The dam didn’t fail, but it came too close for comfort, especially for the tallest structure of its kind in the United States. Auroville Dam falls under the purview of the Federal Energy Regulatory Commission in a state with a progressive dam safety program and regular inspections and evaluations by the most competent engineers in the industry. So how could a failure mode like this slip through the cracks, both figuratively and literally?
Luckily, an independent forensics team got deep in the weeds and prepared a 600 page report to try and find out. This is a summary of that. I’m greedy and this is practical engineering. In today’s episode, we’re talking about the Auroville Dam crisis. Auroville Dam, located in northern California, is the tallest dam in the United States at seven hundred seventy feet or two hundred thirty five meters high, completed in 1968 and owned and operated by the California Department of Water Resources. Every part of Auroville Dam is massive. The facility consists of an earthen embankment which forms the dam itself, a hydropower generation plant that can be reversed to create pump storage, a service spillway with eight radial floodgates and an emergency overflow spillway. The reservoir created by the dam, Lake Oroville, is also immense, the second biggest in the state. It’s part of the California State Water Project, one of the largest water storage and delivery systems in the U.S. that supplies water to more than 20 million people and hundreds of thousands of acres of irrigated farmland. The reservoir is also used to generate electricity with over 800 megawatts of capacity. Finally, the dam also keeps a reserve volume empty during the wet season. In case of major flooding upstream, it can store floodwaters and release them gradually over time, reducing the potential damage downstream.
No dam is built to hold all the water that could ever flow into the reservoir at once. And yet having water over top an unprotected embankment will almost certainly cause a breach and failure. So all dams need spillways to safely release excess inflows and maintain the level of the reservoir once its full spillways are often the most complex and expensive components of a dam. And that’s definitely true at Auroville. The service spillway has a shoot that is one hundred and eighty feet or fifty five meters wide and three thousand feet long. That’s nearly a kilometer for the Metroplex. Radial gates control how much water is released and massive concrete blocks at the bottom of the chute called dentate disperse the flow to reduce erosion as it crashes into the Feather River. The spillway is capable of releasing nearly 300000 cubic feet, or 8000 cubic meters of water per second. That’s roughly an Olympic size swimming pool. Every other second, which I know isn’t that helpful in conceptualizing this incredible volume. If you somehow put that much flow through a standard garden hose, it would travel at fifteen percent of the speed of light, reaching the moon in about nine seconds. How’s that for a flow rate equivalency? But even that is not enough to protect the embankment. Large dams have to be able to withstand extraordinary flooding. In most cases, their design is based on a synthetic or made up storm called the probable maximum flood, which is essentially an approximation of the most rain that could ever physically fall out of the sky. It usually doesn’t make sense to design the primary spillway to handle this event, since such a magnitude of flooding is unlikely to ever happen during the lifetime of the structure. Instead, many dams have a second spillway, much simpler and design and thus less expensive to construct to increase their ability to discharge huge volumes of water during rare but extreme events. At Orvil, the emergency spillway consist of a concrete weir set one foot above the maximum operating level. If the reservoir gets too high and the service spillway can’t release water fast enough, this structure overflows, preventing the reservoir from reaching an overtopping the crest of the dam early. Twenty seventeen was one in Northern California’s wettest winters in history, with several major flood events across the state.
One of those storms happened in February upstream of Oroville Dam. As the reservoir filled, it became clear to operators that the spillway gates would need to be opened to release excess inflows on February 7th. Early during the releases, they noticed an unusual flow pattern about halfway down the chute. The issue is worrying enough that they decided to close the gates and pause the flood releases in order to get a better look. What they saw when the water stopped was harrowing. Several large concrete slabs were completely missing and a gigantic hole had eroded below the chute. There was a lot more inflow to the reservoir in the forecast, so operators knew they didn’t have much time to keep the gates closed while they inspected the damage and no chance to try to make repairs. They knew they would have to keep operating the crippled spillway, so they started opening gates incrementally to test how quickly the erosion would progress. Meanwhile, more rain was falling upstream, contributing the inflows and raising the level of the reservoir faster and faster. It wasn’t long before operators were faced with an extremely difficult decision to open more gates on the service spillway, which would further damage the structure or let the reservoir rise above the untested emergency spillway and cascade down the adjacent hillside. Several issues made this decision even more complicated. On one hand, the service spillway was in bad shape and there was the possibility of the erosion progress. Upstream toward the headworks, which could result in an uncontrolled release of the reservoir, also debris from the damaged spillway was piling up in the Feather River, raising its level and threatening to flood out the power plant. Finally, electrical transmission lines connecting the power plant to the grid were being threatened by the erosion along the service spillway. Losing these lines or flooding the hydropower facility would hamstring the dam’s only backup for making releases from the reservoir. Operators knew that repairing the spillway would be nearly impossible until the power plant could be restored. These factors pointed toward closing the spillway gates and allowing the reservoir to rise. On the other hand, the emergency spillway had never been tested, and operators weren’t confident that it could safely release so much water, especially after witnessing how quickly and aggressively the erosion happened on the spillway nearby. Also, its use would almost certainly strip at least the top layer soil and vegetation from the entire hillside, threatening adjacent electrical transmission towers.
