Large hydroelectric dam spillway AI adversarial injection: how ±8 DN in the rendered spillway chute CCTV camera image suppresses a developing erosion crater — and why FERC Part 12 has no adversarial robustness criterion for the sole-barrier chute erosion classification AI

Oroville Dam 2017: the spillway failure timeline and what the AI classification boundary means

Understanding why the Oroville Dam spillway failure is the structural anchor for large hydroelectric dam AI adversarial injection requires understanding the failure timeline in detail — not as an abstract accident narrative, but as a sequence of classification decisions at defined monitoring boundaries that determined whether the developing erosion was escalated or not.

The main spillway at Oroville Dam is a reinforced concrete chute 915 m long and 54 m wide, built in 1968 with a design discharge capacity of approximately 9,800 m³/s. The chute floor consists of reinforced concrete slabs approximately 0.9 m thick, anchored to the underlying granodiorite rock with drain holes and anchor bolts to limit hydrodynamic uplift. The spillway had never been operated at full capacity; its maximum historical discharge prior to 2017 was approximately 4,640 m³/s in 1997.

In late January and early February 2017, above-average precipitation in the Feather River watershed raised Lake Oroville rapidly, and DWR began discharging through the main spillway to manage reservoir level. On 7 February, the spillway was operating at approximately 1,280 m³/s — a moderate, well-below-capacity discharge. At 09:00 on 7 February, a helicopter patrol of the active spillway observed what operators initially described as a hole developing in the chute surface on the left side, approximately 300 m below the spillway crest gates. Spillway discharge was reduced to approximately 600 m³/s to allow inspection. Inspection revealed a hole approximately 15 m wide and several metres deep in the chute floor — a location where the concrete slab had been lifted by hydrodynamic uplift and shattered by the flow.

The critical classification decision was made at this point. Operators and engineers reviewed the hole and classified it as significant but not requiring a full spillway shutdown. Discharge was resumed, initially at a lower rate but increasing over subsequent days as the reservoir continued rising. The exposed foundation rock — granodiorite that is significantly less erosion-resistant than the armoured concrete surface it replaced — eroded rapidly under the high-velocity flow. Observers in helicopters and on inspection platforms documented the growing crater over the following days, but each observation was classified in a category below the threshold that would have required emergency spillway flow reduction or shutdown.

By the afternoon of 11 February, the crater had developed to approximately 45 m deep — documented in aerial photographs that show a gaping void that had consumed the equivalent of a 15-storey building excavation below the spillway floor level — and the erosion was propagating upstream toward the area immediately below the spillway crest gate structure. The Oroville Dam Incident Investigation Panel (OIDIP) Final Report of January 2018 characterised this progression as an outcome of the absence of a defined “significant erosion” classification trigger: each incremental observation — crater growing from 15 m to 20 m to 30 m to 45 m deep — was compared to the immediately preceding observation and classified as worsening-but-not-yet-emergency, rather than being evaluated against an absolute criterion for emergency flow reduction.

An AI chute erosion classification system operating from rendered CCTV camera images during this sequence faces exactly this classification boundary problem. The AI is trained on a corpus of chute images that is overwhelmingly composed of intact chute surfaces in normal operation. Early-stage erosion appearances — surface pitting, joint openings, incipient slab displacement, surface roughening — are under-represented in any realistic training corpus. The training-distribution boundary between ‘minor surface roughness’ and ‘significant erosion’ is the precise boundary at which adversarial injection is most effective: a ±8 DN pixel shift that normalises the texture of a developing erosion feature toward the dominant intact-concrete texture in the training set exploits the sparsest region of the training distribution. The adversarial injection threat model does not require a sophisticated attacker — it requires only that the rendered chute CCTV image, at the pixel level, shift the appearance of the developing damage toward the closest misclassification boundary, which is the intact-surface cluster that the AI was trained primarily on.

How large hydroelectric dam spillway AI works — and where the adversarial injection surface lives

Large hydroelectric dams use integrated SCADA (Supervisory Control and Data Acquisition) and dam safety monitoring systems from vendors including Voith Hydro (spillway gate control AI integrated with the turbine-generator management system), GE Vernova (hydroelectric plant management AI including spillway scheduling and reservoir routing), ABB (hydroelectric SCADA AI with safety monitoring integration), and ANDRITZ Hydro (spillway gate automation and safety monitoring AI). These systems process real-time data from multiple sensor streams and render the measurements into visual displays — time-series trend charts, geographic maps, camera feeds, and status indicator panels — that operators monitor and that AI classification systems analyse to generate automated advisories, alerts, and gate control commands.

