Water Supply Security—Risk Management Instruments in Water Supply Companies

Abstract

Piped drinking water supplies are exposed to a range of threats. Changing hazard situations arise from climate change, digitisation, and changing conditions in the power supply, among other things. Risk and crisis management adapted to the hazard situation can increase the resilience of the piped drinking water supply. Analogous to the risk management system, this article describes a methodology that ranges from hazard analysis with the prioritisation of 57 individual hazards to vulnerability assessment with the help of balance sheet structure models (BSM) and the planning and implementation of measures to increase the resilience of the piped drinking water supply in a targeted manner. The work steps mentioned build on each other and were tested using the case study of a water supply company in Saxony (Germany). As a result, priority hazards are identified, the remaining supply periods and replacement and emergency water requirements are determined as part of the vulnerability assessment, and finally, planning principles for increasing resilience are documented. The methodology focuses primarily on practicable application by water supply companies.

1. Introduction

Drinking water infrastructure can be severely impaired by a number of hazards. Water supply companies are also exposed to a number of potential hazards in their operations and in the fulfilment of their tasks [1,2,3]. Climate change is one of the greatest threats to the water supply. The intensity and frequency of extreme hydrological events such as floods, flash floods, and droughts are expected to increase worldwide [4,5,6,7,8,9]. However, other natural hazards can also affect the water supply. For example, the SARS-CoV-2 pandemic led to staff shortages and supply difficulties for operating and auxiliary materials for water treatment [10,11,12]. Technical faults also pose a major potential risk. For example, a blackout can lead to long-lasting supply interruptions in the piped water supply [13,14,15]. Other threats to the water supply come from sabotage and acts of war. An increase in cyberattacks on critical infrastructure is currently to be expected [16,17,18].

But which hazards are relevant for maintaining the piped water supply and should be prioritised in scenarios?

In order to increase resilience to crises and disasters, the water supply needs a risk and crisis management system. At the European level, the Water Safety Plan of the World Health Organisation (WHO) [19] has been implemented in regulations with the standards DIN EN 15975-1 [20] and DIN EN 15975-2 [21]. The work steps for risk and crisis management are shown in Figure 1.

However, in the implementation of risk management, there are deficits in the preparation and practical application of risk analyses [5,22,23]. To determine the resilience of water distribution systems, Todini [24] already described the basis for assessing the systems using a heuristic optimisation approach 24 years ago. The mathematical framework described in [24] has recently been further developed by Caldarola et al. [25,26,27,28,29], among others. The mathematical principles are used in many hydraulic models, such as EPANET (Version 2.0) or the WaterNetGen software (EPANET extension–pipe dimensioning) [30,31,32,33,34,35,36,37]. In [25], the challenges of hydraulic simulation are described, including the need for large amounts of data for the components of the network (systems, gate valves, valves, pipe materials), knowledge of the network topology, and water demand (consumption behaviour, peak demand). In addition to hydraulic models, system dynamic modelling [38,39,40,41], society-oriented, economy-based, and combined methods are known in the literature [42]. Many methods require expert knowledge in their application and, due to their complexity, offer only limited application possibilities in crisis management.

The question arises as to whether a simplified modelling approach with semi-dynamic models can offer greater user-friendliness with the least possible loss of information.

To manage the risks, measures to increase the resilience of the piped water supply should be derived from the risk analysis and implemented [21]. There is a lack of planning principles for the dimensioning of systems in emergency and crisis situations compared to normal operation. In addition, an international comparison shows different volume approaches for backup and emergency water supply (

Table 1. Quantities of backup and emergency water supply.

Literature Source	Unit	WHO [43]	Sphere [44]	Switzerland [45]	Austria [46]	Germany [47]
Emergency water supply Minimum population requirement	L/(P·d)	20	15	15	15	15
Replacement water supply incl. domestic hygiene	L/(P·d)	70		100 *	Accord. to water demand plan *	50 *

Further information on drinking water requirements for healthcare and livestock farming can be found in [43,44,45,46,47], * Line-bound.

).

This paper presents a consecutive approach for (i) identifying relevant threats, (ii) analysing the vulnerability of a water supply system and (iii) developing mitigation measures. The proposed approach offers a good balance between the required accuracy and practical applicability. Its application is demonstrated for a water supply system of medium complexity.

2. Materials and Methods

2.1. Hazard Analysis

A tool for semi-quantitative prioritisation was developed to determine the relevance (R) of each hazard. The aim of the procedure is not an exact quantification of the risk but a relative prioritisation of the hazards. The first step was to systematically record the hazards (

Table 2. Sample table for hazard analysis, adopted from [48].

A

B

C

D

E

F

G

H

I

J

K

L

M

N

O

P

Q

R

S

T

U

hazard analysis

Hazards

Source

Reason

Responsible

Affectedness

Relevance

Category

No.

Hazard source

Drinking water supply safety guidelines [3]

Protection of critical infrastructures [1,49]

DVGW W 1001-B1 [50]

Incident documentationof the water supplier

Internal

External

Exposure in the supply area

Water supplier

Country/ Municipality

Covenant

Plants, buildings

Drinking water network

Staff

Region

Degree of danger

Probability ofoccurrence

Relevance

Evaluation of scenario selection, comments

N

1

Hazard 1

X

X

X

X

X

X

1

1

1

1

1

3

3

T

2

Hazard 2

X

X

X

X

X

X

3

3

3

3

3

2

6

Derive scenario

A

n

Hazard n

X

X

X

X

1

1

2

3

1.8

2

3.6

N = natural hazards, T = technical faults/human error, A= attacks, sabotage, acts of war.

