Water, hygiene, sanitation and microbial control

Water safety is a chain of controlled qualities, not a single recycling percentage

A Mars settlement cannot treat “water” as one homogeneous inventory. Drinking water, food-preparation water, hygiene water, technical rinse water, condensate, urine, laboratory effluent and crop-loop water carry different contaminants and require different barriers. The first engineering task is therefore to draw the streams, identify where they may connect, and decide what quality is required at each use point. Only after that map exists does a recovery percentage become meaningful.

Closed-loop thinking changes the logistics question. Gross demand describes how much water passes through human and technical activities, while makeup water describes what must be replaced after recovery losses. Those two numbers can differ by an order of magnitude in a high-recovery system, yet the lower makeup figure must never hide the fact that treatment equipment still processes the much larger gross flow. Pumps, membranes, tanks, sensors and microbial controls are sized by throughput and peak conditions as well as by losses.

Microbiology turns the water system into a living operational environment. Warm wet surfaces, stagnation, roughness, nutrients and dead legs can allow microorganisms to attach and form biofilms. A biofilm can alter water quality, protect organisms from disinfectant, foul sensors, increase hydraulic resistance and make a contamination event persistent even after bulk water tests improve. Prevention therefore depends on geometry, material compatibility, flushing, temperature management, sanitation procedures and trend monitoring, not on one disinfectant measurement.

Sanitary resilience also requires separation between normal and abnormal states. When a sample is out of specification, the crew needs a known sequence: protect a verified potable reserve, isolate the suspect branch, preserve samples, identify the affected boundary, apply a compatible corrective action, flush or replace contaminated components when needed, and demonstrate recovery with independent checks. “Add more disinfectant” is not a complete incident response because it may suppress symptoms without removing the initiating cause.

Human hygiene belongs inside this engineering model. Reducing shower or laundry water can save resources, but excessive restriction can create skin problems, infection risks, poor sleep, odor, morale loss and extra cleaning burdens elsewhere. The right design treats hygiene as a health function with measurable water demand, contamination load and fallback modes. A settlement that closes its water loop while making daily life medically or socially unsustainable has not solved the real problem.

From source to mouth: the twelve control ideas a crew must understand

1. Map every stream before combining any streams

A useful water-flow diagram begins at generation points rather than at the treatment plant. Crew metabolism, cooking, washing, humidity condensate, toilets, laboratories, crop systems and maintenance each produce water with a characteristic contamination profile. The map should show normal destination, storage buffer, treatment path, sampling points, valves and any cross-connection that could send a lower-quality stream toward a higher-quality network. This makes hidden common-cause paths visible before they become incidents.

Operators then attach quantities to the diagram: average flow, credible peak flow, expected solids or chemical load, required product quality and the amount that can be temporarily stored. A stream that is small in daily volume can still dominate hazard if it contains solvents, concentrated salts or biological material that damages the main recovery process. Conversely, a large relatively clean condensate stream may deserve a simpler path. Stream mapping is therefore both hydraulic accounting and risk segregation.

2. Define water quality by use, not by a single universal label

Potable water requires the strongest assurance because failure immediately affects crew health. Technical water may tolerate a different mineral content or microbial specification if it never contacts food, drinking systems or sensitive equipment. Crop irrigation can have yet another quality envelope because nutrients, salts and plant pathogens matter differently. Separating these classes avoids spending maximum treatment energy on every litre while still protecting the uses that need the strictest control.

The separation only works if interfaces are physically and procedurally credible. Connectors, hose fittings, labels, software displays and maintenance instructions should make it difficult to route technical water into the potable network by mistake. Backflow protection and pressure relationships matter as much as color coding. A quality class is not a name printed on a tank; it is an enforced boundary maintained through hardware, operations and verification.

3. Use multiple barriers because no single treatment step answers every hazard

Particle removal, adsorption, oxidation, catalytic processing, membrane separation, disinfection and final polishing address different contaminant families. The design should state what each barrier is expected to remove or control and what measurement demonstrates that the barrier is still working. If the system relies on several barriers in series, one degraded stage may be tolerable for a limited period only when downstream capacity and monitoring can cover the loss.

This barrier logic also prevents false confidence in a “good” bulk parameter. Low turbidity does not prove absence of dissolved organics, and acceptable conductivity does not prove microbiological safety. The crew should know which indicators are screening tools, which are direct measurements, and which require confirmation by a different method. The objective is not to maximize the number of sensors but to create enough independent evidence to make a defensible release decision.