The spillway monitoring AI pipeline at a high-hazard hydroelectric dam processes four primary rendered-image input streams: (1) spillway chute CCTV camera frames — video images of the chute floor and sidewalls captured by cameras mounted on the gate piers and chute sidewalls, providing real-time visual monitoring of the concrete surface condition during discharge; (2) reservoir water level trend displays — time-series charts showing the instantaneous reservoir level, the rate-of-rise over 1-hour, 3-hour, and 6-hour windows, and the EAP action levels relative to the current reservoir elevation; (3) spillway radial gate position camera images — visual confirmation images from cameras mounted at each gate pier confirming the gate aperture against the gate position encoder reading; and (4) downstream tailwater level displays — stage-discharge relationship charts showing whether the current tailwater level in the downstream river channel is above or below the sequent depth required for stilling basin hydraulic performance.

The adversarial injection surface is the boundary between each rendered display image and the AI classifier that processes it — the same structural pattern present in every large hydroelectric dam spillway gate control AI monitoring context: accurate physical sensors measure the safety-critical parameter (chute camera video, reservoir level transducer, gate position encoder, tailwater level sensor); the measurement is rendered into a 2D visualisation for display and AI classification; the AI classifier provides the automated safety advisory and control trigger function; and the AI has never been evaluated for adversarial robustness at its rendered-image ingestion boundary.

Four adversarial injection surfaces in large hydroelectric dam spillway AI

1. Spillway chute concrete erosion CCTV camera AI (Axis Communications spillway AI, Bosch Security chute CCTV AI, Hanwha Vision spillway erosion AI — concrete surface condition classification AI)

The spillway chute concrete floor erodes through three mechanisms, each visible in CCTV camera images before the damage becomes catastrophic: hydrodynamic uplift (pressure fluctuations beneath the concrete slabs lift and shatter the slab at joint openings and surface irregularities), cavitation (flow velocities above 12–15 m/s over surface projections or joint offsets generate vapour cavities whose implosion pits and ablates the concrete surface at rates of 0.3–1.0 m per hour of high-flow operation), and abrasion (sediment-laden flood flow abrades the concrete surface, reducing slab thickness and exposing aggregate and rebar). All three mechanisms leave observable precursors in CCTV camera images: surface pitting and honeycombing from cavitation, joint openings and surface disruption from uplift precursors, concrete discolouration and aggregate exposure from abrasion.

AI classification of rendered chute CCTV camera frames assigns each frame to one of four condition categories: intact (surface within normal parameters — no action), minor surface roughness (monitoring frequency increased — no flow restriction), significant erosion (flow reduction and inspection required — spillway discharge restricted), and critical erosion (emergency flow reduction and possible spillway shutdown). The critical classification boundary is the transition from minor to significant: at significant erosion, the flow restriction intervention prevents the developing damage from accelerating, because reduced flow velocity reduces both the cavitation erosion rate (cavitation rate scales with the fifth to seventh power of flow velocity) and the hydrodynamic uplift pressure fluctuation amplitude.

An adversarial perturbation on a rendered chute CCTV camera frame that suppresses a developing erosion feature — applying a ±8 DN texture normalisation to the pixel region encoding a developing cavity or slab displacement, rendering the damaged surface texture as matching the dominant intact-concrete texture in the AI training corpus — causes the chute erosion AI to classify an actively eroding chute section as having minor surface roughness, suppressing the flow reduction that would arrest the erosion development. The Oroville Dam 2017 sequence — initial 15-m hole classified as significant-but-not-emergency, flow resumed, crater developed to 45 m depth, emergency spillway activated, 188,000 evacuated — is the documented consequence of exactly this misclassification, performed by human operators reviewing camera feeds rather than by an adversarially manipulated AI. The adversarial injection attack automates the misclassification with precision at the pixel level, exploiting the same training-distribution boundary that distinguishes intact concrete texture from early-stage erosion appearance.

