This article was downloaded by: [Brandon University GST]On: 12 April 2013, At: 13:00Publisher: Taylor & FrancisInforma Ltd Registered in England and Wales Registered Number: 1072954 Registered office: Mortimer House,37-41 Mortimer Street, London W1T 3JH, UK

Urban Water JournalPublication details, including instructions for authors and subscription information:http://www.tandfonline.com/loi/nurw20

Predicting risk of water quality failures in distributionnetworks under uncertainties using fault-tree analysisR. Sadiq a , E. Saint-Martin a & Y. Kleiner ba Institute for Research in Construction of National Research Council (NRC-IRC), Ottawa,ON, Canadab Civil Engineering Determent, University of Ottawa, ON, CanadaVersion of record first published: 19 Nov 2008.

To cite this article: R. Sadiq , E. Saint-Martin & Y. Kleiner (2008): Predicting risk of water quality failures in distributionnetworks under uncertainties using fault-tree analysis, Urban Water Journal, 5:4, 287-304

To link to this article: http://dx.doi.org/10.1080/15730620802213504

PLEASE SCROLL DOWN FOR ARTICLE

Full terms and conditions of use: http://www.tandfonline.com/page/terms-and-conditions

This article may be used for research, teaching, and private study purposes. Any substantial or systematicreproduction, redistribution, reselling, loan, sub-licensing, systematic supply, or distribution in any form toanyone is expressly forbidden.

The publisher does not give any warranty express or implied or make any representation that the contentswill be complete or accurate or up to date. The accuracy of any instructions, formulae, and drug doses shouldbe independently verified with primary sources. The publisher shall not be liable for any loss, actions, claims,proceedings, demand, or costs or damages whatsoever or howsoever caused arising directly or indirectly inconnection with or arising out of the use of this material.

RESEARCH ARTICLE

Predicting risk of water quality failures in distribution networks under uncertainties using fault-tree

analysis

R. Sadiqa*, E. Saint-Martina and Y. Kleinerb

aInstitute for Research in Construction of National Research Council (NRC-IRC), Ottawa, ON, Canada; bCivil EngineeringDeterment, University of Ottawa, ON, Canada

(Received 5 November 2007; final version received 17 May 2008)

The water quality in a distribution system is affected by many factors, including operational and environmentalconditions as well as the condition in and around the distribution network. Lack of reliable data as well asknowledge gaps with respect to the impact of these factors on water quality make the quantification of water qualityfailure risk very challenging. Furthermore, the variability inherent in (sometimes) thousands of kilometers ofdistribution pipes presents added complexities. Major modes of water quality failures can be classified into intrusionof contaminants, regrowth of bacteria (biofilm), water treatment breakthrough, leaching of chemicals or corrosionproducts from system components, and permeation of organic compounds through plastic pipes. Deliberatecontamination and negligence of operators have in recent years become an added concern. In earlier works by Sadiqet al. (2004, 2007), an aggregative risk analysis approach using hierarchical structure was proposed to describe allpossible mechanisms of contamination. In this paper a similar structure is used as a basis for a fault-tree approach.While fault-tree analysis is widely used for many engineering applications, in this paper we specifically explore howinterdependencies among factors might impact analysis results. Two types of uncertainties are considered in theproposed analysis. The first is related to the likelihood of risk events, and the second is related to non-lineardependencies among risk events. Each basic risk event (input factor) is defined using a fuzzy probability (likelihood)to deal with its inherent uncertainty. The dependencies among risk events are explored using Frank copula andFrechet’s limit. The proposed approach is demonstrated using two well-documented episodes of water qualityfailures in Canada, namely, Walkerton (ON) and North Battleford (SK).

Keywords: distribution networks; fault-tree analysis; risk events; water quality failure; fuzzy probability; Frankcopula; Walkerton; North Battleford

1. Introduction

Water quality can be defined by a collection of upperand lower limits on selected performance indicators(Maier 1999). Therefore, a water quality failure(WQF) refers to an exceedance of one or more waterquality indicators from specific regulations, or in theabsence of regulations, exceedance of guidelines orself-imposed limits driven by customer service needs(Sadiq et al. 2004). Current and anticipated waterquality regulations in Canada and the United Statesaim to minimize the impact of WQF in distributionsystems. These regulations require utilities continuallyto upgrade and rehabilitate their distribution net-works, water treatment processes and technologies,and to improve operations and/ or change source-waters.

The Bonn Charter of Safe Drinking Water (2004)discusses a generic framework for the effective

management of water quality from source to tap thatcan be linked to World Health Organization (WHO)guidelines for drinking water. It emphasises the needfor proactive risk-based management of drinking watersupplies. The main feature of the Charter is not only theend-of-pipe verification (regular water quality monitor-ing) implementation of management control systemsthroughout the system to assess risks at all points.

The quantification of risk of WQF in waterdistribution systems is a difficult task. Water distribu-tion systems comprise many (sometimes thousands) ofkilometers of pipes of different ages and variousmaterials. Operational and environmental conditionsare highly variable both temporally and spatially.Further, as pipes are mostly buried, limited data areavailable on their condition. Finally, some of thefailure processes are not well understood and forensicinvestigation of contamination is very difficult becausethere is generally a time lag between the time of failure

*Corresponding author. Email: rehan.sadiq@nrc-cnrc.gc.ca

Urban Water Journal

Vol. 5, No. 4, December 2008, 287–304

ISSN 1573-062X print/ISSN 1744-9006 online

� 2008 Government of Canada

DOI: 10.1080/15730620802213504

http://www.informaworld.com

Dow

nloa

ded

by [

Bra

ndon

Uni

vers

ity G

ST]

at 1

3:00

12

Apr

il 20

13

and the time at which the consequences (e.g. out-breaks) are observed.

Fault tree analysis is a commonly used tool todetermine the cause(s) of system failure. The fault treeis constructed as a tree of sub-events, spreading intobottom events, procreating the fault and finally headingto the top [or main] event (Ming-Hung et al. 2006). Afault tree is a graphical representation of an eventstructure that clearly envisions the entire system andeach level of each event within it. This structureenables one to identify particular sub-events that havea high impact on the main event.

The difference between a general hierarchical modeland a fault tree is that while the former simply displaythe order of events that lead to the main failure event(and aggregates them using any appropriate weightingscheme), the latter defines logical relationships (‘and’and ‘or’) between sub-events. Traditional fault treeanalysis requires the assignment of crisp probabilitiesbetween events and the assumption of ‘independence’between risk events. These two requirements carryinherent shortcomings. Firstly, one rarely knows‘precise’ probabilities of causal relationships betweenevents, and secondly, the required assumption ofindependence is often unrealistic.

Recently, Li (2007) proposed an object-orientedapproach for water supply systems based on aggregativerisk assessment (similar to Sadiq et al. 2004) and fuzzyfault tree analysis. Li (2007) used fuzzy evidentialreasoning method to determine the risk levels associatedwith components, subsystems, and the overall watersupply system. Fuzzy sets theory was used to evaluatethe likelihood, severity, and risk levels associated witheach hazard and Dempster-Shafer theory was used toaggregate the risk levels of multiple hazards throughoutthe hierarchical tree. Fuzzy fault tree analysis was usedto evaluate the likelihood of the occurrence for aspecific event in a water supply system. The dependen-cies in fault tree analysis were also studied using a‘dependency factor’ similar to linear correlation.

