← back to the index
GR-015 spillway failure

Oroville Dam Spillways — Slab Uplift Over Weathered Rock Forced 188,000 to Flee

Structure
Oroville Dam flood-control (service) spillway, Feather River, California, USA
Failed
7 February 2017
Status
Failed

Summary

On 7 February 2017 the gated flood-control spillway at Oroville Dam — the tallest dam in the United States, on the Feather River in Butte County, California — failed under a routine flood release when water forced its way beneath the concrete chute and tore a crater hundreds of feet across out of the structure and the hillside below. No one died, but five days later the cascade of consequences nearly killed many: with the main spillway destroyed, rising water spilled for the first time over the dam's ungated emergency spillway, the unlined earth slope eroded headward toward the concrete weir within hours, and on 12 February officials ordered the emergency evacuation of communities downstream. By 13 February some 188,000 people had fled. The cause was not flood, earthquake, or overtopping of the dam itself. It was a thin concrete slab built over poor-quality, weathered foundation rock and a drainage system that, instead of relieving water pressure, helped trap it.

The dam, completed in 1968 and operated by the California Department of Water Resources (DWR), rises about 770 feet of compacted earthfill. Its flood-control spillway is a separate structure: a long, gated concrete chute carrying releases down the right abutment to the Feather River. On 7 February, with the chute discharging roughly 52,500 cubic feet per second, operators noticed an abnormal flow pattern and, on inspection, found a section of the slab gone and a hole eroded into the chute and its foundation. The mechanism was textbook in retrospect: high-velocity water injected through cracks and joints into the thin slab generated uplift pressure beneath it that exceeded the slab's weight and anchorage; once a panel lifted out, the high-velocity flow reached the moderately- to highly-weathered rock beneath, which scoured catastrophically and undercut adjacent panels in a runaway progression.

The Independent Forensic Team (IFT), assembled at the request of FERC and DWR and chaired by John France, released a 584-page report on 5 January 2018. It found no single villain. Instead it diagnosed a "long-term systemic failure" of DWR, of regulators, and of general dam-safety practice over fifty years to recognise and correct weaknesses baked into the spillway's original design and construction — a chute slab too thin where underdrains ran beneath it, anchors too short into weak rock, a foundation mischaracterised as competent bedrock, and decades of cracking and repair treated as cosmetic rather than symptomatic.

Oroville produced no fatalities and did not breach the dam, yet it became one of the most consequential dam-safety events in American history. Repairs exceeded $1.1 billion, the IFT report rewrote how spillways are inspected and judged, and the case stands as the canonical demonstration that a spillway chute is a foundation-and-drainage problem, not merely a slab of concrete.

---

Timeline

1961–1968
Design and construction
DWR designs and builds Oroville Dam and its gated flood-control spillway on the Feather River. The chute slab is thinned over the underdrain pipes rather than trenching the drains below it, and anchors are set into foundation rock later shown to be poor.
1968
Dam completed
At about 770 feet, Oroville becomes the tallest dam in the United States. The separate emergency spillway is an ungated concrete weir discharging onto an unlined earth and rock slope, never used in operation.
Late 1960s onward
Cracking appears almost immediately
Cracks open in the chute slab soon after construction, notably above and along the underdrain lines, with high initial underdrain flows — early evidence the slab and drainage were already underperforming.
1970s–2000s
Decades of patch repairs
DWR repeatedly seals cracks and repairs spalled concrete. The repairs are treated as routine maintenance; the underlying design weakness in slab thickness, anchorage, and foundation quality is never reassessed.
7 Feb 2017, morning
Abnormal flow noticed
With the chute releasing roughly 52,500 cfs during a wet winter, operators observe an unusual flow pattern and shut the gates to inspect.
7 Feb 2017
Slab and foundation gone
Inspection reveals a section of the chute slab destroyed and a large crater eroded into the slab and the weathered foundation rock beneath the steep mid-chute section.
8–10 Feb 2017
Damage worsens with releases
Continued, necessary releases through the damaged chute enlarge the crater dramatically, undermining more slab panels and deepening the hole into the hillside.
11 Feb 2017, ~08:00
Emergency spillway used for first time
As the reservoir rises, water flows over the ungated emergency weir for the first time since 1968. The unlined slope below begins eroding far faster than designers had assumed.
12 Feb 2017
Evacuation ordered
Headward erosion of the emergency-spillway slope threatens to undercut and collapse the concrete weir, risking an uncontrolled release. Authorities order evacuation of low-lying communities in Butte, Yuba and Sutter counties.
12–13 Feb 2017
188,000 flee
Operators raise main-spillway flow toward 100,000 cfs to draw the reservoir below the emergency weir and halt its erosion. By 13 February roughly 188,000 people have evacuated.
14 Feb 2017
Order downgraded
With the reservoir lowered and the emergency weir no longer in use, the evacuation order is reduced to a watch and residents begin returning.
5 Jan 2018
Forensic report published
The Independent Forensic Team, chaired by John France, releases its 584-page report, attributing the incident to systemic failures in design, construction, inspection and regulation over fifty years.

