Methods for risk analysis of drinking water systems from source to tap

Transcription

1 Techneau, June 2009 Methods for risk analysis of drinking water systems from source to tap - Guidance report on Risk Analysis

2 Techneau, June 2009 TECHNEAU 2009 TECHNEAU TECHNEAU is an Integrated Project Funded by the European Commission under the Sixth Framework Programme, Sustainable Development, Global Change and Ecosystems Thematic Priority Area (contractnumber ). All rights reserved. No part of this book may be reproduced, stored in a database or retrieval system, or published, in any form or in any way, electronically, mechanically, by print, photoprint, microfilm or any other means without prior written permission from the publisher

3 Colofon Title Methods for risk analysis of drinking water systems from source to tap - Guidance report on Risk Analysis Authors P. Hokstad 1, J. Røstum 1, S. Sklet 1, L. Rosén 2, T.J.R. Pettersson 2 ; A. Linde 2, S. Sturm 3, R. Beuken 4, D. Kirchner 6, C. Niewersch 6 1SINTEF 2Chalmers University of Technology 3TZW 5KWR 6RWTH Aachen Quality Assurance By LNEC and KWR Deliverable number D This report is: PU = Public 3

4 4

5 Contents Summary 7 1 Introduction Objective and scope Content of the report The TECHNEAU generic framework for risk management Definitions Abbreviations 15 2 Risk analysis of drinking water systems From source to tap Initiation and organisation of a complete risk analysis Relevant decision situations for water utilities System description Hazardous events Safety barriers Causes and consequences of hazardous events Risk estimation 23 3 Coarse risk analysis of water supply systems Identification of hazardous events Various approaches for hazard identification TECHNEAU Hazard Data Base (THDB) Risk estimation in Coarse Risk Analysis (CRA) Tool for Coarse Risk Analysis (CRA) 29 4 Quantification of risk The dimensions of risk and various ways to quantify risk Qualitative versus quantitative expressions for risk Risk measures for loss of water quality Risk measures for loss of water quantity (supply) Risk measured in monetary units 40 5 Data for risk analysis Introduction Data needs Data sources Types of data sources Failure event data bases 45 6 More advanced risk analysis methods for water supply systems Risk modelling and choice of a risk analysis method 47 5

6 6.2 HAZOP Failure Modes, Effects and Criticality Analysis (FMECA) Removal efficiency of the water treatment system Fault Tree Analysis (FTA) Reliability Block Diagram (RBD) Human Reliability Analysis (HRA) Markov Analysis Cause- effect relations - Bayesian Networks Event Tree Analysis (ETA) - analysing consequences Methods for estimation of risk to human health (QMRA and QCRA) Methods for risk analysis of water quantity (supply) GIS as a tool in risk analysis Introduction GIS in catchment risk management GIS Assisted Risk Analysis Description and application Main requirements Concluding comment 75 7 Summary of risk analysis methods 77 8 References 81 Appendix A: Main steps of a risk analysis 87 Appendix B. DALY and a generalisation 91 Appendix B.1. DALY An overall risk measure of health effects. 91 Appendix B.2. Generalisation of DALY. Combined measure for water quantity and quality. 93 Appendix C. Two examples of FTA 95 C.1 A Fault Tree Analysis of an UV system 95 C.2 Integrated risk analysis: Fault-tree analysis to investigate causes of failures 96 Appendix D. Procedure and example of FMECA 99 Appendix E. Analyses to establish treatment and monitoring system 107 Appendix F: Some fundamental reliability concepts 113 6

7 Summary This report is a deliverable of Work Area 4 (WA4) Risk Assessment and Risk Management in the TECHNEAU project. The main objective of WA4 is to integrate risk assessments of the separate parts in drinking water supplies into a comprehensive decision support framework for costefficient risk management in safe and sustainable drinking water supply. The present report gives an introduction into risk analysis methods for water supply, from source to tap. It describes which problems can be addressed by the various methods. The capabilities and restraints of the methods and typical results of the analyses are presented. This report is focussing on informing staff of water utilities on the available methods for risk analysis. The report will refer to the TECHNEAU Case studies and other literature to give details on the various risk analysis methods. It also refers to the TECHNEAU Hazard Data Base (THDB) and to the TECHNEAU report, Generic framework and method for integrated risk management in water safety plans. Various decision situations where use of risk analysis is relevant are presented, demonstrating typical objectives for carrying out risk analyses. There could for instance be a need of: An initial analysis, prior to the start up of water utility as a basis for design of the supply system; Cost/benefit considerations to identify the best risk reducing alternative; An analysis driven by identified problems related to water quality or water availability; An analysis imposed by rebuilding or operational changes of the utility. The main steps of a complete risk analysis are discussed: Scope / analysis objective System description Identification of hazards and hazardous events Estimation of risk (probabilities and consequences). Consequences with respect to both water quality and water quantity are considered. The report describes a Coarse Risk Analysis (CRA), being a total risk analysis, including hazard identification and risk estimation, with the results presented in a risk matrix. This is a relatively simple analysis, and could be carried out by most water utilities with some assistance from risk analysts. In Chapter 7 a summary of all risk analysis methods is presented. However, several of the other risk analysis methods will require deeper knowledge and experience with the risk analysis techniques, and should be carried out by professionals in close cooperation with water utility personnel. Several of these more complex analyses are described in the last part of the report. Possible objectives of these more advanced methods are described. It can for instance be to analyse 7

