Methods for risk analysis of drinking water systems from source to tap

(1)

Methods for risk

analysis of drinking

water systems from

source to tap

-

Guidance report on Risk Analysis

(2)

TECHNEAU is an Integrated Project Funded by the European Commission under the Sixth Framework Programme, Sustainable Development, Global Change and Ecosystems Thematic Priority Area

(contractnumber 018320). All rights reserved. No part of this book may be reproduced, stored in a database or retrieval system, or published, in any form or in any way, electronically, mechanically, by print, photoprint, microfilm or any other means without prior written permission from the publisher

TECHNEAU

(3)

This report is: PU = Public

Colofon

Title

Methods for risk analysis of drinking water systems from source to tap - Guidance report on Risk

Analysis

Authors

P. Hokstad1_{, J. Røstum}1_{, S. Sklet}1_{, L. Rosén}2_,

T.J.R. Pettersson2_{; A. Linde}2_{, S. Sturm}3_{, R. Beuken}4_, D. Kirchner6_{, C. Niewersch}6

1_SINTEF

2_{Chalmers University of Technology} 3_TZW 5_KWR 6_{RWTH Aachen} Quality Assurance By LNEC and KWR Deliverable number D 4.2.4

(4)

(5)

Summary

This report is a deliverable of Work Area 4 (WA4) – Risk Assessment and Risk Management in the TECHNEAU project. The main objective of WA4 is to integrate risk assessments of the separate parts in drinking water supplies into a comprehensive decision support framework for cost-efficient risk management in safe and sustainable drinking water supply.

The present report gives an introduction into risk analysis methods for water supply, from source to tap. It describes which problems can be addressed by the various methods. The capabilities and restraints of the methods and typical results of the analyses are presented. This report is focussing on informing staff of water utilities on the available methods for risk analysis.

The report will refer to the TECHNEAU Case studies and other literature to give details on the various risk analysis methods. It also refers to the TECHNEAU Hazard Data Base (THDB) and to the TECHNEAU report, “Generic framework and method for integrated risk management in water safety plans”.

Various decision situations where use of risk analysis is relevant are presented,

demonstrating typical objectives for carrying out risk analyses. There could for instance be a need of:

• An initial analysis, prior to the start up of water utility as a basis for design of the supply system;

• Cost/benefit considerations to identify the best risk reducing alternative; • An analysis driven by identified problems related to water quality or water

availability;

• An analysis imposed by rebuilding or operational changes of the utility. The main steps of a complete risk analysis are discussed:

• Scope / analysis objective • System description

• Identification of hazards and hazardous events

• Estimation of risk (probabilities and consequences). Consequences with respect to both water quality and water quantity are considered.

The report describes a Coarse Risk Analysis (CRA), being a total risk analysis, including hazard identification and risk estimation, with the results presented in a risk matrix. This is a relatively simple analysis, and could be carried out by most water utilities with some assistance from risk analysts. In Chapter 7 a summary of all risk analysis methods is presented.

However, several of the other risk analysis methods will require deeper knowledge and experience with the risk analysis techniques, and should be carried out by professionals in close cooperation with water utility personnel.

Several of these more complex analyses are described in the last part of the report. Possible objectives of these more advanced methods are described. It can for instance be to analyse

(8)

the causes of hazardous/undesired events, the consequences of these events, to assess the availability of water to various consumers (distribution network analysis), to analyse the effect of human errors on system reliability, and to perform maintenance “optimisation”, etc.

The report discusses various ways to quantify relevant aspects of risk for water supply. The data needed to perform risk analyses are also described.

This risk analysis report will not in any detail treat the risk acceptance and risk evaluation steps of risk assessment.

(9)

1 Introduction

1.1 Objective and scope

The main objective of Work Area 4 (WA4) – Risk Assessment and Risk Management in TECHNEAU is [1]: to integrate risk assessments of the separate parts into a comprehensive decision support framework for cost-efficient risk management in safe and sustainable drinking

water supply. The goals in WA 4 are also to provide tools and guiding documents for water

utilities carrying out risk assessment and risk management. A number of the tools are also tested in case studies and are disseminated through training seminars. A conceptual schematic of the framework, guidance reports (like this) and tools that is to be produced in WA 4 is presented in Figure 1 and the present guidance report is the Methods for Analysing Risk.

Figure 1. A conceptual schematic of the framework, guides and tools that is produced in WA 4 with this report Methods for Analysing Risks put into the context.

This report is based on the TECHNEAU report [2] “Generic Framework and Methods for Risk Management in Water Safety Plans”, where risk management is discussed, and also some risk analysis method are described. The present report provides a more complete overview of risk analyses methods for water utilities. The main target groups of the report are management and operational personnel of water utilities with some basic

understanding of the main concepts of risk management.

The present report aims at demonstrating the application of various risk analysis methods for water utility systems. Thus, it can serve as a guide to the management of a water utility regarding which analyses are most relevant in various decision situations. The report is intended to give insight into the capabilities, the use and potential results of the various methods for risk analysis. However, the report will not give all details of the various

(10)

utilities (at least the smaller ones) may need support from risk analysts/consultants in order to apply many of the methods described here.

Within TECHNEAU we define the term water safety as

“Water supply that protects water availability and human health with a high degree of practical certainty”

that comprises both loss of water quality and water quantity, and the report covers both these aspects of risk. The report focuses on risk analysis, and will not go into any detail on

risk evaluation and risk reduction and control, but will be presented in later reports. Risk evaluation has already been briefly discussed within WA4 [2].

Within WA4 six case studies are carried out at different water supply systems. In these case studies the applicability of various methods for RA is tested. The results of these case studies have been integrated into this report and are described more into detail in the various case study reports, notably:

• Bergen – Coarse Risk Analysis (CRA), [65].

• Göteborg – Quantitative and probabilistic method based on a fault tree analysis, [31].

• Amsterdam –Network simulation model and Bayesian belief networks, [73]. • Freiburg-Ebnet – GIS (Geographic Information System) Assisted Risk Analysis

(GARA-method), [63].

• Březnice – CRA and a Failure Modes and Effect Analysis (FMEA), [74].

• Upper Nyameni – CRA and the South African Risk Evaluation Guidelines, [75].

1.2 Content of the report

Figure 2 gives an overview of the various topics described in this report,(Section/Chapter no. in parenthesis). First some basic background information is given; (see top box in Figure 2):

• The TECHNEAU framework for risk management, showing that risk analysis is an integrated part of risk management, (Section 1.3).

