Levee and Dam Internal Erosion: The Piping Failure Simulator

How Seepage Becomes a Failure Mechanism

Every earthen dam and levee leaks to some degree. Water under hydraulic head naturally seeps through the pores of the compacted soil and along the contact between the embankment and its foundation. In a well-designed structure this seepage is slow, diffuse, and harmless, exiting gradually through engineered drains. Trouble begins when seepage becomes concentrated along a preferential pathway: a shrinkage crack from uneven settlement, an animal burrow, a zone of poor compaction left by construction shortcuts, a root channel from a rotted tree, or the interface around a buried outlet pipe or spillway conduit where soil never bonds perfectly to a rigid structure. Along these pathways, water velocity rises sharply compared to the surrounding soil mass. Erosion begins when the seepage force exerted on individual soil grains exceeds the grains' resistance to being dislodged and carried along, a threshold engineers describe using the local hydraulic gradient, the drop in water pressure per unit distance along the flow path. Fine, poorly graded, cohesionless soils, such as uniform silts and fine sands, are especially vulnerable because their particles are small enough to be entrained in slow-moving water and lack the clay-like cohesion that would otherwise bind them together. Once a few grains move, the pathway enlarges slightly, which locally increases velocity and gradient even further, so more grains dislodge. This is a self-reinforcing, positive feedback process: a small opening grows into a narrow conduit, then into a widening pipe. Critically, this erosion tends to progress backward, or upstream, from the point where water exits the embankment toward the reservoir or river that supplies the seepage, a pattern engineers call backward erosion piping. As the pipe lengthens and widens, flow through it increases dramatically, accelerating the erosion rate further, sometimes transforming a barely perceptible seep into a breach-triggering flow within a matter of hours once the pipe connects fully from the water source to the downstream face.

From Hidden Channel to Catastrophic Collapse

The danger of internal erosion lies in the gap between how it begins and how it ends. The initial stages, tiny particle movement within saturated soil, occur entirely out of sight, buried within the embankment or its foundation, so there is typically no visible change at the surface for a considerable time. Engineers describe several sequential stages that any successful piping failure must pass through: initiation, where erosion begins at a weak point; continuation, where the eroding channel persists and does not seal itself off with surrounding soil; progression, where the pipe extends backward toward the water source; and finally breach, where the enlarged pipe critically undermines the structure. Not every incidence of internal erosion reaches breach; many self-heal when the eroding pathway intersects a zone of coarser, self-filtering material or when the flow path collapses and chokes itself with dislodged particles, a fortunate outcome that is far more likely when proper filter zones are present. When self-healing does not occur, the pipe keeps growing until it fully connects the reservoir side to the downstream face, at which point flow through the conduit increases explosively. The soil arch that had been spanning over the enlarging void loses its remaining support, and the roof of the pipe can collapse suddenly, causing a rapid, unzippering failure of the embankment crest and a sudden release of the impounded water. This is why piping incidents are notorious for offering deceptively little external warning until very near the end. A dam or levee can appear structurally sound for days while an internal channel silently enlarges beneath the surface, then fail within a span of minutes once the final breach mechanism engages, which is precisely why continuous monitoring and rapid emergency response protocols are considered essential parts of dam safety programs rather than optional precautions.

Warning Signs Engineers Watch For

Because internal erosion mostly hides beneath the surface, dam safety inspectors are trained to treat a narrow set of visible clues as urgent red flags rather than minor nuisances. The single most telling sign is cloudy or muddy seepage water carrying visible sediment; clear seepage suggests water is simply percolating through pores without dislodging material, while turbid or sediment-laden discharge means soil particles are actively being transported out of the embankment, direct physical evidence that a pipe is forming or actively enlarging somewhere upstream of that exit point. Inspectors routinely collect seepage samples in clear containers specifically to check for this turbidity and to estimate how much sediment is being lost over time. A second critical indicator is the appearance of sudden new springs, boils, or unexpected wet or damp patches on the downstream face or in the area beyond the toe of the embankment, especially spots that were previously dry; a new seepage point that increases in flow over hours signals that a concentrated pathway has developed and is actively enlarging rather than the slow, diffuse wetting typical of healthy long-term seepage. A boil, where seeping water bubbles up carrying sand grains at the ground surface downstream of the levee, is considered a particularly severe emergency sign, since sand boils indicate the foundation itself is piping. Third, engineers watch the embankment crest and slopes for sinkholes, depressions, or slumping, since a void created by an internally eroding pipe can eventually cause the overlying soil to collapse downward into the cavity, producing a visible surface depression or a sudden hole. Other secondary indicators include unusual whirlpools on the reservoir surface near the upstream face, cracking patterns radiating from a settling area, and unexplained turbidity spikes in downstream monitoring wells. Dam safety programs formalize this vigilance through scheduled visual inspections, instrumented piezometers that track internal pore pressures, and, increasingly, continuous sensor networks and drone-based thermal imaging that can detect anomalous seepage patterns before they become visible to the naked eye.

