In February 2017, concrete slabs in the
spillway at Oroville Dam failed during releases from the floodgates, starting a chain
of events that prompted the evacuation of nearly 200,000 people downstream. The dam didn’t
fail, but it came too close for comfort, especially for the tallest structure
of its kind in the United States. Oroville Dam falls under the purview of
the Federal Energy Regulatory Commission, in a state with a progressive dam safety program
and regular inspections and evaluations by the most competent engineers in the industry. So how
could a failure mode like this slip through the cracks, both figuratively and literally? Luckily,
an independent forensic team got deep in the weeds and prepared a 600 page report to try and find
out. This is a summary of that. I’m Grady and this is Practical Engineering. In today’s episode,
we’re talking about the Oroville Dam Crisis. Oroville Dam, located in northern California,
is the tallest dam in the United States at 770 feet or 235 meters high. Completed in
1968, and owned and operated by the California Department of Water Resources, every part
of Oroville Dam is massive. The facility consists of an earthen embankment which forms
the dam itself, a hydropower generation plant that can be reversed to create pumped storage,
a service spillway with 8 radial floodgates, and an emergency overflow spillway. The
reservoir created by the dam, Lake Oroville, is also immense - the second biggest in the state.
It’s part of the California State Water Project, one of the largest water storage and delivery
systems in the U.S. that supplies water to more than 20 million people and hundreds of thousands
of acres of irrigated farmland. The reservoir is also used to generate electricity with over
800 megawatts of capacity. Finally, the dam also keeps a reserve volume empty during the wet
season. In case of major flooding upstream, it can store floodwaters and release them gradually over
time, reducing the potential damage downstream. No dam is built to hold all the water that could
ever flow into the reservoir at once. And yet, having water overtop an unprotected embankment
will almost certainly cause a breach and failure. So, all dams need spillways to safely release
excess inflows and maintain the level of the reservoir once it’s full. Spillways are often the
most complex and expensive components of a dam, and that is definitely true at Oroville. The
service spillway has a chute that is 180 feet or 55 meters wide and 3,000 feet long. That’s nearly
a kilometer for the metric folks. Radial gates control how much water is released and massive
concrete blocks at the bottom of the chute, called dentates, disperse the flow to reduce erosion as
it crashes into the Feather River. This spillway is capable of releasing nearly 300,000 cubic feet
or 8,000 cubic meters of water per second. That’s roughly an olympic-sized swimming pool every
other second, which I know is not that helpful in conceptualizing this incredible volume. If
you somehow put that much flow through a standard garden hose, it would travel at 15% of the speed
of light, reaching the moon in about 9 seconds. How’s that for a flow rate equivalency? But even
that is not enough to protect the embankment. Large dams have to be able to withstand
extraordinary flooding. In most cases, their design is based on a synthetic (or made
up) storm called the Probable Maximum Flood, which is essentially an approximation of the most
rain that could ever physically fall out of the sky. It usually doesn’t make sense to design
the primary spillway to handle this event, since such a magnitude of flooding is unlikely to
ever happen during the lifetime of the structure. Instead, many dams have a second spillway,
much simpler in design - and thus less expensive to construct - to increase their
ability to discharge huge volumes of water during rare but extreme events. At Oroville, the
emergency spillway consists of a concrete weir set one foot above the maximum operating
level. If the reservoir gets too high and the service spillway can’t release water
fast enough, this structure overflows, preventing the reservoir from reaching
and overtopping the crest of the dam. Early 2017 was one of northern California’s
wettest winters in history with several major flood events across the state. One of those storms
happened in February upstream of Oroville Dam. As the reservoir filled, it became clear to
operators that the spillway gates would need to be opened to release excess inflows.
