In February 2017, concrete slabs in the spillway at Oroville Dam failed during releases from the floodgates, starting a chain of events that prompted the evacuation of nearly 200,000 people downstream. The dam didn’t fail, but it came too close for comfort, especially for the tallest structure of its kind in the United States. Oroville Dam falls under the purview of the Federal Energy Regulatory Commission, in a state with a progressive dam safety program and regular inspections and evaluations by the most competent engineers in the industry. So how could a failure mode like this slip through the cracks, both figuratively and literally? Luckily, an independent forensic team got deep in the weeds and prepared a 600 page report to try and find out. This is a summary of that. I’m Grady and this is Practical Engineering. Today, we’re talking about the Oroville Dam Crisis.

Oroville Dam, located in northern California, is the tallest dam in the United States at 770 feet or 235 meters high. Completed in 1968, and owned and operated by the California Department of Water Resources, every part of Oroville Dam is massive. The facility consists of an earthen embankment which forms the dam itself, a hydropower generation plant that can be reversed to create pumped storage, a service spillway with 8 radial floodgates, and an emergency overflow spillway. The reservoir created by the dam, Lake Oroville, is also immense - the second biggest in the state. It’s part of the California State Water Project, one of the largest water storage and delivery systems in the U.S. that supplies water to more than 20 million people and hundreds of thousands of acres of irrigated farmland. The reservoir is also used to generate electricity with over 800 megawatts of capacity. Finally, the dam also keeps a reserve volume empty during the wet season. In case of major flooding upstream, it can store floodwaters and release them gradually over time, reducing the potential damage downstream.

No dam is built to hold all the water that could ever flow into the reservoir at once. And yet, having water overtop an unprotected embankment will almost certainly cause a breach and failure. So, all dams need spillways to safely release excess inflows and maintain the level of the reservoir once it’s full. Spillways are often the most complex and expensive components of a dam, and that is definitely true at Oroville. The service spillway has a chute that is 180 feet or 55 meters wide and 3,000 feet long. That’s nearly a kilometer for the metric folks. Radial gates control how much water is released and massive concrete blocks at the bottom of the chute, called dentates, disperse the flow to reduce erosion as it crashes into the Feather River. This spillway is capable of releasing nearly 300,000 cubic feet or 8,000 cubic meters of water per second. That’s roughly an olympic-sized swimming pool every other second, which I know is not that helpful in conceptualizing this incredible volume. If you somehow put that much flow through a standard garden hose, it would travel at 15% of the speed of light, reaching the moon in about 9 seconds. How’s that for a flow rate equivalency? But even that is not enough to protect the embankment.

Large dams have to be able to withstand extraordinary flooding. In most cases, their design is based on a synthetic (or made up) storm called the Probable Maximum Flood, which is essentially an approximation of the most rain that could ever physically fall out of the sky. It usually doesn’t make sense to design the primary spillway to handle this event, since such a magnitude of flooding is unlikely to ever happen during the lifetime of the structure. Instead, many dams have a second spillway, much simpler in design - and thus less expensive to construct - to increase their ability to discharge huge volumes of water during rare but extreme events. At Oroville, the emergency spillway consists of a concrete weir set one foot above the maximum operating level. If the reservoir gets too high and the service spillway can’t release water fast enough, this structure overflows, preventing the reservoir from reaching and overtopping the crest of the dam.

Early 2017 was one of northern California’s wettest winters in history with several major flood events across the state. One of those storms happened in February upstream of Oroville Dam. As the reservoir filled, it became clear to operators that the spillway gates would need to be opened to release excess inflows. On February 7, early during the releases, they noticed an unusual flow pattern about halfway down the chute. The issue was worrying enough that they decided to close the gates and pause the flood releases in order to get a better look. What they saw when the water stopped was harrowing. Several large concrete slabs were completely missing and a gigantic hole had eroded below the chute.

There was a lot more inflow to the reservoir in the forecast, so the operators knew they didn’t have much time to keep the gates closed while they inspected the damage, and no chance to try and make repairs. They knew they would have to keep operating the crippled spillway. So, they started opening gates incrementally to test how quickly the erosion would progress. Meanwhile, more rain was falling upstream, contributing to inflows and raising the level of the reservoir faster and faster. It wasn’t long before the operators were faced with an extremely difficult decision: open more gates on the service spillway which would further damage the structure or let the reservoir rise above the untested emergency spillway and cascade down the adjacent hillside.

