One thing I'm really impressed with is how many redundancies are built in to dams, and how their failures are intended to be gradual and not catastrophic and sudden with a full release of the reservoir contents.
ie, use the water to generate electricity. If that's not enough outflow, use the spillway. If the spillway isn't enough, the emergency spillway will drain more.
There's even another contingency (with more details), described here, that I haven't heard anywhere else:
> The emergency spillway is not auxiliary, and i don’t believe any competent geologist present during it’s construction would have considered its use as anything but a last ditch effort. It was designed as a fail-safe to prevent the loss of the main dam during the event of a half a million cfs inflow to the lake during a 200 to 1000 year event. The ogee weir extending from the main spillway gates was likely built to protect the main spillway gates. The bedrock was excavated deeper below the ogee weir to find more competent bedrock than the concrete wall extending northwards from the ogee weir, which was built to protect the ogee weir. The lack of concrete in the far NW corner of the parking lot where we saw considerable erosion and helicopters lowering bags of rocks into is not lack of foresight, but designed weakness built into a weak structure. The parking lot is built on highly weathered bedrock and is designed to function as a sacrificial plug located as far from the dam itself as possible, similar to the Auburn coffer dam failure of 1986. As headcutting progresses into the parking lot, water at elevation 900 and above is skimmed off. Once headcutting reaches the lake, then downcutting commences, “safely” lowering the lake till competent bedrock is found, maybe a hundred feet down, leaving the vast majority of the lake still in the lake and Oroville dam still standing, no matter the magnitude of the storm.
The normal water exit from the dam is through the power plant. If either spillway is moving too much water, the level of the pool below rises, and the power plant turbines can't run because there's backpressure at their exit. That happened this time, which increased the load on the spillway.
Right now, the lake level has been dropped to 50 feet below the dam top, to provide some safety margin for later storms. The crisis is probably over, and there will be heavy construction this summer.
Having the main spillway continue to erode is pretty clearly a failure state of the dam system.