w a t e r r e s e a r c h 4 5 ( 2 0 1 1 ) 2 4 1 e2 5 3

Available at www.sciencedirect.com

journal homepage: www.elsevier.com/locate/watres

Cost-effectiveness analysis of risk-reduction measures to

reach water safety targets

Andreas Lindhe a,*, Lars Rosen a, Tommy Norberg b, Olof Bergstedt a,c,
Thomas J.R. Pettersson a
a
Department of Civil and Environmental Engineering, Chalmers University of Technology, SE-412 96 Gothenburg, Sweden
b
Department of Mathematical Sciences, University of Gothenburg and Chalmers University of Technology, SE-412 96 Gothenburg, Sweden
c
Goteborg Vatten, Box 123, SE-424 23 Angered, Sweden

article info abstract

Article history: Identifying the most suitable risk-reduction measures in drinking water systems requires
Received 1 March 2010 a thorough analysis of possible alternatives. In addition to the effects on the risk level, also
Received in revised form the economic aspects of the risk-reduction alternatives are commonly considered impor-
20 May 2010 tant. Drinking water supplies are complex systems and to avoid sub-optimisation of
Accepted 16 July 2010 risk-reduction measures, the entire system from source to tap needs to be considered.
Available online 3 August 2010 There is a lack of methods for quantification of water supply risk reduction in an economic
context for entire drinking water systems. The aim of this paper is to present a novel
Keywords: approach for risk assessment in combination with economic analysis to evaluate
Risk reduction risk-reduction measures based on a source-to-tap approach. The approach combines
Fault tree analysis a probabilistic and dynamic fault tree method with cost-effectiveness analysis (CEA). The
Cost-effectiveness developed approach comprises the following main parts: (1) quantification of risk reduc-
Decision support tion of alternatives using a probabilistic fault tree model of the entire system; (2) combi-
Water safety plan nation of the modelling results with CEA; and (3) evaluation of the alternatives with respect
to the risk reduction, the probability of not reaching water safety targets and the
cost-effectiveness. The fault tree method and CEA enable comparison of risk-reduction
measures in the same quantitative unit and consider costs and uncertainties. The
approach provides a structured and thorough analysis of risk-reduction measures that
facilitates transparency and long-term planning of drinking water systems in order to
avoid sub-optimisation of available resources for risk reduction.
2010 Elsevier Ltd. All rights reserved.

1. Introduction When analysing risks to a drinking water supply, the entire

Risk management of drinking water systems is becoming
increasingly important worldwide. A safe and reliable
drinking water supply is vital for public health as well as for
economic development and other societal functions. Effi-
cient risk management of drinking water systems requires
a thorough evaluation of risk acceptance and identification
of the most suitable measures to reduce unacceptable risks.
system needs to be considered to avoid overlooking important
interactions between sub-systems and components. The
World Health Organisation (WHO, 2008) thus concludes that
a holistic risk management approach, including the entire
system from catchment to consumer, is necessary to guar-
antee safe drinking water to consumers. Bartram et al. (2009),
the WHO (2008), Davison et al. (2005) and many others advo-
cate the preparation of Water Safety Plans (WSPs), in which

* Corresponding author. Tel.: 46 31 772 20 60; fax: 46 31 772 21 07.

E-mail address: andreas.lindhe@chalmers.se (A. Lindhe).
0043-1354/$ e see front matter 2010 Elsevier Ltd. All rights reserved.
doi:10.1016/j.watres.2010.07.048
242 w a t e r r e s e a r c h 4 5 ( 2 0 1 1 ) 2 4 1 e2 5 3
risks in source waters, treatment systems and distribution
networks should be assessed and managed in an integrated,
from source to tap, manner.
Implementation of WSPs requires relevant decision
support regarding how to manage existing risks. Since
drinking water systems are diverse and are exposed to a wide
variety of risks, one single method or tool cannot be used
universally. A number of strategies and methods for risk
assessment and risk management in drinking water supplies
have been described, see e.g. MacGillivray et al. (2006), Rosen
et al. (2007) and Pollard (2008).
The WHO (2008) suggests that risk assessment in WSPs is
made by ranking of hazards using a risk matrix (see also
Bartram et al., 2009; Davison et al., 2005). This type of quali-
tative (or semi-quantitative) method may be useful but have
several limitations (e.g. Burgman, 2005; Cox, 2008). Risk
ranking methods can only in a limited way consider complex
systems with interactions between components. Risk ranking
methods also assume a discrete nature of hazards, cannot
provide quantitative estimates that can be compared with
performance targets, and typically lack procedures for sensi-
tivity and uncertainty analysis. As an alternative to risk
ranking methods, Lindhe et al. (2009) presented a quantitative
fault tree method for analysing entire drinking water systems.
In a risk evaluation and risk management context, this
method makes it possible to compare the risk level to
acceptable levels in absolute terms and to estimate the effect
of risk-reduction measures quantitatively.
The primary aims of this paper were to apply the fault tree
method presented by Lindhe et al. (2009) to model alternative
risk-reduction measures and to combine the results with
a cost-effectiveness analysis to provide decision support.
Economic resources are often limited and economic evalua-
tion of measures is therefore an important part of the deci-
sion-basis, see e.g. Levin and McEwan (2001) and Nas (1996).
Simplified cost-benefit calculations were also conducted to
allow for a broader economic analysis. Benefits and limita-
tions with the applied approach were identified to evaluate
the added value of combining quantitative risk assessment
and economic evaluation. Seven alternative risk-reduction
measures were analysed for the drinking water system in
Categories of supply failure
Quantity failure (Q = 0)
No water is delivered to the
co nsum er
Supp l y fa ilur e
Quality failure (Q > 0, C)
Water is delivered but does
not comply with water quality
standards
Q = Flow (Q = 0, no water is delivered to the consumer; Q > 0, water is delivered)
C = The drinking water does not comply with water quality standards
Fig. 1 e Categories of supply failure and their main causes (Lindhe et al., 2009).
Gothenburg, Sweden. The risk associated with each of the
seven alternatives was compared to a politically established
water safety target.
2. Method
In order to evaluate and compare risk-reduction measures, fault
tree analysis was combined with cost-effectiveness analysis.
For each measure, a fault tree model was constructed to repre-
sent the entire water supply system structure. The set of fault
tree models provided information on the alternatives effect on
the risk level. A politically established water safety target was
used to define an acceptable level of risk. Information on costs
was obtained from an economic analysis and the cost-effec-
tiveness of each alternative was calculated. To further evaluate
the alternatives, simplified cost-benefit calculations were con-
ducted. The different parts of the applied method are presented
in the subsequent sections.
2.1. Conceptual model
Drinking water systems are composed of a set of sub-systems
and components, e.g. raw water source, treatment plant and
distribution system. Since these are interconnected, it is
important to have a conceptual understanding of how failure
events may occur, interact and finally cause problems to the
consumers. Two important types of supply failure that may
affect the consumers are: (1) quantity failure, i.e. no water is
delivered to the consumer; and (2) quality failure, i.e. water is
delivered but it does not comply with quality standards
(Fig. 1). The applied method can be used to model both types of
failure but in this paper only quantity failure was considered,
i.e. the upper branch in Fig. 1.
The causes of quantity failure may vary but were here cat-
egorised into two main types (Fig. 1). Technical components in
the system, e.g. pumps or pipes, may break down and interrupt
the supply of water. Also quality-related events may occur that
cause an unacceptable water quality (raw water or drinking
water) and if this is detected the water utility may decide to
stop the delivery of water. Consequently, when modelling
Causes
Failure of components in the
system (e.g. pumps or pipes)
Events related to unacceptable
water quality causing the water
utility to stop the delivery
Unacceptable water quality is
detected but no action is taken or
it is not possible to stop the delivery
Unacceptable water quality is not
detected and no action is thus
possible
 w a t e r r e s e a r c h 4 5 ( 2 0 1 1 ) 2 4 1 e2 5 3 243

