vvEPA
United States
Environmental Protection
Agency
Using Advanced Metering Infrastructure
in a Water Quality Surveillance and
Response System
Office of Water (MC 140)
EPA S10-F-21-005
March 2021

-------
Disclaimer
The Water Security Division of the Office of Ground Water and Drinking Water has reviewed and
approved this document for publication. This document does not impose legally binding requirements on
any party. The information in this document is intended solely to recommend or suggest and does not
imply any requirements. Neither the U.S. Government nor any of its employees, contractors or their
employees make any warranty, expressed or implied, or assumes any legal liability or responsibility for
any third party's use of any information, product or process discussed in this document, or represents that
its use by such party would not infringe on privately owned rights. Mention of trade names or commercial
products does not constitute endorsement or recommendation for use.
Questions concerning this document should be addressed to WQ SRS@epa.gov or one of the following
contacts:
Nelson Mix, PE, CHMM
EPA Water Security Division
1200 Pennsylvania Ave, NW
Mail Code 4608T
Washington, DC 20460
(202)564-7951
Mix.Nelson@epa.gov
or
Steven C. Allgeier
EPA Water Security Division
26 West Martin Luther King Drive
Mail Code 140
Cincinnati, OH 45268
(513) 569-7131
Allgeier. Steve@epa.gov
i

-------
Acknowledgements
The document was developed by EPA's Water Security Division, with additional support provided under
EPA contracts EP-C-15-012 and EP-C-15-022. The following individuals contributed to the development
of this document:
•	Jim Cooper, Arcadis
•	Janis Lusco, Arcadis
•	Katie Umberg, Arcadis
•	Melissa Brown-Rosenbladt, Cadmus
•	Frank Letkiewicz, Cadmus
•	Alan Lai, Jacobs
•	Kenneth Thompson, Jacobs
Peer review of this document was provided by the following individuals:
•	John Sullivan, Boston Water and Sewer Commission
•	Steven Seachrist, Gwinnett County Department of Water Resources
•	John Hall, USEPA
•	Deborah VanRenswick, USEPA
11

-------
Table of Contents
Disclaimer	
Acknowledgements	
List of Figures	
List of Tables	
Acronyms and Abbreviations	
Section 1: Introduction	
Section 2: Overview of Incorporating AMI into an SRS	
Section 3: AMI Equipment	
3.1	Meters	
3.2	Meter Interface Units	
3.3	Other Sensors	
3.4	Remotely Controlled Valves	
Section 4: Communications	
Section 5: Information Management	
5.1	AMI Data Management	
5.2	AMI Data Analysis	
5.3	Data Access and Visualization	
Section 6: Alert Investigation Procedures	
6.1	Developing an Effective Alert Investigation Procedure	
6.2	Developing Investigation Tools	
6.3	Preparing for Real-time Alert Investigations	
6.4	Next Steps	
Resources	
References	
Glossary

-------
List of Figures
Figure 1-1: Surveillance and Response System Components	1
Figure 5-1: Example Dashboard for AMI Information	14
Figure 6-1: Example Alert Investigation Process Flow Diagram for AMI Alerts	20
Figure 6-2: Example of Alert Investigation Records	22
IV

-------
List of Tables
Table 2-1: Elements of an AMI SRS Component	4
Table 3-1: AMI Equipment Types	5
Table 6-1: Common Causes of AMI Alerts	16
Table 6-2: Differences in Key Action Examples for Backflow and Tampering	19
Table 6-3: Example of Generic Roles and Responsibilities for AMI Alert Investigations	21
v

-------
Acronyms and Abbreviations
AMI
Advanced Metering Infrastructure
AMR
Automated Meter Reading
CCS
Customer Complaint Surveillance
EPA
U.S. Environmental Protection Agency
IT
Information Technology
MIU
Meter Interface Unit
OWQM
Online Water Quality Monitoring
psi
Pounds per Square Inch
S&A
Sampling and Analysis
SCADA
Supervisory Control and Data Acquisition
SRS
Water Quality Surveillance and Response System
WCR
Water Contamination Response

-------
Section 1: Introduction
Advanced Metering Infrastructure (AMI)1 comprises the equipment, communications, and information
management systems for utilities to remotely collect customer water usage data in real time. AMI can
provide a wide range of benefits including improved utility operations, improved water conservation and
non-revenue water initiatives, and enhanced security and resilience. Utilities generally choose to
implement AMI for operational efficiencies and cost savings, but the data produced can be incorporated
into a Water Quality Surveillance and Response System (SRS) to achieve additional benefit.
An SRS is a framework developed by the United States Environmental Protection Agency (EPA) to
support monitoring and management of water quality from source to tap. The system consists of one or
more components that provide information to guide drinking water utility operations and enhance a
utility's ability to quickly detect and respond to water quality changes. An SRS overview can be found m
the Water Quality Surveillance and Response System Primer. Figure 1-1 shows the components of an
SRS grouped into two operational phases: surveillance and response.
AMI is a surveillance component as it generates data and alerts that may indicate system contamination
or other tampering. Alert investigation procedures guide the systematic investigation of alerts produced
to identify their cause. If distribution system contamination is detected, response actions are implemented
to minimize consequences.
Figure 1-1: Surveillance and Response System Components
EPA intends the design of an SRS to be flexible and adaptable based on a utility's goals and the resources
available to support implementation and operation of the system. It is recommended that all SRS designs
include at least one surveillance component and basic capabilities for Sampling and Analysis (S&A) and
Water Contamination Response (WCR). S&A is important because the surveillance components of an
1 Words in bold italic font are terms defined in the Glossaiy at the end of this document.
1

-------
SRS typically provide only a general indication of a potential water quality problem; S&A establishes the
capability to confirm or rule out specific contaminants or contaminant classes. WCR establishes
relationships with response partners and procedures for responding to serious water quality problems such
as contamination.
The purpose of this document is to provide guidance for incorporating AMI as a component of an SRS. It
is written for drinking water professionals responsible for utility metering and investigating the cause of
backflow and tampering alerts produced by AMI.
In addition to this introductory section, the document is organized into the following major sections:
•	Section 2 provides an overview of AMI and how AMI can be incorporated as a surveillance
component of an SRS.
•	Section 3 provides information about meters and ancillary equipment used with AMI.
•	Section 4 provides information about communications systems that transmit data between
metering locations and a central data repository.
•	Section 5 provides guidance on information management, encompassing collection, storage,
analysis, and display of AMI data and alerts.
Section 6 provides guidance on procedures for investigating AMI alerts.
•	Resources presents a comprehensive list of documents, tools, and other resources useful for
integration of AMI into an SRS. A link to a summary of each resource is provided, which are
listed in order of use.
•	References presents a list of published literature cited within the document.
•	Glossary presents definitions of key terms used in this document, which are indicated by bold
italic font at first use in the body of the document.
This document is written in a modular format in which the guidance provided on a specific topic is largely
self-contained, allowing the reader to skip sections that may not be applicable to their approach to AMI,
or that describe capabilities that have already been implemented. Furthermore, this document was written
to provide a set of core guiding principles that are sufficient to implement the AMI component, while
pointing the reader to additional technical resources useful for a specific task. The reader may benefit
from locating and downloading technical resources of interest from the Resources section for ease of
reference while reading this document.
2