• Definitions of risk analysis terms, (Section 1.4). • Abbreviations used, (Section 1.5).

Further, the main tasks of risk analysis (middle boxes in Figure 2):

• Chapter 2 gives an overview of the integrated approach to a complete risk analysis of a water utility. First some relevant decision situations for carrying out a risk analysis are given. The analysis will include description of the total system, identification of hazardous events and finally risk estimation.

• Chapter 4 describes various ways to quantify and measure1_{different risks to a water} utility.

• Chapter 5 discusses data needed to carry out a risk analysis.

In the lower box in Figure 2 various risk analyses methods are listed and described in the report.

1

(11)

First, Chapter 3 describes a complete “coarse” risk analysis (CRA), including both hazard identification and risk estimation. In the CRA this often restricts to a semi-quantitative risk estimate, giving probability and consequence categories. A CRA is often the first risk

analysis to be carried out for a utility, and when a CRA has been carried out, the water utility should have a rough picture of the main risks. However, the need of more detailed analyses of critical events/subsystems can be identified.

In Chapter 6 we describe several of the more advanced risk analysis methods that could be relevant for a more detailed investigation of the risk related to a water utility. Thus,

Chapter 6 can then be seen as a Part II of the report, advanced level of risk analysis, for readers that have some additional background in the risk and reliability concepts.

Therefore, these more advanced risk analysis techniques will not directly apply to ordinary water utility personnel but for the interested reader. The advanced methods are, (illustrated in the lower part of Figure 2):

(12)

• Hazard and operability (HAZOP) analysis, being a rather elaborate method for hazard identification, (Section 6.2).

• Failure Mode, Effects and Criticality Analysis (FMECA), a systematic way to identify and document the failure modes (and consequences of failure) of a specified system, (Section 6.3).

• Analysis of the efficiency of treatment systems, in order to identify proper method for water treatment applying FMECA, (Section 6.4).

• Fault Tree Analysis (FTA), a systematic approach to “break down a failure event into its “causes”/contributors, (Section 6.5). Appendix C gives two examples of the use of FTA.

• Reliability Block diagram, gives very much the same information as a fault tree, but gives a different graphical presentation of the result, (Section 6.6).

• Human Reliability Analyses (HRA), various analyses to identify human errors and assess the consequences of these, (Section 6.7).

• Markov Analysis, a somewhat detailed analysis that can be carried out to analyse a system that can pass through various (performance) states. Can be relevant for maintenance analyses, (Section 6.8).

• Bayesian networks, a mathematical technique used to analyse dependencies between variables. It can be used for instance to assess the effect of factors influencing the risk, (Section 6.9).

• Event Tree Analysis, used to evaluate various outcomes (consequences) of an undesired (hazardous) event, (Section 6.10).

• QMRA/QCRA, analysis techniques to estimate the effects on human health of microbiological or chemical hazards, (Section 6.11).

• Distribution network analyses, methods to assess the performance of a distribution network. This type of analysis is mostly relevant for analysing water quantity, although in TECHNEAU (WA 5) research is executed on modelling water quality, (Section 6.12).

• GIS tools, allowing geographical representation and analysis of infrastructure assets and the tracking of associated hazards/risks, (Section 6.13).

Note that a couple of these methods (“Treatment efficiency” and GIS tools”) are usually not considered as risk analysis methods, but are included here as being important in risk analysis of water utilities.

Conclusions, including an overview of the various risk analysis methods and the applicability of these methods, are given in Chapter 7.

Finally note that an overview of the main steps of a risk analysis is presented in Appendix A; for each step giving references to the relevant sections of the report.

1.3 The TECHNEAU generic framework for risk management

The risk management process is illustrated in Figure 3. This presents the TECHNEAU generic framework for integrated risk management, (see [2]), which includes the following main components:

• Risk Analysis

In a risk analysis the various hazardous events related to the water utility are

(13)

the frequency of hazardous events and various consequences of these events. • Risk evaluation

The risk evaluation requires that a risk acceptance/tolerability criterion is defined (by the water utility). The estimated risk is then compared with this acceptance criteria in order to decide whether the risk is acceptable (tolerable), see [2]. Further, various risk reduction options are considered to evaluate their cost-effectiveness. • Risk control

Risk reduction options have to be decided on and then implemented. In particular, risks above the acceptance criteria must be treated. Further, the risk is monitored during operation of the utility. (This activity will essentially to be treated in forthcoming report of TECHNEAU, WP4.3.)

Risk Analysis Define Scope Identify Hazards Estimate Risks Qualitative Quantitative Risk Evaluation

Define tolerability criteria Water quality Water quantity Analyse risk reduction

options Ranking Cost-efficiency Cost-benefit Risk Reduction/ Control Make decisions Treat risks Monitor Get new information Update Analyse sensitivity Develop supporting programmes Document and assure quality Report and communicate Review, approve and audit

The first component of this framework, risk analysis (the scope of this report), includes the following three steps:

1. Definition of scope of risk analysis

A complete risk analysis will start by defining the scope of the analysis, (see Section 2.2 below). For a water utility the objective of the analysis could be related to one or more of the following topics:

• Water quality,

• Water quantity (and availability), • Economy,

Figure 3. The main components of the TECHNEAU generic framework for integrated risk management in WSP [2].

(14)

• Environmental impact, • Consumer trust.

The present report focuses on water quality and water quantity. System

definition/description and limitations of analysis are also given in this initial step. Further, an appropriate team need to be assembled according to the scope of the analysis.

2. Hazard identification

The next step is the identification of all hazards and hazardous events. A hazard is usually given as a source of potential harm, (e.g. the existence of a farming or industrial activity in the catchment area). A hazardous event is an event which can cause harm, (e.g. the existence of hazardous agents in the drinking water source). Various methods exist for identifying hazards and hazardous events, e.g. checklists [20], experience from the past and expert judgements.

3 Risk estimation

A lot of methods exist for modelling and estimating the various risks to a water utility. A proper method need to be selected with respect to the specific scope of the risk analysis. Important considerations are if qualitative, semi-quantitative or quantitative measures of risk are needed and if the risk analysis comprises the complete water utility or some subsystem(s) of it.

Various activities are required in order to carry out a risk analysis, risk evaluation and risk control. These are indicated in the rightmost box of Figure 3.

