Quantifying Failure for Critical Water Infrastructures under Cyber-Physical Threats

The intertwining of cyber and physical layers arguably increases efficiency and accuracy by offering capabilities like remote real-time control (RRTC) for pressure management (Giustolisi et al. 2017; Page et al. 2017), mitigation of combined sewer overflow (CSO) (Garofalo et al. 2017) or extension of actuators’ lifespan (Lund et al. 2018), and the detection of contamination (Wang et al. 2015) or leakages at the household level (Kossieris et al. 2014). On the other hand, just as water CIs benefit from shifting to more integrated CPSs, so do potential adversaries by constantly adjusting their tactics, techniques, and procedures (TTPs) (Johnson et al. 2016) to exploit the new cyber-physical domain. The European Union’s (EU) Agency for Network and Information Security (ENISA) has reported a shift in the threat landscape from individuals to companies (ENISA 2019), while for the same period the annual strategic report of the European Cybercrime Center (EC3) identifies the convergence of cyber and terrorism (Europol 2018). Access to a range of malwares and anonymization and encryption tools or services through the Darknet enables even inexperienced threat actors to exploit vulnerabilities and perform cyber-physical attacks (CPAs) that go well beyond their actual know-how and skills. Common misguided security perceptions over industrial control systems (Loukas 2015), broad geographical expansion of CPSs (Konstantinou et al. 2015), and a rise in sophistication (Rasekh et al. 2016) of malicious codes allow for a range of manipulation and deception attacks.

According to the latest Verizon Data Breach Investigations Report (DBIR) (Verizon 2019), 23% of the reported breaches involved nation state- or state-affiliated actors and 28% leveraged malware to establish or advance attacks. Relevant to those findings, a technical alert by US-CERT (US-CERT 2018) revealed that since at least March 2016 multiple US CIs, including water-sector CIs, were strategically targeted by foreign government cyber actors who, inter alia, gained access to industrial control systems (ICSs). Compromised ICSs and unauthorized access over such systems can go undetected for long periods, exposing water CIs and society to significant risks. Such is the case of a company responsible for supplying a number of neighboring counties, anonymized under the pseudonym “Kemuri Water Company” (Verizon 2016), with an unusual operation of remotely controlled assets lasting nearly 2 months. Attackers accessed the platform that supervised hundreds of programmable logic controllers (PLCs), gaining control over and altering the dosing of chemicals used for water treatment and the water flow per se, compromising supply services. Another example from the recent water-sector CPA history is the 2013 near-miss after a successful supervisory control and data acquisition (SCADA) hack of Bowman Dam in New York. As made public by the relevant indictment, the attacker, who had repeatedly obtained data on water levels, temperature and sluice status, had gained access to the sluice remote control system as well. Fortunately, he was unable to escalate his threat only because the dam’s sluice was disconnected for maintenance. A recent review on the sector’s incidents by Hassanzadeh et al. (2020) reveals the diversity of attackers’ TTPs and resulting consequences. Officially disclosed or otherwise, recent incidents or near-misses in water CIs have raised a caution flag that should not be overlooked.

Proactive risk management calls for prevention and preparedness, through structured multidisciplinary approaches for stress testing (Galbusera et al. 2014; Licák 2006), against current and future threats. Both the EU [CD 2008/114/EC, article 2(c)] and the USA (US Department Homeland Security 2009) critical infrastructure protection (CIP) frameworks recommend risk assessments that follow the threat scenarios approach. The latter, considered the drivers of emergency simulations (Grance et al. 2006), act as catalysts that trigger the exploration of infrastructure exposure to risk and inspire actions to protect against potential threats, up to weaponization of supply (ASME-ITI 2009). To meet those objectives, cyber-physical threat scenarios must address key threat characteristics and explore multiple durations and escalations of events under existing operating plans and available alternatives (Bouchon et al. 2008), while rendering the adversary’s TTPs.

