## Abstract

A reliable water distribution network (WDN) can provide an adequate supply service to customers under both normal and abnormal working conditions. The WDN reliability analysis, therefore, is a keystone to improve the supply service efficiency. Strategies for reliability analysis are usually proved on small WDNs, which do not compare with large real complex systems in terms of number of water tanks, pressure reduction valves, variable speed pumps, controlled devices and possible alternative water supply schemes. The topological changes due to pipeline interruptions impact on emptying–filling of water tanks and network pressure status. This work proposes a two-level procedure for mechanical reliability assessment, suited for large real WDNs. It leverages a path/connectivity-based approach to set up reliability indicators for global-level analysis and local screening of the most critical scenarios. The employed advanced hydraulic model includes the automatic detection of topological changes and the robust modelling of water level in tanks using the generalized global gradient algorithm. The extended period simulation enables the reliability assessment of alternative water supply schemes and the sensitivity of tanks and controlled devices to single failure events. The procedure is demonstrated on a real complex network, being consistent with the ongoing digital transition in the WDN management sector.

## HIGHLIGHTS

Demonstrating the key features of advanced hydraulic models to get effective reliability analysis in large WDNs with multiple tanks and controlled devices.

Novel structured procedure to assess reliability in large complex WDNs based on global and local indicators accounting for unsupplied water to consumers and water deficit in tanks.

Demonstration on a real WDN with unprecedented complexity in the literature.

## INTRODUCTION

Providing adequate and continuous water supply service in urban areas is one of the main drivers of regulation in the water sector worldwide and a major challenge for water utilities. The continuous deterioration of water distribution networks (WDNs) causes the increase of leakages with a growing probability of pipe failures (e.g., pipe bursts), related emergency works (e.g., Girard & Stewart 2007) and the planning of proactive maintenance/rehabilitation actions to reduce the impact of abrupt events. In both circumstances, some WDN portions are kept out of service to carry on works causing abnormal water supply conditions.

The reliability of a WDN is defined as the ability to provide an adequate level of service to customers under both normal and abnormal working scenarios within a prescribed time interval (Xu & Goulter 1999). Such a definition has been driving the scientific community in the last three decades (e.g., Ostfeld 2012; Torii & Lopez 2012; Shafiqul Islam *et al.* 2014; Mazumder *et al.* 2018). WDN reliability was originally classified into mechanical reliability and hydraulic reliability (Farmani *et al.* 2005). The former refers to the failure of system components, e.g., pipe breaks and pumps out of service. The latter accounts for the variability of boundary conditions, e.g., consumers' demands and pipe hydraulic resistances. Later, reliability analysis was also reported in terms of water quality (e.g., Gupta *et al.* 2012).

This work tackles the issue of mechanical reliability analysis in real complex WDNs. The main novelties of this contribution can be summarized as follows: (i) demonstrating the key features of advanced hydraulic models to get effective reliability analysis in large WDNs with multiple tanks and controlled devices (i.e., pressure reduction valves and pumping systems); (ii) introducing a structured procedure to assess global WDN reliability and support the screening of the most critical local interruption events based on indicators that account for both unsupplied water to consumers and water deficit in tanks and (iii) demonstrating the strategy on a real WDN with unprecedented complexity shown in the literature. All such aspects put this contribution in the perspective of digital transformation in the WDN management sector, where WDN digital twins integrate advanced modelling to return the actual hydraulic functioning of real systems, allowing verifiable, replicable, scalable and flexible services to support various technical tasks.

Mechanical reliability is known to be related to the isolation valve system (IVS) (e.g., Walski 1993). Two main IVS configurations were reported by Walski *et al.* (2006), namely the N valves and N−1 valves rules. In the N valves rule, the number of valves is equal to the linked pipes at a junction that results in twice the number of pipes. In the N−1 valves rule, the number of valves at a junction is one less than the linked pipes. Few works reported strategies to identify pipe segments automatically for a given IVS as well as to design IVS aimed at maximizing WDN reliability (e.g., Hernandez & Ormsbee 2021).