8 the causes of hazardous/undesired events, the consequences of these events, to assess the availability of water to various consumers (distribution network analysis), to analyse the effect of human errors on system reliability, and to perform maintenance optimisation, etc. The report discusses various ways to quantify relevant aspects of risk for water supply. The data needed to perform risk analyses are also described. This risk analysis report will not in any detail treat the risk acceptance and risk evaluation steps of risk assessment. 8

9 1 Introduction 1.1 Objective and scope The main objective of Work Area 4 (WA4) Risk Assessment and Risk Management in TECHNEAU is [1]: to integrate risk assessments of the separate parts into a comprehensive decision support framework for cost-efficient risk management in safe and sustainable drinking water supply. The goals in WA 4 are also to provide tools and guiding documents for water utilities carrying out risk assessment and risk management. A number of the tools are also tested in case studies and are disseminated through training seminars. A conceptual schematic of the framework, guidance reports (like this) and tools that is to be produced in WA 4 is presented in Figure 1 and the present guidance report is the Methods for Analysing Risk. Figure 1. A conceptual schematic of the framework, guides and tools that is produced in WA 4 with this report Methods for Analysing Risks put into the context. This report is based on the TECHNEAU report [2] Generic Framework and Methods for Risk Management in Water Safety Plans, where risk management is discussed, and also some risk analysis method are described. The present report provides a more complete overview of risk analyses methods for water utilities. The main target groups of the report are management and operational personnel of water utilities with some basic understanding of the main concepts of risk management. The present report aims at demonstrating the application of various risk analysis methods for water utility systems. Thus, it can serve as a guide to the management of a water utility regarding which analyses are most relevant in various decision situations. The report is intended to give insight into the capabilities, the use and potential results of the various methods for risk analysis. However, the report will not give all details of the various methods, as this would require a full text book, which is not the scope here. Thus, the water 9

10 utilities (at least the smaller ones) may need support from risk analysts/consultants in order to apply many of the methods described here. Within TECHNEAU we define the term water safety as Water supply that protects water availability and human health with a high degree of practical certainty that comprises both loss of water quality and water quantity, and the report covers both these aspects of risk. The report focuses on risk analysis, and will not go into any detail on risk evaluation and risk reduction and control, but will be presented in later reports. Risk evaluation has already been briefly discussed within WA4 [2]. Within WA4 six case studies are carried out at different water supply systems. In these case studies the applicability of various methods for RA is tested. The results of these case studies have been integrated into this report and are described more into detail in the various case study reports, notably: Bergen Coarse Risk Analysis (CRA), [65]. Göteborg Quantitative and probabilistic method based on a fault tree analysis, [31]. Amsterdam Network simulation model and Bayesian belief networks, [73]. Freiburg-Ebnet GIS (Geographic Information System) Assisted Risk Analysis (GARA-method), [63]. Březnice CRA and a Failure Modes and Effect Analysis (FMEA), [74]. Upper Nyameni CRA and the South African Risk Evaluation Guidelines, [75]. 1.2 Content of the report Figure 2 gives an overview of the various topics described in this report, (Section/Chapter no. in parenthesis). First some basic background information is given; (see top box in Figure 2): The TECHNEAU framework for risk management, showing that risk analysis is an integrated part of risk management, (Section 1.3). Definitions of risk analysis terms, (Section 1.4). Abbreviations used, (Section 1.5). Further, the main tasks of risk analysis (middle boxes in Figure 2): Chapter 2 gives an overview of the integrated approach to a complete risk analysis of a water utility. First some relevant decision situations for carrying out a risk analysis are given. The analysis will include description of the total system, identification of hazardous events and finally risk estimation. Chapter 4 describes various ways to quantify and measure 1 different risks to a water utility. Chapter 5 discusses data needed to carry out a risk analysis. In the lower box in Figure 2 various risk analyses methods are listed and described in the report. 1 In a risk analysis we may apply risk measures to quantify (express) the risk. Thus, here we are not referring to measurements. 10

11 First, Chapter 3 describes a complete coarse risk analysis (CRA), including both hazard identification and risk estimation. In the CRA this often restricts to a semi-quantitative risk estimate, giving probability and consequence categories. A CRA is often the first risk analysis to be carried out for a utility, and when a CRA has been carried out, the water utility should have a rough picture of the main risks. However, the need of more detailed analyses of critical events/subsystems can be identified. Figure 2. Overview of topics covered in the report (relevant Section/Chapter no. in parenthesis). In Chapter 6 we describe several of the more advanced risk analysis methods that could be relevant for a more detailed investigation of the risk related to a water utility. Thus, Chapter 6 can then be seen as a Part II of the report, advanced level of risk analysis, for readers that have some additional background in the risk and reliability concepts. Therefore, these more advanced risk analysis techniques will not directly apply to ordinary water utility personnel but for the interested reader. The advanced methods are, (illustrated in the lower part of Figure 2): 11