-------
Section 2: Overview of Incorporating AMI into an SRS
Traditional meters are read manually by utility personnel visiting each site. Automated Meter Reading
(AMR) was introduced in the mid-1980s and allows data collection by walking or driving near a meter
(Schlenger, et.al., 2011). Many utilities implemented AMR to improve meter reading efficiency,
timeliness, and safety. Advanced Metering Infrastructure was introduced in the mid-2000s, extending the
benefits of AMR and allowing for automated, frequent, real-time and on-demand access to meter data
from a central location.
AMI can be incorporated into an SRS to improve system security and resilience. AMI can provide real-
time notification of backflow from a customer connection and meter tampering, both of which could
indicate accidental or intentional introduction of a contaminant into a water distribution system. Active
monitoring of these alerts can facilitate a timely and effective response, helping to mitigate potential
consequences.
Backflow is the reversal of water flow in which water or other substances from a premise plumbing
system flows back into the water distribution system. Backflow occurs when water pressure on the
premise side of the meter is higher than that on the distribution system side of the meter. This shift in
relative water pressure can occur in two ways (USEPA, 2001 and 2003):
•	Backsiphonage is caused by a pressure drop in the distribution system due to a main break,
system flushing, fire flow, or any situation where large volumes of water flow out of the
distribution system at a rapid rate.
•	Backpressure is the result of increased pressure on the premise side, such as by high pressure
equipment at a residence or industry that is connected to the home or facility's premise plumbing
system.
Intentional contamination where a perpetrator pumps contaminant into a distribution system is an
example of backpressure. Staff notification of both types of backflow is valuable, as potentially
nonpotable water entering the drinking water supply can pose public health risks. Backflow alerts should
be investigated immediately.
Tampering refers to the unauthorized handling or damage of an AMI meter. Tampering alerts should be
investigated as soon as possible, as most tampering incidents are due to water theft. A less likely,
although possible cause of a tampering alert, is removing or disabling a meter to avoid detection when
injecting a contaminant. Thus, the combination of backflow and tampering alerts could indicate an
intentional injection of contamination. Contaminant injection could have catastrophic consequences for
the utility and region (AWWA, 2013). Prompt response to an AMI backflow or tamper alert allows for a
reduction in consequences, as early awareness could allow for a contaminated portion of a distribution
system to be isolated, customers to be notified, or flushing to be performed. If an extended injection of
contaminant is attempted, fast response may provide responders with an opportunity to interrupt the
injection, if the utility has a WCR protocol for AMI.
The bulleted list below further describes how AMI contributes to achieving standard SRS performance
objectives. Performance objectives are measurable indicators of SRS benefits and are defined in the Water
Quality Surveillance and Response System Primer.
•	Incident coverage. AMI provides reliable detection of intentional or accidental contamination
due to backflow and tampering.
•	Spatial coverage. AMI provides coverage throughout the metered portion of the distribution
system since every meter becomes a monitoring location.
3

-------
•	Timeliness of detection . AMI alerts occur immediately at the time backflow or tampering occurs,
allowing for fast response to minimize the spread of contaminant and potentially interrupt the
introduction of a contaminant.
•	Operational reliability: AMI meters and communications equipment are reliable, and experience
little downtime2.
•	Alert occurrence: Backflow and tampering alerts are generally valid alerts and also often help
identify needed meter repair, detect water theft, and identify potential cross connections.
•	Su stain ability: Integration of AMI into an SRS is relatively inexpensive with minimal
maintenance costs if AMI has already been implemented for utility operations and conservation.
In the construct of an SRS, AMI is comprised of four basic design elements: Equipment,
Communications, Information Management, and Alert Investigation Procedures as summarized in Table
2-1. The first three elements are inherent to any AMI system and can generally support integration into an
SRS with minimal modifications. Alert investigation procedures are developed during development of the
AMI SRS component, as described in Section 6.
Table 2-1: Elements of an AMI SRS Component
AMI Element
Description
AMI Equipment
The hardware that generates AMI data, especially meters that measure the flow to a
customer connection.
Communications
Equipment and systems used to transmit data from the meter or endpoint to the
information management system.
Information
Management
System(s) that retrieve and store data and alerts from meters and other AMI
equipment, and then provides data access, visualization and analytics.
Alert Investigation
Procedures
A documented procedure for the timely and systematic investigation of alerts with
clearly defined roles and responsibilities for each step of the process.
Incorporating AMI into an SRS generally involves limited capital investment, as existing equipment can
generally be directly leveraged. Planning for effective AMI integration can include a review of the
existing communications, information management systems, visualization tools and how to best leverage
these existing resources. The business case for implementing AMI may be driven by other applications of
AMI such as leak detection, customer-facing interfaces, and real-time modeling and should also
acknowledge equipment lifecycles, technology maturity, and sustainability.
2 A typical AMI system performance metric is read success rate (RSR). With several solution providers, the range of
RSRs from all meters within a three-day period is between 98.5% and 99.5%.
4

-------
Section 3: AMI Equipment
Understanding your utility's AMI equipment is important when integrating AMI alerts into an SRS, as
several factors impact alert generation, alert occurrence, and the timeliness of information available for
alert investigation. This section describes AMI equipment types, which are summarized in Table 3-1.
Table 3-1: AMI Equipment Types
Equipment
Description
Meter
Measures the flow to a customer connection. This data can be used to calculate
water usage and to detect backflow. Meters can also detect tampering.
Meter Interface Unit
(MIU)
Receives a hardwired signal from a meter, converts this signal to a flow value, stores
flow values, and wirelessly transmits stored data to the information management
system. Alerts or faults generated are also transmitted.
Other Sensors
Meters may be coupled with other sensor types including pressure monitors,
temperature sensors, acoustic sensors, and water quality monitors. This data is also
transmitted to the information management system.
Remotely Controlled
Valves
Allows a utility to shut off or turn on water service at a customer connection from the
information management system.
3.1	Meters
Meters generally fall into one of two categories: mechanical or solid-state meters. The standard flow
meters used by utilities are mechanical with an embedded mechanism that rotates, and the number of
rotations is translated to flow. Solid-state meters are newer electronic devices with no moving parts and
employ a variety of measurement techniques to more reliably measure flow such as acoustic waves and
magnetic fields. They may also achieve improved flow resolution, integrate sensors or valves, have self-
monitoring functions, and have integrated Meter Interface Units (MIUs).
The meters included in your utility's AMI system can impact how AMI alerts are generated and
configured for an SRS and information available for alert investigations. Functionality to consider related
to meters include:
•	Built-in alerting capabilities for backflow and tampering,
•	Measurement range, precision, flow direction, and
•	Error codes or values generated that provide information on meter function.
Current equipment configuration should be considered. Functionality not in use that could enhance SRS
benefit should be enabled if possible. For example, meters may have the ability to generate backflow
alerts that is not currently implemented. If a utility enables the unused functionalities, they should update
their WCR to include a protocol for investigating and responding to alerts.
3.2	Meter Interface Units
MIUs are the gateway between meters and the data communications network, allowing the data and
analytics generated on site to be transmitted to the information management system. For this document,
the term MIU includes common industry terms such as register, encoder and in some cases data collection
unit. Some MIUs contain advanced features. For example, they may perform self-monitoring functions
such as checking the remaining life of the onboard battery and determining if the meter is communicating
properly with the information management system. MIUs with an embedded Global Positioning System
(GPS) chip may generate a tamper alarm when communications to the meter has been lost (e.g., the
connector cable has been severed) and if MIU movement has been detected. Also, some MIUs may have
5

-------
logic enabling preset or configurable threshold alerts for backflow. The MIU contains a battery and a
computer chip if data is sent by cellular communications, or either a transmitter or transceiver if the data
is communicated by Radio Frequency (RF).
The MIU logic defines how data is stored and when it is transmitted to the utility's information
management system, which impacts the timeliness of detection aspect of AMI in an SRS. Typically, the
MIU periodically (e.g., every 15 minutes or hourly) collects, timestamps, and stores the flow and other
data. The MIU logic impacts the subsequent elements of Communications, Information Management and
Alert Investigation Procedures. The frequency of the data collection does not have a significant on impact
on the battery life, but the transmission frequency can be very significant. Your utility will have to find
the optimal balance between data collection and data transmission to balance any competing goals of the
AMI system.
3.3	Other Sensors
In addition to flow meters, a utility may choose to install other sensors to improve overall system
awareness, support operations, and augment the SRS incident coverage and sustainability performance
objectives. These may include water quality monitors, pressure sensors, and temperature sensors. Pressure
and temperature are the sensor types more commonly included with AMI, though their inclusion is not
standard. Additional sensors may be integrated directly with AMI equipment, connect to AMI
communications hardware, or otherwise leverage the AMI architecture. AMI equipment vendors are
increasingly providing gateways to allow for the connection of additional hardware.
Inclusion of additional sensors in an AMI system can support an SRS by providing additional data to help
detect hydraulic or water quality issues or support the investigation of alert causes. For example, a change
in pressure could corroborate backflow, and abnormal water quality data could support the possibility that
a contaminant has been injected. AMI meters near Online Water Quality Monitoring (OWQM) locations
can possibly provide additional data to help corroborate alerts generated by other SRS components.
3.4	Remotely Controlled Valves
Some meters include an integrated remotely controlled valve. In other cases, a standalone, remotely
controlled valve can be installed next to the meter and either hardwired to the MIU or separately
connected to the utility's information management system. Remotely controlled valves are useful for
managing customer connections, as service can be turned on or off for customers without utility staff
visiting the site. Due to cost, it is uncommon for utilities to install valves at every customer connection.
Remotely controlled valves may be installed at select locations such as customers with frequent changes
in service status, e.g. summer homes or student housing.
These valves can also support SRS response. In the case of backflow, valve closure (automatically or by
utility staff) to inhibit intentional or unintentional flow into the distribution system from a premise could
minimize contamination. Additionally, closing remotely controlled valves could stop water from reaching
customers if distribution system contamination is confirmed.
6

-------
/" >
/	AMI Pressure Sensors and Alerts
The availability of pressure alerting varies by sensor manufacturer. Typically, an alert is
generated when a sensor detects a pressure drop or spike that is outside the normal
operating pressure range as established by the utility. The response to a pressure alert will
depend on the duration of the pressure deviation and how low the pressure reaches. A
continuous low-pressure condition should be investigated immediately because of the
potential risk to public health during a negative pressure situation. Most states have
mandated minimum pressure requirements (usually 20 psi during fire flow conditions).
Some states have required pressure monitoring for pipe repair and different disruptions in
service, which in turn correlate to state response requirements, e.g. Ohio requires a
pressure of at least 20 psi (Ohio, 2018). A pressure alert may also indicate that there is an
operational problem such as a main break, or an issue with a pump or valve. Some sensors
may collect pressure data as frequently as 20 times per second for transients and transmit
the data to the AMI system hourly.

