Editorial: 20th Biennial BDS Conference 2018 – Binnie Lecture: the role of inspection and monitoring in risk and asset management

Good evening Madam Chairman, ladies and gentlemen and fellow panel engineers. I am honoured to be standing here tonight presenting the biennial Binnie Lecture, and feel somewhat humbled by the experience. Acceptance of such a prestigious invitation invariably has a sting in the tail and I now appreciate how guests on Desert Island Discs feel, as trying to summarise a 50-year career in an hour has proved somewhat difficult. However, such invitations work both ways and therefore as it is suggested that engineering, and particularly geotechnical engineering, is more an art than a science, in the words of the great Tom Lehrer: ‘I have suffered for my art and now it's your turn’.

It is impossible to have spent more than 50 years as a dam engineer without unwittingly standing on the shoulders of giants of both engineering and geology, from Hook, Newton, Lyell and Mantell to Terzaghi, Bjerrum, Janbu, Bishop and Skempton. There are others to whom I owe a personal debt of gratitude for guiding me through the early stages of dam engineering: Nick Riley, Derek Marriott and John McKenna to name but a few, with a special mention of John Knill, my engineering geological mentor. However, more prosaically, I am grateful to certain partners of WLPU Consultants who were responsible for my catching an overnight train to Cornwall in July 1975, a trip which changed my career and whence started the eponymous witterings which have continued unabated ever since.

The title of this paper could equally be ‘The unintelligible ramblings of an itinerant engineer’, which might be more fitting as it reflects some 50 years of visit notes – often dictated from the carriages of overnight trains or the departure lounges at airports – which have continued uninterrupted throughout my engineering career. These have been well-thumbed in preparation for this lecture, which hopefully will inform as well as provoke.

Those who are familiar with my career will know that I have spent as many years engineering dams for tailings disposal as I have for water supply. There has always been the suspicion, particularly among panel engineers, that tailings dams are different and are somewhat of a black art. However, the examples given (Figure 1) show the similarities rather than the differences and emphasise that for a confining embankment, whether it is for the safe storage of water or for tailings, the same engineering principles apply.

Over the past 50 years I have kept a very instructive file of dam failures, which from my records seem to have occurred at regular intervals throughout my career – though fortunately none involved me personally. From Jupille in 1963 to Laos in July 2018 there has been a succession of dam and mine waste tip failures from which engineering lessons should have been learned. The number of deaths recorded for each event (Table 1) show the consequences of failure and, more importantly, the result of inadequately assessing risk in geotechnical structures. Post-failure analyses show that a comprehensive system of risk management and mitigation would almost certainly have prevented the majority of these failures or, at minimum, reduced the scale of death, damage and injury. The understanding and mitigation of all foreseeable risks is a major preventative in limiting failure and damage, and therefore in the context of this paper risk assessment equates to asset management. However, we need to understand what is meant by ‘risk assessment’ and how the inspection process can be applied in its broadest context in order to reduce the incidence of failure and the occurrence of untoward events. In many jurisdictions emergency planning guidance has adopted a source/pathway/receptor approach as the basis for all risk/consequence assessments. This can be defined simplistically as follows

This approach is helpful in addressing the overarching risk posed by an embankment dam, but it should be recognised that it is only an umbrella under which a detailed supporting assessment and analysis is required. The source/pathway/receptor approach is a useful starting point for describing potential post-failure consequences and can be applied to all embankment dams (Figure 2). This figure shows the at-risk structure separated into elements determined by either their geotechnical or hydrodynamic characteristics, with examples of each failure type taken from Table 1 (Cambridge, 2018). In this figure the source is the confining structure, the pathway is the valley downstream and the receptor is any person, habitation or environment in that pathway. Such an analysis enables the definition of consequences arising from a failure, which may range from none, where the pathway is severed, to death, injury or damage to the receptor. This approach enables the evaluation of those consequences and the assessment of the criticality of the confining structure. Importantly, within the EU the depth of flow, the velocity in the downstream catchment and the number of people involved, together with the extent of any environmental damage, will determine the categorisation of a facility. In the case of a structure classified as a mine waste facility under the Extractive Waste Directive – that is, a tailings dam- a non-category A dam may be re-categorised as category A if these impacts exceed the defined threshold values, with all the concomitant design, construction and operational requirements (EC, 2006).