12 Hazard and operability (HAZOP) analysis, being a rather elaborate method for hazard identification, (Section 6.2). Failure Mode, Effects and Criticality Analysis (FMECA), a systematic way to identify and document the failure modes (and consequences of failure) of a specified system, (Section 6.3). Analysis of the efficiency of treatment systems, in order to identify proper method for water treatment applying FMECA, (Section 6.4). Fault Tree Analysis (FTA), a systematic approach to break down a failure event into its causes /contributors, (Section 6.5). Appendix C gives two examples of the use of FTA. Reliability Block diagram, gives very much the same information as a fault tree, but gives a different graphical presentation of the result, (Section 6.6). Human Reliability Analyses (HRA), various analyses to identify human errors and assess the consequences of these, (Section 6.7). Markov Analysis, a somewhat detailed analysis that can be carried out to analyse a system that can pass through various (performance) states. Can be relevant for maintenance analyses, (Section 6.8). Bayesian networks, a mathematical technique used to analyse dependencies between variables. It can be used for instance to assess the effect of factors influencing the risk, (Section 6.9). Event Tree Analysis, used to evaluate various outcomes (consequences) of an undesired (hazardous) event, (Section 6.10). QMRA/QCRA, analysis techniques to estimate the effects on human health of microbiological or chemical hazards, (Section 6.11). Distribution network analyses, methods to assess the performance of a distribution network. This type of analysis is mostly relevant for analysing water quantity, although in TECHNEAU (WA 5) research is executed on modelling water quality, (Section 6.12). GIS tools, allowing geographical representation and analysis of infrastructure assets and the tracking of associated hazards/risks, (Section 6.13). Note that a couple of these methods ( Treatment efficiency and GIS tools ) are usually not considered as risk analysis methods, but are included here as being important in risk analysis of water utilities. Conclusions, including an overview of the various risk analysis methods and the applicability of these methods, are given in Chapter 7. Finally note that an overview of the main steps of a risk analysis is presented in Appendix A; for each step giving references to the relevant sections of the report. 1.3 The TECHNEAU generic framework for risk management The risk management process is illustrated in Figure 3. This presents the TECHNEAU generic framework for integrated risk management, (see [2]), which includes the following main components: Risk Analysis In a risk analysis the various hazardous events related to the water utility are identified, and the corresponding risks are estimated. This is done by estimating e.g. 12

13 the frequency of hazardous events and various consequences of these events. Risk evaluation The risk evaluation requires that a risk acceptance/tolerability criterion is defined (by the water utility). The estimated risk is then compared with this acceptance criteria in order to decide whether the risk is acceptable (tolerable), see [2]. Further, various risk reduction options are considered to evaluate their cost-effectiveness. Risk control Risk reduction options have to be decided on and then implemented. In particular, risks above the acceptance criteria must be treated. Further, the risk is monitored during operation of the utility. (This activity will essentially to be treated in forthcoming report of TECHNEAU, WP4.3.) Risk Analysis Define Scope Identify Hazards Estimate Risks Qualitative Quantitative Risk Evaluation Define tolerability criteria Water quality Water quantity Analyse risk reduction options Ranking Cost-efficiency Cost-benefit Risk Reduction/ Control Make decisions Treat risks Monitor Get new information Update Analyse sensitivity Develop supporting programmes Document and assure quality Report and communicate Review, approve and audit Figure 3. The main components of the TECHNEAU generic framework for integrated risk management in WSP [2]. The first component of this framework, risk analysis (the scope of this report), includes the following three steps: 1. Definition of scope of risk analysis A complete risk analysis will start by defining the scope of the analysis, (see Section 2.2 below). For a water utility the objective of the analysis could be related to one or more of the following topics: Water quality, Water quantity (and availability), Economy, 13