-------
Section 4: Communications
AMI requires a means to transmit data from the meter to the information management system. Guidance
,fi	'i Communications Systems for Water Quality Surveillance and Response Systems describes
various evaluation criteria, communications technologies, and requirements for the various SRS
components, including AMI. It also contains information about design and implementation factors such as
security, transmission rates, redundancy, topology, and architecture diagrams.
AMI has rigorous communications needs due to the large number of meters deployed. For AMI,
communications logic is defined at the MIU, and there are two general transmission kinds:
•	Scheduled data transmission: Data is transferred to the information management system at a pre-
defined, recurring polling interval. An interval of 4, 6, 12, or 24 hours is common. The lower
frequency may be selected to preserve battery life and reduce communications requirements,
though more frequent transmission allows for more timely access to data.
•	Conditional data transmission: Each MIU may initiate data transfer immediately upon defined
logic being met. For example, alerts generated within the AMI meter or through MIU self-
monitoring may be immediately sent instead of waiting for the next scheduled data transmission.
This allows for more timely notification of backflow and tampering alerts, thereby increasing the
timeliness of detection performance objective of an SRS.
The transmission type and frequency significantly impact AMI alerting. Most significantly, the timeliness
of transmission of data and alerts to the information management system determines how quickly staff
can be notified of abnormal conditions, which subsequently impacts how quickly investigation and
response actions can be taken. A low data transmission frequency causes a delay in alert notification
since data is not available for analysis until it is transmitted, and alerts cannot be conveyed to staff until
they are in the information management system. Local data analysis generates alerts at the individual
meters, allowing for faster notification if the MIU is programmed to push alerts to the information
management system when they occur.
Two-way communications provide the most functionality for an SRS, in which commands can also be
transmitted from the information management system back to the AMI meters and sensors. Two-way
communication enables utility personnel to interact with the MIU, such as querying for the latest meter
read, rather than waiting for the next scheduled data transmission. This on-demand data access allows for
remote management of meters and remote control of valves and supports the investigation of AMI alerts.
Some AMI systems use one-way communications, from the meter to the information system, which
allows for integration into an SRS but may impose some limitations on data access and functionality.
These communications may utilize a proprietary wireless network or networks using unlicensed
frequencies, as described below.
There are two main types of AMI communication networks, and AMI solutions can be deployed as one
homogeneous network or can be a hybrid of these:
•	Proprietary Communications Networks are owned and managed by a private entity. These
include cellular networks and RF networks on Federal Communication Commission licensed or
unlicensed frequency spectrums. Wireless technologies have been rapidly evolving, beginning
with third generation (3G) data rates. Long-Term Evolution (LTE) is a cellular method of
transmitting data used in some solid-state meters. At least one company has a licensed RF capable
of transmitting more data over longer distances.
•	Open Standard Communications Networks provide an open architecture concept which expands
the market of wireless devices that can operate over an AMI communication network. Examples
of Open Standard Networks include Lora WAN, Wi-SUN and Narrowband IoT. These networks
8

-------
are favored by some city or state-owned metropolitan entities because of lower energy
requirements and increased coverage.
As with any communications system, AMI equipment and the networks used to transmit AMI data are
vulnerable to cyberattack. This can allow perpetrators to infiltrate utility systems, disrupt utility
operations, or steal information. Thus, it is important to incorporate effective physical security, encryption
and cybersecurity controls into the system. For information about cybersecurity best practices, refer to the
Framework for Improving Critical Infrastructure Cvbersecuritv.
9

-------
Section 5: Information Management
An information management system retrieves and stores data and alerts from meters and other sensors,
and then provides analysis, access, and visualization of that data. This section describes AMI data
management, analysis for common types of AMI alerts and staff notification, and access and visualization
of AMI information as part of an SRS.
5.1 AMI Data Management
For AMI systems, meter and sensor data from the endpoints is generally communicated to wvAMI
headend system where it is stored and processed. AMI headend software is typically offered by the AMI
vendor and used to administer the system, monitor system health, and initiate and receive
communications. Some AMI headend systems contain business intelligence (BI) functionality for data
analysis, and specialized applications.
The headend is also typically an integration hub, communicating to other utility systems to leverage the
benefits for operations, conservation, and resilience. These can include GIS, distribution system models,
work management systems, billing systems, and customer information systems. For integration of AMI
into an SRS, the AMI headend may be connected to the SRS-related information management system(s)
for data analysis, visualization, alert notifications, and investigation tools and tracking. Guidance for
Developi. '	'	ce and Response Systems provides guidance on
information management system requirements for an SRS.
5.2 AMI Data Analysis
When integrated into an SRS, AMI data is analyzed in real time for values or data patterns that suggest
backflow or tampering. Analysis of AMI data to produce alerts is generally straightforward, using built-in
alerting capabilities of AMI equipment or analysis of single data points. The alert types used for the AMI
SRS component are inherent to many AMI systems and can be directly leveraged for an SRS.
As discussed in Section 3, local data analysis can occur at individual meters or MIUs (also called edge
computing). Local data analysis can provide faster notifications if alerts are immediately pushed to the
AMI headend, particularly if scheduled data communication is infrequent. However, not all meters and
MIUs are capable of local data analysis, and local data analysis only considers data from that single meter
location.
r
IT SUPPORT AND DATA STORAGE
Internet technology support is needed to fully leverage the benefits of AMI. Data may be hosted
securely in-house, or in the cloud. In-house allows for more control of the data. Cloud hosted data
can be more scalable, require a smaller capital investment, and may use a software, platform or
infrastructure as a Service, i.e., SaaS, PaaS, and laaS. Specific data analytic types (anomalous
conditions, pattern recognition, and predictive analysis) may vary by meter vendor, IT support and
mode of data hosting.
J
Analysis can also occur once data has been transmitted to the centralized information management
systems, which can allow for more advanced and customizable data validation and analytics. Unlike the
MIU where a single meter location is considered, using a headend or centralized information management
system allows all historical meter data to be included in analyses, along with different data types. A
headend or information management system can automate portions of some initial data analyses to
10

