← Back to blog

The Physics of a Concrete Gravity Dam

A gravity dam is a moment balance you can check on one sheet of paper. It passes every visible check at 4x safety. Then the one force you cannot see from the crest, the road, or the inspection boat cancels its weight from underneath.

Published June 2026 · 12 min read

On the morning of March 12, 1928, the keeper of the St. Francis Dam, Tony Harnischfeger, found water leaking from the dam's western abutment and did not like the look of it. The runoff was muddy, and muddy seepage can mean the water is eating the foundation on its way through. He called Los Angeles. William Mulholland, the self-taught chief engineer whose aqueduct had built modern LA, drove out, inspected the leak, judged the mud was coming from a nearby construction road rather than from inside the foundation, pronounced the dam safe, and went home.

At two and a half minutes before midnight, the St. Francis Dam broke apart. Twelve billion gallons went down San Francisquito Canyon in a wave that began a hundred and forty feet high, and at least 431 people died, many of them asleep in towns that no longer had names by sunrise. Harnischfeger and his six-year-old son were the first. The count kept climbing into the 1950s as the riverbed returned remains.

Here is the detail to hold onto. The investigating commission did not conclude that the water had pushed the dam over. Its finding was that water had infiltrated the foundation, lifting it upwards.

Lifting. The deadliest force in the failure of a structure built to resist a horizontal shove turned out to point straight up. To see why that verdict makes engineers go quiet, look at the ledger a gravity dam keeps: one entry for the force that tries to move it, one entry for the only thing it has to answer with. The arithmetic is high-school physics. The story is in which entries you can see.

The push

Take a dam we can put real numbers on: Shasta Dam, on the Sacramento River in Northern California, finished in 1945. It stands 183 meters tall, runs 1,055 meters along its crest, and holds back Shasta Lake, 5.6 cubic kilometers of water at capacity. That is about five and a half billion metric tons of lake leaning on a wall.

Water pressure grows linearly with depth: density times gravity times depth. At the base of Shasta, under 183 meters of reservoir, that is about 1.8 megapascals, roughly 18 atmospheres, or 260 psi. A human at that depth is in saturation-diving territory.

Because pressure rises linearly from zero at the surface to maximum at the base, the load on the upstream face is a triangle, and the total horizontal force per meter of dam width is one half times density times gravity times the height squared: for Shasta, about 164 meganewtons per meter of crest. Across the full 1,055 meters, the reservoir pushes with roughly 173 billion newtons, the weight of 17.7 million metric tons, or around 120,000 blue whales pressing sideways in unison.

One more detail, and it matters later: that triangular load acts not at mid-height but a third of the way up from the base, 61 meters, because the triangle concentrates force toward the bottom. The water is not just pushing. It is prying, low, with a lever.

The answer

What does the dam answer with? Nothing clever. A gravity dam has exactly one move: it is too heavy to move.

Shasta's cross-section is a near-triangle, ten meters wide at the crest, about 168 meters at the base. Concrete runs about 2,400 kilograms per cubic meter, and the section works out to roughly 362 meganewtons of weight per meter of crest, acting down through the triangle's centroid.

Now run the two checks every gravity dam must pass.

First, overturning. The water torques the dam about its downstream toe, trying to tip it like a book pushed at the spine. The overturning moment is the 164 MN push times its 61-meter lever: about 10,000 meganewton-meters per meter of dam. The restoring moment is the 362 MN weight times its 112-meter lever: about 40,500. Divide, and the factor of safety against tipping is 4.0. The minimum standard is 1.5. The reservoir would need four times its actual force to begin rotating the dam, and long before that the water would simply pour over the top.

Second, sliding. Can 173 billion newtons shove the dam downstream along its foundation? Friction resists: concrete on prepared rock has a friction coefficient around 0.70, and 0.70 times 362 MN gives 253 MN of grip per meter against 164 MN of push. Factor of safety: 1.54. Tighter. Close enough to the 1.5 minimum that engineers usually cut a shear key, a deep notch excavated into bedrock and filled with concrete so the dam physically interlocks with the planet, lifting the sliding margin to 2 or 3.

So the ledger reads: safe against tipping four times over, safe against sliding with a key in the rock besides. A gravity dam is gloriously dumb in the best sense. No clever load path to fail, no slender member to buckle, just a moment balance you can check on one sheet of paper.

