Case Study · Dam Failure · 2017
February 2017. The main spillway of the US's tallest dam failed. The emergency spillway — never used in 49 years of operation — was activated for the first time and began to erode catastrophically within hours. 188,000 people evacuated. The dam didn't fail. No one died. But three environmental groups had warned, in a 31-page 2005 FERC filing, that exactly this would happen if the unlined emergency spillway were ever used. The motion was rejected. The fix would have cost money. In 2017, the repair cost $1 billion.
Feather River, Butte County, California · February 2017
Oroville Dam was completed in 1968 — the tallest dam in the United States at 770 feet. For 49 years, its two spillways functioned without incident. The main (service) spillway handled routine reservoir discharge. The emergency (auxiliary) spillway — a concrete weir at the edge of a hillside — had never been used. During its relicensing review in 2005, three environmental groups (Friends of the River, Sierra Club, and South Yuba Citizens League) filed a 31-page motion with FERC. The CNN account of the incident documents what the motion said: the groups "argued that the Oroville Dam did not meet modern safety standards" and warned that "the auxiliary spillway was designed to work with a replacement dam that was never built" — meaning it was not designed for emergency use in its current configuration. The Governing.com account of the incident notes that the 2005 filing described specifically the erosion scenario that unfolded in 2017: "use of the emergency spillway could cause a loss of crest control at the dam." California DWR's May 2006 response to FERC stated that the emergency spillway was "a safe and stable structure founded on solid bedrock that will not erode." FERC rejected the motion. Paving the emergency spillway with concrete was not required.
In February 2017, an exceptionally wet winter brought Lake Oroville to record levels. On February 7, as operators discharged water through the main spillway at high rates, a 200-foot-long, 30-foot-deep hole opened in the spillway concrete. The IAHR account of the incident describes the subsequent decision: "an immediate decision was made to discontinue using the service spillway by shutting the crest gates and allowing the reservoir to rise and activate the adjacent auxiliary (emergency) spillway for the first time in the project's 50-year history." On February 11 at approximately 901 feet, water flowed over the emergency spillway weir — the first time in the dam's history. The IAHR abstract describes what happened next: "This action led to unexpected severe and rapid erosion and deep head-cutting of the terrain immediately downstream of the emergency spillway control structure, threatening control structure stability, and resulting in the precautionary evacuation of approximately 188,000 downstream residents." The 2005 filing had predicted exactly this scenario. DWR had said it would not erode. It eroded — within hours of first use.
The specific threat: if the concrete weir at the top of the emergency spillway had collapsed from undermining erosion, the reservoir would have suddenly released the top 30 feet of Lake Oroville's stored water with no controlled outflow path. The Friends of the River account of the crisis documents the potential consequence: a wall of water could have rushed "more than 100 miles down the Feather and Sacramento rivers, breaching levees all the way to the Sacramento-San Joaquin River Delta." The evacuation of 188,000 people in three counties — Butte, Sutter, and Yuba — was the direct response to this possibility. The evacuation was chaotic: gridlocked traffic on Highway 99 as households fled simultaneously with minimal notice. The crisis was averted: main spillway flows were restored at high rates to lower the reservoir level; the emergency spillway erosion was stabilized with rapid emergency rock placement; the reservoir dropped below the emergency spillway weir. No dam failure, no deaths. Repair costs: over $1 billion. The fix that was not required in 2005 cost 200-400 times more to address in 2017.
Feb 2017
Date
188,000
People Evacuated
0
Deaths
$1 billion+
Repair Cost
2005
Warning Filed
The Science
Think of the Oroville emergency spillway as a system designed for rare, controlled use — not for the uncontrolled emergency scenario that actually occurred. The IAHR account of the incident captures the core problem: the emergency spillway weir was designed to handle overflow, but the hillside below it was unarmored (not paved with concrete). When water flowed over the weir, it began eroding the hillside below. The rate of erosion was far more severe than DWR expected. Headcutting — the process where erosion works progressively backward toward the weir's foundation — threatened to undermine the weir and cause its sudden collapse. The Friends of the River account notes the specific danger: the 2005 filing had specifically warned of "a loss of crest control" — the technical term for exactly what would have happened if the weir had collapsed. DWR's 2006 response had stated the spillway was "founded on solid bedrock that will not erode." The bedrock was not solid enough to resist the flow rates that occurred — and the hillside certainly wasn't. The fundamental assumption — that the emergency spillway would work as designed — was never tested in 49 years. When it was finally tested, it failed almost immediately.