The objective of this paper is to propose a genericfault tree approach to evaluate risk of WQF in adistribution network. The hierarchical structure offactors contributing to failure, presented in earlierwork by Sadiq et al. (2004, 2007) is extended for theproposed fault tree structure. Further, the shortcom-ings discussed earlier, namely false precision inprobability assignments and unrealistic independenceassumptions, are addressed. Probabilities of basic riskevents are defined linguistically using fuzzy numbers,and nonlinear interdependencies are handled usingFrank copula (for known correlation) and Frechet’slimit (for unknown correlation) (Ferson et al. 2004).The proposed fault tree is applied to two case studiesto demonstrate the applicability of the approach.

2. Water quality failures in distribution systems

The safety of drinking water is the supreme priority ofwater utilities. A typical modern water supply systemcomprises the water source (aquifer or surface watersource including the catchment basin), transmissionmains, treatment plant and distribution network, whichincludes pipes and distribution tanks. While waterquality can be compromised at any point in the system,failure at the distribution level can be critical because itis closest to the point of use and, with the exception of afiltering device at the consumer level there are virtuallyno safety barriers before consumption.

The WHO has reported that infectious water bornediseases are the world’s single largest source of humanmortality. Although developed countries have a highercapability of controlling waterborne pathogens, waterquality episodes still occur in North America andEurope (Edge et al. 2003). While biological agents arethe most common source of major WQF, chemicalscan also adversely affect drinking water quality. Thesechemicals can be categorised as organic and inorganic.Inorganic chemicals include arsenic, lead, and nitrate,to name a few. Organic chemicals such as PAH(polynuclear aromatic hydrocarbon) and variousDBPs (disinfection byproducts) can cause anaemia,decreased level of blood platelets and organic chemi-cals such as DBPs have a potential to increase cancerrisk and miscarriages (AWWA 2007).

2.1. Water quality deterioration mechanisms

WQFs compromising either the safety or the aestheticsof water can occur as a result of various mechanismsand pathways throughout the distribution network.Contamination in distribution networks can generallybe classified into the following major categories(Kleiner 1998):

. Intrusion of contaminants into the distributionsystem through system components whose in-tegrity was compromised;

. Material deterioration of system componentsthrough corrosion or leaching causing deteriora-tion of distributed water quality;

. Formation of DBPs and loss of disinfectant;

. Compromised quality of water due to microbial(and chemical) breakthrough at the water treat-ment plant;

. Permeation of organic compounds from thesurrounding soil through plastic system compo-nents into the water supplies;

. Biofilm regrowth in the distribution system; and

. Deliberate contamination of the distributionsystem.

288 R. Sadiq et al.

Dow

nloa

ded

by [

Bra

ndon

Uni

vers

ity G

ST]

at 1

3:00

12

Apr

il 20

13

Intrusion of contaminants in the water distribu-tion system can occur through pipes and storagetanks. Open finished water reservoirs are susceptibleto microbial contamination from external non-pointsources such as feces of infected animals or deadanimals themselves (e.g., beaver, squirrels and rab-bits) within the watershed (Kirmeyer et al. 2001).Organic matter (leaves and pollens) is also of concernin open storage tanks (Kirmeyer et al. 2001).Microorganisms can also be introduced into groundlevel storage through surface water (flooding) orgroundwater infiltration. Intrusion of contaminantsthrough water mains may occur during maintenanceand repair events, through broken pipes and gaskets,and cross connections. A broken gasket, intended toseal pipe joints, can be a pathway for a variety ofbacteria into the distribution network (Geldreich1990). Regular maintenance and repair events aswell as other anthropogenic and natural disasters maycause intrusion of contaminants in the water distribu-tion network. Cross connections (an unprotectedphysical connection between a potable and a non-potable water system) can potentially introducesubstances that may compromise the quality of thefinished water (Kirmeyer et al. 2001).

The corrosion of metallic pipes and plumbing devi-ces increases the concentration of metal compounds inthe water. Metallic (e.g. cast iron) deterioration mayoften cause red water problems. In fact, red water isof the most commonly encountered WQF althoughthe peril is a loss of aesthetics and damage to clothesrather than health issues. Contamination of waterby compounds leached from pipe liners (plastic andepoxy lining) has also been observed (Sadiq et al.2004).

Disinfection is the primary method to inactivatepathogens, however, other concerns have been raisedin the last three decades about the safety of disinfectedwater. Harmful DBPs are formed in the presence ofnatural organic matter and bromide (from the source)during chlorination.

Permeation is a phenomenon in which contami-nants migrate through the wall of plastic pipes. Holsenet al. (1991) reported that most permeation eventsoccur where plastic pipes are buried in soils that arecontaminated with gasoline, diesel fuel, or solvents.Thompson and Jenkins (1987) also reported that poly-ethylene pipes are potentially susceptible to permea-tion of non-polar organic compounds. Similarly, allelastomeric and thermo-plastic materials are prone topermeation by hydrocarbons. In general, the risk ofcontamination through permeation is relatively smallcompared to other contamination mechanisms.

Biofilm is a deposit consisting of microorganisms,microbial products and detritus on the walls of pipes

or tanks. Biological regrowth occurs when bacteriaescape through the treatment plant and enter into thedistribution system and subsequently rejuvenate andre-grow in storage tanks/ water mains.

At the point-of-entry (POE) to the distributionsystem, water quality can be compromised whentreatment is insufficient to address poor raw waterquality. This can happen when treatment units and/ orpumping equipment is ill-designed or functioning atsuboptimal levels due to aging equipment, insuffi-ciently trained staff, unusual loads due to unexpectedenvironmental and anthropogenic conditions (e.g.,heavy rainfall, winds and agricultural practices) orany combination thereof.

(Un)purposeful contamination refers to all formsof threats (terrorism, vandalism) and negligence, whichmay cause water contamination in the distributionsystem. Threat may also include pranks or some formof negligence (e.g. insufficient monitoring of thedistribution system on the part of a staff member).These threats may vary owing to vulnerabilities relatedto factors such as the geographical and physicalconditions (e.g., closeness to the urban centres,topography etc.) of the source water, water treatmentplant, and distribution system.

2.2. Recent episodes of WQFs in Canada

Episodes of contaminated supply of drinking waterare more prominent in rural than in urban jurisdic-tions. Rural communities have less access to trainedstaff and state-of-the-art technologies to regulate andmonitor their water treatment and distributionsystems. Over time, these concerns may escalate andpose serious threats to human health. Two majoroutbreaks related to WQFs including Walkerton andNorth Battleford are discussed and analysed insection 4.

