Summary
The Oroville Dam spillway incident was caused by a long-term systemic failure of the California Department of Water Resources (DWR), regulatory, and general industry practices to recognize and address inherent spillway design and construction weaknesses, poor bedrock quality, and deteriorated service spillway chute conditions. The incident cannot reasonably be “blamed” mainly on any one individual, group, or organization.
During service spillway operation on February 7, 2017, water injection through both cracks and joints in the chute slab resulted in uplift forces beneath the slab that exceeded the uplift capacity and structural strength of the slab, at a location along the steep section of the chute. The uplifted slab section exposed the underlying poor quality foundation rock at that location to unexpected severe erosion, resulting in removal of additional slab sections and more erosion.
Responding to the damage to the service spillway chute necessitated difficult risk tradeoffs while the lake continued to rise. The resulting decisions, made without a full understanding of relative uncertainties and consequences, allowed the reservoir level to rise above the emergency spillway weir for the first time in the project’s history, leading to severe and rapid erosion downstream of the weir and, ultimately, the evacuation order.
There was no single root cause of the Oroville Dam spillway incident, nor was there a simple chain of events that led to the failure of the service spillway chute slab, the subsequent overtopping of the emergency spillway crest structure, and the necessity of the evacuation order. Rather, the incident was caused by a complex interaction of relatively common physical, human, organizational, and industry factors, starting with the design of the project and continuing until the incident. The physical factors can be placed into two general categories:
- Inherent vulnerabilities in the spillway designs and as-constructed conditions, and subsequent chute slab deterioration
- Poor spillway foundation conditions in some locations
A simplified overview of how human, organizational, and industry factors interacted with these two general categories of physical factors is given in Figure S-1, and is broadly outlined below.
The inherent vulnerability of the service spillway design and as-constructed conditions reflect lack of proper modification of the design to fit the site conditions. Almost immediately after construction, the concrete chute slab cracked above and along underdrain pipes, and high underdrain flows were observed. The slab cracking and underdrain flows, although originally thought of as unusual, were quickly deemed to be “normal,” and as simply requiring on-going repairs. However, repeated repairs were ineffective and possibly detrimental.
The seriousness of the weak as-constructed conditions and lack of repair durability was not recognized during numerous inspections and review processes over the almost 50-year history of the project. Over time, chute flows and temperature variations led to progressive deterioration of the concrete and corrosion of steel reinforcing bars and anchors, with likely loss of slab strength and anchor capacity. There was likely also some shallow underslab erosion and some loss of underdrain system effectiveness, which contributed to increased slab uplift forces. The particularly poor foundation conditions at the initial service spillway chute failure location contributed to likely
low anchor capacity and shallow underslab erosion.
Due to the unrecognized inherent vulnerability of the design and as-constructed conditions and the chute slab deterioration, the spillway chute slab failure, although inevitable, was unexpected.
Once the initial section of the chute slab was uplifted, the underlying poor quality foundation materials were directly exposed to high velocity flows and were quickly eroded. Undermining and uplift of other portions of the chute slab resulted in further removal of slab sections and more foundation erosion.
Although the poor foundation conditions at both spillways were well documented in geology reports, these conditions were not properly addressed in the original design and construction, and all subsequent reviews mischaracterized the foundation as good quality rock. As a result, the significant erosion of the service spillway foundation was also not anticipated.
Following the unexpected chute slab failure and erosion, and subsequent closure of the service spillway gates to examine the damage, delicate and difficult risk tradeoffs, involving myriad considerations, were necessary over the next few days in order to manage the incident. Either the gates would need to be re-opened, with the potential for further service spillway damage and/or damage to a transmission tower, or the lake levels would rise and the emergency spillway weir would be overtopped, with the potential for erosion at the emergency spillway. In addition, erosion had transported a tremendous amount of debris into the river channel, and the resulting high tailwater was threatening to flood the powerhouse. The decision-makers attempted to find a “sweet spot,” such that the service spillway would continue to be used, but with discharges no greater than necessary to just prevent the lake from rising above the emergency spillway weir.