14 Environmental impact, Consumer trust. The present report focuses on water quality and water quantity. System definition/description and limitations of analysis are also given in this initial step. Further, an appropriate team need to be assembled according to the scope of the analysis. 2. Hazard identification The next step is the identification of all hazards and hazardous events. A hazard is usually given as a source of potential harm, (e.g. the existence of a farming or industrial activity in the catchment area). A hazardous event is an event which can cause harm, (e.g. the existence of hazardous agents in the drinking water source). Various methods exist for identifying hazards and hazardous events, e.g. checklists [20], experience from the past and expert judgements. 3 Risk estimation A lot of methods exist for modelling and estimating the various risks to a water utility. A proper method need to be selected with respect to the specific scope of the risk analysis. Important considerations are if qualitative, semi-quantitative or quantitative measures of risk are needed and if the risk analysis comprises the complete water utility or some subsystem(s) of it. Various activities are required in order to carry out a risk analysis, risk evaluation and risk control. These are indicated in the rightmost box of Figure Definitions The following definitions of terms are applied in the TECHNEAU project, cf. [2]: Hazard is a source of potential harm or a situation with a potential of harm. Hazardous agent is for example a biological, chemical, physical or radiological agent that has the potential to cause harm. Hazardous event is an event which can trigger a hazard and cause harm. Hazard identification is the process of recognizing that a hazard exists and defining its characteristics. Risk is a combination of the frequency, or probability 2, of occurrence and the consequences of a specified hazardous event. Risk analysis is the systematic use of available information to identify hazards and to estimate the risk to individuals or populations, property or the environment. Risk estimation is the process used to produce a measure of the level of risk being analysed. Risk estimation consists of the following steps; frequency analysis, consequence analysis, and their integration. Risk evaluation is the process in which judgements are made on the tolerability of the risk on the basis of risk analysis and taking into account factors such as socioeconomic and environmental aspects. 2 When we give the mean number of events during a fixed period of time (e.g. per year), we talk about a frequency, f. For instance, f = 3/year. We can also give the probability that the event will occur during one year. The probability, p, is dimensionless and is always a number between 0 and 1. For instance p = 0.1 means that on the average the event will occur in one out of 10 years, (and frequency, f = 0.1/ year.) Likelihood can be used as a common word for probability and frequency. 14

15 Risk assessment is the overall process of risk analysis and risk evaluation. Risk management is the systematic application of management policies, procedures and practices to the tasks of analysing, evaluating and controlling risk. Water safety is defined (within TECHNEAU) as: Water supply that protects water availability and human health with a high degree of practical certainty. 1.5 Abbreviations ALARP - As Low As Reasonable Practicable BN - Bayesian Network CCP - Critical Control Points CML - Customer Minutes Lost CRA - Coarse Risk Analysis DALY - Disability Adjusted Life Years ETA - Event Tree Analysis FTA - Fault Tree Analysis FMEA - Failure Modes and Effect Analysis FMECA - Failure Modes, Effects and Criticality Analysis GARA - GIS Assisted Risk Analysis GIS - Geographic Information System HACCP - Hazard Analysis and Critical Control points HAZID - Hazard Identification HAZOP - Hazard and Operability analysis HCI - Hydraulic Criticality Index HIA - Health Impact Assessment HRA - Human Reliability Assessment MTTF - Mean Time To Failure MTTR - Mean Time To Repair PFD - Probability of Failure on Demand PHA - Preliminary Hazard Analysis PSF - Performance Shaping Factors QCRA - Quantitative Chemical Risk Assessment QMRA - Quantitative Microbiological Risk Assessment RBD - Reliability Block Diagram ROS - Risk and Vulnerability Analysis (ROS is the Norwegian abbreviation) RPN - Risk Priority Number SSM - Substandard Supply Minutes THDB - TECHNEAU Hazard Database WHO - World Health Organisation WSP - Water Safety Plans WSS - Water Supply Structure YLD - Years Lived with Disability YLL - Years of Life Lost YLQ - Years of Life with water supply of bad Quality YLS - Years of Life without water Supply 15

16 16

17 2 Risk analysis of drinking water systems From source to tap This chapter describes the overall structure and main elements of the risk analysis process, including the motivation for carrying out a risk analysis. The process is described in detail in Appendix A (also briefly described in Section 1.3) and includes the following main steps: 1. Scope definition, including study initiation/organisation, system description and assembling a team. 2. The identification of hazardous events. 3. The risk estimation. Some details of the process are given below. Further, Appendix A presents a summary of the various steps of the risk analysis. 2.1 Initiation and organisation of a complete risk analysis A risk analysis should be initiated by a general objective on how to reduce the risk for the public or the water utility. Further, a clear scope of the specific analysis should always be formulated (e.g. see [4]). When assembling the risk (analysis) team relevant stakeholders are to be identified, e.g. water utility owners, safety managers, consumers, municipalities, health authorities. These decide whether any restrictions should be imposed on the work; for instance whether only a subsystem of the utility should be considered, or whether to include only specific types of hazardous events or risk reduction options. Critical stakeholders, for example, hospitals, kindergartens, and schools, have to be identified and given special attention during the analysis. As discussed below, in Section 2.2, the risk analysis could be initiated by making an overview of the overall risk situation within the supply system for the specific decision situations. If the water utility is in a decision situation it should consider the questions: What is the problem? What are the alternatives? Who is affected by the decision? Who is making the decision? (For whom shall we carry out the analysis?) Which aspects are considered when making the decision? What are the wishes and priorities of the various stakeholders? When risk analyses are utilised as decision support there are several ways to express (quantify) the various aspects of the risk. So if there are various benefits and losses (potential consequences) involved, the comparison of these benefits/losses may represent (ethical) problems, which must be handled by decision makers. One typical difficulty is how to give value to human life. 17