quantity failure in this paper, both failures of technical
components and the quality-related failures were included.
To model the drinking water system, a supply chain was
considered including the raw water sources, treatment plants
and the distribution system. These sub-systems interact and
failure in one part may be compensated for by other parts. For
example, if the treatment plant fails to produce drinking
water, reservoirs in the distribution system and increased
production at an additional treatment plant may prevent
quantity failure. However, the ability to compensate is limited
in time, due to limited reservoir volume. In some cases the
ability to compensate may not exist at all.
2.2. Fault tree analysis
The fault tree method used here was developed to facilitate
integrated and probabilistic risk analysis of entire drinking
water systems, see Lindhe et al. (2009). A fault tree is a logic
diagram illustrating potential causes of system failure and
particularly how different events may interact to cause
system failure (e.g. Bedford and Cooke, 2001). The top event in
the tree represents the critical system failure, in this case
quantity-related supply failure. This event is further devel-
oped until a required level of detail is reached. At the lowest
level of the tree the basic events are found, where input data
are required. The capability of representing interactions
between critical system components makes fault tree models
powerful for analysis of entire drinking water systems.
Traditionally, fault trees are used to calculate the probability
of system failure. The applied method also enables calculation
of the risk level, see Section 2.3. A Markovian approach was
used (Norberg et al., 2009) to represent the dynamic, i.e. time-
dependent, behaviour of the events (Rausand and Hyland,
2004). Thus, variables failure rate l and mean downtime
(duration of failure) 1/m were used to define each basic event in
the model. The mean time to failure (uptime) is 1/l, hence the
probability of failure is PF l/(l m). The probability of failure is
here identified with the probability that the system is down.
This probability is typically time-dependent. However, in an
ergodic system, it will tend to l/(l m) in the long run as time
approaches infinity. In reliability theory, the latter is often
referred to as the unavailability of the system.
The main reasons for using the failure rate (or mean
uptime) and mean downtime instead of direct estimations of
the probability of failure, was to facilitate relevant elicitation
of expert judgements and enable modelling of the systems
dynamic behaviour. Information on probability of failure as
well as failure rate and downtime can be calculated for each
event in the fault tree.
The two most common types of logic gates are the OR- and
AND-gates. The OR-gate describes a system where the
occurrence of one input event causes system failure. The
AND-gate describes a system where all input events have to
occur simultaneously to cause the system to fail. To be able to
consider the inherent ability of a system to compensate for
failure, Norberg et al. (2009) and Lindhe et al. (2009) formulated
two variants of the common type AND-gate. The first variant
describes a situation where failure of one component may be
compensated for by one or several other components during
a limited period. The second variant is similar to the first one,
but with the addition that a compensating component that
has failed may recover and start to compensate again. Equa-
tions for calculating the probability of failure, failure rate and
mean downtime at each intermediate level of the fault tree,
are given in Table 1. Here, qi denotes the probability of failure
on demand where compensating component i fails to start
compensating when needed, e.g. a reserve pump that cannot
be started when the main pump brakes down.
A schematic fault tree illustrating the basic structure of the
models used in this paper is shown in Fig. 2. Note that the top
event, supply failure, in the fault tree in Fig. 2 includes quantity
as well as quality failures, but in this study only quantity

Table 1 e Equations for calculating the output of the logic gates (Norberg et al., 2009). PF denotes the probability of failure, l
the mean failure rate and 1/m the mean downtime. For the variants of the AND-gate i [ 1 corresponds to the failure event
that may be compensated for by events i [ 2, ., n. For the second variant only one compensating event is considered, i [ 2.
OR-gate AND-gate
X
n X
n
l li m mi
i1 i1

Q
n Q
n
mi li
X
n X
n
i1
m li $ i1 l mi $
Q
n Q
n Q
n Q
n
i1 li mi  li
i1 li mi  mi i1 i1
i1 i1

l Yn
mi Y
n
PF 1 l li
lm l mi PF
i1 i l m i1 li mi

First variant of AND-gate Second variant of AND-gate

m m1 l1 l2 q2 m1 m2
PF $
l1 m 1 l2 m 1 m 2
l1 Y
n
li qi m 1
PF $
l1 m1 i2 li m1 m1 l1 q2 l2 m1 m2 l1 l2 1  q2 m1 m2
l
l1 m1 l2 m1 m2 1  PF
PF
l $m m1 l1 q2 l2 m1 m2 l1 l2 1  q2 m1 m2
1  PF m
l1 m1 l2 m1 m2 PF
244 w a t e r r e s e a r c h 4 5 ( 2 0 1 1 ) 2 4 1 e2 5 3

Supply failure

Raw water failure Treatment failure Distribution failure

Raw water quantity Treatment quantity Distribution quantity

failure (Q = 0) failure (Q = 0) failure (Q = 0)

Distribution quality
failure (Q > 0, C')
Quantity failure Quantity failure

Treatment fails to Distribution fails to

compensate compensate

Distribution fails to Treament quality

compensate failure (Q > 0, C')

Raw water quality

failure (Q > 0, C')
Quality failure

Distribution fails to
Quality failure
compensate

Treatment fails to
compensate OR-gate
First variant of AND-gate
Distribution fails to Q = flow (Q = 0, no water is delivered to the consumer; Q > 0 water is delivered)
compensate C' = The drinking water does not comply with water quality standards

Fig. 2 e Schematic fault tree including the main events that can be considered using the method (Lindhe, 2008).