Classification of the impact:

1—not relevant, 2—localized impact, 3—widespread impact

Classification of the probability of occurrence:

1—low, 2—medium, 3—high probability of occurrence

, columns A–M) on the basis of known and potential hazards. For this purpose, various technical guidelines [1,3,48,49,50] and the water supplier’s incident documentation from the last 20 years were used. To determine the probability of occurrence (E) and the respective affectedness (B_i) of the individual hazards, literature research was carried out, data provided by authorities or insurers was used, information from the technical regulations was included, operating experience was analysed, experts were interviewed, and/or local media reports were consulted. The areas of facilities, structures, personnel, and regional impact were analysed as part of the impact assessment. This procedure results in an estimated categorisation of the probability (E) (Table 2, column S):

• 1—low (all > 1000 a),
• 2—medium (every 101–1000 a) and
• 3—high (all 0–100 a).

and the respective affectedness B_i (Table 2, columns N–Q) in:

• 1—not relevant,
• 2—selectively and
• 3—area-wide.

The hazard level (G) was calculated as the mean value of the B_i (Table 2, column R). The relevance (R) of the hazard under consideration was calculated as the product of G and E (Equation (1); Table 2, column T). Finally, the relevant hazards were summarised into as few scenarios as possible in order to limit the number of subsequent simulations.

$$\mathrm{R}=\mathrm{E}\cdot \mathrm{G}=\mathrm{E}\cdot \frac{1}{\mathrm{n}}{\sum }_{\mathrm{i}=1}^{\mathrm{n}}{\mathrm{B}}_i$$

(1)

R—Relevance

E—Probability of occurrence (Range of values 1 to 3)

G—Level of risk

Bi—Affectedness i = 1 … n (Range of values: 1 to 3)

i—Index of the respective affectedness

n—Number of affected parties analysed

The results of the hazard analysis using the example of a water supply company are presented in Section 3.2. a detailed description of the methodology is published in [48].

2.2. Vulnerability Analysis with Balance Sheet Structure Models (BSM)

2.2.1. Calculation Approach

The subsequent vulnerability analysis (resilience assessment) was carried out using a semi-dynamic model. This is fundamentally based on a quantitative water balance (Equation (2)).

$$\frac{\mathrm{d}\mathrm{S}(\mathrm{t})}{\mathrm{d}\mathrm{t}}=\mathsf{\Sigma }\mathrm{Q}(\mathrm{t})=\mathsf{\Sigma }{\mathrm{Q}}_{\mathrm{i}\mathrm{n}}(\mathrm{t})-\mathsf{\Sigma }{\mathrm{Q}}_{\mathrm{o}\mathrm{u}\mathrm{t}}(\mathrm{t})$$

(2)

The balance is made up of the inflows (ΣQ_in), such as the inflow from water extraction plants or feed-in points, and the outflows (ΣQ_out), such as drinking water consumers, losses and feed-out points. The difference between inflows and outflows results in the balance value (ΣQ). The integral of the difference between the inflows and outflows therefore represents the change in the system status over a certain period of time. To determine the remaining supply time (t), all available storage capacities (S), such as underground or elevated tanks, are taken into account (Equation (3)).

$$\mathrm{t}=\frac{\mathrm{S}}{-({\mathrm{Q}}_{\mathrm{i}\mathrm{n}}-{\mathrm{Q}}_{\mathrm{o}\mathrm{u}\mathrm{t}})}$$

(3)

To map the various operating scenarios, a mathematical case differentiation of Equation (3) was carried out (Equations (4)–(7)):

Normal operation (case 1: S > 0; Q_in ≈ Q_out):

$$\underset{({\mathrm{Q}}_{\mathrm{in}}-{\mathrm{Q}}_{\mathrm{out}})\to 0}{\lim }\mathrm{t}=\frac{\mathrm{S}}{\mathrm{l}\mathrm{i}\mathrm{m}(-\left({\mathrm{Q}}_{\mathrm{i}\mathrm{n}}-{\mathrm{Q}}_{\mathrm{o}\mathrm{u}\mathrm{t}}\right))}=\mathrm{\infty }$$

(4)

Balance sheet deficit (case 2: S > 0; Q_in < Q_out):

$$\mathrm{t}=\frac{\mathrm{S}}{-({\mathrm{Q}}_{\mathrm{i}\mathrm{n}}-{\mathrm{Q}}_{\mathrm{o}\mathrm{u}\mathrm{t}})}>0$$

(5)