Stress tests are risk and safety assessment approaches designed to associate the severity of a threat scenario with its impact on the system or society, performing the core analysis required for the prevention of risks and the preparedness of the CI (Galbusera et al. 2014). Physical, cyber, geographical, and logical interdependencies within a system, as defined by Rinaldi et al. (2001), allow for cascading effects to occur. For water CIs to prepare against events that may cascade from the cyber to the physical layer and vice versa, appropriate stress-testing environments are required that can model those dynamics (Nikolopoulos et al. 2018). This has triggered cyber-oriented research on developing virtual SCADA environments and test vulnerabilities (Almalawi et al. 2013; Chen et al. 2015; Davis et al. 2006; Fovino et al. 2010; Queiroz et al. 2011; Siaterlis et al. 2013). In the water CI domain, the widely accepted EPANET model (Rossman 2000), used to simulate hydraulic systems, has recently started transforming toward bridging that cyber-physical gap. Eliades et al. (2016) provided a programming interaction for a simulator through MATLAB in an effort to assist research in the field of smart water networks, used by Taormina et al. (2018) to deploy the EpanetCPA toolbox and link monitoring and control device interactions to traditional network hydraulics. The latter, inter alia, provides a structured way of importing CPA scenarios and pass them, in a certain level of modeling abstraction, through a hydraulic solver. In a similar manner, Klise et al. (2017) developed an open-source Python software version 0.2.2 package, the Water Network Tool for Resilience (WNTR), which employs both EPANET and a purpose-built EPANET-based simulator to allow for the modeling and simulation of water distribution networks (WDNs), focused on network resilience in physical emergency states (e.g., earthquake, power outage). WNTR has been recently used in the work of Nikolopoulos et al. (2019a) in an early prototype of a cyber-physical stress-testing platform called RISKNOUGHT.

Stress testing introduces distributed or point loads that cause performance to drift outside normal boundaries and lead to nonideal conditions of service. Events, like an attack or power outage at a pumping station, can lead to pressure deficiency conditions, in which demand-driven analysis (DDA) solvers, such as the original EPANET solver, pose limitations (Chmielewski et al. 2016). DDA solvers continuously supply nodes regardless of the pressure, yielding unrealistic demand satisfaction and hydraulic behavior. Quality of generated data is directly linked to the simulation approaches and methods chosen (Wand and Wang 1996), and as such, DDA is not suitable for the purposes of a stress test. On the other hand, linking pressure to nodal outflow allows for pressure-driven analysis (PDA) through nodal head-flow relationship (NHFR) formulas (e.g., Fujiwara and Li 1998; Germanopoulos 1985; Wagner et al. 1988). Maximum demand satisfaction is met under optimal pressure conditions and decreases as pressure drops, down to a minimum operating value. Because water supply is based on available operating pressure at each node, PDA-based stress-testing platforms are indeed able to represent pressure deficiency effects more realistically (Todini 2003).

Utilizing state-of-the-art tools and methodologies that best fit the purposes of the analysis can form a realistic cyber-physical stress-testing approach. Subsequently, this produces data deemed to be of high quality that need to be mined to express failure. This work provides a defined structure to interpret a system’s predicament by translating simulation data to failure information, aiming to enhance risk-informed decisions and prioritization of actions.

Translating model-derived data to meaningful aggregates and keeping an overview of the simulated behavior is a difficult task because of the large volume of raw data. Real water network models contain thousands of nodes and assets, dynamically operated over a simulation period. Even skeletonized network models, with known limitations and shortcomings (Davis and Janke 2018), produce large sets of data, while fine-time-resolution simulation adds to both the detail and volume of results. Thus, making sense of stress-test results in a structured and efficient way becomes of paramount importance for facilitating risk-informed decision-making (Hansson and Aven 2014) and can be achieved by mapping results to suitable indicators.

Water-sector experts often keep track of network service performance and communicate company goals through sets of measures designed for management which are found to be very similar across countries and companies (Vilanova et al. 2015). The similarity originates from the common fundamental processes, assets, and overall goals of water companies, with metrics usually focused on five main categories of management interest:

Performance measures are metrics that quantify the efficiency or effectiveness of an action (Neely et al. 2005). These are categorized into result indicators (RIs), answering the question of what has been achieved so far, and performance indicators (PIs), indicating what needs to be done to increase performance (Parmenter 2015). Adding the word key indicates the importance of those factors in achieving the defined goals, revealing the critical success factors. RIs capture the results of operational actions and show whether the organization is “travelling at the right direction at the right speed” (Parmenter 2015), which is important for the governance of the organization. The difference can be seen through the definition provided by Alegre et al. (2016), where PIs are efficiency and effectiveness measures for the delivery of services with respect to target values. Such values are benchmarks used for comparison (Cable and Davis 2004) or as reference points of improved performance (Malano et al. 2004) and the establishment of policies (Walter et al. 2009). Thus, metrics like those presented by Alegre et al. (2016), Danilenko et al. (2014), Kanakoudis et al. (2011), Bouziotas et al. (2019), and others, serving trend monitoring (Andersen and Fagerhaug 2002) and long-term benchmarking objectives (Berg 2013), do not reveal the dynamics or inner characteristics of a system failing under stress.

