Tackling the “ New Normal ” : A Resilience Assessment Method Applied to Real-World Urban Water Systems

The water sector is, currently and for the foreseeable future, challenged by rising levels of uncertainty in demand and availability of water, in a context of aging infrastructure and limited investment. In order to support strategic planning, water companies need a way to assess how their system behaves when faced with a range of changing conditions (climatic trends, asset deterioration, behavioral patterns, etc.) as well as accidents/incidents and/or extreme events (wildcards). In this study, a resilience assessment methodology was demonstrated, with ‘stress tests’ alternative water system configurations (including systems designed with decentralized or distributed philosophies) under a range of scenarios and extreme events. A ‘resilience profile graph’ was developed to quantify the performance of each configuration. The methodology was applied to the real-world urban water system of Oasen, which supplies the eastern part of the Province of South Holland, where the current system configuration and two potential future configurations were tested (one decentralized and one distributed). We show how the concept of resilience, operationalized through this methodology, can assist long term decision making and support strategic infrastructure planning.


Planning for the "New Normal"
Infrastructure planning and management (operational, tactical and strategic) relates to being concerned with the longer term: infrastructures we build today need to provide the service they were designed to deliver for several decades into the future (e.g., for a horizon of 25-50 years).That means that infrastructure will inevitably be subjected to the unknown and possibly unknowable at the design/planning stage future pressures.In the more industrialized countries, many systems already outlive their initial design horizon, as most of the water infrastructure was built between 1930s and 1980s; in some cases, urban water systems are over a century old [1,2].Despite infrastructure aging, the actual ongoing renewal rates are lagging behind what should be ideal for ensuring future uncomplicated operation [3].In some cases, for example, with the current rate of infrastructure renewal, the average sewer has to last about 700 years [4] To reduce this unrealistic expectation, levels of investment required by the water sector are very high indeed [5,6].For example, in 2002, the USA

•
The limited supply of water in terms of both quantity and acceptable quality, due to hydro-climatic factors and the associated uncertainty [8,9].

•
The growing demand of water, driven by demographic and socio-economic trends (urbanization, urban growth, industrialization of developing countries, immigration, etc.) changing demand patterns, while concurrently levels of service and related customer expectations increase [10,11].
Of course, as the pre-Socractic Greek philosopher Heraclitus suggested "Change is the only constant in life", and hence, these challenges and the uncertainty that is associated with their future evolution is neither abnormal, nor a new concept.However, regarding the future of the water sector, the landscape is expected to change in an unprecedented rate and magnitude [12][13][14].The current era of higher levels of uncertainty is becoming known in the water industry and policy makers as 'the new normal' [15], implying that this level of uncertainty to everything from climate to geopolitics and from technology to population shifts, is here to stay, challenging water utilities.The "new normal" can result in unexpected and unplanned losses in revenue and increasing costs due to the aforementioned challenges.A recent example of the "new normal" is the Cape Town water scarcity, where officials are adopting a strategy that treats the recent persistent draught events as the "new normal scenario" in their decision-making [16].

Complications of Designing Infrastructure for the 'New Normal'
In order to design infrastructure able to withstand future challenges, we must first categorize the type of pressures applicable to urban water systems (UWS).Some occur outside the remit of the UWS decision maker (e.g., supply-side uncertainties due to large scale climatic changes cannot be 'controlled' by a water company), some occur within (e.g., delivery side challenges addressed within an asset management context) and some occur in an intermediate space where the UWS decision maker has some influence but no direct control (e.g., demand side changes relying on end user behavior change).These three interconnected spheres are termed external, internal and transactional, respectively, and can be seen in Figure 1 [17].The interactions between these three conceptual spheres result in a vast scenario space.To make matters worse, for a given future scenario, the era of the "new normal" is expected to usher in higher order uncertainties to any of these spheres.In this context, the behavior of systems under uncertainty is not well understood.Individual components of the system are more or less comprised of known properties and are tested, during their design stage, against various conditions following stochastic procedures (e.g., the capacity of a water supply network).However, the overall system is affected by a deployment of portfolios of different technologies and must retain operation under significantly different, uncertain futures [17].Water companies need to assess how their system will behave under this ever-changing landscape; however, as the system boundaries widen and the design/planning horizons become longer, it is increasingly more difficult to select the 'best' strategy among multiple alternatives [18].The increasingly volatile environment of the foreseeable future challenges past conventional planning notions, which rely on the ability to project future change [19] and suggests the need for a design paradigm shift in strategic planning [12,17,20].As many contemporary scholars point out, the past notion of overdesigning systems to be 'full proof', against all eventualities should be revisited [12], arguing that it is as expensive [21] as it is futile [22].'full proof', against all eventualities should be revisited [12], arguing that it is as expensive [21] as it is futile [22].

Enter Resilience, the Holy Grail of Water Strategic Planning
This quest for a paradigm shift underpins much of the work around the term "resilience" which is currently dominating the policy discourse of future-proofing our infrastructures [23].Being a relatively recent term in the water industry, there are several definitions used among scholars [24], although dominant and fundamental in the literature is the definition given in Holling's early work [25] and later refinements [26], where resilience is defined as "the amount of disturbance that a system can withstand without changing self-organized processes and structures".A large lineage of definitions stems from Holling's seminal work [25], although there are also definitions of resilience that are based on the theme of "return time to a stable state following a perturbation" [27].Specifically, for engineering systems, such as UWS, it is generally agreed (e.g., [28,29]) that resilience is not limited to specific components, but characterizes the whole system and its performance under stress, measured against specific metrics.Clearly, it is desirable that performance of UWS should be maintained, to the extent possible, during and after failure; thus, in this context, resilient systems should be designed as safe-to-fail rather than fail-safe even under unknown and unforeseen future conditions [22].Considering this distinction, another term often associated with resilience in the literature is robustness [30,31].It is a desired trait and can be defined as the level of pressure that the system can take without failing [32].At the extreme case, a 'perfectly robust' system is not expected to fail under any circumstance-it is the ideal 'fail-safe' system (and hence equally elusive).A robust system is concurrently resilient; however, a resilient system is not always robust, as it can be allowed to gradually fail to some degree even with relatively light pressures, but may continue to provide some performance even under heavy pressures.