2. Reservoir water level rate-of-rise display AI (KISTERS WISKI reservoir AI, Siemens SICAM reservoir level AI, Yokogawa FAST/TOOLS reservoir SCADA AI — EAP action-level trigger AI)

The Emergency Action Plan (EAP) for a FERC-licensed high-hazard dam specifies three action levels for the reservoir water surface elevation: Watch (typically 2–3 m below dam crest — increased monitoring, operator notification), Warning (1.0–1.5 m below crest — downstream emergency notification, public warning initiation), and Emergency (approaching or at the crest — immediate mandatory downstream evacuation). At a dam like Oroville with 188,000 downstream residents, the required time from Warning-level trigger to evacuation completion is approximately 4–6 hours — the minimum time for the regional emergency broadcast, law enforcement door-to-door notification, and population movement out of the flood inundation zone.

During a PMF (Probable Maximum Flood) event — the FEMA P-94 required design event for high-hazard dams — with a net inflow above spillway capacity (total watershed inflow minus turbine and spillway discharge) of 5,000–10,000 m³/s, the reservoir at a large dam rises at 0.1–0.5 m per hour, providing 4–15 hours of decision time from the Watch action level to the dam crest. AI classification of reservoir level rate-of-rise trend displays determines when the Warning-level trigger is issued: the AI classifies the 3-hour and 6-hour rate-of-rise from the rendered trend chart, cross-references the projected time-to-crest against the evacuation lead time requirement, and issues the Warning-level trigger at the appropriate forecast level.

An adversarial perturbation on a rendered reservoir level trend display that suppresses the rate-of-rise — applying a ±10 DN shift to the pixel region encoding the trend line slope, reducing the apparent rate-of-rise from a PMF profile to a routine seasonal profile — causes the reservoir AI to project a longer time-to-crest than the actual trajectory and delay the Warning-level trigger. If the Warning trigger is delayed by 3 hours — from 5 m below crest to 2 m below crest rather than the EAP-specified 3 m trigger — the evacuation lead time is compressed from 6 hours to 3 hours, below the minimum required for 188,000-person evacuation. The consequence of an adversarially delayed Warning trigger at a high-hazard dam is not a missed evacuation in a hypothetical scenario: it is the 188,000-person population that the Oroville 2017 event demonstrated is the real downstream consequence envelope at this specific dam, occurring even without dam failure.

3. Spillway radial gate position camera AI (Cognex InSight gate position AI, Keyence CV-X gate camera AI, Banner Engineering gate position AI — gate aperture confirmation AI)

Large hydroelectric dam spillways use radial (Tainter) gates — curved steel plate gates mounted on radial arms that rotate about a horizontal trunnion pin at the gate pier, operated by hydraulic cylinders or wire rope hoists — to control the flow over the spillway weir. A large spillway may have 5–20 Tainter gates, each 10–20 m wide and 8–18 m tall. Gate position confirmation cameras at each gate pier provide visual confirmation that each gate has opened to its commanded aperture — detecting hydraulic actuator failures, gate jamming by debris, or mechanical binding at the gate sill that the position encoder alone cannot distinguish from a gate that has opened correctly.

AI classification of rendered gate position camera images classifies each gate as closed, partially open, fully open, or malfunctioning — comparing the apparent gate-to-sill gap in the camera image to the position encoder value. An adversarial perturbation that suppresses the visual indication of a gate malfunction — applying a ±8 DN darkening to the pixel region encoding the reduced-aperture water discharge between the gate and the sill, making a stuck gate appear open — causes the gate position AI to overestimate the available spillway discharge capacity. During a PMF event, a single gate stuck at 30% of commanded aperture reduces total spillway capacity by approximately 5% (at a 20-gate spillway); three malfunctioning gates adversarially classified as fully open reduces capacity by 15%, potentially increasing the peak reservoir level during a PMF by 0.5–1.5 m, reducing the freeboard margin against overtopping for an earthen embankment dam.

4. Downstream tailwater energy dissipator display AI (Ott HydroMet tailwater AI, YSI environmental monitoring AI, Hach WIMS tailwater display AI — stilling basin performance monitoring AI)

The energy dissipator at the downstream end of the spillway chute — typically a hydraulic jump stilling basin (a concrete-lined pool in which supercritical flow from the chute decelerates through a hydraulic jump to subcritical flow) or a flip bucket (deflecting the flow as a free jet into a downstream plunge pool) — must maintain adequate tailwater to function correctly. For a stilling basin, the tailwater level must remain above the sequent depth of the hydraulic jump; if the tailwater drops below this threshold, the hydraulic jump “sweeps out” of the basin and the undissipated supercritical flow erodes the downstream river bed and banks, undermining the stilling basin foundation.