Isolating a WDN segment has various potential impacts on water supply: the supply cut-off for the customers directly fed by the isolated segment during the work; and the possibility of unintended isolation of other WDN portions fed by the isolated segment. In addition, the abnormal hydraulic status in WDN portions still connected to water sources (i.e., outside the isolated segments) might cause insufficient pressure to satisfy water requests. From the hydraulic modelling perspective, this problem was originally faced with *ad hoc* variants of classical demand-driven analysis (e.g., Tanyimboh *et al.* 2001), while pressure-driven analyses (PDA) (e.g., Todini 2003) was introduced later and recommended in many works related to WDN reliability (e.g., Wu & Walski 2006).

Today, PDA is a pre-requisite for advanced hydraulic modelling to support WDN asset management that encompasses pressure-dependent functions of various water demand components including leakages distributed along the pipelines (Giustolisi & Walski 2012). In particular, the effective reliability analysis, especially in complex real WDN, asks for overcoming some key limitations of classical WDN modelling tools, such as EPANET 2.0 code (Rossman 2000). For instance, the unexpected closing of valves/pumps due to abnormal scenarios requires integrating the detection of actual WDN topology into the hydraulic solver, overcoming computationally expensive calls to external routines to modify network topology or heuristic numerical expedients (e.g., assuming very small pipe flow in closed pipes). Moreover, the unpredictable change of pressure regime due to interruption scenarios makes incorrect the definition of leakages as additional nodal demand with fixed patterns (e.g., got from classical model calibration). Finally, tanks play a key role in WDN reliability as they provide water volume even during abnormal working conditions (e.g., Farmani *et al.* 2005); therefore, the known instabilities in reproducing tank levels with classical solvers in extended period simulation (EPS), due to decoupling energy and mass balance at such elements across model iterations (Todini 2011), should be avoided because they hinder the effective assessment of WDN reliability. Such aspect is of primary importance since EPS is mandatory to calculate shortfall in tank water volumes due to abnormal conditions (e.g., Liu *et al.* 2017a).

Besides the above-mentioned pre-requisites, the hydraulic analysis of every isolation scenario should also encompass pressure-driven modelling of all water outflows including consumers' demands and leakages along pipes, stable simulation of filling–emptying of tanks and all kinds of controlled devices, pumps and pressure control valves (PCVs).

Since the assessment of WDN reliability requires computationally expensive simulations under many failure scenarios, several surrogate measures of reliability have been proposed so far, especially integrated with optimization strategies (Liu *et al.* 2017b). The resilience index (Todini 2000), providing a measure of WDN performance under failure conditions based on the power required at each node, is probably the most known. It was modified by Prasad & Park (2004) to account for redundancy of water paths as represented by the uniformity in the diameters of pipes connected at each node. Todini's index was also extended to PDA by Creaco *et al.* (2016). Few studies, even in recent years, reported or compared other surrogate measures of reliability (e.g., Liu *et al.* 2017b; Sirsant & Reddy 2020), although they were mainly used to solve design problems.

The reliability analysis strategy presented herein takes global and local perspectives. The indicators introduced by Giustolisi (2020) are used to perform a global reliability analysis. The same indicators are applied herein for the first time to compare alternative water supply configurations as a management strategy to improve reliability. The screening of the most critical local scenarios accounts for the sensitivity of each tank to every interruption event.

The proposed strategy can be applied either in contexts where the IVS is known in detail or where such information is missing. To tackle the latter case, which is quite common, a path/connectivity-based approach is introduced and discussed herein. It allows effective results to support decision-making, while reducing the number of possible scenarios to analyse, which is of relevant impact to support management actions in large real WDN.

Many previous studies on WDN reliability did not tackle complex case studies in terms of number of pipes and nodes in the model and the hydraulic scheme. Indeed, the main aim of such works was to facilitate the verification of the proposed approaches. Some latest examples can be mentioned. Liu *et al.* (2017b) used Hanoi WDN (34 pipes, 30 nodes, 1 reservoir and 1 tank) and Fossolo WDN (58 pipes, 36 nodes and 1 reservoir); Liu *et al.* (2017a) used a WDN with 279 pipes, 188 nodes and 1 tank controlling pump and Mazumder *et al.* (2018) used 11 pipes, 8 nodes and 1 reservoir. Some examples involving larger networks are reported by Giustolisi (2020) using Santeramo in Colle WDN (3,483 pipes, 3,167 nodes and 1 reservoir) and by Berardi *et al.* (2014) using an area of Oslo (5,322 pipes, 5,059 nodes, 3 reservoirs, 1 tank and 3 pumping stations).