failures were analysed (see Section 2.1). The fault tree models
used in this study included approximately 120 basic events
and about 100 logic gates.
2.3. Risk expressed as Customer Minutes Lost (CML)
The risk (R) was estimated in terms of Customer Minutes Lost
(CML). In this application CML corresponds to the number of
minutes per year the average consumer is not supplied with
drinking water. Risk was defined as the estimated value of
CML, which is equal to the calculated mean value.
A comprehensive description of the risk measure CML is
presented by Lindhe et al. (2009). This measure has been used
in, for example, the Netherlands as a performance indicator
within the water industry and is commonly used in the energy
sector (Blokker et al., 2005). It can be shown that the risk
should be calculated as R PF$CF, where PF is the probability of
failure and CF is the proportion of all consumers affected
(Lindhe et al., 2009). The consequence, i.e. proportion of all
consumers affected, was defined for n events in the fault tree
where the top event was divided into well-defined categories
of events. Consequently, the total risk was calculated as
X
n representing the situation as if measures have been imple-
R PFk CFk
k1
2.4. Uncertainties
calculations were performed by Monte Carlo simulations
(10,000 iterations), see Section 4.3. The exponential rates l and
m were modelled by Gamma densities. The proportion of
consumers affected (CF) and the probability of failure on
demand (q) were modelled by Beta densities. The Gamma and
Beta distributions facilitate a Bayesian approach, where new
information, e.g. monitoring data, can be used for a mathe-
matically formal updating of previous knowledge. The Monte
Carlo simulations facilitate two important types of analyses:
(1) sensitivity analysis of contributions to the total uncertainty
from uncertainties in basic events; and (2) analysis of the
probability of not meeting established safety targets.
2.5. Modelling risk reduction
As a basis for this work an existing fault tree model of the
drinking water system in Gothenburg was used (Lindhe, 2008;
Lindhe et al., 2008). The existing model was reconstructed and
updated in order to represent the system with the risk-
reduction measures implemented. Changes were made with
respect to: (1) fault tree structure, i.e. events and logic gates
were added and/or removed; (2) input data, i.e. new input data
(1) mented. The effect of each measure (Ej), i.e. the achieved risk
reduction measured in CML units, was calculated as
Ej R0  Rj (2)

To enable uncertainty analysis all input parameters were where R0 is the risk level prior to any measures and Rj is
expressed as probability density functions and the the residual risk after alternative j has been implemented.
 w a t e r r e s e a r c h 4 5 ( 2 0 1 1 ) 2 4 1 e2 5 3
The risk levels R0 and Rj were calculated according to
Equation (1).
2.6. Cost-effectiveness analysis
Cost-effectiveness analysis (CEA) can be described as a tool to
identify what alternative meets a specified target to the lowest
cost (e.g. Levin and McEwan, 2001). However, a CEA may also
provide additional information that can be used in the deci-
sion-making process. The main purpose of CEA is to provide
a combined, not separate, and proper assessment of both the
costs and the effects. The fault tree models were used to
estimate the effect of the measures (Ej). To estimate the total
cost of each alternative, possible costs for planning, con-
structing and maintenance were identified and assessed.
Costs were assessed considering similar actions within other
projects. All alternatives were analysed based on a 100 year
time horizon (T) and since costs (Cjt) occur over several years,
the present value (Cj) was calculated according to Equation (3).
Recommendations regarding discount rates to be used in
economic analyses vary. Stern (2007) advocates a discount
rate of 1.4% for analyses linked to climate changes and the
Swedish Environmental Protection Agency (Lindstedt et al.,
2003) recommends a rate of 4% to be used when assessing
environmental consequences. In this study a discount rate (r)
of 3% was used. A sensitivity analysis of the discount rate was
also performed.
X
T 3.1.
Cjt
Cj t1
t1 1 r
A cost-effectiveness ratio (CER) was calculated for each
alternative. The ratio corresponds to the cost required to
obtain a single unit of effect, i.e. reduction of one CML. The
effect (Ej) was calculated according to Equation (2) and was
assumed to be constant over time. Therefore, the yearly effect
did not need to be discounted or summed up over the chosen
time horizon in order to provide the correct relation between
the final CER values of the alternatives. The calculation of CER
could therefore be simplified to Equation (4). For a discussion
regarding discounting effects in a CEA, when the effect is not
constant over time, see e.g. Ramsey et al. (2005) and Brouwer
and Koopmanschap (2000).
Cj
CERj
Ej
2.7. Cost-benefit analysis
For assessing whether an action is societally beneficial, a cost-
benefit analysis (CBA) can be conducted. In contrast to CEA,
CBA aims to determine the cost as well as the effect and other
benefits in monetary units (e.g. Johansson, 1993; Nas, 1996).
The result of a CBA may be presented as
X
T
1  
Fj t1
Bjt  Cjt
t1 1 r
where Fj is an objective function representing the net benefit
of alternative j, Bjt and Cjt are the streams of benefits and costs
over time, T is the time horizon (100 years) and r is the
245
discount rate (3%). A positive net benefit implies that the
alternative is desirable. In this application a simplified CBA
was performed and the only benefit included in the calcula-
tions was the alternatives effect on the risk level (Ej). Conse-
quently, the benefit was calculated as
 
