Water Safety Plan for drinking water risk management : the case study of Mortara ( Pavia , Italy )

The Water Safety Plan (WSP) approach is an iterative method focused on analyzing the risks of water contamination in a drinking water supply system, from catchment to consumer, in order to protect human health. This approach is aimed at identifying and drastically reducing water contamination in the entire drinking water system, through the identification and mitigation or, if possible, elimination of all factors that may cause a chemical, physical, microbiological and radiological risk for water. This study developed a proposal of WSP for the drinking water supply system (DWSS) of Mortara, Italy, in order to understand which are the preliminary evaluation aspects to be considered in the elaboration of a WSP. The DWSS of Mortara (a town of 15,500 inhabitants, located in northern Italy) consists of three drinking water treatment plants (DWTPs), considering the following main contaminants: arsenic, iron, manganese and ammonia. Potential hazardous events and associated hazards were identified in each part of the water supply system. The risk assessment was carried out following the semi-quantitative approach. The WSP proposal for Mortara was very useful not only as a risk mitigation approach, but also as a cost-effective tool for water suppliers. Furthermore, this approach will reduce public health risk, ensure a better compliance of water quality parameters with regulatory requirements, increase confidence of consumers and municipal authorities, and improve resource management due to intervention planning. Further, some new control measures are proposed by the WSP team within this work.


INTRODUCTION
Water quality is a global issue which requires both environmental and human health evaluations or assessments (Monteiro et al., 2014;Omaka et al., 2015;Sanches et al., 2015).The Water Safety Plan (WSP) is an innovative risk assessment and management approach aimed at ensuring the safety of water for human consumption in the entire drinking water supply system (DWSS), from catchment to consumer (Collivignarelli, 2017).In 2004, the World Health Organization (WHO) introduced this approach in guidelines for drinking water quality (WHO, 2004).In 2009, the WHO published a manual which describes the step-by-step WSP procedure (Bartram et al., 2009).Recently, the WSP has been included in European Directive 2015/1787 (EU, 2015) concerning water quality intended for human consumption.
The main objectives of a WSP are the following (Lucentini et al., 2014): (i) describe and analyse the DWSS; (ii) identify all factors that may cause a chemical, physical, microbiological and radiological risk for water; (iii) reduce or eliminate these factors; (iii) prevent water re-contamination during storage and distribution.
The knowledge and optimization of a DWSS is the basis for WSP implementation.An example of a methodological scheme for the control and optimization of drinking water treatment plant (DWTP) performance is reported in Sorlini et al. (2015a).DWTP monitoring to highlight critical issues, with the addition of laboratory and/or field tests (so-called experimental performing tests), should be adopted as a routine procedure for the "good management" of a DWSS.The scientific literature (Vieira et al., 2008;Lamrini et al., 2014) reports interesting studies on the optimization of different DWTPs with "targeted upgrading" (Sorlini et al., 2015b) and operative cost saving (Sorlini et al., 2015c) for DWSSs that must respect more stringent limits for specific pollutants, i.e., arsenic (Sorlini et al., 2014;Collivignarelli et al., 2016).
The degree of WSP implementation and the impact on drinking water quality varies significantly between European countries.The results of the global and regional survey on WSPs in the WHO European Region showed that about 40% of the countries had experience with WSPs; about one-third of the countries had national scale-up strategies for WSP Rev. Ambient.Água vol. 12 n. 4 Taubaté -Jul./ Aug. 2017 implementation, and in 1 out of 10 countries WSPs are actively enforced (WHO and IWA, 2014).
In most cases, in countries where WSPs are not mandatory (and no similar requirements for risk-based quality management exist, such as Hazard-Analysis and Critical Control Points, HACCP), WSPs were implemented on a voluntary basis.For these countries, the risk management approach applied is reported in Table 1.Even if some circumstances, such as water system partitioning as in Ciaponi et al. (2016), help the implementation of the WSP, these experiences highlighted the fact that WSPs can be applied to all DWSSs, regardless of their size or complexity (Lucentini et al., 2016b).Moreover, WSPs can be applied in developing countries and offer significant cost savings in water quality control (Rondi et al. 2015).
This study shows the WSP development for the DWSS of a town in northern Italy.Even though this DWSS is in full compliance with Italian regulations pertaining to water for human consumption (Italy, 2001), this case was chosen due to its representativeness in northern Italy, especially in the Po Valley, where many groundwater sources present similar critical contaminants such as ammonia, manganese, iron and, sometimes, arsenic.
This study shows one of the first Italian case studies of a WSP proposal, highlighting the benefits and critical aspects of this approach.

