Predicting risk of water quality failures in distribution networks under uncertainties using fault-tree analysis

Download Predicting risk of water quality failures in distribution networks under uncertainties using fault-tree analysis

Post on 08-Dec-2016

214 views

Category:

Documents

2 download

TRANSCRIPT

  • This article was downloaded by: [Brandon University GST]On: 12 April 2013, At: 13:00Publisher: Taylor & FrancisInforma Ltd Registered in England and Wales Registered Number: 1072954 Registered office: Mortimer House,37-41 Mortimer Street, London W1T 3JH, UK

    Urban Water JournalPublication details, including instructions for authors and subscription information:http://www.tandfonline.com/loi/nurw20

    Predicting risk of water quality failures in distributionnetworks under uncertainties using fault-tree analysisR. Sadiq a , E. Saint-Martin a & Y. Kleiner ba Institute for Research in Construction of National Research Council (NRC-IRC), Ottawa,ON, Canadab Civil Engineering Determent, University of Ottawa, ON, CanadaVersion of record first published: 19 Nov 2008.

    To cite this article: R. Sadiq , E. Saint-Martin & Y. Kleiner (2008): Predicting risk of water quality failures in distributionnetworks under uncertainties using fault-tree analysis, Urban Water Journal, 5:4, 287-304

    To link to this article: http://dx.doi.org/10.1080/15730620802213504

    PLEASE SCROLL DOWN FOR ARTICLE

    Full terms and conditions of use: http://www.tandfonline.com/page/terms-and-conditions

    This article may be used for research, teaching, and private study purposes. Any substantial or systematicreproduction, redistribution, reselling, loan, sub-licensing, systematic supply, or distribution in any form toanyone is expressly forbidden.

    The publisher does not give any warranty express or implied or make any representation that the contentswill be complete or accurate or up to date. The accuracy of any instructions, formulae, and drug doses shouldbe independently verified with primary sources. The publisher shall not be liable for any loss, actions, claims,proceedings, demand, or costs or damages whatsoever or howsoever caused arising directly or indirectly inconnection with or arising out of the use of this material.

  • RESEARCH ARTICLE

    Predicting risk of water quality failures in distribution networks under uncertainties using fault-treeanalysis

    R. Sadiqa*, E. Saint-Martina and Y. Kleinerb

    aInstitute for Research in Construction of National Research Council (NRC-IRC), Ottawa, ON, Canada; bCivil EngineeringDeterment, University of Ottawa, ON, Canada

    (Received 5 November 2007; nal version received 17 May 2008)

    The water quality in a distribution system is aected by many factors, including operational and environmentalconditions as well as the condition in and around the distribution network. Lack of reliable data as well asknowledge gaps with respect to the impact of these factors on water quality make the quantication of water qualityfailure risk very challenging. Furthermore, the variability inherent in (sometimes) thousands of kilometers ofdistribution pipes presents added complexities. Major modes of water quality failures can be classied into intrusionof contaminants, regrowth of bacteria (biolm), water treatment breakthrough, leaching of chemicals or corrosionproducts from system components, and permeation of organic compounds through plastic pipes. Deliberatecontamination and negligence of operators have in recent years become an added concern. In earlier works by Sadiqet al. (2004, 2007), an aggregative risk analysis approach using hierarchical structure was proposed to describe allpossible mechanisms of contamination. In this paper a similar structure is used as a basis for a fault-tree approach.While fault-tree analysis is widely used for many engineering applications, in this paper we specically explore howinterdependencies among factors might impact analysis results. Two types of uncertainties are considered in theproposed analysis. The rst is related to the likelihood of risk events, and the second is related to non-lineardependencies among risk events. Each basic risk event (input factor) is dened using a fuzzy probability (likelihood)to deal with its inherent uncertainty. The dependencies among risk events are explored using Frank copula andFrechets limit. The proposed approach is demonstrated using two well-documented episodes of water qualityfailures in Canada, namely, Walkerton (ON) and North Battleford (SK).

    Keywords: distribution networks; fault-tree analysis; risk events; water quality failure; fuzzy probability; Frankcopula; Walkerton; North Battleford

    1. Introduction

    Water quality can be dened by a collection of upperand lower limits on selected performance indicators(Maier 1999). Therefore, a water quality failure(WQF) refers to an exceedance of one or more waterquality indicators from specic regulations, or in theabsence of regulations, exceedance of guidelines orself-imposed limits driven by customer service needs(Sadiq et al. 2004). Current and anticipated waterquality regulations in Canada and the United Statesaim to minimize the impact of WQF in distributionsystems. These regulations require utilities continuallyto upgrade and rehabilitate their distribution net-works, water treatment processes and technologies,and to improve operations and/ or change source-waters.

    The Bonn Charter of Safe Drinking Water (2004)discusses a generic framework for the eective

    management of water quality from source to tap thatcan be linked to World Health Organization (WHO)guidelines for drinking water. It emphasises the needfor proactive risk-based management of drinking watersupplies. The main feature of the Charter is not only theend-of-pipe verication (regular water quality monitor-ing) implementation of management control systemsthroughout the system to assess risks at all points.

    The quantication of risk of WQF in waterdistribution systems is a dicult task. Water distribu-tion systems comprise many (sometimes thousands) ofkilometers of pipes of dierent ages and variousmaterials. Operational and environmental conditionsare highly variable both temporally and spatially.Further, as pipes are mostly buried, limited data areavailable on their condition. Finally, some of thefailure processes are not well understood and forensicinvestigation of contamination is very dicult becausethere is generally a time lag between the time of failure

    *Corresponding author. Email: rehan.sadiq@nrc-cnrc.gc.ca

    Urban Water Journal

    Vol. 5, No. 4, December 2008, 287304

    ISSN 1573-062X print/ISSN 1744-9006 online

    2008 Government of CanadaDOI: 10.1080/15730620802213504

    http://www.informaworld.com

    Dow

    nloa

    ded

    by [B

    rando

    n Univ

    ersity

    GST

    ] at 1

    3:00 1

    2 Apr

    il 201

    3

  • and the time at which the consequences (e.g. out-breaks) are observed.

    Fault tree analysis is a commonly used tool todetermine the cause(s) of system failure. The fault treeis constructed as a tree of sub-events, spreading intobottom events, procreating the fault and nally headingto the top [or main] event (Ming-Hung et al. 2006). Afault tree is a graphical representation of an eventstructure that clearly envisions the entire system andeach level of each event within it. This structureenables one to identify particular sub-events that havea high impact on the main event.

    The dierence between a general hierarchical modeland a fault tree is that while the former simply displaythe order of events that lead to the main failure event(and aggregates them using any appropriate weightingscheme), the latter denes logical relationships (andand or) between sub-events. Traditional fault treeanalysis requires the assignment of crisp probabilitiesbetween events and the assumption of independencebetween risk events. These two requirements carryinherent shortcomings. Firstly, one rarely knowsprecise probabilities of causal relationships betweenevents, and secondly, the required assumption ofindependence is often unrealistic.

