Dual-use value of network partitioning for water system management and protection from malicious contamination

C_i,ext

external input concentration [mg/l]

C_i,out

contaminant concentration leaving node i [mg/l]

C_i

concentration of the dissolved species k [mg/l]

C_j,in

concentration in the jth pipe [mg/l]

h_i

pressure heads [m]

h_mean

mean node pressure [m]

h_min

minimum node pressure [m]

H_s

source heads [m]

I_i

set of network pipes inflowing to node i

I_r

resilience index

I_rd

resilience deviation index

LD₅₀ (lethal dose)

dose that kills half (50%) of the animals tested [mg/kg]

L_ep

length of contaminated pipes [m]

L_j

pipe length [m]

m_i

subset of pipes j incident to node i

n₉₀

number of nodes where h is less than h_min90 = 90% h_min

N_eu

number of exposed users

N_eu50

number of exposed users that consumed more than the lethal dose LD₅₀

Q_i,ext

external input contaminant flow [m³/s]

Q_i

node water demand distribution [m³/s]

q_j,in

flow in the jth pipe [m³/s]

q_j

pipe flow [m³/s]

r

rate of reaction

S_NND

network with no districts

S_WNP

water network partitioning

S_WNS

water network sectorization with isolation of a single i-DMA

u

water flow velocity

V_j

volume of water in each pipe j incident to node I [m³]

x

position along the pipe [m]

z_i

node elevations [m]

ΔH_j

pipe head loss [m]

ε_j

weights for edges

ω_i

weights for vertices

Water distribution networks are exposed to different potential sources of accidental and intentional contamination (US EPA 2003). Accidental contamination is related to occasional bad source water quality, malfunctioning chlorine stations, pipe breaks, and leak repairs, whereas intentional contamination concerns malicious attacks represented by the intentional introduction of a contaminant at the network sources, the injection of a contaminant in a network pipe (Nilsson et al. 2005; Clark et al. 2006), or the backflow that occurs when a pump system is utilized to overcome the local pressure at the insertion point (Kroll 2010). Water contamination from terrorist attacks is a major risk for society and can have serious consequences, such as poisoning users or spreading infectious diseases; many countries adopted guidelines for water quality monitoring and emergency action plans after 11 September 2001 (HSPDs 2002; US EPA 2003, 2009; CER 2005).

A malicious act may consist of the introduction of chemical, biochemical, microbiological, or radioactive contaminants in the water supply network.

Studies available in the literature have focused on the ability of common sensors to detect noticeable changes in water quality when a contaminant is present (USEPA 2003; Hall et al. 2007), especially by monitoring such parameters as pH, conductivity, total organic carbon, turbidity, and residual chlorine, coupled with interpretive algorithms (McKenna et al. 2007; Umberg 2008; Kroll & King 2010). Other studies have focused on the optimal positioning of measurement stations and the identification of point source contamination (Rico-Ramirez et al. 2007; Ostfeld 2008; Chang et al. 2011). These techniques are helpful for developing early warning systems (EWSs) but are rather ineffective at assessing the impact of actions that reduce dangerous effects for users.

When a water supply network contamination incident is identified, three main actions should be performed: (1) alert users not to use the contaminated water; (2) close the sector of the network to limit health risks; and (3) remove the contaminant.

Early warning is crucial for the first action to be successful, whereas the effectiveness of the second action depends on the possibility of closing pipes to disconnect network sectors. Early warning requires a good distribution of fast warning sensors over the network (Kroll & King 2010), and pipe closing can only be accomplished if network sectorization (or partitioning) has been envisaged in the planning phase.

The recent development of water network partitioning (WNP) techniques that divide the water network in district meter areas (DMAs) (Wrc/WSA/WCA 1994) aim to improve the management and control of water systems (Di Nardo & Di Natale 2011; Di Nardo et al. 2013a) and represent an efficient way to protect networks from chemical and biological agents (Grayman et al. 2009; Murray et al. 2010). Di Nardo et al. (2013b) recently proposed a methodology to reduce the risk of intentional contamination of a water supply network via water network sectorization (WNS). Sectorization is achieved by closing gate valves in the network pipes that link the DMAs (Tzatchkov et al. 2006). In this condition, wherein each district in the system is completely separated (or isolated) from all other districts, the isolated district can be named an isolated DMA (i-DMA), as proposed by Di Nardo et al. (2013c, d).

