ADVANCED WATER

DISTRIBUTION MODELING
AND MANAGEMENT
Authors
Thomas M. Walski
Donald V. Chase
Dragan A. Savic
Walter Grayman
Stephen Beckwith
Edmundo Koelle

Contributing Authors
Scott Cattran, Rick Hammond, Kevin Laptos, Steven G. Lowry,
Robert F. Mankowski, Stan Plante, John Przybyla, Barbara Schmitz

Peer Review Board

Lee Cesario (Denver Water), Robert M. Clark (U.S. EPA),
Jack Dangermond (ESRI), Allen L. Davis (CH2M Hill),
Paul DeBarry (Borton-Lawson), Frank DeFazio (Franklin G. DeFazio Corp.),
Kevin Finnan (Bristol Babcock), Wayne Hartell (Bentley Systems),
Brian Hoefer (ESRI), Bassam Kassab (Santa Clara Valley Water District),
James W. Male (University of Portland), William M. Richards
(WMR Engineering), Zheng Wu (Bentley Systems ),
and E. Benjamin Wylie (University of Michigan)

Click here to visit the Bentley Institute

Press Web page for more information
 C H A P T E R

11
Water System Security

The security of water systems has long been a concern in the water industry. The
potential for natural, accidental, and purposeful contamination or other events that
would hinder the ability of the system to provide a safe water supply has been the sub-
ject of many studies. In May 1998, President Clinton issued Presidential Decision
Directive (PDD) 63, which outlined a policy on critical infrastructure protection,
including our nation’s water supplies. However, it wasn’t until the terrorist events of
September 11, 2001, that the water industry truly focused on the vulnerability of our
nation’s water supplies to terrorist activities.

11.1 WATER SYSTEM VULNERABILITY

Because water systems are spatially diverse (see Figure 11.1), they are inherently vul-
nerable to a variety of activities that can compromise the system’s ability to reliably
deliver sufficient water at an acceptable level of quality. There are several areas of
vulnerability as water travels to the customer. These areas include (1) the raw water
source (surface or groundwater); (2) raw water canals and pipelines; (3) raw water
reservoirs; (4) the treatment facilities; (5) connections to the distribution system
pipes; (6) pump stations and valves; and (7) finished water tanks and reservoirs. Each
of these system elements presents unique challenges to the water utility in safeguard-
ing the water supply. These challenges include
• Physical disruption that prevents sufficient water flow at an acceptable pres-
sure to all customers
• Contamination of the water delivered to the customer by a chemical or bio-
logical agent such that the product is not safe to use or is not of an acceptable
quality to the customer
• Loss of confidence by customers in the ability of the water utility to deliver a
safe and secure water supply
500 Water System Security Chapter 11

Figure 11.1
Major points of
vulnerability in a
Reservoir
water supply system
Tanks

Canals &
Pumps
Pipes

Wells
Distribution System
River

Water systems are vulnerable to natural, purposeful, or accidental events that can
challenge the security of the system. Examples of each of these types of events
include the following:
• Natural events: Floods, earthquakes, fire, severe weather (droughts, hurri-
canes, tornadoes, and so on), sinkholes, and natural contamination of surface
or groundwater sources
• Purposeful events: Terrorist or criminal contamination, vandalism, or
destruction
• Accidental events: Accidental discharges of pollutants into source waters,
cross-connections between the water distribution system and waste collec-
tion system, vehicle and pipeline accidents, and explosions

11.2 POTENTIAL WATER SECURITY EVENTS

Physical Disruption
The ability of a water supply system to provide water to its customers can be compro-
mised by damage or destruction of key physical elements of the water system. Key
elements include raw water facilities (for example, dams, reservoirs, pipelines, and
canals), treatment facilities, and finished water elements (such as transmission lines
and pump stations).
In general, physical disruption can result in disruption of service, significant eco-
nomic cost, inconvenience, and loss of confidence by customers, but the direct threat
to human health is generally limited. Exceptions to this generalization include (1) the
destruction of a dam that causes loss of life and property in the accompanying flood
wave and (2) an explosive release of chlorine gas at a treatment plant that produces a
cloud injurious or lethal to nearby populations.
Section 11.2 Potential Water Security Events 501

Some Prominent Historic Events

in Water System Security
Bibilical times – The Nile River is turned to 1980s – Lawsuit and trial in case of industrial
“blood” in the first plague in the Book of Exodus contamination in Woburn, Massachusetts
requiring Egyptians to turn to wells as an alter- (USA) was subsequently profiled in the book
nate water supply. and movie A Civil Action.
19th Century – Cholera outbreaks in London 1993 – Flooding in Iowa (USA) disrupted water
led to the identification of water supply as the service to 250,000 customers of the Des
major culprit by Dr. John Snow. Moines Water Works.
1860s – During the Civil War, soldiers shot and 1993 – 400,000 people in Milwaukee (USA)
left farm animals in ponds to poison the water became ill from Cryptosporidiosis carried in the
supply so that advancing troops couldn’t use it. public water supply.
1941 – J. Edgar Hoover, director of the FBI, 1998 – President Clinton issued Presidential
acknowledged that “water supply facilities offer Decision Directive 63, which designated water
a particularly vulnerable point of attack to the systems as one of the country’s critical infra-
foreign agent.” structures and outlined a policy for protecting it.
1940s – During World War II, water supplies September 11, 2001 – Attack on the World
were purposely contaminated in China (bacte- Trade Center and Pentagon demonstrated con-
ria) and Bohemia (sewage). clusively that the United States is vulnerable to
1978 – Carbon Tetrachloride spill on the terrorist attacks.
Kanawha River resulted in contamination of
water supplies on the Ohio River and led to
establishment of an early warning system.

Water utilities should examine their physical assets, determine their areas of vulnera-
bility, and increase security accordingly. For example, switching from chlorine gas to
liquid hypochlorite, especially in less secure locations, decreases the risk of exposure
to poisonous chlorine gas. Also, redundant system components can limit disruption of
service by providing backup capability in case of accidental or purposeful damage to
facilities.