Resilience Assessment Approach
We argue that what is required for designing real world resilient systems is a consistent methodology, based on a formal operational definition of resilience, capable to assess the overall performance of an urban water system, without being proprietary or tied to a specific topological or technological scheme.Such a methodology should account for significant long-term uncertainties, so

Enter Resilience, the Holy Grail of Water Strategic Planning
This quest for a paradigm shift underpins much of the work around the term "resilience" which is currently dominating the policy discourse of future-proofing our infrastructures [23].Being a relatively recent term in the water industry, there are several definitions used among scholars [24], although dominant and fundamental in the literature is the definition given in Holling's early work [25] and later refinements [26], where resilience is defined as "the amount of disturbance that a system can withstand without changing self-organized processes and structures".A large lineage of definitions stems from Holling's seminal work [25], although there are also definitions of resilience that are based on the theme of "return time to a stable state following a perturbation" [27].Specifically, for engineering systems, such as UWS, it is generally agreed (e.g., [28,29]) that resilience is not limited to specific components, but characterizes the whole system and its performance under stress, measured against specific metrics.Clearly, it is desirable that performance of UWS should be maintained, to the extent possible, during and after failure; thus, in this context, resilient systems should be designed as safe-to-fail rather than fail-safe even under unknown and unforeseen future conditions [22].Considering this distinction, another term often associated with resilience in the literature is robustness [30,31].It is a desired trait and can be defined as the level of pressure that the system can take without failing [32].At the extreme case, a 'perfectly robust' system is not expected to fail under any circumstance-it is the ideal 'fail-safe' system (and hence equally elusive).A robust system is concurrently resilient; however, a resilient system is not always robust, as it can be allowed to gradually fail to some degree even with relatively light pressures, but may continue to provide some performance even under heavy pressures.

Resilience Assessment Approach
We argue that what is required for designing real world resilient systems is a consistent methodology, based on a formal operational definition of resilience, capable to assess the overall performance of an urban water system, without being proprietary or tied to a specific topological or technological scheme.Such a methodology should account for significant long-term uncertainties, so that options can be better understood and evaluated by water companies in the process of strategic planning by providing information to aid decision making.We have articulated such a definition and methodology in our earlier work [17] where an operational definition of resilience was used by introducing the concept of performance as a function of disturbance, along with a clear methodological framework for urban water systems' resilience assessment.These are summarized for consistency below.

Operational Definition of Resilience and the Basis of Our Methodological Framework
We defined resilience as "the degree to which an urban water system continues to perform under progressively increasing disturbance" [17].The concept is illustrated in Figure 2 with a graphical expression of an urban water system's performance termed the "resilience profile graph" [17].The increasing disturbance takes the form of combined pressures to the system, as part of future world views, interpreted by the x-axis scenario ticks.The y-axis communicates the performance of the system in meeting its objectives (e.g., delivering water to customers) over a time horizon using a specified metric of reliability (e.g., frequency of non-failures, volumetric coverage).In this type of stress-strain graph, the x-axis is an ordinal scale; thus, in order to make a normalized metric scaled from 0 to 1, the area under the curve is divided by the area of the completely robust system and the result is divided by the number of scenarios involved in the stress-strain graph.
that options can be better understood and evaluated by water companies in the process of strategic planning by providing information to aid decision making.We have articulated such a definition and methodology in our earlier work [17] where an operational definition of resilience was used by introducing the concept of performance as a function of disturbance, along with a clear methodological framework for urban water systems' resilience assessment.These are summarized for consistency below.

Operational Definition of Resilience and the Basis of Our Methodological Framework
We defined resilience as "the degree to which an urban water system continues to perform under progressively increasing disturbance" [17].The concept is illustrated in Figure 2 with a graphical expression of an urban water system's performance termed the "resilience profile graph" [17].The increasing disturbance takes the form of combined pressures to the system, as part of future world views, interpreted by the x-axis scenario ticks.The y-axis communicates the performance of the system in meeting its objectives (e.g., delivering water to customers) over a time horizon using a specified metric of reliability (e.g., frequency of non-failures, volumetric coverage).In this type of stress-strain graph, the x-axis is an ordinal scale; thus, in order to make a normalized metric scaled from 0 to 1, the area under the curve is divided by the area of the completely robust system and the result is divided by the number of scenarios involved in the stress-strain graph.The resilience assessment framework incorporates some distinct properties and tools that differentiate it from other approaches to asset planning and infrastructure design: 1.A focus on novel, integrative, whole system modeling, which provides the evidence base to support long term decision choices regarding alternative water system configurations, based on their performance, under higher order uncertainty, at the overall system level.The latter is achieved through the further development and customization of a powerful source-to-tap water system model called UWOT [33][34][35][36].UWOT, initials for Urban Water Optioneering Tool, is a bottom up, micro-component based, urban water cycle model, which simulates the demand, supply, wastewater and drainage at any range of time steps and multiple network scales (from The resilience assessment framework incorporates some distinct properties and tools that differentiate it from other approaches to asset planning and infrastructure design: A focus on novel, integrative, whole system modeling, which provides the evidence base to support long term decision choices regarding alternative water system configurations, based on their performance, under higher order uncertainty, at the overall system level.The latter is achieved through the further development and customization of a powerful source-to-tap water system model called UWOT [33][34][35][36].UWOT, initials for Urban Water Optioneering Tool, is a bottom up, micro-component based, urban water cycle model, which simulates the demand, supply, wastewater and drainage at any range of time steps and multiple network scales (from simple household to a complete hydrosystem).Unlike typical urban water models, which employ a dual approach (simulate outgoing flows directly and assume incoming flows equal to demand), UWOT adopts a simulation methodology that is based on a single consistent approach for every urban water cycle flow.As every urban water flow is caused by a (deterministic) demand (need for potable water, need to drain storm water, need to dispose wastewater, etc.), UWOT simulates the generation, aggregation and transmission of demand signals, which, under normal (non-failure) conditions, are met accordingly by a flow.The routing of the demand signals extends from the household water appliances 'upstream' all the way to the water resources and 'downstream' to the disposal at the water bodies.We used UWOT as the main simulation model of the entire water system and the assessment of its performance in terms of quantity and quality objective(s).The methodology itself was not dependent on the use of this specific (or indeed any other) model.In fact, other whole system models, or even specialized sub-system models (e.g., EPANET or Infoworks for the water distribution subsystem) can, in principle, be used within the same methodological framework, although an important aspect of our framework was the ability to model a complete water system, from the source, through supply and treatment to distribution and then on to sewerage, wastewater treatment and recipient water body.This in turn allowed for the articulation and modeling of scenarios and pressures affecting all the different element of the water system, from source to tap, as well as the inclusion of diverse technological options (including for example, different degrees of centralization for treatment plants, reuse and recycling at multiple scales, rainwater harvesting, demand management, etc.).