A study of water network protection with WNS by Di Nardo et al. (2013b) obtained the following results: the isolation of the DMA is more effective than WNP alone; user protection increases with an increasing number of DMAs in a WNP; the WNP reduces the extent of the risk because several introduction points would be needed to produce a wide negative impact on the network; the WNP allows easier protection measures to be activated because a small part of the network can be disconnected.

The methodology respects the criteria of ‘dual-use value’ (Kroll & King 2010) because the WNP and WNS, in addition to protecting the network from contamination, are defined for other aims (e.g., water balance and pressure management) to optimize costs. In other words, the first goal (and thus the ‘main-use value’) for any WNP (Water Authorities Association and Water Research Centre 1985; Water Industry Research Ltd 1999; AWWA 2003; Di Nardo & Di Natale 2011; Di Nardo et al. 2013c) consists of the following: (a) the identification and reduction of water loss; (b) the management of pressure; (c) the improvement of speed and quality of leak repairs; (d) the planning of maintenance; (e) the prediction and control of water quality; and (f) the measurement of water demand. The secondary goal (or the dual-use value) consists of providing water protection from accidental or intentional contamination (Di Nardo et al. 2013b). In this manner, the water distribution system protection is achieved with WNP and WNS and is capable of a likely return on investment because only a small portion of the system lifetime will be spent on network protection; the majority of the system lifetime will be spent on the day-to-day management of achieving the main goals.

In this paper, different WNPs, obtained with an automatic tool (Di Nardo et al. 2013a) for WNP and/or WNS that provides layouts in compliance with hydraulic performance, were investigated to evaluate the effect of different WNPs on water network protection from intentional contamination. This study analyzed the benefits of defining i-DMAs for network protection that are compatible with hydraulic performance.

The intentional contamination was modeled as proposed in Di Nardo et al. (2013b) by the introduction of cyanide in a tub that is used for a backflow attack into a water system. The weakest points for such deliberate contaminant delivery are also defined.

The analysis was carried out with different WNP and WNS scenarios on real multiple-source water distribution networks. In a recent work of Di Nardo et al. (2013e), this methodology was tested on a small water system in Italy, whereas in this work, a large water distribution network in Mexico was chosen as a case study.

In this section, the definitions of the contamination incident characteristics are first described. A water supply network may be intentionally contaminated in several ways: various contaminants (chemical, biochemical, or radioactive) may be introduced to one or more points of the water system (sources, reservoirs, tanks, or generic points). In this work, a backflow attack into the water system was modeled by defining the most dangerous points of the network for a deliberate contaminant delivery. The chosen contaminant was potassium cyanide (Patnaik 2007), an inorganic compound that is highly soluble in water (716 g/l) and extremely toxic (LD₅₀ = 2.86 mg/kg. LD₅₀ is a standardized measure for expressing and comparing the acute oral toxicity of chemicals. This dose kills half (50%) of the animals tested, LD = lethal dose). Choosing a specific contaminant is important to define the corresponding lethal concentration, but this selection does not undermine the general value of the proposed approach that can be applied to other contaminants (i.e., aldicarb, anthrax culture, fluoroacetate, nicotine, ricin, sarin, and VX).

The backflow attack scenario was borrowed from Di Nardo et al. (2013b, e). Specifically, the backflow is created with a pump – a piece of equipment that is easy to find on the market – that can introduce the contaminant into the water system by overcoming the local pressure at the insertion point and disseminate the contaminant into the network. The simulations were carried out by modeling the sub-network and water demands that occur in a typical building, allowing the case study to define the critical contaminant volume to achieve the malicious attack.

The malicious attack is carried out at a single point and, theoretically, by a single terrorist equipped with a small number of simple devices (e.g., a small pump and a backpack to transport the pollutant) that would allow him or her to commit the crime unnoticed.