Contamination
The ability to deliver water of an acceptable quality can be compromised by the pres-
ence of contaminants in the raw or finished water supply. Contaminants can enter the
water supply through natural causes, accidental spills or events, or purposeful terrorist
or criminal acts. As illustrated in Figure 11.1, there are many potential locations
where a contaminant can enter the water system. Locations include raw water sources
(surface or groundwater), raw water delivery systems, the treatment facility, or the
actual distribution system. Water treatment is the primary barrier to contaminants
reaching the customer but may not be effective for some constituents found in the raw
water and is not effective for contaminants that enter the finished water in the distribu-
tion system. Maintenance of a secondary disinfectant residual in a distribution system
provides protection from some bacterial agents but is not effective for all constituents.
502 Water System Security Chapter 11

Contamination has long been viewed as a serious potential terrorist threat to water
systems (Hoover, 1941). Chemical or biological agents could spread throughout a dis-
tribution system and result in sickness or death among people drinking the water. For
some agents, the presence of the contaminant would not be known until emergency
rooms reported an increase in patients with a particular set of symptoms. Deliberate
chemical and biological contamination of water supply systems is nothing new (Hick-
man, 1999; Deininger, 2000; Clark and Deininger, 2000). Such terrorist activities
were reported in ancient Rome (cyanide), in the United States during the Civil War
(animal carcasses in farm ponds), in Europe and Asia during World War II (anthrax,
cholera, and sewage), and, more recently, in Kosovo (paints, oil, and gasoline in
wells). Deininger and Meier (2000) discuss the topic of deliberate sabotage of water
supply systems.
Accidental contamination of water systems has resulted in many fatalities and ill-
nesses, as well. Examples of such outbreaks include (but are not limited to) E. coli
contamination in Walkerton, Ontario (Canada) (Haestad Methods, 2002), cholera
contamination in Peru (Craun et al., 1991), cryptosporidium contamination in Mil-
waukee, Wisconsin (USA) (Fox and Lytle, 1996), and salmonella contamination in
Gideon, Missouri (USA) (Clark et al., 1996).
The U.S. Army has compiled information on potential biological agents (Burrows and
Renner, 1998). Table 11.1 summarizes this information on agents that may have an
impact on water systems.

There are many factors that should be considered in evaluating the potential threat
from different chemical and biological agents. Following is a summary of some of
these factors:

• Availability: Is the agent readily available or difficult to obtain?

• Monitoring response: Can the agent be detected by monitoring equipment?
• Physical appearance: Is there a telltale odor, color, or taste associated with
the agent?
• Dosage/health effects: What dosage is required to have effects on human
health?
• Chemical and physical stability in water: How long will the agent be sta-
ble in water?
• Tolerance to chlorine: Are chlorine or other disinfectants effective in neu-
tralizing the agent?

Deininger and Meier (2000) ranked various agents and compounds in terms of their
relative factor of effectiveness, R, based on lethality and solubility using the following
equation:

R = solubility in water (in mg/L) / (1000 x lethal dose (in mg/human)) (11.1)

Table 11.2 lists values of R for various biological agents and chemicals by decreasing
level of effectiveness (that is, decreasing degree of toxicity in water).
Section 11.2 Potential Water Security Events 503

Table 11.1 Potential threat of biological weapons agents

Agent Type Weaponized Water Threat Stable in Water Chlorine1 Tolerance
Anthrax Bacteria Yes Yes 2 years (spores) Spores resistant
Brucellosis Bacteria Yes Probable 20-72 days Unknown
C. perfringens Bacteria Probable Probable Common in sewage Resistant
Tularemia Bacteria Yes Yes Up to 90 days Inactivated, 1 pm, 5 min
Glanders Bacteria Probable Unlikely Up to 30 days Unknown
Meliodosis Bacteria Possible Unlikely Unknown Unknown
Shigellosis Bacteria Unknown Yes 2-3 days Inactivated, 0.05 ppm, 10 min
Cholera Bacteria Unknown Yes ‘Survives well’ ‘Easily killed’
Salmonella Bacteria Unknown Yes 8 days, fresh water Inactivated
Plague Bacteria Probable Yes 16 days Unknown
Q Fever Rickettsia 2
Yes Possible Unknown Unknown
Typhus Rickettsia Probable Unlikely Unknown Unknown
Psittacosis Rickettsia-like Possible Possible 18-24 hours, seawater Unknown
Encephalomyelitis Virus Probable Unlikely Unknown Unknown
Hemorrhagic fever Virus Probable Unlikely Unknown Unknown
Variola Virus Possible Possible Unknow Unknown
Hepatitis A Virus Unknown Yes Unknown Inactivated, 0.4 ppm, 30 min
Cryptosporidiosis Protozoan 3
Unknown Yes Stable days or more Oocysts resistant
Botulinum toxins Biotoxin4 Yes Yes Stable Inactivated, 6 ppm, 20 min
T-2 mycotoxin Biotoxin Probable Yes Stable Resistant
Aflatoxin Biotoxin Yes Yes Probably stable Probably tolerant
Ricin Biotoxin Yes Yes Unknown Resistant at 10 ppm
Staph enterotoxins Biotoxin Probable Yes Probably stable Unknown
Microcystins Biotoxin Possible Yes Probably stable Resistant at 100 ppm
Anatoxin A Biotoxin Unknown Probable Inactivated in days Unknown
Tetrodotoxin Biotoxin Possible Yes Unknown Inactivated, 50 ppm
Saxitoxin Biotoxin Possible Yes Stable Resistant at 10 ppm
Based on Burrows and Renner (1998)
1 – Ambient temperature, <1 ppm free available chlorine, 30 minutes, or as indicated
2 – Parasites that are pathogens from humans and animals
3 – Consisting of one cell or of a colony of like or similar cells
4 – Toxic to humans

Source Water Contamination. Contamination of source water is of signifi-

cant concern because of the many potential locations where contaminants can enter
surface water or groundwater sources and the difficulty in providing security over an
entire source water area. Fortunately, a contaminant entering source water is subject
to dilution, chemical reactions, exposure to sunlight, and treatment, and thus the con-
centration may be significantly reduced by the time it enters a water distribution sys-
tem. Contamination of source waters may be caused by natural hydrologic processes,
accidental releases of contaminants, or purposeful dumping of pollutants into the
water.
504 Water System Security Chapter 11

Table 11.2 Relative toxicity of poisons in water

Compound R
Botulinus toxin A 10,000
VX 300
Sarin 100
Nicotine 20
Colchicine 12
Cyanide 9
Amiton 5
Fluoroethanol, sodium, fluoroacetate 1
Selentie 1
Arsenite, arsenate 1
Based on Deininger and Meier (2000)

The primary mechanism for identifying and responding to source water contamina-
tion is an early warning system. An early warning system is a combination of equip-
ment and institutional arrangements and policies that are used in an integrated manner
to achieve the goal of identifying and responding to contaminants in the source water.
An effective early warning system includes the following components (Grayman,
Deininger, and Males, 2002):

• A mechanism for detecting the likely presence of a contaminant in the

source water
• A means of confirming the presence of the contamination, determining the
nature of the contamination event, and predicting when (and for how long)
the contamination will affect the source water at the intake sites and the
intensity (concentration) of the contamination at the intake
• An institutional framework generally composed of a centralized administra-
tive unit that coordinates the efforts associated with managing the contami-
nation event
• Communication linkages for transferring information related to the contami-
nation event
• Various mechanisms for responding to the presence of contamination in the
source water in order to mitigate its impacts on water users

