Using TEVA to Assess Impact of Model Skeletonization on
Contaminant Consequence Assessment and Sensor Placement
Design
Robert Janke1, Regan Murray1, James Uber2, Rakesh Bahadur3, Tom Taxon4, William
Samuels3, Mike Davis4
1 National Homeland Security Research Center
United States Environmental Protection Agency
26. W. Martin Luther King Drive (MS 163), Cincinnati, OH 45268
department of Civil and Environmental Engineering, PO Box 21007, University of
Cincinnati, Cincinnati, OH 45221
3Science Applications International Corporation,
1710 SAIC Dr. McLean, VA 22102
4Argonne National Laboratory
9700 South Cass Avenue, Argonne, IL 60439-4832
1.0 INTRODUCTION:
Drinking water systems are known to be vulnerable to contamination by toxic
substances, whether the contaminants are introduced intentionally during a terrorist
attack, or unintentionally through accidental cross-connections or backflow incidents.
Understanding the vulnerability of drinking water distribution systems to contaminant
intrusion is currently a major research focus within the federal government and across
the water community. The EPA's National Homeland Security Research Center
(NHSRC) developed the Threat Ensemble Vulnerability Assessment (TEVA) Research
Program to analyze the vulnerability of drinking water distribution systems to
contaminant threats and develop a methodology to design Contamination Warning
Systems (CWS). The TEVA Research Program, the NHSRC and its collaborators at
the University of Cincinnati, Argonne National Laboratory, Sandia National Laboratories
developed software that accomplishes this task. The software tool uses quantitative
health impacts data from probabilistic or exhaustive consequence assessments to
optimally locate and evaluate CWS designs for a drinking water distribution system.
Both the characterization of the potential impacts from contaminant attacks and the
designing of CWS rely on calibrated hydraulic models developed by the water
community for modeling and simulating contaminant transport. Distribution system
models, however, vary widely in detail and, therefore, their representation of the actual
system also varies. A complete representation of the distribution system model,
especially given any large or even medium-sized city, can be enormously complex and
very difficult to model. As a result, "skeletonization" is the process most often used to
1
-------
select the most significant attributes of the hydraulic network that accurately represent
the behavior of the system. The underlying assumption is that those portions of the
network that are not modeled are accounted for within the parts of the system that are
represented by the model. The level of detail of a distribution system model can be
described by the number of junctions and pipes in the model as compared to their
numbers in the actual system that the model represents.
The TEVA model for assessing the spatial and temporal distribution of health impacts in
a distribution system has been previously described [Murray et al., 2006(a)],
Furthermore, the strategic placement of sensors in a distribution system to monitor
water quality as part of a CWS has been well studied [Berry et al., 2006] and described
[Murray et al., 2006(b)],
The purpose of this paper is to evaluate the effects that varying levels of model detail
(degree of skeletonization) have on estimating potential health impacts from an
intentional contamination event, on a water system community. Additionally, the
performance of sensor monitoring designs developed for six skeletonized models are
compared to designs developed for an "all-pipes-model". Mean and maximum, or worst
case, health impacts for each of the sensor designs from the skeletonized models are
compared to the performance of the sensor designs developed for the "all-pipes-model".
Given that most distribution systems are represented by models that are skeletonized to
some degree, this paper examines the effectiveness of sensor designs developed for
skeletonized models to protect public health.
2.0 METHODOLOGY
In this section the methodology is described beginning with a description of the water
system used, including its distribution system model and the skeletonization process
used, followed by the consequence assessment and sensor placement design
approaches.
2.1 Water Distribution System
The results presented here are for an "all-pipes-model" of a large city distribution
system. The distribution system model has approximately 12,000 nodes, an average
daily demand of approximately 20 million gallons, and a census population of
approximately 260,000 people. The municipal water system has customer service
accounts which total approximately 80,000. Each node in the model represents a
connection where pipes join together and where water leaves the network due to
demand. Given there are approximately 12,000 nodes and 80,000 service connections,
results in about 7 service connections per node in the model.
The system contains two reservoirs, no tanks, and approximately 1,100 miles of pipe.
The mean node demand is approximately two gallons per minute (gpm) while the
maximum node demand is 200 gpm. The median node demand is one gpm.
2
-------
Populations at each node were estimated using the Geographical Information System
(GIS) thiessen polygon method to assign a population at each node of the "all-pipes"
model and separately for each of the skeletonized models, ensuring that the total
population for the system, across all the models, remained constant. Hydraulic and
water quality simulations were run for 192 hours. Water age analysis using EPANET
(Rossman, 2000) indicates the mean water age is 30 hours while the median water age
is 23 hours.
