Exercise #036 · Catastrophic Infrastructure Failure

Taum Sauk Upper Reservoir Failure

"The whole mountain came down at once."

📅 December 14, 2005 📍 Reynolds County, Missouri 🏛 Reynolds County Sheriff's Office · Missouri State Highway Patrol ~12 minutes · Entire reservoir emptied
1.3B
Gallons Released
12
Minutes to Empty
5:12 AM
Time of Breach
20 ft
Initial Wave Crest
5
Injured (Toops Family)
0
Fatalities
Dam Failure Flash Flood Rural PSAP EAP Failure Multi-Agency Infrastructure Missouri Pre-Dawn
📋
What Happened

At 5:12 on a December morning in 2005, the upper reservoir of AmerenUE's Taum Sauk pumped-storage hydroelectric plant on top of Proffit Mountain in Reynolds County, Missouri, failed catastrophically. The reservoir had been overfilled during an automated overnight pumping cycle. Sensors meant to detect the water level had become detached from their housing months earlier — a known problem that operators continued to work around. That morning, the pump ran too long. Water overtopped the parapet wall, scoured the embankment, and the entire northwest face of the reservoir wall collapsed in minutes.

The result: 1.3 billion gallons of water — enough to fill roughly 2,000 Olympic swimming pools — cascaded down Proffit Mountain in 12 minutes. The wall of water hit Johnson's Shut-Ins State Park below with a crest measured at 20 feet. It obliterated 281 acres of the park. It swept vehicles off Highway N into adjacent fields. And it destroyed the home of state park superintendent Jerry Toops, washing him, his wife Lisa, and their three young children — including a 7-month-old — across the road and into a debris field in predawn darkness and December cold.

No one was killed. That outcome was not by design — it was December, and the park campground was empty. If it had been July, the death toll would likely have been catastrophic.

"I heard a roar — like a group of F-14s combined with a fleet of trains. And then the water hit me like a head-on collision."

— Jerry Toops, Park Superintendent, Johnson's Shut-Ins State Park

The Reynolds County Sheriff's Office and PSAP serve a county of roughly 6,000 people across 818 square miles of Ozark hill country. There is no municipal 911 center — emergency calls go to the sheriff's dispatch, which handles everything from traffic to search-and-rescue to dam failures it wasn't told were possible. That morning, dispatchers woke up to a catastrophic flooding event the same way the public did: calls started coming in, and nobody in the warning chain had called them first.

AmerenUE's Emergency Action Plan (EAP) for the Taum Sauk facility — required by FERC — had notification procedures. The question this exercise explores is what happened between the failure of that private-sector EAP and the moment Reynolds County dispatchers picked up their first 911 call.

Dispatch Timeline
~04:00 CST DISPATCH
Lisa Toops falls asleep on a couch while feeding their infant. Jerry Toops is asleep. All five family members are in the park superintendent's residence inside Johnson's Shut-Ins State Park, directly in the flood path approximately 1.75 miles below the reservoir.
~04:39 CST CRITICAL
Pump Unit #2 shuts down automatically based on a faulty sensor reading of elevation 1,591.6 ft. The reservoir is already above that level — the sensor, with its detached housing, is reading false. Pump Unit #1 continues running.
05:08–05:12 CST CRITICAL
Water begins overtopping the reservoir parapet wall at the northwest face. Sensors fail to trigger automatic shutdown. The overflow scours the downstream side of the embankment wall. The system operates for approximately 6–7 minutes while water pours over the rim before Unit #1 is manually shut down from the Bagnell Dam control center at ~05:15.
05:12–05:15 CST CRITICAL
The northwest section of the rockfill dike collapses. A 656-foot-wide breach opens. The entire reservoir empties in approximately 12 minutes. Peak discharge: ~273,000 cubic feet per second — roughly equivalent to the Mississippi River's flow past St. Louis at flood stage. A 20-foot crest of water accelerates down the mountain toward Johnson's Shut-Ins State Park.
05:12–?? CST EAP GAP
AmerenUE's Emergency Action Plan required notification to downstream agencies in the event of a failure. The EAP's actual notification of local emergency services and the Reynolds County PSAP is not publicly documented with precision. Evidence suggests the warning chain ran toward the National Weather Service before reaching local 911 dispatch.
Shortly after 05:15 CST COMMS
AmerenUE operators and/or Bagnell Dam control center personnel contact the National Weather Service St. Louis forecast office to report the dam failure. NWS begins processing the notification and initiating flash flood warnings for downstream areas. NOAA Weather Radio All Hazards broadcasts are a primary public notification mechanism.
Pre-dawn, shortly after breach DISPATCH
The Toops family home is destroyed. Jerry, Lisa, and their three children — including 7-month-old Iker — are swept into the darkness in December floodwaters. They survive by clinging to trees and debris. Someone eventually reaches 911. Reynolds County dispatchers begin receiving reports of flooding, a destroyed house, and missing persons in Johnson's Shut-Ins State Park — with no pre-notification that a dam had just failed upstream.
05:15+ CST ESCALATION
Flash flood warnings are issued by NWS for Reynolds County and downstream areas including Lesterville along the Black River. Voluntary evacuation orders are issued for downstream communities. Missouri State Highway Patrol, Reynolds County Sheriff's Office, and rescue teams begin converging on Johnson's Shut-Ins. All five Toops family members are located alive, suffering from hypothermia and injuries.
06:00–08:00 CST COMMS
The lower Taum Sauk reservoir — which catches the Black River — absorbs the bulk of the released water and holds. Downstream towns including Lesterville and Centerville are spared significant flooding. The excess flow eventually reaches Clearwater Lake, a Corps of Engineers flood control reservoir downstream. Damage is largely confined to Johnson's Shut-Ins State Park. Reynolds County comm center coordinates rescue operations and mutual aid.
⚠ The EAP Question