An adversarial perturbation on a rendered tailwater level display that suppresses a low-tailwater condition — shifting the apparent tailwater level above the sequent depth threshold when the actual level is below it — causes the energy dissipator monitoring AI to classify a stilling basin approaching sweep-out as operating correctly. Stilling basin sweep-out has caused significant damage at Tarbela Dam (Pakistan, 1974: $50 M repair to stilling basins during the first operational flood season) and multiple Bureau of Reclamation dams. The consequence of undetected sweep-out is progressive erosion of the stilling basin floor and side walls, ultimately threatening the structural integrity of the spillway’s energy dissipation system at the moment — the PMF event — when it is most critically needed.

FERC Part 12, FEMA P-94, and the Oroville OIDIP findings: the qualification framework and its AI boundary

FERC Part 12 (18 CFR Part 12, Safety of Water Power Projects and Project Works) is administered by FERC’s Office of Dam Safety and Inspections. It requires annual owner inspections and five-yearly independent consultant periodic inspections (ICPIs) of all licensed hydroelectric dams. The FERC Engineering Guidelines for the Evaluation of Hydropower Projects (updated 2018) provide the technical basis for these inspections, including specific guidance on spillway capacity evaluation, concrete condition assessment, and instrumentation requirements. FEMA P-94 (Selecting and Accommodating Inflow Design Floods for Dams, 2013) establishes the IDF selection methodology referenced by FERC for licensed dams: high-hazard-potential dams (downstream population at risk from failure) must be evaluated against the PMF.

These requirements are extensive and technically rigorous in their scope. What they do not address is the AI layer. Part 12 requires that licensed dams be equipped with adequate instrumentation to detect adverse conditions — it does not specify that AI systems classifying rendered images from that instrumentation be evaluated for adversarial robustness. The FERC Engineering Guidelines address concrete condition assessment methodology, spillway inspection procedures, and monitoring system calibration requirements — but not AI classification of rendered monitoring images.

The OIDIP Final Report (January 2018) is particularly relevant because it identified monitoring classification failure — not instrument failure — as a root cause of the 2017 incident. The Panel found that inspection records over the years prior to 2017 documented surface erosion, joint damage, and surface staining in the Oroville main spillway chute that were classified as consistent with normal wear requiring routine maintenance, rather than triggering the detailed engineering assessment and remedial action the conditions warranted. The Panel’s recommendation 4 specifically addressed spillway inspection methodology: “DWR should establish spillway condition rating systems and annual and periodic inspection criteria to systematically evaluate the condition of its high-hazard dam spillways and identify deterioration that may increase the potential for failure.” An AI system that reproduces the same classification tendency — systematically placing borderline chute condition observations in the lower category — produces the same outcome the Panel identified. An adversarial injection attack that deliberately drives the AI into the lower category at a specific damage location during a specific high-flow event is an exploit of exactly the vulnerability the Panel found.

The structural parallel extends to tailings dam VWP piezometric level trend display AI adversarial injection, where the GISTM 2020 Global Industry Standard similarly requires continuous monitoring but specifies no adversarial robustness criterion for the AI classifying rendered piezometric displays — and the Brumadinho B1 flow slide (270 killed, 12 Mm³, 4 minutes) demonstrates the consequence of misclassification at the critical monitoring boundary. The pattern across both large dam contexts — hydroelectric spillway monitoring AI and tailings dam piezometric AI — is that the physical sensor is required, the monitoring obligation is specified, but the AI classification layer at the rendered-image ingestion boundary operates entirely outside the regulatory specification scope. See also: nuclear power plant digital I&C AI under NRC GDC 13 and IEEE Std 603-2018, where the same structural gap — physical instrument qualified, AI classifier of rendered instrument output unqualified — exists in the highest-consequence infrastructure domain in the portfolio.

The physics of spillway chute concrete erosion under high-flow discharge: why early AI classification is the only practical intervention window

The progressive nature of spillway chute concrete erosion under high-flow discharge creates a narrow early-intervention window that is widened significantly by early detection and narrowed catastrophically by delayed classification. Understanding the physics establishes why threshold-30 adversarial scan gating on chute CCTV AI is the correct placement.