18 Further, an analysis team must be selected; e.g. it must be decided who shall participate in the analysis work: risk analyst(s), various experts and generalists. The team should consist of water works experts (operators, planners, laboratory personnel etc.), and some outside specialists (e.g. researchers, consultants etc.) that may introduce new perspectives in the risk analysis process. The working process must also be organised in a combination of meetings (with information gathering and evaluation) and analysis work. Thus the initial part of the analysis process is to organise and make a plan for the work. In this respect it is important to stress the importance of having commitment from all professional categories of the water company in order to achieve real risk reductions as a result of the work. 2.2 Relevant decision situations for water utilities The scope of a risk analysis should describe the purpose of the analysis and the problems that initiated it. Below we list some typical decision situations for water companies, which could initiate risk analyses work. Practical examples on this are included. Initial risk analyses, required prior to the start up of a plant/water utility, (or modifications, such as rebuilding or operational changes).. Drinking water supply is subjected to many different risks and it is important to focus the risk control to the most important areas. Relevant objectives to initiate a risk analysis could simply be a need to: o o o Identify and rank all hazards (in order to control risk); Estimate the risk to identify any need of additional Critical Control Points, (CCP); Evaluate cost/benefit of risk reduction options to achieve an acceptable risk. Examples of typical (specific) questions that could launch a risk analysis exercise could be: o o Which out of all chemicals and microbial substances are most critical to health aspects for drinking water consumers? How do we compare the risks of shipping petroleum products on the raw water source with cattle grazing next to it? Analyses carried out to optimise operational maintenance and emergency procedures. The protection against water-borne diseases by implementing new barriers in the plant may be a long-term action for many water utilities, and it may take some years before the required barrier function is implemented. So, in the meantime: o o How can the protection be improved by optimizing the present treatment? Which risks can be reduced by process optimization? How important are periods with suboptimal performance? Analyses initiated by specific operational problem. The water utility may have a deviation reporting system that gives support to the handling of specific problems. Such a system gives information on the acute actions. It is also designed to sort out the need for improvements in order to avoid similar events or to reduce the consequences of them. For instance, it has been experienced that 18

19 deviations related to a very rainy autumn can include simultaneous pollution in the main raw water source and the back-up water source. This can be combined with humic contents in the raw water reservoir and inadequate sludge removal in the treatment. So, relevant questions are: o o What is the likelihood of such combinations in the future? How can they be detected and avoided, or how can the consequences be reduced? More generally, risk analyses could be initiated by problems like: o o o o Delivered water is observed not to comply with required quality standards (e.g. unacceptable level of some bacteria) Reduced availability of water delivery observed (to some group of users) Observed security problems Occurrence of an unwanted event (accident investigation) Analyses to update initial risk analyses, in order to include possible new hazards. For instance, a water treatment plan could be designed for having a multi-barrier protection, while according to new knowledge formerly unknown microbial agents are pointed out as an important hazard. For instance the parasitic protozoa Cryptosporidium was not described until 1970s as infecting humans [8], and not recognized until 1984 as a waterborne infection. The recognition of new hazards can result in new risk reduction options as e.g. improved barriers against Cryptosporidium. So relevant questions to initiate further analyses could be: o o o Are the barriers in the water treatment plant sufficient for emerging microbial contamination? Does the raw water contain micro-organisms that can harm human health? How will present treatment meet to the predicted climate change? Analysis to obtain acceptable risk with respect to supply, (major delivery failures). Water utilities may have acceptance levels for interruption of supply that take into consideration number of consumers without water and time without water. The risk of limited delivery failures can be calculated from statistical data, but little information is available of the larger failures. Relevant problems: o o Is it raw water, treatment or distribution system, or a combination of these, which is the limiting factor to achieve acceptable risk? Where are the bottlenecks? It is observed that the above questions could be related to various life cycle phases, (e.g. design or operational phase), and the questions can be related both to strategic and operational decisions. 2.3 System description One of the first tasks is to provide a system description, and also describing the functions of the various subsystems. Each water supply system is unique and a description of the 19

20 system is therefore an important part of a risk analysis. The description should include both illustrations (drawings) and written text. Important documents are rules and regulations, standards, maps, statistics, operating procedures, drawings, etc. The system descriptions should include detailed knowledge of the following three subsystems (in case the total system is analysed): 1. Water source (groundwater and/or surface water) and the catchment area. 2. Water treatment systems and monitoring systems. 3. Distribution network, including plumbing system and consumers. As an example Figure 4 is an illustration of a water supply system from source to tap carried out according to the WSP guidance. An important aspect is that the risk analysts shall get familiarised with the analysis object. Source water Treatment Distribution Tank WTP 1 Reservoir WTP 2 Reservoir Reservoir Figure 4. Illustration of system flowchart, from source to tap. The system description should include a description of the system boundaries, the technical systems, operational conditions and the environment. For an identification of hazardous events it is also important to point out important support systems, which the water utility is depending on for successful operation, (e.g. power supply, supply of chemicals, ITsystems, training and employment of personnel). Some generic information is also seen as a part of the system description, such as the total number of consumers linked to the distribution system and their consumption demand. The system description illustrates a normal operational situation, after the treatment process and control points have been decided. So specification of this normal operational situation is an important part of the system description. In particular, it is specified which concentrations of various contaminants that the treatment system is designed to handle. Many risk analysis methods require some structured way to breakdown the system in manageable parts. A common way to break down a system in an analysis is a hierarchical model which reflects how the system is designed. The system should be broken down into suitable subsystems that can be handled effectively in an analysis (i.e. splitting Figure 4 into subsystems like source, treatment, distribution ). Each subsystem can further be broken down into modules, and each module into components etc. 20

