Brumadinho gave warning.
The contract wasn't listening.

At 12:28 on January 25, 2019, Dam I at Vale's Córrego do Feijão iron ore mine in Brumadinho, Minas Gerais, collapsed. It had been certified as stable eleven days earlier. In the ninety seconds it took the structure to liquefy, 12 million cubic meters of iron ore tailings — a viscous slurry of mining waste — engulfed the mine's administrative offices, cafeteria, and the downstream communities along the Paraopeba River. 270 people died. It was the deadliest industrial accident in Brazil since 1984.

It was also, by any technical measure, preventable.

This is not a retrospective indictment based on hindsight. The monitoring data that indicated structural failure existed in real time, was being collected by certified instruments, and was available to those responsible for the dam's safety. What did not exist was a legal mechanism capable of converting that data into binding action. No trigger. No automatic obligation. No governance architecture designed to interrupt the gap between recognition and response.

The Warning That Wasn't Heard

Interferometric Synthetic Aperture Radar — InSAR — detects millimeter-scale surface deformation from orbital altitude. It had been commercially available since the early 2000s and was standard practice in dam safety monitoring by 2019. Vale had contracted InSAR monitoring for the Córrego do Feijão site. The instruments worked.

Beginning in early December 2018, the InSAR data recorded surface deformation at Dam I accelerating at a rate of 3.4 millimeters per day. In dam safety engineering, this rate — particularly its acceleration profile — is a well-documented precursor to slope failure. The monitoring system flagged it. Internal engineers at Vale were aware of it. The Brazilian National Mining Agency (ANM) was the regulatory body responsible for enforcement. The dam was certified stable on January 14th, eleven days before it collapsed.

The threshold was crossed. It was crossed not once but repeatedly, and with increasing velocity. Under any reasonable interpretation of the available data, Dam I was exhibiting classical pre-failure behavior for a period measured in weeks, not hours. And yet the dam was certified stable — not because the data was unavailable, but because the legal system had no mechanism to override human judgment once that judgment was exercised.

The Architecture of Failure

Brazilian dam safety law at the time of the Brumadinho collapse operated on a discretionary model. Inspectors reviewed data. Certifiers issued opinions. Regulators could intervene — but intervention was a choice, subject to procedural review, organizational hierarchy, and the routine of institutional inertia. There was no binding trigger. No certification that, once issued, automatically activated a legal obligation independent of human decision.

This is the design problem. Not negligence, though there was negligence. Not corruption, though questions of capture persist. The structural failure is that even a well-functioning version of the same legal architecture — one populated by conscientious regulators and good-faith operators — would have produced the same gap. Recognition existed. Activation did not.

"The monitoring system was not the problem. The monitoring system worked. What failed was the legal architecture's ability to convert certified data into binding action without passing through a discretionary human gate."

c-ECO Research, TFP Level III Classification Analysis, 2024

The Timeline of a Preventable Disaster

What a TFP Clause Would Have Done

The Threshold Function Protocol is a legal architecture designed specifically to close the gap that Brumadinho exposed. It operates on a simple principle: when certified monitoring data exceeds a defined threshold parameter, contractual and regulatory obligations activate automatically — without requiring a managerial decision, a certification review, or any form of discretionary human gate.

Had a TFP clause been operative at Córrego do Feijão, the cascade would have looked like this: on approximately December 9, 2018, the InSAR deformation data would have been automatically processed against the Article 36 threshold parameters by the Calibration Council. Upon certification that the threshold had been exceeded, Vale's obligations under Schedule B of the TFP contract would have activated — non-delegably, non-waivably, and without requiring the approval of any individual within the company. Those obligations would have included immediate notification to ANM, suspension of operations in the downstream zone, and initiation of emergency structural assessment.

The Pattern: Samarco — Brumadinho — and What Comes Next

Brumadinho was not unprecedented. Four years earlier, in November 2015, the Fundão tailings dam at the Samarco joint venture (Vale and BHP Billiton) collapsed in Mariana, 120km away. Nineteen people died. The Rio Doce was contaminated along 600km — the longest river contamination in Brazilian history. The legal response produced new regulations, new monitoring requirements, and new emergency planning mandates. None of them contained a non-discretionary trigger. The discretionary model was reformed; it was not replaced.

The 2025 ANM dam safety audit documents that, seven years after Brumadinho and ten years after Samarco, 23% of Brazil's classified high-risk structures still operate without enforceable Emergency Action Plans. The regulatory deadline for compliance passed in April 2026. Enforcement is not automatic.

The pattern is not accidental. It is architectural. Each individual failure — Samarco, Brumadinho, the 23% figure — is a product of the same underlying design: a governance system that was built to recognize risk and then ask a human to decide what to do about it. In ecological governance, that design has a demonstrated failure mode. c-ECO exists to document it. The TFP exists to replace it.