Dam failures are often remembered by their most visible or dramatic physical consequence, such as an embankment breach, a foundation collapse, or severe downstream flooding. However, the chain of events that eventually leads to a major incident often begins with an often overlooked or underestimated part of the overall structure or project. Gates, valves, outlet works, stoplogs, automated controls, spillway chute slabs, stilling basins, warning systems, and instrumentation are frequently treated as supporting or appurtenant features, yet these same components provide crucial control and monitoring of the dam to the owner during abnormal or emergency situations.
Several of the highlighted case studies demonstrate that dam safety not only depends on the strength of an embankment or concrete monolith, but also on the reliability of the systems that control and measure operations at and around the dam. When these systems are damaged, improperly maintained, obstructed, or otherwise operate in ways that differ from the original assumptions and design intent, the margin for error when managing abnormal or emergency situations is significantly reduced or eliminated. The resulting incident may still present as overtopping or an uncontrolled release, but the underlying cause traces back to an appurtenant component rather than the primary structure itself. For these reasons, instrumentation and appurtenant features must be treated as part of the entire dam system, not as secondary elements. Seemingly minor problems with instrumentation and dam appurtenances can escalate into major incidents or, worse, failure of the dam.
Industry guidance consistently reinforces the importance of these systems. Publications such as the American Society of Civil Engineers' (ASCE) Monitoring Dam Performance: Instrumentation and Measurements, the U.S. Federal Energy Regulatory Commission's (FERC) Engineering Guidelines for the Evaluation of Hydropower Projects, and ICOLD's Dam Surveillance Guide emphasize that instrumentation is a primary tool for evaluating dam performance and identifying abnormal operating conditions. Similarly, USACE and USBR design standards require that instrumentation and appurtenant systems be incorporated into the design, operation, and risk management of dams, with clear objectives tied to potential failure modes and project-specific risks. These documents stress that instrumentation must be reliable, properly calibrated, routinely evaluated, and supported by qualified interpretation in order to provide meaningful information for dam safety decision making.
In practice, however, instrumentation and appurtenant systems are often subject to degradation, misoperation, or neglect over time. Mechanical systems such as spillway gates and outlet works may experience corrosion, alignment issues, or other component wear that limits their operability. Instrumentation systems may also degrade and become damaged, producing inaccurate or misleading data.
Taum Sauk Dam, Missouri (2005)
At Taum Sauk Dam, incorrect reservoir level readings and ineffective backup controls caused the upper reservoir to overtop, resulting in a catastrophic embankment breach that caused significant damage to approximately 281 acres of Missouri state park land. The resulting flood wave was powerful enough to carry the state park superintendent’s residence off its foundation while his family was inside and swept through nearby campground areas. Despite the severity of the release, no fatalities occurred, largely because the incident took place during the winter offseason when the park was largely unoccupied.
The Taum Sauk Pumped Storage Project relied upon instrumentation and automated controls to safely operate the upper reservoir. Unlike many conventional reservoirs, the upper reservoir did not include a spillway and therefore depended on reservoir level instrumentation and automatic shutdown systems to prevent overtopping. During modifications completed in 2004, the original shutdown system was replaced with pressure transducers housed within HDPE conduits anchored to the reservoir lining and monitored by a programmable logic controller. The facility was also operated remotely, making accurate instrumentation essential for safe operation.
Approximately three months before the failure, operators discovered water flowing over the reservoir rim during a near-miss overtopping incident. Subsequent investigations determined that several of the conduits housing the pressure transducers had become detached from their installed positions, causing the instrumentation to report water levels lower than those actually present within the reservoir. Rather than immediately implementing a permanent correction, operators relied on operational adjustments and supplemental backup systems while permanent repairs to the displaced transducer conduits could be executed. Fail-safe Warrick probes were installed to provide an independent automatic shutdown if the reservoir reached a critical elevation.
When the failure occurred on December 14, 2005, neither the primary instrumentation nor the backup shutdown system functioned as intended. Investigators determined that the Warrick probes had been installed at an elevation higher than the lowest point of the reservoir rim, allowing overtopping to occur before the probes activated. This vulnerability was compounded by control logic that required both probes to trip before the pumps would shut down. Furthermore, investigators determined that no formal program existed to verify that instrumentation readings matched actual reservoir elevations or that shutdown trigger elevations remained consistent with the lowest crest elevation around the reservoir perimeter. As a result, the reservoir overtopped, eroding the rockfill embankment and ultimately creating a 650-foot-wide breach that released approximately 4,300 acre-feet of water within 25 minutes.