    Recently, Li (2007) proposed an object-orientedapproach for water supply systems based on aggregativerisk assessment (similar to Sadiq et al. 2004) and fuzzyfault tree analysis. Li (2007) used fuzzy evidentialreasoning method to determine the risk levels associatedwith components, subsystems, and the overall watersupply system. Fuzzy sets theory was used to evaluatethe likelihood, severity, and risk levels associated witheach hazard and Dempster-Shafer theory was used toaggregate the risk levels of multiple hazards throughoutthe hierarchical tree. Fuzzy fault tree analysis was usedto evaluate the likelihood of the occurrence for aspecic event in a water supply system. The dependen-cies in fault tree analysis were also studied using adependency factor similar to linear correlation.

    The objective of this paper is to propose a genericfault tree approach to evaluate risk of WQF in adistribution network. The hierarchical structure offactors contributing to failure, presented in earlierwork by Sadiq et al. (2004, 2007) is extended for theproposed fault tree structure. Further, the shortcom-ings discussed earlier, namely false precision inprobability assignments and unrealistic independenceassumptions, are addressed. Probabilities of basic riskevents are dened linguistically using fuzzy numbers,and nonlinear interdependencies are handled usingFrank copula (for known correlation) and Frechetslimit (for unknown correlation) (Ferson et al. 2004).The proposed fault tree is applied to two case studiesto demonstrate the applicability of the approach.

    2. Water quality failures in distribution systems

    The safety of drinking water is the supreme priority ofwater utilities. A typical modern water supply systemcomprises the water source (aquifer or surface watersource including the catchment basin), transmissionmains, treatment plant and distribution network, whichincludes pipes and distribution tanks. While waterquality can be compromised at any point in the system,failure at the distribution level can be critical because itis closest to the point of use and, with the exception of altering device at the consumer level there are virtuallyno safety barriers before consumption.

    The WHO has reported that infectious water bornediseases are the worlds single largest source of humanmortality. Although developed countries have a highercapability of controlling waterborne pathogens, waterquality episodes still occur in North America andEurope (Edge et al. 2003). While biological agents arethe most common source of major WQF, chemicalscan also adversely aect drinking water quality. Thesechemicals can be categorised as organic and inorganic.Inorganic chemicals include arsenic, lead, and nitrate,to name a few. Organic chemicals such as PAH(polynuclear aromatic hydrocarbon) and variousDBPs (disinfection byproducts) can cause anaemia,decreased level of blood platelets and organic chemi-cals such as DBPs have a potential to increase cancerrisk and miscarriages (AWWA 2007).

    2.1. Water quality deterioration mechanisms

    WQFs compromising either the safety or the aestheticsof water can occur as a result of various mechanismsand pathways throughout the distribution network.Contamination in distribution networks can generallybe classied into the following major categories(Kleiner 1998):

    . Intrusion of contaminants into the distributionsystem through system components whose in-tegrity was compromised;

    . Material deterioration of system componentsthrough corrosion or leaching causing deteriora-tion of distributed water quality;

    . Formation of DBPs and loss of disinfectant;

    . Compromised quality of water due to microbial(and chemical) breakthrough at the water treat-ment plant;

    . Permeation of organic compounds from thesurrounding soil through plastic system compo-nents into the water supplies;

    . Biolm regrowth in the distribution system; and

    . Deliberate contamination of the distributionsystem.

    288 R. Sadiq et al.

    Dow

    nloa

    ded

    by [B

    rando

    n Univ

    ersity

    GST

    ] at 1

    3:00 1

    2 Apr

    il 201

    3

  • Intrusion of contaminants in the water distribu-tion system can occur through pipes and storagetanks. Open nished water reservoirs are susceptibleto microbial contamination from external non-pointsources such as feces of infected animals or deadanimals themselves (e.g., beaver, squirrels and rab-bits) within the watershed (Kirmeyer et al. 2001).Organic matter (leaves and pollens) is also of concernin open storage tanks (Kirmeyer et al. 2001).Microorganisms can also be introduced into groundlevel storage through surface water (ooding) orgroundwater inltration. Intrusion of contaminantsthrough water mains may occur during maintenanceand repair events, through broken pipes and gaskets,and cross connections. A broken gasket, intended toseal pipe joints, can be a pathway for a variety ofbacteria into the distribution network (Geldreich1990). Regular maintenance and repair events aswell as other anthropogenic and natural disasters maycause intrusion of contaminants in the water distribu-tion network. Cross connections (an unprotectedphysical connection between a potable and a non-potable water system) can potentially introducesubstances that may compromise the quality of thenished water (Kirmeyer et al. 2001).

    The corrosion of metallic pipes and plumbing devi-ces increases the concentration of metal compounds inthe water. Metallic (e.g. cast iron) deterioration mayoften cause red water problems. In fact, red water isof the most commonly encountered WQF althoughthe peril is a loss of aesthetics and damage to clothesrather than health issues. Contamination of waterby compounds leached from pipe liners (plastic andepoxy lining) has also been observed (Sadiq et al.2004).

    Disinfection is the primary method to inactivatepathogens, however, other concerns have been raisedin the last three decades about the safety of disinfectedwater. Harmful DBPs are formed in the presence ofnatural organic matter and bromide (from the source)during chlorination.

    Permeation is a phenomenon in which contami-nants migrate through the wall of plastic pipes. Holsenet al. (1991) reported that most permeation eventsoccur where plastic pipes are buried in soils that arecontaminated with gasoline, diesel fuel, or solvents.Thompson and Jenkins (1987) also reported that poly-ethylene pipes are potentially susceptible to permea-tion of non-polar organic compounds. Similarly, allelastomeric and thermo-plastic materials are prone topermeation by hydrocarbons. In general, the risk ofcontamination through permeation is relatively smallcompared to other contamination mechanisms.

    Biolm is a deposit consisting of microorganisms,microbial products and detritus on the walls of pipes

    or tanks. Biological regrowth occurs when bacteriaescape through the treatment plant and enter into thedistribution system and subsequently rejuvenate andre-grow in storage tanks/ water mains.

    At the point-of-entry (POE) to the distributionsystem, water quality can be compromised whentreatment is insucient to address poor raw waterquality. This can happen when treatment units and/ orpumping equipment is ill-designed or functioning atsuboptimal levels due to aging equipment, insu-ciently trained sta, unusual loads due to unexpectedenvironmental and anthropogenic conditions (e.g.,heavy rainfall, winds and agricultural practices) orany combination thereof.

    (Un)purposeful contamination refers to all formsof threats (terrorism, vandalism) and negligence, whichmay cause water contamination in the distributionsystem. Threat may also include pranks or some formof negligence (e.g. insucient monitoring of thedistribution system on the part of a sta member).These threats may vary owing to vulnerabilities relatedto factors such as the geographical and physicalconditions (e.g., closeness to the urban centres,topography etc.) of the source water, water treatmentplant, and distribution system.

    2.2. Recent episodes of WQFs in Canada

    Episodes of contaminated supply of drinking waterare more prominent in rural than in urban jurisdic-tions. Rural communities have less access to trainedsta and state-of-the-art technologies to regulate andmonitor their water treatment and distributionsystems. Over time, these concerns may escalate andpose serious threats to human health. Two majoroutbreaks related to WQFs including Walkerton andNorth Battleford are discussed and analysed insection 4.