AmerenUE was required by FERC to maintain an Emergency Action Plan for Taum Sauk. That plan included notification procedures for a dam failure. The gap this exercise focuses on: at what point did the Reynolds County PSAP receive actionable notification, and did dispatchers know what they were working with when the first calls came in? Evidence suggests the answer is no — dispatchers initially responded to a flooding event and a missing family, not a dam failure, until information developed on scene.

💬
Discussion Questions

No right or wrong answers. These are designed for shift briefings, training sessions, or individual reflection. Click each question to expand.

1. Your PSAP receives a call reporting a house destroyed by flooding and a family missing inside Johnson's Shut-Ins State Park. You have no prior notification. What do you do with call #1, and how does your response change if the second caller tells you "the whole mountain came down"?

This is a cascading information problem. Call #1 describes a structural collapse and missing persons — it warrants immediate dispatch of whatever resources Reynolds County has available, including notifying state patrol. The challenge is that without knowing a dam has failed, you're treating a flood event. With that context, everything changes: the scope of hazard to responders, the potential for the flood to continue downstream, the need to notify NWS and downstream agencies immediately.

Key dispatch competency: holding the call type loosely until information firms up, while not delaying the initial response. Dispatch the resources. But also ask: what else just happened? When callers describe something that doesn't fit the weather or context you know about, the anomaly is the signal. A family's house doesn't just disappear in a "flood" at 5 AM in December.

2. AmerenUE had a FERC-required Emergency Action Plan. That plan had notification procedures. Your PSAP was not notified before calls started coming in. What does that tell you about your relationship to private-sector EAPs in your jurisdiction?

This is a structural gap that exists in many jurisdictions. FERC, EPA, and state agencies require EAPs for dams, chemical facilities, and industrial infrastructure — but those plans are written between the facility and the regulatory body. Your PSAP may or may not be in the notification chain, and even if it is, the practical question is: does your dispatcher on the 3 AM shift know who calls them and what that call means?

Discussion starter for supervisors: pull your county's dam inventory and ask who holds the EAPs. Are any of those EAPs current? Does any notification procedure route to your center in a way a dispatcher would actually recognize? This is a pre-incident planning gap, not an ops failure — but it becomes an ops failure the morning the dam breaks.

3. The warning system that actually worked was NOAA Weather Radio All Hazards — NWS issued flash flood warnings and residents with weather radios heard them. Your 911 center was not in that loop. What's your center's relationship to NWS warnings, and how does that flow work in your jurisdiction?

In many jurisdictions, NWS warnings flow to Emergency Management, not to the 911 center directly. Your PSAP may be downstream of a chain that runs: event → NWS → county EM → public alert → 911 calls start coming in. That's backwards from a dispatch perspective. By the time you're receiving 911 calls about a flash flood, the event is already happening to someone.

In the Taum Sauk case, NWS was the functional public notification mechanism — but they also weren't notified until after the failure was underway. Explore: does your county EM have a direct line to your PSAP for NWS-level events? Do you receive Wireless Emergency Alerts simultaneously with the public, or after? Who in your county is the first call for the NWS warning coordination officer at 3 AM?

4. Responders were dispatched to Johnson's Shut-Ins State Park to locate a family swept by floodwater. Before they arrived, we now know there was a 20-foot initial wave crest and significant ongoing flow. What does that mean for your responder safety briefing on a call like this?

Without knowing the source of the flooding, dispatchers can't effectively brief responding units on the hazard they're entering. A flash flood from rain runoff is a different responder risk profile than a dam-breach wave that's already emptied. The peak flow had passed by the time responders arrived — but dispatchers at the time of dispatch didn't know that.