While undertaking a risk and consequence evaluation, it is important for engineers to understand their responsibilities. In simplistic terms, engineers are responsible for the failings of structures as well as for their successful design and construction, since

• Engineers design structures

• Structures fail

• Ergo, engineers design failures

• (with apologies to Socrates)

The success of a design is a function of the completeness of the risk assessment and of the accompanying risk register, which should comprise a record of all those destabilising factors, their causation and any mitigation measures required. In order to complete such a register and to minimise the chance of failure, a dam engineer must use his engineering judgement by

• considering all potential failure modes

• ensuring that each mode is fully mitigated through all phases of design, construction, operation and monitoring.

The inspection process has a major role to play at each stage of design and construction, as exemplified by the strategy developed for the recently published European Guidelines (Cambridge, 2018). The flowsheet (Figure 3) shows the development of a strategy based on material and facility characterisation and on the identification of failure mechanisms. Risk-based decision making leads to selection of the optimum design approach and to an appropriate construction and operation system. The flowsheet is iterative, as it requires feedback into the design at each stage of the structure such that lessons are learned and the embankment is modified as quality control or construction incidents occur. This strategy applies throughout all phases of embankment dams, particularly in the case of a tailings dam which, due to its design parameters, will invariably be stage-constructed and require a repetition of the cycle of investigation, characterisation, design, construction, CQA and peer review throughout its life. This process should be underwritten at all stages of the development of an embankment dam by a robust inspection and design/construction review system.

The importance of understanding risk and ensuring suitable mitigation measures throughout the design and construction phases is a fundamental element of dam engineering. Risk assessment can be equated to thought experimentation in which highly structured hypothetical questions employing ‘what if?’ are posed, as exemplified by Schrödinger's cat. The risk assessment for an embankment dam can be simplistically equated to a thought experiment as it comprises an overarching life-cycle ‘what if?’ study. This process is not one which can be readily addressed solely through quantitative risk assessment, fault trees, probability theory, abstruse risk management techniques or complex computational methods but rather relies heavily on engineering judgement in assessing the hazard, determining the severity of the risk and in developing suitable mitigating solutions. The examples quoted later concentrate in particular on the geological, geotechnical and geochemical elements of the planning, design, construction and monitoring of embankment dams, with an emphasis on risk assessment and the importance of risk registers.

Engineers ignore history at their peril, a mantra which is expressed far better by George Santayana as ‘those who cannot remember history are doomed to repeat it’. Understanding risk and initiating adequate mitigation measures are, as described, fundamental elements of the design process and important lessons can be learned from history, particularly from engineering failures. This process is not a matter of statistics but requires the application of engineering judgement and ‘common sense’ in order to determine both potential failure modes and mitigation solutions for all foreseeable risks. The development of a comprehensive risk register involves the rigorous application of thought experimentation, as shown in the mine waste facility example (Table 2).

In this example, the design strategy is developed for each project sector and for each risk parameter, which in turn leads to the identification of a set of macro failure modes. A similar initial risk register can be developed for water supply embankment dams using the same principles, though is likely to include fewer elements than for a tailings dam due to the limited number of design and construction phases and the generally fewer dependent variables. As the dam design process develops and the parameters for each individual element of the structure are clarified and the potential failure mechanisms identified, higher-level risk registers for such elements as static and seismic stability, foundation characteristics and construction materials can be detailed and more parameter-specific failure modes generated. The simplified example showing selected macro failure modes (Table 3) could, for instance, be equally applicable to any type of embankment dam, the aim being to ensure compliance with design criteria and appropriate mitigation of all risks.

The key principle of a risk register is the overriding importance of identifying ALL potential failure modes and of ensuring that suitable mitigating measures have been incorporated into the design. Further, it is important that this process include both peer review, in order to confirm that all risks have been appropriately mitigated, and the preparation of a formal record in a future-proofed format – that is, the detailed risk register.

In many jurisdictions risk mitigation is addressed partially through regulation and the application of national standards. However, this does not negate the responsibility of the dam engineer for undertaking a thorough risk assessment and completing a series of appropriate design support registers. In the UK such regulation has been developed primarily as a response to untoward incidents involving fatalities.

The Aberfan colliery spoil tip tragedy occurred on 21 October 1966 during my first year at university and it has had a major impact on my career over the past 50 years. It is a classic example of the failure to consider all risks and thus to mitigate all potential failure modes (Bishop, 1973). There were key pre-event indicators in 1944, 1963 and early in 1966, and a parallel failure in the same valley in 1939, which blocked a road, a railway and a river, with further warning signs in the period leading up to the disaster. These pre-event indicators were apparently ignored and no action was taken by the owner or by senior supervisors, a tragic omission which resulted in 144 deaths of which 139 were children. The associated risks were not appreciated and there was no communication regarding hazard potential or, more importantly, any appropriate assessment of the safety of the tip. The subsequent Tribunal Report (HMSO, 1967) was damning in that the owner was blamed for an absence of tipping policy, for poor communication and for a lack of training. The report recommendations that all tips should be regarded as potentially dangerous and that they should be treated as engineering structures seem now to be statements of the obvious. The report also recognised the importance of daily management and control of the tips, of inspection and monitoring, and of competence at all staff levels.

