM, Jackson Filho JM, Vilela RAG, Silva AJN. Razões para investigar a dimensão organizacional nas origens da catástrofe industrial da Vale em Brumadinho, MG. Cad Saúde Pública [Internet]. 2019 [acessado em 10 maio 2019]; 35(4):e00027319. Disponível em:

2. Wanderley LJ, Mansur MS, Milanez B, Pinto RG. Desastre da Samarco / Vale / BHP no vale do Rio Doce: aspectos, econômicos, políticos e socioambientais. Ciênc Cult. 2016;68(3):30-5.

3. Porto MFS. A tragédia da mineração e do desenvolvimento no Brasil: desafios para a saúde coletiva. Cad Saúde Pública [Internet]. 2016 [acessado em 7 fev. 2019];32(2):e00211015. Disponível em:

4. Rocha RL. Os negócios da mídia e a comunicação da saúde. Cad Saúde Pública. 2016;32(2):e00000616.

5. Le Coze JC. Globalization and high-risk systems. Policy Practice Health Safety. 2017;15(1):57-81.

6. Almeida IM, Vilela RAG, Silva AJN, Beltran SL. Modelo de Análise e Prevenção de Acidentes – MAPA: ferramenta para a vigilância em saúde do trabalhador. Ciênc Saúde Coletiva. 2014;19(12):4679-88.

7. Belluzzo LG, Sarti F. Vale: uma empresa financeirizada. Le Monde Diplomatique. 2019.

8. Levenson NG. A New Accident model for engineering safer systems. Safety Science. 2004;42(4):237-70.

9. Hollnagel E. Barriers and accident prevention. Londres: Routledge; 2004. 242 p.

10. Vaughan D. The Challenger launch decision: risky technology, culture and deviance at NASA. Chicago: University Chicago Press; 1996.

11. Rasmussen J. Risk management in a dynamic society: a modelling problem. Safety Science. 1997;27(2-3):183-213.

12. Beck U. Sociedade de risco. Rumo a uma outra modernidade. São Paulo: Editora 34; 2010. 359 p.

Recebido em 13 de Março de 2019.
Aceito em 14 de Março de 2019.

Fonte de financiamento: Fundação de Amparo à Pesquisa do Estado de São Paulo (FAPESP): Projeto 2012/04721-1


Todos os Direitos Reservados © Revista Brasileira de Medicina do Trabalho