WDN complexity raises two main challenges for reliability assessment: (i) in large WDNs, the IVS might result in many isolation scenarios, most of which have roughly the same impact on the system; this in turns poses decision makers in a quandary to point out the most critical events to design mitigation actions; (ii) large complex WDNs require the hydraulic modelling of articulated hydraulic schemes that might include tanks with the variable water level, controls of valves and pumping stations, unpredictable changes of topology triggered by controls. Therefore, the stable and robust hydraulic modelling of the filling–emptying process in water tanks and all devices controlled by tanks is mandatory to get useful reliability analyses. In fact, the isolation of a pipe segment determines possible changes of pressure regime that might cause the reduction of water supplied to consumers still connected to water sources and the change of leakages along pipelines, thus reducing the outflow from tanks. This, in turn, might have an impact on controlled devices (e.g., valves or pumps) and on larger network portions.

The paper is organized as follows: the next section will recall the main features of the employed advanced WDN modelling which allows for a stable simulation of water tanks. Afterwards, the methodology for mechanical reliability analysis in a large real WDN is described along with some remarks on global and local reliability analyses. The Results and Discussion section will start with the description of the case study based on a real complex WDN; then the results of reliability analysis are discussed, before drawing conclusions.

## MATERIALS AND METHODS

### Stable simulation of water tanks for mechanical reliability analysis in large WDNs

The water level in tanks integrates the hydraulic functioning of a WDN, including pressure-controlled devices, pumping systems, patterns of consumers' demand and pressure-dependent leakages from pipelines. As such, water tanks provide the storage of water volume and energy (i.e., hydraulic head) affecting WDN behaviour under abnormal working conditions due to isolation of pipe segments.

*et al.*2012) and was developed to overcome the known instabilities of other solving algorithms, including that in EPANET2 (Rossman 2000), where mass balance and energy balance equations are decoupled during simulation routines (Todini 2011). To this aim, according to the G-GGA solving paradigm, the equations representing the WDN hydraulic behaviour include the variation of water levels in tanks among the unknowns of the WDN hydraulic status, as reported in matrix form in Equation (1), for each time snapshot

*t*of an EPS (Giustolisi

*et al.*2012):where

**A**

*and*

_{np}**A**

_{p}_{0}are the topological incidence sub-matrices of the general topological matrix;

**A**

*is the transpose matrix of*

_{np}**A**

*;*

_{pn}**A**

*is the diagonal matrix of pipe head-losses per unit flow. The subscript p and n relate to the number of pipes and nodes (unknown heads), while the subscript ‘0’ refers to the number of nodes with known heads.*

_{pp}**Q**

*is the column vector of unknown pipe flow rates;*

_{p}**H**

*is the column vector of unknown nodal heads;*

_{n}**H**

_{0}is the column vector of known nodal heads and

**V**

*is the column vector of volume outflows during Δ*

_{n}*T*lumped at nodes. The choice of the internal variable Δ

*T*, e.g., 15, 30 or 60 min, depends on the specific modelling purpose, the variability of water demand patterns and the size of the network. During each Δ

*T*, water demands are assumed as stationary (Giustolisi & Walski 2012), i.e., with a constant average value, and the filling/emptying process of water tanks is assumed as slow (Todini 2011). The technical lower bound of Δ

*T*is a few minutes and depends on the spatial and time aggregation scales of demands. The selection of a very small Δ

*T*might contradict the assumption of slow time-varying boundary conditions.

**V**

*is as follows:where and are, respectively, the column vector of pressure-dependent consumers' demand (e.g., Wagner*

_{n}*et al.*1988) and the column vector of leakages from pipelines (e.g., Germanopoulos 1985) lumped at nodes; leakages at the pipe level can be modelled as follows (Giustolisi

*et al.*2008a):where

*β*and

_{k}*α*are the model parameters, L

_{k}*is the pipe length and P*

_{k}

_{k}_{,avg}is the average pressure along it.

