Operations is an attention problem before it is a modeling problem
The Government Accountability Office counts nearly 170,000 public water systems in the United States. EPA's 2022 Clean Watersheds Needs Survey counted 17,544 publicly owned treatment works serving 270.4 million people, about 82 percent of the country, and put the twenty-year clean water capital need at $630 billion. Behind those numbers sit control rooms where two or three people on a night shift hold responsibility for a treatment process, a distribution network, a collection system, and a permit. Every hour spent chasing a nuisance alarm or re-keying a report is an hour not spent on the thing that would have mattered.
AWWA's 2026 State of the Water Industry report, drawn from 2,171 water sector professionals, put infrastructure renewal and replacement at the top of the challenge list with financing right behind it. The same survey found that only 43 percent of utilities describe themselves as very to fully able to cover the cost of operations through rates and fees. A utility in that position is not going to buy a platform. It will buy a specific reduction in the number of judgments a thin shift has to make, and it will want to know exactly who is accountable for each one.
This is a companion piece to our article on the data behind water utility analytics, which covers what the source systems contain and what they cost to integrate. This one is about the operating side: the console, the inspection backlog, the storm, the permit, and the accountability chain that decides what software is allowed to do.
Start with who is legally allowed to make the decision
Every serious conversation about operations software runs into the same fact early, and a vendor who has not thought about it will lose the room. Under Section 1419 of the Safe Drinking Water Act, added by the 1996 amendments, EPA published guidelines specifying minimum standards for the certification and recertification of operators of community and nontransient noncommunity public water systems. Those guidelines were finalized in February 1999 and are implemented through state programs, each with its own classifications, exam structure, and continuing education requirements.
The operative concept is direct responsible charge. EPA describes it as active daily on-site technical direction, supervision, or accountability for a facility or a major segment of one. A certified operator in direct responsible charge is the person the state holds answerable for how the plant ran. Wastewater operator certification works the same way through state programs under the Clean Water Act framework.
That structure fixes the design of every useful product in this space. Software does not hold a license. It cannot be in direct responsible charge, cannot sign a monthly operating report, and cannot be the reason a permit limit was exceeded. So the correct output of an operations model is a ranked, explained recommendation delivered to a named human who accepts or rejects it, with the acceptance recorded. Anything that blurs that line is not a shortcut. It is an unowned decision, and the utility holds it during an inspection.
The alarm system is the highest-value target almost nobody bids
Ask an operations manager what wastes the most console time and the answer is rarely modeling. It is the alarm system. A distribution or treatment SCADA system accumulates alarms the way a house accumulates keys: every commissioning, every retrofit, every incident adds a few, and nothing ever removes one. The result is a console where a genuine event arrives inside a stream of noise.
There is a real standard for this. ANSI/ISA-18.2, Management of Alarm Systems for the Process Industries, defines an alarm management lifecycle from philosophy through identification, rationalization, design, implementation, operation, monitoring, and change management. The current American edition is ISA-18.2-2016; the international version, IEC 62682, was reissued as Edition 2.0 in 2022 with technical changes aligned to the 2016 ISA text. Neither was written for water. Both apply cleanly to it.
The 2009 first edition published target alarm rates that practitioners still quote: roughly one alarm per ten minutes as a working average, with about 150 alarms per operator per day treated as likely acceptable and 300 as the practical ceiling. The 2016 revision dropped that specific table, and the standard is explicit that acceptable rates depend on process type, degree of automation, and how the interface presents information. The numbers survive as benchmarks rather than requirements, which is the right way to use them.
The analysis is unglamorous and cheap. Pull a year of the alarm and event journal out of the historian. Compute the alarm rate per console per hour, the distribution of that rate, and the count of standing alarms carried across shift change. Then rank the bad actors. A very small number of tags typically generate a disproportionate share of the annunciations, driven by chattering setpoints on noisy analog signals, alarms never suppressed during known maintenance states, and duplicates on one physical condition inherited from a control system migration.