-------
identify invalid data or group related alerts into a single incident for staff to investigate. An AMI headend
can also connect to a general analytics engine or AMI-specific software (e.g. to detect meter data errors
and simultaneous backflow and tampering alerts) to provide for more complex analysis of the large
amount of data produced through AMI and an SRS. Data patterns and methods are different for detecting
backflow and tampering, as described in this section.
Backflow Alerts
Many meters and MIUs have the capability to detect and produce an alert for backflow, either directly or
by monitoring the flow values recorded. Alternately, detection of backflow can be implemented in the
headend or information management system by assigning a preset alerting threshold for negative flow.
Many AMI systems already incorporate backflow alerts, and preset alerts can be directly leveraged for an
SRS.
If using a flowrate threshold for the detection of backflow, the differences in the data can be calculated at
the MIU, or by the headend or information management system. Threshold values can also be configured
at the headend. In this case, the threshold for multiple meters can be customized relatively easily from a
single interface. In addition, thresholds can be easily changed, to adjust the threshold system-wide to
minimize invalid alerts, e.g. from the slight expansion of water from a water heater back through a
meter. Settings and algorithms will depend on the specifics of the MIU logic and AMI headend software
provided.
Alert Sensitivity and Terminology
A meter may sense movement and measure 'negative' flow not indicative of a true backflow.
Water can move back and forth in a pipe due to changes in pressure or entrapped air, thereby
potentially affecting the meter read. A utility may see one or two 'reverse flow', 'invalid
consumption', 'negative consumption' or other vendor alarm terms suggesting a backflow, even
during a 'positive' flow for a reporting interval. For example, the data may show the meter moved
backwards by a tenth of a gallon within an hour period, but the overall consumption is positive, and
the meter moved forward when the hourly data was transmitted at a four-hour interval.
Meter sensitivity for backflow may be preset by the manufacturer. A meter preset is generally
based on flow directionality and not time, so if the meter moves backward the MIU records an
alarm. Mechanical meters with nutating discs may be less sensitive to reverse flows than solid-
state meters. While rare, electromagnetic meters can have air trapped in the chamber and be
slightly prone to invalid alerts. The meter for at least one vendor generates alerts for the abnormal
condition of 'empty pipe'. Headend analytics may be used to detect when hourly readings are not
aligned with a previous four-hour interval read.
Tampering Alerts
Tampering refers to the unauthorized handling or damage of an AMI meter. The most common reason for
tampering is an attempt of water theft. However, an intruder may remove or disable the meter when
injecting contaminant to avoid detection or if there is a backflow prevention device at the meter.
Meters can directly detect tampering with alerts generated if there is a cut wire, meter movement, or
magnetic tampering. Meters may have a GPS tracker to detect if the meter or MIU has moved.
Information management systems can also help to detect tampering indirectly, by applying logic and
algorithms to AMI headend systems. For example, a sudden stop in flow data corresponding with meter
removal or a significant change in pressure corresponding with an increase in turbidity could suggest a
disturbance at the meter.
11

-------
Alert Notifications
When an AMI alert is generated, personnel responsible for investigating the alerts must be notified to
ensure that all AMI alerts are acknowledged and that the alert investigation begins in a timely manner. An
optimal notification system brings the alert to the attention of the investigator immediately and provides
selected details to support the investigation.
A utility can have automated phone, email, or text message notifications sent electronically to specified
staff when an AMI alert is generated. Alternately, alerts can be conveyed via a visual or audible display
on a routinely monitored dashboard. Some systems require a user to acknowledge that the alert has been
received, with follow-up notifications automatically occurring if acknowledgement has not occurred
within a specified time period.
5.3 Data Access and Visualization
An important element of AMI information management is providing utility staff access to the information
they need in a clear, useful format. When incorporating AMI into an SRS, data access and visualization
can be provided through the AMI headend or other applications that are connected to the AMI headend,
including the applications used for other SRS components.
Users generally interact with data through user interfaces, which can range from simple screens
developed in a standard computer application to complex dashboards created by development tools that
make accessing and visualizing information intuitive. SRS dashboards generally show near real-time data
and information and can include a single source of data or can integrate multiple information types on one
or more screens. Geospatial dashboards can provide context for the data and help staff identify patterns,
such as alerts from AMI and other SRS components that are spatially clustered.
Dashboards are an important component of an SRS, as they convey alerts to staff, support alert
investigation, and capture and store information about investigation activities. Accuracy, completeness,
and documentation of investigations can be improved if activities are integrated into a user dashboard. For
example, screens can guide users through specific alert investigation responsibilities and require users to
select from a pre-defined list of alert causes before closing each alert.
An example AMI dashboard is shown in Figure 5-1. In this example, the functionality needed for an alert
investigation procedure is integrated into a general AMI user interface. Typical AMI monitoring and
analysis information is shown, such as total system consumption and a variety of AMI alert types
including non-reporting meters, pressure events, intermittent leaks, continuous leaks, backflow and
tampering. SRS alerts for backflow and tampering are shown on the geospatial display, with specific
details available in individual information boxes. The alert investigation information panel lists AMI
alerts and shows the alert date/time, location, type, investigator, start and end times, conclusion, and
notes.
12

-------
AMI Data and Resilience
AMI data has been leveraged to make water utilities more resilient, as illustrated by the following
case studies.
During Hurricane Sandy in 2012, one utility identified areas with disrupted power service by noting
where AMI data was missing. This information was provided to the city and used to prioritize
response activities (Mix, 2016).
During the COVID-19 pandemic, many buildings were closed for an extended period due to stay-
at-home orders. This resulted in stagnant water, degraded water quality, and potential public
health risks (USEPA, 2020a). To identify areas where this could be a problem, Cleveland Water
used AMI data to identify the accounts with the largest reduction of usage. These account holders
were directly messaged about the importance of flushing premise plumbing to avoid stagnant
water, thus ensuring acceptable water quality and protecting public health (Smith, 2020).
13

-------
AMI Alerts
Alert Distribution
Type |sBackflowj#Continuous Leak • intermittent Leak #NorvReporting Meters • Pressure Even^#Tamper
Total System Consumption
m

Meter replaced.
See work order *
AM 12020
Meter was
reversed to steal
water.
Loose wire. Water
and debris in
meter can.
January
February
Month
	O
Non-Reporting Meters
5/4/2020
2:15 AM
5/5/2020
&05 AM
5/6/2020
4;05 PM
location
123 Main
456 Hill St
789 Valley Rd
Alert Investigation Information
Alert Date/ Alert
Time
Backflow
or
Tamper
Backflow
Tamper
Tamper
nvestigator Investigation Investigation Conclusion
Start Date/ Stop Date/
Time
lean Smith 5/4/20
2:16am
lohn Brown 5/6/20
B:Q6am
'asha Lee 5/6/20
4:0?prn
Time
5/4/20
2:30am
5/6/20
B:30am
5/6/20
4;30pm
Invalid alert: Meter
malfunction
Valid alert Water
theft
Invalid alert:
Environmental
condition
Continuous Leafc
i
3/2/2020 5/6/2020
o
Alert Types
Pressure Event 2
Intermittent Leak
3
Figure 5-1: Example Dashboard for AMI Information
14

-------
Section 6: Alert Investigation Procedures
Once an AMI alert is received by utility personnel, it should be promptly investigated to identify the
underlying cause of the alert. AMI investigations are guided by documented procedures and include data
review and onsite investigations to determine whether the alert can be explained by a known, benign
cause. If the cause cannot be determined, contamination is considered possible, and Water Contamination
Response is used to determine the credibility of the incident and respond appropriately.
An alert investigation procedure guides consistent and efficient investigation and documentation
activities. This section describes considerations for developing and implementing an effective AMI alert
investigation procedure.
6.1 Developing an Effective Alert Investigation Procedure
This section describes a methodical process for developing an AMI alert investigation procedure. The
steps of the process, listed below, are described in the following subsections:
•	Defining potential alert causes: develop a discrete list of alert causes used to classify each alert;
•	Establishing an alert investigation process: list detailed, sequential steps for investigating an alert;
and
•	Assigning roles and responsibilities: identify all personnel who have a role in alert investigations
and summarize their responsibilities.
The AMI Alert Investigation Procedure Template includes an
editable process flow diagram, table and checklist that can be
used to document the utility's role during an AMI alert
investigation. The template can be opened in Word by clicking
the icon in the callout box.
Defining Potential Alert Causes
A main objective of the alert investigation process is to identify the cause of an alert. Pre-defined alert
categories can be used to classify alerts during each investigation. Awareness of the common causes of
AMI alerts can be used to develop the steps of an investigation procedure and identify resources helpful
in confirming or ruling out potential causes of an alert.
Table 6-1 lists and summarizes common causes of AMI alerts. The causes are grouped into invalid alerts
and valid alerts based on if the alert is caused by true backflow or tampering. The list of acceptable alert
causes should be customized by each utility and may be adjusted based on experience investigating alerts.
Determining the alert cause is useful for revealing problems, e.g. a malfunctioning meter, even if the alert
is not indicative of a true backflow or tamper incident.
This template can be
used to develop an AMI
alert investigation
procedure.
15