4. Greywater recovery depends on what the crew puts into the drain

Greywater from washing can contain surfactants, skin oils, fibres, cleaning agents and microorganisms. Its treatability is therefore partly controlled upstream by the products approved for use in the habitat. A detergent chosen only for terrestrial cleaning performance may foul a membrane, interfere with a sensor or create persistent foam in a recovery loop. Procurement policy becomes a water-system design variable.

Because greywater production varies with crew routines, peak storage and treatment capacity need attention. A large laundry event can create a short high-flow period even if daily average volume is moderate. Buffer tanks can decouple generation from treatment, but long residence times can encourage microbial growth. The buffer is useful only when its volume, mixing, temperature and cleaning strategy are part of the operating concept.

5. Urine and concentrated sanitary streams should be treated as chemistry-rich resources

Urine contains a high dissolved load and can change chemically during storage. Precipitation, odor compounds, biological activity and scaling can complicate recovery equipment. The engineering question is not simply how much water can be extracted, but how the remaining concentrate is managed and whether useful nutrients or chemicals can be recovered without contaminating other loops.

A robust system keeps the concentrate boundary explicit. Maintenance personnel need to know where salts accumulate, which surfaces require inspection, how lines are flushed, and what happens if recovery is temporarily unavailable. Emergency storage capacity may be essential because forcing a problematic concentrate through degraded equipment can turn a local failure into a plant-wide contamination event.

6. Hygiene demand is both a human-factors budget and a contamination source term

Water allocation for hand washing, body cleaning, oral hygiene, toilets and clothing should be based on health and operability, not on an arbitrary desire to minimize litres. Different tasks have different minimum acceptable service levels. During a shortage, the crew can prioritize hand hygiene and clinical cleaning while reducing lower-priority uses, but those degraded modes need to be designed in advance with suitable products and procedures.

The downstream consequence must also be counted. A “dry” cleaning product can reduce water use yet introduce volatile chemicals or solid waste. Reusable textiles may save packaging but increase laundry demand. Hygiene architecture is therefore a cross-system trade among water, air quality, waste, power, crew time and medical risk. A credible budget names those exchanges instead of optimizing one subsystem in isolation.

7. Biofilm prevention starts with geometry and operating discipline

Dead legs, seldom-used branches, rough internal surfaces and low-flow zones create conditions where disinfectant residuals can decay and attached growth can establish itself. Designers should minimize unnecessary stagnant volume and provide ways to flush, sample or isolate branches. The crew should know which outlets must be exercised periodically and which tank or line temperatures make growth more likely.

Once established, a biofilm can release organisms intermittently, producing confusing test results. A single clean sample after disinfection may therefore be insufficient evidence that the system has recovered. Trend data, repeated samples, upstream/downstream comparisons and inspection of vulnerable hardware may be needed. Microbial control is a reliability program with spatial memory, not a one-time laboratory test.

8. Sampling plans must match the question being asked

A sample taken at the treatment outlet answers a different question from a sample taken at a distant tap after several metres of distribution piping. The first may demonstrate treatment performance while the second tests the condition of the network and point of use. Incident sampling should intentionally bracket the suspected boundary so the team can identify where quality changes.

Sampling itself can contaminate the sample. Containers, valves, handling technique, flushing time and storage temperature influence the result. Procedures should distinguish routine trend samples from confirmatory samples that may drive major operational decisions. When the consequence is high, an independent method or replicate can reduce the chance that a handling error causes either an unnecessary shutdown or an unsafe release.

9. Storage is an operational buffer and a sanitary component

Tanks give the crew time to decouple production, treatment and demand. A verified potable reserve can keep vital consumption independent of a temporary treatment outage, while a separate quarantine tank can hold uncertain product until testing is complete. The useful reserve is the volume that can actually be delivered under the failure being considered, not the geometric capacity printed on a drawing.

Tanks also require mixing, level measurement, vent management and a cleaning concept. Sediment or biological growth can accumulate in regions that normal circulation does not reach. If a tank cannot be inspected or sanitized, its long-term reliability depends entirely on assumptions that become harder to verify over years of operation. Maintainability should therefore influence tank shape, access and sensor placement from the start.