Machine learning has a modest and honest role here. Clustering related annunciations into events reduces a flood of forty alarms into one incident with a probable initiating cause. Sequence models trained on the journal can predict which alarm follows which, which is how you find causal chains a human would need weeks to trace. Neither replaces rationalization, which is an engineering exercise with the operators in the room. Both make it finish in a quarter rather than a year.
| Operations decision | What software should actually produce | Who signs |
|---|---|---|
| Alarm response | Clustered event with probable initiating tag and a link to the rationalization record | Console operator, per the alarm philosophy document |
| Sewer inspection order | Ranked segment list with the evidence for each rank and a defensible sampling plan | Collection system superintendent |
| CCTV defect coding | Pre-coded observations in the standard schema, staged for certified review, never auto-accepted | PACP-certified reviewer |
| Wet-weather pre-positioning | Storage and pumping schedule options with forecast uncertainty stated, inside permit constraints | Operations manager on duty |
| Aeration setpoint | Recommended dissolved oxygen or ammonia target with the permit margin shown | Certified operator in direct responsible charge |
| Compliance package | Assembled record with every value traced to its source reading; arithmetic in deterministic code | Certified operator, then the signing official |
The inspection backlog is a ranking and coding problem
Collection system condition assessment runs on closed-circuit television inspection coded to NASSCO's Pipeline Assessment Certification Program. PACP organizes every observation into four code families, structural, operation and maintenance, construction, and miscellaneous, and grades severity on a one-to-five scale. Version 8 is the first major revision since 2015. It modified codes for pressure pipe, access points, and materials, expanded the use of modifiers so force mains and post-rehabilitation surveys can be represented properly, and added pipe use codes for perforated and non-sanitary systems. Across North America it is the required coding standard on contracted inspection work.
Two different pieces of work get confused here. The first is automated defect recognition inside the video: a vision model proposes observations, and a PACP-certified reviewer confirms or corrects them. NASSCO itself has addressed the relationship between PACP codes and automated recognition, and the sector consensus is that the model pre-codes and the certified human owns the record. That is exactly right, and it is also the only version a utility can defend when a rehabilitation decision is questioned.
The second piece has more money in it and less attention on it. A utility with 900 miles of sewer inspects a small fraction of it per year, and the question that decides the budget is which fraction. Ranking segments by expected condition, using age, material, diameter, slope, upstream contributing area, prior grades, root intrusion history, grease-related service calls, and proximity to prior failures, moves crews toward pipe that is actually deteriorating. The output is not a score. It is next year's inspection route, and it should arrive in the work management system rather than in a slide deck.
Wet weather is where operations meets enforcement
Nothing tests a collection system like rain. EPA estimates there are at least 23,000 to 75,000 sanitary sewer overflows per year in the United States, a figure that excludes backups into buildings. Separately, combined sewer overflows are a water quality and public health concern for roughly 700 communities. The 1994 CSO Control Policy set the framework for those communities, requiring the nine minimum controls and a long-term control plan, and Congress codified the policy in December 2000 through the Consolidated Appropriations Act for Fiscal Year 2001, which added Section 402(q) to the Clean Water Act.
A utility under a long-term control plan or a consent decree measures overflow volume and frequency against numbers it has already committed to. That makes wet-weather work the clearest place where analysis converts into avoided liability. The useful products are specific. Separate rain-derived inflow and infiltration from base sanitary flow using flow monitor and rain gauge records, so basin-level I and I is quantified rather than argued. Forecast influent and basin response several hours ahead, so storage and pumping can be pre-positioned instead of reacting. Flag flow monitors that have silted, drifted, or fallen out of the pipe, since a bad monitor quietly corrupts every downstream conclusion.
The modeling foundation for this is public and free. EPA maintains SWMM, currently at version 5.2, for collection system and stormwater hydraulics, and EPANET 2.2 for distribution systems, plus the open-source Water Network Tool for Resilience built on EPANET. A vendor proposing a proprietary hydraulic engine should be asked what it does that the EPA tools and a properly calibrated model do not, and to answer in terms of calibration data rather than features. The value a contractor adds is almost never a new solver. It is calibration, automation of the model runs, and connecting the output to a decision someone makes on a Tuesday.
Energy: aeration is the biggest lever inside the fence
At an activated sludge plant, aeration dominates the electricity bill. EPA's guide to energy efficiency in water and wastewater facilities documents blowers accounting for 57 percent of the energy used by all treatment equipment at one Pennsylvania plant, and aeration above half of total plant electricity is the common finding across the sector. Anything that moves dissolved oxygen control from a fixed setpoint toward demand-following control is chasing the largest controllable operating cost the plant has.
Two constraints keep this honest. The permit comes first: ammonia, total nitrogen, and dissolved oxygen limits are not negotiable against an energy target, and a recommendation that shaves margin has to show how much is left. Second, the biology has memory. Nitrifier populations respond to sustained conditions over days, so an optimizer tuned on hourly power price without a process constraint model saves money for a week and costs a permit exceedance in the second month. The defensible product is an advisory setpoint with the predicted effluent margin shown next to the predicted kilowatt-hours.