Mortara (Pavia) drinking water supply system
The DWSS of Mortara, a town of 15500 inhabitants, located in northern Italy, consists of three DWTPs, each treating groundwater (average treated flow 11-28 L s -1 ) containing the following main contaminants: arsenic, iron, manganese and ammonia.Two of the three DWTPs have the sequence of treatments reported in Figure 1.The other one doesn't have mixed Granular Activated Carbon (GAC)/sand filtration treatment.Disinfection with NaClO is carried out if necessary.Treated water flows into an 84-km interconnected distribution network, whose main pipe materials are polyvinyl chloride (28%), high-density polyethylene (25%), fiber cement (31%), steel (0.5%) and cast iron (0.4%).The 2013-2016 averages of monitored data of the Mortara DWSS are reported in Table 2.  (Italy, 2001)   Plant 1 Fe

Methods
The WSP of the DWSS of Mortara was developed according to the WHO guidelines and to the Italian Institute of Health guidelines (Bartram et al., 2009;Lucentini et al., 2014).The Rev. Ambient.Água vol. 12 n. 4 Taubaté -Jul./ Aug. 2017 WSP included the following steps: (i) formation of a multidisciplinary team that involved a DWSS utility manager, researchers, and environmental and health protection agencies; (ii) a description of DWSS carried out by on-site field checking, historical data analysis, and flow diagram development; (iii) identification of hazardous events, associated hazards and risks by means of the application of a semi-quantitative risk matrix approach (Table 2); (iv) identification and validation of control measures and risk reassessment; (v) development of an upgrade plan with new control measures to reduce risk rating; (vi) development of a monitoring plan that establishes what will be monitored, how it will be monitored, the frequency of monitoring, who will do the monitoring, and critical limits and related corrective actions; (vii) development of a verification plan to control the WSP's effectiveness.
The approach based on the What-If/Checklist Analysis was applied in order to assess the risk.This method is a team-based, structured hazard analysis that combines the brainstorming aspects of the What-if with the systematic approach of the Checklist.To structure the analysis, typical hazards were analyzed, such as chemical, physical and microbial contamination, failures and insufficient water events.According to the WHO guidelines, the semi-quantitative risk matrix approach was used, estimating the likelihood of occurrence of each hazard and evaluating the severity of consequences if the hazard occurred.These factors were classified as reported in Table 3, and the classification of the severity of consequences was based on contaminant compliance with national regulations on drinking water quality and human health effects (Table 3).The risk was calculated as the product of likelihood and severity of consequences (Table 4).