"Skeletonized" models from the "all-pipes-model" were created by trimming pipes and
associated junctions at 2-inch pipe diameter intervals to a maximum of 12-inches using
a commercially available software program (MWH Soft H20MAP, 2004). Table 2-1
provides the diameter specifications and resulting pipe totals, by diameter, for each
skeletonized model. By repeatedly defining a database of pipes by diameter, the
Skeletonizer Tool in the H20MAP Suite was used to perform Reduce and Trim
operations successively, starting with the "all-pipes-model" to produce the resulting
"reduce and trim" skeletonized models. Figures 2-1 a and 2-1 b provide pictures of a
portion of the network for the "all-pipes-model" and the 12 inch skeletonized model,
respectively, to illustrate the skeletonization process and the changes that occur with
respect to the removal of pipes and nodes. Table 2-2 provides model specifications
(i.e., junctions, reservoirs, pipes, and total system demand in gpm) for the "all-pipes-
model" and the skeletonized models. Table 2-3 provides a measure of the degree of
skeletonization (as compared to the "all-pipes-model") for each skeletonized model as
well as the population density for each model.
2.2 Chemical Contaminant Consequence Assessment
Consequence assessments of contamination events were developed by applying the
TEVA consequence assessment methodology to the "all-pipes-model" and the six
skeletonized network models (Murray, et al., 2004). The TEVA contaminant
consequence analyses considered two approaches for modeling public health impacts.
First, attacks were simulated at every node of the "all-pipes-model" and each of the
skeletonized models. Separately, attacks were simulated at a set of nodes that was
common to all the models. This common set of nodes corresponded to the all-nodes
set of the 12 inch skeletonized model. Table 2-4 provides the number of threat
scenarios (attacks) that were simulated for each model for the two contaminant
consequence assessment approaches.
To simulate a contamination event, numerous parameters must be specified, including
characteristics of the contaminant, the contaminant-introduction scenario, and the
consumption patterns of the population. In order to take into consideration the range of
possible parameter values, the TEVA software uses simulation to vary parameters such
as contaminant type, quantity, and concentration, as well as injection location, rate, or
duration, to generate threat ensembles (collections of many threat scenarios) which
collectively can be analyzed for health impact statistics.
3
-------
For the analyses presented here, chemical contaminant releases lasted one hour. The
chemical contaminants were modeled as conservative tracers, i.e. free of the effects of
hydrolysis or other reactions within the bulk water matrix or with pipe wall materials,
which may increase or decrease the contaminant's effectiveness in causing harm to
public health. Contaminants were modeled using a mass injection rate, zero volume
added, which consequently does not influence the network hydraulic solution.
Health impacts are affected by such factors as the contaminant-specific dose-response
relationship, dose received, time before onset of symptoms, time for effective treatment,
and the time delay between contamination event determination and implementation of
mitigative measures to stop further exposures. Considering these factors, modeling and
simulation analyses are performed on a contaminant specific basis. Not surprisingly,
health impacts to a population increase with an increase in the time required to
implement an effective response. For these analyses, a zero response time delay was
assumed.
The public health consequence assessments were performed using a chemical
contaminant. The chemical contaminant chosen has a 50% lethality rate when an adult
(70 kg) individual ingests approximately 3,000 mg of the chemical. The time period for
onset of injury for the chemical contaminant is estimated to be 1 hour. A sigmoidal
dose-response curve was assumed for each contaminant consistent with the above
assumptions. The chemical contaminant had an untreated fatality rate at 100%.
Exposure is assumed to occur only through ingestion. Each person is assumed to
consume two liters of water per day. The probability that an individual at a node
consumes water at a certain time is assumed to be proportional to the ratio of the
demand at that time to the average demand over the simulation time.
Each contaminant release was simulated to occur at time zero (12:00 am) and the start
of the simulation. Statistically analyzing the approximately 6,000 to 12,000 nodes as
release points or threat scenarios, depending on the model, provide an estimate of the
hypothetical health impacts in terms of both average health impacts (in this case
fatalities) and maximum impacts. Average impacts could be expected to result if the
terrorist or saboteur had no knowledge of where best to attack and simply randomly
chose a node location for contaminant injection. Maximum health impacts correspond
to a relatively small set of injection node locations (threat scenarios) that maximize
health impacts to the associated receptors.