    3. Models and methods

    3.1. Fault tree analysis

    To develop building blocks for the hierarchical frame-work of aggregative risk analysis, a Meta language wasdeveloped by Sadiq et al. (2004) and extended in Sadiqet al. (2007). In the hierarchical tree, each risk event(factor) is partitioned into its contributory sub-events,and each of these can be further partitioned into lowerlevel contributory factors. The unit consisting of a riskevent (parent) and its contributory factors (children) iscalled a family (Figure 1). A family consists oftwo generations and each of the children can be aparent of children of the next generation. An elementwith no children is called a basic risk event (factor).In this paper, the terms risk event, event and factor

    Urban Water Journal 289

    Dow

    nloa

    ded

    by [B

    rando

    n Univ

    ersity

    GST

    ] at 1

    3:00 1

    2 Apr

    il 201

    3

  • are used interchangeably for all elements withospring(s).

    The junctions in the fault tree can be generallydescribed by two logical operators, and and or. Forand gate (conjunction) all children in a family arerequired to trigger a parent event. For example, conta-minant intrusion in a distribution system requires apathway (break or leak), driving force (pressuregradient) and presence of contaminant. For or gate(disjunction) any one or more of the children cantrigger the parent event. The fault tree thus describesthe main event as a function of all sub-events usingconjunctions and disjunctions.

    The notation used for any risk event is Xki;j, where iis the ordinal number of risk event X in the currentgeneration; j is the ordinal number of the parent (in theprevious generation); and k is the generation order ofX. The term main risk event is used for the top eventof the fault tree (it has no parent and is denoted byX11;0) and it indicates that it is the rst and the onlyevent of the rst generation (Figure 1). In this analysis,the main event is the risk of WQF in distributionsystems. For clarity, in the remainder of this paper, thenotation for a basic risk event (an event with nochildren) will include an apostrophe at the generationindex, i.e., if event X31;1 is a basic risk event, it will bedenoted X301;1. Since every parent is preceded by a

    junction, J, the notation for a junction is Jki;j, where i,j,k indices are the same as for the subsequent parent(Figure 1). Junction Jki;j represents a logical operatorthat can be either an or gate or and gate.

    Figure 2 provides a full description of theproposed fault tree structure. As mentioned earlier,this structure is an extension of a hierarchicalstructure proposed in earlier work by Sadiq et al.(2004, 2007). The risk events (at generation 2) of thefault tree are water quality deterioration mechanismsincluding water quality at POE, intrusion ofcontaminants, material deterioration, (un)purposefulcontamination, disinfectant loss and THM formation,permeation, and biolm formation/ regrowth. Table 1lists the description of each risk event in the proposedfault tree.

    In conventional fault tree analysis, basic riskevents are assigned crisp probabilities; however, suchprobabilities are often hard to come by due toinsucient statistical data and knowledge. Conse-quently, such crisp probabilities may lead to precisebut unrealistic results. In this paper we propose to usefuzzy linguistic probabilities (p) instead. These enableuncertainties to propagate throughout the structure ofthe fault tree.

    3.2. Fuzzy set theory

    Fuzzy logic provides a language with syntax andsemantics to translate qualitative knowledge intonumerical reasoning. The term computing with wordshas been introduced by Zadeh (1996) to explain thenotion of reasoning linguistically rather than withnumerical quantities. When evaluating events relatedto complex systems, decision-makers, engineers, man-agers, regulators and other stake-holders often viewrisk in terms of linguistic variables like very high, high,very low, low etc. Fuzzy set theory is able to describeeectively these types of uncertainties (encompassingvagueness), and linguistic variables can be used toapproximate reasoning and subsequently be manipu-lated to propagate the uncertainties throughout thedecision process.

    Fuzzy-based techniques are a generalized form ofinterval analysis. A fuzzy number describes therelationship between an uncertain quantity x and amembership function m, which ranges between 0 and1 (Zadeh 1965). Fuzzy-based techniques can help inaddressing deciencies inherent in binary logic andare useful in propagating uncertainties throughmodels. Any shape of a fuzzy number is possible,but the selected shape should be justied by availableinformation. Generally, triangular fuzzy numbers(TFN) or trapezoidal fuzzy numbers (ZFN) areused for representing linguistic variables (Lee 1996).

    Figure 1. Building blocks of hierarchical framework toperform risk analysis.

    290 R. Sadiq et al.

    Dow

    nloa

    ded

    by [B

    rando

    n Univ

    ersity

    GST

    ] at 1

    3:00 1

    2 Apr

    il 201

    3

  • Let the probability (likelihood) of occurrence (p) bedened by the triangular fuzzy number TFNp. Figure3 describes an 11-granular scale to dene thelikelihood (p) for basic risk events (Lee 1996). Thisproposed scale includes 11 linguistic constants,namely, (1) absolutely low, (2) extremely low, (3)quite low, (4) low, (5) mildly low, (6) medium, (7)

    mildly high, (8) high, (9) quite high, (10) extremelyhigh and (11) absolutely high. The objective of usingthis scale is to provide decision-makers moreexibility in expressing their linguistic notions ofprobabilities. Figure 3 also provides a graphicaldepiction of the relationships between the TFNp andthe associated memberships. In addition, a nil event

    Figure 2. Proposed fault tree for water quality failure in a distribution network.

    Urban Water Journal 291

    Dow

    nloa

    ded

    by [B

    rando

    n Univ

    ersity

    GST

    ] at 1

    3:00 1

    2 Apr

    il 201

    3

  • (i.e. if some phenomenon is surely absent), thegranular (q) is assigned a TFNp (0, 0, 0). Forexample, assume that for a given scenario there areonly two types of pipe materials - plastic and metallic.If the water distribution system does not have plasticpipe, the likelihood (p) of a plastic pipe being presentis nil, and can be assigned a TFNp (0, 0, 0). On theother extreme, the likelihood (p) is absolute for ametallic pipe being present and can be assigned aTFNp (1, 1, 1). Each of the basic risk events can beassigned a fuzzy likelihood using this 11-granularsystem. The top table in Figure 6 (see later) providesan example of fuzzy probabilities assigned to basicrisk events.

    3.3. Uncertainty in dependency relationships

    As mentioned earlier, traditional fault tree analysisuses a default assumption of independence among therisk events to determine the joint probability (risk) of aparent event. This assumption simplies the analysis,but may not be very realistic.

    The relationship between risk events may bepositively or negatively correlated (or independent).In the case of two independent events X and Y, the jointprobability of their conjunction is a simply a product oftheir individual probabilities (Ferson et al. 2004), or

    PX ^ Y xy 1

    Figure 2. (Continued).

    292 R. Sadiq et al.

    Dow

    nloa

    ded

    by [B

    rando

    n Univ

    ersity

    GST

    ] at 1

    3:00 1

    2 Apr

    il 201

    3

  • Table 1. Description of all risk events and fuzzy likelihood values (qi) assumed for basic risk events.