Why operations software stalls after go-live
Editorial ranking of how often each factor is the binding cause, drawn from public post-implementation reporting and practitioner accounts. Relative ordering, not a measured statistic. Read it as one claim: the model rarely fails first.
Read the bottom row against the top two. In operations work the algorithm is almost never the binding constraint. A model good enough to reorder an inspection list sits unused if the list arrives as an email attachment instead of work orders in the system the crew opens every morning. That is why we scope the integration and the acceptance step before the model.
The compliance calendar is an operations schedule
Regulatory dates set the rhythm of an operations department, and knowing them is most of what separates a useful vendor from a hopeful one.
Risk and resilience, on a five-year cycle. Section 2013 of America's Water Infrastructure Act of 2018 amended Safe Drinking Water Act Section 1433 to require community water systems serving more than 3,300 people to prepare risk and resilience assessments and emergency response plans, then recertify them every five years. EPA set the current cycle from population data reported to SDWIS Fed as of March 31, 2024. Assessment recertification fell on March 31, 2025 for systems serving 100,000 or more, December 31, 2025 for 50,000 to 99,999, and June 30, 2026 for 3,301 to 49,999. Plan certification follows six months later, so the last group is due December 31, 2026.
Lead, with a date and an open case. The Lead and Copper Rule Improvements were finalized in October 2024 with a compliance date of November 1, 2027, and EPA released implementation tools including a resource guide and waiver checklists on June 29, 2026. The rule is also under judicial review: AWWA petitioned in December 2024 and filed its opening brief in September 2025. Utilities are building inventories and replacement programs against a date that is real today and could move. Any plan built on it should absorb a schedule change without discarding the underlying service line records, which hold standalone value in a rate case and a State Revolving Fund application however the litigation ends.
Overflow reporting, continuously. NPDES permits set the reporting obligations for sanitary and combined sewer overflows, and the record of those events is what a regulator reads first. An overflow log assembled by hand at month end from three people's notes is a compliance risk in itself. Automating the assembly, with every entry traced to the flow monitor reading or the field report that produced it, is unglamorous and repays quickly.
Cybersecurity is now a constraint on the architecture, not a section in the appendix
The federal picture here is genuinely unsettled, and saying so is more useful than pretending otherwise. EPA issued an interpretive memorandum in March 2023 that would have brought cybersecurity into sanitary surveys, then withdrew it on October 11, 2023 after legal challenge. What remains binding is the AWIA cycle: systems serving more than 3,300 people must consider cybersecurity in their risk and resilience assessments and emergency response plans. EPA published a Water and Wastewater Systems Sector Risk Management Plan in January 2025. In testimony released May 21, 2026, GAO reported that EPA had identified critical gaps in its own authorities, specifically the absence of cybersecurity risk assessment requirements for wastewater systems and for certain drinking water systems. Bills in the 119th Congress propose a Water Risk and Resilience Organization and expanded assistance for rural systems.
What does change the architecture is the operational guidance. On December 13, 2024, CISA and EPA released a joint fact sheet on the risks that internet-exposed human machine interfaces pose to water and wastewater systems, describing how an exposed interface lets an unauthorized party view system state and make changes that disrupt treatment. In April 2026, EPA, CISA, and partner agencies issued a joint advisory that programmable logic controllers of the type widely used at these facilities were being actively targeted. The consequence for anyone selling analytics into this sector is simple: a design requiring an inbound connection to the control network will not survive review, and it should not.
Our rule is that the analytic stack reads a mirrored copy of historian data in the enterprise zone and holds no write path to any controller or interface. The vendor's connection design then becomes an auditable item inside the utility's own five-year assessment, so it should be written down in terms an assessor can check. Two references make that conversation faster: AWWA J100, the risk and resilience management standard for water and wastewater systems aligned with ASME's RAMCAP methodology, and AWWA G430, updated in 2024, covering the minimum requirements for a protective security program. EPA also runs two free services worth naming to a client with neither budget nor staff for this: a cybersecurity technical assistance help desk and a no-cost cybersecurity evaluation program.
The workforce argument, made correctly
The pitch that AI will replace operators is both wrong and commercially self-defeating. State certification programs exist precisely because a licensed human must be accountable for how a plant runs, and no software product changes that. What is true is that experienced operators retire carrying knowledge that was never written down: which pump cavitates when the wet well drops below a certain level, which sample site reads high after a main flush, which basin short-circuits at a particular flow.