3. Models and methods

3.1. Fault tree analysis

To develop building blocks for the hierarchical frame-work of aggregative risk analysis, a Meta language wasdeveloped by Sadiq et al. (2004) and extended in Sadiqet al. (2007). In the hierarchical tree, each risk event(factor) is partitioned into its contributory sub-events,and each of these can be further partitioned into lowerlevel contributory factors. The unit consisting of a riskevent (parent) and its contributory factors (children) iscalled a ‘family’ (Figure 1). A family consists oftwo generations and each of the children can be aparent of children of the next generation. An elementwith no children is called a ‘basic risk event (factor)’.In this paper, the terms ‘risk event’, ‘event’ and ‘factor’

Urban Water Journal 289

Dow

nloa

ded

by [

Bra

ndon

Uni

vers

ity G

ST]

at 1

3:00

12

Apr

il 20

13

are used interchangeably for all elements withoffspring(s).

The junctions in the fault tree can be generallydescribed by two logical operators, ‘and’ and ‘or’. For‘and’ gate (conjunction) all children in a family arerequired to trigger a parent event. For example, conta-minant intrusion in a distribution system requires – apathway (break or leak), driving force (pressuregradient) and presence of contaminant. For ‘or’ gate(disjunction) any one or more of the children cantrigger the parent event. The fault tree thus describesthe main event as a function of all sub-events usingconjunctions and disjunctions.

The notation used for any risk event is Xki;j, where i

is the ordinal number of risk event X in the currentgeneration; j is the ordinal number of the parent (in theprevious generation); and k is the generation order ofX. The term ‘main risk event’ is used for the top eventof the fault tree (it has no parent and is denoted byX1

1;0) and it indicates that it is the first and the onlyevent of the first generation (Figure 1). In this analysis,the main event is the risk of WQF in distributionsystems. For clarity, in the remainder of this paper, thenotation for a basic risk event (an event with nochildren) will include an apostrophe at the generationindex, i.e., if event X3

1;1 is a basic risk event, it will bedenoted X30

1;1. Since every parent is preceded by a

junction, J, the notation for a junction is Jki;j, where i,j,k indices are the same as for the subsequent parent(Figure 1). Junction Jki;j represents a logical operatorthat can be either an ‘or’ gate or ‘and’ gate.

Figure 2 provides a full description of theproposed fault tree structure. As mentioned earlier,this structure is an extension of a hierarchicalstructure proposed in earlier work by Sadiq et al.(2004, 2007). The risk events (at generation 2) of thefault tree are water quality deterioration mechanismsincluding – water quality at POE, intrusion ofcontaminants, material deterioration, (un)purposefulcontamination, disinfectant loss and THM formation,permeation, and biofilm formation/ regrowth. Table 1lists the description of each risk event in the proposedfault tree.

In conventional fault tree analysis, basic riskevents are assigned crisp probabilities; however, suchprobabilities are often hard to come by due toinsufficient statistical data and knowledge. Conse-quently, such crisp probabilities may lead to ‘precise’but unrealistic results. In this paper we propose to usefuzzy linguistic probabilities (p) instead. These enableuncertainties to propagate throughout the structure ofthe fault tree.

3.2. Fuzzy set theory

Fuzzy logic provides a language with syntax andsemantics to translate qualitative knowledge intonumerical reasoning. The term computing with wordshas been introduced by Zadeh (1996) to explain thenotion of reasoning linguistically rather than withnumerical quantities. When evaluating events relatedto complex systems, decision-makers, engineers, man-agers, regulators and other stake-holders often viewrisk in terms of linguistic variables like very high, high,very low, low etc. Fuzzy set theory is able to describeeffectively these types of uncertainties (encompassingvagueness), and linguistic variables can be used toapproximate reasoning and subsequently be manipu-lated to propagate the uncertainties throughout thedecision process.

Fuzzy-based techniques are a generalized form ofinterval analysis. A fuzzy number describes therelationship between an uncertain quantity x and amembership function m, which ranges between 0 and1 (Zadeh 1965). Fuzzy-based techniques can help inaddressing deficiencies inherent in binary logic andare useful in propagating uncertainties throughmodels. Any shape of a fuzzy number is possible,but the selected shape should be justified by availableinformation. Generally, triangular fuzzy numbers(TFN) or trapezoidal fuzzy numbers (ZFN) areused for representing linguistic variables (Lee 1996).

Figure 1. Building blocks of hierarchical framework toperform risk analysis.

290 R. Sadiq et al.

Dow

nloa

ded

by [

Bra

ndon

Uni

vers

ity G

ST]

at 1

3:00

12

Apr

il 20

13

Let the probability (likelihood) of occurrence (p) bedefined by the triangular fuzzy number TFNp. Figure3 describes an 11-granular scale to define thelikelihood (p) for basic risk events (Lee 1996). Thisproposed scale includes 11 linguistic constants,namely, (1) absolutely low, (2) extremely low, (3)quite low, (4) low, (5) mildly low, (6) medium, (7)

mildly high, (8) high, (9) quite high, (10) extremelyhigh and (11) absolutely high. The objective of usingthis scale is to provide decision-makers moreflexibility in expressing their linguistic notions ofprobabilities. Figure 3 also provides a graphicaldepiction of the relationships between the TFNp andthe associated memberships. In addition, a nil event

Figure 2. Proposed fault tree for water quality failure in a distribution network.

Urban Water Journal 291

Dow

nloa

ded

by [

Bra

ndon

Uni

vers

ity G

ST]

at 1

3:00

12

Apr

il 20

13

(i.e. if some phenomenon is surely absent), thegranular (q) is assigned a TFNp (0, 0, 0). Forexample, assume that for a given scenario there areonly two types of pipe materials - plastic and metallic.If the water distribution system does not have plasticpipe, the likelihood (p) of a plastic pipe being presentis nil, and can be assigned a TFNp (0, 0, 0). On theother extreme, the likelihood (p) is absolute for ametallic pipe being present and can be assigned aTFNp (1, 1, 1). Each of the basic risk events can beassigned a fuzzy likelihood using this 11-granularsystem. The top table in Figure 6 (see later) providesan example of fuzzy probabilities assigned to basicrisk events.

3.3. Uncertainty in dependency relationships

As mentioned earlier, traditional fault tree analysisuses a default assumption of ‘independence’ among therisk events to determine the joint probability (risk) of aparent event. This assumption simplifies the analysis,but may not be very realistic.

The relationship between risk events may bepositively or negatively correlated (or independent).In the case of two independent events X and Y, the jointprobability of their conjunction is a simply a product oftheir individual probabilities (Ferson et al. 2004), or

PðX ^ YÞ ¼ xy ð1Þ

Figure 2. (Continued).

292 R. Sadiq et al.

Dow

nloa

ded

by [

Bra

ndon

Uni

vers

ity G

ST]

at 1

3:00

12

Apr

il 20

13

Table 1. Description of all risk events and fuzzy likelihood values (qi) assumed for basic risk events.