1.4 Definitions

The following definitions of terms are applied in the TECHNEAU project, cf. [2]:

• Hazard is a source of potential harm or a situation with a potential of harm.

• Hazardous agent is for example a biological, chemical, physical or radiological agent

that has the potential to cause harm.

• Hazardous event is an event which can trigger a hazard and cause harm.

• Hazard identification is the process of recognizing that a hazard exists and defining its characteristics.

• Risk is a combination of the frequency, or probability2_{, of occurrence and the} consequences of a specified hazardous event.

• Risk analysis is the systematic use of available information to identify hazards and to estimate the risk to individuals or populations, property or the environment.

• Risk estimation is the process used to produce a measure of the level of risk being analysed. Risk estimation consists of the following steps; frequency analysis, consequence analysis, and their integration.

• Risk evaluation is the process in which judgements are made on the tolerability of the

risk on the basis of risk analysis and taking into account factors such as socio-economic and environmental aspects.

2

When we give the mean number of events during a fixed period of time (e.g. per year), we talk about a

frequency, f. For instance, f = 3/year. We can also give the probability that the event will occur during one

year. The probability, p, is “dimensionless” and is always a number between 0 and 1. For instance p = 0.1

(15)

• Risk assessment is the overall process of risk analysis and risk evaluation.

• Risk management is the systematic application of management policies, procedures

and practices to the tasks of analysing, evaluating and controlling risk.

• Water safety is defined (within TECHNEAU) as: “Water supply that protects water

availability and human health with a high degree of practical certainty”. 1.5 Abbreviations

ALARP - As Low As Reasonable Practicable

BN - Bayesian Network

CCP - Critical Control Points CML - Customer Minutes Lost CRA - Coarse Risk Analysis

DALY - Disability Adjusted Life Years ETA - Event Tree Analysis

FTA - Fault Tree Analysis

FMEA - Failure Modes and Effect Analysis

FMECA - Failure Modes, Effects and Criticality Analysis GARA - GIS Assisted Risk Analysis

GIS - Geographic Information System

HACCP - Hazard Analysis and Critical Control points

HAZID - Hazard Identification

HAZOP - Hazard and Operability analysis HCI - Hydraulic Criticality Index HIA - Health Impact Assessment HRA - Human Reliability Assessment MTTF - Mean Time To Failure

MTTR - Mean Time To Repair

PFD - Probability of Failure on Demand PHA - Preliminary Hazard Analysis PSF - Performance Shaping Factors

QCRA - Quantitative Chemical Risk Assessment QMRA - Quantitative Microbiological Risk Assessment RBD - Reliability Block Diagram

ROS - Risk and Vulnerability Analysis (ROS is the Norwegian abbreviation) RPN - Risk Priority Number

SSM - Substandard Supply Minutes THDB - TECHNEAU Hazard Database WHO - World Health Organisation WSP - Water Safety Plans

WSS - Water Supply Structure YLD - Years Lived with Disability YLL - Years of Life Lost

YLQ - Years of Life with water supply of bad Quality YLS - Years of Life without water Supply

(16)

(17)

2 Risk analysis of drinking water systems –

“From source to tap”

This chapter describes the overall structure and main elements of the risk analysis process, including the motivation for carrying out a risk analysis. The process is described in detail in Appendix A (also briefly described in Section 1.3) and includes the following main steps: 1. Scope definition, including study initiation/organisation, system description and

assembling a team.

2. The identification of hazardous events. 3. The risk estimation.

Some details of the process are given below. Further, Appendix A presents a summary of the various steps of the risk analysis.

2.1 Initiation and organisation of a complete risk analysis

A risk analysis should be initiated by a general objective on how to reduce the risk for the public or the water utility. Further, a clear scope of the specific analysis should always be formulated (e.g. see [4]).

When assembling the risk (analysis) team relevant stakeholders are to be identified, e.g. water utility owners, safety managers, consumers, municipalities, health authorities. These decide whether any restrictions should be imposed on the work; for instance whether only a subsystem of the utility should be considered, or whether to include only specific types of hazardous events or risk reduction options. Critical stakeholders, for example, hospitals, kindergartens, and schools, have to be identified and given special attention during the analysis.

As discussed below, in Section 2.2, the risk analysis could be initiated by making an overview of the overall risk situation within the supply system for the specific decision situations. If the water utility is in a decision situation it should consider the questions:

• What is the problem? • What are the alternatives? • Who is affected by the decision?

• Who is making the decision? (For whom shall we carry out the analysis?) • Which aspects are considered when making the decision?

• What are the wishes and priorities of the various stakeholders?

When risk analyses are utilised as decision support there are several ways to express (quantify) the various aspects of the risk. So if there are various benefits and losses

(potential consequences) involved, the comparison of these benefits/losses may represent (ethical) problems, which must be handled by decision makers. One typical difficulty is how to give value to human life.

(18)

Further, an analysis team must be selected; e.g. it must be decided who shall participate in the analysis work: risk analyst(s), various experts and generalists. The team should consist of water works experts (operators, planners, laboratory personnel etc.), and some outside specialists (e.g. researchers, consultants etc.) that may introduce new perspectives in the risk analysis process.

The working process must also be organised in a combination of meetings (with information gathering and evaluation) and analysis work. Thus the initial part of the analysis process is to organise and make a plan for the work. In this respect it is important to stress the importance of having commitment from all professional categories of the water company in order to achieve real risk reductions as a result of the work.

2.2 Relevant decision situations for water utilities

The scope of a risk analysis should describe the purpose of the analysis and the problems that initiated it. Below we list some typical decision situations for water companies, which could initiate risk analyses work. Practical examples on this are included.

• Initial risk analyses, required prior to the start up of a plant/water utility, (or modifications, such as rebuilding or operational changes)..

Drinking water supply is subjected to many different risks and it is important to focus the risk control to the most important areas. Relevant objectives to initiate a risk analysis could simply be a need to:

o Identify and rank all hazards (in order to control risk);

o Estimate the risk to identify any need of additional Critical Control Points, (CCP); o Evaluate cost/benefit of risk reduction options to achieve an acceptable risk. Examples of typical (specific) questions that could launch a risk analysis exercise could be:

o Which out of all chemicals and microbial substances are most critical to health aspects for drinking water consumers?

o How do we compare the risks of shipping petroleum products on the raw water source with cattle grazing next to it?

• Analyses carried out to “optimise” operational maintenance and emergency procedures.