A huge contingent of engineers and operations personnel were all hands on deck, running analysis, forecasting weather, reviewing geologic records and original design reports, trying to decide the best course of action. Of course, all this is happening over the course of only a couple of days, with conditions constantly changing and no one having slept. Further complicating the decision making process, operators work to find a sweet spot in managing these risks, limiting releases from the service below as much as possible while trying to keep the reservoir from overtopping the emergency spillway. But every new forecast just showed more rain and more inflows. Eventually, it became clear to operators that they would have to pick a lesser evil, increase discharges and flood the powerhouse or let the reservoir rise above the emergency spillway. They decided to let the reservoir come up. The morning of February 11th, about four days after the damage was initially noticed, Lake Oroville rose above the crest of the emergency spillway for the first time in the facility’s history. Almost immediately, it was clear that things were not going to go smoothly as it flowed across and down the natural hillside, water from the emergency spillway began to channelize and concentrate this quickly accelerated erosion of the soil and rock, creating features called head cuts, which are a sign of unstable and in sizing waterways. Head cuts are vertical drops in the topography eroded by flowing water, and they always move upstream, oftentimes aggressively in this case upstream, toward the emergency spillway structure, threatening its stability. This hillside was a zone many had assumed to be solid, competent bedrock. It only took a modest flow through the emergency spillway to reveal the true geologic conditions. The hillside was composed almost entirely of highly erodible soil and weathered rock. If the head cuts were to reach the concrete structure upstream, it would almost certainly fail, releasing a wall of water from Oroville Lake that would devastate downstream communities. Authorities knew they had to act quickly. On February 12th, only about a day and a half after flow over the emergency spillway began. An evacuation order was issued for downstream residents, displacing nearly 200000 people to higher ground. At the same time, operators elected to open the service spillway gates to double the flow rate and accelerate the lowering of the reservoir. The level dropped below the emergency spillway crest that night, stopping the flow and easing fears about an imminent failure. Two days later, on Valentine’s Day, the evacuation order was changed to a warning allowing people to return to their homes. But there was still more rain in the forecast, and the emergency spillway was in poor condition to handle additional flow if the reservoir were to rise again. California W.R continue discharging through the crippled service spillway to lower the reservoir by 50 feet or 15 meters in order to create enough storage that the spillway could be taken out of service for evaluation and repairs.
The gates stayed open until February 27th, nearly three weeks after this whole mess started revealing the havoc to the dams right above water that started its journey as tiny drops of rain and a heavy storm funneled and concentrated by the Earth’s topography and turbulent early release through massive human made structures had carved harrowing scars through the hillside. But how did it happen? Like all major catastrophes, there were a host of problems and issues that coincided to cause the failure of the concrete chute. One of the most fundamental issues was geologic, although it was well understood that some areas of the Spillways Foundation were not good stuff. In other words, weathered rock and soil. The spillway was designed and maintained as if the entire structure was sitting on hard bedrock. That mischaracterization had profound consequences that I’ll discuss. As for how the spillway damage started, the issue was uplift. Forces had a concrete structure stay put mostly by being heavy. Their weight pins them to the ground so they can resist other forces that may cause them to move. But water complicates this issue. You might think that adding water to the top of the slab just adds to the weight, making things more stable. And that would be true without cracks in joints. The problem with the Orvil Dam serve a spillway shoot was that it had lots of cracks and joints, for reasons I’ll discuss in a moment. These cracks allow the water to get underneath the slabs, essentially submerging the concrete on all sides. Here’s the issue with that structure is way less underwater or more accurately, their weight is counteracted by the buoyant force of the water they displace. So being underwater already starts to destabilize them because it adds an uplift force. But concrete still sinks underwater water, right? The net force is still down, holding the structure in place. That’s true in static conditions, but when the water is moving, things change. We talk about Bernoulli’s principle a lot on this channel, and he’s got something to say about the flow of water in a spillway. In this case, the issue was what happens to a fast moving fluid when it suddenly stops. Cracks and joints and a spillway have an effect on the flow inside. Any protrusion into the stream redirects the flow. If a joint or crack is offset, that redirection can happen underneath the slab. When this happens, all the kinetic energy of the fluid is converted into potential energy. In other words, pressure. When it’s 100 percent of the kinetic energy being converted. We call it the stagnation pressure. See how the level rises in this tube when I direct it into the flowing water. The equation for stagnation. Pressure is a function of the velocity squared. So if I double the speed of the flow in my flume, I get four times the resulting pressure and thus four times the height. The water rises in my two and the water in the Oroville spillway is moving a lot faster than this. When the stagnation pressure acts on the bottom of a concrete slab, it creates an additional uplift force. If all the uplift forces exceed the weight of the slab, it’s going to move. That’s exactly what happened at all. And once one slab goes, it’s just a chain reaction. More of the foundation is exposed to the fast moving water, and more of that water can inject itself below the slabs, causing a runaway failure. Of course, we try to design around this problem. The service spillway had drains consisting of perforated pipes to relieve the pressure of water flowing beneath the slabs. Unfortunately, the design of these drains was a major reason for the cracking shoot. Instead of trenching them into the foundations below the slabs, they reduced the thickness of the concrete to make room for the drains.