**V**

*is the volume of water in tank, which can be written as follows:where Δ*

_{n}^{tank}**H**

_{0}(

*t*) is the vector of water-level variation in tanks due to filling/emptying during Δ

*T*,

**Ω**

_{0}is the vector of cross-sectional areas of tanks and represents the external water volume feeding the tanks (if any). The solving algorithm of model in Equation (1), including the water-level variation Δ

**H**

_{0}(

*t*) among the unknowns, can be found in Giustolisi

*et al.*(2012). Figure 1 shows the example of the Apulian WDN, where each node is replaced with a tank assuming random initial water levels and 24-h EPS, to remark the stability performances of the G-GGA.

It is worth remarking that in real complex WDNs with hydraulic devices controlled by tanks, spurious spikes in modelled water levels might have serious impacts on reliability analyses. In fact, the numerical instabilities in modelling tanks might trigger the switch on/off of controlled pumps and valves and, in turn, non-realistic assessment of system reliability.

Besides the stable simulation of tanks mentioned above, the advanced hydraulic modelling of WDN used herein integrates the automatic detection of current WDN topology before and during the model run, e.g., to account for a possible change of topology due to controlled devices. It encompasses pressure-driven modelling of all water outflows including leakages along pipes and consumers' demands, stable simulation of all kinds of controlled devices, i.e., any kind of pumps and valves (Giustolisi *et al.* 2008b).

All such features of the hydraulic model are mandatory to run the EPS of each interruption scenario and assess the relevant impact and risk in terms of unsupplied demand to consumers and water deficit in tanks over a 24-h operating cycle. Dealing with large WDNs with multiple complex controls, under any possible interruption scenario, also requires high robustness and computational efficiency of the hydraulic model, as an additional pre-requisite to overcome surrogate reliability indicators.

### Structured procedure for reliability analyses in large WDNs: concepts and methodology

Assuming the *N valves* or the *N**−*1 *valves* rule (Walski *et al.* 2006) means that each single pipe can be disconnected from the network, which is not true in a large real WDN. From the topological perspective, interrupting a single pipe in a line of serial pipes (i.e., with nodes joining only two pipes in the line) determines the same loss of connectivity as interrupting the entire line of serial pipes. Moreover, taking each single pipe out of service in large WDNs leads to many scenarios resulting in the same (or very similar) impact on WDN functioning, which is non-informative to design mitigation actions.

The path/connectivity-based approach introduced herein assumes that pipe segments to be used in reliability analysis include pipes between non-serial nodes, i.e., isolation valves are assumed in vaults/manholes joining three or more pipes. Therefore, each segment isolation determines the same impact on connectivity as each single pipe. This way the path/connectivity-based analysis results in about a half of the number of scenarios required for single pipe isolation, thus reducing the computational burden and making the results informative to support mitigation actions.

In addition, this analysis is more realistic since it assumes the correct functioning of a smaller number of isolation valves in the system, i.e., close non-serial nodes, providing at the same time a priority for their inspections and maintenance. The hydraulic variables describing the WDN status, based on G-GGA mentioned in the previous sections, over 24-h EPS are used to support two levels of reliability analysis, i.e., *global* and *local*.

*Global analysis* is based on *reliability indicators* to get the overall reliability of the system at every hour of the day over a typical operating cycle, based on the probability of each failure scenario. Such indicators provide an overall picture of WDN mechanical reliability, which can be of direct relevance to compare the impact of alternative water supply schemes (like in the case study discussed later) or controls on the same WDN.

*Local analysis* allows screening of every interruption scenario and highlighting the sensitivity of each tank. Such screening enables ranking all scenarios by criticality in terms of impact and risk of unsupplied demand, water deficit at tanks and providing a priority to set mitigation actions (e.g., by creating alternative water paths or modifying controls) from among thousands of alternatives.

Therefore, the structured procedure reported here enables two levels of analysis and decision support:

*global*reliability indicators allow comparing alternative management strategies for a given WDN, e.g., supply scenarios or sets of controls, supporting decisions at the scale of the entire system;*local*reliability analysis points out the most critical events, where*ad hoc*countermeasures should be designed to mitigate the potentially disruptive effects of some local events.

Providing outputs suited for different scales of actions is consistent with the purpose of supporting the solution of specific technical problems. This is part of the ongoing digital transformation paradigm in the WDN sector that takes advantage of current and future computational resources and strategies to foster engineering-oriented approaches. Figure 2 summarizes the proposed procedure for reliability analyses in large WDNs as a conceptual map.