    Event Name Description of risk event

    Walkerton North Battleford

    Baseline Outbreak Baseline Outbreak

    X11;0 Water quality failure Overall risk evaluation

    X21;1 WQ at POE Risk at the point-of-entry to the distributionsystem

    X22;1 Intrusion ofcontaminants

    Susceptibility of contaminants intrusion into thedistribution system

    X23;1 Materialdeterioration

    Potential material deterioration causing leachingand corrosion

    X24;1 (un)purposefulcontamination

    Vandalism, terrorism, also includes includenegligence in the form of insucient monitoring

    X25;1 Disinfection related Potential disinfectant loss and DBPs formation

    X26;1 Permeation Permeation of contaminants through plasticmaterial

    X27;1 Biolm growth Potential growth of biological products andmicroorganisms

    X31;1 Treatment adequacy Potential for inadequate treatment

    X302;1

    Source water Raw water contamination potential 3 5 3 6

    X33;2 Pathway Possible contaminants pathways

    X304;2

    Loss of pressure Likelihood of pressure loss 2 2 2 2

    X305;2

    Presence ofcontaminants

    Likelihood of contaminants presence 1 4 1 4

    X35;3 Leaching Potential for leaching from lining materials

    X36;3 Internal corrosion Potential of corrosion of metallic distributionpipes/plumbing devices

    X37;4 Vulnerability Vulnerability of the distribution system againstmalicious attacks

    X308;4

    Threat Direct and indirect threats to the distributionsystem

    2 2 2 2

    X39;5 DBP Formation Potential for formation of disinfection by-products

    X310;5 Disinfection loss Potential for disinfectant loss n the distributionsystem

    X3011;6

    Plastic Plastic material present or not 1 1 1 1

    X3012;6

    Hydro carbon Hydro carbons are present or not around the pipe 1 1 1 1

    X3013;6

    Conds. conducive tochemical permeation

    Exposure of hydrocarbons to plastic material overlong time

    1 1 1 1

    X3018;7

    Organic matter Presence of optimal organic matter for the growthof biolm

    1 2 1 1

    X3019;7

    Detention time The time water stays in the system (water age) 2 3 2 2

    X3020;7

    Conds. conducive tobiolm formation

    Temperature, nutrients etc. 2 3 2 2

    X401;1

    Treatment units Conditions of the treatment units in the plantbefore water enters the distribution system.

    3 7 4 7

    X402;1

    Untrained sta Lack of knowledge, experience and education 4 7 4 8

    X403;3

    Broken pipes &gaskets

    Risk of water quality failure due to broken pipesand gaskets throughout the water distributionsystem

    2 4 2 2

    X404;3

    Maintenance andrepair events

    Risk of water quality failure due to the intrusionof contaminants during maintenance and repairof pipes and other components of thedistribution system.

    2 4 2 2

    X405;3

    Cross-connections Risk of water quality failure due to the intrusionof contaminants at the cross-connections of thedistribution system.

    2 2 2 2

    X406;5

    Metallic surface Risk of water quality failure due to leaching in theabsence of a metallic surface.

    11 11 1 1

    X407;5

    Conds. conducive toleaching

    Conditions conducive to leaching leading to riskof water quality failure.

    1 2 2 2

    X408;6

    Metallic surface Risk of water quality failure due to corrosion inthe presence of a metallic surface.

    11 11 1 1

    (continued)

    Urban Water Journal 293

    Dow

    nloa

    ded

    by [B

    rando

    n Univ

    ersity

    GST

    ] at 1

    3:00 1

    2 Apr

    il 201

    3

  • where x P(X) and y P(Y), and the symbol ^denotes a conjunction. The joint probability of theirdisjunction is obtained using following equation:

    PX _ Y 1 1 x1 y x y xy 2

    where the symbol _ denotes a disjunction.We denote the interdependence of two events by

    Pearson correlation r 2 [71, 1], where r 0 meanscomplete independence, r 1 means perfect de-pendence (consonant events, likely inuenced by thesame causes) and r 71 means opposite dependence(disjoint events). The strongest positive dependencebetween two events (r 1) is when one eventensures the occurrence of another. When two eventsare mutually exclusive (r 71), one event ensuresthe absence of the other. Pearson correlation r canbe used to assign a level of inter-dependenciesbetween the two extremes opposite and perfect(Ferson et al. 2004). Figure 4 shows a possiblegraphical relationship between Pearson correlationand a linguistic dependence scale ranging from oppo-site to perfect.

    A particular formulation for correlation is derivedfrom the Frank copula (1979). To formulate theprobability of a conjunction of two events using the

    Frank model of correlation, the following equationis used

    PX ^ Y

    andFrankx; y; r

    min x; y if r 1x y if r 0max x y 1; 0 if r 1logs1 sx 1sy 1=s 1 otherwise

    8>>>>>>>>>:

    3

    where s tan p 1r4 . This is a continuous functionand the limits are when r 1, 0, or71 as r tends tobe these values respectively. Similarly, disjunction oftwo events using the Frank model is:

    PX _ Y orFrankx; y; r

    max x; y if r 11 1 x1 y if r 0min x y; 1 if r 11 logs1 s1x 1s1y 1=s 1 otherwise

    8>>>>>>>>>:

    4

    Table 1. (Continued).

    Event Name Description of risk event

    Walkerton North Battleford

    Baseline Outbreak Baseline Outbreak

    X409;6

    Conds. conducive tocorrosion

    Risk of water quality failure due to corrosionlikelihood of conditions conducive to corrosion.

    2 3 1 1

    X4010;7

    Physical & Geo.vulnerability

    Risk of water quality failure due to thesurrounding physical and geographicalvulnerability of the system.

    2 2 1 3

    X4011;7

    Insucientmonitoring

    Risk of water quality failure due to insucientmonitoring in a distribution system.

    3 4 3 5

    X4012;9

    Organic matter Risk of water quality failure due to DBPformation likelihood of organic matter.

    1 2 1 2

    X4013;9

    Concentration ofresidualdisinfectant

    Risk of water quality failure due to DBPformation under likelihood of residualdisinfectant.

    2 3 2 2

    X4014;9

    Conds. conducive toDBP formation

    Risk of water quality failure due to DBPformation under likelihood of conduciveconditions.

    2 3 2 3

    X4015;10

    Organic matter Risk of water quality failure related todisinfectant loss under likelihood of organicmatter.

    1 2 1 2

    X4016;10

    Concentration ofresidualdisinfectant

    Risk of water quality failure related todisinfectant loss under likelihood of residualdisinfectant.

    2 3 2 2

    X4017;10

    Conds. conducive todisinfectant loss

    Risk of water quality failure related todisinfectant loss under likelihood of conduciveconditions.

    2 3 2 3

    *Shaded boxes represent the risk events that have children. The fuzzy likelihood of these risk events is calculated while propagating uncertaintiesthrough the fault tree.

    **The number assigned for basic risk events are based on the 11-granular system and represents the fuzzy likelihood as shown in Figure 3.