Several issues made this decision even more complicated. On one hand, the service spillway was in bad shape, and there was the possibility of the erosion progressing upstream toward the headworks which could result in an uncontrolled release of the reservoir. Also, debris from the damaged spillway was piling up in the Feather River, raising its level and threatening to flood out the power plant. Finally, electrical transmission lines connecting the power plant to the grid were being threatened by the erosion along the service spillway. Losing these lines or flooding the hydropower facility would hamstring the dam’s only backup for making releases from the reservoir. Operators knew that repairing the spillway would be nearly impossible until the power plant could be restored. These factors pointed towards closing the spillway gates and allowing the reservoir to rise.

On the other hand, the emergency spillway had never been tested, and operators weren’t confident that it could safely release so much water, especially after witnessing how quickly and aggressively the erosion happened on the service spillway nearby. Also, its use would almost certainly strip at least the top layer of soil and vegetation from the entire hillside, threatening adjacent electrical transmission towers. A huge contingent of engineers and operations personnel were all hands on deck, running analyses, forecasting weather, reviewing geologic records and original design reports trying to decide the best course of action. Of course, this is all happening over the course of only a couple of days with conditions constantly changing and no one having slept, further complicating the decision making process. Operators worked to find a sweet spot in managing these risks, limiting releases from the service spillway as much as possible while still trying to keep the reservoir from overtopping the emergency spillway. But, every new forecast just showed more rain and more inflows.

Eventually it became clear to operators that they would have to pick a lesser evil: Increase discharges and flood the powerhouse or let the reservoir rise above the emergency spillway. They decided to let the reservoir come up. The morning of February 11, about four days after the damage was initially noticed, Lake Oroville rose above the crest of the emergency spillway for the first time in the facility’s history. Almost immediately, it was clear that things were not going to go smoothly.

As it flowed across and down the natural hillside, water from the emergency spillway began to channelize and concentrate. This quickly accelerated erosion of the soil and rock, creating features called headcuts, which are a sign of unstable and incising waterways. Headcuts are vertical drops in the topography eroded by flowing water, and they always move upstream oftentimes aggressively. In this case, upstream meant toward the emergency spillway structure, threatening its stability. This hillside was a zone many had assumed to be solid, competent bedrock. It only took a modest flow through the emergency spillway to reveal the true geologic conditions: the hillside was composed almost entirely of highly erodible soil and weathered rock. If the headcuts were to reach the concrete structure upstream, it would almost certainly fail, releasing a wall of water from Oroville Lake that would devastate downstream communities. Authorities knew they had to act quickly.

On February 12, only about a day and half after flow over the emergency spillway began, an evacuation order was issued for downstream residents, displacing nearly 200,000 people to higher ground. At the same time, operators elected to open the service spillway gates to double the flow rate and accelerate the lowering of the reservoir. The level dropped below the emergency spillway crest that night, stopping the flow and easing fears about an imminent failure. Two days later, on Valentine’s Day, the evacuation order was changed to a warning, allowing people to return to their homes. But there was still more rain in the forecast, and the emergency spillway was in poor condition to handle additional flow if the reservoir were to rise again. California DWR continued discharging through the crippled service spillway to lower the reservoir by 50 feet or 15 meters in order to create enough storage that the spillway could be taken out of service for evaluation and repairs. The gates stayed open until February 27th, nearly three weeks after the whole mess started, revealing the havoc to the dam’s right abutment. Water that started its journey as tiny drops of rain in a heavy storm - funneled and concentrated by the earth’s topography and turbulently released through massive human-made structures - had carved harrowing scars through the hillside. But, how did it happen?

Like all major catastrophes, there were a host of problems and issues that coincided to cause the failure of the concrete chute. One of the most fundamental issues was geologic. Although it was well-understood that some areas of the spillway’s foundation were not good stuff (in other words, weathered rock and soil), the spillway was designed and maintained as if the entire structure was sitting on hard bedrock.

That mischaracterization had profound consequences that I’ll discuss. As for how the spillway damage started, the issue was uplift forces. How do concrete structures stay put? Mostly by being heavy. Their weight pins them to the ground so they can resist other forces that may cause them to move. But, water complicates the issue. You might think that adding water to the top of a slab just adds to the weight, making things more stable. And that would be true without cracks and joints. The problem with the Oroville Dam service spillway chute was that it had lots of cracks and joints, for reasons I’ll discuss in a moment. These cracks allowed water to get underneath the slabs, essentially submerging the concrete on all sides. Here’s the issue with that: structures weigh less under water, or more accurately, their weight is counteracted by the buoyant force of the water they displace. So, being underwater already starts to destabilize them, because it adds an uplift force. But, concrete still sinks underwater, right? The net force is still down, holding the structure in place. That’s true in static conditions, but when the water is moving, things change.