The protection against water-borne diseases by implementing new barriers in the plant may be a long-term action for many water utilities, and it may take some years before the required barrier function is implemented. So, in the meantime:

o How can the protection be improved by optimizing the present treatment?

Which risks can be reduced by process optimization?

o How important are periods with suboptimal performance?

• Analyses initiated by specific operational problem.

The water utility may have a deviation reporting system that gives support to the handling of specific problems. Such a system gives information on the acute actions. It is also designed to sort out the need for improvements in order to avoid similar events or to reduce the consequences of them. For instance, it has been experienced that

(19)

deviations related to a very rainy autumn can include simultaneous pollution in the main raw water source and the back-up water source. This can be combined with humic contents in the raw water reservoir and inadequate sludge removal in the treatment. So, relevant questions are:

o What is the likelihood of such combinations in the future?

o How can they be detected and avoided, or how can the consequences be reduced?

More generally, risk analyses could be initiated by problems like:

o Delivered water is observed not to comply with required quality standards (e.g. unacceptable level of some bacteria)

o Reduced availability of water delivery observed (to some group of users) o Observed security problems

o Occurrence of an unwanted event (accident investigation)

• Analyses to update initial risk analyses, in order to include possible new hazards.

For instance, a water treatment plan could be designed for having a multi-barrier protection, while according to new knowledge formerly unknown microbial agents are pointed out as an important hazard. For instance the parasitic protozoa Cryptosporidium

was not described until 1970s as infecting humans [8], and not recognized until 1984 as a waterborne infection. The recognition of new hazards can result in new risk reduction options as e.g. improved barriers against Cryptosporidium. So relevant questions to initiate further analyses could be:

o Are the barriers in the water treatment plant sufficient for emerging microbial contamination?

o Does the raw water contain micro-organisms that can harm human health? o How will present treatment meet to the predicted climate change?

• Analysis to obtain acceptable risk with respect to supply, (major delivery failures).

Water utilities may have acceptance levels for interruption of supply that take into consideration number of consumers without water and time without water. The risk of limited delivery failures can be calculated from statistical data, but little information is available of the larger failures.Relevant problems:

o Is it raw water, treatment or distribution system, or a combination of these, which is the limiting factor to achieve acceptable risk?

o Where are the bottlenecks?

It is observed that the above questions could be related to various life cycle phases, (e.g. design or operational phase), and the questions can be related both to strategic and operational decisions.

2.3 System description

One of the first tasks is to provide a system description, and also describing the functions of the various subsystems. Each water supply system is unique and a description of the

(20)

system is therefore an important part of a risk analysis. The description should include both illustrations (drawings) and written text. Important documents are rules and regulations, standards, maps, statistics, operating procedures, drawings, etc. The system descriptions should include detailed knowledge of the following three subsystems (in case the total system is analysed):

1. Water source (groundwater and/or surface water) and the catchment area. 2. Water treatment systems and monitoring systems.

3. Distribution network, including plumbing system and consumers.

As an example Figure 4 is an illustration of a water supply system from source to tap carried out according to the WSP guidance. An important aspect is that the risk analysts shall get familiarised with the analysis object.

Figure 4. Illustration of system flowchart, from source to tap.

The system description should include a description of the system boundaries, the technical systems, operational conditions and the environment. For an identification of hazardous events it is also important to point out important support systems, which the water utility is depending on for successful operation, (e.g. power supply, supply of chemicals, IT-systems, training and employment of personnel). Some generic information is also seen as a part of the system description, such as the total number of consumers linked to the

distribution system and their consumption demand.

The system description illustrates a “normal operational situation”, after the treatment process and control points have been decided. So specification of this normal operational situation is an important part of the system description. In particular, it is specified which concentrations of various contaminants that the treatment system is designed to handle. Many risk analysis methods require some structured way to breakdown the system in manageable parts. A common way to break down a system in an analysis is a hierarchical model which reflects how the system is designed. The system should be broken down into suitable subsystems that can be handled effectively in an analysis (i.e. splitting Figure 4 into subsystems like source, treatment, distribution ). Each subsystem can further be broken down into modules, and each module into components etc.

Reservoir WTP 1

Source water Treatment Distribution

Tank Reservoir WTP 2 Reservoir Reservoir WTP 1

Source water Treatment Distribution

Tank

Reservoir WTP 2

(21)

2.4 Hazardous events

Step 2 (on page 15) of the risk analysis is to identify hazardous events, in the various parts of the system. A hazardous event is an event which can cause harm. In principle all types of unwanted events should be included. Identification of hazardous events is described in detail in the TECHNEAU Hazard Database (THDB) [20]. Following groups of hazards are normally considered:

• Biological • Chemical

• Radiological or physical

• Unavailability (insufficient availability of water supply to consumers) • Safety (safety to personnel)

• External damage (external damage to third parties, incl. liability)

A typical example of a hazardous event is the presence of a contamination (hazard) in the source of a drinking water supply system. The Microrisk project3_{, (for additional}

information see [5]), refers to the following types of hazardous events from a microbiological point of view:

1. Primary faecal contamination: Events that cause significant contamination of the source water, with microbial levels much above “normal levels”,(which should in principle be handled by the existing treatment system), and events that result in a biological/chemical agents entering the drinking water source; which the existing treatment system is not designed to handle.

2. Water treatment is malfunctioning: Treatment system having reduced ability to handle “normal contamination” or to detect contamination above “normal levels”. 3. Secondary faecal contamination, i.e. faecal contaminations that are not originating

from the source water, (e.g. wastewater intrusion due to cross-connections or backflow).

In TECHNEAU we add the following type of hazardous events: 4. Events causing insufficient water supply to consumers.

Note that if the objective of the analysis is to assess the total risk caused by all identified hazardous events, there could be a risk of counting hazardous events twice. For instance, failure of the treatment system to handle/detect Giardia is one hazardous event. The presence of Giardia in the water source is another. However, it is not necessarily correct not to add the frequencies of these events to achieve the total risk, because both events must occur at the same time in order for the drinking water to be contaminated. In this case, it is suggested to start from the above four categories of events, to avoid such “double

counting”.

3_{The EU project Microrisk (contract EVK1-CT-2002-00123), see www.microrisk.com resulted in a number on}

reports on QMRA, see

http://217.77.141.80/clueadeau/microrisk/uploads/microrisk_how_to_implement_qmra.pdf . QMRA was applied to 12 systems across Europe and Australia.