The Oroville incident is not an isolated example of aging dam infrastructure creating unexpected risk. The ASDSO's 2023 Infrastructure Report Card grades US dams at D+ — reflecting the condition of a dam system where most structures were built in the mid-20th century, many are now past their designed lifespans, and maintenance and inspection funding has chronically lagged the need. The American Rivers account of the Oroville spillway failure notes that the city of Oroville filed a lawsuit alleging "decades of mismanagement and intentional lack of maintenance" by DWR. The UC Berkeley engineering expert who reviewed the Oroville incident, Robert Bea, noted that cracks and defects in the main spillway had been found "repeatedly since 2009" — eight years before the 2017 failure. The specific pattern of Oroville — a warning filed, rejected to avoid cost, followed by a crisis that cost far more to repair — is a pattern common to deferred infrastructure maintenance across multiple domains. The "it hasn't failed yet" logic becomes dangerous when applied to aging infrastructure under increasing hydrologic stress from climate-change-intensified storms and precipitation events.
Oroville's emergency spillway had not been used in 49 years. This meant: (1) no one had direct experience managing flow over it; (2) it had never been stress-tested at high flow rates; (3) the assumption that it would work as designed had never been validated; and (4) the 2005 warning about its inadequacy had been dismissed partly on the grounds that it "would rarely if ever be used" (FERC July 2006 memo). The general principle: the longer a backup system goes untested, the more uncertain its reliability becomes — and the more confidently it will be described as reliable by people who have never had to use it. This applies to backup generators, emergency spillways, secondary communication systems, and other infrastructure that is designed for rare use. The Banqiao Dam was the "Iron Dam." The Oroville emergency spillway was "founded on solid bedrock." Both were described as safe by officials who had never tested them under the conditions that mattered.
Timeline
01
October 2005: Friends of the River, Sierra Club, and South Yuba Citizens League file a 31-page motion with FERC during Oroville Dam's relicensing review. The motion: the emergency spillway is not armored with concrete and would experience "extreme erosion" if used; the emergency spillway was designed to work with a replacement dam that was never built; "use of the emergency spillway could cause a loss of crest control at the dam"; the spillway "did not meet modern safety standards." 2006: DWR responds — spillway is "a safe and stable structure founded on solid bedrock that will not erode." FERC rejects the motion; emergency spillway "meets FERC engineering guidelines for an emergency spillway." 2014: DWR flood management plan states "the unlined emergency spillway for Oroville Dam would likely suffer heavy damage in the event it must be used in a major flood event."
02
Winter 2017: exceptionally wet; Lake Oroville fills to record levels. February 7: operators discharge high flows through main spillway; a 200-foot-long, 30-foot-deep hole opens in the concrete — main spillway has failed. Decision: close main spillway gates to prevent further damage and allow reservoir to rise. Danger: either continue using the broken main spillway (risk further damage, possibly endanger a power transmission tower), or allow the reservoir to rise above the emergency spillway weir — which has never been used. DWR acting director: "All this is rock. Solid rock." — describing the emergency spillway area as safe at a February 11 press briefing.
03
February 11: reservoir hits 901 feet — overtopping the emergency spillway weir for the first time in 49 years. Within hours: severe erosion and headcutting develops at the base of the concrete weir — exactly what the 2005 filing predicted. Less than 24 hours after first use: DWR engineers inform Butte County Sheriff that erosion threatens weir stability; if the weir collapses, upper 30 feet of Lake Oroville released uncontrolled; flood could travel 100+ miles to Sacramento-San Joaquin Delta. February 12, 4:20 PM: Butte County Sheriff orders evacuation of approximately 188,000 residents in Butte, Sutter, and Yuba counties. Gridlocked evacuation on Highway 99. "Nothing like this has ever happened" — evacuee, age 30.