The central component of an early warning system is the detection of a contaminant

event so that mitigative actions can be taken if needed. The three basic mechanisms
for detecting spills and other contaminant events are monitoring, self-reporting by the
facility causing the spill, and siting and reporting an event by the public or outside
groups. An effective early warning system generally combines all three mechanisms.
A wide range of online monitoring equipment is available that can be used as part of
an early warning system (AwwaRF, 2002). Conventional sensors, which include dis-
solved oxygen, pH, conductivity, temperature, and turbidity, are relatively inexpen-
sive, widely available, and easily used, but they provide little useful information in
Section 11.2 Potential Water Security Events 505

identifying the presence of most transient contaminants. More advanced online moni-
tors, such as gas chromatographs and spectrophotometers are more expensive and
require greater expertise and maintenance, but they are more effective as part of an
early warning system.
Examination of online monitors around the world has shown that given sufficient
resources, almost all analyses can be automated if there is a perceived need. Biomon-
itors utilize living aquatic organisms (such as fish, mussels, daphnia, and bacteria) and
measure the stresses placed on the organisms by contaminants in the water. They do
not provide information on the specific contaminant but rather “raise a red flag” that
there is something unusual in the water that is affecting the organisms used in the
biomonitor. Although they have been in use now in many places for almost 20 years,
the field of biomonitoring still appears to be an emerging technology. Other emerging
technologies that may have future utility in early warning systems are generally being
developed in other fields and include electronic noses, DNA chips, flow cytometry,
immuno-magnetic separation techniques, and online bacteria monitors. The current
state of the art in identification of microbial contamination in drinking water has been
summarized by Sobsey (1999).
If the presence of a contaminant is identified in source water, several responses can be
taken to mitigate the impacts of a spill event:
• Closure of water intakes and use of alternate sources
• Cleanup of the spill prior to impacting water intakes
• Enhanced temporary chemical treatment at the treatment plant
• Public notification
506 Water System Security Chapter 11

Closure of water intakes provides the most absolute barrier to a contaminant impact-
ing a drinking water supply but is effective only if the presence of a contaminant is
identified prior to entering the water intake and is limited by the length of time that a
water utility can close their intake and still provide a sufficient supply of water.
Cleanup within the source water body itself is practical for only a limited range of
pollutants (such as some petroleum products, which can be physically separated from
the water body). Enhanced chemical treatment can include addition of coagulants,
carbon, disinfectant, or other chemicals. In order to be effective, the chemical nature
of the contamination must be known and the proper chemical dosage determined.

If contamination has not been identified in the source water, the only line of defense is
the normal treatment processes that are online at the time of the event. Table 11.3 con-
tains typical contaminant removal ranges for various treatment types and contaminant
categories. Actual removal rates depend on specific designs, the chemical characteris-
tics of the raw water, temperature, and so on. Other treatment options that provide
additional barriers to contaminants reaching the water user include regular use of
granular activated carbon, and groundwater injection and subsequent harvesting of the
water. Another mechanism, raw water storage, provides a time lag between the water
intake and water treatment, thus potentially allowing for additional testing prior to the
use of the water.

Table 11.3 Effectiveness of processes for contaminant removal

Taste &
Bacteria Viruses Protozoa VOC SOC TOC
Odor
Aeration, air  P P P G-E P-F F F-E
stripping
Coagulation,  G-E G-E G-E G-E P P-G P-G
sediment/filtration
Lime softening G-E G-E G-E P-F P-F G P-F
Ion exchange P P P P P G-E -
Reverse osmosis E E E F-E F-E G -
Ultra filtration E E E F-E F-E G -
Disinfection E E E P-G P-G G-E P-E
Granular  F F F F-E F-E F G-E
activated carbon
Powdered  P P P P-G P-E F-G G-E
activated carbon
UV irradiation E E E G G G G
Based on AWWA (1990)

Abbreviations: P – Poor (0–20% removal); F – Fair (20–60% removal); G – Good (60–90% removal); E – Excellent (90–100% removal);
- Insufficient Data; VOC – volatile organic chemicals; SOC - synthetic organic chemical; TOC - total organic carbon

Contamination of Distribution System. Water distribution systems are

usually closed systems that are generally more secure than raw water sources. How-
ever, the implications of contamination directly into the distribution system are poten-
tially much more severe for the following reasons:
Section 11.2 Potential Water Security Events 507

• No treatment exists to provide a barrier (other than residual disinfectant)

• Monitoring within a distribution system is generally quite limited

• The travel time between a point of contamination in the distribution system

and customers can be quite short

• If a contaminant is not detected before it reaches a distribution system stor-

age facility, contaminated water may reach many customers over an
extended period of time

Potential points of contamination within the distribution system include the follow-
ing:

• Water treatment plant: Treatment plants are the interface between the raw
water source and the distribution system. They are especially vulnerable
because the entire water supply goes through the plant. Clearwells at the end
of the treatment should receive special attention. In the clearwells, a large
amount of supply is concentrated in a single location. A contaminant added
at that point can impact the entire water supply leaving the plant for a period
of many hours. Treatment plants generally have some form of security, and
large plants have around the clock personnel.

• Pump stations and valves: These components are potential points of con-
tamination because a large amount of flow may be passing through these
points at any given time. Thus, any contaminant injected at these locations
could impact many downstream customers.

• Finished tanks and reservoirs: Tanks and reservoirs are vulnerable because
they contain a relatively large quantity of water at a single location, are fre-
quently located in isolated locations, are generally maintained at atmo-
spheric pressure, and usually have access to the interior for maintenance
purposes. Open reservoirs are especially vulnerable because of the open
access to the contents, but they are also relatively rare. Because of the quan-
tity of water in storage in a tank or reservoir, a significant amount of contam-
inant is needed to impact the water quality. Once a sufficient amount of
contaminant is added and mixed with the water in the tank, the water quality
in the distribution system fed by the tank can be impacted for many days
until the fill and draw process has sufficiently diluted the contaminant. This
process is shown graphically in Figure 11.2, where it would take approxi-
mately 12 days for the concentration to be reduced by 90 percent from its
initial peak concentration.

• Hydrants: Hydrants are located on relatively major lines throughout water

systems providing fire protection. There are no recorded instances of terror-
ists pumping contaminated water into the system through a hydrant, but
there have been cases of accidental backflow from tankers that were being
filled directly from hydrants.
508 Water System Security Chapter 11

Figure 11.2
Decline in
concentration of a 0.30
well-mixed
contaminated tank
0.25
Calculated Concentration, mg/l

0.20

0.15

0.10

0.05

0.00
0 48 96 144 192 240 288
Time, hr

• Distribution system connections: A pump that is capable of overcoming

the system pressure could inject contaminants into the system affecting
nearby customers or larger areas of the distribution system depending on the
location and amount of water pumped into the system.