A backflow attack can be easily accomplished by mixing cyanide with water in a bathroom tub in any house and pumping the solution into the water network. The introduction point can be anywhere in the system. The most dangerous introduction points to the users can be identified by employing the EPANET2 water quality tool. Several assumptions have been made for evaluating the hazardous effect: (a) every network node corresponds to a given number of users; (b) a given amount of potassium cyanide (represented by the mass flow rate and concentration) is introduced twice into the water network at 7:00 a.m. and at 9:00 a.m. (a 2 h interval is sufficient to refill the bathroom tub and mix cyanide (Di Nardo et al. 2013e)), the time interval when the peak demand of the morning water occurs in the studied network and the contaminant spreads faster; and (c) the lethal concentration of potassium cyanide in water for a 70 kg user is 200 mg/l (Patnaik 2007).

Cyanide contamination has been simulated via EPANET2, a water quality simulation module that allows one to model the transport of a dissolved species traveling down the length of a pipe with the same average velocity as the carrier fluid and may react (either growing or decaying) at a given rate (Liou & Kroon 1987). Longitudinal dispersion is typically not an important transport mechanism under most operating conditions (although this dispersion can be considered, if needed, as shown by Tzatchkov et al. (2002)) and has not been considered in this study, as described in more detail by Di Nardo et al. (2013b, e).

Recently, the authors developed different heuristic algorithms and procedures based on graph theory and partitioning techniques to design WNP and WNS. In this section, some main elements are provided to describe the procedure used in this work and widely disseminated by Di Nardo et al. (2013a).

A water network can be assimilated to a simple weighted graph considering G = (V,E), where V is the set of n vertices (or nodes) and E is the set of m edges (or pipes). Denoting ̃ω_i as the positive weights with i ∈ V and ε_ij as the non-negative weights with ij ∈ E and εij = 0 if ijÏE, a k-way graph partitioning problem consists of partitioning the V vertices of G into k subsets (or districts), D₁, D₂, …, D_k such that for ⁠, ⁠, and ⁠.

Network partitioning is achieved by a multi-level procedure that combines different algorithms with a multi-level recursive bisection algorithm, and these combined algorithms allow the number of edge-cuts (or links between the districts) to be minimized and the number of nodes that belong to each district to be balanced. The k-way partition is recursively solved by performing a sequence of two-way partitions (or bisections). If the edges and vertices of the graph are weighted, the goal becomes to minimize the sum of the edge-cuts with associated weights and to balance the sum of the node weights for each district. The goal is to partition the vertices into k disjoint subsets D_k, while minimizing the sum of the number of edge-cuts e_ij with the associated weights ε_ij, the incident vertices of which belong to different subsets balancing the number of vertices n_p with the associated weights ̃ω_p for each subset.

Once the graph partitioning is achieved and the nodes are assigned to each district, the positioning of the flow meters and gate valves is obtained with a genetic algorithm using an objective function based on the energetic approach. Finally, the WNPs are compared by using specific performance indices (PIs) (Di Nardo & Di Natale 2013f) to find the best solution that is compliant with the hydraulic performance.

This methodology was implemented in an automatic tool developed in the Python v2.7.6 programming language (Summerfield 2009).

Specifically, starting from the INPUT data for the water network (with n nodes, m pipes, a node water demand distribution Q_i, and node elevations z_i, with i = 1 … n; source heads H_s, with s = 1 … r reservoirs; and pipe length L_j with j = 1 … m), the pipe flows q_j,, node pressure heads h_i, and pipe head loss ΔH_j can be calculated by the hydraulic simulation module of EPANET2 (step a). Step b comprises the WNP obtained using the methodology described in the previous section, which allows the number and dimensions of the i-DMAs compatible with the level of service requested from users, based on different weights and node balancing, to be obtained. Starting from a hydraulic simulation model of the network that provides the data for the weights to be assigned to pipes and nodes, the tool obtains different WNP layouts in terms of the dimensions, shape, and hydraulic characteristics of each DMA. In this work, the effect of the different choices for the WNP in providing network protections was investigated by fixing the number of i-DMAs. The EPANET2 hydraulic simulation module was used to compute the weights to be assigned to each pipe, as explained below.