Event Name Description of risk event

Walkerton North Battleford

Baseline Outbreak Baseline Outbreak

X11;0

Water quality failure Overall risk evaluation

X21;1

WQ at POE Risk at the point-of-entry to the distributionsystem

X22;1

Intrusion ofcontaminants

Susceptibility of contaminants intrusion into thedistribution system

X23;1

Materialdeterioration

Potential material deterioration causing leachingand corrosion

X24;1

(un)purposefulcontamination

Vandalism, terrorism, also includes includenegligence in the form of insufficient monitoring

X25;1

Disinfection related Potential disinfectant loss and DBPs formation

X26;1

Permeation Permeation of contaminants through plasticmaterial

X27;1

Biofilm growth Potential growth of biological products andmicroorganisms

X31;1

Treatment adequacy Potential for inadequate treatment

X30

2;1Source water Raw water contamination potential 3 5 3 6

X33;2

Pathway Possible contaminants pathways

X30

4;2Loss of pressure Likelihood of pressure loss 2 2 2 2

X30

5;2Presence ofcontaminants

Likelihood of contaminants’ presence 1 4 1 4

X35;3

Leaching Potential for leaching from lining materials

X36;3

Internal corrosion Potential of corrosion of metallic distributionpipes/plumbing devices

X37;4

Vulnerability Vulnerability of the distribution system againstmalicious attacks

X30

8;4Threat Direct and indirect threats to the distribution

system2 2 2 2

X39;5

DBP Formation Potential for formation of disinfection by-products

X310;5

Disinfection loss Potential for disinfectant loss n the distributionsystem

X30

11;6Plastic Plastic material present or not 1 1 1 1

X30

12;6Hydro carbon Hydro carbons are present or not around the pipe 1 1 1 1

X30

13;6Conds. conducive tochemical permeation

Exposure of hydrocarbons to plastic material overlong time

1 1 1 1

X30

18;7Organic matter Presence of optimal organic matter for the growth

of biofilm1 2 1 1

X30

19;7Detention time The time water stays in the system (water age) 2 3 2 2

X30

20;7Conds. conducive tobiofilm formation

Temperature, nutrients etc. 2 3 2 2

X40

1;1Treatment units Conditions of the treatment units in the plant

before water enters the distribution system.3 7 4 7

X40

2;1Untrained staff Lack of knowledge, experience and education 4 7 4 8

X40

3;3Broken pipes &gaskets

Risk of water quality failure due to broken pipesand gaskets throughout the water distributionsystem

2 4 2 2

X40

4;3Maintenance andrepair events

Risk of water quality failure due to the intrusionof contaminants during maintenance and repairof pipes and other components of thedistribution system.

2 4 2 2

X40

5;3Cross-connections Risk of water quality failure due to the intrusion

of contaminants at the cross-connections of thedistribution system.

2 2 2 2

X40

6;5Metallic surface Risk of water quality failure due to leaching in the

absence of a metallic surface.11 11 1 1

X40

7;5Conds. conducive toleaching

Conditions conducive to leaching leading to riskof water quality failure.

1 2 2 2

X40

8;6Metallic surface Risk of water quality failure due to corrosion in

the presence of a metallic surface.11 11 1 1

(continued)

Urban Water Journal 293

Dow

nloa

ded

by [

Bra

ndon

Uni

vers

ity G

ST]

at 1

3:00

12

Apr

il 20

13

where x ¼ P(X) and y ¼ P(Y), and the symbol ‘^’denotes a conjunction. The joint probability of theirdisjunction is obtained using following equation:

PðX _ YÞ ¼ 1� ð1� xÞð1� yÞ ¼ xþ y� xy ð2Þ

where the symbol ‘_’ denotes a disjunction.We denote the interdependence of two events by

Pearson correlation r 2 [71, 1], where r ¼ 0 meanscomplete independence, r ¼ þ1 means perfect de-pendence (consonant events, likely influenced by thesame causes) and r ¼ 71 means opposite dependence(disjoint events). The strongest positive dependencebetween two events (r ¼ þ1) is when one eventensures the occurrence of another. When two eventsare mutually exclusive (r ¼ 71), one event ensuresthe absence of the other. Pearson correlation r canbe used to assign a level of inter-dependenciesbetween the two extremes opposite and perfect(Ferson et al. 2004). Figure 4 shows a possiblegraphical relationship between Pearson correlationand a linguistic dependence scale ranging from oppo-site to perfect.

A particular formulation for correlation is derivedfrom the Frank copula (1979). To formulate theprobability of a conjunction of two events using the

Frank model of correlation, the following equationis used

PðX ^ YÞ ¼

andFrankðx; y; rÞ ¼

min ðx; yÞ if r ¼ þ1x y if r ¼ 0

max ðxþ y� 1; 0Þ if r ¼ �1logs½1þ ðsx � 1Þðsy � 1Þ=ðs� 1Þ� otherwise

8>>>>><>>>>>:

ð3Þ

where s ¼ tan ðp ð1�rÞ4 Þ. This is a continuous functionand the limits are when r ¼ þ1, 0, or 71 as r tends tobe these values respectively. Similarly, disjunction oftwo events using the Frank model is:

PðX _ YÞ ¼ orFrankðx; y; rÞ

¼

max ðx; yÞ if r ¼ þ11� ð1� xÞð1� yÞ if r ¼ 0

min ðxþ y; 1Þ if r ¼ �11� logs½1þ ðs1�x � 1Þðs1�y � 1Þ=ðs� 1Þ� otherwise

8>>>>><>>>>>:

ð4Þ

Table 1. (Continued).

Event Name Description of risk event

Walkerton North Battleford

Baseline Outbreak Baseline Outbreak

X40

9;6Conds. conducive tocorrosion

Risk of water quality failure due to corrosionlikelihood of conditions conducive to corrosion.

2 3 1 1

X40

10;7Physical & Geo.vulnerability

Risk of water quality failure due to thesurrounding physical and geographicalvulnerability of the system.

2 2 1 3

X40

11;7Insufficientmonitoring

Risk of water quality failure due to insufficientmonitoring in a distribution system.

3 4 3 5

X40

12;9Organic matter Risk of water quality failure due to DBP

formation likelihood of organic matter.1 2 1 2

X40

13;9Concentration ofresidualdisinfectant

Risk of water quality failure due to DBPformation under likelihood of residualdisinfectant.

2 3 2 2

X40

14;9Conds. conducive toDBP formation

Risk of water quality failure due to DBPformation under likelihood of conduciveconditions.

2 3 2 3

X40

15;10Organic matter Risk of water quality failure related to

disinfectant loss under likelihood of organicmatter.

1 2 1 2

X40

16;10Concentration ofresidualdisinfectant

Risk of water quality failure related todisinfectant loss under likelihood of residualdisinfectant.

2 3 2 2

X40

17;10Conds. conducive todisinfectant loss

Risk of water quality failure related todisinfectant loss under likelihood of conduciveconditions.

2 3 2 3

*Shaded boxes represent the risk events that have children. The fuzzy likelihood of these risk events is calculated while propagating uncertaintiesthrough the fault tree.

**The number assigned for basic risk events are based on the 11-granular system and represents the fuzzy likelihood as shown in Figure 3.