On February 7, early during the releases, they noticed an unusual flow pattern
about halfway down the chute. The issue was worrying enough that they decided to
close the gates and pause the flood releases in order to get a better look. What they saw
when the water stopped was harrowing. Several large concrete slabs were completely missing
and a gigantic hole had eroded below the chute. There was a lot more inflow to the reservoir in
the forecast, so the operators knew they didn’t have much time to keep the gates closed while
they inspected the damage, and no chance to try and make repairs. They knew they would have
to keep operating the crippled spillway. So, they started opening gates incrementally to test
how quickly the erosion would progress. Meanwhile, more rain was falling upstream, contributing to
inflows and raising the level of the reservoir faster and faster. It wasn’t long before the
operators were faced with an extremely difficult decision: open more gates on the service spillway
which would further damage the structure or let the reservoir rise above the untested emergency
spillway and cascade down the adjacent hillside. Several issues made this decision
even more complicated. On one hand, the service spillway was in bad shape, and there
was the possibility of the erosion progressing upstream toward the headworks which could result
in an uncontrolled release of the reservoir. Also, debris from the damaged spillway
was piling up in the Feather River, raising its level and threatening to
flood out the power plant. Finally, electrical transmission lines connecting the
power plant to the grid were being threatened by the erosion along the service spillway. Losing
these lines or flooding the hydropower facility would hamstring the dam’s only backup for making
releases from the reservoir. Operators knew that repairing the spillway would be nearly impossible
until the power plant could be restored. These factors pointed towards closing the spillway
gates and allowing the reservoir to rise. On the other hand, the emergency spillway
had never been tested, and operators weren’t confident that it could safely release so much
water, especially after witnessing how quickly and aggressively the erosion happened on the
service spillway nearby. Also, its use would almost certainly strip at least the top layer
of soil and vegetation from the entire hillside, threatening adjacent electrical transmission
towers. A huge contingent of engineers and operations personnel were all hands on
deck, running analyses, forecasting weather, reviewing geologic records and original design
reports trying to decide the best course of action. Of course, this is all happening
over the course of only a couple of days with conditions constantly changing and no one
having slept, further complicating the decision making process. Operators worked to find a sweet
spot in managing these risks, limiting releases from the service spillway as much as possible
while still trying to keep the reservoir from overtopping the emergency spillway. But, every new
forecast just showed more rain and more inflows. Eventually it became clear to operators that
they would have to pick a lesser evil: Increase discharges and flood the powerhouse or let the
reservoir rise above the emergency spillway. They decided to let the reservoir
come up. The morning of February 11, about four days after the damage was
initially noticed, Lake Oroville rose above the crest of the emergency spillway
for the first time in the facility’s history. Almost immediately, it was clear that
things were not going to go smoothly. As it flowed across and down the natural hillside,
water from the emergency spillway began to channelize and concentrate. This quickly
accelerated erosion of the soil and rock, creating features called headcuts, which are a
sign of unstable and incising waterways. Headcuts are vertical drops in the topography eroded by
flowing water, and they always move upstream oftentimes aggressively. In this case, upstream
meant toward the emergency spillway structure, threatening its stability. This hillside
was a zone many had assumed to be solid, competent bedrock. It only took a modest flow
through the emergency spillway to reveal the true geologic conditions: the hillside was
composed almost entirely of highly erodible soil and weathered rock. If the headcuts were
to reach the concrete structure upstream, it would almost certainly fail, releasing
a wall of water from Oroville Lake that would devastate downstream communities.
Authorities knew they had to act quickly. On February 12, only about a day and half
after flow over the emergency spillway began, an evacuation order was issued for downstream
residents, displacing nearly 200,000 people to higher ground. At the same time, operators
elected to open the service spillway gates to double the flow rate and accelerate the lowering
of the reservoir. The level dropped below the emergency spillway crest that night, stopping the
flow and easing fears about an imminent failure. Two days later, on Valentine’s Day, the evacuation
order was changed to a warning, allowing people to return to their homes. But there was still more
rain in the forecast, and the emergency spillway was in poor condition to handle additional
flow if the reservoir were to rise again. California DWR continued discharging through the
crippled service spillway to lower the reservoir by 50 feet or 15 meters in order to create
enough storage that the spillway could be taken out of service for evaluation and repairs.
The gates stayed open until February 27th, nearly three weeks after the whole mess started,
revealing the havoc to the dam’s right abutment. Water that started its journey as tiny
drops of rain in a heavy storm - funneled and concentrated by the earth’s topography and
turbulently released through massive human-made structures - had carved harrowing scars
through the hillside. But, how did it happen? Like all major catastrophes, there were a
host of problems and issues that coincided to cause the failure of the concrete chute.
One of the most fundamental issues was geologic. Although it was
well-understood that some areas of the spillway’s foundation were not good
stuff (in other words, weathered rock and soil), the spillway was designed and maintained as if
the entire structure was sitting on hard bedrock. That mischaracterization had profound
consequences that I’ll discuss. As for how the spillway damage started, the
issue was uplift forces. How do concrete structures stay put? Mostly by being heavy. Their
weight pins them to the ground so they can resist other forces that may cause them to move.
But, water complicates the issue. You might think that adding water to the top
of a slab just adds to the weight, making things more stable. And that would be true
without cracks and joints. The problem with the Oroville Dam service spillway chute was that it
had lots of cracks and joints, for reasons I’ll discuss in a moment. These cracks allowed water to
get underneath the slabs, essentially submerging the concrete on all sides. Here’s the issue
with that: structures weigh less under water, or more accurately, their weight is counteracted
by the buoyant force of the water they displace. So, being underwater already starts to destabilize
them, because it adds an uplift force. But, concrete still sinks underwater, right? The
net force is still down, holding the structure in place. That’s true in static conditions,
but when the water is moving, things change. We talk about Bernoulli’s principle a lot on this
channel, and he’s got something to say about the flow of water in a spillway. In this case, the
issue was what happens to a fast-moving fluid when it suddenly stops. Cracks and joints in a concrete
spillway have an effect on the flow inside. Any protrusion into the stream redirects the flow. If
a joint or crack is offset, that redirection can happen underneath the slab. When this happens, all
the kinetic energy of the fluid is converted into potential energy, in other words, pressure. When
it’s 100% of the kinetic energy being converted, we call it the stagnation pressure. See how the
level rises in this tube when I direct it into the flowing water. The equation for stagnation
pressure is a function of velocity squared. So, if I double the speed of flow in my flume,
I get four times the resulting pressure and thus four times the height the water rises in my tube.