21 2.4 Hazardous events Step 2 (on page 15) of the risk analysis is to identify hazardous events, in the various parts of the system. A hazardous event is an event which can cause harm. In principle all types of unwanted events should be included. Identification of hazardous events is described in detail in the TECHNEAU Hazard Database (THDB) [20]. Following groups of hazards are normally considered: Biological Chemical Radiological or physical Unavailability (insufficient availability of water supply to consumers) Safety (safety to personnel) External damage (external damage to third parties, incl. liability) A typical example of a hazardous event is the presence of a contamination (hazard) in the source of a drinking water supply system. The Microrisk project 3, (for additional information see [5]), refers to the following types of hazardous events from a microbiological point of view: 1. Primary faecal contamination: Events that cause significant contamination of the source water, with microbial levels much above normal levels, (which should in principle be handled by the existing treatment system), and events that result in a biological/chemical agents entering the drinking water source; which the existing treatment system is not designed to handle. 2. Water treatment is malfunctioning: Treatment system having reduced ability to handle normal contamination or to detect contamination above normal levels. 3. Secondary faecal contamination, i.e. faecal contaminations that are not originating from the source water, (e.g. wastewater intrusion due to cross-connections or backflow). In TECHNEAU we add the following type of hazardous events: 4. Events causing insufficient water supply to consumers. Note that if the objective of the analysis is to assess the total risk caused by all identified hazardous events, there could be a risk of counting hazardous events twice. For instance, failure of the treatment system to handle/detect Giardia is one hazardous event. The presence of Giardia in the water source is another. However, it is not necessarily correct not to add the frequencies of these events to achieve the total risk, because both events must occur at the same time in order for the drinking water to be contaminated. In this case, it is suggested to start from the above four categories of events, to avoid such double counting. 3 The EU project Microrisk (contract EVK1-CT ), see resulted in a number on reports on QMRA, see QMRA was applied to 12 systems across Europe and Australia. 21

22 Different approaches for identifying hazardous events are discussed in Section Safety barriers Causes and consequences of hazardous events When hazardous events are identified we may want to analyse both causes and possible consequences. The so-called Bow-Tie diagram can be used to illustrate this, see the example in Figure 5, with the hazardous event Giardia in water source. The chain of events goes from left to right with the causes (and hazards) on the left, the hazardous event in the middle and the consequences on the right. In Figure 5 also some safety barriers are introduced, which are implemented to reduce the risk. In the left part of the bow-tie diagram we have barriers (1, 2, 3) that prevent the hazardous event to occur or mitigate the hazardous event; to the right we see barriers (4, 5) for preventing or reducing unwanted consequences; (e.g. people being infected by contaminated water). In general safety barriers can either: Figure 5. Bow-Tie diagram and barriers. A practical example. prevent the undesired event to occur (reduce probability), e.g. by introducing restrictions on the use of the catchment area, or reduce the consequences by water treatment systems; thus preventing contaminated water to be delivered to consumer. So introducing a barrier actually means implementing a risk reducing option. Figure 6 illustrates the concept of hygienic (safety) barriers in a water supply system considering all elements from source to tap, see also the Bergen Case study [65]. 22

23 Figure 6. Illustration hygienic barriers in a water supply system from source to tap (modification of a figure taken from: SA Water - Drinking water quality report ). 2.6 Risk estimation The risk estimation can be carried out at various levels of detail. An analysis of the hazardous events should include estimation of likelihood (probability) and consequence. Often a semi-quantitative approach is chosen, just giving categories of likelihood and consequence. The combined likelihood-consequence categories could then be inserted in a risk matrix, see example of risk matrix in Figure 7. As an example we here indicate corresponding risk values ranking from 1 (likelihood = rare; consequence = insignificant) to 9 (likelihood = almost certain; consequence = catastrophic). This is just an example on how to rank the risks related to the various hazardous events. The categories (e.g. catastrophic ) can be defined in various ways (see Figure 11). Severity of consequences Likelihood Insignificant Minor Moderate Major Catastrophic Almost certain Likely Moderately likely Unlikely Rare Figure 7. An example of a Risk matrix. One should make a separate risk matrix for loss of quality, and another for loss of quantity, (and possibly one for e.g. economic losses). Performing the risk estimation one should note the possible links between poor water quality and reduced water quantity. Water quality problems can occur due to low pressure, as a result of a pipe burst (water quantity problem). Further, a drought (quantity problem), will often also result in a decrease of water quality. 23

24 In more advanced analyses risk can be fully quantified, see Chapter 6. Often the input data to these quantifications are rather uncertain, and the results involve considerable uncertainty. Then it is recommended to carry out a sensitivity analysis; i.e. calculating risk with various input values to demonstrate the range of probable results. 24