294 R. Sadiq et al.

Dow

nloa

ded

by [

Bra

ndon

Uni

vers

ity G

ST]

at 1

3:00

12

Apr

il 20

13

There exist many different methods to expresscorrelation (dependence) but the Frank model (copula)is the most common. It is selected to expressdependencies among risk events in the proposed faulttree analysis. Although exact correlation (r) is rarelyavailable, meaningful analysis can be performed even ifthe type (sign) of correlation is known e.g., ‘positive’(r 2 [0, þ1]) or ‘negative’ (r 2 [0, 71]). In the case ofcompletely unknown correlation, the Frechet’s limitr 2 [71, þ1] can be used to represent the maximumuncertainty in dependence relationships. Figure 5demonstrates various types of possible dependencyrelationships as a function of the correlation coefficientusing Frank model (Ferson et al. 2004).

Figure 6 provides an example in which the samplefault tree depicted in Figure 1 is analyzed. Final riskvalues (R) are shown using trapezoidal fuzzy number(ZFN), and a summary of results is provided in thetable of Figure 6. A total of 10 trials are performed,

using different assumptions of dependencies. A fewpoints should be noted. Trial 6 represents the highestuncertainty related to interdependencies among riskevents, which results in a maximum uncertainty in thecalculated risk. Similarly, Trial 1 represents the lowestuncertainty related to interdependencies among riskevents, which results in the lowest uncertainty in thecalculated risk. Positively dependent risk events resultin higher risk and negatively dependent events tend toreduce the calculated risk. These last two points can beintuitively understood.

3.4. Interpretation of calculated risk

Two measures – similarity measure (S) and entropy (E)are employed to interpret the final results of the analysis.The similarity measure is an empirical value thatindicates which of the 11 failure likelihoods, shown inFigure 3 has the closest resemblance to the calculated

Figure 3. A scale of fuzzy likelihood of a failure (after Sadiq et al. 2004).

Urban Water Journal 295

Dow

nloa

ded

by [

Bra

ndon

Uni

vers

ity G

ST]

at 1

3:00

12

Apr

il 20

13

risk R. The similarity measure is calculated using thereciprocal of the absolute averaged distance between thecalculated fuzzy number, and each of the 11 granulars qi.

S ¼MAXðsiÞ; where

si ¼1

½ d� aij j þ e� bij j þ f� bij j þ g� cij j�=4;

i ¼ 1; 2; :::; 11

ð5Þ

where [d, e, f, g] represents the calculated risk R asZFN, and [ai, bi, ci, di] represents the granular qi asZFN (for TFN, bi ¼ ci).

The calculated risk R is assigned a linguisticconstant based on qi, which corresponds to MAX(si),i.e., the granular with the highest similarity. The tablein Figure 6 provides similarities for all 10 trials.

Entropy E represents a spread or variance of thecalculated risk R. Entropy E is simply described by a

Figure 4. Correlation and dependency relationship.

Figure 5. Uncertainty in dependencies represented as a function of correlation (r).

296 R. Sadiq et al.

Dow

nloa

ded

by [

Bra

ndon

Uni

vers

ity G

ST]

at 1

3:00

12

Apr

il 20

13

convex set of granulars qi (linguistic constants), whichintersect with the calculated risk R and can bemathematically written as:

E ¼[

R\qi 6¼fq

ið6Þ

Entropy (E) describes the uncertainty in the finalrisk value and consists of a set of linguistic constantsthat R spans. For example, in trial 6, the final risk is(most similar to) quite low (QL), but can vary fromabsolutely low (AL) to mildly low (ML) (Figure 6).

It should be noted that in this paper we have notprovided a detailed description of the fault tree

analysis procedure. This is a well-established proce-dure that is provided in detail in many textbooks, e.g.,see Vesely (1987). Rather we focused on the impact ofinterdependencies of contributing factors (events) onthe final risk results using fault tree analysis procedure.

4. Case studies

4.1. Walkerton (Ontario)

Walkerton is a community of about 5000 people withinthe Municipality of Brockton in Bruce County, north-west of Toronto. It is principally an agricultural area.In mid May 2000, Walkerton experienced one of themost detrimental episodes of WQF in recent years.

Figure 6. Risk analysis results for an example.

Urban Water Journal 297

Dow

nloa

ded

by [

Bra

ndon

Uni

vers

ity G

ST]

at 1

3:00

12

Apr

il 20

13

More than 2300 people were affected by contaminatedwater originating from the water distribution systemsin and around the Walkerton municipality. Theaffected population showed symptoms of gastrointest-inal illness caused by E. coli (O157:H7). The bacteriaexist in both human and animal intestines, and areusually derived from fecal matter (Zhao 2002).

Health officials issued a boiled water advisory oncethey started receiving reports from local doctors aboutbloody diarrhea cases. Water samples taken during thecrisis were tested by the Public Health laboratory andconfirmed that the drinking water was contaminatedwith E. coli. Further, the water utility for Walkerton(Grey-Bruce Regional Health Unit) confirmed that thechlorinator had not been properly functional in thepast for an undetermined period of time. By the end ofMay, seven deaths related directly to this bacterialoutbreak were recorded. Medical experts declared thatthe Walkerton outbreak was the world’s second worstinstance of E. coli (O157:H7) contamination spreadthrough drinking water. The forensic investigation intothe incident found that cattle manure from a neigh-bouring farm washed off during heavy rainfall andcontaminated Well #5 of the Walkerton PublicUtilities Commission (WPUC).

At the time of the incident, the town’s drinkingwater supply came from a groundwater supply fedfrom three drilled wells, identified as well #5, #6, and#7 (Zhao 2002). Each well had a chlorination unit. Thewells supplied water through a distribution system ofabout 42 km in length (50-400 mm in diameter) andtwo system storage facilities.

The outbreak occurred due to a combination offactors; the principal contributing risk events are theintrusion of contaminants into the distribution system,vulnerability of the system, inadequate treatment, and(un)purposeful contamination (i.e., negligence andinsufficient monitoring) due to negligence and disre-gard for public safety.

The intrusion of contaminants into the system wascaused by the contamination of well #5 due to surfacewater runoff from the surrounding agricultural activ-ity, which occurred during heavy rainfall (Zhao 2002).The surface water runoff became contaminated withE. coli bacteria originating from calf faeces. Well #5was nearer to the surrounding agricultural activitythan well #6 and #7. Therefore, the vulnerability of well#5 in terms of physical and geographical conditionswas relatively high.

The wells were insufficiently monitored and rawwater samples were not taken at the required 10-daysintervals (Woo and Vicente 2002). It was noted thatchlorine residuals were not monitored daily as requiredand the residual monitoring records incorrectlyshowed residuals exactly of 0.5 mg/L and 0.75 mg/L

(Hrudey et al. 2003). Poor laboratory results wereconcealed and modified (Woo and Vicente 2002). Theinquiry revealed that chlorine treatment at well #5 wasinadequate and consequently poorly disinfected waterwas entering the water distribution network.