Identification of hazardous events, hazards and risk assessment
The potential hazardous events and all related potential physical, biological, chemical or radiological hazards associated with each step in the DWSS were identified.Table 5 shows an example of risk assessment before consideration of the current control measures.Note: L = likelihood; S = severity; R = risk.
Rev. Ambient.Água vol. 12 n. 4 Taubaté -Jul./ Aug. 2017 For example, at the catchment, the pump drawing water from the well to the treatment plant could malfunction.In this case, there is no water supply to the plant.The severity of consequences is 3 (moderate impact).According to the information reported by DWSS utility manager, the likelihood of occurrence is once a year (unlikely, 2).So, the calculated risk is medium (2 x 3 = 6).Furthermore, at the biofiltration, the inner wall of the filters could peel-off.In this case, there is chemical/physical contamination, due to the presence of iron and cement mortar in the water at the filter outlet.The severity of consequences is 4 (major impact) because iron and cement mortar are associated with chemical contamination.According to monitoring data (Figure 2) and information reported by the DWSS utility manager, the likelihood of occurrence is once a year (unlikely, 2). Figure 2 shows the 2013-2016 average iron concentrations at the inlet and outlet of biofiltration.The outlet concentrations are lower than the inlet ones, but iron is not completely removed.Therefore, the presence of residual iron at the outlet of biofiltration is an indicator of possible peeling-off of the filter wall.According to these data, the assigned likelihood value is 2. Finally, the calculated risk is medium (2 x 4 = 8).In this first risk assessment, 130 hazardous events (24 at the catchment, 88 at the treatment and 18 in the distribution network) and 148 hazards were analyzed (29 at the catchment, 98 at the treatment and 21 in the distribution network).
Typical challenges arose from this work, also in accord with Bartram et al. (2009), regarding: • The possibility of missing new hazards and hazardous events.The risk assessment provides a 'point in time' picture of the system.Thus, it should be reviewed on a regular basis; for example, once a year, and/or in case of plant upgrade or incidents.
• Uncertainty in assessing risks due to lack of data, poor knowledge of activities within the water supply chain and their relative contribution to the risk generated.In this work, this problem was overcome thanks to the collaboration of the DWSS utility manager in the WSP development.According to Gunnarsdóttir et al. (2012), this aspect is important for the successful operation of a WSP.
• Properly defining likelihood and consequence with sufficient detail to avoid subjective assessment.Again, the importance of engagement activities of the DWSS utility manager and personnel represent an interesting solution.
Once hazardous events and hazards were identified and ranked according to their likelihood and severity, a first cut-off was applied: risks with low ratings were documented and kept under review, in order to develop the subsequent steps of the procedure only for risks that require further action, so with medium, high and very high ratings.Low ratings with catastrophic impact (severity rating 5) were also carried on.After this first cut-off, 97 hazardous events (21 at the catchment, 58 at the treatment and 18 in the distribution network) and 106 hazards (24 at the catchment, 61at the treatment and 21 in the distribution network) were considered, reducing them by 25% and 28%, respectively, from the first risk assessment step.

Determination and validation of control measures, risk reassessment and prioritization
Current control measures were identified and validated, and risks were reassessed for each hazardous event and hazard considered after the first cut-off (Table 6).
The control measures were validated by means of site inspections and verifying the performance of the technologies and the monitoring data.This validation method included qualitative checks and measures, such as the regular inspection of catchment areas as well as continuous on-line monitoring (Hamilton et al., 2006).The validation was considered ineffective if a control measure did not function properly, or if non-compliance of water quality parameters with Italian regulations was verified or if a technology performed effectively.
As shown in Table 4, for example, at the catchment pump operation is controlled by remote control and by periodically in situ inspections; moreover, there are two pumps operating in active reserve, so that if one pump does not work, water drawing is guaranteed by the other pump.These three control measures were validated and the results showed that they are effective.Therefore, the likelihood of this hazardous event and hazard can be reduced from unlikely to rare, and the risk rating becomes low.
In some cases, the risk reduction often represented a critical issue because sometimes control measures were in place but were not effective; thus, the likelihood could not be reduced.Furthermore, the likelihood assessment, after considering control measures, could be quite subjective.However, to be as objective as possible, the WSP team used historical monitoring data and the information provided by the DWSS manager.
Again, the WSP team documented and kept under review the risks with low ratings, in order to develop the subsequent steps of the procedure only for hazards with medium, high and very high ratings.After this second cut-off, 10 hazardous events (1 at the catchment, 4 at the treatment and 5 in the distribution network) and 13 hazards (2 at the catchment, 5 at the treatment and 6 in the distribution network) were considered, reducing them by 90% and 88%, respectively, from the second risk assessment step.After risk assessment, an improvement/upgrade plan was developed.New control measures were identified to reduce risks with medium, high and very high rating, for each hazardous event and hazard considered after the second cut-off (Table 4).For example, in order to control FeCl3 injection, the dosing pump could be connected to remote control that triggers alarms if the pump is not working.Moreover, a jar test at laboratory scale can be performed in order to verify the effectiveness of the arsenic precipitation process.The new control measures proposed seem to be cost-effective and sustainable.