10. Backflow and cross-connection control protect the hierarchy of quality

A hose connected for maintenance can temporarily defeat a carefully designed sanitary architecture. Pressure transients can then drive contaminated liquid backward into a clean branch. Hardware backflow preventers, air gaps where practical, isolation valves and controlled connection procedures reduce this risk. The most dangerous configuration is often an unusual maintenance setup rather than normal operation.

Configuration control matters because temporary connections tend to become invisible once the immediate job is finished. The work record should identify what was connected, when it was removed and which post-maintenance flush or sample is required. A sanitary boundary is preserved through configuration discipline just as an electrical safety boundary is preserved through lockout and verification.

11. Treatment capacity must handle peaks and degraded modes, not only daily averages

Average litres per day can hide short periods when many crew members wash, a laboratory releases a batch, or a crop operation produces a large drain flow. If the processor cannot accept the peak, storage must absorb it without overflowing or creating excessive residence time. The design should therefore pair throughput calculations with buffer-volume calculations and operational scheduling.

Degraded capacity deserves the same treatment. If one pump, membrane train or sterilization stage is unavailable, can the crew reduce nonessential demand, reroute a cleaner stream, or operate the remaining train at a safe duty cycle? A recovery system becomes resilient when procedures connect physical capacity with priority rules rather than assuming every component is continuously available.

12. Release criteria turn measurements into a controlled decision

The final question is not whether a value “looks normal” but whether the product meets a defined release condition. The plan should state which parameters must be within bounds, whether a confirmatory sample is required after corrective action, who has authority to release the water, and what volume remains quarantined until the decision is made. This prevents social pressure or supply anxiety from quietly lowering standards during an incident.

Release criteria should also define what happens when evidence disagrees. A chemical sensor can look acceptable while a microbiological sample is suspect; two samples can conflict because one was contaminated during handling. The procedure should prescribe escalation, repeat testing and preservation of a safe reserve. Uncertainty is managed explicitly rather than resolved by optimism.

Water calculation laboratory: gross demand, makeup and sanitary reserve

Formula 1 — gross demand, recovered volume and makeup requirement

Formula 2 — usable buffer time before a potable reserve reaches its minimum

Operational cases: how water problems propagate through a settlement

A positive microbial result at one distant tap

The crew should resist the temptation to disinfect the entire settlement immediately. A distant point-of-use result can originate in the treatment plant, the distribution branch, the tap hardware or the sampling act itself. Operators first protect consumers, switch the affected zone to a verified source if necessary, and take bracketing samples upstream and downstream. Flow history, temperature and recent maintenance help identify whether stagnation or a disturbed biofilm is plausible.

If upstream samples remain clean while repeated point-of-use samples fail, the corrective action can stay local. If multiple branches show the same trend, the boundary expands. This staged reasoning preserves scarce disinfectant, avoids unnecessary shutdowns and builds evidence about the actual failure mechanism. After cleaning or component replacement, recovery requires repeated acceptable results under representative flow, not just one sample taken immediately after a strong flush.

A greywater processor loses half of its nominal capacity

The first response is not automatically to shut down hygiene. The crew compares expected generation with remaining processor throughput and buffer storage. Laundry can be deferred, shower schedules adjusted, and some low-priority cleaning shifted to methods that create less liquid. High-priority hand and clinical hygiene remain protected because their health value is disproportionate to their water volume.

Operators also watch buffer residence time. Slowing generation can be helpful, but simply storing warm nutrient-rich greywater for many days can create a microbiological problem that outlasts the processor repair. The degraded plan therefore combines demand reduction, storage limits, treatment priority and a trigger for more severe restrictions if repair slips beyond the calculated buffer.

A laboratory solvent is accidentally sent toward the recovery loop

Chemical compatibility determines the response. The affected stream should be isolated before it reaches components that could be damaged or before it contaminates a large mixed inventory. The team records the chemical identity, estimated quantity, time and route, then checks which adsorbents, membranes, sensors or catalysts are vulnerable. A small volume can justify discarding or quarantining a larger batch if the consequence of contaminating critical treatment hardware is greater than the cost of losing water.

This case shows why laboratory drains deserve explicit routing and why maintenance bypasses need configuration control. Water conservation is not the only objective. Sometimes the safest resource decision is to sacrifice a limited contaminated volume to protect the much larger clean loop and the treatment capability that the settlement cannot readily replace.

