water utility operators

Abstract: Digitally controlled water distribution systems must maintain service during disruptions, yet restoring water delivery does not necessarily ensure hydraulic recovery. This study evaluates cyber-induced pump outages under hypothetical environmental operating stress using two EPANET benchmark networks (Net1 and Net3) simulated with the Water Network Tool for Resilience. The experimental design comprises 288 simulation records (240 distinct configurations), including 192 verified attack scenarios, with four- and twelve-hour outages, six hydraulic configurations, and four mitigation strategies. All attack scenarios satisfied pump-shutdown verification and pre-attack hydraulic-equivalence criteria. Twelve-hour outages produced an average of 404.96 m$^3$ of unmet demand in Net1, while Net3 maintained full modeled demand delivery despite pressure deviations. Sustained pressure recovery occurred in 103 of 192 scenarios, with 65 exhibiting subsequent relapse, whereas all scenarios satisfied the post-outage water-service recovery criterion. Combined mitigation eliminated unmet demand in evaluated Net1 scenarios, while outage shortening achieved the highest sustained-pressure-recovery count. These findings highlight network-dependent resilience and the distinction between service restoration and hydraulic recovery. Environmental stress scenarios represent sensitivity assumptions rather than empirically calibrated climate impacts.

Abstract: When a SCADA alarm is raised in a water distribution network, operators must decide quickly whether it reflects a cyberattack, a physical fault, a normal transient or a faulty sensor. Supervised classifiers need labelled incidents that utilities rarely have, and frontier large language models (LLMs) take tens of seconds per decision. We tested whether Jev, a training-free model that returns class probabilities in about one second, can serve as the first tier of this triage. On a four-class cause-attribution benchmark built on the C-Town network in EPANET, Jev was compared with a hand-written rule tree, a supervised classifier and seven cloud LLMs on identical evidence in four sealed, pre-registered rounds. With only a label-free prior correction, Jev matched the rule tree (macro-F1 0.62-0.64 against 0.56-0.61 in distribution) and exceeded the supervised classifier by 0.36-0.42 on event subtypes absent from its labels, in all four rounds, and it outperformed the classifier whenever fewer than about four labelled events per class were available. Jev also decided 20-40 times faster than frontier LLMs. Accepting only benign Jev verdicts confirmed by the rule tree spared an LLM reviewer 35-38% of windows on fresh sealed sets without loss of macro-F1. Transferred unchanged to two further networks, this gated cascade stayed within the non-inferiority margin of its reviewer on all four sets. A fast, training-free screen can therefore take over about a third of the review load in SCADA anomaly triage while preserving the accuracy of deliberate review.