The water treatment plant had improperly trainedstaff (as in many small communities), which contrib-uted to poor water quality testing and monitoring aswell as reporting of false data (Woo and Vicente 2002).Other possible causes included pipe installations,broken pipes that were later repaired, cross-connec-tions at private wells, loss of pressure due to a fireevent, and potential contamination of two waterstorage standpipes (Hrudey et al. 2003).

4.2. North Battleford (Saskatchewan)

In April 2001, North Battleford experienced anoutbreak of C. parvum affecting a community ofapproximately 14 000 people (Office of LaboratorySecurity 2001). There were approximately 5800-7100reported cases of diarrheal illness linked to thisincident. A commission of inquiry stated that a majorcontributing factor was a high concentration of faecalmatter found in the source water. The faecal matteroriginated from neighbouring agricultural activityand was known to contain high concentrations ofC. parvum (Woo and Vicente 2003).

A second possible contributing factor was identifiedas the location of the sewage treatment plant. The plantwas located 3500m upstream of the raw water intake.Results from studies conducted by the SaskatchewanEnvironment and Resource Management (SERM)indicated that the geographical conditions were favour-able to allow the sewage to migrate toward the waterintake. It was reported, ‘ . . . the topology of the area,along with river turbidity and flow caused the sewageeffluent to reach the surface more often than not’ (Wooand Vicente 2003). Consequently, the C. parvumoutbreak may have occurred in part because ofcontamination of the raw surface water.

There were two water treatment facilities in NorthBattleford. The groundwater treatment system wascomprised of chlorination and filtration, whereassurface water treatment system comprised flocculation,sedimentation, sand filtration, and chlorination. Con-sequently, a third possible source of contaminationwas identified as insufficient treatment related to thesolids contact unit (SCU) of the surface watertreatment plant. It can be concluded that it was afailure of multi-barriers to protect the drinking watersupplies from contamination.

Woo and Vicente (2002) reported, ‘ . . . the majorcontributing factor [at the technical and operationalmanagement level] dealt with the lack of education and

298 R. Sadiq et al.

Dow

nloa

ded

by [

Bra

ndon

Uni

vers

ity G

ST]

at 1

3:00

12

Apr

il 20

13

a culture of non-compliance’. Further, there wasinadequate treatment at the time of the outbreak. Asmentioned earlier, small rural communities often donot have the best technological equipment and know-how. Consequently, the SCU of the surface watertreatment plant was not functioning at the requiredlevel, causing poor settling (Stirling et al. 2001). Therewas evidence that floc formation in the SCU had notbeen established prior to the outbreak in April 2001(Woo and Vicente 2002). This made it possible forC. parvum to pass into the finished drinking water. Inaddition, the treatment units were found to be in poorcondition due to the aging of the surface watertreatment plant. The Commission report stated,‘ . . . components of the surface water treatment werediscovered to be either missing or offline prior to theoutbreak’ (Woo and Vicente 2002).

The subsequent analyses in this paper intend toillustrate the effects of the contributing risk events andtheir associated interdependencies on the overall riskof water contamination in distribution networks inboth case studies.

4.3. Examination procedure

The risk events selected for inclusion in the two casestudies for outbreak scenarios were intrusion ofcontaminants, treatment adequacy, (un)purposeful con-tamination, vulnerability of the system with respect tophysical/geographical conditions. In each case study,fuzzy likelihood values assigned to the basic risk eventswere fixed for all outbreak scenarios, but the depen-dency assumptions were varied to investigate theimpacts of unknown dependencies on the risk analysis.

4.3.1. Baseline scenario

For each case study, a baseline scenario was estab-lished, which represents normal operating conditions(not considering the outbreaks). A baseline scenariosets a benchmark, against which three outbreakscenarios (per case study) were subsequently examined.

It should be noted that relatively large uncertainties(related to input values for basic risk factors) wereanticipated in the baseline scenarios. Ironically, therewas less uncertainty involved in the outbreak scenariosdue to the rigorous investigations that ensued. Table 1provides the fuzzy likelihood values (defined based onthe 11-granular system) assigned to each basic riskevent for baseline scenarios for the two case studies.

4.3.2. Interdependencies in baseline scenario

Interdependencies in baseline scenarios were assumedonly for basic risk events as provided in Table 2.

An independence assumption was made for all higher-level risk events. In addition for simplicity, interde-pendencies among non-relevant basic risk events werealso assumed independent (r ¼ 0).

4.3.3. Outbreak scenarios and interdependencies

Three outbreak scenarios were explored for each of thetwo case studies where various levels of dependencieswere assigned to explore conditions at the time of eachoutbreak. The differences between these outbreak scena-rios were related only to variations in the interdepen-dency assumptions. Table 1 provides the fuzzy likelihoodvalues (defined on the 11-granular system) assigned toeach basic risk event for all the outbreak scenarios.

For example, based on a notion that there is arelationship between vulnerability and threat, positiveweak dependency was assumed for ‘family’ (un)purpo-seful contamination (Figure 2). It can be argued thatvulnerability of the system due to insufficient monitoringmay possibly increase the likelihood of threat such asvandalism. Similarly, vulnerability due to physical/geographical conditions of the system (e.g. proximity toindustrial activity or hospital) may entice sabotage orother forms of threats to the system. Similarly, positivemildly strong dependency was assumed between theadequacy of treatment units and untrained staff (it isgenerally observed that small communities havelimited resources for highly trained staff and theyalso lack sophisticated treatment). As mentionedearlier, the set of dependencies for the three outbreakscenarios are modified for risk events like contaminantintrusion, treatment adequacy, deliberate acts and thesystem vulnerability.

Scenario 1 (Sc1) assumed the same set of depen-dencies as that of the baseline scenario, i.e., two of thefour risk events had some form of positive dependency,while for the other two no information was assumed. InSc2, the set of dependency of all major risk events wereassumed positive strong. Sc3 was investigated as aworst-case scenario where the least amount of infor-mation, i.e. no information was provided for thedependencies. Table 3 provides a summary of thedependencies assumed for risk events of the fault treefor baseline and outbreak scenarios.

4.4. Risk analyses results

4.4.1. Walkerton

The results of all outbreak scenarios are superimposedgraphically in Figure 7, to enable easy comparison withthe baseline scenario. In Sc1, the calculated risk is[0.26, 0.51, 0.57, 0.78], clearly higher than the baselinerisk of [0.02, 0.20, 0.20, 0.47]. This corresponds to a

Urban Water Journal 299

Dow

nloa

ded

by [

Bra

ndon

Uni

vers

ity G

ST]

at 1

3:00

12

Apr

il 20

13

Table 3. Summary of interdependencies assumptions among risk events for both case studies.