### Some remarks on global reliability indicators for large WDNs

*global level*reliability analysis in large complex WDNs is based on

*global reliability indicators*proposed by Giustolisi (2020), which integrate hydraulic status with topological changes due to intended/unintended segment isolation and, if the case, to controls. The

*reliability indicator*,

*RI*, of water supply at each

^{fd}*i*th node, for each time step

*t*of the EPS, is defined as follows:where

*d*(

^{req}*i*,

*t*) is the required demand, and

*d*

^{ac}^{t}(

*i*,

*s*,

*t*) is the delivered demand assuming the isolation of the

*s*th segment, such that the

*i*th node is external to the

*s*th segment and still connected to some water source (i.e., it belongs to the set

*conn*of nodes connected to water sources).

*n*is the number of nodes, and

_{n}*n*is the number of segments.

_{s}*Π*(

*s*) is the ratio between the sum of failure probability of all the elements inside the

*s*th segment and the sum of the failure probability of any element in the network. The probability of pipe failure can be defined based on maintenance records; if such data are missing or insufficient, the probability of failure can be reasonably assumed as proportional to the length of the pipes in the segment.

It is worth noting that the change of topology might result in lower flow through some water paths, increase of pressure in some nodes in the network and local increase of leakages. Therefore, assessing mechanical reliability based on pressure in a single node or in terms of average pressure variation over an operating cycle (i.e., accounting for pressure deficit and pressure raising) may provide misleading results. *Vice versa*, the *unsupplied water demand to consumers* in consequence of pressure deficit is an explicit indicator of system reliability.

*topological reliability indicator TI*

^{fd}of the

*i*th node, as belonging to the isolated segment; the

*topological reliability indicator UI*of the

^{fd}*i*th node, as unintentionally isolated, as in Equation (6):

*TI ^{fd}*(

*s*,

*i*) and

*UI*(

^{fd}*s*,

*i*) depend on IVS and probability of failure of the

*s*th segment, but do not change over time since they depend on network topology under failure events. All such indicators can be included in the

*hydraulic reliability indicator*(

*RIH*) at the

^{fd}*i*th node at time

*t*entailing insufficient water supply or topological disconnection from water sources:

*RIH*(

^{fd}*i*,

*t*)

*=*

*RI*(

^{fd}*i*,

*t*)

*+*

*TI*(

^{fd}*s*,

*i*)+

*UI*(

^{fd}*s*,

*i*).

*hydraulic reliability indicator*. Therefore, unlike small WDNs, such indicator could be non-informative to drive management actions in larger systems.

*Vice versa*, the

*network hydraulic reliability indicator RIH*(

^{net}*t*), defined as follows, provides a global indicator to assess the reliability of the entire network at each time step:where

*RI ^{net}*(

*t*) is called

*network reliability indicator*,

*TI*is the

^{net}*network topological reliability indicator*; Δ(

*s*,

*t*) is the sum of unsupplied demand internal to

*s*th isolated segments, normalized to total network demand at time

*t*;

*TU*is the

^{net}*network topological reliability indicator*due to

*unintended disconnection*of nodes after closing each

*s*th segment;

*Ψ*(

*s*,

*t*) is the sum of unintentionally unsupplied demand, normalized to total network demand at time

*t*.

It is worth noting that, differently from *TI ^{fd}*(

*s*,

*i*) and

*UI*(

^{fd}*s*,

*i*), the network indicators based on topological changes (

*TI*,

^{net}*TU*) depend on time as they encompass the impact of isolation in terms of unsupplied water (i.e., Δ(

^{net}*s*,

*t*) and

*Ψ*(

*s*,

*t*)) in each segment isolation scenarios.

It has to remark that it is impossible to use global network indicators *RI ^{net}*,

*TI*,

^{net}*TU*and

^{net}*RIH*to compare different WDNs, since small differences of such indicators (e.g., 1%) might represent quite different volumes of unsupplied water demand depending on the size, connectivity, asset deterioration (i.e., leakages) and IVS of the systems.

^{net}*Vice versa*, global network indicators can be useful to compare reliability for the same WDN.

Therefore, the proposed strategy uses the global indicators in large WDNs with many tanks and controlled devices and/or alternative water supply schemes to evaluate the reliability of different management options.