Bjt Ej cn R0  Rj cn (6)
where R0 is the risk level prior to any measures, Rj is the
residual risk for alternative j, c is the economic value of 1 min
additional water supply per year and consumer and n is the
total number of consumers. The value of c thus represents the
cost an average consumer is willing to pay per year to reduce
the time of interruption by 1 min, i.e. one CML, per year. In
a complete CBA the objective function (Fj) represents the net
present benefit value expressed in monetary units. In this
application, only the change in risk level was considered as
a benefit. No consideration was taken to when in time this
change occurs. Furthermore, the benefit was not valued in
monetary units, i.e. the value of c was not determined.
Instead, the objective function was plotted as a function of c,
i.e. Fj(c). This illustrates how the economic valuation of the
effect may affect the selection of alternatives and clearly
shows break-even points of different alternatives.
3. Case study site
System description
(3)
The drinking water system in Gothenburg, Sweden, was used
to exemplify method application. The supply system is based
solely on surface water, includes two treatment plants, and
has approximately 500,000 consumers. A schematic descrip-
tion of the raw water system in Gothenburg is given in Fig. 3.
The main raw water source is the Gota Alv River. In addition,
two smaller interconnected lakes (main reservoir lakes in Fig. 3)
are used for intermediate storage of water and to improve the
water quality. Approximately half of the water taken from the
river is transferred directly to treatment plant no 1. The other
half is transferred via a 12 km rock tunnel to the main reser-
voir lakes. From the main reservoir lakes, water is pumped to
treatment plant no 2. Due to the variable quality of the river
water, the intake is closed 100 days a year on average (e.g.
Astrom et al., 2007). Decisions to close the intake are based on
(4)
online monitoring and reports from operating bodies
upstream, e.g. industries and municipalities.
When the intake from the river is closed, the main reser-
voir lakes supply both treatment plants. During long periods
(weeks) of closure of the intake, water from a reservoir in an
additional raw water supply system (lower additional reservoir
in Fig. 3) can be pumped to the main reservoir lakes or directly
to treatment plant no 2. However, the situation where treat-
ment plant no 1 has no alternative raw water supply of its own
makes the system vulnerable.
(5)
3.2. Acceptable risk
The City of Gothenburg has defined quantitative water safety
targets as a basis for long-term planning of investments and
246 w a t e r r e s e a r c h 4 5 ( 2 0 1 1 ) 2 4 1 e2 5 3
Existing water source / reservoir
Possible future water source
Water treatment plant
Raw water distribution
Possible future raw water
distribution
Watercourse
ce
ur
so
er
at
w
w
ra
n
ai
M
Water treatment
plant no 1
Fig. 3 e Schematic description of the Gothenburg raw water system. Possible future raw water supplies included in the
analysis are further described in Section 3.4.
reinvestments (Goteborg Vatten, 2006). These targets were
compiled and suggested by the water utility organisation and
then decided by the politicians in the city. Hence, the targets
are confirmed at the political level and can be considered as
acceptable levels of risk. The target used in this analysis is:
Duration of interruption in delivery to the average consumer shall,
irrespective of the reason, be less than a total of 10 days in 100 years.
For the average consumer this translates to a target value of
144 annual CML.
3.3. Current situation
Previous risk analyses have shown high probability of inter-
ruption in the supply to one of the two treatment plants due to
failures in the raw water system (Lindhe, 2008; Lindhe et al.,
2008; Rosen and Steier, 2006). The maximum capacity of
each plant is far below the average demand of the city and
drinking water storage is well below the daily need. An addi-
tional analysis of the dominating failure scenario showed that
increased treatment capacity would reduce the risk of exten-
sive delivery interruptions to an acceptable level, and that the
raw water supply would not be a limiting factor in this
scenario. As a result, increased treatment capacity is consid-
ered as a possible risk-reduction measure. However, there are
other scenarios, including pollution of the reservoir lakes,
where additional raw water sources would be crucial for
sufficient drinking water production. Several options for
additional raw water sources have been identified.
3.4. Risk-reduction alternatives
The three main risk-reduction measures considered relevant
for the system and included in this study are increased
treatment capacity, supply from small lakes and supply from
a large lake. In addition to the three separate measures, also
four combinations of these were analysed, see also Rosen
et al. (2010). All alternatives are presented below and the
possible raw water supplies are illustrated in Fig. 3.
Supply from large lake,
alternative 3
Supply from small
lakes, alternative 2
Upper additional
reservoir
Main reservoir lakes
Lower additional
Water treatment reservoir
plant no 2
3.4.1. Alt. 1: increased treatment capacity
The treatment capacity is increased at both treatment plants
so that each plant manages to produce up to the average
total water demand. Consequently, each plant will get an
enhanced ability to compensate for shortage in raw water
supply and failures in the other treatment plant. To model
the increased treatment capacity, no additional events or
changes in the fault tree structure were needed. However,
the input data was changed for four events describing the
plants ability to compensate for failure. Also the conse-
quences for four events were changed. Based on statistical
data on water demand and estimations regarding the reli-
ability of the treatment plants, the time for compensation
(i.e. time to failure or uptime, 1/l) was estimated to 3e120
days (90%-interval). The probability of failure on demand
was estimated to 0.0025e0.01 (90%-interval). The increased
treatment capacity may also reduce the number of
consumers affected when a failure occurs. Thus, the number
of people affected were estimated to 6,500e33,900 (90%-
interval) for four events.
3.4.2. Alt. 2: supply from small lakes
Some fairly pristine lakes are regulated to increase the flow in
a small river for transfer to the drinking water system. These
lakes contain relatively large water volumes but their water-
shed is too small for a continuous supply. The lakes will work
as reservoir lakes and water from the connected river will be
pumped into the existing raw water system (Fig. 3). The lakes
were included in the fault tree model as an alternative water
source for each treatment plant, modelled using AND-gates.
To cause failure, all water sources have to be unavailable
simultaneously for the specific treatment plant. For treatment
plant no 2 some events had to be restructured to consider that
failures in the existing system also may cause the new water
source to become unavailable. When only treatment plant no
1 is supplied the uptime was estimated to 25e35 days and for
both plants it is 8e18 days (90%-intervals). For both cases the
downtime was estimated to 7e60 days (90%-interval).
 w a t e r r e s e a r c h 4 5 ( 2 0 1 1 ) 2 4 1 e2 5 3
3.4.3. Alt. 3: supply from large lake
The largest lake in the area is regulated and a pipeline is
constructed for raw water transfer to the drinking water
system (Fig. 3). The lake may provide a high availability to raw
water but failures may occur due to: (1) unacceptable water
quality, e.g. pollution events; (2) insufficient supply of water
due to dry periods and legal restrictions; and (3) failure of
technical components making transfer of water to the treat-
ment plants impossible. All three events were assessed to
have the same uptimes of 5e15 years and downtimes of 5e30,
1e30 and 0.5e2 days respectively (90%-intervals). The large
lake was included in the fault tree in the same way as the
small lakes in alternative 2. However, an OR-gate was also
used to consider that the lake will become unavailable if one
of the three events listed above occurs.
3.4.4. Alt. 4e7: combinations of measures
Alternatives 4e7 are combinations of the first three measures.
Consequently, the fault tree models representing these alter-
native are combinations of the changes presented above. The
following combinations were considered:
- Alt. 4: Combination of alternatives 1 and 2.
- Alt. 5: Combination of alternatives 1 and 3.
- Alt. 6: Combination of alternatives 2 and 3.
- Alt. 7: Combination of alternatives 1, 2 and 3.
4. Results
4.1. Current system
Previous studies of the current system structure have shown
a significant probability of failures that may cause severe
supply interruptions. Furthermore, it has been concluded that
the raw water supply contributes most to the risk. A risk level
of 612 CML (mean value) was calculated using the fault tree
model of the current system. This level is clearly above the
specified water safety target of 144 CML per year for
0.05
0.04
Probability
0.03
0.02
0.01
0 0
0 500 1000 1500
CML
Fig. 4 e Uncertainty distribution of the risk for the current
system. The safety target (144 CML per year for the average
consumer) is indicated by a solid vertical line (Lindhe et al.,
2009).
247
the average consumer. In Fig. 4 an uncertainty distribution of
the calculated risk level and its relation to the safety target are
presented. The probability of not meeting the target value was
calculated to be 0.84. Consequently, the current system most
likely has an unacceptable risk level and measures are thus
required.
4.2. Risk reduction
The mean value and percentiles of the empirical distributions
of the current risk level and the residual risk levels after
implementation of the different measures are presented in
Fig. 5. The histograms in Fig. 5 illustrate uncertainties in risk
values, originating from uncertainties in input data. Based on
the histograms it can be concluded that for some alternatives
(alt. 2, 3 and 6) the probability of exceeding the safety target is
substantial, whereas for others (alt. 1, 4, 5 and 7) the proba-
bility is considerably lower. If the estimated risk (mean value)
is used as a criterion to select what alternatives that meet the
safety target, only alternatives 1, 4, 5 and 7 should be
approved. Although the mean risk level is below the safety
target, there may be a probability of exceeding the target value
that cannot be ignored. Based on the uncertainties of the risk
levels, the probably of exceeding the safety target was calcu-
lated for each alternative (Fig. 6). A highest acceptable prob-
ability of not meeting the target value should be considered,
since it influences what alternatives can be accepted. For
example, an acceptable probability of 0.10 makes alternative 1
acceptable, whereas a probability of 0.05 disqualifies it (see
also Section 5).
The risk reduction, i.e. effect, of the different alternatives
can be seen from Fig. 5. Among the tree alternatives that are
not combinations of measures (alt. 1e3), increased treatment
capacity (alt. 1) has the largest effect on the risk. The risk level
is reduced from 612 to 81 CML and the probability of not
meeting the safety target is reduced from 0.84 to 0.08. Among
the alternative raw water sources (alt. 2 and 3), the large lake
(alt. 3) is most effective with respect to both the mean risk
level and the probability of not meeting the target. However,
1800
P05
1600 Mean
P95
1400
1200
1000
CML
800
612
600
364
400
200
188 182
81 59 52 50
0
1 2 3 4 5 6 7
2000 Alternative
Fig. 5 e Histograms showing mean, 5- and 95-percentiles
of simulated risk levels for the current situation (0) and the
seven alternatives (1e7). The mean values are given at the
mean value bars and the safety target (144 CML) is
indicated by a solid horizontal line.
248 w a t e r r e s e a r c h 4 5 ( 2 0 1 1 ) 2 4 1 e2 5 3