25 3 Coarse risk analysis of water supply systems The Coarse Risk Analysis (CRA) is a method for semi-quantitative risk analysis. The scope of an overall CRA including risk evaluation and risk control - typically consists of (see [18, 21, 22]): 1. Identify hazardous events related either to the total water supply system, or to a specific part (or in general to some category of undesired events). (Section 3.1) 2. Risk estimation, i.e. estimate the probability and consequence for each hazardous event. (Section 3.2) 3. Present these risks in risk matrices, and possibly compare to risk acceptance criteria. 4. Rank the hazardous events with respect to their risk. 5. Assess the need for risk reduction options or more detailed analyses. The first two steps relate to risk analysis, and in this chapter we first give a description of the hazard identification of an overall CRA (Section 3.1). Next, the risk estimation in a CRA is discussed (Section 3.2). Finally an example is given (Section 3.3). 3.1 Identification of hazardous events There are various approaches for the identification of hazardous events, e.g. using; Brainstorming, experience from the past, checklists (Section 3.1.1). Checklists may be databases, such as the TECHNEAU Hazard database (THDB, Section 3.1.2). HAZOP is another commonly used method (Section 6.2). A general discussion is given first; then THDB is shortly described Various approaches for hazard identification There are various techniques for identification of hazards or hazardous events within a system. Hazard Identification (HAZID) is a collective term often used for such techniques. A brief description of some of the methods is presented in this section. The descriptions are primarily based on [18] and [19]. Brainstorming is a main method of problem solving or idea generation in which members of a group contribute ideas spontaneously. In this case, the task is to identify hazards or hazardous events in a water supply system. What-if analysis is a specific and effective brainstorming approach [2]. Use of experience from the past, i.e. accident and reliability data, may also be used to identify potential problem areas and provide input into frequency analysis (probability estimation). Experience from the past is often used as input to the methods described in this chapter. A traditional checklist comprises a list of specific items to identify known types of hazards and potential accidents scenarios associated to a system. Checklists may vary widely in level of detail. Checklists are limited by their author s knowledge and experience and should be viewed as living documents, reviewed regularly and updated when necessary. 25

26 Experience from the past could be experience from the actual (or similar) water utility, provided by operational personnel of these utilities. One could then go through the total system and record operational problems and concerns that are experienced. This method is rather similar to the brainstorming session. One could also utilise statistics and data on events that have been recorded in various data sources, cf. Chapter 5. A checklist is easy to use and is a cost-effective way to identify common and customarily recognized hazards. Checklists can be applied at any stage of the life-cycle of a water supply system and can be used to evaluate conformance with codes and standards. The TECHNEAU Hazard Database, [20] presents a comprehensive list of hazards and hazardous events that can serve as a checklist for water utilities, see below. A list of generic hazardous events can be formulated by considering characteristics such as [18]: Materials used or produced and their reactivity Equipment employed Operating environment Layout Interfaces among system components, etc. Based on the general hazardous events identified, a more specific list may be described for the various parts of the system. A form, shown in Table 1, may be used for doing this. Table 1. Specific list of hazardous events. Hazardous event Cause Vulnerable locality Possible effects: Tanker containing 20 m³ of - Sudden illness of Intersection XX gasoline tips over near tank driver intersection XX, polluting the - Slippery water source near by the conditions inlets TECHNEAU Hazard Data Base (THDB) The THDB, [20], applies a holistic view on hazard identification within the water supply system and provides a list of hazards and hazardous events for each element in the water system. The hazards identified in the THDB are both internal and external. Internal hazards are mostly related to functional failures or the absence of infrastructure. External hazards are for instance source water contamination, degradation of mains due to aggressive soils or terrorist actions. The objective of the database is to help water supply utilities with the identification of relevant hazards by providing a catalogue with potential hazards of technical, geographical or human origin for the whole part of the system. The database has a generic set-up. It does not cover all possible specific operational hazards, but should be regarded as a checklist to assess possible risks of the supply system. 26

27 The water supply system is subdivided into 12 sub-systems, of which 10 are physical subsystems representing the infrastructure, one is a non-physical sub-system representing organizational aspects and one is a sub-system representing future hazards. The hazard database is presenting the identified hazards in a table at the subsystem level. The tables are divided into components and elements. At component level the most important elements are given, and for each element the most relevant hazards are given in combination with a description of the cause of the hazard, the hazard type and the consequences. The THDB focuses on both water quality and water quantity. The hazard database uses the definitions given in Table 2. Examples of hazardous events from the THDB are shown in Table 3. Table 2. Definitions applied in the TECHNEAU database (THDB), [20]. Element: Hazard: Ref.: Hazardous event: Type of hazardous event: Type of hazard: Consequence description: Consequence to sub-system: Rel. system: Lowest level of the system at which hazards are described. A source of potential harm or a situation with a potential of harm (e.g. a biological, chemical, physical or radiological agent or undesired event that has the potential to have a negative effect on the supply of safe and sufficient water). Reference number (id.) of the hazard. An event which can cause harm (e.g. an incident or situation that can lead to the presence of a hazard, what can happen and how). Indication of the origin of the hazardous event. - D: design-related - O: operation-related - E: external-related - OS: consequence of a hazard in other sub-system - Ref. OS: Reference of other sub-system Indication of the type of hazard. - Biolog.: biological - Chemic.: chemical - Rad./phys.: radiological or physical (including turbidity) - Unavail.: insufficient availability of water supplied to consumers - Safety: safety to personnel - External damage: external damage to third parties, including liability Description of potential consequences of the hazard to other sub-systems and to consumers. Reference of the sub-system affected by the hazard. Column to be used by the end-user for marking the identified hazards. 27