### Some remarks on local reliability analysis in large WDNs

*Local reliability analysis* is conceived herein to drive the *screening* of the most critical scenarios based on the advanced hydraulic modelling of each single segment isolation scenario, i.e., without averaging as performed in global indicators.

The unsupplied water to consumers represents the main hydraulic variable to assess the reliability of water supply even for each single interruption event. Nonetheless, in a large WDN, the variation of water level in tanks represents an integral measure of WDN hydraulic functioning and an element to assure reliability (e.g., for firefighting) in face of abnormal conditions. For this reason, the water level in tanks at the end of an operating cycle (e.g., 24 h) should be not lower than the initial value.

In Equations (11) and (12), *n _{tank}* is the number of tanks in the WDN, and

*V*(

_{wt}^{tank}*t*) is the volume in the water tank

*wt*at time step

*t*. The summations in and include only positive terms (i.e., water deficit at tank

*wt*).

It must remark that, unlike the global indicators proposed by Giustolisi (2020), indicators in Equations (11) and (12) are introduced in this work as part of the structured strategy for reliability analysis in large complex WDNs, aimed at supporting the design of possible countermeasures.

## RESULTS AND DISCUSSION

### Case study description

In a complex WDN, the interplay between the emptying/filling process of tanks and current WDN connectivity is emphasized by the size of system. Therefore, a structured procedure based on advanced hydraulic modelling integrated with topological analysis of actual WDN connectivity is mandatory to get effective information on WDN reliability and support design/management decisions.

This work reports the reliability analysis carried on a real large WDN. The model of the WDN comprises 9,521 nodes (with 3 reservoirs and 12 tanks) and 10,776 pipes, with a total pipeline length of about 852 km. The analysed WDN can be fed by two source points: the source indicated by ‘J’, which consists of two reservoirs, and the source indicated by ‘B’, which consists of one reservoir; the WDN also includes 12 internal tanks (see Figure 3). About the main devices, the WDN includes 4 check (unidirectional) valves (CH), 118 PCVs and 66 pumps, of which 35 are variable speed pumps (VSPs). The complexity of such a system is due to the peculiar elevation layout, which requires a combination of pumping for higher areas and pressure reduction for lower areas.

Figure 3 reports the WDN layout emphasizing elevation (right figure), where blue indicates lower values and red higher ones; red circles identify water sources B and J. The left of Figure 3 globally shows the used WDN with all its relevant devices, such as the internal water tanks (yellow dots), pumps (labels ‘PM’), VSP (labels ‘VS’ close to pumps), PCV (labels ‘PV’, where the labels ‘Pset’ identify the nodes controlling PCV or VSP) and check valves (labels ‘CH’). The red squared window reports some details on how PCV, pumps and internal water tanks are represented in the WDNetXL model. Please note that for confidentiality reasons it is not possible to show more details.

The complexity of the analysed system goes well beyond commonly adopted case studies in technical/scientific papers about reliability analysis. For example, there are 35 VSPs grouped into 13 pumping stations with two or more pumps. In addition, there is a PCV with changing setpoint based on flow along a pipe to emulate a flow control valve and a PCV with a target pressure changing over time. It is worth reporting that the WDN is characterized by three water supply configurations: from J only, from B only or from both; consequently, the reported analyses account for all such operating configurations.

It is worth also noting that the original model, which was available in the classical EPANET format, allows switching among the different supply configurations, including several closed/abandoned pipes, ranging between 393 and 396, depending on the water supply scenario. Moreover, to make the system work properly, several automatic controls are used and implemented in the model (about 364 lines of ‘rules’ and ‘controls’ in the original EPANET file).

Such circumstances have made it mandatory to use the advanced hydraulic model as above described, which integrates the automatic detection of actual WDN topology connected to water sources as well as the representation of leakages at pipe level, allowing an efficient representation of controls and devices in the WDN. In fact, the analysed WDN has 28 pipes or pumps whose status (open/closed or switch on/off) is controlled by the water level in tanks. It is worth reporting that for pumps highlighted in yellow (Pipe ID 10645, 10646, 10648 and 10649), such control is redundant because they are VSPs controlled by the water level in tanks; i.e., whose speed factor is modulated to keep the water level in tanks T11 and T8 at a desired fixed level.