We talk about Bernoulli’s principle a lot, and he’s got something to say about the flow of water in a spillway. In this case, the issue was what happens to a fast-moving fluid when it suddenly stops. Cracks and joints in a concrete spillway have an effect on the flow inside. Any protrusion into the stream redirects the flow. If a joint or crack is offset, that redirection can happen underneath the slab. When this happens, all the kinetic energy of the fluid is converted into potential energy, in other words, pressure. When it’s 100% of the kinetic energy being converted, we call it the stagnation pressure. When you direct the end of a tube into the flowing water, you see how the level rises?. The equation for stagnation pressure is a function of velocity squared. So, if you double the speed of flow, you get four times the resulting pressure and thus four times the height the water rises in the tube. And the water in the Oroville spillway is moving a lot faster than this. When this stagnation pressure acts on the bottom of a concrete slab, it creates an additional uplift force. If all the uplift forces exceed the weight of the slab, it’s going to move. That’s exactly what happened at Oroville. And once one slab goes, it’s just a chain reaction. More of the foundation is exposed to the fast moving water, and more of that water can inject itself below the slabs, causing a runaway failure.

Of course, we try to design around this problem. The service spillway had drains consisting of perforated pipes to relieve the pressure of water flowing beneath the slabs. Unfortunately, the design of these drains was a major reason for the cracking chute. Instead of trenching them into the foundation below the slabs, they reduced the thickness of the concrete to make room for the drains. The crack pattern on the chute essentially matched the layout of the drains beneath perfectly. So, in this case the drains inadvertently let more water below the slab than they let out from underneath it. The chute also included anchors, steel rods tying the concrete to the foundation material below. Unfortunately those anchors were designed for strong rock and their design wasn’t modified when the actual foundation conditions were revealed during construction.

The root cause wasn’t just a bad design, though. There are plenty of human factors that played into the lack of recognition and failure to address the inherent weaknesses in the structure. Large dams are regularly inspected, and their designs periodically compared to the state of current practice in dam engineering. Put simply, we’ve built bigger structures on worse foundations than this. Modern spillway designs have lots of features that help to avoid what happened at Oroville. Multiple layers of reinforcement keep cracks from getting too wide. Flexible waterstops are embedded into joints to keep water from migrating below the concrete. Joints are also keyed so individual slabs can’t separate from one another easily. Lateral cutoffs help resist sliding and keep water from migrating beneath one slab to another. Anchors add uplift resistance by holding the slabs down against their foundation. Even the surface of the joints is offset to avoid the possibility of a protrusion into the high velocity flow. All these are things that the Oroville Spillway either didn’t have or weren’t done properly. Periodic reviews of the structure’s design, required by regulators, should have recognized the deterioration and inherent weaknesses and addressed them before they could turn into such a consequential chain of tribulations.

As for the emergency spillway, the fundamental cause of the problem was similar: a mischaracterization of the foundation material during and after design. Emergency spillways are just that: intended for use only during a rare event where it’s ok to sustain some damage. But, it’s never acceptable for the structure to fail, or even come close enough to failing that the residents downstream have to be evacuated. That means engineers have to be able to make conservative estimates of how much erosion will occur when an emergency spillway engages. Predicting the amount and extent of erosion caused by flowing water is a notoriously difficult problem in civil engineering. It takes sophisticated analysis in the best of times, and even then, the uncertainty is still significant. It is practically impossible to do under the severe pressure of an emergency. The operators of the dam chose to allow the reservoir to rise above the crest of the emergency spillway rather than increase discharges through the debilitated service spillway, trusting the original designer that it could withstand the flows. It’s a decision I think most people (in hindsight) would not have made.

The powerhouse was further from flooding and the transmission lines further from failing than initially thought, and they eventually ramped up discharges from the service spillway anyway, after realizing the magnitude of the erosion happening at the emergency spillway. But, it’s difficult to pass blame too strongly. The operators making decisions during the heat of the emergency did not have the benefit of hindsight. They were stuck with the many small but consequential decisions made over a very long period of time that eventually led to the initial failure, not to mention the limitations of professional engineering practice’s ability to shine a light down multiple paths and choose the perfect one.

The forensic team’s report outlines many lessons to be learned from the event by the owner of the dam and the engineering community at large, and it’s worth a read if you’re interested in more detail. But, I think the most important lesson is about professional responsibility. The people downstream of Oroville Dam, and indeed any large dam across the world, probably chose their home or workplace without considering too carefully the consequences of a failure and breach. We rarely have the luxury to make decisions with such esoteric priorities. That means, whether they realized it or not, they put their trust in the engineers, operators, and regulators in charge of that dam to keep them safe and sound against disaster. In this case, that trust was broken. It’s a good reminder to anyone whose work can affect public safety. The repairs and rebuilding of the spillways at Oroville Dam are a whole other fascinating story. Maybe I’ll cover that in a future post. Thank you, and let me know what you think!