The inundation model uses a river hydrograph (either recorded or calculated for a hydro-meteorological scenario) to produce a raster map showing the representative flood parameters, in particular water depth. In the literature computation is commonly performed through simplified Navier–Stokes equations with different numerical schemes and spatial resolutions of the computational domain . In particular, accurate forecast of flood propagation in urban environments usually requires 2-D models with an adequate description of the street-building pattern, limiting the computational grid resolution to about 1 m . In this context, the increasing availability of geographic data such as lidar-derived digital terrain models (DTMs) ease the setup of the model . Nevertheless, some issues such as the computational effort and the definition of representative roughness coefficients still arise. As an alternative, parsimonious hydraulic models are also accepted as a compromise between accuracy and computational effort when steady-state approximations and large and cumbersome computational domains are not sustainable .

The implemented hydraulic model is comprised of two parts. Firstly, the river is represented with a 1-D unsteady flow model and the urban flood-prone area is modelled as a system of interconnected quasi-2-D storage cells. A digital surface model with resolution of 1 m and vertical accuracy of 0.25 m, derived from lidar surveys, is used for the detailed representation of the flow domain at street-building scale; buildings are, by default, considered to be waterproof blocks. The computation of flood propagation is performed through an implicit 1-D finite-difference scheme of the general equation of unsteady flow (i.e. mass and momentum conservation equations). The quasi-2-D hydraulic model for the floodplain consists of several storage areas (cells) connected to the riverbanks through a set of lateral weirs, whose geometry is extracted from a topographic survey. When the inundation starts, the quasi-2-D module – governed by mass conservation and stage-storage relationships – calculates water levels from the volume stored in the cell. Flow between adjacent cells is described by a weir equation accounting for backwater effects. The details of the model construct and equations adopted in the HEC-RAS framework (for both 1-D and quasi-2-D modules) are described in . The increasing availability inundation maps from local water authorities – due to the evolving normative frameworks in flood risk management – may also offer an alternative to numerically simulating surface flow. In this perspective, official inundation maps can be adopted if accessible and adequate in spatial resolution in the area of interest.

Exposure analysis requires matching of data from inundation maps and information on location of assets, usually performed by means of GIS. All the components of the WDN, both active and passive, must therefore be geo-referenced to be compared with inundation maps for assigned scenarios. For the risk assessment of the WDS, exposure analysis is conducted on active components based on the maximum water depth occurring during the flood event. Maximum water depth is also used to assess the potential contamination at nodes. The selection of a suitable inundation model giving accurate flood depths depends on the characteristics of the domain, i.e. area and topography, although a spatial resolution of the order of 1 m (e.g. lidar-derived products) should be preferred in urban areas to represent the street-building pattern. Exposure analysis consists of four steps. First, the coordinates of the WSS point components (nodes, reservoirs, lifting stations, etc.) are exported from the WSS model to the GIS environment so that a new vector is created whose coordinate reference system is assigned in the shapefile properties. Afterwards, the raster inundation map is imported into the GIS workspace and converted if necessary to a compatible reference system. The raster cell information (i.e. water depth) is then extracted over the point feature and added as attribute (e.g. with the “point sampling tool” plug-in available for QGIS). For each failure-prone point component belonging to an exposed asset, the water depth attribute is compared to a threshold depth which takes into account local geometry and functional dependencies. If calculated depth exceeds the threshold, the component is marked as failed, added to the list of exposed asset and its properties modified in the WSS model (Sect. ) to reproduce the failed configuration.

The model is based on the freely available EPANET libraries, which calculate time-varying pressures at the nodes given a set of initial tank levels, pump switching criteria, base nodal demands and demand patterns. In particular, EPANET can be launched by other software through a set of DLL libraries.

One drawback of the standard EPANET implementation is its strict demand-driven approach, which stems from the primary goal of simulating correctly operated networks. In such networks, pressure at each node is sufficient so as to allow withdrawal of required flow rate from each node, so that demands can be assumed as defined input data. However, when simulating strongly off-design networks, nodes featuring a reduced pressure are quite common, so that a PDD approach is needed . PDD models differ from conventional ones in that nodal demands are not attributed a priori; instead, their value depends on the current local pressure. In particular, and consistently with practice, the model assumes that each node is in one of three states:

Fully served: if Hi ≥ Hservice, the node is able to withdraw its nominal demand.