Some PIs were used to check the level of service provided to the users, as suggested by Di Nardo et al. (2013f): (a) the resilience index I_r (Todini 2000) and resilience deviation index I_rd (Di Nardo & Di Natale 2011) that are based on the comparison of the resilience indices of the original and sectorized networks; and (b) pressure indices that are traditionally measured by the mean node pressure h_mean and minimum node pressure h_min.

Step c consists of simulating the malicious attack, as described in the previous section, by using the water quality simulation module of EPANET2. Different scenarios can be defined to test the effectiveness of this methodology. For each scenario, the node where the contaminant injection would produce the worst consequences in the case of a backflow attack (in terms of N_eu, N_eu50, and L_ep) has been identified. For this purpose, a large number of water quality simulations were run in EPANET2 by inserting a pump system with the same cyanide concentration at each network node and finding the corresponding maximum values of the numbers N_eu, N_eu50, and L_ep.

After comparing the results obtained with the considered scenarios (step d) in terms of N_eu, by returning to step b, the criteria used to define the DMAs and thus the number and dimension of the DMAs can be changed (step e). A higher number of the smaller districts can be defined, and the DMA sectorization that best reduces the negative effects of the network contamination can be identified.

This methodology can be applied to not only intentional and severe contamination but also accidental and less severe contamination caused by poor source water quality, accidental backflows, or other similar problems that can occur in a water distribution system.

The real water distribution network of the city of Matamoros, illustrated in Figure 2, has been used to validate the proposed methodology and investigate the positive effects of WNP. The city of Matamoros is located in the northeast part of the state of Tamaulipas, Mexico. The climate is semi-dry, with hot summers and cold winters (the temperature ranges from −7 to 40 °C, and the annual precipitation averages 687.2 mm). The number of service connections to the city water distribution network is approximately 120,000, and there are approximately 500,000 city inhabitants. The only water supply source is the Rio Grande River. Water is taken from the river at two points, and treated by four water treatment plants. The distribution network is between 40 and 50 years old and interconnects the water sources and tanks. Three large water tanks are used in the city (two of these tanks have a capacity of 4,000 m³, and the other one has a capacity of 3,800 m³). The main characteristics of the Matamoros water distribution network model are reported in Table 1.

After the hydraulic simulation (step a) was carried out with an hourly pattern of the daily water usage with the average and peak water demand reported in Table 1, different WNPs of the Matamoros water network (step b) were defined using the automatic tool proposed by Di Nardo et al. (2013a).

The automatic tool for WNP, based on graph partitioning techniques, allows some WNPs to be achieved by considering different weights for both the edges and vertices (ε_j and ω_i, respectively). In this case study, the chosen weights were the dissipated power in each pipe γq_jΔH_j (Di Nardo & Di Natale 2011, 2012; Greco et al. 2012) for the edges (ε_j), length and volume of water in the pipes linked to each node (ω_i), and node water demand. Because the aim of this study was to analyze protection measures corresponding to different WNP and WNS layouts, three different partitioning layouts were compared, as follows:

• S_WNP1 with weights ε_j = γq_jΔH_j and ⁠, where m_i is the subset of pipes j incident to node i;

• S_WNP2 with weights ε_j = γq_jΔH_j and ⁠, where V_j is the volume of water in each pipe j incident to node i;

• S_WNP3 with weights ε_j = γq_jΔH_j and ω_i = Q_i (water demand at ith node).

Then, the results for N_eu, N_eu50, and L_ep for the following scenarios were compared:

• S_NND: network with no districts (NND);

• S_{WNP1 … 3}: WNP layout with 10 DMAs;

• S_{WNS1 … 3-1 … 10}: WNS with isolation of each i-DMA at 8:00 a.m. (1 h from the first attack), at 10:00 a.m. (3 h from the first attack and 1 h from the second attack), or at 12:00 p.m. (5 h from the first attack and 3 h from the second attack). The isolation of each i-DMA is achieved by closing the gate valves and stopping the water supply to the users.

This work concerns the planning of WNP and thus the optimal positioning of the gate valves and flow meters in the system. In the S_NND scenario, use of the valves that are already present in the network and conceptualization of a basic protection intervention may be achieved by isolating the segments by methodologies such as those individualized by Creaco et al. (2010), Alvisi et al. (2011), and Giustolisi et al. (2014).