(22)

Different approaches for identifying hazardous events are discussed in Section 3.1.

2.5 Safety barriers – Causes and consequences of hazardous events

When hazardous events are identified we may want to analyse both causes and possible consequences. The so-called Bow-Tie diagram can be used to illustrate this, see the example in Figure 5, with the hazardous event “Giardia in water source”. The chain of events goes from left to right with the causes (and hazards) on the left, the hazardous event in the middle and the consequences on the right.

In Figure 5 also some safety barriers are introduced, which are implemented to reduce the risk. In the left part of the bow-tie diagram we have barriers (1, 2, 3) that prevent the hazardous event to occur or mitigate the hazardous event; to the right we see barriers (4, 5) for preventing or reducing unwanted consequences; (e.g. people being infected by

contaminated water).

In general safety barriers can either:

• prevent the undesired event to occur (reduce probability), e.g. by introducing restrictions on the use of the catchment area, or

• reduce the consequences by water treatment systems; thus preventing contaminated water to be delivered to consumer.

So introducing a barrier actually means implementing a risk reducing option.

Figure 6 illustrates the concept of hygienic (safety) barriers in a water supply system considering all elements from source to tap, see also the Bergen Case study [65].

(23)

2.6 Risk estimation

The risk estimation can be carried out at various levels of detail. An analysis of the hazardous events should include estimation of likelihood (probability) and consequence. Often a semi-quantitative approach is chosen, just giving categories of likelihood and consequence. The combined likelihood-consequence categories could then be inserted in a risk matrix, see example of risk matrix in Figure 7. As an example we here indicate

corresponding risk values ranking from 1 (likelihood = rare; consequence = insignificant) to 9 (likelihood = almost certain; consequence = catastrophic). This is just an example on how to rank the risks related to the various hazardous events. The categories (e.g.

“catastrophic”) can be defined in various ways (see Figure 11).

Severity of consequences

Likelihood Insignificant Minor Moderate Major Catastrophic

Almost certain 5 6 7 8 9

Likely 4 5 6 7 8

Moderately likely 3 4 5 6 7

Unlikely 2 3 4 5 6

Rare 1 2 3 4 5

One should make a separate risk matrix for loss of quality, and another for loss of quantity, (and possibly one for e.g. economic losses).

Performing the risk estimation one should note the possible links between poor water quality and reduced water quantity. Water quality problems can occur due to low pressure, as a result of a pipe burst (water quantity problem). Further, a drought (quantity problem), will often also result in a decrease of water quality.

Figure 6.Illustration hygienic barriers in a water supply system from source to tap (modification of a figure taken from: SA Water - Drinking water quality report 2004-2005).

(24)

In more advanced analyses risk can be fully quantified, see Chapter 6. Often the input data to these quantifications are rather uncertain, and the results involve considerable

uncertainty. Then it is recommended to carry out a sensitivity analysis; i.e. calculating risk with various input values to demonstrate the range of “probable results”.

(25)

3 Coarse risk analysis of water supply systems

The Coarse Risk Analysis (CRA) is a method for semi-quantitative risk analysis. The scope of an overall CRA – including risk evaluation and risk control - typically consists of (see [18, 21, 22]):

1. Identify hazardous events related either to the total water supply system, or to a specific part (or in general to some category of undesired events). (Section 3.1) 2. Risk estimation, i.e. estimate the probability and consequence for each hazardous

event. (Section 3.2)

3. Present these risks in risk matrices, and possibly compare to risk acceptance criteria. 4. Rank the hazardous events with respect to their risk.

5. Assess the need for risk reduction options or more detailed analyses.

The first two steps relate to risk analysis, and in this chapter we first give a description of the hazard identification of an overall CRA (Section 3.1). Next, the risk estimation in a CRA is discussed (Section 3.2). Finally an example is given (Section 3.3).

3.1 Identification of hazardous events

There are various approaches for the identification of hazardous events, e.g. using; Brainstorming, experience from the past, checklists (Section 3.1.1). Checklists may be databases, such as the TECHNEAU Hazard database (THDB, Section 3.1.2). HAZOP is another commonly used method (Section 6.2). A general discussion is given first; then THDB is shortly described.

3.1.1 Various approaches for hazard identification

There are various techniques for identification of hazards or hazardous events within a system. Hazard Identification (HAZID) is a collective term often used for such techniques. A brief description of some of the methods is presented in this section. The descriptions are primarily based on [18] and [19].

• Brainstorming is a main method of problem solving or idea generation in which members of a group contribute ideas spontaneously. In this case, the task is to identify hazards or hazardous events in a water supply system. “What-if” analysis is a specific and effective brainstorming approach [2].

• Use of experience from the past, i.e. accident and reliability data, may also be used to identify potential problem areas and provide input into frequency analysis (probability estimation). Experience from the past is often used as input to the methods described in this chapter.

• A traditional checklist comprises a list of specific items to identify known types of hazards and potential accidents scenarios associated to a system. Checklists may vary widely in level of detail. Checklists are limited by their author’s knowledge and

experience and should be viewed as living documents, reviewed regularly and updated when necessary.

(26)

Experience from the past could be experience from the actual (or similar) water utility, provided by operational personnel of these utilities. One could then go through the total system and record operational problems and concerns that are experienced. This method is rather similar to the brainstorming session. One could also utilise statistics and data on events that have been recorded in various data sources, cf. Chapter 5.

A checklist is easy to use and is a cost-effective way to identify common and customarily recognized hazards. Checklists can be applied at any stage of the life-cycle of a water supply system and can be used to evaluate conformance with codes and standards. The TECHNEAU Hazard Database, [20] presents a comprehensive list of hazards and hazardous events that can serve as a checklist for water utilities, see below.

A list of generic hazardous events can be formulated by considering characteristics such as [18]:

• Materials used or produced and their reactivity • Equipment employed

• Operating environment • Layout

• Interfaces among system components, etc.

Based on the general hazardous events identified, a more specific list may be described for the various parts of the system. A form, shown in Table 1, may be used for doing this.

Hazardous event Cause Vulnerable locality Possible effects: Tanker containing 20 m³ of

gasoline tips over near intersection XX, polluting the water source near by the inlets - Sudden illness of tank driver - Slippery conditions Intersection XX

3.1.2 TECHNEAU Hazard Data Base (THDB)

The THDB, [20], applies a holistic view on hazard identification within the water supply system and provides a list of hazards and hazardous events for each element in the water system. The hazards identified in the THDB are both internal and external. Internal hazards are mostly related to functional failures or the absence of infrastructure. External hazards are for instance source water contamination, degradation of mains due to aggressive soils or terrorist actions.