There were decision points during the incident when discharge through the service spillway was specifically limited, even though risks to the powerhouse from further discharge were clearly diminishing. These decisions ultimately resulted in the lake rising high enough to initiate flow over the emergency spillway weir. The decisions were made with the best of intentions, but against the advice of civil engineering and geological personnel, who had by then recognized the poor bedrock conditions and the potential for unsatisfactory performance of the previously untested emergency spillway. In limiting service spillway discharge to reduce the likelihood of powerhouse flooding, the additional dam safety risk associated with use of the emergency spillway was not appropriately considered. Once the emergency spillway was allowed to overtop, this additional risk was soon realized, and the evacuation order became a necessary precaution.
There were many opportunities to intervene and prevent the incident, but the overall system of interconnected factors operated in a way that these opportunities were missed. Numerous human, organizational, and industry factors led to the physical factors not being recognized and properly addressed, and to the decision-making during the incident. The following are some of the key factors which are specific to DWR:
- The dam safety culture and program within DWR, although maturing rapidly and on the right path, was still relatively immature at the time of the incident and has been too reliant on regulators and the regulatory process.
- Like many other large dam owners, DWR has been somewhat overconfident and complacent regarding the integrity of its civil infrastructure and has tended to emphasize shorter-term operational considerations. Combined with cost pressures, this resulted in strained internal relationships and inadequate priority for dam safety.
- DWR has been a somewhat insular organization, which inhibited accessing industry knowledge and developing needed technical expertise.
- DWR’s ability to build the appropriate size, composition, and expertise of its technical staff involved in dam engineering and safety has been limited by bureaucratic constraints.
In addition to lessons which are specific to DWR, as described in this report, the following are some of the general lessons to be learned by the broader dam safety community:
- In order to ensure the safe management of water retention and conveyance structures, dam owners must develop and maintain mature dam safety management programs which are based on a strong “top-down” dam safety culture. There should be one executive specifically charged with overall responsibility for dam safety, and this executive should be fully aware of dam safety concerns and prioritizations through direct and regular reporting from a designated dam safety professional, to ensure that “the balance is right” in terms of the organization’s priorities.
- More frequent physical inspections are not always sufficient to identify risks and manage safety.
- Periodic comprehensive reviews of original design and construction and subsequent performance are imperative. These reviews should be based on complete records and need to be more in-depth than periodic general reviews, such as the current FERC-mandated five-year reviews.
- Appurtenant structures associated with dams, such as spillways, outlet works, power plants, etc., must be given attention by qualified individuals. This attention should be commensurate with the risks that the facilities pose to the public, the environment, and dam owners, including risks associated with events which may not result in uncontrolled release of reservoirs, but are still highly consequential.
- Shortcomings of the current Potential Failure Mode Analysis (PFMA) processes in dealing with complex systems must be recognized and addressed. A critical review of these processes in dam safety practice is warranted, comparing their strengths and weaknesses with risk assessment processes used in other industries worldwide and by other federal agencies. Evolution of “best practice” must continue by supplementing current practice with new approaches, as appropriate.
- Compliance with regulatory requirements is not sufficient to manage risk and meet dam owners’ legal and ethical responsibilities.
Some of these general lessons are self-evident, and have been noted by others previous to the IFT’s investigation of this incident. The question is whether dam owners, regulators, and other dam safety professionals will recognize that many of these lessons are actually still to be learned. Although the practice of dam safety has certainly improved since the 1970s, the fact that this incident happened to the owner of the tallest dam in the United States, under regulation of a federal agency, with repeated evaluation by reputable outside consultants, in a state with a leading dam safety regulatory program, is a wake-up call for everyone involved in dam safety. Challenging current assumptions on what constitutes “best practice” in our industry is overdue.
Download full version (PDF): Independent Forensic Team Report – Oroville Dam Spillway Incident
Independent Forensic Team Members:
John W. France, PE, D.GE, D.WRE – Team Leader and Geotechnical Engineer
Irfan A. Alvi, PE – Hydraulic Structures Engineer and Human Factors Specialist
Peter A. Dickson, PhD, PG – Engineering Geologist
Henry T. Falvey, Dr.-Ing, Hon.D.WRE – Hydraulic Engineer
Stephen J. Rigbey – Director, Dam Safety at BC Hydro, and Geological Engineer
John Trojanowski, PE – Hydraulic Structures Engineer
Tags: CA, California, Oroville Dam, Oroville Dam Incident, Oroville Dam Spillway Incident
RSS Feed