11.3 ASSESSMENT OF VULNERABILITY

The purposes of a vulnerability study or assessment are
• To examine facilities to determine their vulnerability to various events that
could threaten their ability to achieve their specific operational purposes
• To assess and prioritize the risks associated with the facilities and operations
of the water system
• To develop a program to reduce risks and respond in case of events that
could threaten the water system
Formal vulnerability assessments have been applied to facilities that have been recog-
nized as vulnerable to terrorist or natural events that could result in significant conse-
quences. Examples of such facilities include nuclear power plants, military bases, and
federal dams. Transfer of such methods to water systems is a recent and ongoing
development (Sandia National Laboratories, 2001). Such assessments can employ
formalized information collection and analysis tools, or more simply, a set of check-
lists, protocols, and procedures.
Section 11.3 Assessment of Vulnerability 509

Water System Vulnerability Checklist

SOURCE WATER STORAGE
Wells • Is the structure covered, fenced, locked, well
• Are the wells covered, preferably in perma- lit, with an area clear of vegetation and obsta-
nent, secured structures? cles?

• Are the wellheads covered and locked? • Can the structure be isolated from the sys-
tem?
• Are the wells with vents not easily accessi-
ble? • Are manholes/access ports and vents locked
and secured?
• Is the area fenced, well lit, and clear of vege-
tation and obstalces?
DISTRIBUTION
Surface Sources • Is the system above ground or below ground?
• Are intakes accessible? If so, can their vul- Can it be tampered with?
nerability be reduced? • Are there valve pits on the system? Are the
facilities fenced, locked, and secured? Who
Local Supplies has access to them?
• Who operates and maintains them? • Are pits located upstream from critical facili-
• Are there controlling valves between the sys- ties?
tems? Who controls them?
• Do they have an adequate vulnerability PERSONNEL
reduction program?
• Who has access to any components of the
water system?
Alternate Emergency Sources Identified
• Are such personnel reliable? Have they been
• Is bottled water available? Does it meet pre-
ventive medicine standards? checked out?
• How are keys and combination locks secured
• Is there an adequate supply? Is it secure?
and managed?

TREATMENT
SECURITY PATROLS
• How is water disinfected? Is chlorine used?
• Are they regularly conducted? If so, how
• Are chlorine levels checked throughout the often and on what sites? Is this sufficient?
system, by whom, and how often?
• Is there remote monitoring of critical points
• What other chemicals are added? and/or processes? Is it necessary?
• How and by whom are the process and the
concentration monitored?
SAMPLING/DETECTION
• Could treatment process(es) be modified to
• How often are chlorine residual measure-
prevent injection of unwanted material?
ments done and where?
• Is the facility secured, is it monitored, how
• What type of monitoring capability exists?
often?
• Are there adequate contingency plans?
• Are the grounds fenced, locked, with an area
clear of vegetation and obstacles, and is it • Do medical facilities identify and track a
well lit? waterborne epidemic?
(Hickman, 1999)
510 Water System Security Chapter 11

Whichever approach is adopted, the vulnerability analysis can be framed in the con-
text of managing the risks within the water system. The basic framework for consider-
ing risk analysis consists of the interwoven areas of risk assessment and risk
management. Risk analysis recognizes that it is impossible to eliminate all risks but
that risks can be identified, assessed, managed, and balanced with other resources so
that the resulting risks are within an acceptable level. Quite simply, risk analysis can
be embodied in a series of questions, such as the following.

Assessment
• What can go wrong?

• How can it happen?

• How likely is it to happen?
• What are the consequences?
Management
• What questions should the risk assessment answer?
• What can be done to reduce the impact of the risk described?
• What can be done to reduce the likelihood of the risk described?

• What are the trade-offs of the available options?

• What is the best way to address the described risk?

Inspections and Checklists

In conducting a vulnerability analysis, water utilities can develop a set of inspection
protocols and a checklist of items. The inspection protocol includes items such as
examination of design plans, field inspection of the facilities, and review of the opera-
tional and maintenance procedures within the water utility.

Formal Assessment Tools and Methods

Vulnerability assessments of water systems can involve a large number of facilities
and a wide range of potential risks and solutions. There are various methods and tools
available to help a water utility to organize, manage, and assess such information.
Examples of such tools include fault trees, event trees, decision trees, Monte Carlo
simulations, and computer simulations.

Fault Trees. Sandia National Laboratories in conjunction with the EPA and
AwwaRF developed a water system vulnerability assessment training package. This
stemmed from a performance-based vulnerability assessment methodology initially
developed by Sandia for the nuclear security area and later applied to security of fed-
eral dams. The central component of this analysis is a risk assessment process shown
schematically in Figure 11.3.
Section 11.3 Assessment of Vulnerability 511

Figure 11.3
Risk assessment
process applied to
Characterize
Context water systems (Sandia
Assets
National Laboratories,
2001)
Determine
Prioritize Targets
Consequence

Define
Protection Goals
Threats

Define
Protection Systems
Safeguards

Analyze
System Risks

No Risks Yes
Proposed Upgrades Acceptable END
?

One of the tools applied in the Sandia assessment is a fault tree. Figure 11.4 illustrates
an example of a generic fault tree applied to a water system. A fault tree is a top-down
method of analyzing system design and performance. The top event is an undesired
state of the system—in this case, defined as an occurrence that will result in the water
utility being unable to meets its mission of supplying safe water to its customers. In
the second level, specific credible ways that could result in not meeting this mission
are enumerated, such as interruption of the raw water supply, treatment capability, or
distribution.

The fault tree continues down with events being combined either through AND or OR
gates. An AND gate indicates that multiple events must occur simultaneously for the
higher level event to occur while OR gates indicate that either of two or more events
could lead to the higher level event occurring. The lowest level of detail depicted in
the graphical fault tree is referred to as a basic event. In the example shown, the basic
events are referred to as “undeveloped” events because they may be broken down into
more detail. (That level of detail is not shown in the diagram.)