Cascade effects (case 2 extended, 1 … n = index of the memory considered in the cascade system, n = number of memories in the cascade system):

$${\mathrm{t}}_{\mathrm{n}=}\frac{{\mathrm{S}}_1}{-({\mathrm{Q}}_{\mathrm{i}\mathrm{n},1}-{\mathrm{Q}}_{\mathrm{o}\mathrm{u}\mathrm{t},1})}+\frac{{\mathrm{S}}_2}{-({\mathrm{Q}}_{\mathrm{i}\mathrm{n},2}-{\mathrm{Q}}_{\mathrm{o}\mathrm{u}\mathrm{t},2})}+\dots +\frac{{\mathrm{S}}_{\mathrm{n}}}{-({\mathrm{Q}}_{\mathrm{i}\mathrm{n},\mathrm{n}}-{\mathrm{Q}}_{\mathrm{o}\mathrm{u}\mathrm{t},\mathrm{n}})}$$

(6)

without memory (case 3: S = 0; Q_in < Q_out):

$$\mathrm{t}=\frac{\mathrm{S}}{-({\mathrm{Q}}_{\mathrm{o}\mathrm{u}\mathrm{t}}-{\mathrm{Q}}_{\mathrm{i}\mathrm{n}})}=0$$

(7)

The theoretical cases of a negative denominator (case 4: Q_in > Q_out) and a negative storage volume (case 5: S < 0) are not taken into account in the BSM. This means that no negative time (−t) can result. Assuming a full storage tank, a surplus feed-in leads to a storage tank overflow and is therefore mathematically balanced by increased losses on the consumption side. A negative storage volume at the time the simulation starts is practically impossible. Further information on the calculation approach is published in [51].

2.2.2. Modelling Implementation

The model structure is explained in this chapter using a sample scenario with a three-day outage of a waterworks as an example. The publication of the models actually created is limited to the simulation results (Section 3.3). This procedure was chosen in order to protect the sensitive data of the water supply companies.

The mathematical approach was implemented in a spreadsheet programme. The BSM consists of several system components. The existing system components, including the necessary parameterisation and links, are shown and explained in

Table 3. Parameterisation and linking of the system components.

	System Component	Parameters	Unit	Remarks
Global	Global input field	Scenario		Description of the scenario
		Runtime	d	Depending on the scenario
		Consumption factor fdx		has a constant effect over the entire scenario period and reflects increases or decreases in drinking water consumption
		Emergency water factor fd,NW		acts constantly over the entire scenario time and calculates the required emergency water quantity
		Remarks
		Connection points		All consumption points
Drinking water supply (inflows)	Feed-in	Designation/No.		Abbreviation “I”
		Capacity Qcap	m³/d	Decisive capacity of the feed-in (technical or regulatory)
		Feed-in QInput	m³/d	Actual feed-in in the scenario, with reference Qdm of the feed-in
		Connection points		Feed-in point grid, water storage, water pumping
	Water catchments	Designation/No.		Abbreviation “WC”
		Usability	%	Utilisation of capacity, consideration of e.g., reduction due to dry periods
		Capacity Qcap	m³/d	Decisive capacity of the feed-in (technical or regulatory)
		Connection points		Water treatment
	Water treatment	Designation/No.		Abbreviation “WT”
		Operational switching		Selector switch between “ON” and “OFF”
		Capacity Qcap	m³/d	Decisive capacity of the feed-in (technical or regulatory)
		Connection points		Feed-in point grid, water storage, water pumping
Drinking water network	Water reservoir	Designation/No.		Abbreviation “S”
		Useful volume VUse	m³	Available usable volume
		Useful volume VIS	m³	Minimum volume of normal operation
		Connection points		Grid feed-ins and feed-outs, consumption points, water delivery
	Water pumping	Designation/No.		Abbreviation “P”
		Capacity Qcap	m³/d	Decisive capacity of the feed-in (technical or regulatory)
		Connection points		Grid feed-ins and feed-outs, consumption points, water storage tanks
Drinking water consumption (drains)	Consumption point	Designation/No.		Abbreviation “SA”
		Inhabitants	P	Indication of inhabitants supplied
		Storage system		Specification of linked memory
		Consumption factor fdx		Selector switch “GLOBAL” or “HAND”, differentiated input required for “HAND”, e.g. for commercial customers
		Manual value fdx		If “Hand” is preselected, it has a constant effect over the entire scenario time and maps excess or reduced quantities of drinking water consumption
		Drinking water consumption	m³/d	Specification of drinking water consumption Qdm, as direct input or database link
		Meter number		Specification of existing meter numbers
		Connection points		Grid feed-ins and feed-outs, downstream consumption points, water storage tanks, drinking water consumption if applicable
	Feed-out	Designation/No.		Abbreviation “O”
		Capacity Qcap	m³/d	Relevant capacity of the feed-out (technical or regulatory)
		Feed-out QFeed-out	m³/d	Actual feed-in in the scenario, with reference Qdm of the feed-in
		Connection points		Grid feed-out point, water storage tank, water pumping

.

The model structure is based on the topology and takes flow directions and technological relationships, such as pressure zones, into account. The data are analysed via the visual representation in the model and via overall balances. Figure 2 shows the abstracted model scenario for the failure of a waterworks at the simulation period of three days. The areas shown in Figure 2 correspond to the following specifications:

• An area module (coloured box) comprises 0–50 inhabitants,
• Red areas—inhabitants without drinking water supply,
• Yellow areas—residents with a temporary drinking water supply and
• Green areas—residents with an unlimited supply of drinking water.

Supply diagrams (Figure 3) and evaluation tables (

Table 4. Evaluation table in the sample scenario.