To reduce the number of exposed users N_eu50, each S_WNP was defined after step e in the flow chart in Figure 1, and then, step b was revisited after changing the weight of the nodes according to the methodology proposed by Di Nardo et al. (2013a).

As reported in Di Nardo et al. (2013b, e), the choice of closing the contaminated DMA 1 h (at 8:00 a.m.) or 3 h (at 10:00 a.m.) after the beginning of the malicious attack is a reasonable hypothesis for a water network that is not equipped with an EWS (allowing for shorter detection times). In this case, a realistic assumption is that the authorities are alerted and ordered to close the network district several hours after the attack. In this work, a further (worse) case was simulated by closing the contaminated DMA at 12:00 p.m. (5 h after the first malicious attack).

In Tables 2 and 3, the three different scenarios of S_WNP and S_NND are compared using the PIs computed with both the average and peak water demands. In the first case (average water demand), h_mean is equal to 17.67 m for S_WNP1, 17.55 m for S_WNP2, and 18.03 m for S_WNP3, similar to the original h_mean value of S_NND equal to 18.31 m; in contrast, h_min is equal to 11.02 m for S_WNP1, 8.60 m for S_WNP2, and 8.98 for S_WNP3, slightly lower than the h_min value of S_NND equal to 12.58 m. Then, the alteration is negligible with reference to the third scenario, S_WNP3, in terms of the resilience deviation index (I_rd = 0.16%). In addition, the number of nodes where h is less than h_min90, which equals 90% of h_min, was computed and indicated with the label n₉₀; this value was extremely low in all cases (n₉₀ = 1 for S_WNP1, n₉₀ = 56 for S_WNP2, and n₉₀ = 30 for S_WNP3) compared to the total number of nodes n (equal to 1,283).

The situation is different in the second case (peak water demand) because, as reported in Greco et al. (2012), in a network with a low original resilience index I_r, the water system has a ‘low availability’ to change its original layout by the insertion of gate valves without a decrease in hydraulic performance. Indeed, in the case study, the reduction of the resilience index is evident (from I_r = 0.379 for S_NND to I_r = 0.267 for S_WNP3), although this reduction is limited to several hours and required network improvements (e.g., in pump systems and change of diameters). In this case, the pressure indices are promising in terms of h_mean, similar to the values of S_NND for each S_WNP, but h_min is lower than the original values. Therefore, as reported in Table 3, the value of n₉₀ is also negligible (n₉₀ = 10 for S_WNP1, n₉₀ = 52 for S_WNP2, and n₉₀ = 27 for S_WNP3) for this operational condition.

All simulations were carried out with the assumption that a pump system in the corresponding DMA introduced potassium cyanide into the node that generates the worst damage for the users. The analyzed scenarios are illustrated in Figures 3,⁴⁵–6: a black triangle indicates the insertion point in each district, but additional information about the specific position of the worst nodes, cyanide concentrations, and other simulation details are not reported to protect the Matamoros water supply system. For the same reason, the numbers N_eu and N_eu50 are also not provided; rather, only the percentage deviation is reported for each scenario compared with S_NND. In Tables 4,⁵–6, the simulation results are reported, with reference to the scenario S_NND, by providing the percentage reduction of affected users achieved by either WNP (S_WNP) or WNS (S_WNS) for the worst insertion point, i.e., the point for which the values of N_eu, N_eu50, and L_ep are the highest among the simulations. In other words, the values in these tables compare the effect of the worst case of an intentional contamination with and without any partitioning or sectorization measures.

A comparison of the simulation results for S_WNP1 is reported in Table 4. The values for S_WNP1 exhibit a high reduction (−65.83%) of N_eu but a low reduction (−12.20%) of N_eu50 for this simple WNP without any district isolations. In this scenario, no additional security measure is taken, and the effects of the contamination incident on the exposed users depend exclusively on the reduction of the looping level and hydraulic section of the water system due to WNP.