The objective of the database is to help water supply utilities with the identification of relevant hazards by providing a catalogue with potential hazards of technical, geographical or human origin for the whole part of the system. The database has a generic set-up. It does not cover all possible specific operational hazards, but should be regarded as a checklist to assess possible risks of the supply system.

(27)

The water supply system is subdivided into 12 systems, of which 10 are physical sub-systems representing the infrastructure, one is a non-physical sub-system representing organizational aspects and one is a sub-system representing future hazards.

The hazard database is presenting the identified hazards in a table at the subsystem level. The tables are divided into components and elements. At component level the most important elements are given, and for each element the most relevant hazards are given in combination with a description of the cause of the hazard, the hazard type and the

consequences.

The THDB focuses on both water quality and water quantity. The hazard database uses the definitions given in Table 2. Examples of hazardous events from the THDB are shown in Table 3.

Element: Lowest level of the system at which hazards are described.

Hazard: A source of potential harm or a situation with a potential of harm (e.g. a biological, chemical, physical or radiological agent or undesired event that has the potential to have a negative effect on the supply of safe and

sufficient water).

Ref.: Reference number (id.) of the hazard. Hazardous

event:

An event which can cause harm (e.g. an incident or situation that can lead to the presence of a hazard, what can happen and how).

Type of hazardous event:

Indication of the origin of the hazardous event. - D: design-related

- O: operation-related - E: external-related

- OS: consequence of a hazard in other sub-system - Ref. OS: Reference of other sub-system

Type of hazard: Indication of the type of hazard. - Biolog.: biological

- Chemic.: chemical

- Rad./phys.: radiological or physical (including turbidity)

- Unavail.: insufficient availability of water supplied to consumers - Safety: safety to personnel

- External damage: external damage to third parties, including liability Consequence

description: Description of potential consequences of the hazard to other sub-systems and to consumers. Consequence to

sub-system: Reference of the sub-system affected by the hazard.

Rel. system: Column to be used by the end-user for marking the identified hazards.

(28)

Table 3. Examples of hazardous events in the TECHNEAU hazard database (THDB) [20]. System Examples of hazardous events from the THDB – (hazard id. in brackets) Source/

Catchment

- Industrial discharges of chemicals. (1.1.1) - Industrial discharge of biological matter. (1.1.2)

- Emissions during accidents (fire or explosions) e.g. industrial accidents or forest fire. (1.1.3)

Water treatment plant

- Improper coagulant mixing and/or flocculation; inappropriate flocculant or flocculation agent; improper pH control. (6.4.3)

- Decrease of UV lamp performance due to ageing or colour sediments on quartz tube. Electrical disruptions. (6.6.7)

Distribution and

plumbing

- Poor hygiene during repair. (8.1.2)

- Malfunctioning valves, connections to different water qualities (industrial water, sewers). (8.1.14)

3.2 Risk estimation in Coarse Risk Analysis (CRA)

It is a rather common situation that a water utility wants to have a coarse overview of the main risks for its activities, in order to identify the most serious threats and then to make the right priorities with respect to implementing risk reduction options.

In such a situation water utilities can carry out a Coarse Risk Analysis (CRA); this method is similar to the Preliminary Hazard Analysis (PHA). In Norway this type of analysis is commonly applied, and is referred to as a ROS (Risk and Vulnerability) analyses. These analyses are often carried out early in the development of a utility, or in the

launching of a WSP implementation in an existing system. Then there is little information on design details and operating procedures, and the analysis can be a precursor to further studies. However, they are also used for analysing existing systems, or specific subsystem. The CRA can also be used to prepare emergency preparedness plans for the water supply companies.

The main objective of the CRA is to identify hazardous events (as described above), the causes of the event, and to make a coarse evaluation of likelihoods (probabilities) and consequences of these events. The results are normally displayed in a list of hazardous events (in a worksheet form). Several variations of this form are used. One example of a worksheet used to document the results of the analysis are shown in Table 4. Each hazardous event identified is inserted in the list and analysed. As an example we have taken the hazardous event 6.6.7 in the THDB, [20].

The risk estimation in a CRA usually restricts to presenting categories of probability and consequence. The probability categories are denoted e.g. P1–P4, and similarly consequence categories, C1-C4; cf. Table 4. These pairs of values are later inserted in the appropriate cell of the risk matrix. Note that the consequences can be evaluated with respect to several “dimensions”; e. g. water quality, water quantity (supply) or reputation/economic loss.

(29)

1)_{Probability category} 2)_{Consequence category}

According to the resulting risk-score of the various hazardous events in the risk matrix, the most serious hazardous events are identified. Risk reduction options to prevent the

hazardous event or to neutralize its consequences are identified. The needed efforts (in terms of costs, time, organization, training, etc.) and the reduction of risk of the various risk reduction options are roughly evaluated. Finally a priority list for risk reduction options (with deadlines) is formulated.

In summary, a CRA is a rather simple semi-quantitative risk analysis method. However, the CRA requires good information and knowledge about the system including

surroundings. Hazard identification is usually based on some kind of expert judgement, e.g. using experience from the past, check lists, or a combination of these. If statistics about hazards are not available the CRA will rely on expert judgements to estimate the risk and define appropriate risk reduction options.

No detailed modelling and calculations are needed, and the analysis may be carried out by professionals with good system knowledge, but is not requiring computational skills. Normally a CRA is not very time consuming. However, this depends on the size and complexity of the system to be analysed.

Note that the CRA does not provide a score of the total risk of the water utility. The main focus is on identifying major hazardous events, and then ranking these with respect to their contribution to risk.

3.3 Tool for Coarse Risk Analysis (CRA)

A tool for carrying out a coarse risk analysis was developed. The tool is applicable for small, medium and large water companies. The tools itself is also an aid for organizing the data generated as a part of the coarse risk analysis.

The structure of the tool is a database which enhances future updating of the tool. The user-interface for carrying out the analysis is shown in Figure 8. By clicking on the acronym of a potential hazardous event the corresponding risk registering dialog box for the relevant hazardous event appears, as shown in this figure. The various fields of the interface are explained in Table 5.