An emerging concept related to the performance of water systems under stress is that of resilience. Being a relatively recent term in the water industry, it has received many definitions in the scholarly literature (Francis and Bekera 2014). The variations are mostly subtle (Butler et al. 2017), while a stress-testing-oriented approach regarding water system resilience is given by Makropoulos et al. (2018), who define resilience as “the degree to which an urban water system continues to perform under progressively increasing disturbance.” As an expansion of stability (Holling 1996), resilience is linked to the ability of a system to react to stress conditions (Todini 2000) and reduce the magnitude or duration of disruptive events (NIAC 2009), to retain a level of functionality. Several studies have tried to capture and indicate resilience against a failure (mainly in network design), as a generic inverse function of failure time (Hashimoto et al. 1982; Kjeldsen and Rosbjerg 2005), quantified via resilience profile graphing tools (Makropoulos et al. 2018), through a demand satisfaction ratio (Mehran et al. 2015; Zhuang et al. 2012), available energy (Creaco et al. 2016; Todini 2000), or graph theory metrics (Herrera et al. 2016), while resilience through operational and financial dimensions is proposed in the Risk Analysis and Management for Critical Asset Protection (RAMCAP) approach (AWWA 2010). Though it is used in system design optimization, linked to recovery plans (Chmielewski et al. 2016), and becoming increasingly recognized as essential to rethinking contemporary water CPSs (Nikolopoulos et al. 2019b), it has been argued that no resilience measure proposed to date can adequately describe cascading failures (Shin et al. 2018) or provide adequate context on a system’s complex integrity predicament during stress.

Recognizing a need to summarize, interpret, and communicate data derived from stress testing, a quantification framework is proposed in the following sections that is deployable through a purpose-built tool. It is designed specifically for water CIs under threat and is adjustable to any internal and external operating environment of a water utility.

Mapping data is essential in accurate information delivery for emergency preparedness (Zoppi et al. 2016) and data-driven risk management (Niesen et al. 2016) that aims to preserve water system integrity. According to the European standard on drinking water security [CEN-EN 15975-2 (CEN 2013)], referenced by Commission Directive (EU) 2015/1787, integrity means meeting “specified quality, quantity, continuity and pressure targets in accordance with legal/regulatory requirements and the drinking water supplier’s objectives.” These targets, regulatory restrictions, and acceptable levels of performance vary according to each company’s operational environment and risk attitude. Results must be presented in a way that assists water companies to comprehend the nature and level of risk by linking potential consequences to a company’s objectives.

Both events and their consequences are used to characterize risk (ISO 2018), but to obtain a balanced information flow, especially in a multistakeholder environment such as the water sector, it may be argued that shared information needs to be

The preceding “5C” checklist is used as a guide to the approach proposed in this work: the information produced through the proposed approach is failure-oriented (compatible) focused on the center of gravity of the CI (concise). Risk information can derive from different families of metrics in multiple dimensions (comprehensive) adjustable to the internal and external operating environment (consistent). Metrics are selected to be quantitative, dimensionful, and related to a reference state of the system (comparable). Each of these concepts is explained in one of the following sections, while the last section briefly presents a basic flowchart and functionalities of an early version of a tool designed to operationalize the proposed framework for interested water companies.

Risk analysis is defined as a necessary step to comprehend the nature and profile of a risk and define its level as a function of an event’s consequences for a system. Consequences, either positive or negative, are the outcomes of an event that affect system objectives (ISO 2018). Performance improvements, measured through PIs, come from utility management actions, while negative effects on the system’s objectives come as the result of malfunctions, accidents, natural disasters, malevolent actions, or hybrids of these. In the light of the cyber-physical era, threat actors can be categorized, based on their intentions, as terrorists, state actors, cyber-criminals, hacktivists, hobbyists, and insiders (Nicholson et al. 2012; Rasekh et al. 2016). Evidently, the causality relationship between an actor’s intentions and impact is affected by existing system vulnerabilities, required capabilities, and available resources of the actor. Whether seeking to harm people or an organization’s reputation, the impact of an attack is measured by the decay of the system’s performance. For CI stakeholders to acquire situational awareness in that perspective, the adversary’s perspective should be adopted (Schnaubelt et al. 2014) and address system behavior under stress in a failure-oriented manner. This provides an information context that is more compatible with the purposes of risk analysis. Such a frame of reference also better serves the decision-making process: A positive tone risk approach can be misleading, biasing decision-making (Damasio et al. 1996; Sanfey et al. 2003), while in fact the prospect and experience of losses lead to safer and higher reward decisions (Bechara et al. 1999).