1 that when the treatment capacity has been increased the raw
water system is no longer the dominating contributor to the
0.84
total risk level. Thus, after installing increased treatment
0.8 0.73 capacity also measures in the treatment and distribution
systems will be important for further risk reduction.
0.6
P(R>Rc)

0.42 0.41
4.3. Uncertainty analysis
0.4

The fault tree method is probabilistic to include uncertainties in

0.2
0.08
0.05 0.04
0 depending on the selected number of iterations in the Monte
0 1 2 3 4 5
Alternative
Fig. 6 e Probabilities of exceeding the acceptable risk level
(Rc) defined by the water safety target (144 CML) for current
situation (0) and the seven alternatives (1e7).
both the small lakes (alt. 2) and the large lake (alt. 3) have risk
levels (364 and 188 CML respectively) above the acceptable
level and the probability of exceeding it is considerable, 0.73
and 0.42 respectively.
Combining increased treatment capacity with either
regulation of the small lakes (alt. 4) or the large lake (alt. 5)
results in further reduction of the risk level, from 81 CML to 65
and 54 CML respectively. These levels are clearly below the
target value. The probability of exceeding the safety target is
0.05 for alternative 4 and 0.04 for alternative 5.
Regulation of both the large and small lakes without
measures in the treatment plants (alt. 6) results in a risk level
of 187 CML. This is above the safety target and the probability
of not meeting the target value is 0.41.
Combining all measures (alt. 7) provides the greatest risk
reduction, however, not substantially larger than for alterna-
tives 4 and 5. The three alternatives (4, 5 and 7) have a proba-
bility of 0.04 or 0.05 of not meeting the safety target. The main
reason for the small difference between the alternatives is
input data, which makes it possible to analyse uncertainties in
0.04 results. In addition, it is important to evaluate the uncertainties
6 7 Carlo simulations. If not enough iterations are made, the stan-
dard error of the mean (estimate) will be high, resulting in a low
accuracy of the calculations. Non-parametric bootstrapping
(e.g. Efron and Tibshirani, 1993) was used to evaluate the
uncertainties in the simulation results. This means that
statistics were sampled empirically by repeatedly sampling
data. Thus, the model data (10,000 iterations) were sampled
once and new samples were then created by resampling from
this data set. In total 1000 resamplings were made, each
including 10,000 samples. Replacement was applied so that
each sample can be resampled more than once.
By means of bootstrapping the 95 percent upper confidence
limit (UCL95) of the mean was calculated for the risk values and
for the probabilities of exceeding the safety target (Fig. 7). The
bars in both plots in Fig. 7 show small differences between
mean and UCL95 values. Thus, simulations based on 10,000
iterations were considered to give results with acceptable
uncertainty since using UCL95 instead of mean values when
comparing risk levels with the safety target does not affect the
results. Values close to target values are especially important to
scrutinise. The estimated value of the probability of exceeding
the safety target is close to, or equal to, 0.05 for alternatives 4, 5
and 7 (Fig. 6). The UCL95 values are only slightly larger (0.05 for
all alternatives) and due to the probabilistic approach applied,
with uncertainties in input data, values close to target values
should be evaluated with cautiousness.

Risk levels Comparison with water safety target

a 400 b 0.8

350 0.7

300 0.6

250 0.5
P(R>Rc)
CML

200 0.4

150 0.3

100 0.2

50 0.1

0 0
1 2 3 4 5 6 7 1 2 3 4 5 6 7
Alternative Alternative

Fig. 7 e Mean (light colours) and UCL95 values (dark colours) of risk levels (a) and probabilities of exceeding the safety targets
(b) for the alternatives.
 w a t e r r e s e a r c h 4 5 ( 2 0 1 1 ) 2 4 1 e2 5 3 249

900 Combining the cost and effect of each alternative, the cost-
1% effectiveness ratio (CER) was calculated (Fig. 9). Based only on
800 2% the CER, alternative 2 is clearly more cost-effective than the
3% others. However, since also the safety target and the ability of
700 4% the alternatives to meet the target have to be considered,
5%
further evaluation is required (see Section 5).
600
Cost [MSEK]