And the water in the Oroville spillway is moving a lot faster than this. When this stagnation
pressure acts on the bottom of a concrete slab, it creates an additional uplift force. If all
the uplift forces exceed the weight of the slab, it’s going to move. That’s exactly what
happened at Oroville. And once one slab goes, it’s just a chain reaction. More of the
foundation is exposed to the fast moving water, and more of that water can inject itself
below the slabs, causing a runaway failure. Of course, we try to design around this problem.
The service spillway had drains consisting of perforated pipes to relieve the pressure of
water flowing beneath the slabs. Unfortunately, the design of these drains was a major reason for
the cracking chute. Instead of trenching them into the foundation below the slabs, they reduced
the thickness of the concrete to make room for the drains. The crack pattern on the chute
essentially matched the layout of the drains beneath perfectly. So, in this case the drains
inadvertently let more water below the slab than they let out from underneath it. The chute also
included anchors, steel rods tying the concrete to the foundation material below. Unfortunately those
anchors were designed for strong rock and their design wasn’t modified when the actual foundation
conditions were revealed during construction. The root cause wasn’t just a bad design, though.
There are plenty of human factors that played into the lack of recognition and failure to
address the inherent weaknesses in the structure. Large dams are regularly inspected, and their
designs periodically compared to the state of current practice in dam engineering. Put
simply, we’ve built bigger structures on worse foundations than this. Modern spillway
designs have lots of features that help to avoid what happened at Oroville. Multiple layers
of reinforcement keep cracks from getting too wide. Flexible waterstops are embedded into joints
to keep water from migrating below the concrete. Joints are also keyed so individual slabs
can’t separate from one another easily. Lateral cutoffs help resist sliding and keep
water from migrating beneath one slab to another. Anchors add uplift resistance by holding
the slabs down against their foundation. Even the surface of the joints is offset
to avoid the possibility of a protrusion into the high velocity flow. All these are things
that the Oroville Spillway either didn’t have or weren’t done properly. Periodic reviews of the
structure’s design, required by regulators, should have recognized the deterioration
and inherent weaknesses and addressed them before they could turn into such
a consequential chain of tribulations. As for the emergency spillway, the
fundamental cause of the problem was similar: a mischaracterization of the foundation material
during and after design. Emergency spillways are just that: intended for use only during a rare
event where it’s ok to sustain some damage. But, it’s never acceptable for the structure
to fail, or even come close enough to failing that the residents downstream have to be
evacuated. That means engineers have to be able to make conservative estimates of how much
erosion will occur when an emergency spillway engages. Predicting the amount and extent of
erosion caused by flowing water is a notoriously difficult problem in civil engineering. It takes
sophisticated analysis in the best of times, and even then, the uncertainty is still
significant. It is practically impossible to do under the severe pressure of an emergency. The
operators of the dam chose to allow the reservoir to rise above the crest of the emergency
spillway rather than increase discharges through the debilitated service spillway,
trusting the original designer that it could withstand the flows. It’s a decision I think
most people (in hindsight) would not have made. The powerhouse was further from flooding and
the transmission lines further from failing than initially thought, and they eventually ramped
up discharges from the service spillway anyway, after realizing the magnitude of the
erosion happening at the emergency spillway. But, it’s difficult to pass blame too strongly.
The operators making decisions during the heat of the emergency did not have the benefit
of hindsight. They were stuck with the many small but consequential decisions made over
a very long period of time that eventually led to the initial failure, not to mention
the limitations of professional engineering practice’s ability to shine a light down
multiple paths and choose the perfect one. The forensic team’s report outlines many lessons
to be learned from the event by the owner of the dam and the engineering community at large,
and it’s worth a read if you’re interested in more detail. But, I think the most important
lesson is about professional responsibility. The people downstream of Oroville Dam,
and indeed any large dam across the world, probably chose their home or workplace without
considering too carefully the consequences of a failure and breach. We rarely have the luxury to
make decisions with such esoteric priorities. That means, whether they realized it or not, they
put their trust in the engineers, operators, and regulators in charge of that dam to keep them
safe and sound against disaster. In this case, that trust was broken. It’s a good reminder
to anyone whose work can affect public safety. The repairs and rebuilding of the spillways at
Oroville Dam are a whole other fascinating story. Maybe I’ll cover that in a future video. Thank
you for watching, and let me know what you think!
This was actually a very good video, as all of the practical engineering videos are
I live in area, south of the dam, that was evacuated just in case everything went wrong. So hearing about this is awesome.
Great video, would like to have seen/learned more about the repair
awesome video. this is the kinda stuff that really makes youtube shine.
20 years ago we wouldn't have had access to this kinda informative content.