• Extract all the active causes and their underlying latent causes from your sources;
• Document the causes of the accident in terms of the above model.
• Discuss how the accident could have been prevented.
• In terms of prevention do not turn the failures around (i.e. if the cause was poor training
then preventative action would have been better training). Think in terms of systems and
safety management
PROGRESS FROM ERRORS/VIOLATIONS to CONDITIONS to DECISIONS/PROCESSES
Causes –All latent apart from the rainfall the night before?
Almost a year before the accident it was decided with the dam operator that no further deposition into 4A be made, however tailings continued to be deposited.
The dam between 4A and 4B was breached some time before the disaster, increasing the size of the water pool, and pushing it away from the drainage pipe and up against the wall of the dam; satellite imagery showed the pool against the wall of the dam in February 1994. This also meant that the pool was no longer being drained by the penstock outlet in the centre of the pool.
At the time of the disaster the freeboard at the northern wall was contravening legislation that required 1m clearance, with a clearance of only 0.3m.
Rain falling into both 4A and 4B drained into the pool at the north dam, and despite the rainfall being normal for that time of year, it was enough to cause the pool to overlap the northern wall and erode loose material on the other side, weakening the dam and leading to a progression of minor collapses, the debris from which was washed away rather than supporting the dam at its base. Finally a total collapse of the dam took place when it could no longer contain the weight of water and tailings behind it, and released over 2.5 million tons of tailings and water into Merriespruit.
Underlying causes/Latent failures –
The tailings dam was constructed in an unsuitable location; over a natural drainage valley and above an existing settlement.
Hard economic climate had led to the reduction in the number of staff available to monitor the dam. The manager of the operator had also been forced to reduce the amount of time he could spend monitoring the Merriespruit site.
Personnel had been promoted to positions where they were responsible for monitoring the dam, but were not given adequate training to allow them to do this.
The mining industry previously did not consider tailings dams and their operation a high managerial priority as they provided no income. The prevention of disasters like Merriespruit however can clearly be seen to prevent large-scale loss in the form of legal costs and prosecution as well as clean up costs.
Causes in terms of the safety management model –
Errors and violations –
It is hard to identify and errors or violations which led to the disaster with the current evidence. There is the potential that problems with the dam were observed and not reported, or that tailings were deposited or ordered to be despite awareness of the order not to do so.
Error and violation producing conditions –
If we assume that defects in the dam were observed, then their full import cannot have been appreciated, either due to poor training of staff or inadequate communication of health and safety policies and procedures.At the inquest the staff of the dam operator denied that the pool had migrated to the northern wall of the dam until a satellite image showed that this was the case at least four months before the accident. This could illustrate a severe lack of awareness of conditions at the site.
Management decisions and organisational processes –
The risk management system in place at Merriespruit was evidently ineffective; the order to halt deposition did not reach all concerned, including the operator of the dam, a clear sign that the responsibilities for risk management in this area were not clearly defined.
Staff were promoted to positions where they were responsible for the tailings operation, but without the necessary training which would have enabled to them to identify dangerous conditions i.e., the pool migration/dividing dam breach etc. It also seems that the importance of closely monitoring the tailings operation at all was poorly communicated, and there was no way to measure the conditions…
Inspections appear to have been carried out in a purely reactive fashion (for example in March 1993 after the appearance of seepage), and there does not appear to have been any continuous review/audit policy which would have confirmed that deposition had stopped or that the water levels in the dams were improving.
There appear to be a number of control measures designed to prevent accidents of this kind from occurring which were not effective:
The fact that deposition continued after March 1993 indicates that no planned and systematic operational or safety plan was in place, otherwise it should have been impossible for the operator to be unaware of the decision to halt deposition of tailings. Alternatively these systems were violated by an individual(s), presumably unaware of the potential danger they were causing. Either situation indicates that any safety procedures which were in place were not fully understood or communicated effectively, and this was no doubt exacerbated by the reduced number of staff and management hours available to the operator.
As regards control measures such as the breach in the dividing dam, the migration of the pool from the penstock were not noticed, not reported, or if reported not considered worthy of action. In any case it is clear that no proactive safety management process existed, as in a sense each of these circumstances lead toor exacerbated another, and identifying and addressing any one of them may have prevented the accident. In this case the decision to promote staff without proper training may be accountable as the implications of the pool migration or breach of the dividing dam may not have been clear.
It is worth pointing out that an external audit, or even an inspection by trained operating personnel should have identified the ineffectiveness of these control measures.
The dam failed because a number of control measures had been rendered ineffective due to a workplace which either did not notice their failujre or appreciate it’s importance due to a
The overall picture is that of an organisation that was either criminally unaware of the circumstances in the dam, or recklessly ignoring unsafe conditions. There was no systematically planned or implemented safety management procedure for the tailings dam, with no effective review or audit system and the potential for serious violations from operational workers responsible for deposition, and poorly trained staff unable to identify dangerous conditions within the dam.
Prevention –
In future, tailings dams to be sited away from populated areas and on evenly drained land.
A system of regular inspection by trained staff whose findings would be conveyed to management who would be responsible for altering safety management policies is necessary, and/or communicating any changes or interventions to those responsible for ensuring their operation.
Management took a reactive approach to risk management, other disasters elsewhere showed the importance of managing tailings operations systematically and carefully, and the fact that the dam was only 320m from a settlement should have encouraged a proative and rigouros approach taking lessons from these other disasters.