That knowledge is recoverable from the record. Historian trends, work orders, operator log entries, and the alarm journal contain the traces of thousands of past judgments. A language model reading operator logs and maintenance narratives can surface the recurring pattern behind a failure and present it as a searchable record with citations back to the original entry. This is the version of the workforce pitch a general manager will accept, because it is help for the people who remain rather than a threat to them, and because the artifact it produces outlasts everyone who wrote it.
How this gets bought
Funding shapes scope more than technology does, and the split between capital and operating budgets is the first thing to establish. A capital project competes in a five-year plan, needs a board vote, and moves on a rate schedule. An operations-budget engagement moves on the general manager's authority within a purchasing threshold. Anything a utility can buy inside its operations budget will start months earlier, which is why an operations pilot should be sized to that threshold on purpose.
The Clean Water State Revolving Fund is more flexible than most vendors realize. EPA states that technical assistance such as water and energy audits and asset management plans is CWSRF-eligible where it is reasonably expected to result in a capital project. That is a real path for a condition assessment or an inflow and infiltration study that will justify rehabilitation work, and it means the analysis is funded as part of the program it informs rather than fought for separately. Our piece on county-level analytics procurement covers the thresholds and vehicles in detail.
- Name the operator role that receives each output, and state what accepting or rejecting it does downstream.
- Require read-only data access with no write path to any controller, interface, or control network device.
- Specify the destination system by name, whether that is the work order system, the console, or the reporting package.
- Set the acceptance metric against the decision, such as capture rate in the inspected fraction, not overall accuracy.
- Require a tag and field dictionary as a deliverable, because it is the artifact that keeps the work usable after handoff.
- Keep regulatory arithmetic in deterministic code with a stored audit trail, and confine models to reading and ranking.
- Define the retraining owner and cadence before signature, not in a closeout meeting.
A first engagement scoped to the operations calendar
Operations departments run on seasons. Wet weather work is scoped before the wet season, not during it. Alarm work belongs in a maintenance window. Inspection ranking has to land before the next inspection contract is bid. A schedule that ignores that is technically correct and operationally useless.
Operations engagement, gated and seasonal
Step five is where most engagements in this sector go wrong, and it is worth being blunt about it. Building the model first and integrating later produces a demonstration that everyone praises and nobody adopts. Putting the output into the destination system while the model is still mediocre produces the opposite: operators complain about the recommendations, which is the only feedback that ever improves them.
Bottom line
Water and wastewater operations reward a narrow kind of software. It has to reduce the number of judgments a short-staffed shift must make, arrive inside a system people already open, explain itself well enough to survive a regulator's question, and leave a licensed human holding the decision. The regulatory calendar says when a utility is receptive. The alarm journal and the inspection backlog say where the wasted hours are. The funding structure says how large a first engagement can be. None of that requires a new sensor, a new platform, or a new category of model. It requires reading the operation in front of you before proposing anything.
Frequently asked questions
Closed-loop control belongs to the control system and the process engineer, inside interlocks, with a certified operator in direct responsible charge accountable for the result. An analytics contractor should target the advisory layer: a recommended setpoint with the predicted permit margin shown, entered by an operator who can decline it. The recommendation and the acceptance should both be recorded.
An alarm system audit is usually the least expensive and the fastest to show results. It needs only the alarm and event journal, produces a ranked list of the tags generating most of the console load, and feeds directly into a rationalization effort the utility can run with its own staff under ANSI/ISA-18.2. It also builds the trust needed for anything larger.
It can pre-code them. The defensible pattern is a vision model that proposes observations in the standard schema and a PACP-certified reviewer who confirms or corrects each one before the record is accepted. The larger and less contested value is ranking which segments get inspected next, because that decision sets the inspection budget.
No, and asking for one will end the conversation at a well-run utility. Analytics should read a mirrored copy of historian data in the enterprise zone with no write path to any controller or interface. CISA and EPA issued joint guidance in December 2024 on the risks of exposed control interfaces, and the connection design becomes an auditable item in the utility's own risk and resilience assessment.
Two routes are common. Sizing the engagement to the operations budget keeps it under the general manager's purchasing authority and avoids a capital plan cycle. Where the analysis will justify rehabilitation, EPA states that technical assistance such as water and energy audits and asset management plans is Clean Water State Revolving Fund eligible when it is reasonably expected to result in a capital project.