The Taum Sauk failure demonstrates that instrumentation systems should not be evaluated solely on whether they are operational or calibrated. The physical installation of sensors, the assumptions embedded within control logic, the location of backup protection systems, and the relationship between trigger elevations and actual site conditions are equally important. An instrument can be functioning exactly as programmed while still providing misleading information if it is no longer measuring the condition it was intended to monitor. The incident illustrates how the gradual divergence between field conditions and design assumptions can defeat multiple layers of protection, allowing deficiencies in instrumentation, backup systems, and control logic to combine and ultimately result in dam failure.
Folsom Dam, California (1995)
While the Taum Sauk failure demonstrates how faulty instrumentation and control systems can contribute directly to dam failure, other incidents show that deterioration of dam appurtenances can also create serious consequences, even when the primary structure remains intact. One notable example occurred at Folsom Dam in California on July 17, 1995. During a routine operation to maintain downstream river flows during a scheduled powerplant shutdown, the operator began opening Spillway Gate No. 3. As the gate passed an opening height of two feet, unusual vibrations and grinding noises were observed. Within seconds, the radial gate failed, swinging open to one side and releasing approximately 40 percent of the reservoir storage over the next several hours before it could be stabilized. Quick action by dam personnel and coordinated operation of the downstream Nimbus Dam prevented overtopping of the downstream structure and significantly reduced downstream consequences. Fortunately, no fatalities or major flood damage occurred, but the incident resulted in the loss of a substantial volume of stored water and approximately $20 million in repair costs.
Subsequent forensic investigations determined that the failure was caused by excessive friction at the gate’s 32-inch diameter trunnion pin assembly. Corrosion and deterioration over decades of service increased friction within the pivot mechanism, creating forces that had not been accounted for in the original gate design. These forces overstressed the gate arms and bracing, ultimately leading to a structural failure of the gate. Investigators also discovered that the gate had not been operated beyond approximately two feet of opening under high head conditions since 1958, illustrating the importance of periodically exercising critical mechanical systems under realistic operating conditions.
An important lesson from the Folsom Dam incident is that appurtenant structures may experience loading conditions that differ significantly from those assumed during design. The original gate design did not account for the additional stresses generated by friction at the trunnion pins, which was consistent with accepted engineering practice at the time the gates were designed and installed. However, decades of corrosion and deterioration gradually changed the behavior of the system, introducing forces that the structure was never intended to resist. As a result, a gate that had operated successfully for many years became vulnerable to failure despite no significant change in its operational purpose. The incident demonstrates the importance of periodically reevaluating aging appurtenant structures using current engineering knowledge and considering whether long-term deterioration mechanisms may invalidate assumptions made during the original design.
As with instrumentation systems, the reliability of spillway gates and outlet works must be verified through inspection, maintenance, periodic engineering reviews, and risk-informed operation. Equally important, the assumptions underlying the design and operation of these structures should be periodically reevaluated to ensure they remain valid as facilities age and operating conditions evolve.
Tempe Town Lake Dam, Arizona (2010)
The Folsom Dam incident demonstrated how deterioration of a relatively small mechanical component within a spillway gate system could trigger a major uncontrolled release from a reservoir. Although the dam itself remained structurally sound, the consequences highlighted the critical role that appurtenant structures play in maintaining operational control of a dam. Similar lessons emerged fifteen years later at Tempe Town Lake Dam in Arizona, where the failure of a nontraditional dam appurtenance caused the sudden failure of the rubber dam system and a complete loss of the reservoir despite the absence of a flood event.
Tempe Town Lake was created by a pair of inflatable rubber dams constructed on the Salt River between 1997 and 1999. Unlike conventional spillway gates, the system relied on large air filled rubber bladders that could be inflated to impound water and deflated to safely pass flood flows. The project transformed a normally dry 850-foot-wide ephemeral river channel into a 220-acre recreational lake that became the focal point for economic development, recreation, and community events in the City of Tempe. Because the rubber dams served as the primary water retaining feature of the project, their continued performance was essential to maintaining the reservoir.
On July 20, 2010, one of the four 16-foot-high rubber bladders that formed the downstream dam suddenly ruptured, releasing approximately one billion gallons of water and effectively draining the lake. Investigations concluded that the failure resulted from the deterioration and separation of the reinforced rubber bladder layers, a process accelerated by prolonged exposure to extreme environmental conditions, including heat and solar radiation, of the Arizona desert. While the original design had accounted for the harsh Arizona desert climate by including a recirculating cooling system that passed shallow flow over the tops of the four rubber bladders, the system did not operate as originally intended. The middle sections of the rubber bladders sagged lower than the sides, causing uneven distribution of the recirculating flow across the width of each bladder. This condition may have reduced the effectiveness of the cooling system intended to combat the harsh desert environment and could have contributed to accelerated deterioration of the rubber bladders and the eventual failure of the dam.