    294 R. Sadiq et al.

    Dow

    nloa

    ded

    by [B

    rando

    n Univ

    ersity

    GST

    ] at 1

    3:00 1

    2 Apr

    il 201

    3

  • There exist many dierent methods to expresscorrelation (dependence) but the Frank model (copula)is the most common. It is selected to expressdependencies among risk events in the proposed faulttree analysis. Although exact correlation (r) is rarelyavailable, meaningful analysis can be performed even ifthe type (sign) of correlation is known e.g., positive(r 2 [0, 1]) or negative (r 2 [0, 71]). In the case ofcompletely unknown correlation, the Frechets limitr 2 [71, 1] can be used to represent the maximumuncertainty in dependence relationships. Figure 5demonstrates various types of possible dependencyrelationships as a function of the correlation coecientusing Frank model (Ferson et al. 2004).

    Figure 6 provides an example in which the samplefault tree depicted in Figure 1 is analyzed. Final riskvalues (R) are shown using trapezoidal fuzzy number(ZFN), and a summary of results is provided in thetable of Figure 6. A total of 10 trials are performed,

    using dierent assumptions of dependencies. A fewpoints should be noted. Trial 6 represents the highestuncertainty related to interdependencies among riskevents, which results in a maximum uncertainty in thecalculated risk. Similarly, Trial 1 represents the lowestuncertainty related to interdependencies among riskevents, which results in the lowest uncertainty in thecalculated risk. Positively dependent risk events resultin higher risk and negatively dependent events tend toreduce the calculated risk. These last two points can beintuitively understood.

    3.4. Interpretation of calculated risk

    Two measures similarity measure (S) and entropy (E)are employed to interpret the nal results of the analysis.The similarity measure is an empirical value thatindicates which of the 11 failure likelihoods, shown inFigure 3 has the closest resemblance to the calculated

    Figure 3. A scale of fuzzy likelihood of a failure (after Sadiq et al. 2004).

    Urban Water Journal 295

    Dow

    nloa

    ded

    by [B

    rando

    n Univ

    ersity

    GST

    ] at 1

    3:00 1

    2 Apr

    il 201

    3

  • risk R. The similarity measure is calculated using thereciprocal of the absolute averaged distance between thecalculated fuzzy number, and each of the 11 granulars qi.

    S MAXsi; wheresi 1 d aij j e bij j f bij j g cij j=4 ;

    i 1; 2; :::; 115

    where [d, e, f, g] represents the calculated risk R asZFN, and [ai, bi, ci, di] represents the granular qi asZFN (for TFN, bi ci).

    The calculated risk R is assigned a linguisticconstant based on qi, which corresponds to MAX(si),i.e., the granular with the highest similarity. The tablein Figure 6 provides similarities for all 10 trials.

    Entropy E represents a spread or variance of thecalculated risk R. Entropy E is simply described by a

    Figure 4. Correlation and dependency relationship.

    Figure 5. Uncertainty in dependencies represented as a function of correlation (r).

    296 R. Sadiq et al.

    Dow

    nloa

    ded

    by [B

    rando

    n Univ

    ersity

    GST

    ] at 1

    3:00 1

    2 Apr

    il 201

    3

  • convex set of granulars qi (linguistic constants), whichintersect with the calculated risk R and can bemathematically written as:

    E [

    R\qi 6fqi

    6

    Entropy (E) describes the uncertainty in the nalrisk value and consists of a set of linguistic constantsthat R spans. For example, in trial 6, the nal risk is(most similar to) quite low (QL), but can vary fromabsolutely low (AL) to mildly low (ML) (Figure 6).

    It should be noted that in this paper we have notprovided a detailed description of the fault tree

    analysis procedure. This is a well-established proce-dure that is provided in detail in many textbooks, e.g.,see Vesely (1987). Rather we focused on the impact ofinterdependencies of contributing factors (events) onthe nal risk results using fault tree analysis procedure.

    4. Case studies

    4.1. Walkerton (Ontario)

    Walkerton is a community of about 5000 people withinthe Municipality of Brockton in Bruce County, north-west of Toronto. It is principally an agricultural area.In mid May 2000, Walkerton experienced one of themost detrimental episodes of WQF in recent years.

    Figure 6. Risk analysis results for an example.

    Urban Water Journal 297

    Dow

    nloa

    ded

    by [B

    rando

    n Univ

    ersity

    GST

    ] at 1

    3:00 1

    2 Apr

    il 201

    3

  • More than 2300 people were aected by contaminatedwater originating from the water distribution systemsin and around the Walkerton municipality. Theaected population showed symptoms of gastrointest-inal illness caused by E. coli (O157:H7). The bacteriaexist in both human and animal intestines, and areusually derived from fecal matter (Zhao 2002).

    Health ocials issued a boiled water advisory oncethey started receiving reports from local doctors aboutbloody diarrhea cases. Water samples taken during thecrisis were tested by the Public Health laboratory andconrmed that the drinking water was contaminatedwith E. coli. Further, the water utility for Walkerton(Grey-Bruce Regional Health Unit) conrmed that thechlorinator had not been properly functional in thepast for an undetermined period of time. By the end ofMay, seven deaths related directly to this bacterialoutbreak were recorded. Medical experts declared thatthe Walkerton outbreak was the worlds second worstinstance of E. coli (O157:H7) contamination spreadthrough drinking water. The forensic investigation intothe incident found that cattle manure from a neigh-bouring farm washed o during heavy rainfall andcontaminated Well #5 of the Walkerton PublicUtilities Commission (WPUC).

    At the time of the incident, the towns drinkingwater supply came from a groundwater supply fedfrom three drilled wells, identied as well #5, #6, and#7 (Zhao 2002). Each well had a chlorination unit. Thewells supplied water through a distribution system ofabout 42 km in length (50-400 mm in diameter) andtwo system storage facilities.

    The outbreak occurred due to a combination offactors; the principal contributing risk events are theintrusion of contaminants into the distribution system,vulnerability of the system, inadequate treatment, and(un)purposeful contamination (i.e., negligence andinsucient monitoring) due to negligence and disre-gard for public safety.

    The intrusion of contaminants into the system wascaused by the contamination of well #5 due to surfacewater runo from the surrounding agricultural activ-ity, which occurred during heavy rainfall (Zhao 2002).The surface water runo became contaminated withE. coli bacteria originating from calf faeces. Well #5was nearer to the surrounding agricultural activitythan well #6 and #7. Therefore, the vulnerability of well#5 in terms of physical and geographical conditionswas relatively high.

    The wells were insuciently monitored and rawwater samples were not taken at the required 10-daysintervals (Woo and Vicente 2002). It was noted thatchlorine residuals were not monitored daily as requiredand the residual monitoring records incorrectlyshowed residuals exactly of 0.5 mg/L and 0.75 mg/L

    (Hrudey et al. 2003). Poor laboratory results wereconcealed and modied (Woo and Vicente 2002). Theinquiry revealed that chlorine treatment at well #5 wasinadequate and consequently poorly disinfected waterwas entering the water distribution network.

    The water treatment plant had improperly trainedsta (as in many small communities), which contrib-uted to poor water quality testing and monitoring aswell as reporting of false data (Woo and Vicente 2002).Other possible causes included pipe installations,broken pipes that were later repaired, cross-connec-tions at private wells, loss of pressure due to a reevent, and potential contamination of two waterstorage standpipes (Hrudey et al. 2003).