The fault tree can be viewed as a graphical depiction of events that would lead to the
overall system failure. Alternatively, it may take on more of a quantitative tool by
assigning probabilities of occurrence to the basic events and then, by following the
tree upward, calculating the overall probability of the top event occurring.
512 Water System Security Chapter 11

Figure 11.4
Sample fault tree for
water system (Sandia
National Laboratories,
2001)

Monte Carlo Simulation. Monte Carlo simulation is a well-known technique

for analyzing complex physical systems where probabilistic behavior is important.
Grayman and Males (2001) developed a Monte Carlo simulation of a source water
early warning system to test the effectiveness of alternative designs. Spill events are
represented as probabilistic occurrences (that is, probability distribution of stream-
flows, probabilities of spills of different substances, magnitudes and duration, and so
on). The relationships of these events (for example, how a river responds to a spill) are
embodied in the model, which is then run many times, with varying inputs based on
the probabilities of the events. This model was applied to the Ohio River to study the
effectiveness of alternative early warning system designs (for example, monitor loca-
tions, monitoring frequency, response policies, and so on) on the resulting water qual-
ity of the finished water supply.

Computer Simulation Models. Simulation models are another tool that can
be used in vulnerability studies to help a water utility understand how their system
will respond to an accidental or purposeful physical or chemical event. This under-
standing can be used to identify the consequences of such events, to test solutions to
minimize the impacts of the events, or to learn how to respond if such events occur.
Simulation models are discussed in more detail in the following section.

11.4 APPLICATION OF SIMULATION MODELS

Models are representations of systems that are especially effective in examining the
consequences of “what if” scenarios. Within the context of water system security,
some examples of “what if” scenarios include the following.
Section 11.4 Application of Simulation Models 513

• If an oil tank adjacent to a river ruptures and discharges to a river used down-
stream as a source of raw water, when should the utility close its water intake
and for how long will they need to keep the intake closed?
• If a major main in the water system breaks, what happens to pressure
throughout the distribution system and will there be sufficient flow and pres-
sure to provide fire protection?
• If runoff contaminates a particular well, what customers would receive con-
taminated water and how quickly will the contaminant reach them?
• If a terrorist manages to dump a barrel of a particular chemical into a fin-
ished water tank, how will the chemical mix within the tank and, if the con-
tamination is not discovered, which customers will receive the contaminated
water, when will they receive it, and what will the concentration be?
In the area of water system security, computer models have been used to examine
three different time frames:
• As a planning tool to look at what may happen in the future in order to assess
the vulnerability of a system to different types of events and to plan how to
respond if such an event occurs
514 Water System Security Chapter 11

• As a real-time tool for use during an actual event to assist in formulating a

response to the situation
• As a tool for investigating a past event so as to understand what happened
The characteristics of models used and the type of information that is available in
these three time frames can vary significantly. The following sections discuss this in
the context of three types of computers models: water distribution system models,
tank and reservoir mixing models, and surface water hydraulic and water quality
models.

Water Distribution System Models

A water distribution system model can be used to simulate flows and pressures within
a distribution system, and the movement and transformation of a constituent after it is
introduced into the distribution system. Previous chapters of this book discuss the use
of water distribution system models. In this section, we will examine in greater detail
the specific cases of modeling contaminants that have entered a distribution system by
accidental or purposeful causes.
In order to simulate the movement of a contaminant in a distribution system, a
hydraulic extended-period simulation (EPS) model of the system is needed. The
model should reflect the hydraulic conditions of concern. In using the model in a vul-
nerability study, it would be appropriate to select several normal operating conditions
such as a typical summer day, a typical winter day, and a typical spring/autumn day. It
is impossible to simulate all possible conditions. In addition, selecting typical operat-
ing conditions provides information reflective of most situations rather than an
extreme demand day that represents conditions for only a few days per year.
A contaminant is represented in the model by describing the transformation character-
istics of the constituent in the distribution system, where it is introduced into the sys-
tem, and the time history of the amount of the constituent that is introduced. Most
modern distribution system models provide options for designating this information.
Typically, a constituent is represented as being a conservative substance, which means
that it does not change concentration unless dilution occurs, or a non-conservative
substance, which means that it follows some form of decay (for example, first order
exponential decay). For the purposes of a vulnerability study, it is generally assumed
that the constituent will be conservative.
Most modern distribution system models provide the user with several options for
introducing a contaminant at a source (see page 465 for more information). In each
case, a time-varying pattern can be applied to the source. These options include the
following:
• Concentration: A concentration constituent source fixes the concentration
of any external inflow entering the network at a node, such as flow from a
reservoir or from a source placed at a junction.
• Flow-Paced Booster: A flow-paced booster constituent source adds a fixed
concentration to the flow resulting after the mixing of all inflow to the node
from other points in the network.
Section 11.4 Application of Simulation Models 515

• Setpoint Booster: A setpoint booster constituent source fixes the concentra-

tion of any flow leaving the source node, as long as the concentration result-
ing from the inflow to the node is below the set point.
• Mass Booster: A mass booster constituent source adds a fixed mass flow to
the flow entering the node from other points in the network.
• Initial Concentration: The initial concentration in a tank may be set with
the concentration changing over time due to either decay or dilution during
the fill cycle.
These options for specifying source concentrations allow the user to select the method
that most accurately represents the physical contamination event that he or she is sim-
ulating.
Use as a Planning Model. A water distribution system model can be applied
to a wide range of “what if” scenarios to determine the general vulnerability of the
distribution system. For example, the model can be used to determine the effects of a
major pipe break or the impacts of a purposeful or accidental contamination of the
system. With this information in hand, a water utility is better equipped to develop an
effective plan of action.
An example of the results of the application of a distribution system model to repre-
sent contamination tracking in the distribution system is shown in Figure 11.5. This
example illustrates the case where a contaminant has been pumped directly into the
distribution system at a constant flow and concentration rate over a 24-hour period.
The figure shows how the contaminant spreads over a significant portion of the sys-
tem during the 24-hour period.
An important part of any emergency planning is the simulation of a possible emer-
gency before it occurs. Using a model to simulate emergency drills with operators is
another facet of such preparedness. An operator can be given a contamination sce-
nario and asked to respond. The operator’s response can be simulated in the model,
showing where the contaminated plume would move and how the actions affected the
movement of the plume and exposure for customers.

Historical Modeling. What caused a sudden outbreak of debilitating and fatal

cases of diarrhea in Gideon, Missouri, in December 1993? Was an elevated number of
serious childhood illnesses in Dover Township, New Jersey, caused by industrial con-
tamination of the water supply dating back more than 40 years? These are the types of
questions that have been investigated by historical modeling (also referred to as retro-
spective or forensic modeling) using water distribution system models (see page 459).
The disease outbreak in Gideon was identified as salmonellosis and a private tank was
suspected as a source of the bacteria (Clark et al., 1996). The U.S. EPA applied a
water distribution system model of the Gideon system to investigate possible scenar-
ios by which the bacteria could propagate through the system and infect the custom-
ers. Ultimately, it was determined that it was likely that the tank, which was in bad
repair, was infected by birds. A sudden drop in temperature resulted in a temperature
inversion in the tank which mixed infected bird droppings and feathers throughout the
tank, and resulted in taste and odor problems. An aggressive flushing program then
516 Water System Security Chapter 11

drew the contaminated water deep into the distribution system. Similar historical
modeling has been done in the investigation of E. coli outbreaks in Cabool, Missouri,
and Walkerton, Ontario (Haestad Methods, 2002).