Notably, concerns regarding the condition of the aging bladders had already been identified and noted, and preparations were already underway to replace them prior to the failure. Although no fatalities occurred and the dam’s concrete foundation structure remained intact, the failure resulted in the loss of the reservoir, significant economic impacts, and the need for a complete redesign of the impoundment system for the lake. Ultimately, the rubber dam was replaced with a hydraulically operated steel gate structure designed to provide greater long-term reliability and maintainability.
The Tempe Town Lake incident illustrates that dam safety vulnerabilities are not limited to traditional gates, valves, or instrumentation. Novel and specialized appurtenant systems may introduce unique aging mechanisms and maintenance requirements that differ from those associated with conventional dam infrastructure. Furthermore, appurtenant systems may experience different aging mechanisms and maintenance requirements depending on the climate and environmental conditions in which they operate, which owners, operators, and engineers should be aware of. As dams continue to incorporate innovative systems and materials, owners and engineers must ensure that inspection, monitoring, maintenance, and replacement planning adequately account for long-term performance and environmental exposure. Failure to recognize these risks can result in the loss of critical project functions even when the primary dam structure itself remains undamaged.
Cleveland Dam, British Columbia (2020)
While the Tempe Town Lake incident demonstrated how long-term deterioration of a specialized appurtenant structure can ultimately result in failure, other incidents illustrate how operational and control system deficiencies can create equally serious consequences even when no physical deterioration is present. One such example occurred at Cleveland Dam in British Columbia, Canada. Cleveland Dam is a 300-foot-high concrete gravity dam that impounds the Capilano Reservoir, one of the primary drinking water supplies for the Greater Vancouver region. At the time of the incident, downstream releases were controlled by a large remotely operated drum gate, a specialized spillway structure that regulates water levels using buoyancy forces within a hollow steel chamber. The drum gate operated in an automated mode that automatically adjusted gate position as the reservoir inflows varied in order to maintain reservoir levels and downstream river flows.
On October 1, 2020, the drum gate unexpectedly lowered, releasing a large surge of water downstream into the Capilano River. The release occurred rapidly and without warning to members of the public using the river corridor for recreational activities. Within minutes, river levels rose dramatically, sweeping several individuals downstream. Two people ultimately lost their lives as a result of the incident, while others narrowly escaped. Notably, the dam itself suffered no structural damage, and the uncontrolled release was not caused by deficiencies in the concrete structure, foundation, or spillway. Instead, subsequent investigations identified human error associated with programming of the gate control system as the primary contributing factor to the incident.
The Cleveland Dam incident highlights the increasing importance of automated controls, human-machine interfaces, and public warning systems within modern dam safety programs. As dam operations become more dependent upon remote monitoring and programmable logic controls, failures may originate not from deterioration of physical infrastructure but from errors in software, programming logic, operational procedures, or system configuration. The incident also demonstrates that reliable downstream notification and warning systems should be considered critical appurtenant features, particularly at projects where operational releases can affect public recreation areas with little advance notice.
More broadly, the incident illustrates that assumptions embedded within automated control systems should be periodically reevaluated and should not be treated as static simply because the system functioned correctly when originally implemented. Automated operating sequences, set points, interlocks, alarms, and control algorithms are often developed based on specific data and assumptions regarding equipment configuration, operating procedures, communication systems, site conditions, and downstream consequences. Over time, however, these assumptions may become invalid as equipment is modified, operating practices evolve, software updates occur, or new risks and uses develop downstream of the dam. Consequently, periodic reviews of automated control systems should evaluate not only whether the software continues to function as programmed, but also whether the underlying assumptions remain valid and appropriate for current and reasonably foreseeable future conditions. A structurally sound dam can still present significant risk if the systems used to control it no longer perform as intended. Therefore, control systems should be inspected, maintained, and periodically reevaluated with the same rigor applied to traditional structural and mechanical components of a dam.
a
Supporting Infrastructure Beyond the Dam
Instrumentation and appurtenances are often assumed to mean features located directly on or immediately adjacent to the dam. However, safe dam operation often times also depends on additional supporting infrastructure located elsewhere within the reservoir, upstream watershed, downstream corridor, or broader project area. Although these systems may not be physically incorporated into the dam or owned by the dam owner, they can provide critical information, communication, power, access, control, and public warning functions during normal operations, unusual conditions, and emergencies.
Examples of supporting infrastructure that may be important to dam safety include, but are not limited to:
- Hydrologic and meteorological monitoring systems, including upstream and downstream river gaging stations, reservoir inflow gages, precipitation gages, weather stations, snowpack monitoring stations, and watershed telemetry networks.
- Communications systems, including radio repeaters, fiber-optic links, cellular and satellite connections, and other communication pathways used to transmit data or coordinate operations and emergency response.