No.	Zone	People in P	Supply Time in d	Normal Supply in P	Limited Supply in P	Supply Interrup. in P	Qdm in m³/d	Qd,NW in m³/d	Sensitive Consumers
S-2	City 1 Zone 1	1200	0.80	0	0	1200	169.8	23.8	Nursing home A
S-3	City1 Zone 2-5	1510	1.93	0	0	1510	129.6	18.1
P-2	City 1 Zone 6	30	1.93	0	0	30	2.5	0.3
S-4	City 2 Zone 1	1000	unlimited	0	1000	0	103.9	14.5
S-5	City 3 Zone 1	780	2.52	0	0	780	73.8	10.3
S-6	City 4 Zone 1	1030	3.16	0	1030	0	105.5	14.8	Hospital B
S-6	SA external	120	3.16	0	120	0	11.7	1.6
P-6	City 4 Zone 3	50	3.16	0	50	0	4.9	0.7
S-7	City 4 Zone 2	410	5.67	0	410	0	41.9	5.9
Total		6130		0	2610	3520	643.6	90.1

) supplement the analysis of the BSM. Figure 3 shows, as function of failure time, the number of affected residents with normal supply (green), the time until supply failure (yellow) and the duration of the supply interruption (red).

Table 4 contains information on the affected inhabitants, the affected sensitive consumers, the remaining supply time and an estimate of the emergency water demand not connected to the mains.

More detailed information on the systematics of the models is contained in the sample model (Supplementary Material).

2.2.3. Input Parameterisation

In order to assess the actual impact of the relevant hazards (Section 2.1) on the water supply, the BSMs of the supply system have to be parametrized accordingly. For the standard operation, the average drinking water consumption quantities (Q_dm) were recorded and linked to the consumption units. The correct calculation was checked for the reference year by comparing the overall balance of the system with monitored data. For this validation scenario, the consumption factor (f_dx) was set to 1.0 and a runtime of 365 days was selected.

Scenarios were identified on the basis of the hazard analysis (Section 2.1), and system settings were derived from them. The scenarios are defined by the duration of the regarded event, the affected system components, and the usability of the water catchments n. Furthermore, the extent to which a change in drinking water demand is to be expected must be estimated. Changes in drinking water demand are taken into account in the BSM using the consumption factor (f_dx). The consumption factor (f_dx) remains constant over the entire simulation period. If the recovery period after the event is simulated too, this can be carried out as a “hot-start” after the event by switching back all settings to standard.

In the model scenario, the failure of a waterworks (selector switch ‘OFF’) was assumed to last 3 days. A sub-area in the model can continue to be supplied permanently via an emergency network. Such a scenario could be derived, for example, from the failure of a technical component and its subsequent repair.

The approaches chosen in this study are shown in

Table 5. Determining water requirements for emergencies and crises.

Scenario	Consumption Factor (fdx)	Water Requirement (Qdx)	Remarks
Failure of system- relevant-component	${\mathrm{f}}_{\mathrm{d}\mathrm{m}}$= $1.0$	${\mathrm{Q}}_{\mathrm{d}\mathrm{m}}$	No change in consumption behaviour
Pipe burst	${\mathrm{f}}_{\mathrm{d}\mathrm{m}}$= $1.0$	${\mathrm{Q}}_{\mathrm{d}\mathrm{m}}$	No change in consumption behaviour
Hazardous substance input	${\mathrm{f}}_{\mathrm{d}\mathrm{m}}$= $1.0$	${\mathrm{Q}}_{\mathrm{d}\mathrm{m}}$	No change in consumption behaviour
Dry periods	${\mathrm{f}}_{\mathrm{d},7}$= ${\mathrm{Q}}_{\mathrm{d},7}/{\mathrm{Q}}_{\mathrm{d}\mathrm{m}}$	${\mathrm{Q}}_{\mathrm{d},7}$= ${\mathrm{f}}_{\mathrm{d},7}\cdot {\mathrm{Q}}_{\mathrm{d}\mathrm{m}}$	Increased consumption
Blackout	${\mathrm{f}}_{\mathrm{d},\mathrm{E}\mathrm{W}}=\frac{{\mathrm{q}}_{\mathrm{E}\mathrm{W}}\cdot \mathrm{E}}{{\mathrm{Q}}_{\mathrm{d}\mathrm{m},\mathrm{H}\mathrm{B}}}$	${\mathrm{Q}}_{\mathrm{d},\mathrm{E}\mathrm{W}}$= ${\mathrm{f}}_{\mathrm{d},\mathrm{E}\mathrm{W}}\cdot {\mathrm{Q}}_{\mathrm{d}\mathrm{m}}$	Reduced consumption, Qd,EW = 50 l/(P∙d), flat rate industrial and commercial consumption, Qdm,HB= consumption of household and small business
Emergency water supply	${\mathrm{f}}_{\mathrm{d},\mathrm{N}\mathrm{W}}=\frac{{\mathrm{q}}_{\mathrm{N}\mathrm{W}}\cdot \mathrm{E}}{{\mathrm{Q}}_{\mathrm{d}\mathrm{m},\mathrm{H}\mathrm{B}}}$	${\mathrm{Q}}_{\mathrm{d},\mathrm{N}\mathrm{W}}$= ${\mathrm{f}}_{\mathrm{d},\mathrm{N}\mathrm{W}}\cdot {\mathrm{Q}}_{\mathrm{d}\mathrm{m}}$	Qd,NW = 15 l/(P∙d)Determination of emergency water requirements in the event of a mains supply failure

and are described below:

• Scenarios in which no change in drinking water demand is to be expected, such as the failure of a waterworks, were calculated with a f_dx = 1.0. The use of maximum values (Q_d,max) was deliberately avoided in order to prevent the scenarios from overlapping.
• In the event of a prolonged dry period, a f_d,7 > 1.0 was calculated, whereby not the maximum consumption (Q_d,max) but a 7-day maximum was assumed for the increased drinking water quantities in order not to generate an extreme value over a long period of time.
• Reduced consumption rates (f_dx < 1.0) were assumed in the case of area-affecting events such as blackouts. The national specifications for risk management [47] in Germany were selected as the approach for calculating a piped replacement water quantity (Q_d,EW). The total drinking water consumption, including the consumption of industry and commerce, was calculated as a lump sum using the consumption factor for the replacement water supply (f_d,EW).
• The calculation of the non-piped emergency water demand (Q_d,NW) was also based on [47].

The simulation results of the case study are shown in Section 3.3. The consumption approaches are described in more detail in [51,52].

2.3. Measures to Increase Resilience

The BSMs offer the possibility of supporting the planning process to increase the resilience of water supply systems. They can also be used for decision-making in crisis management.

The first step is to identify and plan existing and potential interconnection structures. The planning should take into account possible variants for connection lines, transfer points and an expansion of technical capacities.

The planning objectives selected in the study can be summarised as follows;

• Maintaining the piped drinking water supply during a blackout with as few systems as possible;
• Utilisation of normal operation facilities also for emergencies and crises;
• Creation of redundancies of system-relevant components, e.g., the failure of an entire waterworks, and;
• Consideration of scenario-dependent drinking water consumption.

Once the planning variants have been defined, the consumption rates must be determined. The following consumption rates were selected for planning the systems:

For normal operation:

• National technical standards (in Germany: DVGW regulations).

For emergencies and crises:

• Scenario-dependent consumption estimates according to Table 5,
• Waiver of minimum supply pressure and
• Utilisation of the full technical capacity without taking redundancies into account.

The planning variants are to be mapped in the BSM as extended balance areas, whereby several supply areas are considered in one balance area (Figure 4, Equation (8)).

$$\begin{array}{c}\frac{\mathrm{d}\mathrm{S}\left(\mathrm{t}\right)}{\mathrm{d}\mathrm{t}}=\mathsf{\Sigma }\mathrm{Q}\left(\mathrm{t}\right)=\\ \mathsf{\Sigma }{\mathrm{Q}}_{\mathrm{z}\mathrm{u},1}\left(\mathrm{t}\right)-\mathsf{\Sigma }{\mathrm{Q}}_{\mathrm{a}\mathrm{b},1}\left(\mathrm{t}\right)+\mathsf{\Sigma }{\mathrm{Q}}_{\mathrm{z}\mathrm{u},2}\left(\mathrm{t}\right)-\mathsf{\Sigma }{\mathrm{Q}}_{\mathrm{a}\mathrm{b},2}\left(\mathrm{t}\right)+\dots +\mathsf{\Sigma }{\mathrm{Q}}_{\mathrm{z}\mathrm{u},\mathrm{n}}\left(\mathrm{t}\right)-\mathsf{\Sigma }{\mathrm{Q}}_{\mathrm{a}\mathrm{b},\mathrm{n}}\left(\mathrm{t}\right)\end{array}$$

(8)

The decisive load case for the dimensioning of the systems results from the comparison of the required capacities in normal operation and the consideration of emergency and crisis situations. Detailed descriptions of the planning and consumption approaches can be found in [52].

During a blackout, the necessary diesel supply for emergency power operations can be determined based on the systems to be operated and the production capacities. Careful consideration should be given to whether the external supply can be guaranteed under these conditions or whether self-sufficient supply systems are advisable. A checklist for the construction of company refuelling stations and a tool for determining fuel requirements were developed for the planning and construction of the fuel supply [53].

The planning results of the case study are presented in Section 3.4.

3. Results

3.1. Description of the Case Study

The study area is located in the German state of Saxony. The water supply company in question supplies around 75,000 people with drinking water. There are 21 supply areas with 17 waterworks, 40 pumping stations, 62 drinking water reservoirs, 63 entry and exit points, and 1035 km of drinking water supply pipes. In total, there are 182 system components to be analysed.

3.2. Hazard Analysis

The case study analysed and assessed 57 individual hazards, including 18 natural hazards, 29 technical faults, and 10 hazards caused by attacks, sabotage, or acts of war. A list of the hazards analysed and the results of the investigation can be found in supplementary materials. The detailed hazard analysis is published in [48]. Information on the assessment is provided below, and the assessment is explained using individual examples.

The 18 natural hazards include floods, flash floods, droughts, earthquakes, and pandemics. The extent of damage and the probability of the occurrence of the natural hazards could be determined using existing modelling or statistical evaluations of data series [3,54,55,56,57,58,59,60,61].