04
February 12-13: around-the-clock repair operations; rock dropped into emergency spillway erosion. Main spillway flows increased to lower reservoir level. February 14: evacuation order downgraded to evacuation warning. Crisis averted; dam did not fail; no deaths. Repair costs: $1 billion+ (does not include economic impacts on community; salmon/steelhead fisheries impacts from sediment). January 2018 independent report: DWR concerns about emergency spillway cost "were shaken off in part because the agency was concerned about the costs the improvements would incur." City of Oroville lawsuit: crisis resulted from "decades of mismanagement and intentional lack of maintenance." Spillway repaired and strengthened. The 2005 warning had predicted exactly what happened. The repair cost roughly 200-400x the estimated cost of the 2005 fix.
Human Decisions
The institutional failure
The CNN account of the incident documents that Ron Stork of Friends of the River, who authored the 2005 motion, said the fix had been rejected partly because DWR "didn't think the emergency spillway would ever be required." This is the specific institutional logic that characterizes deferred maintenance of backup systems: if the backup is rarely needed, and it would cost money to improve it, and it has never failed before, the default is to keep it as is. The independent report published in January 2018 confirmed this: the concerns were "shaken off in part because the agency was concerned about the costs the improvements would incur." The economic logic is inverted: the cost of addressing a known deficiency before failure is almost always a small fraction of the cost of emergency repair after failure — plus the cost of the emergency response, the evacuation, the legal consequences, and the property damage. At Oroville, the 2005 fix would have cost perhaps $5-10 million to armor the emergency spillway with concrete. The 2017 repair cost over $1 billion.
Multiple news accounts of the 2017 Oroville crisis document a specific institutional failure: Bill Croyle, acting director of California DWR at the time, told reporters on February 11 that he "was not familiar with the 2005 warnings." He described the emergency spillway area as "solid rock" — the day before the erosion crisis made it clear the area was not solid rock. This institutional memory failure — where a 12-year-old warning about a specific deficiency wasn't known by the agency head during the crisis that the warning predicted — is a specific feature of organizational dysfunction around infrastructure risk. Warnings filed in administrative proceedings, documented in aging reports, and rejected in budget processes tend not to become operational knowledge that persists in institutional memory. The 2005 warning was not a secret; it was a public FERC filing. But it wasn't part of the operational culture of the agency that operated the dam.
The broader context
The ASDSO 2023 Infrastructure Report Card grade of D+ for US dams reflects the condition of approximately 90,000 dams, most built in the mid-20th century. Over 17,000 are classified as high-hazard-potential (failure would likely cause loss of life). Thousands of those high-hazard dams are in poor or unsatisfactory condition — with documented deficiencies that create failure risk under certain conditions. The Federal government provides some funding through the National Dam Safety Program and hazardous dam rehabilitation programs, but ASDSO estimates the repair cost for the most critical unsafe dams runs into tens of billions of dollars. Many state dam safety programs lack the inspection staff and regulatory authority to enforce compliance with dam safety standards. The Oroville incident is one high-profile example of the consequences of deferred maintenance — but the pattern repeats across the US dam inventory, typically without the public visibility of a near-miss that required evacuating 188,000 people.
The Oroville incident occurred in the context of an exceptionally wet California winter — 2016-2017 ended one of the worst droughts in California's history. The wet winter that caused the Oroville spillway crisis was unusual but not unprecedented in the context of California's natural climate variability. Future climate projections for California (and for many parts of the US) indicate increasing intensity of both wet and dry extremes — more intense precipitation events that could exceed dam design flood levels. Banqiao Dam was designed for a 1-in-1,000-year flood; Typhoon Nina was a 1-in-2,000-year event. As extreme precipitation events become more frequent and intense, the margin between a dam's design flood and the floods that actually arrive narrows. Aging dam infrastructure that was designed for 20th-century hydrology may be increasingly stressed by 21st-century precipitation extremes.
