6.4 Oroville IFT Lesson Learned
73
6.4.4 A Risk-Based Perspective
The cause of the Oroville Dam spillway incident was a long-term systemic failure
of the California Department of Water Resources (DWR), regulatory, and general
industry practices to recognize and address inherent spillway design and construction
weaknesses. In addition, poor bedrock quality, and deteriorated service spillway chute
conditions caused the incident.
Indeed, this was a case of normalization of deviance over service life during which
no one evaluated how the multi-hazard risk landscape of the system had evolved.
Quantitative multi-hazard convergent, scalable and drillable risk assessments are
paramount. Monitoring, near-misses and inspections should feed their updates.
Thus the incident cannot reasonably be “blamed” mainly on any one individual,
group, or organization. As a matter of fact, failures does not happen overnight and the
“common practice” siloed management structure is certainly to blame, rather than
any individual, group or organization. Abolishing the silo culture is paramount.
There was no single root cause of the Oroville Dam spillway incident, nor was
there a simple chain of events.
Interdependencies and common cause failures (https://www.riskope.com/
2015/04/16/how-system-definition-and-interdependencies-allow-transparent-andscalable-risk-assessments/#_blank) need to be accounted for in the risk register (i.e.,
complex failure modes, domino effects, long chains of events). The inclusion of
complex failures modes would deliver to management a better perception of reality.
Responding to the damage to the service spillway chute necessitated difficult risk
trade-offs in times of crisis and risk trade-offs may be extremely difficult when on top
of actual uncertainties one finds a layer of “soft uncertainties” due to the lack of robust
and uniform glossary, poor risk assessments, misleading conclusions. That becomes
especially important in infrastructures with a long-term service life. Fostering clarity
and transparency ensuring the use of robust and uniform glossary, training people to
recognize hazards from risks, understanding well-made risk assessment, which are
not using risk matrix-based approaches will go in the right direction.
At the end of the day decisions made without a full understanding of
relative uncertainties and consequences, allowed the reservoir level to rise above
the emergency spillway weir for the first time in the project’s history, leading
to severe and rapid erosion downstream of the weir and, ultimately, the evacuation order. Furthermore decisions made under stress, in fear and under poor
information (https://www.riskope.com/2018/01/03/acting-intuitively-planning-360view-upward-downward-tactical-strategic-risks/#_blank) are indeed oftentimes illguided and tend to look to the short term while forgetting the longer term.
Risk assessment should describe the multi-hazard risk landscape, and deliver
understanding of uncertainties and multi-dimensional consequences.
Following the unexpected chute slab failure and erosion, and subsequent closure of the service spillway gates to examine the damage, delicate and difficult risk
trade-offs, involving myriad considerations, were necessary over the next few days in
order to manage the incident. Risk-informed decision making (RIDM) and risk-based
decision making (RBDM) makes it possible specifically to manage those considera-
73
6.4.4 A Risk-Based Perspective
The cause of the Oroville Dam spillway incident was a long-term systemic failure
of the California Department of Water Resources (DWR), regulatory, and general
industry practices to recognize and address inherent spillway design and construction
weaknesses. In addition, poor bedrock quality, and deteriorated service spillway chute
conditions caused the incident.
Indeed, this was a case of normalization of deviance over service life during which
no one evaluated how the multi-hazard risk landscape of the system had evolved.
Quantitative multi-hazard convergent, scalable and drillable risk assessments are
paramount. Monitoring, near-misses and inspections should feed their updates.
Thus the incident cannot reasonably be “blamed” mainly on any one individual,
group, or organization. As a matter of fact, failures does not happen overnight and the
“common practice” siloed management structure is certainly to blame, rather than
any individual, group or organization. Abolishing the silo culture is paramount.
There was no single root cause of the Oroville Dam spillway incident, nor was
there a simple chain of events.
Interdependencies and common cause failures (https://www.riskope.com/
2015/04/16/how-system-definition-and-interdependencies-allow-transparent-andscalable-risk-assessments/#_blank) need to be accounted for in the risk register (i.e.,
complex failure modes, domino effects, long chains of events). The inclusion of
complex failures modes would deliver to management a better perception of reality.
Responding to the damage to the service spillway chute necessitated difficult risk
trade-offs in times of crisis and risk trade-offs may be extremely difficult when on top
of actual uncertainties one finds a layer of “soft uncertainties” due to the lack of robust
and uniform glossary, poor risk assessments, misleading conclusions. That becomes
especially important in infrastructures with a long-term service life. Fostering clarity
and transparency ensuring the use of robust and uniform glossary, training people to
recognize hazards from risks, understanding well-made risk assessment, which are
not using risk matrix-based approaches will go in the right direction.
At the end of the day decisions made without a full understanding of
relative uncertainties and consequences, allowed the reservoir level to rise above
the emergency spillway weir for the first time in the project’s history, leading
to severe and rapid erosion downstream of the weir and, ultimately, the evacuation order. Furthermore decisions made under stress, in fear and under poor
information (https://www.riskope.com/2018/01/03/acting-intuitively-planning-360view-upward-downward-tactical-strategic-risks/#_blank) are indeed oftentimes illguided and tend to look to the short term while forgetting the longer term.
Risk assessment should describe the multi-hazard risk landscape, and deliver
understanding of uncertainties and multi-dimensional consequences.
Following the unexpected chute slab failure and erosion, and subsequent closure of the service spillway gates to examine the damage, delicate and difficult risk
trade-offs, involving myriad considerations, were necessary over the next few days in
order to manage the incident. Risk-informed decision making (RIDM) and risk-based
decision making (RBDM) makes it possible specifically to manage those considera-