For a valve closure 1 h after the attack, the best result obtained for some of the WNS scenarios is a reduction of N_eu50 of up to −100% (no user consumed more than LD₅₀) and up to −99.21% of N_eu (for S_WNS1-9). All i-DMA isolations exhibit good results, with a reduction of N_eu50 of at least −55.67% and a reduction of N_eu of at least −91.19% for S_WNS1-3. The results are also promising for the isolation of each i-DMA after 3 h (at 10:00 a.m.), with a mean N_eu50 of −78.37%, although this value is slightly lower than the value in the case of isolation at 8:00 a.m., which has a mean N_eu50 of −92.02%. Furthermore, N_eu is always lower than the case without DMA isolation security measures at 8:00 a.m. and 10:00 a.m. (except for S_WNS1-9). Naturally, with an isolation delayed until 12:00 p.m., the contaminant travels further in the network, and the number of exposed users increases; in this case, the mean N_eu increases to −84.30%, but this value is always lower than the value for the original network.

The simulation results for S_WNP2 are compared in Table 5. For the case of S_WNP2 with no DMA isolation, N_eu50 is negligible with a value equal to −5.32%, similar to the value achieved for S_NND; in contrast, N_eu is decreased significantly (−58.03%).

WNS provides a significant reduction in affected users in the three scenarios, as reported in Table 5, with closures after 1, 3, and 5 h, with a higher mean value of N_eu50 than S_WNP1 for all closure times: −99.46% at 8:00 a.m., −90.28% at 10:00 a.m., and −78.05% at 12:00 p.m. The mean value of N_eu is quite similar to the value of N_eu50, reaching −97.83% at 8:00 a.m., −81.59% at 10:00 a.m., and −77.93% at 12:00 p.m.

The simulation results for S_WNP3 are reported in Table 6, which confirms that the partitioning measures alone enable a high reduction of N_eu (−58.02%) but a low reduction of N_eu50 (−16.67%), although this performance is better than the performance in the previous scenarios. The WNS scenario exhibits a significant reduction in risk: the mean value of N_eu50 is −99.87%, −86.03%, and −69.37% for security measures initiated at 8:00 a.m., 10:00 a.m., and 12:00 p.m., respectively, with highly similar percentages for the mean values of N_eu.

Tables 4,⁵–6 also report the value of L_ep computed for the contaminant insertion point that produced the maximum length of contaminated pipes. This index also indicates that all of the isolation scenarios significantly improve the water network protection, achieving a minimum value of the percentage reduction of L_ep equal to −41.91% for S_WNS3-5 at 12:00 p.m. In all other isolation scenarios, the reduction of L_ep is significantly higher than the scenarios without sectorization.

The comparison of the results achieved with these three different S_WNS indicates that the WNP design modifies the number of contaminated users and pipe length with different values of each index. In this case study, the best network protection is obtained with the partitioning layout S_WNP2, achieved by using two weights: the dissipated power for each pipe j and the half volume of pipe j incident to node i. S_WNP2 has the drawback of the lowest value of the PIs of resilience and pressure. Promising results for water network protection were also obtained with S_WNP3, which displayed the highest reductions in affected users with (−99.87% of N_eu50) or without (−16.67% of N_eu50) security measures. Then, for the DMA isolation 1 h after the malicious attack, the values of N_eu and N_eu50 are highly similar. In this manner, with respect to the criteria of ‘dual-use value’, this option can be the best choice to improve water network management and protection.

Figure 3 presents the three S_WNP of the Matamoros supply network, in which each DMA is indicated with black dashed lines, compared with S_NND. This figure illustrates that the dimension and thus the shape of each DMA is different.

The exposed nodes N_eu in Figure 3 are denoted with different colors; a gray full circle for S_NND and a black empty circle for S_WNP, as explained in the figure legend. The diameter of each circle is proportional to the number of exposed users; therefore, a larger diameter indicates a larger N_eu corresponding to the individual node. The worst insertion points that produced the maximum N_eu for each scenario were obtained, and Figure 3 illustrates that the cyanide contamination is extremely high in the network without any WNP (gray circles) and that the simple WNP S_WNP only slightly reduces the number of exposed users (black circles). Another effect shown in Figure 3 is the movement of cyanide in the network, with the contaminated nodes changing considerably.