The Build: A Thin Slab on Weak Rock With Drains That Trapped Water

Oroville Dam was conceived in the early 1960s as the keystone of California's State Water Project and built by the state's own engineers at DWR. The dam — an earthfill embankment rising about 770 feet — was, and remains, the tallest in the United States. Its flood-control function lived not in the dam but in a separate, gated concrete chute on the right abutment, designed to carry large releases down a steep slope to the Feather River. A second, ungated emergency spillway stood alongside it: a concrete overflow weir discharging onto a bare earth-and-rock hillside, intended only as a last resort for extreme floods and, in nearly half a century of operation, never once used.

Two decisions made during design and construction set the stage for 2017. The first concerned the underdrain system meant to relieve water pressure beneath the chute. Rather than trench the drain pipes into the foundation below the slab, the builders ran them through the lower part of the slab itself, locally thinning the concrete to accommodate them. The drainage network thus became a plane of weakness threaded through the very element it was supposed to protect, and a conduit that, under the wrong conditions, could deliver pressurised water to the slab's underside instead of carrying it away. The second decision was to anchor the slab and seat the structure on foundation rock that was, in places, moderately to highly weathered — poor-quality material that the design treated as if it were competent bedrock. Anchors were too short and too sparse for rock that strong, and far too generous for the rock that was actually there.

The warning came at once. Cracks opened in the chute slab almost immediately after construction, concentrated above and along the underdrain pipes, and the underdrains ran heavily from the start. These were not random defects; they were the structure announcing the exact flaw that would later destroy it. But the cracking was read as a maintenance nuisance. For five decades DWR sealed cracks and patched spalls, and FERC's periodic reviews accepted the chute as serviceable. No one returned to first principles to ask whether a thin, cracked slab anchored into weathered rock could survive a hard, sustained release. The structure was never re-evaluated against the failure mode it had been signalling since the 1970s.

The Failure Sequence: Uplift, Ejection, and a Runaway Scour

The wet winter of 2017 finally asked the question. On the morning of 7 February, with the chute discharging roughly 52,500 cubic feet per second — a substantial but not extreme release — operators saw the flow behaving abnormally and closed the gates to look. A section of the slab was simply gone, and a crater had been eroded into the chute and the foundation rock beneath the steep mid-chute reach.

The mechanism was hydraulic and unforgiving. Where joints and cracks in the slab were offset, fast-moving water no longer skimmed over the surface; it was driven down into the cracks, decelerated against the offsets, and converted its velocity into stagnation pressure beneath the slab. That under-slab water pressure, augmented by the compromised underdrains delivering more flow than they could remove, generated uplift forces. Once those forces exceeded the slab's weight and the holding capacity of its corroded, undersized anchors, a panel lifted out of the chute. That was the irreversible step. With one panel gone, the high-velocity flow poured directly onto the moderately- to highly-weathered rock and soil-like material beneath — material that scoured violently under such flow, undercutting the edges of adjacent panels, ejecting them in turn, and driving the crater wider and deeper with every cubic foot released.

DWR now faced an impossible choice. The reservoir was rising in a wet winter and had to be lowered, but every release through the wrecked chute enlarged the hole. When operators throttled back to limit chute damage, the reservoir climbed until, shortly after 08:00 on 11 February, water crested the emergency spillway for the first time in the dam's history. The unlined hillside below the weir eroded far faster than the design had ever assumed, and the erosion advanced headward — uphill — toward the concrete weir itself. If that weir were undercut and collapsed, a wall of stored water could be released uncontrolled. On 12 February the evacuation order went out; by the 13th about 188,000 people had fled. To save the emergency weir, operators reopened the ruined main chute and pushed flow toward 100,000 cfs, accepting enormous damage to draw the reservoir below the emergency weir. It worked. The dam held, the weir survived, and on 14 February the order was downgraded.

The Reckoning: No Single Cause, a Fifty-Year Systemic Failure

The Independent Forensic Team — recommended by ASDSO and USSD, accepted by FERC and DWR, and chaired by John France — investigated for nine months and published a 584-page report on 5 January 2018. Its central finding was unusual and pointed: there was no single root cause. The incident was the product of a "long-term systemic failure" of DWR, of its regulators, and of general dam-safety practice to recognise and correct inherent weaknesses in the spillway's design and construction, the poor quality of the foundation rock, and the deteriorated state of the chute — over a span of fifty years.