For example, incident documentation from the water supplier and local climate projections [59,61] are available for the assessment of dry periods and the development of groundwater recharge. Experience from the dry periods in 2018 and 2019 shows a high level of impact due to: high water demand, declining water supply from the catchments, utilisation of the capacity of the technical systems, and an increased number of pipe bursts with additional personnel requirements. The water supplier suspects that pressure fluctuations due to high consumption and stresses in the dried-out ground are the cause of the high number of burst pipes. According to climate projections [59,61], an increase in dry periods is to be expected across the board. Differences in the forecast data exist in the projection of groundwater recharge. The fluctuations lie between a decrease in groundwater recharge from the current actual level by up to 80% (basis of the climate projection: WETTREG2010_A1B_66) [60] and a slight increase in groundwater recharge (basis of the climate projection: mean annual groundwater recharge (rel. changes)—ensemble median RCP 8.5) [61] by the year 2100. In all simulations, the precipitation dynamics increase. Studies on the development of quality parameters are lacking. Based on the available findings, the impact and the probability of occurrence were assessed as high.

Overall, the results of the natural hazards are site-specific, meaning that their relevance can vary depending on the catchment area. In the study, area, the highest relevance was found for expected climatic changes, such as prolonged dry periods and extreme weather events.

The 29 hazards due to technical malfunctions and human error are made up of, for example, operational organisational hazards, pipe bursts, discharges into the water catchments, or dependencies on other sectors. When assessing the hazards caused by technical faults and human error, different data were found.

The risks of the general company organisation, such as the risk of inadequate substance maintenance, were easy to assess. Here, the water supplier was able to demonstrate a rehabilitation strategy and operation in accordance with DVGW regulations (national regulations). An insufficient reinvestment rate could disrupt the operation of the water supply facilities in the long term, which leads to an assessment of the higher impact on the facilities and the network as well as an assessment of a medium probability of occurrence. Overall, the analysed facilities and the drinking water network are in very good technical condition (network age 37 a, losses < 0.04 m³/(h∙km), and the treatment quality of the distributed drinking water is very high. Possible side effects of risk management measures on drinking water quality can thus be ruled out.

The cross-sectoral impacts on water management, as described by [62], were more difficult to assess. For example, the extent of damage caused by a blackout could be easily determined based on the technical conditions in the study area, but a reliable determination of the probability of occurrence was lacking, which was also found in comparable studies [63,64]. The assessment of special technical incidents sometimes requires expert knowledge, e.g., in the case of nuclear accidents. The probabilities of occurrence and expected extent of damage were determined for the risk of nuclear accidents based on [65,66]. However, validation is hardly possible due to the lack of real events.

In the overall assessment of technical faults, the highest relevance was given to a blackout, the supply of non-drinking water, major pipe bursts, and substance inputs into drinking water catchments, e.g., due to hazardous substances or agricultural inputs.

Of the 10 dangers from attacks, sabotage and acts of war, cyberattacks, sabotage, theft, and attacks of various causes were analysed.

Cyberattacks were identified as a relevant source of risk [16,17,18], although the risk to the technical systems in the study area is considered to be low due to the spatial separation of the systems. In the present case study, the operation of the water supply systems is only at low risk from cyberattacks. The installed technology sends data and cannot receive data. The data are sent using a programming language developed by the water supply company. For this reason, the cyberattack was not analysed further in the case study. As the degree of digitisation increases, cyberattacks are expected to become more relevant.

A high level of damage is conceivable for the other hazards from attacks, sabotage, or acts of war; information on the probability of occurrence could not be researched.

A total of 12 priority hazards (score > 4) were identified. The priority hazards were summarised into 5 scenarios (

Table 6. Priority hazards in the supply area under consideration, adopted from [48].

No.	Source of Danger	Relevance	Evaluation of Scenario Selection, Comments
N-5	Flooding water intake	5.25	1st scenario: Hazardous substance entry
N-7	Dryness	9	2nd scenario: Long dry period with potential deficit in demand coverage
N-10	Storm, tornado, thunderstorm	5.25	3rd scenario: Failure of a system-relevant component
T-1	Company organisation	4.5	Safeguarding via quality, environmental and energy management systems.
T-20	Pipe burst on long-distance water pipe	5.25	4th scenario: Burst pipe on a main supply line
T-21	Feed-in of non-potable water	6.75	1st scenario: Hazardous substance entry
T-22	Power failure short, selective	5.25	3rd scenario: Failure of a system-relevant component
T-23	Long, widespread power outage	6	5th scenario: Widespread power failure
T-24	Information technology failure	4.5	3rd scenario: Failure of a system-relevant component
T-28	Accidents involving hazardous substances	6	1st scenario: Hazardous substance entry
T-29	Water pollution	4.5	1st scenario: Hazardous substance entry
T-30	Agricultural entries	6	1st scenario: Hazardous substance entry
A-3	Inadequate property protection, burglary, theft, vandalism	4.5	3rd scenario: Failure of a system-relevant component

) and form the basis for scenario identification as the next step in the risk analysis.