EPANET allows two types of nodes: nodes are assigned a time-varying, pressure-independent demand and can be effectively used to model fully served users, whereas emitters, conceived to model fixed cross-section water outlets such as fire hoses and orifices, adequately model the aforementioned behaviour of partially served users. Emitters are defined by a fixed exponent α, equal for all instances, and a flow coefficient which represents the volume flow rate for unitary pressure loss across the orifice. Unfortunately, emitters do not cope well with calculated negative pressures, attributing a negative (entering) flow rate where such negative pressures occur. In order to cope with this issue, a MATLAB code has been implemented so as to run transient simulation while correctly using a PDD approach. The code, as shown in Fig. , works as follows. Three node states are defined: “2” for served nodes, “1” for partially served ones and “0” for non-served ones; type 2 and type 0 nodes are modelled as EPANET nodes with nominal demand equal to the assigned nominal demand Di and nought, respectively, whereas type 1 nodes are modelled as emitters whose flow coefficients are calculated to ensure that Di = Dnom,i if Hi = Hservice.

Overall, the model works as follows: for each time step, a first trial simulation is run with all nodes in state 2 in order to get the expected pressures. Afterwards, each node is checked to assess whether its pressure is in the pressure range corresponding to the current flow regimen and, if this is not the case, its state is accordingly raised or lowered by one unit (namely, it is not possible to jump from state 2 to state 0 and vice versa). After node states have been changed, simulation is repeated until no more state change is necessary. Calculated flow rates and pressures are considered to represent network operation during the subsequent time step. In particular, flow rates are used to calculate the time to the next event (tank being filled or drained), and the first event affecting network topology is considered (e.g. demand change, pump setting toggling due to time pattern, tank becoming empty or full). Tank levels are thus updated and simulation proceeds to the next time step. The described procedure allows for calculating pressure and supplied demand at each node for each time step, therefore fully estimating the network state in each moment.

Two measures have been defined in order to evaluate the global impact of the flood on network operativeness and integrity.

First, impact of the flood on network operation is assessed through evaluation of the number of inhabitants experiencing lack of service. To this aim, data about population density in the area made available by the Italian Institute of Statistics are used. Such data define 2186 polygonal zones with areas ranging from 156 to 2.48 × 106 m2) and provide a population value for each of them. Inhabitants are assigned to nodes as follows: a uniform demand per capita is assumed in each area and calculated, and the number of inhabitants for each node pertaining to that area is estimated accordingly. In particular, Pi∈A=Dnom,i∑k∈ADnom,kPA, where Pi is the population assigned to node i belonging to area A and PA is the total population of area A. The population not served, (PNS), parameter is thus estimated as the total population of nodes with reduced or null pressure, i.e. PNS=∑i∈IPiwithI=i|Hi<Hservice, where Hservice is the minimum head required to consider a node fully served (5.0 m in the case study).

As a second measure, network damage due to pipe contamination is evaluated by calculating the total length of pipework to be decontaminated. A pipe is considered to be contaminated if at any point in time the head inside the pipe is lower than the floodwater head outside or below zero, i.e. L=∑i∈I∑j∈JiLjwithI=i|Hi<maxHflood,0, where Ji is the set of pipes with either end connected to node i.

The study area is the municipality of Florence, Italy, with an areal extent of 102 km2. The area hosts about 380 000 inhabitants, the highest population density being found in the city centre along the Arno riverbanks. Documents indicate that the town has a long account of floods since the Middle Ages, as confirmed by more recent hydrologic–hydraulic studies showing that floods may occur also for low recurrence interval (30-year return period). For such frequent events, only the lower-lying suburbs are affected (brown areas on the centre left side of Fig. ), whereas more severe scenarios (recurrence interval of over 200 years) affect the whole city including the historic centre. Flood risk in the study area is estimated in EUR 55 million a-1 when only direct tangible losses to buildings, household contents and commercial activities are taken into account . In this context, analysis of flood risk to the WSS is crucial to understand the potential adverse consequences on such strategic infrastructures and to estimate the recovery costs.

The metre-scale DTM used for the hydraulic model is freely available in the regional cartographic repository (dati.toscana.it/dataset/lidar). The hydraulic data (hydrographs and river water profiles) are made available by the catchment authority (Autorità di Bacino del Fiume Arno), which is in charge of flood risk management and water resource planning.

Four flood scenarios with different recurrence intervals (RIs) are considered when applying the method described in Sect. : a frequent scenario (RI = 30 years), two medium recurrence intervals (100 and 200 years) and a rare scenario (500 years). Accordingly, four inundation raster maps are generated to carry out the exposure analysis.