The worst insertion points that produced the maximum N_eu50 for each scenario were obtained, and as shown in Figure 4, similar results were obtained for S_NND and each S_WNP in terms of both the total number of N_eu50 and contaminated node positions. This result is confirmed by the values in Tables 4,⁵–6.

Finally, in Figures 5 and 6 and Table 7, the S_WNP3-1 scenario, with district isolations at 8:00 a.m., 10:00 a.m., and 12:00 p.m., was compared to the S_WNP3 scenario (and not, as in the previous tables and figures, with S_NND) for both contamination indices, N_eu and N_eu50. This isolation scenario was chosen because the worst insertion point for the entire partitioned network (S_WNP3) was found to be in i-DMA1 for both contamination indices, N_eu and N_eu50. In this manner, Figures 5 and 6 illustrate how the proposed methodology can protect the network, even in the worst contamination case for S_WNP3, if the system was previously designed for sectorization.

In Figures 5 and 6, the number and position of N_eu and N_eu50 are illustrated with gray circles for the scenarios without sectorization and with black circles for the scenarios with district isolation for each of the three instants of isolation studied. The results with isolation at different times are highly variable: an isolation after 1 h (at 8:00 a.m.) from the malicious attack provides better protection: the black circles are small in Figure 5, illustrating a value of N_eu with a reduction up to −98.95%, and the number of N_eu50 is even equal to −100%, as reported in Table 7.

Figure 5 presents a significant reduction in the protection of the water network by isolation 3 h after the first attack (at 10:00 a.m.), with an important difference between the gray and black circles for N_eu and a reduction equal to −41.97%, but with a larger reduction of N_eu50 equal to −83.21%, as illustrated in Figure 6 with a small number of black circles. For a district isolation at 12:00 p.m., the difference between the gray and black circles is almost unnoticeable, with the same numbers for N_eu (−1.51%) and N_eu50 (−12.24%), as reported in Figures 5 and 6 and Table 7. These figures provide a comparison with the already partitioned network, whereas all other figures and tables are compared with the original Matamoros network without any protection measures.

Hydraulic and water quality simulations indicated that network protection can be achieved by DMA partitioning and sectorization; the latter may significantly decrease contaminant propagation and protect a greater part of the users from cyanide ingestion. The study, carried out on a large water network, confirmed the following insights of a previous study carried out by Di Nardo et al. (2013b, e). (a) WNP without additional sectorization measures (DMA isolation) does not significantly improve the protection of the water system. In fact, the isolation of the attacked DMAs is always more effective in reducing the number of exposed users, although the efficacy is dependent on how quickly the district is isolated. An isolation achieved 3 or 5 h after the beginning of the terrorist attack could be useless at protecting users. (b) WNP reduces the risk because several points of contaminant introduction would be needed to produce a wide negative impact on the network.

Then, the work also provides some new insights. (c) The choice of the WNP can significantly change the number of contaminated users. (d) The design of i-DMAs can help operators choose the best position of contamination measurement devices to be inserted in each district to allow for the early warning and activation of safety measures.

The WNP respects the criterion of ‘dual-use value’ as a technique for water protection because this approach can be implemented to also achieve other management aims. In this logic, the study indicated that different WNPs allow different solutions to be chosen to optimize performance or protection; in this study, network partitioning obtained with weights equal to the dissipated power of pipes and water demands on nodes, S_WNP3, displayed the best PIs and had high levels of protection.

This study was focused on the problem of an intentional contamination of a large water supply network; therefore, the methodology can also be applied to an accidental contamination (i.e., from arsenic, which is often present in some Mexican cities and, to a lesser extent, in Italian supply networks). In this case, the benefits of WNS are evident because only a small part of the network can be disconnected, minimizing problems or inconvenience for other users.

Finally, the practical application of the proposed method depends on accurate modeling of the network. This observation is particularly true for protection from intentional contamination. The operator experience shows, however, that even in some well-maintained, well-monitored, and well-controlled networks, a not insignificant fraction of the valve population is open when the operators think the valve should be closed or vice versa. In such cases, i-DMAs may not have a closed water balance, and contaminants may flow to areas that are not expected according to the model. Applying numerical models to drinking water distribution systems requires that water utilities spend additional time and effort on understanding their systems to ensure that the models in use are an effective representation of reality.