Cavitation erosion at flow velocities above 12 m/s scales with approximately the fifth to seventh power of flow velocity — a doubling of flow velocity at a cavitation-prone surface irregularity increases the erosion rate by a factor of 32 to 128. This extreme velocity sensitivity means that reducing flow velocity from 35 m/s (typical of Oroville main spillway at 1,280 m³/s) to 20 m/s (achievable with 60% flow reduction to approximately 750 m³/s) reduces the cavitation erosion rate at a damaged surface by a factor of 5 to 15. A 10 mm cavitation pit that deepens at 50 mm/hour at 35 m/s deepens at 3–10 mm/hour at 20 m/s — and at these reduced rates, the concrete has approximately 50–100 hours of service life before the damage develops to structural failure depth, providing adequate time for an inspection team to access the site and assess remediation options.

Hydrodynamic uplift failures — the failure mode at Oroville — are more sensitive to the presence of joint openings and drainage blockages than to flow velocity directly, but the pressure fluctuation amplitude that drives uplift is proportional to the dynamic pressure (½ρV²), which scales with the square of flow velocity. A 60% flow reduction reduces the dynamic pressure by 84% and the uplift pressure fluctuation amplitude by 84%, substantially reducing the probability of an uplift failure event at a joint with degraded drainage.

The implication for AI classification timing is that the useful intervention is only available when the damage is at the early stage — surface pitting, joint openings, incipient slab displacement — where flow reduction is both feasible (the spillway can continue to pass a reduced flow while the damage is being assessed) and effective (the reduced flow velocity extends the safe service life from hours to days or weeks). Once the damage reaches the critical erosion stage — where a concrete slab has already been displaced and the foundation rock is exposed — flow reduction slows the erosion rate but cannot reverse the structural loss. The early-classification window is therefore the only practical intervention window, and AI adversarial injection at the chute CCTV camera boundary — forcing the AI to classify early-stage damage as minor surface roughness — eliminates this window entirely.

Glyphward threshold 30 for large hydroelectric dam spillway AI

Glyphward’s adversarial detection API operates as a pre-classification gate at each rendered-image ingestion boundary in the dam spillway monitoring AI pipeline: before the chute erosion CCTV AI processes each camera frame, before the reservoir level AI processes the rate-of-rise trend display, before the gate position AI processes each gate confirmation image, and before the tailwater display AI processes the downstream level chart. Each rendered image receives a risk score (0–100) in 8–15 ms. At or above threshold 30, Glyphward gates the AI classification and generates an alert that triggers manual review of the physical sensor output — the raw CCTV camera feed, the direct reservoir level transducer reading, or the physical gate position encoder value — none of which can be adversarially manipulated at the pixel level.

Threshold 30 for large hydroelectric dam spillway AI contexts reflects three consequence factors. First, the dam failure downstream flood consequence. A PMF event combined with adversarially suppressed gate position AI (overestimating available discharge capacity), adversarially delayed reservoir level rate-of-rise AI (compressing evacuation lead time), and adversarially suppressed chute erosion AI (allowing structural damage to the spillway during the PMF discharge event) constitutes a combined attack on three independent monitoring layers that each provide a partial safety margin against dam overtopping or spillway structural failure. The downstream consequence at a FERC high-hazard dam — 188,000-person mandatory evacuation at Oroville, with dam failure potential adding a catastrophic flood wave consequence — is the most severe natural-disaster consequence in the dam safety incident record for a single US dam. Second, the 6-hour evacuation window compression. The 4–6-hour evacuation requirement for 188,000 downstream residents provides no safety margin at the compressed 1–2-hour decision window that a 3-hour Warning-level delay creates. Third, the Oroville 2017 precedent demonstrating that the spillway chute erosion classification failure mode is operational, not theoretical: a real high-hazard dam, at one-third of design flow capacity, developed a 45-m erosion crater because classification decisions at the monitoring boundary did not trigger the intervention that the physical evidence, in retrospect, warranted.

The false positive cost at threshold 30 is a manual review of the physical sensor output — the same review that the Oroville Dam OIDIP recommended should be standard practice at any point where the AI (or human observer) classifies a chute condition observation at or near the minor/significant boundary. The false negative cost is the suppression of the classification that triggers flow reduction at the early-stage intervention window — allowing the erosion to progress to the scale documented at Oroville in 2017 and beyond. The proportionality is not close.

Free tier — 10 scans/day, no card required. Submit a rendered spillway chute CCTV camera frame from your dam monitoring system to the Glyphward scanner to generate a baseline adversarial risk score for your hydroelectric dam spillway AI classification inputs.