This is a common limitation: you can only brief on what you know. The training point is what questions to ask that would accelerate your understanding of the hazard type. "Is the water still rising?" "What was the water level before it hit?" "Did anyone see where it came from?" These aren't just good customer service — they're responder safety questions.

5. The lower reservoir absorbed most of the water and held — sparing Lesterville and downstream communities. But dispatchers didn't know that when they were handling calls and coordinating voluntary evacuations. How do you prioritize when you don't know the scope of the downstream threat?

When a dam fails and you don't know downstream containment status, the conservative approach is to treat every downstream community as threatened until you have information otherwise. That means coordinating voluntary evacuation advisories, notifying downstream PSAPs, and getting someone on the phone with whoever can tell you what the lower reservoir's status is.

The challenge: Reynolds County dispatchers had the most immediate victim situation (the Toops family rescue) plus a potential catastrophic downstream threat — simultaneously. How do you triage? This is a supervisor decision as much as a dispatcher decision. This exercise is worth exploring: when do you call in off-duty staff, when do you call for mutual aid dispatch support, and who makes that call at 5:30 AM?

6. AmerenUE had been aware of the faulty sensor housings since October 2005 — and continued operating. A near-miss had been observed at the reservoir in September 2005 that was caught manually. How does "it's been fine so far" thinking manifest in comm centers, and what's the parallel?

This is normalization of deviance — the same concept explored in the Staten Island Ferry Barberi exercise (#031). AmerenUE knew the sensors were unreliable. They created a workaround. The system kept running. Nothing bad happened. So the workaround became the norm. Then one morning at 5 AM, the workaround failed at the worst possible moment.

In comm centers, this shows up as: procedures that haven't been reviewed because "we've always done it this way," CAD notes that get ignored because "that caller always calls," systems running on deferred maintenance because "it works fine," and training gaps that persist because "nothing's gone wrong yet." The question isn't whether your center has a Taum Sauk — it's which one it is.

🎯
Supervisor Discussion Guide

This exercise pairs well with pre-incident planning reviews. Before or after using it as a shift training exercise, consider the following facilitation questions for supervisors and training staff:

Does your center have a current list of dams, reservoirs, or industrial facilities in your jurisdiction with EAPs that include a 911 notification requirement?

This is a county emergency management coordination question. Most centers don't have this list — and that's the gap. Your state dam safety office maintains an inventory of regulated dams. Your state emergency management agency may have contacts at facilities with FERC or EPA-required EAPs. The question to ask EM: if facility X calls to report a dam failure at 3 AM, what is the EAP notification chain to our center, and does our dispatcher know what to do with that call?

Does your center receive NWS warnings in real time, or do those notifications go somewhere else first?

In many counties, the flow is: NWS issues warning → IPAWS/WEA broadcast to phones → public calls 911. Your dispatchers are often in a reactive position. Some centers have direct NWS feeds, EAS receivers on console, or county EM liaison protocols that push warnings directly. If your center doesn't have that, a conversation with your county EM director about creating a direct notification protocol is a low-cost improvement with high potential value.

What's your center's protocol for a catastrophic infrastructure event — dam failure, industrial release, bridge collapse — that comes in as an unknown-cause flooding or explosion call?

Many centers don't have one, because it's impossible to protocol-ize every low-frequency high-consequence event. What centers can do is train the underlying skill: recognizing when a call's presentation is inconsistent with the known context, escalating quickly, and buying time for information to develop while not waiting on information before dispatching. "We don't wait to respond — we respond and gather information simultaneously" is a trainable disposition, not just a policy statement.

✏️
Knowledge Check
Operational Judgment Quiz Question 1 of 5
Question 1 of 5
The Taum Sauk reservoir sensors had been known to be unreliable since October 2005. Operators continued running the facility using manual workarounds. What failure mode does this best illustrate?
Question 2 of 5
Reynolds County dispatchers received 911 calls about a destroyed house and missing family before they knew a dam had failed. What is the most important dispatch action in the first 60 seconds of that first call?
Question 3 of 5
The lower reservoir absorbed most of the released water and held, sparing downstream communities. But at the time of dispatch, the status of the lower reservoir was unknown. How should dispatchers handle a potential downstream threat under those conditions?
Question 4 of 5
AmerenUE's EAP included a notification requirement for local emergency services in the event of a dam failure. Evidence suggests the Reynolds County PSAP received no pre-failure warning. What is the most practical corrective action for a PSAP to take before a similar event?
Question 5 of 5
The Toops family survived because it was December and the campground was empty. Had it been July, the death toll would likely have been catastrophic. What does this "luck factor" tell us about how we evaluate our emergency response systems?
0/5
Quiz Complete
📝
Your Notes
🔗
Related Exercises
📚
Sources & Further Reading