-------
Table 6-1: Common Causes of AMI Alerts

Alert Cause
Description
Invalid Alerts
Employee Error
Employee or contractor installed a meter backwards.
Employee or contractor accidently cut a wire at the meter.
Employee or contractor moved a meter without proper reporting.
Equipment Issue
Sensor malfunction.
Communications fault or power failure.
Water heater expansion causing backflow.
Data Analysis Error
Automated data validation or analysis algorithm incorrectly generated an alert.
Environmental
Flooding, freezing, or damage by animals.
Valid Alerts
Non-contamination
Water theft.
Vandalism.
System activities caused by flushing, hydrant testing, firefighting or mainline break.
Operational changes caused by exercising valves or pumping operations.
Possible contamination
Cross connection (at customer connection).
Signs of contamination at the location of the AMI alert.
Investigators cannot rule out the possibility that the premise is a source of
contamination introduced into the water distribution system.
Establishing an Alert Investigation Process
With potential causes of AMI alerts defined, the next step is to develop an alert investigation process to
guide investigators through a detailed sequence of steps to determine the cause of an alert. AMI alerts
need to be promptly investigated by utility personnel to determine if the incident might be related to or
cause drinking water contamination. The sooner response actions are initiated, the more effective they can
be in minimizing consequences.
In general, the process begins with receipt and acknowledgement of an alert and ends with a
determination of alert cause. The steps between involve a review of all available relevant and accessible
information to investigate potential causes of the alert. The alert investigation process is generally
structured to consider the most likely causes first, allowing contamination to be quickly ruled out for the
majority of alerts. The AMI alert investigation is then closed and documented. There are four key actions
of AMI alert investigations:
Continuous Monitoring
As part of an SRS, there is continuous monitoring for backflow and tampering, as the real-time data
generated through AMI is analyzed as it is generated or communicated, and alerts are automatically
conveyed to staff. An AMI investigation begins when utility staff receive and acknowledge an AMI alert.
Receipt of and response to alerts 24 hours per day and seven days per week is recommended but may be
constrained by utility staffing. Backflow alerts should be investigated immediately, especially if
accompanied by a tamper alert (Mix, 2020). Backflow into the system could pose a risk to public health,
and a prompt response and field investigation, if necessary, which can significantly reduce consequences.
The urgency of investigating a tampering alert may be a risk management decision during non-work
hours, as tampering alerts may be attributed to water theft and generally do not result in water
contamination. However, prompt investigation of tamper alerts is important because if a meter is removed
to intentionally contaminate a distribution system, only a tamper alert may be received.
16

-------
Data Review
Utility personnel review available information to investigate potential causes of the alert, developed as
described in Table 6-1. Examples of data sources to review include the AMI headend system, the
customer connection history, water quality complaint details, system pressure or water quality data from a
Supervisory Control and Data Acquisition (SCADA) or SRS system, ongoing work orders in a work
management system, newsfeeds, and alerts from other SRS components. Investigators may also reach out
to other departments and stakeholders to access relevant information that may explain why the alert
occurred.
Other factors used to determine the validity of alerts include:
•	Records of recent meter installation or maintenance of the meter could point to invalid alerts that
are employee error causes (as in Table 6-1).
•	Invalid backflow and tamper alerts can generally be identified promptly by reviewing AMI data
values and instrument alerts, the status of the communications system, and if any utility meter or
system work is occurring nearby.
•	If backflow alerts are received from multiple meters, if alerts from other SRS components have
been received, or if abnormal pressure data is observed in the area, then backflow is likely caused
by a distribution system issue. Clustering of backflow alerts provides for early detection of a main
break.
•	System activities or operational changes such as flushing, hydrant testing, changes in nearby
valving or pumping, main breaks or firefighting reported in the area of a backflow alert may also
suggest a distribution system disturbance. Referencing ongoing work orders and contacting
stakeholders working in the area could suggest the alert cause.
•	Exercising valves could cause a backflow alert for a district meter.
•	A poorly designed, constructed or inspected system that is stressed could potentially see low
pressures with high demands, depending on elevation, equipment and activity resulting in a
backflow alert.
•	The prevalence or absence of backflow prevention devices and the potential for a cross
connection on both sides of the meter are factors for backflow alerts.
•	If customer calls indicate unusual behavior at the site of the alert, meter tampering or intentional
contamination is deemed possible and Water Contamination Response procedures are
immediately initiated.
Field Investigation
If definitive evidence is not available to identify a cause for the alert through data review, an investigation
is conducted on site to identify the cause of the alert and determine if there is potential contamination of
the finished water supply. Safety measures should be taken including wearing PPE, having appropriate
staff onsite or standing by, and requesting police escort if at any time the incident seems suspicious or
dangerous. Guidance for Building Field Capabilities to Respond to Drinking Water Contamination
provides guidance for performing field activities safely.
When staff arrive at the site, they should immediately inspect the site for signs of contamination before
proceeding. This includes perpetrators still on site, suspicious vehicles or equipment (e.g., containers,
hoses, or discarded PPE), unusual vapors or odors, or dead or distressed vegetation or animals.
Subsequent inspection activities at the site and meter, as needed, are specified in the alert investigation
checklist. These potential causes include:
•	Meter installation error
•	Malfunctioning meter or MIU
17

-------
•	Flooding in meter box, loose wire or damage by an animal, rodent or pest
•	Distribution system valve exercising or flushing of main
•	Fire demands
•	Main break or customer service line break with visible water on the ground
•	Water theft
•	Pressure Releasing Valve (PRV) failure or blockage
•	Backflow prevention failure
For tampering alerts, investigators should verify if the meter is removed, reversed, bypassed, or has a
magnet on it, and if the communications cable been damaged. For backflow alerts, investigators should
check that the meter has been installed in the correct direction, shut off the water, check the pressure on
the customer side of the meter (e.g., at a hose bib), and check for cross connections (e.g., at a private well,
irrigation system, or swimming pool).
Resolution
All alert investigations should be officially closed, and the cause of the alert documented. Even if the
cause of an alert is not determined once the investigation is closed, the details of the investigation should
still be documented to support future investigations. If the investigator concludes that there is potential
contamination of finished water, the SRS manager is notified and additional investigative and response
actions are implemented under the utility's Water Contamination Response Plan. This plan includes
procedures to establish the credibility of the possible contamination incident, minimize public health and
economic consequences by implementing response activities such as operational changes (e.g., close
valves, turn off pumps) or public notification, and guide the remediation and recovery effort. The
credibility of an AMI alert can quickly escalate, requiring notifications to external partners, such as the
drinking water primacy agency. The Guidance for Respondi ¦	¦	
-------
Table 6-2: Differences in Key Action Examples for Backflow and Tampering
Key Action
Backflow
Tampering
Continuous
Monitoring
Respond to alerts immediately.
Respond to alerts as soon as possible.
Data Review
Check for other backflow alerts in the area, drops
or spikes in system pressure, flushing, hydrant
testing, valve operations, mainline breaks or
firefighting in the area.
Check for customer potential to cause the alert or
history of water theft.
Dispatch Staff
Shut off water, check pressure, and look for
causes of backflow and contamination.
Check for signs of meter removal, reversal, bypass
tampering and water theft.
Resolution
Consult with public health officials if necessary.
Consult with law enforcement if necessary.
The alert investigation process can be visually depicted in a diagram that shows a simplified
representation of the progression of steps. Separate procedures may be developed for business and after-
hours incidents, specific types of alerts, and specific investigatory roles. Figure 6-1 provides an example
of an AMI alert investigation process flow diagram.
19
-------
c
1: Receive an AMI alert.

1
r
2: Review available data to investigate cause,
(e.g. meter faults, work orders, and data and
alerts from other SRS components)
1
r
15 Start of Process
I I Action Performed
Decision Step
End of Decision Tree
3: Can data review determine the
alert is invalid?
(e.g. due to meter malfunction or a
maintenance error)
I
No
	±	
4: Can contamination be ruled out
through data review?
I
No
L
Yes
Yes
5: Inspect meter and conduct an on-site
investigation, using appropriate safety
measures.