There is also a rule hiding under both checks, the most elegant idea in the design. Concrete is magnificent in compression and miserable in tension; it crushes at stresses ten times higher than the stress at which it tears. So a gravity dam is designed never to feel tension anywhere, not one fiber, not for one hour of its life. The guarantee is a geometric condition nineteenth-century masonry engineers already knew: the resultant of all forces, weight and water combined, must pass through the middle third of the base. Inside that central band, the whole base stays in compression. Let the resultant stray outside it, and the upstream edge of the base, the heel, goes into tension.

And tension is not a state a dam visits. It is a door. Tension at the heel opens a crack; the reservoir is standing there at full pressure, so water enters; now pressure inside the crack pushes up, shifting the resultant further downstream, deepening the tension, extending the crack, admitting more water. Inside the middle third, nothing happens, forever. Outside it, a feedback loop starts. The serene geometry of the triangle exists to make sure a particular conversation between water and concrete never begins.

The entry you cannot see

Which brings us to the force that actually kills dams, the one in the commission's verdict.

Everything above treats the reservoir as a thing that pushes sideways against a wall on dry rock. But foundation rock is fractured, jointed, porous, and the reservoir has all the time in the world. Water works into the rock under the dam and, once there, does what water under pressure does in every direction it can: it pushes. The component that matters pushes up, on the underside of the dam. Engineers call it uplift.

Run the number for Shasta with no countermeasures, full reservoir head at the heel tapering to zero at the toe: roughly 151 meganewtons per meter, upward. Set that against the ledger. The dam's entire answer to the reservoir was its 362 MN of weight. Uplift silently deletes 151 of it. Effective weight: 211.

Redo the sliding check with the weight the dam actually has: 0.70 times 211 gives 148 MN of grip against 164 MN of push. Factor of safety: 0.90.

Below one. The dam slides. The same structure that passed its visible checks at 4.0 and 1.54 fails outright the moment you book the one force you cannot see from the crest, the road, or the inspection boat. No flood arrived. The push never grew. The resisting side of the ledger was cancelled from underneath.

Shasta sliding check	Factor of safety
Overturning (visible)	4.0
Sliding, no uplift booked (visible)	1.54
Sliding, with full uplift (the entry you can't see)	0.90 (fails)
Sliding, with working drains (~40%)	1.29
Sliding, drains + shear key	2 to 3

That asymmetry is the transferable physics here. Every safety factor is a fraction: what resists, over what pushes. The watching instinct goes to the push, the flood gauge, the load. The lethal failures live on the other side of the fraction, in the silent shrinkage of what resists. The dam was not overwhelmed. It was hollowed.

The most important room in the dam

The fix is one of the great objects in civil engineering precisely because of what it admits. You cannot stop water from entering fractured rock; the reservoir has infinite patience and 18 atmospheres of motive. So engineers stopped pretending. Inside every modern gravity dam, at foundation level, runs a corridor called the drainage gallery. From it, crews drill a curtain of relief holes down into the rock. Seepage on its way to becoming uplift finds the drains first, loses its pressure into them, and is piped harmlessly downstream. Upstream of the drains, grout injected deep into the rock chokes the flow before it starts.

Working drains cut uplift to a third or half of its uncontrolled value. Book 40 percent for Shasta's geometry and the deleted weight shrinks from 151 MN to about 60; effective weight climbs back to 302; the sliding factor recovers to 1.29. Still below the 1.5 standard, which is exactly why the shear key exists too. Drains, grout curtain, key: belt-and-suspenders, for once, is a literal engineering description.

But the gallery is more than a remedy. It is an epistemological device. The engineers took the invisible force and built a room where it becomes visible: you can walk the base of the dam, hear the drains trickle, and read the uplift on gauges. Dam-safety practice treats those readings as vital signs, because a drain that clogs is uplift quietly reclaiming its 151 MN, one blocked hole at a time. The deadliest enemy was the one nobody could see, so they gave it a room, plumbing, and instrumentation, and made someone responsible for looking. That move, not the concrete, is the masterpiece.

What the rock was hiding

Now go back to San Francisquito Canyon with the ledger in hand.