2.
A powerful and versatile approach adopted to take long term uncertainties into account and examine what effects they have to the system(s) under study, through the creation of alternative 'world view' scenarios used in the modeling framework.This approach allows water companies to understand how their system is likely to behave when faced with a range of changing conditions (climatic trends, asset deterioration, behavioral patterns, etc.) as well as accidents/incidents and/or extreme (black swan) events [37] in the physical, social or economic spheres.The approach is based on the articulation of sets of scenarios, from mild to severe with which to 'stress test' alternative water system configurations.It is important to note that these scenarios are not the only ones that can be conceived, nor necessarily the absolutely worst scenarios that can affect a particular case.They are internally plausible multi-faceted scenarios co-developed with water system owners (Oasen in this particular case study) that examine a range of eventualities, without taking a view on the probability of each scenario occurring.Different scenarios can be co-developed with utilities and be adapted to the method.The important thing is that the same, internally consistent scenarios are applied to each of the alternative water systems under consideration in order to evaluate them.Specifically, for the "black swan" events we expanded the methodological framework developed in our earlier work [17] by introducing explicit wildcard modeling.These events ("wildcards") do not represent a continued change of world view (e.g., a growing population with water demand that overburdens the systems limits), but rather a single (no matter its duration) stressful incident, e.g., hacking of critical infrastructure.Wildcards have unpredictable patterns and deviate from classical structural or operational failures in the sense of non-repeatability.
The concept of resilience was pivotal in our work and we operationalized it through its application to different water systems.The methodology was first developed by the authors in [17] and applied to a semi-hypothetical case as a proof of concept.The purpose of this paper was to report on enhancing our method and tools and on its application to a real-world case study for demonstrative purposes.

General Characteristics
Oasen is a public drinking water company and its shareholders are the municipalities in the eastern part of the Province South Holland.The history of Oasen begins in Gouda, 1883, where the first 165 houses were connected to the pipeline network.Today, the Headquarters of Oasen are still in Gouda; however, Oasen has expanded, and currently supplies drinking water to 750,000 people and 7500 companies.With seven drinking water purification plants, nine pump stations and a water tower, Oasen is a vast water system that delivers 48 hm 3 of drinking water to customers each year, which includes support to horticultural and industrial activities.In this case study, a downscaled topology of Oasen's hydro system was developed, strictly for the sake of simplicity.Despite being simplified, the model retained extensive detail of the actual water system and all major system and component attributes were included.Oasen provided the relevant data for the model, working in close collaboration with the authors to ensure its integrity.The simplified topology of Oasen's current system-termed hereafter the Business As Usual (BAU) configuration-was first developed to serve as a baseline, as well as a proof of concept for the subsequent modeling work.It should be noted that this simplification cannot act as an extensive technical analysis of Oasen.The BAU configuration model included the following Supply Areas (SAs) and Water Treatment Plants (WTPs): The waste water part of Oasen services was not modeled in this work, although in principle this could be added using exactly the same tools and approach in conjunction with the water supply branch.A map of the area and the simplified topology of the drinking water system are shown in Figures 3 and 4, respectively.Note in Figure 4, that in the real system, the SAs are interconnected, not the WTPs.However, this schematic complies with UWOT's signal routing procedure.WTP capacity stated is the nominal capacity; however, we need to emphasize that there was a level of simplification and abstraction in this work that served the demonstrative purpose of the paper, rather than a detailed assessment of the water company's actual performance.The actual treatment plants employed various treatment chains and processes with variations in terms of actual nominal/maximum capacities and operation management.The UWOT model of the BAU configuration is illustrated in

Formulation of Design Configurations
Three different network design philosophies were examined in Oasen, based on the concepts of centralized, decentralized and distributed network systems.As seen in the conceptual (stylized) schematic of Figure 6, centralized systems (as for BAU) have "stations" (which can be interpreted here as demand sites) linked to the same central source node (for example, one large WTP), decentralized systems include a number of smaller central nodes (e.g., a number of smaller WTPs)

Formulation of Design Configurations
Three different network design philosophies were examined in Oasen, based on the concepts of centralized, decentralized and distributed network systems.As seen in the conceptual (stylized) schematic of Figure 6, centralized systems (as for BAU) have "stations" (which can be interpreted here as demand sites) linked to the same central source node (for example, one large WTP), decentralized systems include a number of smaller central nodes (e.g., a number of smaller WTPs) and distributed systems employ a scheme with stations connected to many other stations/nodes (e.g., with (very) local sources supplying local demands).Additionally, the proposed configurations employed different levels of technologies from current baseline technologies to state of the art, innovative and (sometimes) disruptive solutions:

•
The BAU configuration that is based largely on a centralized philosophy, where the system stays "as is" for the future.