A disinfectant sensor suddenly reports zero residual

A zero reading can mean genuine loss of protection, sensor failure, wiring trouble, calibration drift or a sample-point problem. Operators compare independent evidence before making a large chemical adjustment. They can check a second method, inspect recent dosing trends, verify flow and review whether a tank turnover or maintenance activity changed conditions. During uncertainty, potable release can be constrained while a verified reserve supports essential use.

If the sensor is wrong, blindly increasing dose may create an out-of-specification chemical condition. If the zero is real, delaying action may allow growth. The response therefore separates detection, confirmation and control. This is a general principle of remote settlement operations: never let one unverified instrument both diagnose the problem and command an irreversible corrective action.

A potable tank must be opened for maintenance

Opening a sanitary boundary converts a normally closed component into a contamination-sensitive worksite. The team defines cleanliness controls, tools, protective clothing, temporary covers, environmental conditions and the post-maintenance sanitation plan before the hatch is opened. Parts that contact potable water are protected from dust and from tools used on other fluid systems.

After closure, mechanical leak checks are not enough. The return-to-service sequence should restore flow, flush or sanitize as required, and verify the appropriate quality parameters before the tank is released. Configuration records capture what was changed. This protects the crew from a common maintenance trap: fixing the mechanical defect while quietly introducing a sanitary one.

A settlement grows from twelve to twenty people

Crew growth increases gross water throughput, but the stress is not uniform. Potable demand, toilet use, hygiene peaks and laundry batches may rise at different times. A processor that had comfortable average capacity can become constrained during peaks, while tank turnover becomes faster and storage margins shrink. Expansion planning therefore revisits each stream rather than scaling one total number by a population ratio.

The new occupancy also changes emergency reserve duration. The same 600 L tank provides fewer person-days of essential supply. If the architecture relies on a reserve to cover maintenance outages, the growth decision must include either more storage, higher repair readiness, lower degraded-mode demand or additional treatment redundancy. Population is an engineering parameter, not merely a habitation count.

Sanitary water drills with worked reasoning

Exercise 1 — Separate gross demand from imported makeup

A crew of 8 uses a gross 10 L per person per day for 20 days. Overall recovery across the chosen boundary is 92%. Calculate gross throughput and nominal makeup, then explain why treatment equipment cannot be sized from the makeup number alone.

Exercise 2 — Find the suspected contamination boundary

Routine samples are acceptable at the treatment outlet and first two taps but repeatedly fail at the final branch after a rarely used hose connection. State the next three actions.

Exercise 3 — Choose a degraded hygiene strategy

Greywater processing capacity falls to 60% for 48 hours. Which uses would you reduce first, and which would you protect?

Exercise 4 — Protect a potable reserve

A verified tank contains 500 L. The operating plan protects 140 L as untouchable emergency reserve. Essential degraded demand is 30 L/h. Calculate usable buffer time.

Exercise 5 — Respond to conflicting sensor evidence

Online conductivity is normal, but a microbial screening result is suspect. Can the crew release the water solely because conductivity is acceptable?

Exercise 6 — Evaluate a cross-connection risk

A maintenance team proposes using the same portable pump alternately for technical rinse water and potable transfer. Identify the design concern and propose a safer arrangement.

Exercise 7 — Plan tank maintenance

List the sanitary steps that belong before, during and after opening a potable-water tank.

Exercise 8 — Scale a system for population growth

A twelve-person habitat becomes an eighteen-person habitat while treatment hardware remains unchanged. What four quantities would you recalculate before approving occupancy?

Water incidents: diagnosis, isolation and sanitary recovery

Commissioning a new potable branch after construction

Before a new branch can serve drinking water, the team treats construction debris, lubricants, cleaning products and stagnant test water as possible contaminants. Mechanical pressure testing is only one part of commissioning. The line is flushed through a controlled route, sanitary treatment is applied when appropriate to the materials, and samples are taken at locations that demonstrate both the source and the new distal point. Valve positions and backflow devices are verified against the as-built configuration rather than assumed from the drawing.

The release decision also checks that the branch can be maintained. Sampling access, isolation capability and flushing flow must be practical after surrounding equipment is installed. A branch that is clean on day one but cannot later be isolated or sanitized becomes a long-term vulnerability. Commissioning therefore validates both present quality and future operability.

A membrane train shows gradual pressure increase

A rising pressure drop can indicate fouling, scaling, blocked prefilters, valve position error or sensor drift. Operators compare differential pressure with flow, feed quality and recent cleaning history before forcing the pump to work harder. Increasing pressure without diagnosis may accelerate damage or compact deposits that are harder to remove. If parallel capacity exists, the affected train can be isolated while product quality and total throughput remain protected.