- Power supply systems, including utility service, backup generators, uninterruptible power supplies, battery systems, transfer switches, and independent power supplies serving remote monitoring or control equipment.
- Data acquisition and control systems, including supervisory control and data acquisition systems, programmable logic controllers, human-machine interfaces, remote terminal units, servers, software, and cloud-based monitoring platforms.
- Public warning and notification systems, including downstream sirens, automated alerts, electronic message boards, recreation-area warning devices, and other systems used to notify potentially affected populations.
- Access and operational support infrastructure, including access roads, bridges, security systems, equipment staging areas, maintenance platforms, cranes, hoists, and other features needed to inspect, maintain, or operate critical equipment.
- Reservoir and watershed surveillance systems, including landslide monitoring, reservoir-rim movement monitoring, water-quality stations, sediment monitoring, and remote cameras.
- Interconnected hydraulic infrastructure, including upstream regulating reservoirs, diversion structures, canals, pumping plants, intake structures, and other facilities whose operation may influence reservoir levels, inflows, releases, or downstream conditions.
The importance of these systems depends on the site, operating configuration, potential failure modes, and the extent to which dam personnel rely upon them when making operational decisions. For example, an upstream river gaging station may provide advance warning of rapidly increasing inflows; a remote communication network may transmit reservoir levels and equipment alarms; an access road may be the only means of reaching a manually operated gate; and a downstream warning system may be the primary means of alerting the public before an emergency release. Failure of any one of these systems may not directly damage the dam, but it can reduce situational awareness, delay timely intervention, limit operational control, or otherwise impair emergency response.
In many cases, these supporting systems may be owned, operated, maintained, or funded by organizations other than the dam owner. For example, stream gaging stations may be operated by federal or state agencies, communication networks may rely on telecommunications providers, warning systems may involve local emergency management agencies, and power supplies may depend upon external utilities. As a result, dam owners may have limited control over inspection practices, maintenance activities, replacement schedules, cybersecurity measures, funding priorities, or system upgrades. Furthermore, the resilience, redundancy, and long-term reliability of these systems may not be fully understood by the dam owner despite their importance to dam operations. Consequently, effective dam safety programs should include coordination with external stakeholders, identification of critical dependencies, and consideration of contingency measures when externally owned or operated infrastructure becomes unavailable.
Accordingly, dam safety programs should identify supporting systems that are essential to monitoring, decision-making, operation, communication, and emergency response, regardless of their physical distance from the dam or organizational ownership. These systems should be evaluated in relation to the functions they support, the consequences of their unavailability, the availability of independent or redundant means of performing those functions, and the degree to which the dam owner relies upon infrastructure controlled by others.
Conclusion
Collectively, these case studies demonstrate that instrumentation and appurtenant features are frequently involved in the progression of dam incidents, whether through deterioration, design deficiencies, operational errors, inadequate maintenance, or unexpected interactions between system components. In some cases, such as Taum Sauk, these deficiencies ultimately contributed to dam failure. In others, including Folsom Dam, Tempe Town Lake, and Cleveland Dam, the primary structure remained intact but significant operational, economic, environmental, or public safety consequences still occurred.
The common lesson is that instrumentation and appurtenant systems should not be viewed as secondary features. They are integral components of the dam system and often represent the mechanisms through which owners monitor conditions and make crucial operational and dam safety-related decisions. A recurring theme throughout these incidents is that failures often occurred when actual field conditions gradually diverged from the assumptions under which instrumentation, appurtenant structures, or automated control systems were originally designed, configured, or operated. Effective dam safety programs therefore require these features to be regularly inspected and maintained throughout their service lives. Equally important, the assumptions underlying the design and operation of these systems must be periodically reevaluated to ensure they remain applicable as facilities and conditions continually evolve over time. By recognizing the risk significance of these systems and addressing deficiencies before they become critical, dam owners and engineers can reduce the likelihood that seemingly minor problems escalate into major incidents or dam failure.
References:
(4) ASDSO. (2016). Taum Sauk Dam (Missouri, 2005). Association of State Dam Safety Officials.
(5) ASDSO. (2016). Folsom Dam (California, 1995). Association of State Dam Safety Officials.
This lesson learned was peer-reviewed by Nathaniel Gee, P.E., PhD (Tennessee Valley Authority) and Eric Halpin, P.E. (Halpin Consulting LLC).
Taum Sauk Dam (Missouri, 2005)
Folsom Dam (California, 1995)
Tempe Town Lake Dam (Arizona, 2010)
Cleveland Dam (British Columbia, 2020)
Oroville Dam (California, 2017)
Why Include Instrumentation in Dam Monitoring Programs?
Dam Surveillance Guide