•
The Next Step (NS) configuration based on a decentralization design philosophy.In this option, the larger water treatment plants (10-16 hm 3 /y) are substituted by treatment units of 3-6 hm 3 /y, which are still units with a proven track record, tested in modern system design and could be implemented in a horizon of 5-10 years.The new units use different sources and all plants now use reverse osmosis (RO) as the primary purification technology, allowing them to operate even in a high salinity environment.

•
The Further Ahead (FA) configuration based on a distributed design.In this option, all the existing water treatment plants are replaced by a series of approximately 100 small RO purification units each with production capacity of 70 m 3 /h and a wellfield for every plant.These units are located at the neighborhood level close to the customers and act as each other's back-up in the same SA through a connecting network.The number of units per community is assumed proportional to the number of inhabitants.Rain water is also used as an additional source at the domestic level for non-potable uses e.g., toilet flushing.This represents a rather innovative and disruptive design to implement system-wide and on province-scale, with an estimated technology readiness level of more than a decade.
Water 2019, 10, x FOR PEER REVIEW 9 of 25 Table 1 summarizes key elements of each configuration for comparison.The total installed water production capacity is (nearly) the same for every configuration.UWOT models of NS and FA configurations are shown in Figures 7 and 8.   Table 1 summarizes key elements of each configuration for comparison.The total installed water production capacity is (nearly) the same for every configuration.UWOT models of NS and FA configurations are shown in Figures 7 and 8.

Future World Views
For the generation of future world views, we relied on the toolbox presented in [17] and the reader is referred to this publication for a more detailed analysis.Each future world view is an exploratory scenario that allows the study of diverse future socio-metabolic circumstances for which extrapolations or predictions based on the historical data are not applicable.With the help of the Oasen water company, we co-developed a list (Table 2) of variables that could underpin several future world views and allowed us to construct scenarios rich in narrative options.A scenario was formulated by stating a) the magnitude of change of each parameter, i.e., how much it will change through the design lifespan from the current conditions (see Table 2) of the system and b) the rate of change, i.e., how fast on a standardized ordinal scale the change happens.The rate of change is characterized by one of three curves as seen in Figure 9.These two attributes form the model of scenario morphogenesis, as described in [17].

Future World Views
For the generation of future world views, we relied on the toolbox presented in [17] and the reader is referred to this publication for a more detailed analysis.Each future world view is an exploratory scenario that allows the study of diverse future socio-metabolic circumstances for which extrapolations or predictions based on the historical data are not applicable.With the help of the Oasen water company, we co-developed a list (Table 2) of variables that could underpin several future world views and allowed us to construct scenarios rich in narrative options.A scenario was formulated by stating a) the magnitude of change of each parameter, i.e., how much it will change  We created seven scenarios ranging from mild (small magnitude of change across few parameters, with gradual rate of change) to extreme (high magnitude of change across most parameters, with abrupt rate of change for some) in order to assess resilience of each configuration.The design lifespan of the configurations was set at 25 years.The scenarios were grouped in four narratives, with some narratives including more than one scenario with the same magnitude of change across parameters but differences in rate of change.Details about the variables can be found in Tables A1-4.
The narratives were:  We created seven scenarios ranging from mild (small magnitude of change across few parameters, with gradual rate of change) to extreme (high magnitude of change across most parameters, with abrupt rate of change for some) in order to assess resilience of each configuration.The design lifespan of the configurations was set at 25 years.The scenarios were grouped in four narratives, with some narratives including more than one scenario with the same magnitude of change across parameters but differences in rate of change.Details about the variables can be found in Tables A1-A4.
The narratives were: • Scenario 1 & 2, "Easy does it": These scenarios exhibited the smallest magnitude and rate of change from the Baseline scenario.The Oasen supply area stays roughly the same size, with no change in population and households.Aging occurs as expected with the population share of 65+ almost doubling.There is a modest increase in GDP.The Province of Zuid-Holland gradually allows its industry to expand, resulting in an increase in water demand.Due to a reduction in the usage of fertilizer there is a slight decrease in phosphorus emission to surface water.The political landscape is fairly stable with mostly liberal coalitions.Privatization of the water sector is off the table as trust in government to take care of utilities is high.Although there is a modest increase in industrial activity, to the expense of agriculture, peak contamination of surface water with pollutants remains limited.
• Scenario 3 & 4, "The Young Ones": Faced with economic uncertainty and the outlook of an aging population the Dutch government together with the private sector formulates an ambitious plan to attract young immigrants from Asia and the Middle East to the country.This leads to a gradual increase in the Oasen area population.Water conservation is not a high priority with the younger generation and the partly privatized water sector was not very keen on pushing a change in behaviour either.As a result of the economic expansion, both industrial and horticultural water demand gradually rises as well.To be able to serve this increasing demand at reasonable costs, quality standards are loosened.Due to an increase in industrial activity, the water sector has to deal with frequent increases in pollutants.