The Aberfan enquiry resulted in the wholesale re-appraisal of the engineering approach to the construction and management of all UK tips and lagoons. The changes were underwritten by statute in the Mines & Quarries (Tips) Regulations 1971 (HMSO, 1971). To put the importance of these changes in context, more than 2·5 billion tons of mine (colliery) waste alone were stored on the surface in the UK in 1966. The legislation created regulated, but non-prescriptive, guidance for tip owners, which has improved the safety record in the UK, has been adopted internationally and was influential in the formulation of the Extractive Waste Directive (EC, 2006). There are distinct parallels between the development of these Regulations and those of the 1930 Reservoirs Act (HMSO, 1930), which followed the loss of life at the Eigau/Coedty dams in Wales (Morris et al., 2018). The enactment of both Reservoirs and Mines & Quarries (Tips) Legislation and the development of the associated regulations resulted in significant improvements in design and inspection standards for embankment dams. It is interesting to note similarities in inspection and monitoring requirements across this legislation, despite rumours to the contrary (Cambridge, 2008a).

The principal conclusions from the Aberfan and Eigau/Coedty disasters were that there had been

• design and construction omissions

• a lack of adequate inspection and reporting

• a lack of communication regarding the condition of the facilities.

Most importantly, there was no detailed assessment of

• all potential failure modes

• the ongoing suitability of both design and construction

• the adequacy and competence of the inspection procedures.

Extending this to the present, there appears to be an unfortunate parallel between failings at Aberfan/Eigau/Coedty and the recent events at Grenfell Tower, where there were extensive warnings concerning safety and fire resistance, and a near-parallel failure together with a number of deaths in 2009 at nearby Lakanal House in Camberwell. It is not the intention to pre-empt the public enquiry, but the deficiencies in safety standards and the decision to prioritise cost over safety is likely to inform the outcome and change the building regulations, unfortunately too late for the 72 fatalities involved at Grenfell. Again, as per mine tips and reservoirs, modified regulations must follow.

Despite increasingly stringent regulations globally, dam incidents continue to occur. These, and a growing lack of appropriate engineering resources and skills worldwide, should warn against complacency. Unfortunately, it would seem that large parts of the profession are incapable of learning from history, and the examples cited later confirm this uncomfortable truth. The industry must appreciate that the identification of all failure modes, and their mitigation through design and construction, together with confirmation through inspection and monitoring, is fundamental to all stages of a dam engineering project. The following examples taken from the past 50 years are well–referenced in the literature and are only briefly described here to emphasise the importance of inspection and monitoring at all stages of the engineering process in preventing tragedies and in reducing the incidence of failure.

All suitably qualified civil engineers (SQCEs) are familiar with the role of inspection during both the construction and operation period of a dam. Inspection must be undertaken in relation to the construction and operating parameters established during the design process, and the subsequently defined rules against which the reservoir supervisor can monitor the performance of the facility are a key part of the risk mitigation process. The importance of developing construction quality assurance (CQA) requirements and operating rules at the design stage cannot be over-stressed, and the preparation of an operating manual should always be part of the design of the embankment and of its appurtenant structures to guide both constructors and operators alike. However, this system is only truly effective in ensuring that the dam is compliant with design criteria if there is a parallel inspection system encompassing all levels from operators, through site managers and designers to the independent inspecting engineer. Unfortunately, numerous failures have been caused, and continue to occur, due to operators not inspecting rigorously and not reporting untoward incidents to the owner's team, as well as to senior professionals failing to respond to such reports. Aberfan is one such example and there are many others which are educational in demonstrating the issues which arise when there is a poor inspection regime and a lack of communication regarding untoward occurrences.