The crew records the condition at the point of intervention because maintenance results are diagnostic evidence. If cleaning restores performance only briefly, the upstream chemistry or pretreatment may be the true cause. Reliability improves when the team asks why fouling returned rather than treating each pressure rise as an isolated maintenance task.

A tank level reading disagrees with water-accounting estimates

Inventory mismatch can come from a level-sensor fault, unrecorded transfer, leak, trapped volume, density assumption or a boundary error in the accounting model. The response compares independent measurements and valve history before declaring a water loss. A manual or alternate level check, pump runtime and downstream tank change can help reconstruct where the volume actually moved.

This matters because unnecessary emergency conservation can burden the crew, while a real leak left unexplained can consume reserve silently. Water accounting is therefore a diagnostic tool as well as a logistics table. Reconciliation rules should define how much unexplained difference is acceptable before operators stop transfers and investigate.

A sanitation chemical becomes unavailable

The settlement should know which sanitation functions depend on that specific chemical and which have qualified alternatives. Switching products is not trivial because material compatibility, required contact conditions, downstream removal and sensor interference may differ. The team prioritizes the remaining stock for the highest-consequence applications while using mechanical cleaning, heat or another validated method where suitable.

Procurement records should identify substitute products before the shortage occurs. A closed-loop habitat that depends on one imported disinfectant without an alternate procedure has a hidden consumable dependency. The response may also trigger local production research, but immediate operations rely on already demonstrated methods rather than experimental chemistry.

Crop-loop water shows a rising salt trend

A crop system can accumulate salts even while total water recovery looks excellent. Operators review nutrient dosing, plant uptake, evaporation, reject streams and any blending with other water qualities. Simply sending the high-salt water back into the potable loop can increase treatment burden or damage a process not designed for that load. A controlled purge may be necessary even though it reduces headline closure.

The useful engineering question is where the salts ultimately go. If they can be separated and recovered as nutrients, the purge becomes a resource stream. If not, storage or disposal must appear in the mass balance. Closing the water loop while allowing dissolved solids to accumulate indefinitely is not a physically closed system.

A crew member develops repeated skin irritation during conservation mode

The medical and water teams investigate hygiene products, rinse quality, clothing practices, humidity and the conservation procedure itself. The problem may indicate that the degraded hygiene plan saves water by creating a health burden elsewhere. Adjusting hand and body-cleaning priorities can use more water while still keeping total demand below normal through reductions in laundry or discretionary rinsing.

The event should update the conservation plan rather than be treated as individual preference. Habitability is part of mission reliability. If a water-shortage mode cannot be sustained for the duration assumed in the contingency analysis, the reserve calculation is optimistic even when the litres are mathematically correct.

A quarantine tank approaches capacity during a long investigation

Operators decide whether additional uncertain product can be diverted to another compatible tank, whether low-risk technical use is permitted before potable release, or whether generation must be reduced. Mixing batches can destroy diagnostic information by combining water from different time periods or treatment states. The tank inventory should preserve enough separation to support root-cause analysis.

Capacity planning therefore includes investigation duration, not only normal process flow. A quarantine volume that holds one routine sample period may be inadequate for a multi-day incident. The system needs a strategy for prolonged uncertainty without forcing premature release or dumping valuable water blindly.

A pipe repair requires a temporary bypass around treatment

Temporary bypasses are high-risk configurations because they can defeat sanitary barriers that are normally automatic. The work package states exactly which quality can flow through the bypass, what downstream uses are prohibited, how the temporary hose or pipe is cleaned, and which valves must be locked or tagged. Visual markings and independent verification reduce the chance that another operator assumes the system is in normal configuration.

After repair, the bypass is removed, normal barrier sequence is restored, and post-maintenance samples confirm that no lower-quality water reached protected branches. Configuration control closes the incident; simply repairing the broken pipe is not enough.

A remote sampling result is delayed while the potable reserve shrinks

The crew must balance evidence quality with resource time. The release plan can define whether a rapid local screening method is sufficient for provisional restricted use while a slower confirmatory result is pending. The decision depends on hazard, treatment history and reserve state, not on impatience. Some uses may remain prohibited even if limited technical consumption is allowed.