    4.2. North Battleford (Saskatchewan)

    In April 2001, North Battleford experienced anoutbreak of C. parvum aecting a community ofapproximately 14 000 people (Oce of LaboratorySecurity 2001). There were approximately 5800-7100reported cases of diarrheal illness linked to thisincident. A commission of inquiry stated that a majorcontributing factor was a high concentration of faecalmatter found in the source water. The faecal matteroriginated from neighbouring agricultural activityand was known to contain high concentrations ofC. parvum (Woo and Vicente 2003).

    A second possible contributing factor was identiedas the location of the sewage treatment plant. The plantwas located 3500m upstream of the raw water intake.Results from studies conducted by the SaskatchewanEnvironment and Resource Management (SERM)indicated that the geographical conditions were favour-able to allow the sewage to migrate toward the waterintake. It was reported, . . . the topology of the area,along with river turbidity and ow caused the sewageeuent to reach the surface more often than not (Wooand Vicente 2003). Consequently, the C. parvumoutbreak may have occurred in part because ofcontamination of the raw surface water.

    There were two water treatment facilities in NorthBattleford. The groundwater treatment system wascomprised of chlorination and ltration, whereassurface water treatment system comprised occulation,sedimentation, sand ltration, and chlorination. Con-sequently, a third possible source of contaminationwas identied as insucient treatment related to thesolids contact unit (SCU) of the surface watertreatment plant. It can be concluded that it was afailure of multi-barriers to protect the drinking watersupplies from contamination.

    Woo and Vicente (2002) reported, . . . the majorcontributing factor [at the technical and operationalmanagement level] dealt with the lack of education and

    298 R. Sadiq et al.

    Dow

    nloa

    ded

    by [B

    rando

    n Univ

    ersity

    GST

    ] at 1

    3:00 1

    2 Apr

    il 201

    3

  • a culture of non-compliance. Further, there wasinadequate treatment at the time of the outbreak. Asmentioned earlier, small rural communities often donot have the best technological equipment and know-how. Consequently, the SCU of the surface watertreatment plant was not functioning at the requiredlevel, causing poor settling (Stirling et al. 2001). Therewas evidence that oc formation in the SCU had notbeen established prior to the outbreak in April 2001(Woo and Vicente 2002). This made it possible forC. parvum to pass into the nished drinking water. Inaddition, the treatment units were found to be in poorcondition due to the aging of the surface watertreatment plant. The Commission report stated, . . . components of the surface water treatment werediscovered to be either missing or oine prior to theoutbreak (Woo and Vicente 2002).

    The subsequent analyses in this paper intend toillustrate the eects of the contributing risk events andtheir associated interdependencies on the overall riskof water contamination in distribution networks inboth case studies.

    4.3. Examination procedure

    The risk events selected for inclusion in the two casestudies for outbreak scenarios were intrusion ofcontaminants, treatment adequacy, (un)purposeful con-tamination, vulnerability of the system with respect tophysical/geographical conditions. In each case study,fuzzy likelihood values assigned to the basic risk eventswere xed for all outbreak scenarios, but the depen-dency assumptions were varied to investigate theimpacts of unknown dependencies on the risk analysis.

    4.3.1. Baseline scenario

    For each case study, a baseline scenario was estab-lished, which represents normal operating conditions(not considering the outbreaks). A baseline scenariosets a benchmark, against which three outbreakscenarios (per case study) were subsequently examined.

    It should be noted that relatively large uncertainties(related to input values for basic risk factors) wereanticipated in the baseline scenarios. Ironically, therewas less uncertainty involved in the outbreak scenariosdue to the rigorous investigations that ensued. Table 1provides the fuzzy likelihood values (dened based onthe 11-granular system) assigned to each basic riskevent for baseline scenarios for the two case studies.

    4.3.2. Interdependencies in baseline scenario

    Interdependencies in baseline scenarios were assumedonly for basic risk events as provided in Table 2.

    An independence assumption was made for all higher-level risk events. In addition for simplicity, interde-pendencies among non-relevant basic risk events werealso assumed independent (r 0).

    4.3.3. Outbreak scenarios and interdependencies

    Three outbreak scenarios were explored for each of thetwo case studies where various levels of dependencieswere assigned to explore conditions at the time of eachoutbreak. The dierences between these outbreak scena-rios were related only to variations in the interdepen-dency assumptions. Table 1 provides the fuzzy likelihoodvalues (dened on the 11-granular system) assigned toeach basic risk event for all the outbreak scenarios.

    For example, based on a notion that there is arelationship between vulnerability and threat, positiveweak dependency was assumed for family (un)purpo-seful contamination (Figure 2). It can be argued thatvulnerability of the system due to insucient monitoringmay possibly increase the likelihood of threat such asvandalism. Similarly, vulnerability due to physical/geographical conditions of the system (e.g. proximity toindustrial activity or hospital) may entice sabotage orother forms of threats to the system. Similarly, positivemildly strong dependency was assumed between theadequacy of treatment units and untrained sta (it isgenerally observed that small communities havelimited resources for highly trained sta and theyalso lack sophisticated treatment). As mentionedearlier, the set of dependencies for the three outbreakscenarios are modied for risk events like contaminantintrusion, treatment adequacy, deliberate acts and thesystem vulnerability.

    Scenario 1 (Sc1) assumed the same set of depen-dencies as that of the baseline scenario, i.e., two of thefour risk events had some form of positive dependency,while for the other two no information was assumed. InSc2, the set of dependency of all major risk events wereassumed positive strong. Sc3 was investigated as aworst-case scenario where the least amount of infor-mation, i.e. no information was provided for thedependencies. Table 3 provides a summary of thedependencies assumed for risk events of the fault treefor baseline and outbreak scenarios.

    4.4. Risk analyses results

    4.4.1. Walkerton

    The results of all outbreak scenarios are superimposedgraphically in Figure 7, to enable easy comparison withthe baseline scenario. In Sc1, the calculated risk is[0.26, 0.51, 0.57, 0.78], clearly higher than the baselinerisk of [0.02, 0.20, 0.20, 0.47]. This corresponds to a

    Urban Water Journal 299

    Dow

    nloa

    ded

    by [B

    rando

    n Univ

    ersity

    GST

    ] at 1

    3:00 1

    2 Apr

    il 201

    3

  • Table 3. Summary of interdependencies assumptions among risk events for both case studies.

    Dependency assumptions

    Junction Description Gate Baseline Sc 1 Sc 2 Sc 3

    J11;0 Risk of water qualityfailure

    OR Independent Independent Independent Independent

    J21;1 Water Quality at POE AND Independent Independent Independent Independent

    J22;1 Intrusion ofcontaminants

    AND No Info No Info Positive Strong No Info

    J23;1 Material deterioration OR Independent Independent Independent Independent

    J24;1 (un)purposefulcontamination

    AND Positive M. Strong Positive M. Strong Positive Strong No Info

    J25;1 Disinfection OR Positive M. Strong Positive M. Strong Positive M. Strong Positive M. Strong

    J26;1 Permeation AND Independent Independent Independent Independent

    J27;1 Biolm growth AND Independent Independent Independent Independent

    J301;1

    Treatment adequacy AND Positive V. Strong Positive V. Strong Positive Strong No Info

    J33;2 Pathway OR Independent Independent Independent Independent

    J35;3 Leaching AND Independent Independent Independent Independent

    X36;3 Internal corrosion AND Independent Independent Independent Independent

    J37;4 Vulnerability OR No Info No Info Positive Strong No Info

    J39;5 DBP formation AND Independent Independent Independent Independent

    J310;5 Disinfectant loss AND Independent Independent Independent Independent

    Note: Highlighted events are identied as major risk events.