The studied WSS features one main treatment facility, 17 tanks and the pipework to supply drinking water for domestic and industrial use.

Freshwater supply is ensured by the river, which flows westbound amidst the urban area. Water is abstracted from the river by three 373 kW pumps in the treatment plant “Anconella”, which is located in the left bank and designed to process 4 m3 s-1 (Fig. ). The water undergoes treatment and reaches the lifting station, where six 710 kW pumps ensure a maximum head of 60 m and feed the distribution network. The storage tanks are mostly located at high altitudes and feature a total operative volume of 48 620 m3.

An EPANET model of the WSS is provided by the utility operator Publiacqua SpA. The model is barely skeletonised and consists of 4863 nodes and 12 436 pipes for a total length of the modelled piping network of 619 km.

The WSS elements most vulnerable to floods are the lifting stations and the pumps feeding the storage tanks, because they rely on electrical power and are affected by power outage. Water depth at the location of vulnerable WDS components is compared to a threshold depth to define the operation state of each of them. In this work, a threshold of 0.5 m is defined, so components experiencing greater depths are considered failed and switched off in the water distribution model. The 0.5 m threshold has been identified based on the judgement of experts who undertook a “what-if” analysis to evaluate the vulnerability of active components. This threshold has been considered conservative with respect to the mean position of electric and electronic devices observed in the plants.

Figure  shows the results of hazard analysis. For the 30-year RI an area of 2.5 km2 is flooded, with an average water depth of 1 m. Two areas are affected, one upstream of the historic city on the right bank (right-hand side of Fig. ) and one downstream on the left bank (left-hand side of Fig. . In the upstream area flood depth is about 0.3 m, whereas in the downstream area water depth locally attains 4 m in correspondence of excavation zones. For the 100-year RI, the flooded area increases to 12.7 km2 with an average flood depth of about 1 m. In the downstream area, the right bank is also inundated with depth up to 2.5 m. For higher RI (200 and 500 years), the affected areas rise to 20 and 27 km2 and average depths to 1.2 and 1.7 m, respectively. In these scenarios the historic district is also affected (centre of Fig. ) with water depth as high as 4 m. In the downstream areas water depth locally exceeds 4 m (see Fig.  for an example of 500-year RI inundation).

Table  shows the results of the exposure analysis. For RI = 30 years, none of the vulnerable WSS components is affected. For RI = 100 years, the tank labelled “VCMantigna” is exposed to flood, yet the average flood depth in a buffer zone of 25 m radius is about 0.15 m, and therefore the electrical devices are assumed in operation. For RI = 200 and 500 years, the drinking water treatment plant (DWTP) in Anconella, shown in the right-hand side of Fig. , is flooded with a water depth exceeding 0.85 m. In these scenarios, issues are expected because of drinking water treatment restrictions, loss of control and power shutdown of the lifting station. The VCMantigna tank is still exposed, with water depths as high as 2 m for RI = 500 years.

Results are shown relative to the 200- and 500-year recurrence intervals, those for which failure of the DWTP is expected. In particular, two scenarios are considered: in scenario 1, it is assumed that the DWTP completely stops providing freshwater to the system; in scenario 2, some backup system is assumed to keep one of the three main pumps feeding the network in operation.

The nodal heads 120 min after the lifting station failure are shown in Fig.  for failure scenarios 1 (Fig. a) and 2 (Fig. b). At 120 min after the shutdown in the failure scenario 1 (Fig. a), about 50 % of nodes already experience heads lower that 1 m, where just three zones, one in the westernmost part of the network (due to the lower altitude favouring piezometric head) and two on the northern and southern hills (due to local tanks providing capacity; see Sect. ), feature heads higher than 20 m. After 6 h (Fig. ), the number of served nodes is further reduced, with only the westernmost part of the network and southern hills (low altitude and higher with a great number of tanks, respectively) being served. For what concerns failure scenario 2 (Fig. b), most nodes of the network are operational after 120 min from the shutdown, with pressures in the minimum range of residual level of service (1–10 m). A few nodes on the northern hills (about 15 %) experience heads lower than 1 m and a significant part of the western city on the right bank experiences heads between 10 and 200 m due to its low elevation. In both cases the service disruption due to insufficient head also affects nodes outside the inundated area, and hence it can be accounted for as an indirect impact of the flood triggered by the failure of the lifting station.