This is where predeclared decision authority matters. Operators should not invent lower acceptance standards because the tank is getting empty. Instead, the contingency architecture should provide another verified source, a reduced-demand plan or a clearly justified provisional criterion developed before the emergency.

Long-term trend shows slowly declining recovery efficiency

A one-percent decline may not trigger an alarm, yet over months it can materially increase makeup demand and indicate membrane aging, leakage, fouling or changed crew usage. Trend review separates measurement drift from real loss by reconciling multiple meters and process performance. Maintenance can then be scheduled before reserve requirements grow unexpectedly.

The lesson is that high closure needs statistical attention. The difference between ninety-eight and ninety-six percent can double the unrecovered fraction. Small percentage changes near the top of the scale deserve operational interpretation rather than being dismissed as rounding noise.

Water-system design dossier: sanitary verification and long-duration operation

Design dossier — separate potable availability from treatment availability

A settlement can have a healthy treatment plant and still lack deliverable potable water if a distribution pump, valve group or tank outlet is unavailable. Conversely, treatment can be down while a verified reserve keeps consumption safe. Reliability accounting should therefore represent production, storage and delivery as separate functions. The crew dashboard can show how many hours of potable service remain under each relevant failure, not merely whether the processor itself is “green.”

This functional view changes spare-part priorities. A small outlet valve or level sensor can become as mission-critical as a large membrane assembly if it is the only path to the reserve. The design dossier should list such hidden single points and show the manual or redundant route that preserves water access during maintenance.

Design dossier — manage water quality after long stagnation

A branch that remains unused for weeks can differ substantially from a continuously circulated line. Disinfectant residual may decay, temperature may drift and attached growth can develop even though the central tank remains within specification. Long-idle branches therefore need a restart procedure that can include flushing, sampling or controlled recirculation before the outlet returns to potable service.

The required action depends on branch volume, material, previous history and hazard consequence. The important principle is that “isolated and untouched” is not automatically equivalent to “preserved.” Storage and stagnation are physical states that affect quality over time.

Design dossier — use maintenance windows to preserve sanitary redundancy

Water-system maintenance should be scheduled against reserve level, alternate treatment capacity, crew demand and the probability of overlapping work. Taking two nominally redundant trains out of service for convenience can erase the very redundancy that protects a contamination event. Work permits can include a sanitary availability check before valves are opened.

If a second anomaly occurs during maintenance, operators need an abort point that leaves the system in a stable configuration. This may mean reinstalling a cleaned module, closing a bypass or restoring one train before continuing diagnosis. Maintenance sequencing is therefore part of sanitary resilience, not an afterthought.

Design dossier — instrument uncertainty belongs in the alarm threshold

A sensor threshold should not be chosen without considering measurement accuracy, drift and process variability. If normal variation is close to the alarm limit, the crew will face frequent ambiguous events and may learn to ignore alerts. If the threshold is too loose, a real deterioration can progress before action. Trending and confirmatory methods can create an intermediate warning state rather than forcing every deviation into an immediate shutdown.

The control plan should record calibration interval, known interferences and what secondary evidence is required for release decisions. Instrument engineering and sanitary policy meet at the threshold.

Design dossier — plan for cleaning water and cleaning waste

Cleaning a tank, membrane or pipe consumes water and produces a concentrated waste stream. That volume must appear in the balance, particularly during a contamination event when repeated cleaning can consume reserve quickly. The waste may contain disinfectant, biofilm debris or chemicals that should not be routed straight back to the normal recovery process.

A mature procedure identifies the source of cleaning water, maximum expected volume, temporary storage destination and criteria for returning the equipment to service. Maintenance water is part of life-support logistics, not an invisible utility.

Design dossier — verify the emergency water plan by drill

A tabletop calculation can show twelve hours of potable buffer, yet an actual drill may reveal that transferring from the reserve tank requires a hose stored behind other equipment, a pump that shares the failed bus, or a sampling step that takes longer than expected. Periodic drills should exercise the full path from declaring an out-of-specification condition to delivering verified water under degraded conditions.

Timing, crew workload and configuration errors from the drill feed back into reserve sizing and procedure design. A reserve is credible only when the crew can access and manage it through the same failure that motivated the reserve.