3.3. Vulnerability Analysis with Balance Sheet Structure Models

The 21 supply areas of the water supplier in question were modelled in 19 BSMs. The balance areas of the models vary between 20,470 inhabitants with 52 system components and 10 inhabitants with 3 system components. The year 2018 was selected as the reference year with a prolonged dry period. The choice of the reference year 2018 is considered a realistic load assumption for a low water supply in the coming years. A reference scenario with normal consumption was created to calibrate the models.

The following scenarios were selected from the relevant hazards (Section 3.2) as input variables for the simulation:

• Hazardous substance input into a water intake, duration 30 d, average water consumption;
• prolonged dry period in the entire supply area, duration 110 d, increased water consumption;
• failure of a system-relevant component, runtime 7 d, average water consumption;
• pipe burst on a main supply line, duration 2 d average water consumption;
• power failure across the board, duration 7 d, replacement water consumption.

A total of 90 simulations were carried out to show the existing vulnerability. The simulation results are shown in Figure 5, clustered according to interconnection possibility and size.

The analysis of the case studies documents the existing vulnerability and, as expected, shows the most critical impact in the scenario of a widespread power outage. However, the failure of system-relevant components can also lead to massive supply disruptions. In these scenarios, systems with interconnected lines are less vulnerable. The cause of the failure of system-relevant components is initially independent of the system impact but influences the time until normal operation is restored. By intersecting the expected downtime with the remaining supply time, the scenarios can be further analysed accordingly.

3.4. Measures to Increase Resilience

In the study, measures to increase resilience were analysed in accordance with the specifications in Section 2.3. A detailed description of the plan is not possible in order to protect the sensitive data of the supplier. Abstract planning principles for the dimensioning of an intermediate pumping station are published in [52].

In the study, area, the preferred option is the construction of interconnected pipelines and the expansion of the technical capacity of two intermediate pumping stations. The planned measures can almost completely compensate for the failure of individual waterworks (the system-relevant component) and also significantly increase resilience to a blackout (comparison of Figure 6 and Figure 7). By operating just one waterworks and two intermediate pumping stations that are connected to the district water supply, 75% of the population in the study area can continue to be supplied in the event of a blackout (Figure 7). The fuel supply of the remaining plants was planned and constructed according to the specifications of [53].

The production capacities required for emergencies and crises were determined by analysing the extended balance area and the scenarios to be considered. The full system capacities and no redundancies were taken into account in the event of an emergency or crisis. In the case study, the scenario of a prolonged dry period and the associated failure of a near-surface groundwater catchment were relevant to the design.

4. Discussion

The hazard analysis methodology presented corresponds to the requirements of European risk management [20,21] and identifies potential hazards to the public water supply with technical justification. The categorisation, with subsequent quantification, achieves a clearly comprehensible order and reduces the subjective component. However, the assessment of each individual hazard requires extensive research. The results of the research show that there is not always sufficient data available for an exact assessment, for example, of the probability of a blackout occurring. The subjective component increases, especially when there is little data available, which can lead to inaccuracies in the process. In addition, the assessment of some hazards, such as the effects of a nuclear accident, requires expert knowledge. As a rule, the expert knowledge required to assess the aforementioned hazards is only available to a limited extent at the water supply company.

For this reason, it is proposed that a minimum scope (

Table 7. Minimum scope of the hazard analysis, adopted from [48].

Natural Hazards	Technical and Human Error	Attacks, Sabotage, Acts of War
Flood	Failure of individual systems *	Cyberattack
Flash flood	Pipe burst on composite pipes
Dryness	Blackout *
Earthquake	Accidents with hazardous substances
Large and wildfires
Epidemic, pandemic

* Priority use for scenario building.

) of the hazards to be considered be specified by a higher authority. The hazards contained in Table 4 were developed from the findings of the literature [63,64] and are based on the database of the present study.

As part of risk management in accordance with [20,21], the next step is to carry out a risk assessment. The extent of damage is determined by creating scenarios derived from the hazard analysis and a vulnerability analysis using the BSM. The BSM represents a useful addition to existing instruments for determining vulnerability [24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42]. The differences in the existing literature are summarised below:

• Compared to hydraulic simulations with pipe network models [24,25,26,27,28,29,30,31,32,33,34,35,36,37], the system structure is depicted in a much simpler way. The exact pipe routing, elevation data, pipe dimensioning, material data, and consumption curves are only indirectly taken into account in the BSM by modelling a functioning system in terms of a balance. The hydromechanical limit values are taken into account via the capacity data of the system components and are not verified in the simulation of the BSM.
• A comparison of the system dynamics models [38,39,40,41,42] shows that the BSMs map the causal operating conditions directly on the basis of the real system structure and the topology of the water supply and not via abstracted chains of effects. The simulation of the BSM is carried out using selected system settings under constant conditions. In contrast to the system dynamics models, it is not possible to model dynamic system conditions in the BSM, which could lead to uncertainties in the calculation results of the BSM.

The BSM therefore replaces complex hydraulic or system dynamic models with a graph-based semi-dynamic balance. However, due to the simplified system structure of the BSM, these are not suitable for an exact determination of water demand or hydraulic simulation. The simulation result provides a visual representation of the vulnerability in relation to the topology and a time-dependent forecast of the extent of damage, indicating the affected inhabitants. In addition, the simulation is used to estimate drinking, replacement, and emergency water requirements.