r
8: Close
investigation and
log incident.
6. Are there signs of
contamination?
I
Yes
	k	
No
7. Determine alert
cause and follow up as
needed.
9: Contamination is
suspected. Notify
designated personnel and
initiate Water
Contamination Response.
Figure 6-1: Example Alert Investigation Process Flow Diagram for AMI Alerts
20
-------
Assigning Roles and Responsibilities
Different utility personnel may be involved in investigating AMI alerts. Table 6-3 shows an example of
roles and responsibilities during AMI alert investigations. These will vary by utility and should be
customized by information sources available for review by your utility.
Table 6-3: Example of Generic Roles and Responsibilities for AMI Alert Investigations
Role
Alert Investigation Responsibilities
AMI Manager
•	Monitor AMI alerts including backflow/tamper alerts.
•	Perform the data review of alert information to determine if the backflow/tamper alert
is invalid, such as:
o Reviewing information from additional SRS components, if available,
o Reviewing work orders in the work order management system, including
activities such as flushing, hydrant testing, pump and valve operations, and
mainline breaks.
o Reviewing communications between engineering and maintenance dispatch
groups that describe work in the area, if there is no work management system,
o Check reports of high or unusual demand, such as due to firefighting activities.
•	Notify utility onsite investigation personnel if a backflow/tamper is suspected.
•	Notify local public health officials of any backflow alerts that may require their
involvement. For example, if a site investigation reveals plumbing conditions that
may make drinking water within the premise plumbing system unsafe for use (e.g.,
an apparent cross-connection).
•	Notify local law enforcement of tamper alerts that may require their involvement.
•	Notify the SRS Manager if signs of contamination are observed on backflow/tamper.
•	Determine whether contamination of the water supply is possible and initiate Water
Contamination Response.
Utility Control Center
Operator
•	Monitor all SCADA alerts 24/7/365, including AMI and pressure alerts.
•	Perform AMI Manager duties during non-business hours or if the AMI Manager is off
duty or does not acknowledge the AMI alert.
Water Quality Supervisor
or SRS Manager
•	Monitor for OWQM alerts.
•	Implement Water Contamination Response.
Customer Service
•	Monitor for Customer Complaint Surveillance (CCS) alerts.
•	Review account history for tampering and theft.
Meter Technician
•	Lead the on-site investigation of all AMI alerts.
•	Coordinate site investigation activities with distribution field crews and local law
enforcement, as necessary.
•	If backflow/tampering is confirmed, determine if contamination at the customer
connection could have entered the distribution system.
•	Make the determination regarding if there was an opportunity to contaminate the
drinking water.
•	Review distribution system work activity to determine if an AMI alert could have
been inadvertently caused by utility personnel.
•	Ensure employees, equipment or environmental factors didn't cause the alert.
•	Look for cross connections at the premise.
Local Law Enforcement
• Help conduct an investigation at the premise for a tampering alert, or significantly
consequential backflow incident, if warranted or entry and inspection is needed.
Local Public Health
•	Evaluate whether a public health or safety violation has occurred, if
backflow/tampering is confirmed.
•	Advise on health issues related to contamination as result of backflow.
21
-------
6.2 Developing Investigation Tools
While the detailed alert investigation procedure materials described in Section 6.1 are necessary when
developing and documenting the procedure, that level of detail is generally not used during real-time alert
investigations. This section describes checklists, alert investigation records, and quick reference guides
that can be developed to assist investigators in efficiently carrying out their responsibilities.
Checklists
Alert investigation checklists are job aids that guide personnel through their investigative responsibilities
and document investigation findings. Checklists can help ensure consistency among investigators, verify
that all activities are completed, and reduce the time required to conduct alert investigations. They
generally list the activities assigned to specific roles, and more than one checklist may be developed to
support the AMI alert investigation procedure.
Depending on the number of utility roles involved in an investigation and the overall complexity of the
alert investigation process, a utility may have single or multiple checklists. The AMI Alert Investigation
Procedure Template contains an editable AMI alert investigation checklist.
Record of Alert Investigations
A record of alert investigations provides documentation of key information such as the date and time of
the alert and investigation, the name of the investigator, actions implemented during the investigation, and
the conclusion as to the cause of the alert. This record may serve as a resource during the investigation of
future alerts and provides a means to analyze the frequency and validity of alert investigations by a
variety of factors (e.g., alert cause, location, thoroughness of the investigation, time of day, season of
year).
There are a variety of ways to document alert investigations. For example, a spreadsheet can be
maintained that can be accessed by the SRS Manager and all necessary investigators on a shared drive.
Electronic tools and mobile applications make it easy to standardize, synchronize, and compare data,
while increasing accuracy. Records can then be analyzed to show alert frequency, average delay before
investigation begins, staff time required for investigation, common alert types and spatial clustering. In
addition, previous conclusions can be referenced to support current alert investigations. These tools may
provide valuable insight into the need to update alert algorithms, the alert investigation procedure, and
highlight the need for training or exercises on the procedure. Figure 6-2 provides an example of
electronic alert investigation records.
Alert Investigation Information
Alert Date/
Alert
Backflowor
Investigator
Investigation
Investigation
Conclusion
Notes
Time
Location
Tamper