2.3 Sensor Placement
A number of researchers have developed approaches to place sensors and design
CWS (Ostfeld, 2004; Watson, 2004; Uber 2004). The Sensor Placement Optimization
Tool (SPOT) (developed by Sandia National Laboratories) used in this analysis has
been described in numerous publications (Berry, 2006). SPOT can find sensor
placement solutions for a variety of objectives, and prove that these solutions are
optimal with respect to the modeling assumptions. Recently, SPOT has been integrated
with TEVA in a JAVA-based graphical user interface with the resulting, integrated,
4
-------
software program called TEVA-SPOT. The TEVA-SPOT program is flexible enough to
allow for exploring the trade-offs of selecting one objective as compared to another,
minimizing worst cases measures, and allowing for multiple constraints. Furthermore,
the TEVA-SPOT software program has the capability to develop numerous sensor
placement designs for a variety of threat ensembles and determine which sensor design
performs best overall.
For the analyses presented here, sensor designs were developed using TEVA-SPOT
for the "all-pipes-model" and the six skeletonized models. Sensor locations were
selected to minimize mean public health impacts. Sensor designs were developed for 5
sensor set sizes, i.e., 5, 10, 15, 20, and 25 locations. Further discussion of the sensor
placement methodology is described by Murray in the paper titled, "Sensor Network
Design for Contamination Warning Systems: Tools and Applications," (Murray, et al.,
2006b).
3.0 RESULTS
In this section results are presented for the chemical contaminant consequence
assessments and the sensor placement designs. Mean and maximum health impacts
(fatalities) are presented for the "all-pipes-model" and the skeletonized models for the
baseline (no sensors case) and the CWS sensors case. For the analysis of the sensor
design's ability to reduce public health impacts, each skeletonized sensor design, for a
given sensor number, was evaluated in the "all-pipes-model" of attacks.
3.1 Contaminant Consequence Assessment
Table 3-1 provides the mean and maximum fatalities for the baseline case for the "all-
pipes-model," and each of the skeletonized models. Figures 3-1 and 3-2 provide plots
of the average and maximum fatalities, respectively. As the degree of skeletonization
increases, mean fatalities increase. However, the estimate for maximum health impacts
remains relatively constant across the range of skeletonized models, except for the 12
inch skeletonized model. The increase in mean fatalities indicates an exaggeration of
health impacts proportional to the level of skeletonization. In reality, average fatalities
increase because lower impact contaminant release nodes, e.g., dead-end nodes, are
eliminated in the skeletonization process so that the average threat scenario's impact is
increased.
Table 3-2 provides the mean and maximum fatalities for the "all-pipes-model" and the
skeletonized models considering the threat ensemble is composed of only those nodes
common to all the models, i.e., determined by the 12 inch skeletonized model
containing 6,691 release nodes. Figures 3-3 and 3-4 provide plots of the average and
maximum fatalities, respectively, for this common node set. As shown in Figure 3-3,
mean fatalities do not increase until the level of skeletonization reaches the degree
exhibited by the 8 inch, 10 inch, and 12 inch models, resulting in an exaggeration of
fatalities from approximately 5 to 10 percent above the estimate provided by the "all-
5
-------
pipes-model". This increase is likely due to the aggregation of larger numbers of people
to nodes where they can be exposed. Although there is a decrease in maximum
fatalities for the 2 inch through 10 inch skeletonized models, the "all-pipes-model" and
the 12 inch skeletonized model have comparable maximum fatalities. It is not clear the
reason for the decrease in maximum fatalities for the 2 inch through 10 inch
skeletonized models.
3.2 Sensor Placement Designs
Tables 3-3 and 3-4 provide mean and maximum health impacts, respectively, by sensor
set design. These results were developed by determining the health impacts resulting
from each skeletonized sensor design given the threat scenarios associated with the
"all-pipes-model," i.e., attacks from 12,624 nodes. Comparing each skeletonized
model's health impacts with the blue shaded results from the "all-pipes-model" illustrate
the effectiveness of a sensor design developed based on a skeletonized model to
perform as well, in most cases, as the design developed for the "all-pipes-model".
Figure 3-5 illustrates for a portion of the network and a subset of sensor locations the
nearly identical selection of sensor locations between the "all-pipes-model" (red circles)
and the 12 inch skeletonized model (red squares). Figure 3-6 provides a plot of percent
increase in mean fatalities versus sensor set size between the 12 inch skeletonized
model's sensor design and the "all-pipes-model" sensor design. These results illustrate
that even for the most skeletonized model, the performance of the sensor designs is
within approximately 5 to 15 percent of the performance of the sensor designs
developed by the "all-pipes-model".