A water system’s state can be defined, at any point or period, through sets of multidimensional metrics, which provide information on performance relative to specified reference values. As the operating environment changes, the system reacts to the received stimulus and alters its state. Ex ante risk analysis focuses on the prediction of the system’s potential state, if a threat event were to occur, under specific internal and external operating conditions. Stress testing the system results in a snapshot of its state, allowing for a comparison between that and the system’s state without the stimuli. The difference between the two is a measure of an event’s consequences. This conceptualization of consequence is at the core of the approach proposed herein.

A system’s performance, under normal operating conditions (undistorted state), is depicted here as a steady state. Imposing a stress would cause a change of state, shifting the system to lower performance levels (stress state), as in Fig. 1. As described in previous section, the retained functionality of the system under stress is related to the system’s resilience. To provide a risk-compatible context, the failure-oriented approach proposed is focused on profiling the area between the performance curves, which is complementary, at least at an abstract level, to resilience.

To ensure a resilient and efficient system, companies orchestrate assets and operations throughout the urban water cycle. From the wide range of systems and subsystems included in the urban water cycle, here the focus is on the WDN, which is suggested is the so-called center of gravity of a water CI. The concept of center of gravity is borrowed here from the general security literature (Schnaubelt et al. 2014) and defined as the entity processing the key capabilities to achieve a CI’s objectives. The purpose of identifying a center of gravity is to assist stakeholders in maintaining their focus on crucial risk information (Schnaubelt et al. 2014). For a resilient water infrastructure, arguably, the distribution network is the key indispensable resource utilized to provide services and support the objectives of safe and adequate water supply to the community. Destroying, weakening, or influencing a cyber-physical WDN’s processes hinders the fulfillment of objectives, making it the system’s center of gravity.

A failure profile is defined as a collection of factual aspects of consequences that can be used to interpret a system’s predicament. Plain as it may sound, reconstructing the failure information from simulation-derived data requires multiple viewpoints through metrics that allow an unbiased and opinion-free information flow to interested stakeholders. To assess a system’s failure, especially in the case of deliberate CPAs, stakeholders need to be aware of the type, level, and characteristics of an event’s aftermath. For this reason, this paper proposes a three-step approach for the main profiling structure. The first step is categorizing the services provided by the supplier to the community. The second step is to identify pivotal levels of failure for each service category. The third and last step is setting the dimensions on which failure, for each level, is mapped.

The previously defined four categories of metrics are the dimensions of failure manifestation for which failure needs to be quantified. Let us assume a CPA occurring in a system affecting it at time $t_e$. The attack affects performance, with loss of performance building up to a maximum point ($t_p$), while recovery actions taking place at time $t_d$ start restoring performance up to a recovered state. Such a generic failure curve, inspired by EPA (2015), is represented by Fig. 4, which strongly resembles the shape of a flood hydrograph, with the CPA taking the place of the rain event. Just as the shape and size of the flood hydrograph are affected by rainfall and basin characteristics, so the CPA and water system characteristics affect the form of the failure curve.

With this analogy in mind, one observes that key information found in flood hydrographs can also be defined for the case of a CPA on a water system. The rising limb of the hydrograph, where runoff gradually increases up to peak flow, is seen as the failure from the undistorted state up to a peak value $(t_e,t_p)$, while the receding limb, where flood discharge decreases down to basic flow again, is represented by the system recovering ($t_r$). It is possible to adopt a new, intermediate state prior to full restoration, similarly to the new base flow. Following this analogy, the failure is explored under a series of lenses to interpret the system’s predicament, as presented in the following subsections.