500
400
300
200
100
0 should mainly be used to identify and discuss differences
7 5 6 3 4 1
Alternative
Fig. 8 e Ranked costs (Cj) for the seven alternatives using
different discount rates. The alternatives are ranked from
highest to lowest cost. The 3% discount rate was used for
the subsequent calculations.
4.4. Cost-effectiveness
The total cost of each alternative based on different discount
rates is presented in Fig. 8 (10 SEK w 1 EUR; w 1.2 USD). In Fig. 8
the costs for the alternatives are showed in ranked order.
Ranked from highest to lowest cost the alternatives are sorted
as: 7, 5, 6, 3, 4, 1 and 2. It can be seen that the order does not
change with respect to the discount rate. It can also be seen in
Fig. 8 that a change in discount rate has the largest affect on
high costs. In the subsequent calculations the 3% discount
rate was used. If the alternative of increased treatment
capacity (alt. 1) is chosen, this will probably include additional
actions aimed at reducing odour problems and improving the
working environment. The costs, and benefits, included in
this analysis are only the ones related to actions needed to
increase the treatment capacity.
1.5
1.16
CER [MSEK/CML]
4.5. Cost-benefit
The net benefit of all alternatives is presented in Fig. 10 as
a function of the economic value of 1 min additional water
supply per year and consumer. If the economic value of risk
reduction (c) is lower than 0.03 SEK, only alternative 2
provides a positive net benefit. From a strict cost-benefit
approach only alternatives resulting in a positive net benefit
should be approved. In this application, however, the only
benefit included was the risk reduction. Consequently, Fig. 10
2
between the alternative measures. It can, for example, be
seen that whether the value of c is above or below the
intersection points at 0.06 and 0.13 clearly affects the rela-
tionship between the alternatives. Furthermore, if c is
approximately 0.07 SEK or higher, all alternatives result in
a positive net benefit (Fig. 10).
As an example, the value of c has to be at least 0.033 SEK
for alternative 1 to result in a positive net benefit. This
alternative reduces the risk by 531 CML, which result in
a total cost per year and consumer of 17.5 SEK. This figure can
be compared to the annual cost for drinking water, which is
approximately 400 SEK per consumer in Gothenburg. In
addition to this cost there is a fixed service cost for drinking
water and wastewater, which is 2542 SEK per year for
a single-family house.
Alternatives 2, 3 and 6 do most likely not meet the safety
target (Figs. 5 and 6). Among the remaining options, alter-
natives 1 and 4 as well as 5 and 7 have similar net benefits.
The first set of alternatives (alt. 1 and 4) is mainly charac-
terised by the large risk reduction by increased treatment
capacity, while the second set (alt. 5 and 7) is characterised
by the high cost of regulating the large lake. The difference
between these sets of alternatives is fairly similar over the
range of c values included in Fig. 10. At c equal to 0.1 SEK the
difference is approximately 340 MSEK. Thus, if the large lake
provides additional benefits (i.e. not included in this anal-
ysis) of more than 340 MSEK, alternatives 5 and 7 may result
1.17 in the highest net benefits. Furthermore, if c is equal to
approximately 2.5 SEK alternative 7 becomes most

1 0.88 beneficial.
0.87

0.53 0.52 5. Discussion

0.5
The results clearly show that the risk for the current system is
not acceptable and that measures are required. What risk-
0.04 reduction measure to select depends on the criteria for the
0 decision. A summary of the alternatives is presented in Table
1 2 3 4 5 6 7
2 and it is indicated whether the estimated risks (Rj) exceed
Alternative
the target value of 144 CML (Rc) or not. Furthermore, two
Fig. 9 e Cost-effectiveness ratio (CER) for the seven examples of a certainty criterion are included, representing
alternatives. the highest acceptable probability of not meeting the target
250 w a t e r r e s e a r c h 4 5 ( 2 0 1 1 ) 2 4 1 e2 5 3

a 1500 300

Alt. 4
b

Net Benefit [MSEK]

Alt. 1
250

1000

200
Net Benefit [MSEK]

150
500 0.05 0.055 0.06 0.065
c [SEK]

550

c
Alt. 2 Alt. 3
0

Net Benefit [MSEK]

Alt. 1
Alt. 6
Alt. 2 500
Alt. 3
Alt. 5 Alt. 4
500
Alt. 5
Alt. 7 Alt. 6
Alt. 7
450
0 0.05 0.1 0.15 0.2 0.12 0.125 0.13 0.135
c [SEK] c [SEK]

Fig. 10 e Net benefit of alternatives as a function of the economic value of 1 min additional water supply per year and
consumer (c). In Figure (a) all alternatives are included and in Figures (b) and (c) the two intersection points have been
zoomed in. The same legend is used in all figures.

value, i.e. P(Rj > Rc). The probabilities used in our example are lowest cost. However, to fully understand the results a couple
0.10 and 0.05. It should be emphasised that the decision- of different aspects have to be considered, see below.
makers have to define the certainty criterion; it is not the task
of the risk analysts. As can be seen in Table 2 alternatives 2, 3 5.1. Target values and the CER
and 6 exceed both probabilities. Alternative 1 may be accepted
if the certainty criterion is represented by the highest (0.10) Although an alternative results in a low CER, such as alternative
probability. Thus, the required level of certainty has an impact 2, it cannot be considered cost-effective if the acceptable level
on what alternatives that can be accepted. of risk is exceeded (Table 2). In the kind of case study performed
Among the three alternatives meeting all criteria (alt. 4, 5 here, a predefined target value is necessary for a CEA to be
and 7), increased treatment capacity in combination with useful. If the aim is to achieve the largest risk reduction for
regulation of the small lakes (alt. 4) has the lowest cost and a certain amount of money, irrespective of the residual risk, no
CER. Hence, if the certainty criterion is represented by an target value is needed. However, to consider both the cost and
acceptable probability of 0.05, alternative 4 is the most cost- effect in a sensible way, a target value is required.
effective alternative. If the certainty criterion is represented If no target value exists and only the CER values are ana-
by an acceptable probability of 0.10, increased treatment lysed, this may cause (i) insufficient risk reduction as well as
capacity alone (alt. 1) is most cost-effective since it has the (ii) unnecessarily large reduction. The first case (i) is

Table 2 e Summary of risk levels (Rj), probabilities of not meeting the safety target P (Rj > Rc), costs (Cj) and cost-
effectiveness ratios (CERj) for the alternatives. The safety target value is 144 CML. For the probability of not meeting the
safety target two example criteria are used (0.10 and 0.05). Bold values indicate that the criterion is not met.
Criterion 144 0.10 0.05

Alternative Rj [CML] P(Rj>Rc) P(Rj>Rc) Cj [MSEK] CERj [MSEK/CML]