Development of a monitoring plan and verification of the WSP's effectiveness
After identifying new control measures, a monitoring plan was developed, establishing what will be monitored, how it will be monitored, the frequency of monitoring, where it will be monitored and who will do the monitoring.Moreover, critical limits and related corrective actions were established (Table 7).The critical limit of each water quality parameter was conservatively fixed just below the regulation limit defined by Italian regulation (Legislative Decree n.31, 2 February 2001).The critical limit values were defined for each parameter after a discussion within the WSP team based on the DWSS manager's experience.The exceedance of critical limits requires urgent corrective actions, defined to ensure safe water to users.Therefore, corrective actions were discussed within the team for each hazardous event, and might involve immediate notification to the local health authority and/or the application of a contingency plan for an alternative water supply.
The example shown in Table 7 regards the monitoring of the precipitation process with FeCl3.The water utility manager should collect water samples at the outlet of the mixed GAC/sand filters once a month and analyze the iron and arsenic concentration.
If iron results are over 140 µg L -1 , there might be iron deposits in the distribution network pipes.Therefore, precipitation with FeCl3 must be verified and proper levels restored.Furthermore, if arsenic results over the Italian regulation limit of 10 µg L -1 , the water utility manager must verify the performance of the FeCl3 precipitation process.
The human resources to carry out monitoring and analysis (which has financial implications) and the creation of good working conditions for control and monitoring are important issues for the WSP's success (Gunnarsdóttir et al., 2012;Kutane et al., 2016;Lucentini et al., 2016a;Nurali et al., 2016;Setty et al., 2017;String and Lantagne, 2016;Thompson et al., 2016).Moreover, changing the attitudes of personnel who conduct the monitoring represents a challenge that can be solved by appropriate training.In this work, these aspects were considered to improve the success of the WSP's implementation.
After defining the monitoring plan, the effectiveness of the verification of the WSP was developed.Verification involves the activities that are undertaken together to prove that the WSP is working effectively.Compliance monitoring establishes what will be verified, how it will be verified, the frequency of verification, where it will be verified and who will do the verification.
For example, as concerns the chemical quality, concentrations of the main critical pollutants (iron, arsenic, manganese and ammonia) at the outlet of the GAC/sand filters should be monitored monthly.Regarding the microbial water quality in the distribution system, in order to guarantee water safety to users, the water utility manager should monitor monthly microbial pathogens, such as E. Coli, by collecting and analyzing water samples at the outlet of the drinking water treatment plant and at different points of the water distribution network.
Sabrina Sorlini et al. parameters with regulatory requirements, increased the confidence of consumers, and improved resource management due to intervention planning.The utility manager is already moving to adopt some of the new control measures the WSP team proposed within this work.

Likelihood 1 .
Rare: once every 5 years 2. Unlikely: once a year 3. Moderate: once a month 4. Likely: once a week 5. Almost certain: once a day Severity of Consequences 1. Insignificant or no impact: no water contamination and no human health effects 2. Minor impact: temporary non-compliance of some physical parameters with no direct link to human health effects 3. Moderate impact: long non-compliance of some physical parameters with no direct link to human health effects 4. Major impact: non-compliance of some chemical parameters with direct link to long term human health effects 5. Catastrophic impact: non-compliance of some chemical and/or microbiological parameters with direct link to long and/or short-term health effectsSabrina Sorlini et al.

Table 3 .
Definitions of likelihood of occurrence and severity of consequences.

Table 5 .
Examples of risk assessment before considering current control measures.

Table 6 .
Examples of risk assessment after considering current control measures.