The St. Francis Dam was a concrete gravity dam, the same species as Shasta. Its concrete mostly did not fail. Its foundation did. The commission found the conglomerate rock beneath it of insufficient strength, with water moving through the foundation producing the uplift in the verdict. Decades later the forensic geologist J. David Rogers established something the 1928 engineers had no way to know: the eastern abutment stood on an ancient landslide, a hillside that had already failed once in geologic time and was ready, once saturated, to fail again.

One detail from the construction history reads like a worked example from this essay. Midway through the project, Mulholland raised the dam from 185 to 205 feet to enlarge the reservoir, without widening the base. Recall the scaling: hydrostatic force grows with the square of height, the overturning moment roughly with its cube. The raise added about a fifth more push and a third more overturning moment while the answering weight stayed nearly fixed, spending the very margins uplift would then attack. The coroner's jury blamed an error in engineering judgment in determining the foundation. Mulholland, who had looked at the leak that morning and seen nothing the visible checks could catch, testified that he envied the dead, took responsibility, and was finished; the most celebrated engineer in the American West retired into silence within the year.

Thirty-one years later, in December 1959, the Malpasset Dam above Fréjus in southern France failed and killed 423 people. Malpasset was not a gravity dam but a thin arch, the opposite philosophy, an eggshell that resists by geometry instead of mass. It did not matter. Water pressure built along a hidden fault in the left abutment until uplift dislodged the block the arch leaned on. The two great dam disasters of the twentieth century involved opposite structural ideas and the identical killer: not the wall, the foundation; not the push, the lift.

That is the meta-lesson dam failures keep teaching. Dams almost never fail because concrete crushes; concrete in compression is the most reliable thing humans pour. They fail because the rock beneath, the one component the builders did not make and mostly cannot see, harbors a fault, a landslide, a seam that conducts pressure. A dam is a hypothesis about its foundation. The concrete is just the part of the hypothesis you got to manufacture under controlled conditions.

Still curing

One last force, the strangest in the ledger: the dam attacks itself, from inside, with chemistry. Setting cement is exothermic, and mass concrete is so thick the heat of hydration cannot escape. The interior of a fresh dam heats like a slow furnace; left to cool at nature's pace, the outside would shrink decades before the inside and the structure would crack itself apart. The Bureau of Reclamation calculated that Hoover Dam, poured as a single mass, would have needed about 125 years to cool. The builders' answer, beginning in 1933, was to make the dam a heat exchanger: they poured it as a grid of interlocking blocks threaded with 582 miles of one-inch steel pipe, circulating river water first, then water chilled by a refrigeration plant that could produce a thousand tons of ice a day. The dam was refrigerated into existence. Shasta, with 4.8 million cubic meters of concrete, was built the same way. Even the dam's own birth heat is an invisible force with a plumbing system dedicated to it.

The uplift audit

It is tempting to leave all this as a marvel, and it is one. But the ledger generalizes too cleanly to waste, and anyone who runs systems for a living has already felt it.

Every margin you believe in is a fraction, something resisting over something pushing, and the two sides fail differently. The pushing side announces itself: traffic spikes, queues deepen, load graphs climb, and everyone watches, because watching the push feels like diligence. The resisting side fails silently and from underneath: the failover that expired, the replica that stopped replicating, the backup that restores nothing, the on-call knowledge that left in March, the dependency three layers down doing the actual load-bearing. None of those raise the push by a single newton. They delete weight. A system can hold a 4.0 safety factor on every visible check and stand at 0.90 where nobody is measuring, and from the crest it looks exactly the same.

So borrow the two moves the dam engineers made. First, run the uplift audit: for each margin you claim, write down the fraction, then name what could shrink the top without ever touching the bottom. The honest answers are usually decay and assumption, not attack. Second, the move that separates the professionals: for the force you find, build the drainage gallery. Not a policy, a place: a designed relief path plus an instrument plus a human who reads it, the way dam crews read uplift gauges in a corridor under five and a half billion tons of lake. An invisible force with a room, a drain, and a dial is just another number in the ledger. An invisible force without one is a verdict waiting for its commission.

Mulholland looked at the wall the morning of March 12, and the wall looked fine, because the wall was fine. What failed was everything the wall stood on, where no one had built the room that would have let him see. The visible threat is engineered for. The invisible one is what kills you.