Dependency assumptions

Junction Description Gate Baseline Sc 1 Sc 2 Sc 3

J11;0 Risk of water qualityfailure

OR Independent Independent Independent Independent

J21;1 Water Quality at POE AND Independent Independent Independent Independent

J22;1 Intrusion ofcontaminants

AND No Info No Info Positive Strong No Info

J23;1 Material deterioration OR Independent Independent Independent Independent

J24;1 (un)purposefulcontamination

AND Positive M. Strong Positive M. Strong Positive Strong No Info

J25;1 Disinfection OR Positive M. Strong Positive M. Strong Positive M. Strong Positive M. Strong

J26;1 Permeation AND Independent Independent Independent Independent

J27;1 Biofilm growth AND Independent Independent Independent Independent

J30

1;1Treatment adequacy AND Positive V. Strong Positive V. Strong Positive Strong No Info

J33;2 Pathway OR Independent Independent Independent Independent

J35;3 Leaching AND Independent Independent Independent Independent

X36;3

Internal corrosion AND Independent Independent Independent Independent

J37;4 Vulnerability OR No Info No Info Positive Strong No Info

J39;5 DBP formation AND Independent Independent Independent Independent

J310;5 Disinfectant loss AND Independent Independent Independent Independent

Note: Highlighted events are identified as major risk events.

Table 2. Assumed interdependencies among risk events for ‘baseline’ scenario for both case studies.

Junction Description Gate Dependence Justification

J11;0 Risk of water qualityfailure

OR Independent No correlation between second-generation riskevents.

J21;1 Water Quality atPOE

AND Independent No correlation between treatment adequacy andsource water

J22;1 Intrusion ofcontaminants

AND Independent No correlation between third generation riskevents.

J23;1 Materialdeterioration

OR Independent No correlation between leaching and corrosion.

J24;1 (un)purposefulcontamination

AND Positive Weak Vulnerability of the system encourages threat.

J25;1 Disinfection OR Positive M. Strong Low value correlation between DBP formationand disinfectant loss (inversely proportional).

J26;1 Permeation AND Independent Third generation events are independent of eachother, e.g., detention time does not affecttemperature.

J27;1 Biofilm growth AND Independent No correlation between third generation riskevents.

J30

1;1Treatment adequacy AND Positive M. Strong Poor treatment units because of probability of

untrained staff in smaller communities.J33;2 Pathway OR Independent Third generation events are dependant of each

other. Maintenance and repair events increasethe probability of broken pipes and gaskets.

J35;3 Leaching AND Independent No correlation between third generation riskevents for leaching.

J36;3 Internal corrosion AND Independent No correlation between third generation riskevents.

J37;4 Vulnerability OR Independent No correlation between physical/geographicalvulnerability of the system and insufficientmonitoring.

J39;5 DBP formation AND Independent No correlation between third generation riskevents.

J310;5 Disinfectant loss AND Independent No correlation between third generation riskevents.

Note: Highlighted events are the identified as major risk events.

300 R. Sadiq et al.

Dow

nloa

ded

by [

Bra

ndon

Uni

vers

ity G

ST]

at 1

3:00

12

Apr

il 20

13

medium risk (based on the similarity measure asdefined in section 3.2) of a WQF in the distributionsystem. This higher risk of Sc1 is due only to the basicrisk event uncertainties, since Sc1 has the same set ofdependencies as the baseline scenario. The entropy ofSc1 is quite low to high.

In Sc2, the entropy increases to quite low to extremelyhigh. The increase in entropy suggests that the assump-tion of positive dependency increases the uncertaintysignificantly. The calculated risk is mildly high andranges from 0.28 to 0.84. In this scenario, the resultinghigher risk is due to a combination of the basic riskevents uncertainties and the particular set of dependen-cies. In Sc3, complete ignorance is assumed about therelevant interdependencies, resulting in calculated riskdescribed by a ZFN [0.23, 0.46, 0.65, 0.83]. The overallrisk ismildly high and the total entropy ranges from quitelow to extremely high. The table in Figure 7 provides asummary of risk estimates and associated entropy resultsfor all scenarios of the Walkerton case study.

4.4.2. North Battleford

A similar set of dependencies is assumed for NorthBattleford. The input likelihood (i.e. for basic risk

events) is different, however, based on the conditionsspecific to North Battleford present at the time of theoutbreak. For instance, the estimated risk associatedwith treatment in Walkerton is quite low (based onsimilarity measure) while for North Battleford it isestimated to be low. Evidence during the inquiry of theoutbreak in North Battleford revealed that inadequatetreatment units of the water treatment plant contrib-uted to the increased risk. The units were practicallyobsolete or functioning at sub-optimal levels due to theage of the treatment plant.

Figure 8 illustrates the results of all scenarios in theNorth Battleford case study. In Sc1, the calculated riskR of WQF in the distribution systems is described by aZFN [0.27, 0.42, 0.49, 0.70], which can be interpretedas medium risk. The entropy is found to be between lowto quite high.

The entropy for Sc2 increases to quite low to quitehigh. This reinforces the notion that there is a slightlyhigher uncertainty associated with positive dependen-cies. The risk R remains medium and ranges from 0.30to 0.71. Since the risk does not increase significantlyfrom Sc1 as is observed in the Walkerton case study, itis assumed that in this case positive dependencies haveonly a limited impact on the calculated risk.

Figure 7. Risk analysis results for Walkerton (ON).

Urban Water Journal 301

Dow

nloa

ded

by [

Bra

ndon

Uni

vers

ity G

ST]

at 1

3:00

12

Apr

il 20

13

In Sc3, the risk R remains medium and is describedby a ZFN [0.24, 0.35, 0.60, 0.76]. Entropy is quite lowto quite high, as in Sc2. In this case, no significantdifference in the risk R emerges when the assumptionsfor dependencies are changed. It appears that the riskevents with relatively high likelihood overshadow otherevents, which results in a similar risk R. The table inFigure 8 contains a summary of the calculated risk Rand associated entropy E for all simulated scenariosfor the North Battleford.

5. Conclusions

Water in distribution networks can be contaminated viaseveral pathways and the quantification and character-ization of this risk is a complex process. Thousands ofkilometres of pipes of different ages and materials,uncertain operational and environmental conditions,unavailability of reliable data, and lack of understandingof some factors and processes affecting pipe performancemake predicting the risk of distribution system failureextremely challenging. These complexities alsomake riskanalysis for a water distribution system highly uncertain.

Two types of uncertainties were explored using afault tree analysis of a WQF in distribution systems.

The first was uncertainty with respect to the basic riskevents, and the second was uncertainty with respect tointerdependencies among risk events. A range ofvalues was defined based on informed assumptionsand empirical estimates. Interdependencies werevaried in the analysis to understand the relationshipsamong risk events and the impact of these assump-tions on the final calculated risk. The input values ofthe events were represented by fuzzy probabilities(likelihood). Frank copula and Frechet’s limit wereused to described uncertainties in interdependenciesamong risk events. The interpretation of risk analysisresults was carried out using similarity and entropymeasures.

The proposed approach was applied to two casestudies – Walkerton (Ontario) and North Battleford(Saskatchewan). Factors contributing to WQF wereassumed to be comprised of water quality at POE,intrusion of contaminants into the distributionsystem, material deterioration, (un)purposeful con-tamination, and water quality deterioration related todisinfection, and biofilm regrowth. In the case ofWalkerton, the calculated risk was at the most mildlyhigh, but entropy was quite low to extremely high inthe three outbreak scenarios. In North Battleford,

Figure 8. Risk analysis results for North Battleford (SK).