Figure 11.5
Example movement
of a contaminant
through a distribution
system

Improper handling and disposal of industrial chemicals led to the contamination of

some groundwater in the United States during the 20th century. In many cases, the
contaminated groundwater was used as a source of drinking water and, as a result,
customers were exposed to elevated levels of the contaminants. Many of these cases
have resulted in legal actions and governmental studies of the impacts of the contami-
nants on the population exposed to the substances. Distribution system hydraulic and
water quality models have played a key role in many of these cases in determining the
likely movement of the contaminants through the distribution system. Because some
of these incidents date back many years (for example, the 1950s through the 1980s),
the development of models and reconstruction of the operation of the water system
was required. Information on the model development and reconstruction process is
limited because of non-disclosure requirements associated with many legal cases.
A contamination case in Woburn, Massachusetts, has been documented in the book
and movie, A Civil Action (Harr, 1995), and was the subject of an early modeling
study in the 1980s (Murphy, 1986). Industrial sources were found to have improperly
discarded chemicals that seeped into the groundwater and contaminated two wells. 
Section 11.4 Application of Simulation Models 517

A Checklist of Security Measures

SHORT TERM • Limit access to water supply reservoirs.
• At your office, well houses, treatment plants, • Develop a clear policy so all employees know
and vaults, make it a rule that doors are how to deal with trespassers.
locked and alarms are set. • Fit hydrants and valve boxes with tamper
• Make security a priority, and emphasize it at proof caps and lids.
employee and safety meetings. • Install pass-code locks instead of keyed locks
• Tell your employees to ask questions and so access numbers can be changed as nec-
make note of strangers who are in your facili- essary—for example, when an employee is
ties or call in threats. terminated. (Make sure, however, that emer-
• Limit access to facilities. Indicate restricted gency response personnel and law enforce-
areas by posting Employees Only signs. ment personnel receive the updated access
codes.)
• Increase lighting in parking lots, treatment
bays, and other areas that seldom have peo- • Fence and lock vulnerable areas such as
ple present. wellheads, reservoir vents, and meter pits.

• DO NOT leave keys in equipment of vehicles • Mark equipment with logos and distinctive
at any time. paint jobs.

• Invite local law enforcement to become famil- • Integrate early warning monitoring systems
iar with your facilities, and establish a proto- into water transport, treatment, and distribu-
col for reporting and responding to threats. tion systems so that an operator will be noti-
fied immediately of changes in chemical
• Discuss detection, response, and notification characteristics, flows, pressures, and temper-
issues with public health officials, and estab-
ature.
lish protocols for them.
• Design and install valves that open and close
• Establish a chain of command and an emer- slowly.
gency call list to be used in emergency situa-
tions. • Know your employees and who it is you are
hiring. Make it a standard procedure to con-
• Provide copies of your operational proce- duct background checks on all new employ-
dures to local law enforcement and emer-
ees.
gency management personnel.
• Install firewalls in computer systems, and
LONG TERM change access codes frequently.

• Install motion sensors and video cameras to • Conduct and attend training activities to pre-
monitor, detect, and record events. They can pare your staff to detect, delay, and respond
be tied into a supervisory control and data appropriately.
acquisition system for remote monitoring. (Denileon, 2001)
• Install intrusion alarms that cover remote
buildings and grounds.

A series of steady-state distribution system models were used to identify areas of

Woburn that received the contaminated water under different well operating patterns
and demand conditions.
A groundwater contamination case in Phoenix and Scottsdale, Arizona, involving the
chemical trichloroethylene (TCE) was studied using extended-period simulations of
the operation of the water systems and the movement of water through those distribu-
tion systems. Most notable in this study was the use of long-term continuous simula-
518 Water System Security Chapter 11

tions (multiple years) of the hydraulics and water quality in the distribution system
(Harding and Walski, 2000).

A recently completed detailed study of the water system in the Dover Township, New
Jersey, area by the U.S. Agency for Toxic Substances and Disease Registry identified
the paths between wells and customers over a multi-decade period (ATSDR, 2001). In
this study, a water distribution system model of the present day system was first
developed and calibrated. Subsequently, models of the distribution system were
developed that covered the period from 1962 to 1996. The models were used to trace
the percentage of water reaching nodes from the wells serving the system.

In all historical reconstruction modeling, the challenge is to utilize historical data to

determine the characteristics and operation of the water system during the period of
interest. Generally, the challenge increases as one models further back in time. One of
the key challenges is reconstructing the actual operation of pumps when records are
incomplete. For example, a typical well might be operated to discharge 100,000 gal-
lons over the course of a day (69 gpm, 4.4 l/s), but the well pump discharges 120 gpm
(7.6 l/s). This would mean that the well pump is only operating 57 percent of the time,
but to which hours does that correspond? The resolution of this problem makes a
great difference in determining which customers were exposed to which sources.

Real-Time Modeling. Suppose that the manager of a water system receives a

call from the police that an individual has been apprehended for dumping a poisonous
chemical into the water system. The location, chemical, and approximate time and
duration of the contamination are known. The first action the manager takes, of
course, is to notify the public. Next the manager needs to determine how to operate
the system to flush out the contaminant; that is, he needs to determine which hydrants
to open and how long to keep them open. The manager has a good idea of how water
moves through the system during a normal day, but he also knows the flushing pro-
gram could drastically change the normal flow patterns. Attempting to clean the sys-
tem by trial-and-error would be a long, risky, and uncertain proposition. The best and
easiest way to analyze the problem is to use a properly developed and maintained
water distribution system model.

Water distribution system models have been proposed as part of a real-time or near
real-time system to assist in many aspects of the operation of a water system includ-
ing energy management, water quality management, and emergency operation. The
major obstacle in such use of water distribution system models is the requirement that
the model must be calibrated for a wide range of conditions and is ready to apply
quickly and easily in an extended-period simulation mode. Information on the current
state of the system must be readily available to the model through direct ties to a
SCADA system. In addition, the model must be set up in an automated mode so that
operation is represented by a series of logical controls that reflect the existing operat-
ing procedures. Both information requirements are feasible based on existing technol-
ogy but there have been only limited demonstrations of this type of operation to date.

