Anatomy of a Collapse

The contract was working.
The dam was not listening.

In September 2015, TÜV SÜD certified the Fundão dam as stable. On November 5, it collapsed. Nineteen people died. The Rio Doce — 850 kilometers of it — reached the Atlantic Ocean carrying iron ore tailings. Brazil had never seen an environmental disaster at this scale. It would not be the last.

Fig. 01 Aerial view of the Fundão dam breach, Mariana, Minas Gerais, November 2015. The tailings wave destroyed the village of Bento Rodrigues downstream. Photo: Reuters / Brazil government.

I. The architecture of the failure

Samarco's Fundão dam was not an anomaly. It was the product of a standard approach to tailings management that had been used across Brazil's mining sector for decades — upstream construction, volume maximization, regulatory compliance as the primary safety metric. What distinguished Fundão from dozens of other dams operating on the same logic was not the nature of its design flaw. It was that the flaw activated first.

The upstream construction method — in which each successive lift of the dam is built atop the deposited tailings of the previous one — is the cheapest, fastest method of expanding tailings capacity. It is also, under saturated conditions, the most vulnerable to liquefaction. Brazilian regulators permitted it. Brazilian law required stability certification. The certification system created by that law, in practice, measured what could be measured: geometric parameters, seepage levels, instrumentation readings. It did not, and by design could not, assess what happens when the underlying assumptions of the model fail to hold.

In September 2015, TÜV SÜD's engineers reviewed Samarco's instrumentation data and certified the Fundão dam as stable. Their methodology was consistent with prevailing standards. Their conclusion was wrong.

"The monitoring system worked. It collected the data. The data was reviewed. The dam collapsed anyway. This is not a failure of measurement. It is a failure of architecture."

— c-eco.org, Case File № 02

II. What the data said

Internal Samarco documents later disclosed in litigation showed that the company had tracked anomalous pore pressure readings in the dam's body for months before the collapse. Pore pressure — the pressure of water within the soil matrix — is a primary indicator of liquefaction risk. Elevated readings trigger remediation requirements under the certification standards that governed the dam.

The remediation did not occur. The readings were logged, reviewed, and assessed against the existing stability model. The model, calibrated on historical performance rather than failure scenarios, returned a finding of acceptable risk. The certification was maintained.

This is the structural mechanism that the doctrine of temporal integrity identifies as catastrophic: a legal system that converts a discretionary finding ("acceptable risk") into a binding authorization, without a non-discretionary trigger for intervention when the parameters that define "acceptable" are violated in real time. The monitoring flagged the problem. The legal architecture converted that flag into a conclusion of safety. The gap between those two things — 47 days of anomalous readings before the Brumadinho collapse, months of pore pressure anomalies before Fundão — is not a gap in monitoring. It is a gap in law.

III. The certifier

TÜV SÜD, the German technical certification firm, issued the stability declaration for Fundão in September 2015. The same firm issued the stability declaration for Vale's Córrego do Feijão dam at Brumadinho — also just months before its collapse — in September 2018.

This coincidence is not the point. The certifications were not negligent by the standards of the regulatory regime that authorized them. They were standard. What they shared was a structural feature: both were conclusions reached by applying a model to data, where the model's validity depended on assumptions about subsurface conditions that the model could not independently verify.

The problem is not the certifier. The problem is a regulatory design that treats a probabilistic technical finding as a legal authorization — and that provides no mechanism for converting anomalous real-time data into mandatory intervention, regardless of what the certification says.

IV. The river

The tailings wave from Fundão traveled 663 kilometers down the Rio Doce, Brazil's fifth-longest river, reaching the Atlantic Ocean at Regência, Espírito Santo, sixteen days after the collapse. The plume killed fish, destroyed water treatment infrastructure for 22 cities, and contaminated the primary water source for indigenous and riverside communities along the entire river course.

Ten years later, the Rio Doce has not recovered. The terms of the legal settlement — a R$155 billion reparation agreement reached in October 2024 after nearly a decade of litigation — include restoration commitments that environmental scientists estimate may require 20 to 30 years to show measurable impact, if they are performed as specified.

The damages are denominated in currency. The losses are denominated in time. The doctrine of temporal integrity holds that these two measures are not interchangeable: a right that cannot be restored is not compensated by a payment, however large. The Rio Doce is the most visible instance of that proposition in Brazilian environmental law.

V. The pattern

On January 25, 2019 — three years, two months, and twenty days after the Fundão collapse — Vale's Córrego do Feijão dam at Brumadinho collapsed. 270 people died. The dam had been certified stable by TÜV SÜD four months earlier.

Between the two events, Brazil enacted Law 14.066/2020 — the dam safety law — which mandated the decommissioning of all upstream-method dams, established new inspection requirements, and created liability frameworks for certification failures. These were significant reforms. They were enacted in response to Brumadinho. They were not sufficient to prevent it.

The question this case file asks is not whether Brazilian law responded to Fundão. It did. The question is whether the response was designed to interrupt the pattern — or to comply with it. Compliance, in this context, means adopting new monitoring requirements, certification standards, and liability rules within the same architectural framework that allowed Fundão to collapse: one in which the legal trigger for intervention is a discretionary expert finding, not a non-discretionary threshold.

The Brumadinho collapse, four years later, is the answer.