    Table 2. Assumed interdependencies among risk events for baseline scenario for both case studies.

    Junction Description Gate Dependence Justication

    J11;0 Risk of water qualityfailure

    OR Independent No correlation between second-generation riskevents.

    J21;1 Water Quality atPOE

    AND Independent No correlation between treatment adequacy andsource water

    J22;1 Intrusion ofcontaminants

    AND Independent No correlation between third generation riskevents.

    J23;1 Materialdeterioration

    OR Independent No correlation between leaching and corrosion.

    J24;1 (un)purposefulcontamination

    AND Positive Weak Vulnerability of the system encourages threat.

    J25;1 Disinfection OR Positive M. Strong Low value correlation between DBP formationand disinfectant loss (inversely proportional).

    J26;1 Permeation AND Independent Third generation events are independent of eachother, e.g., detention time does not aecttemperature.

    J27;1 Biolm growth AND Independent No correlation between third generation riskevents.

    J301;1

    Treatment adequacy AND Positive M. Strong Poor treatment units because of probability ofuntrained sta in smaller communities.

    J33;2 Pathway OR Independent Third generation events are dependant of eachother. Maintenance and repair events increasethe probability of broken pipes and gaskets.

    J35;3 Leaching AND Independent No correlation between third generation riskevents for leaching.

    J36;3 Internal corrosion AND Independent No correlation between third generation riskevents.

    J37;4 Vulnerability OR Independent No correlation between physical/geographicalvulnerability of the system and insucientmonitoring.

    J39;5 DBP formation AND Independent No correlation between third generation riskevents.

    J310;5 Disinfectant loss AND Independent No correlation between third generation riskevents.

    Note: Highlighted events are the identied as major risk events.

    300 R. Sadiq et al.

    Dow

    nloa

    ded

    by [B

    rando

    n Univ

    ersity

    GST

    ] at 1

    3:00 1

    2 Apr

    il 201

    3

  • medium risk (based on the similarity measure asdened in section 3.2) of a WQF in the distributionsystem. This higher risk of Sc1 is due only to the basicrisk event uncertainties, since Sc1 has the same set ofdependencies as the baseline scenario. The entropy ofSc1 is quite low to high.

    In Sc2, the entropy increases to quite low to extremelyhigh. The increase in entropy suggests that the assump-tion of positive dependency increases the uncertaintysignicantly. The calculated risk is mildly high andranges from 0.28 to 0.84. In this scenario, the resultinghigher risk is due to a combination of the basic riskevents uncertainties and the particular set of dependen-cies. In Sc3, complete ignorance is assumed about therelevant interdependencies, resulting in calculated riskdescribed by a ZFN [0.23, 0.46, 0.65, 0.83]. The overallrisk ismildly high and the total entropy ranges from quitelow to extremely high. The table in Figure 7 provides asummary of risk estimates and associated entropy resultsfor all scenarios of the Walkerton case study.

    4.4.2. North Battleford

    A similar set of dependencies is assumed for NorthBattleford. The input likelihood (i.e. for basic risk

    events) is dierent, however, based on the conditionsspecic to North Battleford present at the time of theoutbreak. For instance, the estimated risk associatedwith treatment in Walkerton is quite low (based onsimilarity measure) while for North Battleford it isestimated to be low. Evidence during the inquiry of theoutbreak in North Battleford revealed that inadequatetreatment units of the water treatment plant contrib-uted to the increased risk. The units were practicallyobsolete or functioning at sub-optimal levels due to theage of the treatment plant.

    Figure 8 illustrates the results of all scenarios in theNorth Battleford case study. In Sc1, the calculated riskR of WQF in the distribution systems is described by aZFN [0.27, 0.42, 0.49, 0.70], which can be interpretedas medium risk. The entropy is found to be between lowto quite high.

    The entropy for Sc2 increases to quite low to quitehigh. This reinforces the notion that there is a slightlyhigher uncertainty associated with positive dependen-cies. The risk R remains medium and ranges from 0.30to 0.71. Since the risk does not increase signicantlyfrom Sc1 as is observed in the Walkerton case study, itis assumed that in this case positive dependencies haveonly a limited impact on the calculated risk.

    Figure 7. Risk analysis results for Walkerton (ON).

    Urban Water Journal 301

    Dow

    nloa

    ded

    by [B

    rando

    n Univ

    ersity

    GST

    ] at 1

    3:00 1

    2 Apr

    il 201

    3

  • In Sc3, the risk R remains medium and is describedby a ZFN [0.24, 0.35, 0.60, 0.76]. Entropy is quite lowto quite high, as in Sc2. In this case, no signicantdierence in the risk R emerges when the assumptionsfor dependencies are changed. It appears that the riskevents with relatively high likelihood overshadow otherevents, which results in a similar risk R. The table inFigure 8 contains a summary of the calculated risk Rand associated entropy E for all simulated scenariosfor the North Battleford.

    5. Conclusions

    Water in distribution networks can be contaminated viaseveral pathways and the quantication and character-ization of this risk is a complex process. Thousands ofkilometres of pipes of dierent ages and materials,uncertain operational and environmental conditions,unavailability of reliable data, and lack of understandingof some factors and processes aecting pipe performancemake predicting the risk of distribution system failureextremely challenging. These complexities alsomake riskanalysis for a water distribution system highly uncertain.

    Two types of uncertainties were explored using afault tree analysis of a WQF in distribution systems.

    The rst was uncertainty with respect to the basic riskevents, and the second was uncertainty with respect tointerdependencies among risk events. A range ofvalues was dened based on informed assumptionsand empirical estimates. Interdependencies werevaried in the analysis to understand the relationshipsamong risk events and the impact of these assump-tions on the nal calculated risk. The input values ofthe events were represented by fuzzy probabilities(likelihood). Frank copula and Frechets limit wereused to described uncertainties in interdependenciesamong risk events. The interpretation of risk analysisresults was carried out using similarity and entropymeasures.

    The proposed approach was applied to two casestudies Walkerton (Ontario) and North Battleford(Saskatchewan). Factors contributing to WQF wereassumed to be comprised of water quality at POE,intrusion of contaminants into the distributionsystem, material deterioration, (un)purposeful con-tamination, and water quality deterioration related todisinfection, and biolm regrowth. In the case ofWalkerton, the calculated risk was at the most mildlyhigh, but entropy was quite low to extremely high inthe three outbreak scenarios. In North Battleford,

    Figure 8. Risk analysis results for North Battleford (SK).