28 Table 3. Examples of hazardous events in the TECHNEAU hazard database (THDB) [20]. System Source/ Catchment Water treatment plant Distribution and plumbing Examples of hazardous events from the THDB (hazard id. in brackets) - Industrial discharges of chemicals. (1.1.1) - Industrial discharge of biological matter. (1.1.2) - Emissions during accidents (fire or explosions) e.g. industrial accidents or forest fire. (1.1.3) - Improper coagulant mixing and/or flocculation; inappropriate flocculant or flocculation agent; improper ph control. (6.4.3) - Decrease of UV lamp performance due to ageing or colour sediments on quartz tube. Electrical disruptions. (6.6.7) - Poor hygiene during repair. (8.1.2) - Malfunctioning valves, connections to different water qualities (industrial water, sewers). (8.1.14) 3.2 Risk estimation in Coarse Risk Analysis (CRA) It is a rather common situation that a water utility wants to have a coarse overview of the main risks for its activities, in order to identify the most serious threats and then to make the right priorities with respect to implementing risk reduction options. In such a situation water utilities can carry out a Coarse Risk Analysis (CRA); this method is similar to the Preliminary Hazard Analysis (PHA). In Norway this type of analysis is commonly applied, and is referred to as a ROS (Risk and Vulnerability) analyses. These analyses are often carried out early in the development of a utility, or in the launching of a WSP implementation in an existing system. Then there is little information on design details and operating procedures, and the analysis can be a precursor to further studies. However, they are also used for analysing existing systems, or specific subsystem. The CRA can also be used to prepare emergency preparedness plans for the water supply companies. The main objective of the CRA is to identify hazardous events (as described above), the causes of the event, and to make a coarse evaluation of likelihoods (probabilities) and consequences of these events. The results are normally displayed in a list of hazardous events (in a worksheet form). Several variations of this form are used. One example of a worksheet used to document the results of the analysis are shown in Table 4. Each hazardous event identified is inserted in the list and analysed. As an example we have taken the hazardous event in the THDB, [20]. The risk estimation in a CRA usually restricts to presenting categories of probability and consequence. The probability categories are denoted e.g. P1 P4, and similarly consequence categories, C1-C4; cf. Table 4. These pairs of values are later inserted in the appropriate cell of the risk matrix. Note that the consequences can be evaluated with respect to several dimensions ; e. g. water quality, water quantity (supply) or reputation/economic loss. 28

29 Table 4. Example of a CRA- worksheet. System: Treatment Operating mode: Normal operation Analyst: NN Date: Ref. Hazard Hazardous event Causes Probability Consequence Preventive actions Comments Pathogen in water source Too low UV dose Ageing or colour sediments on quartz tube P2 1) C2 2) Online measurement of UV intensity to verify correct intensity 1) Probability category 2) Consequence category According to the resulting risk-score of the various hazardous events in the risk matrix, the most serious hazardous events are identified. Risk reduction options to prevent the hazardous event or to neutralize its consequences are identified. The needed efforts (in terms of costs, time, organization, training, etc.) and the reduction of risk of the various risk reduction options are roughly evaluated. Finally a priority list for risk reduction options (with deadlines) is formulated. In summary, a CRA is a rather simple semi-quantitative risk analysis method. However, the CRA requires good information and knowledge about the system including surroundings. Hazard identification is usually based on some kind of expert judgement, e.g. using experience from the past, check lists, or a combination of these. If statistics about hazards are not available the CRA will rely on expert judgements to estimate the risk and define appropriate risk reduction options. No detailed modelling and calculations are needed, and the analysis may be carried out by professionals with good system knowledge, but is not requiring computational skills. Normally a CRA is not very time consuming. However, this depends on the size and complexity of the system to be analysed. Note that the CRA does not provide a score of the total risk of the water utility. The main focus is on identifying major hazardous events, and then ranking these with respect to their contribution to risk. 3.3 Tool for Coarse Risk Analysis (CRA) A tool for carrying out a coarse risk analysis was developed. The tool is applicable for small, medium and large water companies. The tools itself is also an aid for organizing the data generated as a part of the coarse risk analysis. The structure of the tool is a database which enhances future updating of the tool. The userinterface for carrying out the analysis is shown in Figure 8. By clicking on the acronym of a potential hazardous event the corresponding risk registering dialog box for the relevant hazardous event appears, as shown in this figure. The various fields of the interface are explained in Table 5. 29