In 1970 the underground workings at the Mufulira Mine in Zambia were some 450 m below surface and the overlying operational tailings dam, TD3. The extraction method at the mine resulted in large voids at depth below the hanging wall strata comprising shales, quartzites and dolomites, all of which were considered to be competent. During the period leading up to September that year, a crown–hole(s) developed above these workings and intersected the base of the sediments forming the basin to TD3, leading to the formation of small sinkholes in the tailings surface. No significance was attached to these features in relation to the underground workings and they were simply infilled with fresh tailings (Figure 4(a)). At the same time, the water level on the surface of TD3 was raised, thus increasing the hydraulic head on the overburden. This increase is believed to have forced a plug of overburden material into a crown-hole(s). With time, this plug was pushed down towards the mine workings, allowing the chimney(s) above to fill with tailings and water. In the early part of September clayey, toothpaste-like extrusions, subsequently identified as the overburden, were recorded in some underground faces. Despite their sudden appearance these clayey extrusions were not associated with the surface operations and no investigation, which would otherwise have enabled precautionary measures to be put in place, was undertaken. On 25 September 1970 the plug was ejected into the workings at high velocity (Figure 4(b)), followed by between  450 000 and 630 000 m³ of liquefied tailings at a discharge rate of about 500 m³/s, overwhelming 89 men on two operating levels in a period of some 15 minutes (Sandy et al., 1976).

At the time there was no formal inspection and reporting system of the workings/tailings dam and therefore even if the precursors had been reported it is doubtful whether immediate action would have been taken. The potential for crown-hole development above mined-out areas is a well-documented feature of underground extraction and the risk of such features daylighting had been addressed in guidance documents in the UK and elsewhere (Figure 5). A detailed risk assessment based on well–documented historic events (Cambridge, 2005) would have informed this assessment and unknown geological conditions in the overlying strata would have been identified as a principal risk to TD3. The development of a risk register would have highlighted the potential failure modes and enabled mitigating measures to be developed once the warning signs of impending failure had been investigated, thus preventing this tragedy.

The presence of voids or potential voids beneath a dam and its reservoir poses significant risk, as is evidenced by the failures at Mufulira and Martin County (Blight and Fourie, 2003). The designer of any dam therefore needs to be aware of the geological setting of the structure as well as of any anthropogenic influences/disturbances. One of the principal issues associated with design and construction of dams in historic mining locations is the presence of old workings. These may comprise deep stable water–bearing adits, shallow timber-supported adits, loosely backfilled mine shafts or indeed collapsed or partially backfilled stopes (Figure 6). Such underground structures are ubiquitous in the UK and have had, and continue to have, major implications both for surface stability and for the environment in the downstream catchment. They are generally difficult to locate by conventional site investigation techniques due to the means used by the old men to backfill them, with even geophysics proving to be of limited application. In Cornwall, for instance, the old men regularly cut down holly trees, inverting them in disused shafts and backfilling the remaining void with local earth/rockfill immediately prior to abandoning the site. Over time, as the trees rot, the risk of a sudden catastrophic failure of the temporary earthfill cap increases, frequently precipitated by wandering livestock to the chagrin of local farmers.

This issue is well-exemplified by the design of the Clemows Valley tailings dam (CVTD) in 1970, scheduled to be constructed in a valley where there was evidence of mining extending back over 3500 years (Cambridge, 2004). The CVTD design had to accommodate a number of known shafts, including adit accessways, a shallow adit system (the Janes Adit) and possible surface stoping (Figure 7). The proximity of the underground workings to the dam, and the concern that any breakthrough might lead to liquefaction and flow into these workings in a Mufulira-type disaster, prompted a major surface and underground investigation. The risk assessment identified the need for the design of a belt-and-braces approach both to the adit-access shafts and to the adit itself in order to reduce the risk of a breakthrough underground. Permeable plugs were installed both on surface and underground to resist full hydraulic head but allowing any tailings deposited against them to drain, thus inhibiting liquefaction and flow. Further to this a non-return valve and concrete plug were installed in the upstream section of the Janes Adit in order to prevent liquefied tailings from entering the operating sections of the mine and threatening the safety of the underground workers. However, the risk assessment also recognised that further workings might be uncovered as the dam was extended, and therefore all foundation areas, including those forming the depository, were stripped in advance of inundation and the area mapped. A formal inspection process was initiated and one morning in 1977, straight off the sleeper from London and while walking around the perimeter of the dam, I noted tailings flowing upslope. Emergency monitoring underground was initiated and an immediate trial excavation undertaken which revealed a shallow, loosely filled, 1 m wide, steeply dipping (70°) and partially collapsed stope not shown on the historical records, which proved to be potentially between 100 and 200 m in depth. The investigation and monitoring process provided advance warning, enabling the operator to take preventative action involving excavation of the stope to surface and the installation of a compacted rockfill (permeable) plug in advance of rising tailings levels, thus mitigating the risk of any untoward flow underground. Further works were undertaken in the mine, including the installation of a series of water-tight doors in critical mine passages. Without this investigation and reporting system, a Mufulira-type event endangering the underground operators might have occurred.