•
Scenario 5 & 6, "A crisis looms": The decades following the 2018 political crisis in the EU show hardly any recovery.The brief periods of growth are quickly outdone by subsequent economic crises.The conservative governments of the 2020-2030 push an agenda of austerity and privatization.Trust in government hit an all-time low, with people looking to the private sector for solutions.The Oasen area is hit particularly hard.Population declines, with young families leaving for Amsterdam and Rotterdam exacerbating the already pressing burden of an aging population.Both industry and horticulture gradually leaves the area, leading to a decrease in water demand.Climate change leads to a series of exceptionally dry summers and huge peaks in rainfall in autumn and spring.Due to minimal regulations and oversight from authorities, the river Lek is frequently polluted with all sorts of chemical pollutants, worsened by the long periods of drought.• Scenario 7, "Maximum Overdrive": Two decades of unprecedented growth have put huge strains on de Randstad.Being one of the winners in the catch-all competition between West-European cities, it now has to deal with the consequences: uneven population growth, huge increases in demand for water, food and energy and a relatively low tax-base.Most public services have been privatized and environmental regulations are minimal.The Lek River suffers from frequent peak concentrations of both chemical and biological pollutants.However, drinking water quality norms have not been relaxed, resulting in increasing pressure on the private water suppliers to reliably produce clean drinking water.The use of medicines has doubled due to aging and increase in chronic diseases.Climate change turns out much worse than expected with average rainfall in the winter increased by 50% and an average temperature increase of 4 degrees Celsius.
Moreover, as the Oasen company considers groundwater quality changes due to saline intrusion an important aspect of future performance for the system, an exploratory scenario component was added to all narratives.In this scenario, saline intrusion affects the northern wellfields at year 19, and most of the southern wellfields by year 24, causing Oasen to abandon them, greatly reducing the available good quality groundwater resources.

Wildcard Modeling
To explore wildcard events within the context of a resilience assessment, we decided not to embed them into the formal scenario space, as we did with other, more probability-driven variables (such as the probability of a pipe bursting), but rather to employ a standardized way of further stress testing all scenarios/configurations with wildcards.Specifically, wildcards were applied to every scenario at year 13 (Y13), which is the center of the time horizon under investigation.The benefit of (arbitrarily) stressing the system with a wildcard event in Year 13 across all scenarios is that by the middle of the simulation period, performance across configurations is typically not extremely different; however, the effects of the scenarios are beginning to emerge, as per the rate of change attributes.As such, the wildcard effect was different enough for various configurations and scenarios, but was not overshadowed by extreme differences between scenarios.We measured the impact the wildcard had over the specific period during which it is manifested, and finally, we aggregated wildcard and scenario results.
Four wildcards were developed as storylines and applied the case study: • Wildcard #1, Breach of Veendijk narrative: "At Y13, during a storm, a dyke in the southern area is breached and the area close to the location of BAU's Rodenhuis WTP is flooded".Duration of wildcard is 7 days.Effect of the wildcard (model input): BAU configuration loses a major WTP (Rodenhuis) for 7 days until recovery, a heavy blow to system's reliability.NS configuration is built around decentralization and employs two smaller units in the same area.One of them is located far from the dyke and in higher elevation; thus, only one WTP is affected for 7 days.
FA is completely decentralized with many smaller localized units laid out according to urban density.The area affected is not heavily urbanized, thus, effects are minimal: only two out of the 43 interconnected smaller local WTPs are affected by the dyke breach.
• Wildcard #2, Summer with increased chloride and extreme drought narrative: "The summer of Y13 is characterized by an extreme drought, reducing rainfall by 75% and increasing chloride concentration in river water".Duration of this event is the three summer months of Year 13.Effects of the wildcard: BAU configuration uses conventional technologies, and thus, some of the bank-filtration units are abandoned (De Hooge Boom, Rodenhuis).As the SAs are interconnected, De Steeg WTP is overburdened with the task of providing supply to nearly all areas, greatly reducing the system's reliability.NS configuration uses RO technology.It is largely unaffected, and this can also be attributed to the interconnected SAs: when peak concentration occurs, water can be transferred from Lekkerkerk and De Steeg Plants, which do not use bank-filtration units.FA uses RO technology, but the SAs are not interconnected.Additionally, the reduced rainfall greatly reduces the ability to cover demand through rainwater harvesting, thus the configurations reliability is mildly affected.
• Wildcard #3, Hacking of critical infrastructure narrative: "On 13/06 of Y13, a hacker group exploits a backdoor in the SCADA (Supervisory Control and Data Acquisition) of the most critical component of the system, gains control through ransomware, shuts down the water supply and demands ransom."Duration of wildcard till crisis averted: 1 day.Effect: In the BAU configuration, the De Steeg WTP is targeted.Reliability drops as the demand is diverted to Rodenhuis WTP which has small capacity headroom.
In the NS configuration, the two smaller De Steeg WTPs (which are assumed to be managed and controlled through the same centre) are targeted.Both shut down.Reliability drops as the demand is diverted to the two Rodenhuis WTPs, which have small capacity headroom.
In the FA configuration, it is assumed that the largest WTP group is targeted, which is the Rodenhuis group in this case.The local WTPs are assumed to be controlled and monitored using a single SCADA system at the SA level.As such, all plants shut down.Different SAs are not interconnected in this configuration for back-up.Reliability suffers, as there is no way to cover demand other than (local) rainwater harvesting in the SA that is affected.
• Wildcard #4, Extreme immigration due to climate change narrative: "Due to climate change people from southern Europe and the Middle East, immigrate en masse to northern Europe at Year 13.Oasen is particularly affected facing a population increase of 10%" This resembles a sensitivity test to all configurations, and a more "linear" behavior is expected across this wildcard.
The wildcard period was assumed to be, in this case, a whole year.