Evolution of aggregate service metrics in time is calculated for the two aforementioned failure scenarios. PNS is shown in the panels of Fig.  as a fraction of total population. In failure scenario 1 (Fig. a), the complete shutdown of the DWTP pumping station deprives almost 50 % of the population of water supply after 3 h, consistent with the dynamics shown in Sect. . After 6 h, this condition extends to the 70 %. If inhabitants experiencing insufficient pressure are also considered, total affected population is about 90 %. In failure scenario 2 (Fig. b), total affected population ranges from 62 to 77 %. Nevertheless, inhabitants experiencing no service at all are about 15 %, rising to less than 30 % only after 9 h. Population not served by the WDN exemplifies the large gap between direct and indirect flood impacts. In fact, for the 200- and 500-year flood scenarios, residents directly affected only account for 35.6 and 44.8 % of total population, respectively. This means that inhabitants indirectly affected (by the WSS failure) are two to three times as much as those directly flooded. For what concerns evaluation of network damage, the panels of Fig.  show the length of contaminated pipe as a function of time for the two studied failure scenarios. Again, scenario 1 (Fig. a) shows a critical situation, where about 25 % of the network undergoes contamination risk shortly after the shutdown and 68 % of the network is out of service just 6 h afterwards. In scenario 2 (Fig. b), the contaminated pipe length fraction rises from 9 to 26 % in the first 12 h, thus suggesting a milder impact. Nevertheless, caution must be taken for the risk of backflow towards nodes which lie on the borders of the served areas. In principle, contaminated pipe length does depend of the RI considered, since higher floodwater depth leads to higher contamination risk. Nevertheless, results show that in the studied case there is little difference between the 200- and 500-year recurrence intervals.

If a pipe has been contaminated it needs to be disinfected before being put in service again. Disinfection is usually achieved by flushing: trailer-mounted equipment pumps a disinfecting solution (e.g. liquid chlorine or sodium hypochlorite) through a closed piping loop. Firstly, service laterals are closed and customers are connected to bypass piping. Subsequently, the cleaning solution is pumped from a tank on the equipment trailer into the pipe to be cleaned. After cleaning, the solution is neutralised and pumped to a sanitary sewer. The entire system is then flushed (including laterals) to eliminate sediments and completely remove the disinfecting fluid. From the operational point of view, discharge is monitored during the flushing to assure a sufficient contact time and chlorine residuals after disinfection are recorded to meet the sanitary standards. An order-of-magnitude estimation of the cost of the disinfection–flushing operation is EUR 50 per metre of cleaned pipe ; nevertheless, during contingencies, costs may increase due to the disproportion between available and needed resources. According to calculated values of contaminated pipe length, flood damage to the WDN can be estimated in EUR 21 and 8 million for failure scenarios 1 and 2, respectively, which correspond to approximately 0.5 and 0.2 % of the direct losses to buildings and contents for the 200-year flood scenario estimated in .

Figure  shows the water volume stored in the tank system at a given time after the failure. In scenario 1, where no water is provided by the DWTP, the entire demand is met by withdrawing water from the tank system. This is highlighted by the average slope of the curve in the first 3 h (about 0.75 m3 s-1), which corresponds to half of the total demand in normal conditions. After about 3 and 5 h, reservoir configuration changes so that the average slope of the volume of the tanks is also affected. Slope changes in both curves are caused both by demand variations and tanks being drained. In particular, the abrupt change for failure scenario 1 after about 5 h corresponds to a tank serving a great number of nodes being drained, thus corresponding in sudden change in served demand (slope). The relationship between served demand and curve slope is not so evident for failure scenario 2, since slope curve only relates to those users not directly served by the DWTP.

In case of power shutdown, the transient behaviour of the system is determined by the amount of water stored in tanks. In order to better understand the relevance of each storage tank in the system, a sensitivity analysis has been performed. In particular, a sensitivity matrix is calculated by numerically computing the derivative of head of each node with respect on the level of each tank in a quasi-static assumption. By examining the resulting data, two types of tanks are identified, according to their altitude. On the one hand, variations of water levels in low-altitude tanks strongly impact most network nodes, as shown in Fig. a, where the sensitivity to the VCMantigna storage tank is depicted. The nodes of the network lying at elevations in the range 25–50 m – which largely outnumber the rest – undergo pressure variations of about 0.5–1 m for a 1 m variation of tank level. On the other hand, high-altitude tanks, like the one labelled “Arcetri” shown in Fig. b, have a smaller area of influence limited to the immediate surroundings of the tank itself. This is also reflected by the longer service periods experienced by nodes pertaining to this areas, which share a locally abundant resource.