Event sourcing in mining operations

The slope that moved on a Tuesday

At 4:40 on a Tuesday morning, a haul road on the eastern wall of an open pit closed itself. Not by procedure — by rockfall. Three days earlier, a geotechnical engineer had signed off the weekly slope stability review: displacement within tolerance, piezometric levels normal, radar returns unremarkable. The review was accurate when it was written. It was also four days old by the time the wall failed, and in those four days the pore pressure behind the failure surface had risen after an unscheduled discharge from a tailings decant, unnoticed because no one was looking at that sensor in relation to that slope in real time. The weekly report was a snapshot. The slope was a process. Nobody had built the second thing.

This is not a story about a careless engineer. The review followed the procedure exactly as written, and the procedure was itself the failure. Slope monitoring radar, extensometers, piezometers and rain gauges were all logging continuously, second by second, in different systems with different retention windows. But the artefact that reached a human decision-maker was a rolled-up summary produced once a week: a single materialised number, "movement rate acceptable", derived from an unspecified mixture of readings and then thrown away in favour of the next week's number. Nobody could go back and ask what the belief had been on Sunday, because Sunday's belief had never been stored — only Sunday's contribution to an average. The gap between review cadence and hazard cadence was not a scheduling oversight. It was a data-modelling one.

What was actually missing

The instruments were not at fault. Slope radar systems commonly resolve sub-millimetre displacement; piezometers report pore pressure with more than adequate precision; ore-grade assays and equipment telemetry elsewhere on site were logged with timestamps to the second. The fault was in what happened to those readings after collection. Each system kept only its current state: the latest displacement rate, the latest pressure head, overwritten on arrival of the next reading. The weekly report was a fold performed once, by a human, over whatever numbers happened to be on screen at review time, and then discarded. There was no durable record of the sequence of facts that had produced any given belief about the slope. There was only ever a belief, replaced by another belief, with the reasoning connecting them living nowhere but in the engineer's head and the previous week's now-obsolete PDF.

This is precisely the failure that event sourcing is designed to make structurally impossible. Event sourcing is a way of storing data in which the durable record is not the current state but the ordered sequence of facts that produced it. A slope's stability estimate should not be a cell in a spreadsheet, overwritten each Monday. It should be the sum — the fold, or left-reduction — of every displacement reading, every pore-pressure reading, every blast vibration event and every rainfall record the slope has ever produced, each stored once, immutably, with its source and timestamp attached. Current state becomes something you compute on demand, not something you keep and lose. If the discharge into the decant pond had been an event in the same log as the piezometer readings and the radar returns, a reducer watching pore pressure trends against displacement acceleration could have flagged the correlation on Friday, not been asked to explain it in a post-incident report the following month.

The three generations, and why mining forces the third

A model trained once on historical slope failures — a Large Language Model, in the general sense of a system built from a frozen corpus — can tell you the textbook signature of an impending failure. It cannot tell you what this wall is doing this hour, because its corpus was closed before the discharge event ever happened, and it has no mechanism for admitting that fact afterwards. A system that ingests a live scene — a Large World Model, watching one bench or one pit face through its sensors for the duration of a shift — does better: it folds sensor events into a running estimate while the scene lasts. But if the window closes at shift end and the log is not kept, next week's reviewer inherits only a number, not the reasoning, and the failure recurs in a different form: short-term accuracy, long-term amnesia.

Mining operations are, structurally, the case that exhausts the difference. Geotechnical sensors, ore-grade assays, equipment telemetry and commodity curves are streams that never stop arriving and are never individually sufficient. A commodity price movement can justify accelerating a cutback that changes slope geometry; an assay result can revise the ore-grade model that justified the mine plan a haul road was built to serve; a telemetry fault on a single autonomous truck can be the first sign of a broader control failure. None of these streams closes. None of them can be safely discarded once read, because the question "why do we believe the wall is stable" must be answerable not just now but retroactively, when an incident review asks what was known on the Tuesday before the fall. A Large Universe Model, in the sense this site uses the term, is the architecture that takes this seriously as a design constraint rather than an inconvenience: every stream still arriving is appended to a log with source, timestamp and confidence, and belief about the slope is a fold over that log, recomputable whenever a new correlation — like discharge-linked pore pressure spikes — is discovered and needs to be applied backward as well as forward.

The honest objections

Event sourcing sounds elegant until you try to run it. Logs from geotechnical sensors alone generate millions of rows a day across a large pit. Replay takes hours. Schema drift, once a monitoring vendor changes its data format, turns five-year-old radar events into archaeology. Every team that has tried full event sourcing on industrial IoT has eventually retreated to snapshots and CRUD.

This is fair, and it is not hypothetical — mine sites that have piloted full-fidelity event logging for slope monitoring have hit exactly these walls. The honest answer is that the retreat is from full replay, not from the log itself. What survives, and should survive, is the append-only journal of raw sensor events with their provenance intact, paired with periodic snapshots — a compacted "known-good fold as of this checkpoint" — so that daily operations run off a cheap cached state while the full log remains available for the rarer job of recomputation: re-running the reducer after an incident, or after a vendor's radar recalibration changes how a past reading should be interpreted. That is cost engineering on top of the requirement, not an escape from it. A mine that keeps only the snapshot has quietly rebuilt the weekly-report failure with better software.

Provenance tells you which sensor said what and when. It does not tell you the sensor was right. A perfectly logged, perfectly timestamped reading from a miscalibrated piezometer is still wrong, and dressing up bad data with an audit trail is bureaucracy, not geotechnical judgment.

This is the sharper objection and it should not be waved away. Provenance is necessary, not sufficient. A log that faithfully records a faulty instrument gives you faithfully recorded nonsense. What the log actually buys is narrower: the capacity to revise. When that piezometer is later found to have drifted out of calibration for six weeks, a system that recorded which slope-stability beliefs depended on its readings can retract exactly those beliefs and recompute the rest — cleanly, and without re-deriving everything from raw memory. A system that only ever kept the current fold cannot do this at all; it can only start over. That is the specific, limited, and still decisive thing event sourcing offers a geotechnical engineer: not certainty, but the ability to say, precisely, what changes and what doesn't when a source turns out to have lied.

The lineage claim follows from this, not around it. Once every stream a mine produces — geotechnical, assay, telemetry, market — is admitted continuously into a provenance-bearing log that never closes, there is no further category of intake left to add. There is only more of it, logged better, and trusted more carefully.