Scenario-Based Analysis
Performance results of the BAU, NS and FA configurations are shown in the resilience profile graphs of Figure 10.The metric employed in the analysis is the coverage reliability (defined as volume delivered/volume demanded) over the entire design period.As summarized in Table 3, in scenarios that do not stress the system to its limits, all configurations supply water with at least an acceptable reliability (e.g., >95%).Moreover, differences are indiscernible between the high-end NS and FA configurations.The resilience score of the three configurations is calculated as the average coverage performance for all scenarios.Results suggest that in harsher (in terms of water demand) world views, BAU, the current baseline, is not very resilient.Comparing the other two configurations for more lenient scenarios (scenarios 5, 1, 2, 6), performance differences are indiscernible between them; however, it is evident that the most innovative configuration, FA, has an advantage as the pressures increase (scenarios 3, 4, 7).
Water 2019, 10, x FOR PEER REVIEW 15 of 25 delivered/volume demanded) over the entire design period.As summarized in Table 3, in scenarios that do not stress the system to its limits, all configurations supply water with at least an acceptable reliability (e.g., >95%).Moreover, differences are indiscernible between the high-end NS and FA configurations.The resilience score of the three configurations is calculated as the average coverage performance for all scenarios.Results suggest that in harsher (in terms of water demand) world views, BAU, the current baseline, is not very resilient.Comparing the other two configurations for more lenient scenarios (scenarios 5, 1, 2, 6), performance differences are indiscernible between them; however, it is evident that the most innovative configuration, FA, has an advantage as the pressures increase (scenarios 3, 4, 7).

Wildcard Results
Results from wildcard simulation in Figure 11 can be interpreted as follows: • Wildcard #1: BAU is heavily affected and is the worst performer, while FA is the best performer, since it appears to be unaffected by the event due to interconnectivity of the localized plants in the same SA.

•
Wildcard #2: BAU is heavily affected, being the worst performer, with NS coming up as the best performer.

•
Wildcard #3: There is no configuration that is clearly much better or worse than the others in all scenarios.BAU is never the worst performer, and appears to be the best performer in SC1.NS

Wildcard Results
Results from wildcard simulation in Figure 11 can be interpreted as follows: • Wildcard #1: BAU is heavily affected and is the worst performer, while FA is the best performer, since it appears to be unaffected by the event due to interconnectivity of the localized plants in the same SA.

•
Wildcard #2: BAU is heavily affected, being the worst performer, with NS coming up as the best performer.
• Wildcard #3: There is no configuration that is clearly much better or worse than the others in all scenarios.BAU is never the worst performer, and appears to be the best performer in SC1.NS and FA have worse performance than BAU, which can be explained through the headroom capacity lost as RO technology ages faster than conventional plants and at Y13 actual capacity is lower than BAU.

•
Wildcard #4: The best performer is FA due to the usage of RWH technology, but only marginally.

Interpreting Results from Oasen Case Study
Although the primary purpose of this study was to showcase the resilience assessment method and not to provide a detailed technical analysis of the specific Oasen case, insights into the system's resilience are visible in the results.Results suggest, that significant gains in resilience for Oasen, compared to their current system, can be achieved by moving towards the "Next Step" (moderate decentralization) configuration, while a more extreme decentralization and disruptive option (the "Further Ahead" configuration) does not really achieve significant performance enhancements in most of the scenarios examined.Interestingly, and perhaps counter-intuitively, from the analysis of wildcard scenarios, introduced into the method for the first time in this report, it appears that although both "Business As Usual" and "Further Ahead" come up as the best configurations in some wildcard events, they perform quite badly in others, while "Next Step" seems to be a relatively stable (average) performer overall, providing more confidence towards suggesting a "Next Step" type of