302 R. Sadiq et al.

Dow

nloa

ded

by [

Bra

ndon

Uni

vers

ity G

ST]

at 1

3:00

12

Apr

il 20

13

similar observations were made, though the calculatedrisk remained medium for all three scenarios ofoutbreak.

The calculated risk values, R, for the differentoutbreak scenarios in the two case studies were mostlymedium. Overall, the lower estimates of R wereprimarily attributed to smaller values of the fuzzylikelihood assumed for the basic risk events. Both WQFevents were primarily linked to the ‘point of entry’contamination, therefore comparatively higher like-lihood values of basic risk events were assumed in thatcategory. There was no enough evidence to makeassumptions of higher likelihood values for other basicrisk events. Even though events have already happenedand proved to culminate in major outbreaks, this doesnot imply that the risk analysis results obtained in thisstudy are not valuable. Rather, this analysis furtherenhances the importance and underscores the need formore comprehensive risk analysis with considerationof different types of uncertainties including a thoroughinvestigation of the structure of the fault tree and theassumed logical relationships among various riskevents as proposed in this paper.

Note that the calculated risk values, R, representonly the most likely estimates and should be inter-preted with entropy (E) results, which account foruncertainties. The uncertainties were considerablylarge in both case studies. For example in Scenario 3,the estimated risk was as high as Extremely High andQuite High for Walkerton and North Battleford casestudies, respectively. Risk-based decision-making is aprocess of identifying necessary and appropriateactions. The proposed risk-based methodology pro-vides an effective tool for water utilities to makeinformed decisions. It offers a scientifically rigorousand administratively effective way to respond to thepressures in a timely way. Therefore, even thecalculated risk were mostly medium, the conservativeestimates were alarming, and required swift actionsfrom the water utilities. Further, it is important torecognize that risk-based decision-making should notintended to be just a cost-saving tool, rather should beused to prioritize the rehabilitation and correctiveactions required.’

A major advantage of the proposed methodology isthat it can accommodate both qualitative and quanti-tative data. Some data may be supported by rigorousobservations, while other data may be based on looselysupported or anecdotal-based beliefs. These two typesof data should have different weights in the aggrega-tion and uncertainty propagation process. The ap-proach can also accommodate and process dataobtained from sources of different reliabilities. Thesetwo aspects are not discussed in this paper and are thesubject of future research.

References

American Water Works Association (AWWA), 2007. Chlor-ine Disinfectants/Disinfectant By-Products (DBPs) [on-line] Available from: http://www.awwa.org/Advocacy/pressroom/dbps.cfm (Accessed 8 May 2007).

Edge, T., et al., 2003. Waterborne Pathogens. Canada:National Water Research Institute.

Ferson, S., et al., 2004. Dependence in Dempster-ShaferTheory and Probability Bounds Analysis. US: SandiaNational Laboratories.

Frank, M., 1979. On the Simultaneous Associativity of andF(x, y) and x þ y- F(x, y). Aequationes Mathematicae,19, 194–226.

Geldreich, E.E., 1990. Microbiological quality control indistribution systems. In: W.P. Frederick, ed. WaterQuality and Treatment. New York: American WaterWorks Association, McGraw-Hill.

Holsen, T.M., Park, J.K., Jenkins, D., and Shelleck, R.E.,1991. Contamination of potable water by permeation ofplastic pipe. Journal of American Water Works Associa-tion, 83 (8), 53–56.

Hrudey, S.E., et al., 2003. A fatal waterborne diseaseepidemic in walkerton, ontario: comparison with otherwaterborne outbreaks in the developed world. WaterScience and Technology, 47 (3), 7–14.

Kirmeyer, G.J., et al., 2001. Pathogen intrusion into distribu-tion system. Denver, Colarado: AWWARF.

Kleiner, Y., 1998. Risk factors in water distribution sys-tems. British-Colombia Water and Waste Association26th Annual Conference, Whistler, British-Columbia, 26–29 April 1998.

Lee, H.-M., 1996. Applying fuzzy set theory to evaluate therate of aggregative risk in software development. FuzzySets and Systems, 79, 323–336.

Li, H., 2007. Hierarchical risk assessment of water supplysystems. Thesis (PhD). Loughborough University,Leicestershire.

Maier, S.H., 1999. Modeling water quality for water distribu-tion systems. Thesis (PhD). Brunel University, Uxbridge.

Ming-Hung, S., et al., 2006. Using intuitionistic fuzzy sets forfault-tree analysis on printed circuit board assembly.Microelectronics Reliability, 46 (12), 2139–2148.

Office of Laboratory Security, 2001. Material Safety DataSheet – Infectious Substances. Public Health Agency ofCanada [online]. Available from: http://www.phac-aspc.gc.ca/msds-ftss/index.html [Accessed 7 May 2007).

Sadiq, R., Kleiner, Y., and Rajani, B., 2004. Aggregative riskanalysis for water quality failure in distribution net-works. Journal of Water Supply Research and Technol-ogy: Aqua, 53 (4), 241–261.

Sadiq, R., Kleiner, Y., and Rajani, B., 2007. Water qualityfailures in distribution networks – risk analysis usingfuzzy logic and evidential reasoning. Risk Analysis – AnInternational Journal, 27 (5), 1381–1394.

Stirling, M.D., et al., 2001. Waterborne CryptosporidiosisOutbreak North Battleford, Saskatchewan, Spring 2001,Public Health Agency of Canada (PHAC), CanadaCommunicable Disease Report, Vol. 27-22, 15 November2001 [online]. Available from http://www.phac-aspc.gc.ca/publicat/ccdr-rmtc/01vol27/dr2722ea.html [Acces-sed 7 May 2007].

The Bonn Charter of Safe Drinking Water, 2004. Interna-tional Water Association (IWA), September 2004, p. 18.

Thompson, C. and Jenkins, P., 1987. Review of water industryplastic pipe practices. Denver, Colorado: AWWARF.

Urban Water Journal 303

Dow

nloa

ded

by [

Bra

ndon

Uni

vers

ity G

ST]

at 1

3:00

12

Apr

il 20

13

Vesely, W.E., 1987. Fault tree handbook, Nuclear RegulatoryCommission, 218.

Woo, D. and Vicente, K.J., 2003. Socio-technical systems,risk management, and public health: comparing theNorth Battleford and Walkerton Outbreaks. ReliabilityEngineering and Safety Systems, 80 (3), 253–269.

Zadeh, L.A., 1965. Fuzzy sets. Information and Control, 8 (3),338–353.

Zadeh, L.A., 1996. Fuzzy logic computing with words. IEEETransactions of Fuzzy Systems, 4 (2), 103–111.

Zhao, Z., 2002. Risk Analysis of the Walkerton DrinkingWater Contamination Tragedy. Thesis (Masters). Uni-versity of Waterloo, Ontario, Canada.

304 R. Sadiq et al.

Dow

nloa

ded

by [

Bra

ndon

Uni

vers

ity G

ST]

at 1

3:00

12

Apr

il 20

13