Start Date /
Time
End Date /
Time


5/4/20
2:15 AM
123 Main
Backflow
Jean Smith
5/4/20
2:16 AM
5/4/20
2:30 AM
Invalid alert: Meter
malfunction.
Meter replaced.
See work order#
AM 12020.
5/5/20
8:05 AM
456 Hill St
Tamper
John Brown
5/6/20
8:06 AM
5/6/20
8:30 AM
Valid alert: Water
theft.
Meter was
reversed to steal
water.
5/6/20
4:05 PM
789 Valley Rd
Tamper
Tasha Lee
5/6/20
4:07 PM
5/6/20
4:30 PM
Invalid alert:
Environmental
Loose wire.
Water and debris
condition.	in meter can.
Figure 6-2: Example of Alert Investigation Records
22
-------
If a dashboard will be used to support the SRS, the electronic tracking of investigations may be
incorporated into the design. For example, electronic checklists can be developed that automatically enter
investigation records and updates into an SRS's information management system. Dashboard Design
Guidi	7ater Quality Surveillance and Response System provides more detail on guiding and
recording alert investigations via a dashboard.
Quick Reference Guides
While many alert investigation activities will become second nature to investigators, additional tools may
be useful for completing complex or less frequently implemented tasks. Key information can be
summarized using quick reference guides or factsheets to ensure investigators can easily get the
information they need. For example, quick reference guides could be developed that list meter error
codes.
6.3 Preparing for Real-time Alert Investigations
After the AMI alert investigation procedure is developed, a utility will need to develop a plan to put it into
practice. The benefits of the AMI SRS component can be fully realized only if the alerts are investigated
and responded to appropriately. The following topics are to help prepare for real-time alert investigations:
Training, Preliminary Operation, and Real-time Operation.
Training
Proper training on the alert investigation procedure ensures that all personnel with a role in investigating
AMI alerts are aware of their responsibilities and have the knowledge and expertise needed to execute
those responsibilities. Training on the alert investigation procedure could include the following:
•	An overview of the purpose and integration of the AMI system into an SRS;
•	A detailed description of the alert investigation procedure and the role of each participant;
•	A review of checklists, quick reference guides, information management systems, and other tools
available to support AMI alert investigations; and
•	Instructions for entering new alert investigation records and retrieving previous records.
Section 6 of Guidance for	Developing Integrated Water	Surveillance and Response Systems
provides information on implementing a training and exercise program. In general, classroom training is
used first to orient personnel to the procedure and their responsibilities during AMI alert investigations.
Once personnel are comfortable with the procedure, exercises can be conducted to provide personnel with
an opportunity to implement their responsibilities in a controlled environment. The SRS Exercise
Development Toolbox is an interactive software program designed to help utilities design, conduct, and
evaluate exercises specific to SRS components.
Preliminary Operation
A period of preliminary operation should follow initial training, allowing utility personnel to practice
their responsibilities in test mode before the transition to real-time operation. During preliminary
operations, it may be useful to hold regular meetings with all investigators to discuss recent data and
alerts. It is generally most effective if participants are asked to perform specific analyses or alert
investigations before each meeting and then discuss conclusions, observations, insights, and challenges as
a group. Based on feedback from investigators, responsibilities can be clarified, unnecessary steps can be
eliminated, existing tools can be refined, new tools can be developed, and procedures can be better
integrated into existing job functions.
23
-------
Real-time Operation
During real-time operation, AMI alerts are investigated as they are generated, and the Water
Contamination Response component is activated if a contamination incident is considered possible. The
transition from preliminary operation to real-time operation should be clearly communicated to all utility
personnel with a role in AMI alert investigations. This includes establishing a date for the transition to
real-time operation and providing expectations for how alert investigations will be performed and
documented.
After transitioning to real-time operation, it is important to continue to oversee and support investigators.
The record of alert investigations should be regularly reviewed to ensure that personnel are accurately and
thoroughly carrying out their responsibilities, and instruction should be provided to individuals who are
not. Ongoing drills, exercises, and training are important to ensure that personnel remain familiar with
their responsibilities and to address any changes, such as updates to the procedure or investigation tools.
Maintenance of the alert investigation procedure during real-time operation may involve periodic review
to verify that it is working as intended. Finally, it is important to thoroughly train new personnel on their
responsibilities and alert investigation procedures.
Regularly Review and Update the Alert Investigation Procedure
Routine updates to the Alert Investigation Procedure and investigation tools are necessary to maintain their
usefulness. Recommendations for procedure maintenance include:
•	Designate one or more individuals with responsibility for maintaining alert investigation materials;
•	Establish a review schedule (annual reviews should suffice in most cases);
•	Review the record of alert investigations, conduct tabletop exercises, and solicit feedback from
investigators to identify necessary updates; and
•	Establish a protocol for submitting and tracking change requests.
6.4 Next Steps
Incorporating an AMI component into an SRS can provide significant benefits for utility security and
resilience. Utilities with AMI are strongly encouraged to implement backflow and tampering alerts, if not
already in place, and develop alert investigation procedures to further optimize the investment made in the
AMI system. In general, existing AMI system elements can be directly leveraged, making the required
investment for this additional application of AMI data relatively low.
Visit the Water Quality Surveillance and Response website at
https://www.epa.gov/waterqualitvsurveillance for more information about SRS practices. The website
contains guidance and tools that will help a utility to enhance surveillance and response capabilities, as
well as case studies that share utility experiences with SRS implementation and operation.
24
-------
Resources
Section 2: Overview of Incorporating AMI into an SRS
Water Quality Surveillance and Response System Primer (USEPA, 2015)
This document provides an overview of Water Quality Surveillance and Response Systems (SRS)
for drinking water distribution systems. It defines the components of an SRS, describes common
design goals and performance objectives for an SRS, and provides an overview of the approach
for implementing an SRS. The SRS primer is referenced in the Introduction and Topic 3 of this
document. EPA 817-B-15-002, May 2015.
http://www.epa.gov/sites/production/files/2015-
06/documents/water quality sureveillance and response system primer.pdf
Section 4: Communications
Guidance for Designing Communications Systems for Water Quality Surveillance and Response
Systems (USEPA, 2016)
This guidance document describes an approach for evaluating and selecting communications
technologies to support the transmission of data generated by AMI. The document provides users
with a description of attributes that should be considered when evaluating communications
systems alternatives and a general assessment of common technologies relative to these attributes.
EPA 817-B-16-002, September 2016.
https://www.epa.gov/sites/production/files/2017-
04/documents/srs communications guidance 081016.pdf
Framework for Improving Critical Infrastructure Cybersecurity (NIST, 2020)
The National Institute of Standards and Technology (NIST) provides tools to help organizations
better understand and improve their management of cybersecurity risk. This includes a
framework that describes how to use business drivers to guide cybersecurity activities and
consider cybersecurity risks as part of an organization's risk management processes.
https://www.nist.gov/cvberframework
Section 5: Information Management
Guidance for Developing Integrated Water Quality Surveillance and Response Systems (USEPA,
2015)
This document provides guidance for applying system engineering principles to the design and
implementation of a Water Quality Surveillance and Response System (SRS) to ensure that the
SRS functions as an integrated whole and is designed to effectively perform its intended function.
Section 4 provides guidance on developing information management system requirements,
selecting an information management system, and IT master planning. Section 5 provides
guidance on developing alert investigation procedures for the surveillance components of an SRS.
Section 6 provides guidance on developing a training and exercise program to support SRS
operations. EPA 817-B-15-006, October 2015.
http://www.epa.gov/sites/production/files/2015-
12/documents/guidance for developing integrated wq srss 110415.pdf
25
-------
Section 6: Alert Investigation Procedures
Guidance for Building Field Capabilities to Respond to Drinking Water Contamination (USEPA,
2017)
Provides utilities with planning and implementation guidance, templates, customizable report
forms, and other documentation for visual site hazard assessment, sample collection, water
quality parameter testing, and sample packaging and shipping. EPA 817-R-16-001, January 2017.
https ://www.epa. gov/sites/production/files/2017-
01/documents/field capabilities guidance ianuarv2017.pdf
Guidance for Responding to Drinking Water Contamination Incidents (USEPA, 2018)
This resource provides an editable template for developing a utility-specific Distribution System
Contamination Response Procedure. Elements of this plan include investigation of a possible
distribution system contamination incident, planning for site characterization, implementing
operational response activities, issuing public notification, and planning for remediation and
recovery. An accompanying guide helps the user populate the template to customize the plan to a
specific utility. EPA 817-B-18-005, April 2018.
https://www.epa.gov/sites/production/files/2018-
12/documents/responding to dw contamination incidents.pdf
AMI Alert Investigation Procedure Template (USEPA, 2020)
The alert investigation procedure template includes editable flow diagrams and checklists that can
be used to document the utility's role in an AMI alert investigation process. March 2021.
Click this link to open the template
Dashboard Design Guidance for Water Quality Surveillance and Response Systems (USEPA, 2015)
A dashboard is a visually oriented user interface that integrates data from multiple Water Quality
Surveillance and Response System (SRS) components to provide a holistic view of distribution
system water quality. This document provides information about useful features and functions
that can be incorporated into an SRS dashboard. It also provides example user interface designs.
EPA 817-B-15 -007, November 2015.
http://www.epa.gov/sites/production/files/2015-
12/documents/srs dashboard guidance 112015.pdf
SRS Exercise Development Toolbox (USEPA, 2016)
The Exercise Development Toolbox helps drinking water utilities to design and conduct exercises
to evaluate procedures developed to support a Water Quality Surveillance and Response System
(SRS). These exercises can be used to refine SRS procedures and train personnel in the proper
implementation of those procedures. The toolbox guides users through the process of learning
about training programs, developing realistic contamination scenarios, designing SRS discussion-
based and operations-based exercises, and creating exercise documents. February, 2016. The
Exercise Development Toolbox is Homeland Security Exercise and Evaluation Program
compliant.
https://www.epa.gov/waterresiliencetraining/develop-and-conduct-water-resilience-tabletop-
exercise -water-utilitie s
26
-------
References
American Waterworks Association (AWWA), 2013. AWWA J100-10(R13) Risk and Resilience
Management of Water and Wastewater Systems. STJ0078234.
Ohio Environmental Protection Agency, 2018. Guidelines for Water lines and Repairs in Areas with Lead
Service Lines, PWS-06-001.
Mix, N. and Thompson, K., 2016. Improving Water System Resiliency and Security: Advanced Metering
Infrastructure, Journal AWWA, June 2016.
Mix, N., Thompson, K., Lai, A., and Seachrist, S., 2020. Advanced Metering Infrastructure: Reducing
Water Loss, Improving Security, and Enhancing Resiliency, Journal AWWA, February 2020 (38-49).
Schlenger, D.L., Hughes, D.M., and Green, A., Advanced Metering Infrastructure - Best Practices for
Water Utilities. Water Research Foundation, Denver, August 2011.
Smith, K. (2020, June 10). Returning to Service: Addressing Water Quality in Buildings with Low or No
Use [Webinar], American Water Works Association (AWWA).
USEPA. 2001. Potential Contamination Due to Cross-Connections and Backflow and the Associated
Health Risks, An Issues Paper. September 27, 2001. Washington, D.C.
USEPA. 2003. Cross Connection Control Manual. 816-R-03-002. Washington, D.C.