Interpreting Results from Oasen Case Study
Although the primary purpose of this study was to showcase the resilience assessment method and not to provide a detailed technical analysis of the specific Oasen case, insights into the system's resilience are visible in the results.Results suggest, that significant gains in resilience for Oasen, compared to their current system, can be achieved by moving towards the "Next Step" (moderate decentralization) configuration, while a more extreme decentralization and disruptive option (the "Further Ahead" configuration) does not really achieve significant performance enhancements in most of the scenarios examined.Interestingly, and perhaps counter-intuitively, from the analysis of wildcard scenarios, introduced into the method for the first time in this report, it appears that although both "Business As Usual" and "Further Ahead" come up as the best configurations in some wildcard events, they perform quite badly in others, while "Next Step" seems to be a relatively stable (average) performer overall, providing more confidence towards suggesting a "Next Step" type of configuration as the best way forward for Oasen.It is also a more cost-efficient option than "Further Ahead" and that is before accounting for transaction costs that would occur from such a disruptive change of the distribution system's configuration and operation, which is a significant advantage and a tie-breaker.It should also be noted that domestic rainwater harvesting (RWH), as implemented in the Further Ahead system is neither configuration-specific nor incompatible to a Next Step type of system and has been shown to enhance performance.The option of RWH of course requires private investments by customers, and thus, cannot be directly implemented by a water utility.However, a water utility can give incentives to costumers in order to invest in this domestic technology.In this regard, it could be viewed as an option in the transaction space of Figure 1.Additionally, RWH can be of great value in drastically distributed systems as it can compensate (in terms of supply reliability), to some extent, the loss of interconnectivity of bigger WTPs and distribution networks.
The water system also seems sensitive to certain scenario variables.As seen from the response of the configurations to the full set of scenarios created it is scenarios 3, 4 and 7, which affect all system configurations the most, while the current system (BAU) is also affected to some extent even by scenarios 1, 2 (mainly due to the saline intrusion parameter) and 6.This suggests that both the current, but also the other system configurations, to a lesser extent, are vulnerable to significant increases in demand (driven, for example, by population increases through migration postulated in scenarios 3 and 4).This is, of course, a result of the dependence of Oasen on groundwater as a resource, the rates of renewal inherent in this resource (albeit with bank filtration) and, importantly, the strict constraints on abstraction imposed to the well field production by the authorities.The current system is especially vulnerable here due to its sensitivity to futures where saline intrusion and pollution generated from industrial zones upstream, which affects the main groundwater resources.
The difference between configurations becomes even more pronounced when examining the performance in wildcard events.For example, a breach of Veendijk is catastrophic for the current system, while only marginally affecting the NS and not impacting the FA configuration.The same is true of increased chloride and extreme drought scenarios due to the technologies involved; however, perhaps more interestingly and less intuitively, two other aspects of the NS and FA configurations come into view in the wildcard analysis: that of limited interconnectivity between SAs of the FA configuration and that of more rapid aging of the RO technologies in both NS and FA configurations.The former means that although no single event is able to significantly impact the ability of the company to deliver water services to most of its customers in these decentralized/distributed scenarios, there are more failures per unit time and there is less ability to supply water from other SAs when things go wrong.The latter is effectively decreasing, as a function of time, the headroom available as a backup supply, even within a given SA, when some treatment plants are rendered non-operational for any reason.
A final point worth making, also coming from the wildcard scenario analysis, is that although distributed solutions do allow for a spreading and minimization of (spatial) risks as seen in the resilience of the FA configuration, there are important ways in which even the most distributed configuration is centralized and thus vulnerable to other pressures: a case in point is the cybersecurity scenario (wildcard #3, see for example Figure 11), where it is assumed that to be able to control the massively decentralized local treatment plants in the FA configuration, these are all controlled through a central SCADA system and thus more vulnerable to a cyber-attack than the more centralized BAU and decentralized (but not fully distributed) NS, as these allow for manual back-up controls on site, potentially by-passing, for a limited time at least, the affected central control.Such a manual override would not be possible in the FA configuration; hence, it is this configuration that suffers the most from such a wildcard.It is suggested that this interplay between physical and cyber infrastructure (or cyber-physical infrastructure) and related, targeted stress testing should be the subject matter of a further, more targeted investigation.

Insights on the Resilience Assessment Method Applied to A Real World UWS
It should be noted here that these scenarios do not represent 'forecasts' of future, nor do we assign probabilities in their coming to pass-this would negate the basic premise of our work: that of irreducibly high orders of uncertainty affecting the systems in the longer term.As such, the whole approach can be more aptly described as a 'stress test' where the probability of a given stress on, say a concrete element under pressure, is not a relevant parameter for the designer.The ensemble of scenarios applied on the system through modeling allows for an evidence-based assessment of its performance under very different conditions.Performance is affected by both the installed technologies and the way they are connected (design concept) i.e., by the system's configuration.The resilience assessment framework analyzes different configurations of the system under the same pressures to identify the best future performer.Two obvious shortcomings of the method are:

•
The need to translate several qualitative scenario parameters to (necessarily restricted) model inputs and as such introduce subjective bias into model results.This issue is always present when looking at complete socio-technical systems and has been addressed, to some extent, through the development of an enhanced toolbox for a more explicit representation of the complete system, as reported in [18].However, as in all modeling work, internalizing some system elements ultimately only pushes (subjective) assumptions to other system boundaries.

•
Despite the best intentions and an active imagination, scenario planners always fall short of reality, which never seizes to amaze us.This quest for accounting for "unknown unknowns" has been a holy grail of future studies, requirements engineering and evidence-based decision-making for some time [39].However, efforts to account for this in a 'brute force' manner (i.e., by testing "all possible values" of certain parameters) have to face the open-ended, highly complex and interconnected nature of the socio-political and even physical landscapes.This makes them beneficial only in a small subset of pertinent questions (e.g., a sensitivity analysis of the UWS in terms of per capita demand).
Having said this, we would argue that ultimately, the constraint is not in the ability to imagine (by definition) unknowable futures, which could improve with the advent of new ways of experimenting, such as serious games [40], but in the willingness of the water sector to be prepared to think outside the box and prepare for unknowns.A proactive water company (such as Oasen) and a forward looking, resilient water sector (such as the Drinking Water Sector in the Netherlands) could also use this approach to identify key scenario variables that are more critical to the system's performance.Depending on whether these key scenario variables were part of the external, internal or transactional system different strategies could lend themselves as suitable responses, including for example closer monitoring of trends in the external system (e.g., immigration policies, energy pricing or climatic shifts), collaboration with relevant sectors to modify drivers in the transactional system (e.g., saline intrusion in the Delta, working with farmers sharing water resources, etc.) or direct action in the internal system scenario variables (e.g., demand management at household levels).Such a pro-active approach, based on the resilience assessment methodology, could turn the problem on its head and focus attention to critical, albeit perhaps little noticed future scenario variables rather than trying to (only) forecast current trends.In a similar vein, the method could be run 'in reverse' and identify 'threshold' values for these scenario variables, or for water system variables, or indeed (and perhaps more interestingly) combinations of both, which, when surpassed, affect the system significantly.This would empower utilities (and the sector as a whole) to develop 'forward looking observatories' (in combination with scenario variables monitoring as above) as part of their resilience-enhancing strategies and potentially act as triggers for appropriate responses.
The proposed framework is flexible enough to account for any type of scenario developed, in collaboration with stakeholders, from the incremental to the most daring.The complexity of both the scenario scape and the water system (potentially accounting for links with and cascading effect between associated infrastructure: wastewater, energy, flood protection, etc.) that exist in all but the simplest situations, mean that this evidence-based, formal modeling and stress testing approach can yield results that are not accessible through intuition alone, of even the most experienced system operators.
It is further suggested that the idea of stress-testing could also be used, suitably modified, to examine more closely effects of wildcard events (such as intentional cyber-attacks, physical attacks and their combinations) on water infrastructure conceptualized as proper cyber-physical infrastructure.Although an initial attempt to look into this issue as one of the wildcards selected for the case study was undertaken in this work, yielding interesting results, more research is needed into the formal modeling, stress-testing and risk assessment of the combined cyber-physical water system [41].The need for such research is growing as the risk of cyberattacks is rising with the rise of instrumentation, Internet of Things (IoT) and other ICT-related developments in the water sector.