Final synthesis for mission qualification

Final synthesis — define what “water-secure” means for the settlement

A water-secure settlement is not one that reports a high recycling percentage. It is one that can identify each water quality, preserve a verified potable reserve, isolate contamination without losing the whole network, continue essential hygiene in degraded mode, repair treatment equipment without destroying sanitary barriers, and demonstrate return to service with independent evidence. The design review should therefore ask for time-to-consequence under treatment loss, distribution loss and contamination, then show the hardware and procedure that buys recovery time in each case. This closes the gap between chemistry, microbiology, logistics and human habitability: water security is a system capability whose proof is the ability to keep people healthy while a credible fault is being diagnosed and corrected.

Qualification notes

Qualification note — preserve margin above the mathematical minimum

A final water design should retain operating margin above the calculated minimum reserve because real consumption, sampling delay and recovery performance fluctuate. The acceptance review should therefore compare expected, degraded and worst-reasonable cases rather than approve a tank volume that works only when every assumption lands exactly on its nominal value. Margin is what converts a correct equation into an operable system.

Interactive beginner glossary

These terms are written to stand alone in a tooltip: a beginner should not need another technical dictionary to understand the first sentence.

• potable water — Water released for drinking and food preparation after the required sanitary checks have been satisfied.
• makeup water — New water added to replace the fraction lost from a recovery loop.
• gross demand — The total water passing through activities before recovery is subtracted.
• greywater — Wastewater from washing or similar uses that is less contaminated than toilet waste but still requires controlled treatment.
• sanitary stream — A water or wastewater flow whose contamination and health implications require defined handling rules.
• barrier — A treatment or physical control that blocks, removes or reduces a specified hazard.
• biofilm — A community of microorganisms attached to a wet surface and embedded in protective material they produce.
• dead leg — A poorly flushed branch or pocket of piping where water can remain stagnant.
• disinfectant residual — The measurable amount of active disinfectant remaining in water after dosing and reactions.
• cross-connection — A connection through which lower-quality fluid could reach a cleaner system.
• backflow — Reverse movement of fluid into a system from which it should remain separated.
• quarantine tank — Storage used to hold uncertain or out-of-specification water until a release decision is made.
• release criterion — A defined condition that must be satisfied before water is authorized for its intended use.
• sampling point — A designed location where a representative water sample can be collected.
• confirmatory test — A second measurement or method used to check an important initial result.
• throughput — The amount of fluid a process receives or treats during a stated time.
• peak flow — The highest relevant short-duration flow that equipment or storage must accommodate.
• residence time — How long water remains in a tank, pipe or process volume before leaving it.
• sanitation — Controlled cleaning and treatment intended to reduce contamination to an acceptable state.
• potabilization — The set of treatment and verification steps used to make water suitable for drinking.
• concentrate — The smaller stream in which salts or other contaminants become more concentrated after recovery.
• fouling — Performance loss caused by material accumulating on a membrane, surface, sensor or process component.
• buffer volume — Stored capacity that separates short-term generation or demand from process throughput.
• essential demand — The reduced water use that must still be supplied to protect health and critical operations during a degraded mode.
• quality class — A defined water category linked to the requirements of a particular use.
• trend monitoring — Repeated measurements used to detect gradual change rather than relying on a single result.
• isolation valve — A valve used to separate one branch or component from the rest of the fluid network.
• sanitary boundary — The physical and procedural separation that protects a clean water system from contamination.
• out of specification — A measured condition that falls outside the approved acceptance range.
• return to service — The controlled process of verifying a repaired or sanitized system before normal use resumes.

Operational review checklist

• Draw every normal and abnormal water stream, including temporary maintenance connections.
• State the required quality at each use point and the evidence that proves it.
• Keep gross throughput separate from makeup logistics in calculations.
• Verify peak treatment flow and buffer storage, not only daily averages.
• Provide a deliverable potable reserve that remains independent of the most credible treatment outage.
• Minimize dead legs and identify branches requiring periodic flushing or exercise.
• Control products placed into greywater so they remain compatible with downstream treatment.
• Define how urine concentrate and special laboratory effluent are isolated and stored.
• Use sampling locations that can bracket an incident boundary.
• Require independent confirmation when one measurement could trigger a major irreversible action.
• Protect potable equipment during maintenance with explicit cleanliness and post-work release steps.
• Design backflow prevention and connection hardware so quality classes cannot be casually mixed.
• Predefine degraded hygiene priorities that protect hand, food and clinical sanitation.
• Keep a response sequence for microbial events: protect, isolate, sample, diagnose, correct, verify.
• Recalculate reserve duration and processor margins whenever crew size or operating pattern changes.