Filter and Drain Zones: Engineering the Defense

Modern earthen dam design does not rely on hoping internal erosion never starts; it assumes seepage is inevitable and builds in defenses specifically to stop erosion from progressing even if it does begin. The primary tool is the graded filter zone, a layer of carefully selected sand or sand-and-gravel placed downstream of the core or foundation contact where seepage exits the embankment. A properly designed filter follows particle-size design rules, sometimes called the Terzaghi or Sherard criteria, ensuring the filter material's grain size is fine enough to physically block and trap the base soil's particles from migrating through it, yet coarse enough to remain far more permeable than the base soil so it does not itself impede drainage or build up damaging pore pressure. When seepage carrying fine particles reaches a correctly graded filter, the filter's own pore spaces bridge and arrest the migrating grains within the first few centimeters, forming a self-sealing zone that halts further particle loss almost immediately, converting what could have been a runaway erosion channel into a stable, harmless seepage path. Beyond the filter, a coarser drain zone, typically clean gravel or a perforated collector pipe, provides a low-resistance outlet that safely conveys the filtered water away from the embankment without letting pressure build up inside the dam body. Together these layers are often built as a continuous chimney drain rising vertically through the downstream portion of the embankment, intercepting any seepage exiting the core before it can reach the downstream slope uncontrolled. Filter and drain zones are considered so effective that many national dam safety guidelines treat their presence, condition, and design adequacy as one of the single most important factors distinguishing a dam at low risk of piping failure from one at high risk, and retrofitting adequate filters into older dams built before these design principles were standardized is one of the most common and highest-priority dam safety rehabilitation projects undertaken today.

Lessons From Historical Failures and Modern Risk Assessment

Internal erosion has been implicated in some of the most consequential dam and levee failures in recorded history, and the pattern across these events is remarkably consistent: a period of unremarkable service, a brief window of subtle warning signs, and then sudden, rapid collapse. Investigations into historical breaches repeatedly find contributing factors such as inadequately compacted fill placed decades before modern quality-control standards existed, conduits or spillway structures embedded directly in the embankment without adequate filter protection around their exterior, and foundations containing erodible layers that were never fully assessed during original design. Statistically, piping and internal erosion account for a substantial share of all historical embankment dam failures, rivaling or exceeding overtopping as a leading cause, which is why dam safety engineers now treat internal erosion potential as a primary category in formal risk assessment frameworks rather than a secondary concern. Contemporary risk analysis uses event-tree methods that estimate, stage by stage, the probability that erosion initiates, continues without self-healing, progresses to full connection, and ultimately breaches, allowing owners to prioritize limited rehabilitation budgets toward the structures with the weakest natural defenses. Instrumentation such as seepage weirs, piezometer networks, and turbidity sensors now allow many facilities to detect the earliest stages of internal erosion long before visible surface signs appear, turning what was once an almost undetectable process into one that can, with sufficient monitoring investment, be caught and remediated while repair is still straightforward and inexpensive. The recurring lesson from failure investigations is that internal erosion is rarely caused by a single dramatic event; it is nearly always the slow convergence of an underlying vulnerability, whether a compaction flaw, an unprotected conduit, or an erodible foundation seam, with a sustained period of high reservoir head that finally provides enough hydraulic gradient to set the erosion process in motion.

Frequently asked questions

Try it live

Everything above runs in your browser — open Levee and Dam Internal Erosion: The Piping Failure Simulator and change the parameters while it is running. Nothing is installed, nothing is uploaded, the whole model lives in one tab.