The physical chain was clear: water injected through cracks and joints, uplift exceeding the thin slab's capacity, a panel ejected, and weathered rock exposed to a scour that fed on itself. But the IFT refused to stop there, because every one of those physical facts had been knowable and, in the cracking of the 1970s, visible. The slab had been built too thin over its drains; the anchors and foundation had been mismatched to the rock; the underdrains had been a liability rather than a safeguard; and the chronic cracking had been managed as cosmetic for decades. The report described DWR, the owner of the tallest dam in the United States, as having grown "somewhat overconfident and complacent" about its own engineering. The lesson was institutional as much as geotechnical: a robust dam-safety culture must treat persistent symptoms as evidence of a mechanism, and must periodically re-examine old structures against the failure modes they keep hinting at — not merely repair the surface and renew the assumption that the design was sound.

---

Contributing Factors

01
A chute slab too thin over its own drains
The underdrain pipes were run through the lower portion of the slab rather than trenched into the foundation beneath it, locally thinning the concrete and threading a plane of weakness through the structure. The result was a slab with reduced section exactly where it most needed strength, and a drainage system positioned to deliver pressurised water to the slab's underside rather than carry it away.
02
Foundation rock mischaracterised as competent
The chute was seated on, and anchored into, rock that was in places moderately to highly weathered — erodible, soil-like material — yet the design treated it as sound bedrock. Anchors were too short and too few for such weak rock, and once the slab was breached the foundation offered no scour resistance, allowing a localized failure to become a hillside-consuming crater.
03
Uplift pressure that exceeded the slab's capacity
High-velocity flow forced through offset joints and cracks decelerated beneath the slab and converted to stagnation pressure. Combined with an underdrain system that admitted more water than it removed, the under-slab uplift exceeded the slab's weight and anchorage. This is the governing mechanism: a spillway slab fails when uplift beneath it beats the forces holding it down.
04
Five decades of symptoms read as maintenance
The slab cracked almost immediately after construction, above and along the underdrains, with high early drain flows — the structure signalling its exact flaw. DWR patched cracks and spalls for fifty years and FERC reviews accepted the chute, but no one re-evaluated the design against the failure mode the cracking implied. Chronic symptoms were managed cosmetically rather than diagnosed.
05
An emergency spillway on bare, erodible ground
The ungated emergency spillway discharged onto an unlined earth-and-rock slope that had never been tested. When it carried water for the first time in 2017, the slope eroded headward toward the concrete weir far faster than assumed, threatening an uncontrolled release and forcing the evacuation. A last-resort structure had no margin against the very erosion that defined its first use. ---

Aftermath

Oroville killed no one and never breached the dam, but it forced roughly 188,000 people from their homes and cost more than $1.1 billion to repair, with the main spillway rebuilt by November 2018 and the emergency spillway fortified with a buttressed concrete splash pad and a secant-pile cutoff wall to arrest headward erosion. The Independent Forensic Team's January 2018 report became a reference document for the profession: it pushed FERC and dam owners toward comprehensive, risk-informed periodic spillway reviews that scrutinise foundation quality, underdrain performance and slab anchorage rather than surface condition alone, and it elevated the treatment of spillway chutes as foundation-and-hydraulic systems where uplift, not concrete strength, governs survival. Above all the case became the byword for institutional complacency at the top of an industry — the cautionary phrase that even the owner of the tallest dam in the United States could be "overconfident and complacent," and that a structure cracking the same way for fifty years was telling its owners exactly how it would one day fail.

---

Lessons

  1. Design and seat a spillway chute against uplift, not just flow: size the slab, anchors and joints so that under-slab pressure can never exceed the forces holding the slab down, and trench drains below the slab rather than weakening it to fit them.
  2. Investigate and classify the foundation rock honestly: never treat weathered, erodible material as competent bedrock, and detail anchorage and scour protection for the rock that is actually present, not the rock the design assumed.
  3. Treat persistent symptoms as a mechanism, not maintenance: when a structure cracks the same way for decades, return to first principles and re-evaluate it against the failure mode the cracking implies — do not patch and renew the assumption of soundness.
  4. Prove every emergency or last-resort element before you rely on it: an ungated spillway on bare ground that has never carried water is an untested assumption; line, armour, or analyze its erosion behaviour as if your worst day depends on it.
  5. Guard against institutional overconfidence: the larger and more reputable the owner, the more deliberately it must invite independent, risk-informed review — complacency, not flood, is what destroyed the most heavily defended spillway in the country. ---

References