The key to using a model as part of a real-time response lies in having the model
ready to run. During an emergency, there is no time to construct a model. There is
only time to make some minor adjustments to an existing model.
Section 11.5 Security Measures 519

Tank and Reservoir Mixing Models

Distribution system models represent mixing in tanks and reservoirs using simplified,
hypothetical representations such as complete and instantaneous mixing, plug flow, or
by a last in-first out “short-circuiting” model (see page 356). Though this has proved
adequate for most planning and operational situations, a more accurate representation
of how the facility mixes may be needed when planning for emergency contamination
events.
Computational fluid dynamics (CFD) models (see page 358) use mathematical equa-
tions to simulate flow patterns, heat transfer, and chemical reactions and thus provide
a much truer picture of the actual mixing processes in a tank. The use of CFD models
has grown significantly in the drinking water industry in the past several years (Gray-
man et al., 2000), and the technology has been applied in many planning and design
studies to assess the mixing characteristics of a tank and its inlet-outlet configuration.
Several commercial CFD software packages are available. Significant experience is
required to apply CFD models, and model run times of many hours, days, or even
weeks are required for complex situations. In conducting a vulnerability study, knowl-
edge of the mixing characteristics in a tank is useful in assessing the likely impacts of
a contaminant being added to a storage facility.

Surface Water Hydraulic and Water Quality Models

Hydraulic and water quality models of surface water systems can be used to study the
movement of contaminants in a surface water body. This information is useful in
assessing the vulnerability of a water intake to contaminants that are accidentally or
purposely added to the water body. Such models are also useful as part of an early
warning system to predict the real-time movement of contaminants that have been
detected upstream of a water intake. There are many general purpose hydraulic/water
quality models and specially designed “spill models” that can be used in both vulner-
ability studies and in real-time prediction (Grayman, Deininger, and Males, 2000).

11.5 SECURITY MEASURES

Many security measures are available that can be applied to decrease the vulnerability
of a distribution system to purposeful (and accidental) events that threaten the ability
of a water utility to provide a safe water supply to its customers. Some of these mea-
sures can be applied quickly with minimal costs, and others may take significant time
and resources to apply. The applicability of specific measures varies from water sys-
tem to water system. In evaluating potential security measures, a water utility should
balance the reduction of risks with the costs of implementing the measures.
The following list describes a variety of potential security measures.
• Maintain a significant disinfectant residual. As illustrated in Table 11.1,
many of the potential biological agents are inactivated by exposure to chlo-
rine. The inactivation effects of other disinfectants (such as chloramines) are
not as well known. Actions that can be taken relative to maintaining an
520 Water System Security Chapter 11

acceptable disinfectant residual include (1) placing continuous chlorine

monitors throughout the system to report chlorine residual back to a central
control center and warn of low residuals; (2) increasing the chlorine dose at
the treatment plant during periods of higher alert (although this may result in
undesirable higher levels of disinfectant by-products); (3) adding booster
chlorination stations at locations in the distribution system that routinely
experience low disinfectant residuals; and (4) modifying operating policies
to reduce water age in the system, including changing the fill and draw pat-
terns for tanks.
 References 521

• Increase the security surrounding key facilities in a water system. Dein-

inger and Meier (2000) recommend the following to increase the security of
a water system:
The intakes, pumping stations, treatment plants, and reservoirs should be fenced to secure
them against casual vandalism. Beyond that, there should be intrusion alarms that notify the
operator that an individual has entered a restricted area. An immediate response may be to
shut down part of the pumping system until the appropriate authorities determine that there
is no threat to the system. In underground reservoirs, the ventilation devices must be con-
structed in such a way as to not allow a person to pour a liquid into the reservoir. An above
ground reservoir with roof hatches should not have ladders on it that allow climbing. In addi-
tion, the hatches should be secured.
• Install secure backflow preventers or check valves at potential injection
sites. A contaminant can be injected at any connection to a water system if a
pump that is capable of overcoming the system pressure is available. Back-
flow preventers provide an obstacle and deterrent to such action, but in order
to be effective, the backflow preventer must be installed so that it cannot be
disengaged easily. Maintenance and cost issues associated with widespread
installation of such devices should be considered when evaluating this
option.
• Develop an early warning system for the raw water supply. If not
detected, contaminants in source waters (surface and groundwater) can pass
through a treatment plant and enter the distribution system. An early warning
system is a combination of equipment and institutional arrangements and
policies that are used to detect and respond to contaminants in the source
water.
• Install continuous monitors at key locations in the distribution system.
Monitoring can provide a means of identifying the presence of unwanted
contaminants in the distribution system. In order to be effective as a security
mechanism, monitors that sample continuously or very frequently at key
locations in the distribution system and are tied into a central operations cen-
ter are needed.
• Develop a detailed emergency response plan. An emergency response plan
is like an insurance policy—one hopes that he or she will never have to use it
but is very thankful that a plan is available if there is an emergency. Such a
plan should provide detailed information on how to respond under a wide
range of emergency situations. The plan should be kept up-to-date and per-
sonnel should be familiar with it so that it can be quickly implemented when
needed. The procedures for developing emergency response plans have been
developed by the American Water Works Association (AWWA, 2001).

REFERENCES

Agency for Toxic Substances and Disease Registry (ATSDR). (2001). Summary of Findings. Historical
Reconstruction of the Water-Distribution System Serving the Dover Township Area, New Jersey: Janu-
ary 1962-December 1996. Atlanta, Georgia.
American Water Works Association. (1990). Water Quality & Treatment A Handbook of Community Water
Supplies. 4th Edition, McGraw-Hill, New York, New York.
522 Water System Security Chapter 11