    302 R. Sadiq et al.

    Dow

    nloa

    ded

    by [B

    rando

    n Univ

    ersity

    GST

    ] at 1

    3:00 1

    2 Apr

    il 201

    3

  • similar observations were made, though the calculatedrisk remained medium for all three scenarios ofoutbreak.

    The calculated risk values, R, for the dierentoutbreak scenarios in the two case studies were mostlymedium. Overall, the lower estimates of R wereprimarily attributed to smaller values of the fuzzylikelihood assumed for the basic risk events. Both WQFevents were primarily linked to the point of entrycontamination, therefore comparatively higher like-lihood values of basic risk events were assumed in thatcategory. There was no enough evidence to makeassumptions of higher likelihood values for other basicrisk events. Even though events have already happenedand proved to culminate in major outbreaks, this doesnot imply that the risk analysis results obtained in thisstudy are not valuable. Rather, this analysis furtherenhances the importance and underscores the need formore comprehensive risk analysis with considerationof dierent types of uncertainties including a thoroughinvestigation of the structure of the fault tree and theassumed logical relationships among various riskevents as proposed in this paper.

    Note that the calculated risk values, R, representonly the most likely estimates and should be inter-preted with entropy (E) results, which account foruncertainties. The uncertainties were considerablylarge in both case studies. For example in Scenario 3,the estimated risk was as high as Extremely High andQuite High for Walkerton and North Battleford casestudies, respectively. Risk-based decision-making is aprocess of identifying necessary and appropriateactions. The proposed risk-based methodology pro-vides an eective tool for water utilities to makeinformed decisions. It oers a scientically rigorousand administratively eective way to respond to thepressures in a timely way. Therefore, even thecalculated risk were mostly medium, the conservativeestimates were alarming, and required swift actionsfrom the water utilities. Further, it is important torecognize that risk-based decision-making should notintended to be just a cost-saving tool, rather should beused to prioritize the rehabilitation and correctiveactions required.

    A major advantage of the proposed methodology isthat it can accommodate both qualitative and quanti-tative data. Some data may be supported by rigorousobservations, while other data may be based on looselysupported or anecdotal-based beliefs. These two typesof data should have dierent weights in the aggrega-tion and uncertainty propagation process. The ap-proach can also accommodate and process dataobtained from sources of dierent reliabilities. Thesetwo aspects are not discussed in this paper and are thesubject of future research.

    References

    American Water Works Association (AWWA), 2007. Chlor-ine Disinfectants/Disinfectant By-Products (DBPs) [on-line] Available from: http://www.awwa.org/Advocacy/pressroom/dbps.cfm (Accessed 8 May 2007).

    Edge, T., et al., 2003. Waterborne Pathogens. Canada:National Water Research Institute.

    Ferson, S., et al., 2004. Dependence in Dempster-ShaferTheory and Probability Bounds Analysis. US: SandiaNational Laboratories.

    Frank, M., 1979. On the Simultaneous Associativity of andF(x, y) and x y- F(x, y). Aequationes Mathematicae,19, 194226.

    Geldreich, E.E., 1990. Microbiological quality control indistribution systems. In: W.P. Frederick, ed. WaterQuality and Treatment. New York: American WaterWorks Association, McGraw-Hill.

    Holsen, T.M., Park, J.K., Jenkins, D., and Shelleck, R.E.,1991. Contamination of potable water by permeation ofplastic pipe. Journal of American Water Works Associa-tion, 83 (8), 5356.

    Hrudey, S.E., et al., 2003. A fatal waterborne diseaseepidemic in walkerton, ontario: comparison with otherwaterborne outbreaks in the developed world. WaterScience and Technology, 47 (3), 714.

    Kirmeyer, G.J., et al., 2001. Pathogen intrusion into distribu-tion system. Denver, Colarado: AWWARF.

    Kleiner, Y., 1998. Risk factors in water distribution sys-tems. British-Colombia Water and Waste Association26th Annual Conference, Whistler, British-Columbia, 2629 April 1998.

    Lee, H.-M., 1996. Applying fuzzy set theory to evaluate therate of aggregative risk in software development. FuzzySets and Systems, 79, 323336.

    Li, H., 2007. Hierarchical risk assessment of water supplysystems. Thesis (PhD). Loughborough University,Leicestershire.

    Maier, S.H., 1999. Modeling water quality for water distribu-tion systems. Thesis (PhD). Brunel University, Uxbridge.

    Ming-Hung, S., et al., 2006. Using intuitionistic fuzzy sets forfault-tree analysis on printed circuit board assembly.Microelectronics Reliability, 46 (12), 21392148.

    Oce of Laboratory Security, 2001. Material Safety DataSheet Infectious Substances. Public Health Agency ofCanada [online]. Available from: http://www.phac-aspc.gc.ca/msds-ftss/index.html [Accessed 7 May 2007).

    Sadiq, R., Kleiner, Y., and Rajani, B., 2004. Aggregative riskanalysis for water quality failure in distribution net-works. Journal of Water Supply Research and Technol-ogy: Aqua, 53 (4), 241261.

    Sadiq, R., Kleiner, Y., and Rajani, B., 2007. Water qualityfailures in distribution networks risk analysis usingfuzzy logic and evidential reasoning. Risk Analysis AnInternational Journal, 27 (5), 13811394.

    Stirling, M.D., et al., 2001. Waterborne CryptosporidiosisOutbreak North Battleford, Saskatchewan, Spring 2001,Public Health Agency of Canada (PHAC), CanadaCommunicable Disease Report, Vol. 27-22, 15 November2001 [online]. Available from http://www.phac-aspc.gc.ca/publicat/ccdr-rmtc/01vol27/dr2722ea.html [Acces-sed 7 May 2007].

    The Bonn Charter of Safe Drinking Water, 2004. Interna-tional Water Association (IWA), September 2004, p. 18.

    Thompson, C. and Jenkins, P., 1987. Review of water industryplastic pipe practices. Denver, Colorado: AWWARF.

    Urban Water Journal 303

    Dow

    nloa

    ded

    by [B

    rando

    n Univ

    ersity

    GST

    ] at 1

    3:00 1

    2 Apr

    il 201

    3

  • Vesely, W.E., 1987. Fault tree handbook, Nuclear RegulatoryCommission, 218.

    Woo, D. and Vicente, K.J., 2003. Socio-technical systems,risk management, and public health: comparing theNorth Battleford and Walkerton Outbreaks. ReliabilityEngineering and Safety Systems, 80 (3), 253269.

    Zadeh, L.A., 1965. Fuzzy sets. Information and Control, 8 (3),338353.

    Zadeh, L.A., 1996. Fuzzy logic computing with words. IEEETransactions of Fuzzy Systems, 4 (2), 103111.

    Zhao, Z., 2002. Risk Analysis of the Walkerton DrinkingWater Contamination Tragedy. Thesis (Masters). Uni-versity of Waterloo, Ontario, Canada.

    304 R. Sadiq et al.

    Dow

    nloa

    ded

    by [B

    rando

    n Univ

    ersity

    GST

    ] at 1

    3:00 1

    2 Apr

    il 201

    3

Recommended

View more >