4.0 CONCLUSIONS
In summary, this paper presents results illustrating the effect that model detail has on
estimating public health impacts given an intentional release of contamination and
designing contamination warning systems. Using the TEVA methodology for
contaminant consequence assessment and sensor placement design, intentional
releases of a chemical contaminant are simulated, modeled, and evaluated for a real
drinking water distribution system. The results indicate that mean and maximum health
impacts can be predicted fairly well using skeletonized models and sensor designs
developed for such models perform very well in comparison to their "all-pipes-model".
These results support the application of the TEVA methodology to water systems
represented by less detailed models. This work is based on only one distribution
system network model, additional distribution systems will be evaluated in the future.
With increasing levels of skeletonization the exaggeration of health impacts could
become an issue. Although, for this model after removing nearly half the nodes, the
results still prove favorable. There is more uncertainty surrounding the health impact
results.
6
-------
5.0 REFERENCES
1. Murray, R., Uber, J., and Janke, R., "Estimating the Acute Health Impacts Resulting
from Ingestion of Contaminated Drinking Water," special issue: drinking water
distribution system security, ASCE Journal of Water Resources Planning and
Management, 132 (4): 293-299, July/August 2006a.
2. Berry, J., Hart, W. E., Phillips, C. A., Uber, J. G., Watson, J. P., "Sensor Placement
in Municipal Water Networks with Temporal Integer Programming Models." special
issue: drinking water distribution system security, ASCE Journal of Water Resources
Planning and Management, 132 (4): 218-224, July/August 2006.
3. Murray, R., Hart, W. E., and Berry, J., "Sensor Network Design for Contamination
Warning Systems: Tools and Applications," Proceedings of the AWWA Water
Security Congress 2006b.
4. Rossman, L., EPANET2 Users Manual, EPA/600/R-00/057, U.S. Environmental
Protection Agency, National Risk Management Research Laboratory, Office of
Research and Development, Cincinnati, Ohio, USA, 2000.
5. MHW Soft H20MAP, H20MAP Water GIS Suite 6.0, Update #7, MWH Soft Inc.,
2004.
6. Murray, Regan, Robert Janke, and Jim Uber. 2004. The Threat Ensemble
Vulnerability Assessment Program for Drinking Water Distribution System Security.
Proceedings ofEWRI Congress, Salt Lake City, UT. June, 2004.
7. Ostefeld, A., and Salomons, E., 2004. "Optimal Layout of Early Warning Detection
Stations for Water Distribution System Security," J. Water Resource Planning
Management. 130(5): 377-385.
8. Watson, J.P., Greenberg, H., and Hart, W. E., 2004. "A Multi-Objective Analysis of
Sensor Placement Optimization in Water Networks," Proceedings of the
ASCE/EWRI Conference, Salt Lake City.
9. Uber, J. G., Janke, R., Murray, R., and Meyer, P., 2004.
for locating water quality sensors in distribution systems,
ASCE/EWRI Conference, Salt Lake City.
"Set covering formulation
" Proceedings of the
-------
Figure 2-1 a: Portion of network model for the "all-pipes-model"
Figure 2-1 b: Portion (same portion as Figure 2-1 a) of network model for the 12 inch
skeletonized model to illustrate the effect of skeletonization with respect to the removal
of model junctions and pipes.
-------
Model
Pipe Diameters Specified for Skeletonization Process
(d = diameter, inches)
Total
Number
of
Pipes
0
-------
Model
Fraction of All Pipe
Junctions
Population Density per
Node
All Pipes
1.00
20.9
2 inch
0.96
21.5
4 inch
0.90
22.9
6 inch
0.72
28.8
8 inch
0.60
34.7
10 inch
0.58
35.6
12 inch
0.53
38.9
Table 2-3: Degree of skeletonization and population distribution for "all-pipes" and
skeletonized models
Model
Number of Attacks
Number of Attacks
at All Nodes
at Common Node Set
All Pipes
12,624
6,691
2 inch
12,134
6,691
4 inch
11,368
6,691
6 inch
9,031
6,691
8 inch
7,518
6,691
10 inch
7,324
6,691
12 inch
6,691
6,691
Table 2-4: Number of threat scenarios (attacks) simulated for each model for the two
contaminant consequence assessment approaches
Model
Average
Impacts
(fatalities)
Maximum
Impacts
(fatalities)
All Pipes
2,435
35,261
2 inch
2,537
35,398
4 inch
2,688
35,421
6 inch
3,079
35,094
8 inch
3,337
35,654
10 inch
3,384
35,778
12 inch
3,476
37,077
Table 3-1: Health impacts for baseline (no-sensors case) for the "all-pipes-model" and
each skeletonized model considering contaminant releases at all-nodes in each model.