The above-mentioned remarks emphasize that the WDN model implementation can be affected by the limitation of the adopted modelling tool, forcing the user to adopt expedients to represent the real functioning of the network. This is the case of taking a fixed ‘leakage’ demand pattern which is independent of pressure and lumped at nodes (in place of assuming leakages along pipes depending on deterioration and pressure).

To perform the proposed reliability analysis, the WDN model was implemented in the WDNetXL software platform (WDNetXL 2021), which implements the advanced hydraulic model described above. After importing the original data, the parameters *β _{k}* and

*α*of the pressure-leakage model (see Equation (3)) were calibrated for each single pipe (e.g., Berardi & Giustolisi 2021) by using the information on ‘leakage’ demand component at nodes to get the same leakage volume and spatial distribution as reported in the original file.

_{k}Isolation valves are assumed close to non-serial nodes, i.e., joining three or more pipes, consistently with the path/connectivity-based analysis of WDN reliability described above. This allows also overcoming the lack of information on real IVS. Such assumption resulted in 5,575 pipe segment isolation scenarios, i.e., about half of the single-pipe isolation case (i.e., 10,776).

All controls and settings are based on the current water supply configuration which is fed from ‘J’ source only. Therefore, controls are not set for configurations of water supply from ‘B’ and from both ‘B+J’. Consequently, two tanks are emptying even in a normal operating cycle (i.e., without isolating segments) in configuration B, and a tank is in complete filling (possibly overflowing) in B+J case as reported in Figure 4.

### Global reliability indicators

The analysis of mechanical reliability was performed under each water supply configuration, i.e., ‘B’, ‘J’ and ‘B+J’, resulting in different values of reliability indicators *RI ^{net}* (network reliability),

*RIH*(network hydraulic reliability),

^{net}*TI*(network topological reliability indicator) and

^{net}*TU*(topological reliability indicator of the network and assumed IVS due to unintended disconnection of nodes). The probability of failure of each segment is assumed as proportional to the length of pipes in the segment.

^{net}Figure 5 (left) shows the comparison of the network hydraulic reliability indicator *RIH ^{net}* for the three water supply scenarios, i.e., averaged over all segment isolation scenarios.

Figure 5 (right) shows network topological reliability indicator with respect to isolated nodes (*TI ^{net}*) and unintended disconnection of nodes (

*TU*) that change over time due to patterns of water requests in isolated nodes and are the same for all water supply scenarios. It can be noted that the values of

^{net}*RI*, not reported here for sake of brevity, are quite close to

^{net}*RIH*, because of the low values of

^{net}*TI*and

^{net}*TU*, which are likely to happen in large real WDNs because of many alternative water paths.

^{net}When the network is supplied from ‘B’ only, the reliability indicator *RIH ^{net}* decreases; this is consistent with the emptying of some tanks even without failure events in such configuration.

In ‘B+J’, WDN reliability is larger than in ‘J’ case, as expected from the presence of two water sources from the network, located on opposite sides of the main water distribution area.

The most remarkable differences between configuration ‘B’ and the other two are observed after the first 6 h of the day, due to the increase in water requests and emptying of some tanks, which are emphasized when segments are isolated.

This demonstrates how *global reliability indicators* allow comparing WDN mechanical reliability under different water supply configurations or possible alternative controls in the same system, by averaging results from exhaustive hydraulic analysis of isolation scenarios of each segment, as identified by the IVS. Nonetheless, such indicators do not provide useful information about the most critical failure events.

### Role of emptying–filling of tanks on WDN reliability

Each failure event impacts WDN in terms of unsupplied demand, changes in pressure regime and leakages from pipelines, emptying of tanks and, therefore, alteration in normal control over the operating cycle.

Figure 6 compares the three water supply configurations (‘B’, ‘J’ and ‘B+J’) in terms of unsupplied water to consumers, averaged over 24-h EPS. All segment isolation scenarios are sorted as descending unsupplied water; the same figure also shows the 500 scenarios with the highest impact.

Figure 6 compares configurations ‘B’, ‘J’ and ‘B+J’ in terms of water deficit in tanks, reported as water flow unsupplied to tank over 24-h EPS; the same figure also shows the 500 scenarios with the highest impact. Consistently with the purpose of reliability analysis in Equation (11), tanks with the final water level higher than the initial level are taken as null deficit.

