• Extract all the active causes and their underlying latent causes from your sources;
• Document the causes of the accident in terms of the above model.
• Discuss how the accident could have been prevented.
• In terms of prevention do not turn the failures around (i.e. if the cause was poor training
then preventative action would have been better training). Think in terms of systems and
safety management
PROGRESS FROM ERRORS/VIOLATIONS to CONDITIONS to DECISIONS/PROCESSES
Causes – All latent apart from the rainfall the night before?
Almost a year before the accident it was decided with the dam operator that no further deposition into
4A be made, however tailings continued to be deposited.
The dam between 4A and 4B was breached some time before the disaster, increasing the size of the
water pool, and pushing it away from the drainage pipe and up against the wall of the dam; satellite
imagery showed the pool against the wall of the dam in February 1994. This also meant that the pool
was no longer being drained by the penstock outlet in the centre of the pool.
At the time of the disaster the freeboard at the northern wall was contravening legislation that required
1m clearance, with a clearance of only 0.3m.
Rain falling into both 4A and 4B drained into the pool at the north dam, and despite the rainfall being
normal for that time of year, it was enough to cause the pool to overlap the northern wall and erode
loose material on the other side, weakening the dam and leading to a progression of minor collapses,
the debris from which was washed away rather than supporting the dam at its base. Finally a total
collapse of the dam took place when it could no longer contain the weight of water and tailings behind
it, and released over 2.5 million tons of tailings and water into Merriespruit.
Underlying causes/Latent failures –
The tailings dam was constructed in an unsuitable location; over a natural drainage valley and above an
existing settlement.
Hard economic climate had led to the reduction in the number of staff available to monitor the dam.
The manager of the operator had also been forced to reduce the amount of time he could spend
monitoring the Merriespruit site.
Personnel had been promoted to positions where they were responsible for monitoring the dam, but
were not given adequate training to allow them to do this.
The mining industry previously did not consider tailings dams and their operation a high managerial
priority as they provided no income. The prevention of disasters like Merriespruit however can clearly
be seen to prevent large-scale loss in the form of legal costs and prosecution as well as clean up costs.
Causes in terms of the safety management model –
Errors and violations –
It is hard to identify and errors or violations which led to the disaster with the current evidence. There is
the potential that problems with the dam were observed and not reported, or that tailings were
deposited or ordered to be despite awareness of the order not to do so.
Error and violation producing conditions –
If we assume that defects in the dam were observed, then their full import cannot have been
appreciated, either due to poor training of staff or inadequate communication of health and safety
policies and procedures. At the inquest the staff of the dam operator denied that the pool had migrated
to the northern wall of the dam until a satellite image showed that this was the case at least four
months before the accident. This could illustrate a severe lack of awareness of conditions at the site.
Management decisions and organisational processes –
The risk management system in place at Merriespruit was evidently ineffective; the order to halt
deposition did not reach all concerned, including the operator of the dam, a clear sign that the
responsibilities for risk management in this area were not clearly defined.
Staff were promoted to positions where they were responsible for the tailings operation, but without
the necessary training which would have enabled to them to identify dangerous conditions i.e., the pool
migration/dividing dam breach etc. It also seems that the importance of closely monitoring the tailings
operation at all was poorly communicated, and there was no way to measure the conditions…
Inspections appear to have been carried out in a purely reactive fashion (for example in March 1993
after the appearance of seepage), and there does not appear to have been any continuous review/audit
policy which would have confirmed that deposition had stopped or that the water levels in the dams
were improving.
There appear to be a number of control measures designed to prevent accidents of this kind from
occurring which were not effective:
The fact that deposition continued after March 1993 indicates that no planned and systematic
operational or safety plan was in place, otherwise it should have been impossible for the operator to be
unaware of the decision to halt deposition of tailings. Alternatively these systems were violated by an
individual(s), presumably unaware of the potential danger they were causing. Either situation indicates
that any safety procedures which were in place were not fully understood or communicated effectively,
and this was no doubt exacerbated by the reduced number of staff and management hours available to
the operator.
As regards control measures such as the breach in the dividing dam, the migration of the pool from the
penstock were not noticed, not reported, or if reported not considered worthy of action. In any case it is
clear that no proactive safety management process existed, as in a sense each of these circumstances
lead to or exacerbated another, and identifying and addressing any one of them may have prevented
the accident. In this case the decision to promote staff without proper training may be accountable as
the implications of the pool migration or breach of the dividing dam may not have been clear.
It is worth pointing out that an external audit, or even an inspection by trained operating personnel
should have identified the ineffectiveness of these control measures.
The dam failed because a number of control measures had been rendered ineffective due to a
workplace which either did not notice their failujre or appreciate it’s importance due to a
The overall picture is that of an organisation that was either criminally unaware of the circumstances in
the dam, or recklessly ignoring unsafe conditions. There was no systematically planned or implemented
safety management procedure for the tailings dam, with no effective review or audit system and the
potential for serious violations from operational workers responsible for deposition, and poorly trained
staff unable to identify dangerous conditions within the dam.
Prevention –
In future, tailings dams to be sited away from populated areas and on evenly drained land.
A system of regular inspection by trained staff whose findings would be conveyed to management who
would be responsible for altering safety management policies is necessary, and/or communicating any
changes or interventions to those responsible for ensuring their operation.
Management took a reactive approach to risk management, other disasters elsewhere showed the
importance of managing tailings operations systematically and carefully, and the fact that the dam was
only 320m from a settlement should have encouraged a proative and rigouros approach taking lessons
from these other disasters.