10
-------
Figure 3-1: Mean public health impacts for "All-Pipes-Model" and each skeletonized
model considering contaminant releases at all-nodes in each model. RT refers to the
"Reduce and Trim" skeletonization method of the Skeletonizer Tool in the H20MAP
Suite.
11
-------
37,5CO
37,CCD
^ 36,500
£ 36,000
¦c
| 35,500 -
| 35,000
34,500
34,000
All Pipes R~l2inch RT4inch RT6inch RTBinch RTIOinch RT12inch
Model
Figure 3-2: Maximum (Worst Case) health impacts for "all-pipes-model" and each
skeletonized model considering contaminant releases at all-nodes in each model. RT
refers to the "Reduce and Trim" skeletonization method of the Skeletonizer Tool in the
H20MAP Suite.
Model
Average
Impacts
(fatalities)
Maximum
Impacts
(fatalities)
All Pipes
3,177
35,261
2 inch
3,204
32,554
4 inch
3,210
32,365
6 inch
3,204
32,719
8 inch
3,332
34,004
10 inch
3,363
34,669
12 inch
3,521
37,077
Table 3-2: Health impacts for the baseline (no-sensors case) for the "all-pipes-model"
and each skeletonized model considering contaminant releases only at the common set
of all-nodes (6,691 contaminant release scenarios).
12
-------
3,600
3,500
3,400
| 3,300
I
£ 3,200
3,100
3,000
All 2inch 4inch 6inch 8inch 10inch 12inch
Model
Figure 3-3: Mean public health impacts for "all-pipes-model" and each skeletonized
model considering the common attack node set.
13
-------
37,000
36,000
35,000
34,000
33,000
32,000
31,000
30,000
All
n
2 inch 4 inch
6 inch
Model
8 inch 10 inch 12 inch
Figure 3-4: Maximum public health impacts (fatalities) for "all-pipes-model" and each
skeletonized model considering the common attack node set.
14
-------
Model
Mean Health Impacts (fatalities) by
Sensor Set Size
5
10
15
20
25
2 inch
587
383
303
259
230
4 inch
587
385
305
259
231
6 inch
589
386
306
260
232
8 inch
589
388
306
260
233
10 inch
589
388
263
263
237
12 inch
644
440
357
306
241
All
Pipes
587
383
303
259
230
Table 3-3: Mean health impacts by model and sensor set size. Results developed by
determining the health impacts for each skeletonized sensor design given the threat
scenarios associated with the "all-pipes-model". Each estimate of fatalities for a
skeletonized model sensor set size should be compared to the estimate of fatalities for
the "all-pipes-model" of the same sensor set size.
Model
Maximum Health Impact (fatalities) by
Sensor Set Size
5
10
15
20
25
2 inch
10,949
7,360
4,302
4,302
4,302
4 inch
10,949
7,360
4,302
4,302
4,302
6 inch
10,949
7,360
4,302
4,302
2,759
8 inch
10,949
7,360
4,302
4,302
2,759
10 inch
10,949
7,360
4,302
4,302
2,684
12 inch
7,483
6,485
5,562
5,562
3,708
All
Pipes
10,949
7,360
4,302
4,302
2,978
Table 3-4: Maximum health impacts by model and sensor set size. Results developed
by determining the health impacts for each skeletonized sensor design given the threat
scenarios associated with the "all-pipes-model". Each estimate of fatalities for a
skeletonized model sensor set size should be compared to the estimate of fatalities for
the "all-pipes-model" of the same sensor set size.
15
-------
Figure 3-5: Portion of "all-pipes-model" illustrating 4 of 5 sensor iocations from 12 inch
skeletonized model's design (red squares) and the sensor locations from "all-pipes"
model's design (red circles). Note that for all but one location (see arrows) the selected
sensor locations are nearly the same
16
-------
1
c
o
c
so
0s
10 15 20
Sensor Set Size
25
Figure 3-6: Percent increase in mean fatalities by sensor set size for the 12 inch
skeletonized sensor design as compared to the "all-pipes-model" sensor designs for the
same sensor set sizes.
17
-------
40.0%
30.0%
20.0%
10.0%
0.0%
-10.0%
so -20.0%
0s
-30.0%
-40.0%
10
15
20
25
Sensor Set Size
Figure 3-7: Percent increase in maximum fatalities by sensor set size for the 12 inch
skeletonized sensor design as compared to the "all-pipes-model" sensor designs for the
same sensor set sizes.
18
------- |