During my career I have been surprised that designers of new tailings dams, particularly in Europe, have been guilty of taking little cognisance of previous mining activity and thus of the risk of the often well-documented evidence of shafts and shallow adits being located within the footprint of a facility. On these projects, the engineers have been unprepared when surficial excavations for dam foundations or other infrastructure have revealed extensive networks of shallow adits and shafts throughout, resulting in major re-design of the embankment and the concomitant programme delays and increased construction costs. Fortunately, in the UK these design omissions have not to date resulted in major inflows of tailings or destabilisation of the confining embankment. However, old workings from Neolithic flint to recent coal and tin mines are commonly encountered in the UK, and thus few areas are unaffected by historic mining (Ford, 1998). Such workings are often unstable and deterioration is an ongoing issue (Irish Times, 2019), increasing the risk not only to the dam engineer and facility owner but also, in many areas, to the safety of the public. All reservoir panel engineers (ARPEs) should be aware of the presence of mine workings and should take into consideration the potential impact that the collapse of shallow shafts and stopes can have on dams. In particular, public safety elements should not be ignored, and capping such as that carried out in Cornwall, Derbyshire and Devon using simple steel bat–friendly structures (Figure 6) provides ample protection. However, I have also encountered numerous unprotected shafts on dam sites in public access areas despite the duty of care owed to third parties by reservoir owners. All SQCEs should be aware of the implications for dam safety arising from old workings and ensure that attention is drawn in statutory reports to any unprotected workings.

Old workings may well have been implicated in the failure of the central decant at the CVTD, an example which demonstrates how a detailed risk assessment involving a review of historic decant failures enabled risks to be mitigated, in particular, through a rigorous inspection and reporting regime. This decant comprised a 600 mm-diameter vertical concrete tower constructed in the centre of the reservoir and intended to carry the routed design flood in combination with the return water flow from the disposal operations (Forbes et al., 1991). The design had been informed by a study of a number decant towers, particularly in Africa, which had failed at a height of about 20 m, primarily due to consolidation stresses. For the CVTD, therefore, the principal risk mitigation measure incorporated into the design was the inclusion of thick neoprene rings between each concrete unit, restrained for lateral stability by stainless-steel bolts inserted through the peripheral flange. The rings were designed to absorb consolidation loading and to reduce the risk of crushing (Figure 8(a)). The risk assessment led to the development of a rigorous inspection and monitoring regime to mitigate against a collapse (Figure 8(b)). The subsequent annual internal inspections of the tower highlighted the progressive development of asymmetric deformation of the neoprene rings (Figure 9). In 1984, with the height approaching 20 m, the tower was shown to have suddenly moved out of the vertical plane (Figure 10). An urgent investigation was commenced and concluded that continuing deviation from the vertical was likely and would lead ultimately to a collapse, resulting in an untoward discharge of water and tailings into the downstream catchment. The investigation report could not reach definitive conclusions regarding the cause, but tailings movement resulting from localised collapse of nearby old workings was inferred. The owner and regulator (HSE) agreed that the tower should be abandoned after being plugged under strict CQA conditions and be replaced with a series of side valley decant spillways. The risk assessment and the review of historic tower decant failures led to mitigation by design but also to the imposition of a rigorous inspection and reporting system, which prevented a disastrous collapse of the CVTD tower.

The previous examples show the importance of developing a comprehensive inspection and monitoring system as part of the risk mitigation process. As Peter Mason stated in the 2016 Binnie Lecture, ‘ensuring that a dam is safe is about appropriate maintenance and it is also about understanding the dam and its behaviour. This requires monitoring’ (Mason, 2017: p. 73). To this I would add and appropriate trigger values to enable the performance of a structure to be compared with the design assumptions. Importantly, data collection without a review process and an accompanying action/management plan may only lead to uncomfortable questions in any post-incident enquiry.

Dams often require the installation of sophisticated instrumentation systems which must be robust, be appropriately specified, be installed to a strict CQA system and be interrogated at a sensible frequency. Dam designs should include an instrumentation specification which satisfies these criteria and should future-proof the instrumentation system such that it will be reliable for the lifespan of the facility. The specification of each instrument and the installation process should be subject to strict peer review and be included in the remit of the independent inspecting engineer both at design and operational stages. Further, the instrumentation should be fully documented in the operating manual, which should include installation, maintenance and reading protocols along with critical data assessments.