Table 4. Example of a CRA- worksheet. System:

Treatment

Operating mode:

Normal operation Analyst:Date: 2008-10-10 NN

Ref. Hazard Hazardous event Causes Proba-bility Conse-quence Preventive actions Comments 6.6.7 Pathogen in water source Too low UV

dose Ageing or colour sediments on quartz tube

P2 1) _C22)_Online

measure-ment of UV intensity to verify correct intensity

(30)

Likelihood (probability) and consequence are given as categories. The consequence classes can be specified by two dimensions. In the example below (in Figure 9) duration and exposure are chosen.

Duration of e.g. illness or lack of supply can, for example, be classified as: 1. 0-6 hrs 2. 6-24 hrs 3. 1-7 days 4. 1-4 weeks 5. 1-6 months 6. > 6 months

Exposure, i.e. number of affected persons, can be given as: 1. 1-10 2. 10-100 3. 100-1 000 4. 1000-10 000 5. 10 000-100 000 6. > 100 000

As seen in Figure 9 this can be used to define four consequence categories, (from Low to

Very high).

(31)

Comment

Waterworks The user selects which waterworks the analysis belongs to. One water

company might have several waterworks and some hazardous events might be unique for one of the waterworks.

Analysis object Describes which element in the water supply system is analysed (e.g.

catchment, source, intake, water treatment plant). The user must select analysis object from a drop down text.

Detailed Detailed description of the analysis object (e.g. for treatment plant the

following detailed elements might be analysed: coagulation, filtration, chlorination, UV, CO2, pH). The user must select detailed analysis object from a drop down text.

Undesired event/hazardous event

Description of the undesired event or hazardous event. A check list of possible events is available from the “Hazard database” developed as a part of Techneau. The user must select event from a drop down text.

Cause The underlying cause for undesired event. A checklist for possible causes

can be found in the “Hazard database” developed in Techneau. The user must select cause from a drop down text.

Probability The probability for the undesired event to occur. The probability must be

estimated by the user either based on available data or expert evaluation. Some guidance on assessing the probability is given within the tool. The probabilities of occurrence are defined as small (P1), medium (P2), large (P3) or very large (P4).

Cause description A more detailed description of the underlying cause of event can be given.

Vulnerability Description of how vulnerable the system is if the analysed elements fails

(e.g. if the water company has alternative sources of backup supply the water supply will be less vulnerable). Might also be used indirectly for assessing the consequences.

Components A description of the components (e.g. two pumps in parallel)

Description A more detailed description of the consequences of the event might be

given here. It will also serve as a justification for the assessed consequences making it easier to review the estimated values.

Consequences (quality,

delivery/quantity, reputation/ economic)

The possible consequences resulting from the event are described as small (C1), medium (C2), large (C3) and very large C4). The consequences consist of 3 elements: quantity/delivery, water quality and loss of

reputation/direct economic loss. For the terms quality and delivery/quantity the duration and the number of involved persons

Barriers Identification of barriers (c.f Bow-tie diagram) reducing both the

probability and consequences for the event. The barriers can be existing barriers and possible future barriers. Assessing whether the barriers reduces the Probability (P) or the Consequences (C) might be useful.

Manageability Description on how the risk can be managed i.e. how and what can be

modelled and/or measured to control the process; (e.g. measuring remaining pipe wall thickness by non-destructive testing)

Risk reduction

options /CCP Based on the resulting risk matrixes, the need for risk reduction options for each of the undesired events might be introduced. These can either be physical options or implementation of critical control points (CCP) for controlling the risk in real time.

(32)

So, one outcome of the analysis of a specific hazardous event is the risk, given by probability (likelihood), P, and consequence, C. This set (P, C), is to be inserted in the risk matrices, see Figure 10. There can for instance be one matrix for quality (life and health), one for quantity (delivery) and one for reputation/economic; i.e. for the various “dimensions” of risk considered. Each hazardous event will be shown in the risk matrices by a symbol.

Note that the colour coding within the risk matrix in the CRA tool are defined by the user by editing the individual cells of the risk matrix.

In Figure 10 “Green” risk indicates that the risk is tolerable and there is no need for risk reduction options. “Yellow” risks indicate that the need for risk reduction options should be discussed, while “red” risks indicate that the risk is not tolerable and there is need for risk reduction options. The decisions of the spreading of the red, yellow and green area of the risk matrix reflect the applied risk acceptance criteria of the water utility. Decisions of these acceptance criteria are to be taken by the management. By this splitting of outcomes in three categories, red, yellow and green, we adopt the ALARP principle, ref. [2].

(33)

An example of the application of the tool is given in the Bergen case study report, [65]. In that case the following undesired events, which might take place in the distribution system, were identified:

I

Failures in hygienic barriers (water quality)/ intrusion of contaminated water into network:

• Contamination in water tanks (water surface)

• Intrusion due to low pressure/non-pressurised network

o

Operational and maintenance situations (e.g. valve operations)

o

Power failure

o

Work on non-pressurised network (e.g. repair, rehabilitation, construction)

o

Fire (huge water demands might lead to low pressure)

o

Water mains failure (might lead to non-pressurised system)

o

Incorrect operation of valves

o

Failure at pumping stations in zones without water tanks

o

Water hammer

o

Pipe fracture, valve closes without intention

o

Water tanks emptied due to communication error

o

Extraordinary water demand/tapping

o

In-pipe processes

• Cross-connection/backflow

o

Unintended backflow from building

o

Sabotage (intended backflow from building)

Figure 10. The risk matrix for water quality (delivery). Identical matrices are given for quality (life and health) and loss of reputation/economy (CRA tool).

(34)

II

Failures of water delivery/quantity:

o

Operational and maintenance situations (e.g. valve operations)

o

Pipe failures

o

Rockslides/rockfall in tunnel

o

Water tanks emptied due to communication error

o

Failure at pumping stations

(35)

4 Quantification of risk

Depending on which aspects of risk are considered, risk can be quantified in various ways. In this chapter various ways to quantify (measure) risk are discussed.

4.1 The dimensions of risk and various ways to quantify risk

The TECHNEAU project applies the very common definition of risk (Section 1.4), as a combination of the probability (frequency) of the occurrence of specified hazardous events and the consequence(s) of these events. Risk is often expressed in terms of these

probabilities and consequences. The estimated risk of the various hazardous events can also be aggregated, in order to give an expression of the total risk of a water supply system. Several types of potential consequences can be considered in a risk analysis of a water supply system. One refers to the various “dimensions” of risk, representing the different types of consequences, and each of these risk dimensions can be quantified.