1. Increased capacity 81 0.08 0.08 280 0.53

2. Supply from small lakes 364 0.73 0.73 9 0.04
3. Supply from large lake 188 0.42 0.42 372 0.87
4. Combination of alt. 1 and 2 59 0.05 0.05 289 0.52
5. Combination of alt. 1 and 3 52 0.04 0.04 652 1.16
6. Combination of alt. 2 and 3 182 0.41 0.41 381 0.88
7. Combination of alt. 1, 2 and 3 50 0.04 0.04 661 1.17
 w a t e r r e s e a r c h 4 5 ( 2 0 1 1 ) 2 4 1 e2 5 3
Table 3 e Example of two fictitious alternatives to
illustrate limitations with the CER. For each alternative
the residual risk (Rj), cost (Cj) and cost-effectiveness ratio
(CERj) are presented. The current risk level (R0) is assumed
to be the same as in the case study (612 CML).
Alternative Rj [CML] Cj [MSEK] CERj [MSEK/CML]
A 144 420 0.90
B 12 450 0.75
exemplified by alternative 2 in this application (Table 2).
Although the safety target is not met the CER may seem
favourable if the cost, in relation to the effect, is low. The
second case (ii) may, for example, occur if one alternative
reduces the risk far below the acceptable level and another
alternative reduces the risk just to the target value. In Table 3
two alternatives are presented as examples to illustrate this
possible problem. Alternative A reduces the risk just to the
acceptable level of 144 CML to a cost of 420 MSEK. Alternative B
on the other hand, reduces the risk to a level of 12 CML but to
a cost of 450 MSEK. Since the safety target is 144 CML, both
alternatives provide an acceptable risk. To simplify the
example we do not consider uncertainties in risk levels and
costs. If the CER values are compared, alternative B appears to
be most cost-effective (Table 3). However, alternative A meets
the safety target to a lower cost. One may argue that there is
no use of reducing the risk below the acceptable risk level. It
would be better to use these resources for other purposes.
Consequently, the CER should be used to illustrate the cost of
reducing the risk one unit but not as the single criterion for
evaluating alternatives.
An alternative way of calculating the effect (Ej) could be
used to avoid the problem with CER values described above. By
not considering risk reduction below the safety target (Rc), the
effect could be calculated as
 