It should be remembered that instrumentation can detect both positive and negative trends and provide useful information, particularly in the case of tailings dams, for improving the efficiency of future design stages. For example, the long-term stability of a confining embankment for a tailings dam depends not only on the structural parameters but also on the pore pressures and in situ characteristics of the deposited tailings. Accordingly, the embankment and, in the case of a tailings dam, the beach deposit, needs to be instrumented. Controlled sub-aerial disposal of tailings against the downstream embankment will lead to a laminated deposit, to enhanced values of the k_h/k_v ratio and to lateral drainage through the confining wall. This may result in pore pressures in the beach becoming less than hydrostatic despite subsequent levels of inundation. At the CVTD the records for the tailings beach piezometers (Figure 11) evidenced a progressive dislocation with time between the rise in tailings deposition/reservoir level and the piezometric head in the beach. The desaturation of the beach zone was reflected in the later stability analyses, leading to improved stability from that assumed in the original design.

The instrumentation of the CVTD benefited from a long record of piezometric measurements, which were crucial in enabling ongoing assessment of the facility and in providing regulatory assurance of stability at closure. As indicated above, the installation and operation of a robust instrumentation system is important not only for the measurement of physical parameters but also for environmental monitoring and, for tailings dams in particular, for the geochemical characterisation of fill materials (Cambridge, 2008b). Pyrite, the principal sulfide of concern, is ubiquitous in the geological environment and thus in embankment fill, and will degrade under the right conditions. The rate and extent of oxidation and particle degradation is often difficult to predict, hence the longer-term implications for geotechnical parameters are often ignored. However, any geomaterial with sulfide content as low as 0·5% may oxidise and deteriorate, affecting the geotechnical properties of the fill such as particle grading, structural competence and permeability.

This degradation process became evident on the Cerro do Lobo (CdL) tailings dam in Portugal due to the robust seepage monitoring system employed on the site (Cambridge and Oliveira, 2006; Oliveira and Cambridge, 2006). Though the designer's experience on other mine dam sites indicated that there was a low risk of significant oxidation on this dam, regular monitoring of both quality and quantity of seepage was instigated from an early stage. Some years into operation the relationship between precipitation events and seepage quality became apparent, with pH levels dropping from a mean of 7 to near 2 after each rainfall spike (Figure 12). These data reflected the seasonal oxidation and degradation in the fill on the downstream face of the embankment resulting from the wet/dry periods, the so-called oxidation/flushing cycle. The impact on the earthfill was apparent, with progressive degradation over a period of less than five years, resulting in the D₁₀ size reducing from 0·6 to 0·1 mm with a concomitant impact on permeability and shear strength (Figure 13). These data did not reflect the end point for the degradation process as without intervention further oxidation would have taken place and led to ongoing changes in particle size. The impact on the downstream face was two-fold.

• the permeability reduced as the grading size changed, resulting in a rise in the phreatic surface.

• the filter system became clogged with oxidation products/chemical precipitates, resulting in a further rise in the phreatic surface.

The overall impact was a failure of the filter system and an increase in pore pressures, thus reducing the stability of the downstream face. However, the rigorous inspection of seepage monitoring instigated from the outset enabled the potential for structural deterioration to be identified and a mitigation strategy developed and implemented as part of the next phase of dam construction. Filter design criteria are now well understood and the recent ICOLD bulletin on embankment dam filters (ICOLD, 2014) should ensure their proper design, construction and function in the future. The opportunity to address geochemical elements of filter systems and of embankment materials in this bulletin appears unfortunately to have been missed primarily, it is assumed, as the authors consider pyrite and other sulfide compounds to be absent from embankment dams built for water supply. However, my experience of dams globally is that any embankment constructed in an area of mining activity is likely to include sulfidic elements and that the geochemical deterioration of such materials should be part of the design. In the UK, embankment dams such as Roadford and the canal dams in Staffordshire are prime examples.

As implied in Table 2, inspection and monitoring applies particularly to fill materials and compatibility during construction. There have been significant advances in filter design criteria over the past 40 years, as reflected in recent ICOLD bulletins and other technical standards. These criteria have been available to dam designers and should have ensured the proper design, construction and function of embankment dam filter systems globally. However, the lack of a filter at a European tailings dam led to the repeated appearance of sinkholes in the crest and, on one occasion, to tailings appearing on the downstream face. A design review was initiated and recommended the retrofitting of a filter system, which should have mitigated against piping failures and the appearance of further sinkholes. The design of this system relied optimistically on the filter grading being achieved by blending two as–blasted quarry products. However, the issue of quality control for this blended filter material was not recognised in either the specification or in the construction CQA system. Subsequent independent inspection during one of my audit visits revealed that the filter system had rarely, if ever, met the design criteria, resulting in a further succession of sinkholes in the dam structure and potentially compromising its safety and stability. The design elements showed poor engineering with limited, if any, reference to the large body of work on filter design. In retrospect it is evident that this tailings dam only remained intact by good fortune as at no stage was a detailed risk assessment and failure analysis ever conducted despite the recommendations made during the peer reviews. There seems little point in engaging an independent inspecting engineer to review an embankment dam if the recommendations are subsequently ignored, even when they are identified as being high-risk issues.