The crack pattern on the chute essentially matched the layout of the drains beneath perfectly. So in this case, the drains inadvertently let more water below the slab than they let out from underneath the chute. Also included anchors steel rods tying the concrete to the foundation material below. Unfortunately, those anchors were designed for strong rock and their design wasn’t modified when the actual foundation conditions were revealed during construction. The root cause wasn’t just a bad design, though there are plenty of human factors that played into the lack of recognition and failure to address the inherent weaknesses in the structure. Large dams are regularly inspected and their designs periodically compared to the state of current practice in dam engineering. Put simply, we’ve built bigger structures on a worse foundations than this. Modern spillway designs have lots of features that help avoid what happened at Auroville. Multiple layers of reinforcement keep crack’s from getting too wide. Flexible water stops are embedded into joints to keep water from migrating below. The concrete joints are also keyed. So individual. All slabs can’t separate from one another easily lateral cutoffs help resist sliding and keep water from migrating beneath one slab to another. Anchors add uplift resistance by holding the slabs down against their foundation. Even the surface of joints is offset to avoid the possibility of a protrusion into the high velocity flow. All these are things that the Auroville spillway either didn’t have or weren’t done properly. Periodic reviews of the structures design required by regulators should have recognized the deterioration and inherent weaknesses and address them before they could turn into such a consequential chain of tribulations. As for the emergency spillway, the fundamental cause of the problem was similar a mischaracterization of the foundation material during and after design. Emergency spillways are just that intended for use only during a rare event where it’s OK to sustain some damage. But it’s never acceptable for the structure to fail or even come close enough to failing that, the residents downstream have to be evacuated. That means engineers have to be able to make conservative estimates of how much erosion will occur when an emergency spillway engages.
Predicting the amount and extent of erosion caused by flowing water is a notoriously difficult problem in civil engineering. It takes sophisticated analysis in the best of times, and even then, the uncertainty is still significant. It is practically impossible to do under the severe pressure of an emergency. The operators of the dam chose to allow the reservoir to rise above the crest of the emergency spillway rather than increase discharges through the debilitated service spillway, trusting the original designer that it could withstand the flows. It’s a decision I think most people in hindsight would not have made. The powerhouse was further from flooding and the transmission lines further from failing than initially thought, and they eventually ramped up discharges from the service spillway anyway after realizing the magnitude of the erosion happening at the emergency spillway. But it’s difficult to pass blame too strongly. The operators making decisions during the heat of the emergency did not have the benefit of hindsight. They were stuck with the many small but consequential decisions made over a very long period of time that eventually led to the initial failure, not to mention the limitations of professional engineering practices, ability to shine a light down multiple paths and choose the perfect one. The forensic teams report outlines many lessons to be learned from the event by the owner of the dam and the engineering community at large. And it’s worth a read if you’re interested in more detail. But I think the most important lesson is about professional responsibility. The people downstream of Auroville Dam and indeed any large dam across the world probably chose their home or workplace without considering too carefully the consequences of a failure and breach. We rarely have the luxury to make decisions with such esoteric priorities. That means whether they realize it or not, they put their trust in the engineers, operators and regulators in charge of that dam to keep them safe and sound against disaster. In this case, that trust was broken. It’s a good reminder to anyone whose work can affect public safety.