Ej min R0  Rj ; R0  Rc
where R0 is the risk level prior to any measures, Rj the residual
risk for alternative j. Thus, the largest possible effect is R0Rc.
Using Equation (7) for the two examples in Table 3, results in
a CER of 0.96 for alternative B and no changes for alternative A.
Based on the alternative approach alternative A is most cost-
effective (0.90 < 0.96).
5.2. Aspects included
Considering only the three first alternatives, increased treat-
ment capacity (alt. 1) provides a substantial risk reduction
compared to the alternative raw water supplies (alt. 2 and 3). It
can be concluded that the capacity of the treatment plants is
a bottleneck in the system that cannot be solved only by
increased access to raw water. Although increased treatment
capacity has a large effect on the risk level, additional measures
may be needed depending on the required level of certainty.
The combination of increased treatment capacity and both
the large and small lakes (alt. 7) provides the largest risk
reduction. However, if increased treatment capacity is
251
combined with only the large lake (alt. 5) a risk reduction
almost equivalent to alternative 7 is obtained. Increased
treatment capacity in combination with the small lakes (alt. 4)
also results in similar residual risk. The only combination of
measures not meeting the target value is the combination of
the large and small lakes (alt. 6). This alternative provides
limited additional risk reduction compared to using the large
lake only (alt. 3). Thus, including the large lake, solely or
combined with increased treatment capacity, the small lakes
provide only marginal additional risk reduction. Considering
the effect and the cost, alternatives 1 and 4 seems to be the
best options.
A major advantage of the applied method is the possibility
to measure each alternatives effect on the risk using the same
unit (CML). The use of CML as a performance indicator is
common in the energy sector and has been used in the
drinking water sector in the Netherlands. This study shows
that CML is an applicable unit to be used when evaluating and
comparing measures for reducing water supply interruptions,
i.e. quantity failures. However, alternatives may have other
positive effects that are not related to quantity failure. For
example, regulation of the large lake will most probably also
provide a raw water of better and more stable quality
compared to the current main raw water source. The cost-
benefit calculations (Fig. 10) show that a costly alternative
may result in a positive net benefit if the value of risk reduc-
tion is high or large benefits are obtained. If a full CBA would
have been performed, it may not have provided recommen-
dations similar to those of the CEA, e.g. because of possible
health benefits provided by the large lake but not considered
in the CEA. The reduced quality risk, i.e. related to human
health effects, was not considered in this analysis but could
also be assessed using the fault tree method.
Another aspect not explicitly included in the CEA is the
time for implementing measures. For example, the inclusion
of the large lake is expected to be a rather complicated and
long process, for various reasons. Assume that increased
(7) treatment capacity combined with the large lake (alt. 5) is
selected as the most suitable alternative. Furthermore,
increased treatment capacity by itself is not associated with
an acceptable risk. Since the large lake takes a long time to
implement, it might be reasonable to first combine increased
treatment capacity with the small lakes (alt. 4). Thus, when
the large lake is installed, the small lakes may be excluded. In
this way the risk is not unacceptable during the installation of
the large lake.
The CEA, as applied here, includes one criterion related to
the risk level and one to the cost. To further develop the
approach, additional criteria can be included and a multi-
criteria decision analysis (MCDA) applied. A MCDA would
make it possible to include additional types of risk, such as the
quality risk, and also additional criteria for evaluating the
performance of alternative measures. One criterion could be
linked to, for example, the time it takes to implement
measures. If the aim is to evaluate how well alternative
measures contribute to a sustainable supply system, they can
be assessed based on criteria linked to environmental,
economic and socio-cultural dimensions. In a MCDA it is also
possible to take into account that all criteria may not be
regarded as equally important.
252 w a t e r r e s e a r c h 4 5 ( 2 0 1 1 ) 2 4 1 e2 5 3
5.3. Uncertainties and cost
The uncertainty analysis of the costs was related to the
discount rate. By calculating the present value for each alter-
native using different discount rates, the sensitivity of the
results with respect to this variable was analysed. Although
uncertainties in input data are not considered, this type of
analysis is important to know whether the value of parame-
ters affects the final prioritisation of alternatives.
5.4. The method
The applied fault tree analysis in combination with CEA
illustrates its possibilities as a decision support tool for struc-
tured comparison of alternative risk-reduction measures. The
fault tree analysis makes it possible to model alternatives that
influence different parts of a system and to quantify the risk
reduction. The method facilitates two very important anal-
yses: (1) analysis of the risk reduction provided by a specific
measure; and (2) analysis of the uncertainty of the risk esti-
mate, which enables an estimation of the probability of not
meeting acceptable risk levels. Combination of the quantita-
tive fault tree analysis and economic evaluation provides
transparency and a basis for long-term planning of drinking
water systems.
6. Conclusions
The main conclusions of this study are:
- The fault tree method enables comparison of risk-reduction
alternatives in the same quantitative unit and for an entire
drinking water system from source to tap. Interactions
between events and components of the system can be
modelled in a realistic way. Furthermore, the probabilistic
approach enables comparisons with safety targets and the
probability of exceeding these target values can be calculated.
- A CEA provides useful information by combing the effect
and cost. However, it is important to understand existing
pitfalls when interpreting the results. For example, alter-
natives may provide additional benefits not considered in
the CEA and alternatives cannot be evaluated solely based
on cost-effectiveness ratios.
- A CEA requires a safety target representing the acceptable
level of risk. In addition to the target value it is also impor-
tant to consider the highest acceptable probability of not
meeting the target value, i.e. a certainty criterion.
- A multi-criteria decision analysis could be applied to further
develop the applied approach and include additional
criteria for evaluating the performance of risk-reduction
measures.
Combining quantitative risk analysis tools, such as the
applied fault tree method and economic evaluation, provides
a powerful tool for decision-makers. A combined quantitative
risk assessment and economic evaluation can provide
a structured and thorough analysis of risk-reduction
measures that facilitates transparency and long-term
planning of drinking water systems in order to avoid sub-
optimisation of available resources for risk reduction.
Acknowledgements
This research was sponsored by The Swedish Water &
Wastewater Association, the City of Gothenburg and the
TECHNEAU project, a EC-funded FP6 project (www.techneau.
org). We would like to thank the City of Gothenburg for its
valuable and fruitful collaboration. We also appreciate
the comments and suggestions given by the anonymous
reviewers.
references
Astrom, J., Pettersson, T.J.R., Stenstrom, T.A., 2007. Identification
and management of microbial contaminations in a surface
drinking water source. Journal of Water and Health 5 (Suppl.
1), 67e79.
Bartram, J., Corrales, L., Davison, A., Deere, D., Drury, D.,
Gordon, B., Howard, G., Rinehold, A., Stevens, M., 2009. Water
Safety Plan Manual: Step-By-Step Risk Management for
Drinking-Water Suppliers. World Health Organization,
Geneva.
Bedford, T., Cooke, R.M., 2001. Probabilistic Risk Analysis:
Foundations and Methods. Cambridge University Press,
Cambridge.
Blokker, M., Ruijg, K., de Kater, H., 2005. Introduction of
a substandard supply minutes performance indicator. Water
Asset Management International 1 (3), 19e22.
Brouwer, W.B.F., Koopmanschap, M.A., 2000. On the economic
foundations of CEA. Ladies and gentlemen, take your
positions! Journal of Health Economics 19 (4), 439e459.
Burgman, M.A., 2005. Risks and Decisions for Conservation and
Environmental Management. Cambridge University Press,
Cambridge.
Cox, A.L., 2008. Whats wrong with risk matrices? Risk Analysis 28
(2), 497e512.
Davison, A., Howard, G., Stevens, M., Callan, P., Fewtrell, L.,
Deere, D., Bartram, J., 2005. Water Safety Plans: Managing
Drinking-Water Quality from Catchment to Consumer. WHO/
SDE/WSH/05.06. World Health Organization, Geneva.
Efron, B., Tibshirani, R., 1993. An Introduction to the Bootstrap.
Chapman & Hall, New York.
Goteborg Vatten, 2006. Action Plan Water: Long-term Goals for
the Water Supply in Gothenburg (In Swedish) City of
Gothenburg.
Johansson, P.-O., 1993. Cost-benefit Analysis of Environmental
Change. Cambridge University Press, Cambridge, New York.
Levin, H.M., McEwan, P.J., 2001. Cost-effectiveness Analysis:
Methods and Applications, second ed. Sage Publications,
Thousand Oaks, California.
Lindhe, A., 2008. Integrated and probabilistic risk analysis of
drinking water systems, Licentiate Thesis No. 2008:8,
Chalmers University of Technology, Goteborg.
Lindhe, A., Rosen, L., Norberg, T., Bergstedt, O., 2009. Fault
tree analysis for integrated and probabilistic risk analysis
of drinking water systems. Water Research 43 (6),
1641e1653.
Lindhe, A., Rosen, L., Norberg, T., Petterson, T.J.R., Bergstedt, O.,
Astrom, J., Bondelind, M., 2008. Integrated risk analysis from
source to tap: Case study Goteborg, In: 6th Nordic Drinking
Water Conference, pp. 231e241.
 w a t e r r e s e a r c h 4 5 ( 2 0 1 1 ) 2 4 1 e2 5 3
Lindstedt, U., Ingelsson, M., Engleryd, A., 2003. Consequence
Analysis Step-By-Step: Guidance on Economic Consequence
Analysis for the Environmental Protection Agency (In Swedish).
Swedish Environmental Protection Agency, Stockholm.
MacGillivray, B.H., Hamilton, P.D., Strutt, J.E., Pollard, S.J.T., 2006.
Risk analysis strategies in the water utility sector: an
inventory of applications for better and more credible decision
making. Critical Reviews in Environmental Science and
Technology 36 (2), 85e139.
Nas, T.F., 1996. Cost-benefit Analysis: Theory and Application.
Sage Publications, Thousand Oaks, Calif.
Norberg, T., Rosen, L., Lindhe, A., et al., 2009. Added value in fault
tree analyses. In: Martorell, S. (Ed.), Safety, Reliability and Risk
Analysis: Theory, Methods and Applications. Taylor & Francis
Group, London, pp. 1041e1048.
Pollard, S.J.T., 2008. Risk Management for Water and Wastewater
Utilities. IWA Publishing, London.
Ramsey, S., Willke, R., Briggs, A., Brown, R., Buxton, M.,
Chawla, A., Cook, J., Glick, H., Liljas, B., Petitti, D., Reed, S.,
2005. Good research practices for cost-effectiveness analysis
alongside clinical trials: the ISPOR RCT-CEA task force report.
Value in Health 8 (5), 521e533.
253
Rausand, M., Hyland, A., 2004. System Reliability Theory:
Models, Statistical Methods, and Applications, second ed.
Wiley-Interscience, N.J.
Rosen, L., Hokstad, P., Lindhe, A., Sklet, S., Rstum, J., 2007.
Generic FRAMEWork and Methods for Integrated Risk
Management in Water Safety Plans. Deliverable no. D 4.1.3, D
4.2.1, D 4.2.2, D 4.2.3. TECHNEAU.
Rosen, L., Lindhe, A., Bergstedt, O., Norberg, T., Pettersson, T.J.
R., 2010. Comparing risk-reduction measures to reach
water safety targets using an integrated fault tree model.
Water Science and Technology: Water Supply 10 (3),
428e436.
Rosen, L., Steier, K., 2006. Risk Analysis: Interruptions in Raw
Water Supply to the Gothenburg Drinking Water System (In
Swedish), Consulting report, Contract no. 1310786. SWECO
VIAK AB.
Stern, N., 2007. The Economics of Climate Change: The Stern
Review. Cambridge University Press, Cambridge.
WHO, 2008. Guidelines for Drinking-Water Quality [Electronic
Resource]: Incorporating First and Second Addenda. In:
Recommendations, third ed., vol. 1. World Health
Organization, Geneva.