Dams around the world have often served their intended purposes without interruption for multiple decades, regulating rivers, powering hydroelectric stations, irrigating farmlands, and protecting communities from floods. For many of these structures, the absence of a major incident over the years can lead to an assumption of reliability. Unfortunately, several notable failures illustrate the danger of equating a long, successful (incident-free) operational history with guaranteed future performance.
This article examines this fallacy through three case studies or examples where dams had previously withstood challenges similar to those that would later cause their failure, underscoring the need for updated risk assessments, robust design standards, and rigorous maintenance practices.
Lawn Lake Dam (Completed 1903)
Lawn Lake Dam performed for nearly 80 years, but its longevity masked an outlet-works vulnerability. Although the 1903 plans called for encasing the gate valve in concrete, that was never done, and remote access meant inspections were infrequent (1951, 1975, 1977, 1978). Between 5–6 a.m. on July 15, 1982, the dam breached: roughly 674 acre-feet evacuated in about an hour (peak outflow of ~18,000 cfs), scouring the Roaring River; Cascade Dam then overtopped and failed after ~40 minutes, and the flood reached Estes Park, causing three fatalities and about $31 million in damage. The State Engineer’s investigation concluded the failure was probably initiated by leakage under high pressure at the leaded slip connection between the outlet pipe and gate valve, which triggered internal erosion (piping) and progressive slope collapse; metallurgical evidence indicated the lead caulking may have been placed cold, weakening the joint. Thus, despite having weathered prior runoff seasons, past successful performance did not guarantee future success; latent defects at the outlet works and sparse opportunities to detect them set the stage for failure when conditions aligned.
Oroville Dam (Completed 1968)
Oroville Dam’s February 2017 incident did not require record-setting discharge; the project had safely passed higher flows in earlier years. The failure initiated because long-standing leakage through joints and cracks—present since early operations—pressurized the underdrains and foundation, elevating uplift beneath the slab. The chute system included several vulnerabilities that limited redundancy: herringbone drains intruded into the slab section (leaving only ~7 inches of concrete above the drains), contraction joints without waterstops, a single near-surface reinforcement mat, short rock anchors with limited embedment, and zones of strongly weathered/soil-like foundation left in place. As discharge ramped up to around ~52,500 cfs, distress was first manifested, a slab panel lost support; hydraulic jacking allowed high-velocity water to enter beneath the slab, rapidly eroding the subgrade and enlarging the breach.
Crucially, previous successful performance under equal or larger floods did not guarantee success during this incident. Those earlier events simply had not activated the particular combination of defects, hydraulic boundary conditions, and operating nuances (local joint condition, drain behavior, foundation roughness, and flow ramping) that aligned in 2017. Apparent robustness demonstrated by past floods can mask latent, nonredundant weaknesses until the right trigger sequence arrives.
Spencer Dam (Completed 1927)
Spencer Dam was a run-of-river hydropower facility on the Niobrara with a 3,200-ft embankment tied to a powerhouse/spillway that combined four Tainter-gated bays with five stoplog bays operated by steel needle beams from an exposed walkway. During Winter Storm Ulmer (March 13–14, 2019), dynamic ice breakup upstream sent surging ice and water towards the dam. As operators opened the Tainter gates and began lifting stoplogs, a lifting chain on Gate 3 broke, and many stoplog bays remained immobilized by ice. Darkness, icing, and high winds limited safe access to the walkway, so not all needle beams could be removed to release the stop logs. As the pool rose, ice-laden flow overtopped lower sections of the embankment crest, initiating downstream-slope erosion and headcut development; two breaches formed, one adjacent to the spillway and another near the access road.
The independent panel concluded that, given the dam’s configuration and the evolving ice-run hydraulics, operators could not have averted failure, and that the dam’s breach contributed little additional flood volume compared with the river’s ice-run flooding. Notably, Spencer had a history of severe ice-run impacts (an embankment breach in 1935 and heavy damage in 1960 and 1966) and because records were destroyed in 1966 and personnel turned over, both the owner and regulator had little knowledge of this vulnerability. The 2019 failure underscores that many years of apparently successful performance do not guarantee future success when latent hazards and operational constraints combine under extreme conditions. Further, human impacts, such as the loss of operational and historical knowledge regarding ice flows at the structure, may have left the dam more vulnerable than it otherwise would have been.
Human Factors
Long-run success can blunt vigilance by nudging organizations toward ignorance (risks are not fully understood), complacency (risks are known but tolerated), and overconfidence (belief that existing controls are sufficient), especially in complex sociotechnical systems like dams where physical and organizational factors interact over long periods of time. Safety culture should be proactively maintained rather than rely solely on historical performance, which may overlook warning signs of possible failures or deficiencies. To develop a proactive safety culture, a dam owner must ensure their dam safety program receives leadership priority, financial and other resources, and follows industry best practices for inspection, and maintenance.
Using Oroville as an example, the Independent Forensic Team found a long-term systemic shortfall in recognizing/addressing spillway design/construction weaknesses and deteriorated conditions. Years of apparently successful high-flow operations contributed to normalization of abnormal drain flows and other warning signs, consistent with an attitude of complacency and overconfidence, until 2017 conditions aligned and exposed the latent fragilities. Similarly, at Spencer Dam, prior ice seasons and institutional churn eroded institutional memory: records lost in 1966, and staff turnover left both owner and regulator with limited awareness of severe ice-run vulnerability. Leading to an inadvertent situation of ignorance (insufficient awareness) of the dam’s true exposure to ice runs.
Collectively, these cases contribute to the dam safety industry's comprehension of human factors, encompassing culture, cognition, and organizational memory, and highlight why historical performance may not reliably predict future safety outcomes unless warning signs prompt ongoing, deliberate risk management efforts.
Key Takeaways
- Past success does not equate to future safety. Long incident-free operation can mask latent, non-redundant weaknesses that only appear under a particular trigger sequence .
- Periodically update risk and design assumptions. Reassess hydrology and site-specific hazards (including ice dynamics), strengthen spillway/defensive measures, and design for current loads and best practices rather than relying on historical performance.
- Conduct targeted inspection, monitoring, and maintenance. Focus on known weak points and potential failure modes, and verify access and functionality under adverse conditions (e.g., ice, darkness, high winds).
- Human factors matter. Avoid complacency, normalization of abnormal conditions, and loss of institutional memory; staff and fund a dam safety program, preserve records (damfailures.org), and encourage a questioning, learning culture that acts on warning signs.
- Plan for operational constraints and add redundancy. Anticipate equipment failures and limited access; build in redundant release capacity and practicable emergency procedures to maintain control when conditions deteriorate.
- Rotate inspectors or engineering teams to get fresh eyes on dams and their components to identify long standing vulnerabilities that may be considered normal by people who frequent the dam.
References
(3) Baker, M. E. (2021). Spencer Dam (Nebraska, 2019). Association of State Dam Safety Officials.
(5) Irfan, A. A. (2019). Oroville Dam (California, 2017). Association of State Dam Safety Officials.
(6) Ifran, A. A. (2019). Dam Incidents and Failures Can Fundamentally Be Attributed to Human Factors. Association of State Dam Safety Officials.
This lesson learned was peer-reviewed by Mark E. Baker, P.E. (DamCrest Consulting).
Lawn Lake Dam (Colorado, 1982)
Oroville Dam (California, 2017)
Spencer Dam (Nebraska, 2019)
Edenville Dam (Michigan, 2020)
Lake Delhi Dam (Iowa, 2010)
Ka Loko Dam (Hawaii, 2006)
Human Factors in Dam Failures
Pocket Safety Guide for Dams and Impoundments