For the consumer it is important to be supplied with water of good quality, but there should also beenough water. So the TECHNEAU project focuses on the quality and quantity

of the water supply, both aspects essential for the consumers’ risk.

In order to quantify risk related to water quality, the complete water supply chain should be considered. Some examples of risk measures for water quality are:

1. Probability of a specific degree of contamination/pollution of the water source.

2. Probability of a specific failure of the treatment system, resulting in contaminated

water entering the distribution network.

3. Probability that one litre of drinking water at tap contains a certain parasite;

(meaning that contaminated water is delivered to consumer).

4. Mean number of consumers getting adverse health effects caused by drinking water

(due to a certain hazardous event).

Risk related to water qualityis not necessarily measured in terms of the quality of water delivered to consumers (item 3 on the list), or as the actual health effects for the consumers (item 4). For a water utility it can be useful also to estimate the risk of a water source being polluted or of a failure of the treatment system (items 1 and 2).

In Item 4 “Mean number of persons getting adverse health effects” a quantification of risk is applied where probability and consequence are combined into one figure. This means that a rather traditional definition of risk as the “mean loss”, (probability x consequence)4_is applied. Various measures for water quality are discussed in Section 4.3.

When risk related to water quantity shall be quantified, it should be noted that loss with respect to water quantity/availability depends on (see Section 4.4):

• frequency of interruptions of water supply

(36)

• duration of the interruption,

• exposure, i.e. number of consumers being affected.

Note that even without interruption of the water flow at the consumers tap, the water may be delivered with a pressure which is too low (e.g. for appliance to work). So water

pressure being excessively low is also a risk to water quantity, (and excessive high pressure is a hazard, potentially causing leakage or bursts in plumbing installations).

Thus, loss of water quality and loss of water quantity are the two most important

“dimensions” of risk for a water utility. But note that if analysis of water quality restricts to include the effect on human health, then environmental impacts is another dimension of the risk. Also this risk can be measured in various ways, e.g. in terms of frequency of polluting events and the exposure (e.g. number of affected species/animals).

In addition, the water utility can experience loss of reputation (consumer thrust), which is more difficult to measure, but also these losses can have economic consequences.

Further, consumers (e.g. certain industries) and the water utility itself may experience

economic losses, which are most reasonably expressed in monetary units, (e.g. Euro). But in principle, it is possible to measure all losses - related both to water quality and quantity (and

environment) – as economic losses, and in this way give an overall measure of the total risk. Finally, we mention societal risk, which is the risk related to major events, e.g. causing main functions of society to be at risk. This is certainly relevant for a major infrastructure like the water supply; (either lack of water or polluted water, affecting many consumers or an institution like a hospital). Specific risk measures could be designed to express also these risks. However, the present report focuses on risks for the consumers and for the water utility.

Various ways to measure (quantify) risk will be discussed in more detail below. Some measures are “common”, i.e. can be used for various dimensions of risk, and others are related to a specific dimension, as quality or quantity.

4.2 Qualitative versus quantitative expressions for risk

As stated above, risk is usually measured by severity of some unwanted consequence, C

and the likelihood (i.e. probability, p, or frequency, f) that this consequence occurs. Various types of consequences (losses) can be considered. Often we want to rank various risks, and so the C- and p-values are quantified to give an overall measure of the risk, e.g. R = p x C. This quantification can be time consuming. Also note that risk quantification expressed in ‘detailed’ numbers pretends an exactness that may not be the case because it has been derived from assumed probabilities or ranges of numbers described in then literature. So there is a danger of creating a false sense of precision of the result.

A ranking can also be carried out qualitatively, without specifying p- and C-values for each risk. One possibility is to apply paired ranking; i.e. comparing pairs of risks: each risk is compared to every other risk, specifying which of the two is greater [7]. This should give an explicit weighting, but again with the danger of giving a false sense of precision. The

(37)

process could also be very time consuming and complicated due to the fact that “experts” are not always consistent (agreeing) in their evaluations of paired comparisons.

A common qualitative approach is to apply a classification of risk. Probabilities and

consequences are divided into categories. For the probability category measures as ‘rare’ and ‘frequent’ are used. Consequences could be categorised as ‘small’, ‘medium’ and

‘catastrophic’. These categories are a ranking of likelihood and consequences. The categories can also be defined by intervals, for instance, the probability category ‘rare’ could be defined as ‘less than once a month’. Similarly, the consequence category ‘small’ with respect to health effects could be defined as ‘at most 10 consumers with minor health effects’, etc. In this case the term semi-quantitative approach is used (not fully quantitative but placed into pre-determined categories).

Based on categories for probability and consequence, a risk matrix can be made; for an example based on WHO [8], see Figure 11. In this figure risk categories are given (1-9) (note that this is an example). Also observe that the WHO definition of the likelihood (probability) category “Almost certain” equals “Once per day”. In a risk analysis it is rather seldom to include events which are that frequent.

Severity of consequences

Likelihood

Insig-nificant Minor Moderate Major Cata-strophic Almost certain 5 6 7 8 9 Likely 4 5 6 7 8 Moderately likely 3 4 5 6 7 Unlikely 2 3 4 5 6 Rare 1 2 3 4 5

Examples of definitions of likelihood (probability) and severity (consequence) categories that can be used in risk scoring

Item Definition

Likelihood categories

Almost certain Once per day

Likely Once per week

Moderately likely Once per month

Unlikely Once per year

Rare Once every 5 years

Severity category

Catastrophic Mortality expected from consuming water

Major Morbidity expected from consuming water

Moderate Major aesthetic impact possibly resulting in use of alternative but unsafe water sources

Minor Minor aesthetic impact possibly resulting in use of alternative but unsafe water sources

Insignificant Not detectable impact

Figure 11. Example of a risk matrix and definitions of likelihood (probability) and severity (consequence) categories to be used in risk scoring in WSP (WHO, [76]). Suggested risk categories, 1-9, are added here as

Methods for risk analysis of drinking water systems from source to tap

Methods for risk

analysis of drinking

water systems from

source to tap

-

Guidance report on Risk Analysis

TECHNEAU

Colofon

Contents

Summary

1

Introduction

2

Risk analysis of drinking water systems –

“From source to tap”

3

Coarse risk analysis of water supply systems

I

o

o

o

o

o

o

o

o

o

o

o

o

o

o

II

o

o

o

o

o

4

Quantification of risk