Conclusions
We conclude that the resilience assessment methodology is easy to implement on practically any water system, after suitable customization like case-specific model inputs and UWS configurations.This framework is able to take into account a wide range of specific hazards/events/scenarios and infrastructure options.It can be used to (i) stress test alternative water system configurations and assess their ability to perform (or otherwise) under a whole range of stresses, in other words quantify their resilience; (ii) enrich an initial resilience assessment with follow-up what if or sensitivity-type questions, based on the same models, testing options, assumptions, variables and scenarios; (iii) help identify the scenario parameters or combinations of parameters that are the most 'stressful' for a given system and inform a 'monitoring' process within the water sector of these (physical, socio-economic or even political) parameters; and (iv) be used to back-calculate threshold values of scenario parameters and their combinations that would be deemed 'tipping points' for water system resilience, thus triggering appropriate responses (from political lobbying to new infrastructure commissioning) from the sector.We suggest that following this real-world application, there is enough know-how to apply the method in a relatively short time for any new water system.We argue that, despite its limitations, the resilience assessment method, can serve as a 'bird's eye view' screening and steering tool for supporting strategic infrastructure planning under large scale uncertainty, at the company level.As such, it can precede the commissioning of more detailed design studies of screened options, and additional (more detailed but also costlier) modeling of separate sub-system elements.It is envisaged that this type of study will help fill (part of) the gap between policy rhetoric, specific water technology development and performance assessment supporting strategic infrastructure planning, building on systems thinking and hydroinformatics for a more resilient water sector.

Figure 2 .
Figure 2. The concept of resilience profile graph.In this example, Water System B is more resilient and (happens to be also) more robust than A.

Figure 2 .
Figure 2. The concept of resilience profile graph.In this example, Water System B is more resilient and (happens to be also) more robust than A.

Figure 4 .
Figure 4. Simplified topological relations used in the case study.Blue arrows signify connections of a Supply Area (SA) to a Water Treatment Plant (WTP) and red arrows connections used in case of calamities.Plant capacity is the nominal water treatment capability in m 3 per day.The average daily demand per SA is also given.

Figure 4 . 25 Figure 5 .
Figure 4. Simplified topological relations used in the case study.Blue arrows signify connections of a Supply Area (SA) to a Water Treatment Plant (WTP) and red arrows connections used in case of calamities.Plant capacity is the nominal water treatment capability in m 3 per day.The average daily demand per SA is also given.Water 2019, 10, x FOR PEER REVIEW 8 of 25

Figure 6 .
Figure 6.Stylized schematic of the concepts of centralized, decentralized and distributed systems [38].

Figure 6 .
Figure 6.Stylized schematic of the concepts of centralized, decentralized and distributed systems [38].

Figure 7 .
Figure 7. UWOT model of the NS configuration.Figure 7. UWOT model of the NS configuration.

Figure 7 .
Figure 7. UWOT model of the NS configuration.Figure 7. UWOT model of the NS configuration.

Figure 7 .
Figure 7. UWOT model of the NS configuration.

Figure 8 .
Figure 8. UWOT model of the FA configuration.

Figure 8 .
Figure 8. UWOT model of the FA configuration.

Figure 9 .
Figure 9.The three rate of change curves used in the scenarios, adapted from [17].

Figure 9 .
Figure 9.The three rate of change curves used in the scenarios, adapted from [17].

Figure 10 .
Figure 10.Resilience profile graphs.Scenarios are ordered by increasing severity.

Figure 10 .
Figure 10.Resilience profile graphs.Scenarios are ordered by increasing severity.

Water 2019 ,
10, x FOR PEER REVIEW 16 of 25 capacity lost as RO technology ages faster than conventional plants and at Y13 actual capacity is lower than BAU.• Wildcard #4: The best performer is FA due to the usage of RWH technology, but only marginally.

Figure 11 .
Figure 11.Wildcard results.Orange/Green/Red represents the baseline coverage value of configuration BAU/NS/FA in Year 13, whereas Blue represents the coverage of the configuration when the wildcard occurs, if the configuration is affected.

Figure 11 .
Figure 11.Wildcard results.Orange/Green/Red represents the baseline coverage value of configuration BAU/NS/FA in Year 13, whereas Blue represents the coverage of the configuration when the wildcard occurs, if the configuration is affected.

•
Supply areas: Alblasserdam, Hazerwoude, Rodenhuis, Lekkerkerk, De Hooge Boom, Den Hoorn • Water Treatment plants: De Steeg, Lekkerkerk, Rodenhuis, de Hooge Boom It was agreed with Oasen not to include in the model the following SAs and WTPs:

Table 1 .
Key elements of each configuration.NS: Next Step; FA: Further Ahead.
All UWOT models employ mechanisms for discrete component failure (e.g., transportation pipe bursting) and component maintenance which affects treatment capacity, accidents, incidents and various other problems based on probabilistic rules.Water 2019, 10, x FOR PEER REVIEW 10 of 25

Table 2 .
Scenario parameters and baseline values.

Table 3 .
Tabulated scenario results of coverage reliability.

Table 3 .
Tabulated scenario results of coverage reliability.