Risk assessment for the emerging cyber-physical water domain is expected to become an integral component in water companies’ workflow (Makropoulos and Savíc 2019). Nonetheless, operationalizing and integrating new (potentially disruptive) approaches can be challenging. To assist in this transition, the methodology presented in this paper is encapsulated as a standalone MATLAB compiled tool. The tool processes simulation data, of a specific format, regardless of the stress-test model used, and generates the failure profile for the given scenario based on user-defined criteria. Additional functionalities are also introduced and briefly presented next.

Consistent with the scope described in the section “Failure Oriented Approach,” the tool focuses on profiling the failure area appearing between the ideal and the under-stress performance of the system, based on user-defined service levels. This process can be seen in the simplified flowchart of the tool in Fig. 5. The hydraulic network topology (EPANET.inp file) and data that compose the undistorted, attack-free, performance are used as the reference state. The network file provides information on units used and reports layout information for validation purposes, to ensure that performance data refer to the same topology. The stress-test results of the CPA scenario to be profiled are the next required input, reporting performance data per asset. Currently the tool supports.csv formats performance data tables that provide variable names and corresponding asset IDs. For example, the expected demand of Node N1 under normal conditions, for each time step, is found in the undistorted performance file column labeled “Demand_N1.” User-defined service levels $L_1$ and $L_2$ and critical conditions $C{r}_{F_{L_i}}$ are specified using the tool’s interactive interface.

WDNs are typically zoned into districts with fixed boundaries, known as district metered areas (DMAs), primarily to control leakages and regulate supply pressure and quality (Butler et al. 2005). Within such districts, service is provided to various customers, some of which can be considered critical based on the (societal) impact a disruption of service to them can cause (e.g., hospitals, government, and military buildings). In this spirit, the tool provides network sectorization capabilities to quantify failure and evaluate CPAs at the district level. Different thresholds can be assigned per district to signify the importance or specific performance requirements for each DMA. Such capability allows for additional adjustability with spatial customization of failure quantification, to account for critical parts of the serviced community and support a more realistic assessment of cyber-physical consequences. After defining the service levels and critical conditions through the tool’s interface, at either the system or district level, the core algorithm can be deployed and results can be visually explored through the tool’s visualization capabilities. An example can be seen in Fig. 6, which shows the main dashboard, where key failure information can be explored. Peak effects and available time slots to react are also visualized in the tool. The tool profiles and represents failure using preferred simulation parameters; thus, both SI and customary US units are supported.

To assist the usability and communication of risk-related information, which is a very important aspect of rapid situational awareness, the tool supports two export capabilities. The first export capability produces a JSON file, which contains all failure profile data for both system and district levels and a set of metadata. This file can then be stored in a database or used as input in other software. The second export capability comes in the form of a report. The report-generating module of the tool includes human readable files, organizing numerical information into structured word templates with supporting figures to increase comprehension and provide a faster, easier, and more standardized way to communicate information. The modular design of the report generator allows for further customization, including customizing the reports’ language to facilitate local operators.

To demonstrate the proposed failure quantification approach implemented through the purpose-built tool, a case study was conducted where a WDN was subjected to a CPA. The network selected was the well-known C-Town benchmark network, an EPANET network introduced by Ostfeld et al. (2012) that is composed of 388 demand nodes and 7 tanks linked with 429 pipes, 11 pumps, and 4 valves to a single source (1 reservoir) divided into 5 DMAs (Fig. 7). The cyber network is composed of 9 PLCs, linked to 7 tank stage sensors, and 12 actuators across the WDN, based on a configuration proposed by Taormina et al. (2017). To generate the data on the effects of CPA needed to demonstrate the quantification approach that was used, one of the CPA scenarios introduced in Taormina et al. (2017) was adopted and simulated using the same tool: the EpanetCPA toolbox. This CPA scenario is explained in what follows.