Advanced analyses demonstrate that some changes in WDN topology might change water paths from pumps to tanks or from tanks to some network portions. In the latter case, this might reduce pressure along pipelines, resulting in less water leaving the tank because of reduced leakages and possible unsupplied water demand at consumers. This hydraulic condition might delay the emptying of the tank, thus resulting in a sufficient water level at the end of the operating cycle, although water is not delivered to some consumers.

Configuration ‘B’ results in the highest unsupplied water to consumers and the lowest deficit in tanks. In this case, the combined effect of less water supplied to consumers and lower leakages due to pressure reduction in consequence of segment isolation results in slower emptying of tanks. In configuration ‘B+J’, the level of unsupplied demand is the lowest of all supply configurations tested owing to multiple water sources activating alternative water paths. This scenario is also consistent with the highest water deficit at tanks because of faster emptying. Figure 6 shows that some events have a massive impact on the main WDN hydraulic functioning, leading to an increase of water deficit in tanks, moving from right to left of the same figure. The 400 most critical scenarios for supply from ‘J’ mostly fall between configurations ‘B’ and ‘B+J’.

It must recall that all analyses so far are based on the assumed IVS using the path/connectivity approach and the assumed failure probability proportional to pipeline length in each segment. Therefore, from the WDN management perspective, each failure scenario can be described in terms of risk, computed as the product between the probability of segment failure and relevant impact, as in Equation (12).

Figures 8 and 9 show failure events for the three supply configurations sorted in descending order of risk of unsupplied water to consumers and risk of unsupplied water to tanks, respectively, with emphasis on the first 100 segment failures. It is evident that the probability of failure makes the trends smoother than Figures 6 and 7. This means that, although some events have a major impact on WDN functioning, either as unsupplied water to consumers or deficit at tanks, the probability of such events is lower because they refer to short pipes, close to tanks, reservoirs or devices.

Figure 8 confirms that the supply from ‘B’ only results in the highest risk of unsupplied water to consumers, although Figure 9 reports the lowest risk of deficit at tanks. Such results further demonstrate that stable modelling of the filing/emptying process of tanks, within advanced hydraulic modelling, is mandatory to get meaningful mechanical reliability analyses.

## CONCLUSIONS

The analysis of mechanical reliability in a large real WDN poses serious challenges due to the number of possible isolation scenarios as well as to the system hydraulics, including multiple water tanks and controlled devices. The integrated effects of topological changes due to closing isolation valves, pressure-dependent demands and leakages, and water level in tanks and controlled devices in such systems make the impact of each failure event non easily predictable.

According to what was set out at the beginning, this paper demonstrates:

The stable and robust modelling of water level in tanks, coupled with the identification of topological changes under the isolation of segments, which allows quantifying WDN reliability: The strategy allows two levels of decision support based on the mechanical reliability assessment. Global reliability indicators, based on explicit quantification of unsupplied water to consumers, allow comparing alternative water supply configurations or controls. Local reliability analysis drives the screening of the most critical interruption scenarios, leveraging the unsupplied water and the water deficit at tank over an operating cycle, in terms of both impact (i.e., absolute values) and risk. On the one hand, this helps identifying the most critical scenarios, supporting the targeted design of countermeasures; on the other hand, this puts into evidence the sensitivity of each tank and controls to single events, driving towards possible changes in settings controls.

A structured approach for effective reliability analyses in large WDNs: The strategy leverages the path/connectivity-based approach, i.e., assuming the IVS at non-serial nodes if the real IVS is not available. Indeed, as changes in topological domain determine WDN reliability, isolating a single pipe has the same impact as isolating the entire line of serial pipes it belongs to. Moreover, this approach allows reducing the segment interruption scenarios and implicitly provides priority for the maintenance of isolation valves.

The use of a real WDN, with unprecedented complexity shown in the literature, was an indispensable testbed for proving the usefulness of the strategy described on a real management problem of considerable size and complexity.

As a final remark, the proposed procedures and tools tackle the requirements of digital services based on digital twins of real systems, thus being in line with the future digitalization of decision support services for engineers and decision makers.

## ACKNOWLEDGEMENTS

Pictures from WDNetXL were provided by IDEA-RT s.r.l. (www.idea-rt.com).

## DATA AVAILABILITY STATEMENT

Data cannot be made publicly available; readers should contact the corresponding author for details.