The cascade lesson
Oroville 2017 is the deferred maintenance lesson: infrastructure deficiencies don't resolve themselves when ignored. They wait for the conditions that make them catastrophic. The specific Oroville pattern — warning filed → rejected for cost → deficiency persists → crisis far more expensive than prevention → $1 billion repair — is the pattern that characterizes deferred infrastructure maintenance. For residents of the US, this means that living downstream of a dam built in the mid-20th century is not inherently safe just because the dam has never failed. The condition of the dam, the maintenance it has received, and whether its backup systems have been tested are the questions that determine safety. The ASDSO D+ rating means that for thousands of high-hazard US dams, the honest answer to those questions is not reassuring.
What You Can Do Now
Oroville's lesson is about deferred maintenance risk, backup system reliability, and the specific preparations downstream residents need before a dam emergency — because dam events unfold in hours, not days. These five actions directly address the Oroville pattern.
ASDSO's dam failure database (damfailures.org) and your state dam safety office maintain condition and inspection records for regulated dams. Most states have searchable online dam inventories that include hazard classification (high/significant/low) and, in some cases, condition ratings. Searching "[state] dam safety" and looking for the dam safety program's database is the starting point. For high-hazard dams near your community, knowing whether they have recently been inspected and whether they carry known deficiencies is the Oroville-motivated awareness. The National Inventory of Dams (nid.sec.usace.army.mil) provides basic information for all regulated dams.
Dam condition and inspection records guideThe 188,000 Oroville evacuees received notification through Butte County's emergency alert system, Wireless Emergency Alerts on cell phones, and media broadcasts. The evacuation order was issued at 4:20 PM; communities needed to be moving by 5-6 PM to avoid peak gridlock. Registering for your county's emergency notification system (search "[county name] emergency alert registration") ensures you receive notifications as early as possible in a dam emergency. The critical difference at Oroville: residents who were registered received earlier, more specific information than those who only received Wireless Emergency Alerts. Registration is free and takes a few minutes.
Emergency notification registration guideThe Oroville evacuation produced gridlock on Highway 99 as 188,000 residents tried to leave simultaneously through a limited road network. Residents who knew alternate routes to high ground were better positioned than those trying to navigate in real time. For communities in dam inundation zones, identifying: (a) the primary and alternate evacuation routes out of the inundation zone; (b) where those routes lead to that is above the inundation depth; and (c) the location of family members and how to meet up if communications are disrupted — is pre-work that cannot be done in the hour after an evacuation order is issued. A go-bag with essential documents, medications, and supplies for 72 hours ensures you spend your evacuation time moving, not packing.
Pre-planned evacuation route and go-bag guideThe Oroville crisis developed because an exceptionally wet winter brought the reservoir to full — conditions that hadn't occurred in 49 years and that activated the never-used emergency spillway. Most major US dam operators publish real-time reservoir elevation and storage data online. During a period of heavy precipitation in a region where major dams are present, monitoring the upstream reservoir levels provides situational awareness before an official emergency declaration. California DWR publishes real-time data at cdec.water.ca.gov. The Army Corps of Engineers publishes reservoir data for Corps-operated dams at water.usace.army.mil. This is advanced preparedness — but for residents in high-risk downstream communities, it is exactly the kind of awareness that provides additional lead time.
Real-time dam reservoir monitoring guideThe ASDSO's D+ rating for US dams reflects a documented funding gap: thousands of high-hazard dams in poor condition, with known deficiencies, waiting for state or federal funds to address them. The Infrastructure Investment and Jobs Act (2021) included $7.5 billion for dam safety — but ASDSO's estimated need runs much higher. State dam safety programs vary dramatically in funding and enforcement capacity. Asking your state legislators about dam safety inspection and repair funding, supporting infrastructure bills that include dam safety provisions, and being aware of the specific dams in your area on state dam safety watchlists are community-level actions with direct public safety implications. The Oroville lesson is that the cost of prevention is almost always dramatically less than the cost of crisis response.
Dam safety advocacy and infrastructure funding guideDam Failure case study series
Johnstown 1889 covers the defining US dam failure. Vajont 1963 covers dam overtopping from a landslide without structural failure. Banqiao 1975 covers cascade dam failure and the largest death toll in dam failure history. Teton 1976 covers engineering defects in a new dam's first filling.
Full dam failure case study seriesSources