C-town actuators are operated by the main SCADA based on the water levels reported by the sensors found in each of the seven tanks. For example, tank T2 and control valve V2 are operationally linked through such a control logic. Based on the reported T2 level sensor readings, the SCADA updates the status of valve V2 and remotely opens it when a low level ($<0.5\mathrm{m}$) is detected. Or, when the tank sensor reports high water levels ($>5.5\mathrm{m}$), the SCADA closes the valve. For this case study, it is assumed that a threat actor, after breaching the system and repeatedly obtaining sensor and actuator status data, has leveraged operational knowledge over this refill protocol. This allows him to perform an attack that alters the T2 stage readings, introducing bogus input data (Zhu et al. 2011) that lead the assigned PLC to (erroneously) believe the tank is full. This information is then reported back to the SCADA, deceiving it and preventing it from activating the refill protocol by requesting V2 status to be “closed.” This CPA scenario is expected to cause supply problems to the districts supplied by tank T2. It is assumed that the false sensor reading attack begins at time $t_e=5\mathrm{h}$ and has a duration of 15 h. To produce a more realistic behavior in the network, a PDA approach was selected using the NHFR formula of Wagner et al. (1988). For the purposes of estimating the number of customers based on Eq. (3), a per-capita consumption $D_{pc}$ of $200\mathrm{L}/\mathrm{day}$ is assumed. Failure quantification using the proposed approach was conducted both on the entire system and at the DMA scale. Service level thresholds [disrupted ($L_1$) and degraded ($L_2$)], defined for the system and per DMA, are shown in Table 2. Conditions critical for the examination of failure rapidity and available reaction times are also defined in the same table.

The attack led to low pressure conditions and supply deficiency to parts of C-Town. Failure in terms of magnitude for all four dimensions (service, spatial, social, and continuity) can be found in Table 3.

The results suggest that C-Town was unable to meet nearly 12% of the total daily demand to 28.6% of the network due to interruptions. This resulted in 31,571 customers being cut off during the 11 h of failure. Note that, although the system faces degraded supply conditions for a longer period of time, its spatial expansion is limited, while high values for $C{M}_{L_1}$ indicate a significant service outage. The main impact was felt in DMA2, which saw 47.5% of its supply lost owing to complete supply interruption ($L_1$). Some damage also spread to DMA3, but only partially, while the rest of the system remained intact. In fact, one can clearly see in Fig. 8(b) that DMA3 started to fail shortly before the attack ended, allowing the PLC to detect the low stage and react. The refill process caused pump activation and a rise in pressure, which restored supply services.

In terms of the failure’s average propagation, the results are presented in Table 4. In an average hour of disrupted services, 82 nodes were cut off, unable to meet the demands of 22,814 customers for $52.71\mathrm{L}/\mathrm{s}$. On average each affected customer of the system experienced 6.48 h of disrupted service. The nearly identical down time per affected node in DMA2 ($\overline{N{T}_{L_1}}=9.49\mathrm{h}$) and total disruption duration ($T_{L_1}=9.5\mathrm{h}$) indicate that the attack affected a fixed area throughout the failure duration, which can be seen in Fig. 9(a).

Severity was then calculated as a snapshot of the system at its highest stress point (Table 5). In addition to the absolute number of the peak effect for each dimension, the PAR metrics are also calculated and shown in the second part of Table 5. At the system level one can see a rather uniform profile, revealing a steadily evolving failure. The failure seems to gradually (as opposed to abruptly) add load to the system after its manifestation, as seen through the PAR metrics. This can be seen in Fig. 10, where the time series of unmet demand for the system are plotted.

At the district level, DMA2 PAR metrics ($PA{R}_{U{D}_{L_1}}=1.09$, $PA{R}_{N_{L_1}}=1$, $PA{R}_{C_{L_1}}=1.09$) indicate a smoothly propagating failure, with no extreme peaks, as seen in Figs. 8(a) and 9(a).

The rapidity of propagation is calculated from the attack’s occurrence ($t_e=5\mathrm{h})$ until the peak and critical marks, respectively. Defining the available time until peak effect of the attack occurs creates the first and largest possible time window for mitigation actions to become effective. In the absence of effective actions, disruption of supply seems to gradually rise and spread, as $TE{P}_{U{D}_{L_1}}$ and $TE{P}_{N_{L_1}}$ approach attack duration. This was seen previously, with failure cascading to DMA3 shortly before the end of the attack. With respect to the entire system, the water company has 8 h before maximum service disruption. The maximum disruption of service to DMA2 occurs 12 h after the attack, but the company only has 5.5 h to deploy the necessary resources before the maximum spatial spread to the subsystem. This is almost 2.5 times faster than the failure occurrence to DMA3, raising a priority flag in terms of available time.

The identical times to critical (TEC) found in Table 6 for all three conditions at the system and DMA levels are the result of lower critical condition thresholds determined and the C-Town dependence on tanks to regulate nodal pressure, which allows for immediate disruption once the tank is empty. Prioritization of actions for DMA2 is highlighted in terms of criticality, available time to react, and size of failure, as a result of the proposed methodology implementation.