USEPA. 2020a. Information on Maintaining or Restoring Water Quality in Buildings with Low or No
Use. https://www.cpa.gov/coronavirus/information-maintaining-or-rcstoring-watcr-aualitv-buildings-
low-or-no-usc [Last Accessed February 2021],
27
-------
Glossary
alert. An indication from an SRS surveillance component that an anomaly has been detected. Alerts may
be visual or audible, and may initiate automatic notifications such as pager, text, or email messages.
alert investigation. The process of investigating the validity and potential causes of an alert generated by
an SRS surveillance component.
alert investigation checklist. A form that lists a sequence of steps to follow when investigating an SRS
alert. This form ensures consistency with an alert investigation procedure and provides documentation of
the investigation of each alert.
Alert Investigation Procedure. A documented process that guides the investigation of an SRS alert. A
typical procedure defines roles and responsibilities for alert investigations, includes an investigation
process diagram, and provides one or more checklists to guide investigators through their roles in the
process.
alert occurrence. The frequency of detection of true water quality incidents, the frequency of incidents
that do undetected, and the frequency of invalid alerts.
Advanced Metering Infrastructure (AMI). Systems that measure, collect, and analyze water usage, and
communicate with water meters, either on request or on a schedule. These systems include hardware,
software, and communications for data access, visualization, and analysis. An AMI system may include
consumer use displays, customer associated systems, meter data management software, and supplier
business systems. The meters may be coupled with pressure monitors, temperature sensors, other devices,
outside data streams (e.g. weather), and alert for backflow and tampering incidents.
AMI equipment. The hardware that generates AMI data, especially meters that measure the flow to a
customer or premise.
AMI headend. Software typically offered by the AMI vendor and used to administer the AMI system,
monitor system health, and initiate and receive communications. This may typically be referred to as a
Meter Data Management System.
backflow. The reversal of water flow in which water or other substances from a residential, industrial, or
institutional piping system flows back into the water distribution system.
business intelligence. Technologies, applications, and procedures for the analysis, integration, and
presentation of business information.
communications. Equipment and systems used to transmit data from the meter or endpoint to the
information management system.
component. One of the primary functional areas of an SRS. There are five surveillance components:
Online Water Quality Monitoring (including source water and distribution system monitoring), Physical
Security Monitoring, Advanced Metering Infrastructure, Customer Complaint Surveillance, and Public
Health Surveillance. There are two response components: Water Contamination Response and Sampling
and Analysis.
conditional data transmission. MIU initiates the data transfer immediately upon defined logic being
met. For example, when an MIU receives an alert signal from the meter or detects an internal alert
through self-monitoring, it may be configured to immediately send the alert signal to the information
28
-------
management system instead of waiting for the next scheduled data transmission. This method is also
referred to as "non-synchronized data transfer" and allows for more timely notification of backflow and
tampering alerts.
consequence. An adverse public health or economic impact resulting from a contamination incident.
contamination response procedure. A planned decision-making framework that establishes roles and
responsibilities and guides the investigative and response actions following a determination that
distribution system contamination is possible.
continuous monitoring. Uninterrupted collection and analysis of data. Collection and analysis frequency
can range from seconds to hours.
Customer Complaint Surveillance (CCS). One of the surveillance components of an SRS. CCS
monitors water quality complaint data in call or work management systems and identifies abnormally
high volumes or spatial clustering of complaints that may be indicative of a contamination incident.
customer connections. Metered premise location at which a residential, industrial, or institutional piping
system is connected to a utility water distribution system main.
cybersecurity. Measures implemented to protect an information management system and network from
unauthorized access, damage, or attack. Common examples include password protected computers,
encryption, and use of anti-virus software.
dashboard. A visually oriented user interface that integrates data from multiple SRS components to
provide a holistic view of system water quality. The integrated display of information in a dashboard
allows for more efficient and effective management of water quality and the timely investigation of water
quality anomalies.
distribution system. Networks of storage tanks, valves, pumps and pipes that transport finished water to
customer connections.
incident coverage. The number and type of incidents that can be detected by the SRS, including those
resulting from natural, accidental or intentional contamination.
information management. The processes involved in the collection, storage, access, and visualization of
information. In the context of an SRS, information includes the raw data generated by SRS surveillance
components, alerts generated by the components, ancillary information used to support data analysis or
alert investigations, details entered during alert investigations, and documentation of Water
Contamination Response activities.
invalid alert. An alert from an SRS surveillance component that is not due to a water quality incident or
public health incident.
local data analysis. Analysis of data at a meter, meeting defined logic conditions using embedded
computing, that is interoperable with internet infrastructure. Analytics may encompass anomalous
detection for data excursions from the norm, e.g. "If flow is negative (or meter movement = yes), then
send alert" or pattern recognition by identifying previous occurrences in current time frame, e.g. "If sum
of hourly flow is negative before a four-hour data push, then send backflow alert".
mechanical meter. Standard positive displacement type of flow meter with an embedded mechanism that
rotates, and the number of rotations is translated to flow.
29
-------
meter. Measures the flow of water to a service district or customer's connection at a premise. Meter data
can be used to calculate water usage and to detect backflow and tampering.
meter interface unit. Receives a hardwired signal from a meter, converts this signal to a flow value,
stores flow values, and wirelessly transmits stored data to the information management system. Alerts
generated are also transmitted.
monitoring location. A specific point in the water distribution system where SRS component data is
collected, such as the location of OWQM sensor hardware, PSM video surveillance camera, or AMI
meter.
one-way communications. A communications path that only allows the flow of data in one direction.
Also referred to as unidirectional or simplex communications.
Online Water Quality Monitoring (OWQM). One of the surveillance components of an SRS. OWQM
utilizes data collected from monitoring stations that are installed at strategic locations in a utility's source
water and/or a distribution system. Data from the monitoring stations is transferred to a central location
and analyzed for water quality anomalies.
open standard communications network. Provides an open architecture concept which expands the
market of wireless devices that can operate over an AMI communication network. Examples of Open
Standard Networks include LoRaWAN, Wi-SUN and Narrowband IoT. These networks are becoming
increasingly common with lower energy requirements and increased coverage.
operational reliability. The percentage of time that the SRS is functioning at a level that achieves the
other performance objectives.
Other sensors. Pressure, temperature, and acoustic sensors, and water quality monitors, whose data is
also transmitted to the information management system, along with meter data.
performance objectives. Measurable indicators of how well an SRS or its components meet established
design goals.
polling interval. The frequency at which data is collected, reported, or transmitted.
possible. In the context of the threat level determination process, water contamination is considered
possible if the cause of an alert from one of the surveillance components cannot be identified or
determined to be benign.
proprietary communications network. Owned and managed by a private entity and include Cellular
Networks and Fixed Radio Frequency Networks.
real time. A mode of operation in which data describing the current state of a system is available in
sufficient time for analysis and subsequent use to support assessment, control, and decision functions
related to the monitored system.
remotely controlled valves. Allow a utility to shut off or turn on water service at a customer or premise
from the information management system. These valves could aid Water Contamination Response.
response action. An action taken by a utility, public health agency or another response partner to
minimize the consequences of an undesirable water quality incident. Response activities may include
issuing a public notification, changing system operations, flushing the system or other actions.
30
-------
Sampling and Analysis (S&A). One of the response components of an SRS. S&A is activated during
Water Contamination Response to help confirm or rule out possible water contamination through field
and laboratory analyses of water samples. In addition to laboratory analyses, S&A includes all the
activities associated with site characterization. S&A continues to be active throughout remediation and
recovery if contamination is confirmed.
scheduled data transmission. Data is transferred at a pre-defined, recurring polling interval. At the time
of writing, a transmission frequency of 4, 6, 12, or 24 hours is common. The lower frequency can be
selected to preserve battery life.
solid-state meter. Newer meter type with a variety of measurement techniques to more reliably measure
flow such as using acoustic waves or a magnetic field. Common types are ultrasonic, electromagnetic and
fluid oscillation.
spatial coverage. The percent of a utility's distribution system monitored by the SRS.
surveillance component. An SRS component in which real-time data is constantly analyzed to detect and
notify staff of potentially abnormal and potentially harmful conditions.
sustainability. The degree to which the benefits derived from the SRS justify the cost to implement and
maintain the system.
tampering. Unauthorized handling or damage of an AMI meter.
threshold. A value that is compared against current or recent data to determine whether conditions are
anomalous or atypical of normal operations.
timeliness of detection. The amount of time between the start of a water quality incident and detection by
an SRS component, and the amount of time between detection and implementation of response actions to
minimize the consequences of the incident.
two-way communications. A communications path that allows the flow of data in both directions. Also
referred to as bi-directional or duplex communications. For AMI, this means that in addition to data being
sent from the MIU to headend system, the commands or queries can be transmitted to the MIU.
user interface. A visually oriented interface that allows a user to interact with an information
management system. A user interface typically facilitates data access and analysis.
valid alert. An alert due to water contamination, verified water quality incidents, intrusions at utility
facilities, or public health incidents.
Water Contamination Response (WCR). One of the response components of an SRS. This component
encompasses actions taken to plan for and respond to possible drinking water contamination incidents to
minimize the response and recovery timeframe, and ultimately minimize consequences to a utility and the
public.
Water Quality Surveillance and Response System (SRS). A system that employs one or more
surveillance components to monitor and manage source water and distribution system water quality in
real time. An SRS utilizes a variety of data analysis techniques to detect water quality anomalies and
generate alerts. Procedures guide the investigation of alerts and the response to validated water quality
incidents that might impact operations, public health, or utility infrastructure.
31
-------
Water Quality Surveillance and Response System Manager (SRS Manager). A role within an SRS
typically filled by a mid- to upper-level manager from a drinking water utility. Responsibilities of this
position include receiving notification of valid alerts, coordinating the threat level determination process,
integrating information across the different surveillance components, and activating the Water
Contamination Response component.
work management system. Software used by a utility to schedule and track maintenance, repairs, or
other operations in the distribution system. The system may generate work orders or work requests that
can be leveraged as a CCS data stream.
32
-------