A number of high-profile dam and slope failures have occurred in the past 20 years for which deficiencies in the site investigations have been cited as a major cause, particularly the failure to properly characterise important layers of weak underlying clay in the dam foundations. The failure of Mount Polley in 2014 (Morgenstern et al., 2015) and that of Aznacollar in 1999 (Polimon and Rodriguez-Ortiz, 2013) raises the fundamental question as to why, given the state of geotechnical knowledge and the availability of qualified geotechnical engineers, important geotechnical data were missed on these sites. The preparation of a detailed risk register might have resulted in the presence of such a layer in the foundations being identified as a significant geological risk, thus allowing suitable mitigating measures to be included in the design. However, regardless of the apparent lack of an appropriate risk assessment process, of more concern is that there appears to have been inadequate oversight of the site investigation and insufficient peer review of the data. This lack may have been a contributory factor in a key foundation design risk being ignored.

The omission of a comprehensive risk register was paralleled in a recent Portuguese example where a new reservoir and the adjacent diversion channel were being excavated in heavily faulted, folded and fractured greywackes. The lithology and structure of this sequence were known from the extensive geological site database to be highly variable. The initial reservoir side slopes of 30° were designed on the basis of non-site-specific parameters, but failed within weeks of completion, necessitating redesign and reconstruction. The designer then undertook a single back-analysis of this failure surface as the basis for the diversion channel configuration, expressing confidence that all potential failure surfaces along the entire length of this waterway had been addressed by the revised design. However, within a month another full-slope failure had occurred, necessitating a further channel slope redesign. This failure was subsequently proved to relate to a series of thin low-strength clay-filled joints, which extended over the full height of the channel side slope and which had not been identified from the geological database. The third channel slope angle was reduced to between 14° and 16° based on detailed mapping of the entire length of the channel. This site-specific mapping could have been undertaken at the onset of the design and would in the end have saved the owner costs and programme time. The design consultant took the view that a review of all available geological data was adequate. However, it is evident that not all potential failure mechanisms had been considered, as would have been the case had a competent risk register been prepared.

The site investigation sets the framework for any geotechnical project and the dam engineer should be able to rely on the subsequent report. Thus the scope, the specification, the contractor and the supervision must be competent and owners/funders must recognise that it is essential to opt for competence over cost during geotechnical investigations at all times.

My final example relates to the failure in 2007 of one of the tailings dams at Cavendish Mill in Derbyshire (Cambridge, 2014). TD1 comprised the northern part of a two-paddock tailings dam constructed in the 1960s and had for 30 years been used for sheep grazing, but at the time of the incident was being rehabilitated by excavation and reprocessing. The pre-extraction investigation had shown zones of low-strength tailings interspersed by higher-strength coarse deposits typical of cyclone disposal across the depository, with no evidence of connectivity between the finer zones. The excavation and transport operation was being undertaken from elevated roadways in strict compliance with the Quarries Regulations and a protective berm had been installed to protect the plant and operators against any potential flow failure. Of key importance to the subsequent event was the presence of an 8800 m³ lagoon impounded by the Head Wrightson Dam (HWD) on the northern perimeter of TD1. This facility was kept fully impounded for environmental reasons despite it being identified as a potential hazard in the audit reports (Figure 14).

The beginning of 2007 experienced very heavy rainfall, followed by snowfall and a rapid freeze on 21 January. Early on 22 January a surficial thaw led to a minor failure in the coarser tailings in the excavation face and to the rapid initiation of a flow failure in the finer tailings. A succession of similar slides was triggered upstream of the initial failure surface, thus adding to the volume of tailings then surging into the excavation void. The liquefied tailings overtopped the protective rock bund, causing the displacement of the impounded water in the HWD lagoon which, together with debris and vegetation, flowed off site on to Farnsley Lane and caused severe damage to the surface of the tarmac road (Figure 15). This discharge eventually reached the local trunk road, leading to its closure and to the inundation of a number of houses and gardens in Stoney Middleton. Rapid action by mine management brought the tailings discharge under control, allowing the displaced solids to settle in the TD1 and HWD basins and prevent further releases.