American Water Works Association (2001). “Emergency Planning for Water Utilities.” Manual of Practice
M-19, Denver, Colorado.
AwwaRF. (2002). Online Monitoring for Drinking Water Utilities. Edited by E. Hargesheimer, Denver, Col-
orado.
Burrows, W. D., and Renner, S. E. (1998). “Biological Warfare Agents as Threats to Potable Water.” Envi-
ronmental Health Perspectives, 107(12), 975.
Clark, R. M., and Deininger, R. A. (2000). “Protecting the Nation’s Critical Infrastructure: The Vulnerabil-
ity of U.S. Water Supply Systems.” Journal of Contingencies and Crisis Management, 8(2), 73.
Clark, R. M., Geldreich, E. E., Fox, K. R., Rice, E. W., Johnson, C. W., Goodrich, J. A., Barnick, J. A., and
Abdesaken, F. (1996). “Tracking a Salmonella Serovar Typhimurium Outbreak in Gideon, Missouri:
Role of Contaminant Propagation Modeling.” Journal Of Water Supply and Technology, 45(4), 171.
Craun, G., Swerdlow, D., Tauxe, R., Clark, R., Fox, K., Geldreich, E., Reasoner, D., and Rice, E. (1991).
“Prevention of Waterborne Cholera in the United States.” Journal of the American Water Works Associ-
ation, 83(11), 43.
Deininger, R. A. (2000). “Constituents of Concern. The Threat of Chemical and Biological Agents to Pub-
lic Water Supply Systems.” Appendix F in Pipeline Net User’s Guide, SAIC, McLean, Virginia.
Deininger, R. A., and Meier, P. G. (2000). “Sabotage of Public Water Supply Systems.” Security of Public
Water Supplies, Deininger, R. A., Literathy, P., and Bartram, J., eds, NATO Science Series 2, Environ-
ment - Volume 66, Kluwer Academic Publishers.
Denileon, G. P. (2001). “The Who, What, Why, and How of Counterterrorism Issues.” Journal of the Amer-
ican Water Works Association, 93(5), 78.
Fox, K. R., and Lytle, D. A. (1996). “Milwaukee’s Crypto Outbreak Investigation and Recommendations.”
Journal of the American Water Works Association, 88(9), 87.
Grayman, W. M., Deininger, R. A., and Males, R. M. (2002). Design Of Early Warning and Predictive
Source-Water Monitoring Systems. AWWA Research Foundataion, Denver, Colorado.
Grayman, W. M., and Males, R. M. (2001). “Risk-Based Modeling of Early Warning Systems for Pollution
Accidents.” Proceedings of the IWA 2nd World Water Congress, IWA, London, United Kingdom.
Grayman, W. M., Rossman, L. A., Arnold, C., Deininger, R. A., Smith, C., Smith, J. F., Schnipke, R.
(2000). Water Quality Modeling of Distribution System Storage Facilities. AWWA Research Founda-
tion, Denver, Colorado.
Haestad Methods, Inc. (2002). Proceedings of the Water Security Summit. Haestad Press, Waterbury, Con-
necticut.
Harding, B. L., and Walski, T. M. (2000). “Long Time-Series Simulation of Water Quality in Distribution
Systems.” Journal of Water Resources Planning and Management, ASCE, 126(4), 1199.
Harr, J. (1995). A Civil Action. Vintage Books, New York, New York.
Hickman, D. C. (1999). “A Chemical and Biological Warfare Threat: USAF Water Systems at Risk.” Coun-
terproliferation Paper No. 3, Maxwell Air Force Base, USAF Counterproliferation Center, http://
www.au.af.mil/au/awc/awcgate/cpc-pubs/hickman.pdf.
Hoover, J. E. (1941). “Water Supply Facilities and National Defense.” Journal of the American Water
Works Association, 33(11), 1861-1865.
Murphy, P. J. (1986). Water Distribution in Woburn, Massachusetts. University of Massachusetts, Amherst,
Massachusetts.
Sandia National Laboratories (2001). “Water Infrastructure Security Critical Infrastructure Protection.”
Webcast presented by AwwaRF, http://www.awwarf.com/whatsnew.html.
Sobsey, M. D. (1999). “Methods to Identify and Detect Contaminants in Drinking Water.” Identifying
Future Drinking Water Contaminates, National Academy Press, Washington, D.C.
 Discussion Topics and Problems 523

DISCUSSION TOPICS AND PROBLEMS

Read the chapter and complete the problems. Submit your work to Haestad Methods
and earn up to 11.0 CEUs. See Continuing Education Units on page xxix for more
information, or visit www.haestad.com/awdm-ceus/.

11.1 The source (node A) in a distribution system has become contaminated and you have been asked to
determine when the contamination will reach a hospital located at node B. You have a steady-state
hydraulic model that has been calibrated for average day conditions that you feel is representative of
the current day.

A
1 2 6 14

3 5 7

4 8
9

11
10 12

B
13

The following table contains information on the network as represented under steady-state average
day conditions. Fill in the values for velocity and travel time in the table.
Diameter Length Discharge Velocity Travel Time
Pipe Label
(in.) (ft) (gpm) (ft/s) (hours)
P-1 8 8,000 500
P-2 8 8,000 300
P-3 8 8,000 200
P-4 8 8,000 180
P-5 6 8,000 50
P-6 8 8,000 240
P-7 8 8,000 40
P-8 8 8,000 220
P-9 8 4,000 240
P-10 6 4,000 120
P-11 6 4,000 120
P-12 6 4,000 100
P-13 6 4,000 100
P-14 8 4,000 200
524 Water System Security Chapter 11

a) What is the shortest travel time and longest travel time between nodes A and B?

b) Is it reasonable to expect that flows will remain relatively constant over the time it takes for the
contaminant to travel from node A to B?

c) What is likely to happen when the tank switches from the fill cycle represented in the diagram to
a draw cycle?

d) Based on your analysis do you feel that the use of a steady-state model is reasonable or should
you use an EPS hydraulic and water quality model to calculate travel times?

11.2 You are conducting a vulnerability analysis of a water system and want to determine the potential
impacts of a particular toxic substance if it was added to the city’s water supply. The city water sys-
tem serves 100,000 people with a daily average water use of 400 liters per person. Assume that only
1 liter is actually consumed by the average person per day. The average lethal dose for this toxic
contaminant for a person is estimated to be 1 milligram over a course of a day. Assuming that the
substance is evenly mixed throughout the water supply, how much of the substance must be added to
reach the lethal level?

Is it reasonable to assume that the substance would be evenly distributed throughout the system?
What other factors should you consider in making a more accurate assessment of the vulnerability of
the water system to this substance?

11.3 Assume you are given an EPS model of the water distribution system in the following figure and you
are asked to investigate the consequence of contaminants being added at several locations (Prob11-
03.wcd). The model is currently set up to represent average day conditions with a repeating daily
pattern for 288 hours. The system is served by a well (represented as a constant inflow at J-13) and
by a pump from a surface water source (R-1). The pump is controlled by the water level in tank T-1.
Run the model for the following three situations to simulate the movement of the contaminant and
answer the corresponding questions.
 Discussion Topics and Problems 525

a) A conservative substance is dumped into the tank where it mixes completely resulting in an ini-
tial concentration of 100 mg/L. If the substance is not detected and the system is operated nor-
mally, how long will it take for the concentration in the tank to drop by 90% to 10 mg/L? Do all
demand nodes receive contaminated water at some time?

b) A contaminant is added at the well (node J-13) at a high concentration (1,000 mg/L) from hour 6
to hour 7. Does the contaminant reach the tank? How much of the system is affected by the con-
taminant? How long does it take until the entire system is cleared of the contaminant?

c) A contaminant is pumped into the system at node J-5 for a 24-hour period starting at hour 6 at a
rate of 1 gpm with a concentration of 1,000 mg/L. Does the contaminant reach the tank? What is
the maximum concentration in the tank? How many nodes receive a concentration exceeding 1
mg/L at any time during the event? What demand node receives the highest concentration (aside
from node J-5)? When does the concentration drop below 1 mg/L throughout the entire system?