The consumption calculations were carried out under constant conditions. Excess or reduced quantities were selected depending on the scenario under consideration and taken into account as a lump sum in the models via the consumption factor (f_dx). The international data on replacement and emergency water requirements [43,44,45,46,47] contain different consumption estimates. The validation of the consumption approaches is only possible to a limited extent due to a lack of data on known emergencies and crises. In addition, a scenario-dependent consumption analysis has (to our knowledge) not yet been described. However, the authors believe that a scenario-dependent consumption analysis is important in order to adapt the measures to increase resilience to the actual drinking water demand. For example, when considering dry periods, peak values such as Q_d,max should not be used, and moderate increases in consumption such as Q_d,7 should be applied. In the case of widespread events such as a blackout, for example, a reduced consumption approach appears to be correct, as reduced consumption behaviour can also be expected here due to the lack of power supply, e.g., lack of hot water supply, non-operation of washing machines or dishwashers and reduced consumption in the industrial and commercial sectors. The following consumption approaches based on scenarios are proposed as part of the initial parameterisation of the BSM;

• f_dx > 1.0 Application during dry periods as f_d,7;
• f_dx = 1.0 Application for scenarios that do not exceed normal consumption; Utilisation of f_dm, e.g., the failure of a waterworks;
• f_dx < 1.0 Application for determining replacement of f_d,EW and the emergency water volumes f_d,NW in the case of large-scale events such as blackouts.

Due to the existing uncertainties regarding the input parameterisation of the BSM, the simplified model structure with limited accuracy in the assessment of the replacement and emergency water demand appears to be sufficient. As expected, the evaluation of the case studies shows the most critical impact in the scenario of a widespread power outage, with a very high vulnerability up to a total failure of the piped drinking water supply. However, the failure of system-relevant components can also lead to massive supply interruptions. In systems with interconnected pipelines, a significantly higher resilience of the piped water supply could be demonstrated.

Measures to increase resilience must be identified for risk control as the final step in risk management, according to [20,21]. BSM can support the identification and planning of measures. In particular, with the help of an extended balance area, measures can be identified that enable a piped drinking water supply with as few systems as possible. This enables transparent optimisation of the use of resources in risk management. The following principles are proposed for the future consideration of emergencies and crises when designing systems;

• Risk analyses of the water supply systems, taking into account the relevant hazards;
• Maintaining operations with a minimum number of systems;
• Waiver of minimum supply pressure;
• Utilisation of the full technical capacity without consideration of redundancies for emergencies and crises;
• Scenario-dependent consumption estimates according to Table 2.

The implementation of the planning principles was evaluated using a case study. It was demonstrated that the resilience of the drinking water supply systems can be significantly increased by taking into account the necessary pumping capacities for emergencies and crises. Specifically, interconnected pipes and transfer points were created, the pumping capacity of two intermediate pumping stations was increased, and three emergency power generators were procured. With the measures described above, 75% of the population can be supplied in the future with the operation of just three systems in the event of a blackout.

Compared to advanced risk management instruments, the proposed approach is fairly straightforward and oriented to operators needs and capacities. Each step can be performed without specific expert knowledge. This applies also to BSMs, which can be developed and parametrized by operators and coded with standard office software. The lack of detail appears sufficient in view of the uncertainties when selecting operational parameters for an assumed crisis/disruption.

5. Conclusions

What findings does the study provide for the application of the developed risk management instruments in water management?

The hazard analysis step is very extensive and requires expert knowledge in several fields. It should therefore be considered that a meta-hazard analysis is first carried out by a higher water authority to prioritise relevant hazards. The limited number of prioritised hazards should then be made available to the water supplier to reduce the workload not only in the hazard analysis itself but also in the subsequent risk management steps.

There are many good tools for assessing the resilience of pipework systems [24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42]. The known methods are complex and require sufficient and qualified data for an exact simulation. Particularly in view of the deficits in the preparation and practical application of risk analyses [5,22,23], BSMs can lower the application threshold due to their simplicity and thus make a valuable contribution to the implementation of risk management.

Measures must be identified and planned to increase the resilience of the network-based drinking water supply. There is a lack of reliable standardised specifications for planning outside of normal operation. An increase in resilience could be achieved in the case study through interconnected pipelines and by expanding the capacity of existing systems. Operation with a minimum number of plants should also be made possible in order to ensure operation even in the event of large-scale events.

Where is there a need for further research into the implementation of risk management in water supply companies?

There is a specific need for research in the study area with regard to a more precise forecast of the quantitative and qualitative development of the usable groundwater supply.

The heterogeneous quantity approaches in international comparison [43,44,45,46,47], especially for the requirements for a replacement water supply, lead to uncertainties in the risk analysis and also in the planning of measures to increase resilience. Cross-national standards, norms, or legal foundations should be developed on the basis of further investigations. This requires a systematic evaluation of water consumption in historically recorded emergency and crisis situations, as well as considerations for controlling water withdrawal in such situations.

In which other areas could BSM be used?

The use of BSMs in crisis management is also conceivable in the future. BSMs are easy to use, do not require any special software, and deliver simulation results quickly. The simulation results can also be used to determine ad hoc effects in the system, such as the separation of sub-areas and the resulting emergency water requirements.