The post-incident analysis indicated that the majority of the tailings were retained on site within TD1 and the HWD. The flow down Farnsley Lane comprised water displaced from the HWD mixed with local runoff, with only a relatively small proportion (5%) of the tailings ultimately reaching the trunk road. The report concluded that the downstream damage was primarily caused by the displaced water from the HWD and that, had this been emptied prior to the incident, the downstream effects would have been limited to the mine site since in the event it acted as a transport mechanism for the residual tailings. Without this water volume the inundation of houses, gardens and fields downstream would have been unlikely, as a comprehensive risk assessment analysis supported by a risk register would have shown. Regulators should take note that the damage was considerable and was caused by a volume of flow which did not exceed the current lower threshold covered by the various UK Reservoir Acts (Cambridge et al., 2014).

During the course of this lecture I have used a number of failures as examples of how appropriate investigation, design and construction and operating supervision could have been improved and serious incidents reduced in number, with the associated deaths and injuries being avoided. The examples clearly show that, had there been a proper inspection of the data, the analytical techniques and the construction and operating routines, many of these failures would have been avoided. Further, as has been indicated, historic evidence pointed to previous examples which should have acted as informative lessons to those responsible as to what could happen if the risks associated with an embankment project were not properly assessed. The analysis of failure is a fundamental part of the design process and should lead inexorably to improvements in safety and stability. To ignore failure is to jeopardise the function of future structures often, as has been demonstrated, with disastrous consequences. The risk assessment process as a thought experiment – that is, as a holistic ‘what if?’ analysis, should provide all potential failure modes and enable designer and owner alike to address suitable mitigation methods. The generation of a risk register to accompany each failure mode should be mandatory for all elements of an embankment dam project and the review of historic failures should always form part of this design process.

My principal conclusion is that risk mitigation is necessary as part of an engineering analysis at all stages from inception to completion and closure. This process requires not only competent engineering but also knowledge of historical precedents in order to guide selection of the optimum solution and formulate suitable mitigation measures. A detailed risk register and the development of a comprehensive mitigation strategy enable both competent engineering of the structure and assist third-party scrutiny and verification. This process has subsequently to be accompanied by a comprehensive inspection and monitoring system in order to verify compliance with design function, construction specification and operating rules. Failure to inspect and monitor may result in the safety of the operations being put at risk, and higher risk leads to the increased probability of death or injury to workers or third parties. Regular reassessment of risk and potential consequences is an essential element in maintaining designed safety and stability.

As demonstrated, incidents continue to occur and the evident lack of appropriate engineering resources and skills should make senior dam engineers wary of complacency. The profession needs competent engineers with the relevant skills and expertise. It is apparent that in recent years there has been a failure to pass on knowledge and experience to a younger generation such that it is capable of addressing the engineering issues presented. To my knowledge the issue of succession planning in the UK has been under discussion for 10 years and has even been highlighted at ICOLD. We now urgently need a coherent plan to address the identified shortfall in SQCEs, particularly with regard to the future supply of ARPEs and Competent Persons. Risk management requires investment in engineering competence and a long–term strategy for developing the necessary skills. Without this investment we run the risk of further Aberfans, Mufuliras, Stavas and other dam failures occurring.

In my experience, embankment dam engineering is the most exciting discipline within civil engineering, posing many and various problems and with each site presenting a unique set of geological and geotechnical characteristics. I would encourage all young dam engineers to embrace the profession wholeheartedly while learning from the past, and I would strongly recommend the following personal strategy when undertaking any future dam projects.

• Research the geology of each site (both sequence and history).

• Scope all investigation and test programmes with flexibility (expect the unexpected).

• Define function and parameters (design, construction, operating and, for a tailings dam, closure).

• Assess potential hazards, risk and consequence (consider historic parallels).

• Undertake a comprehensive ‘what if?’ analysis (prepare a detailed risk register).

• Never underestimate the potential of water (impounded or interstitial).

• Prepare a comprehensive operating manual (reservoir rules/inspection regimes/instrumentation systems).

• Finally, and most importantly, absorb the lessons of historic failures.

Thank you for your attention.

I thank the following for their advice and assistance during the preparation of this paper: Darren Evans of Wheal Jane Ltd, Gavin Ferguson of Seltrust Associates, Rafael Monroy of Wood plc, Mafalda Oliveira of Lundin Mining and Tracey Williamson of Arup.