Americans are accustomed to drinking from the kitchen tap without fear that it might harm them, even though water utilities could be vulnerable to terrorist attacks or natural contaminants.

Now, CANARY Event Detection Software – open source software developed by Sandia in partnership with the Environmental Protection Agency (EPA) – is being used to protect public water systems by enhancing the detection of these threats to drinking water systems.

“People are excited about it because it’s free and because we’ve shown that it works really well. We would love to have more utilities using it,” says Regan Murray, acting associate division director of EPA’s Water Infrastructure Protection Division at the National Homeland Security Research Center.

The software tells utility operators within minutes whether something is wrong with their water, giving them time to warn and protect the public. And, it’s improving water quality by giving utility managers more comprehensive real-time data about changes in their water.

Greater focus on water security

CANARY is being used in Cincinnati and Singapore, and Philadelphia is testing the software system. A number of other utilities in the US are evaluating CANARY for future application.

Sean McKenna (6911), the Sandia researcher who led the team that developed CANARY and lived in Singapore for two years to install the software there and train water authority staff how to use it, says people began to pay attention to the security of the nation’s water systems after 9/11. Other team members included: Dave Hart and Kate Klise (both 6911); Eric Vugrin (6921); Mark Koch (5448); and Shawn Martin and Bill Hart (both 1464).

“We wanted to help make things more secure. Water systems in particular are designed to provide water to customers and there was less consideration of security previously, but there’s greater focus on security now,” Sean says. Sean and Murray say that CANARY could have lessened the impact of the largest contaminated public water source ever reported in the United States. In 1993, Milwaukee’s cryptosporidiosis outbreak hastened the deaths of dozens of citizens, made more than 400,000 residents ill, and cost more than $96 million in medical costs and productivity losses, according to reports about the tragedy.

“If you don’t have a detection system, the way you find out about these things is when people get sick,” Murray says.

Sandia had worked on water security before 9/11. So when the EPA was looking for help early in the last decade to better monitor water utilities, they contacted Sandia.

Reducing false alarms

A Sandia-developed risk assessment methodology for water focused on infrastructure physical security, but did not address how to detect and assess the impact of contamination in the water itself. Sean says his team initially received funding through Sandia’s Laboratory Directed Research and Development program to address that gap in the technology and then teamed with the EPA to develop CANARY and other software tools designed to focus on security threats to water.

CANARY, which runs on a desktop computer, can be customized for individual water utilities, working with sensors and software already in use, Sean says.

While some utilities monitor their water using real-time sensors, many still send operators out once a week to take samples, says Dave, the lead software developer for the CANARY project.

Compared to weekly samples, CANARY works at lightning speed.

“From the start of an event – when a contaminant reaches the first sensor – to an event alarm would be 20-40 minutes, depending on how the utility has CANARY configured,” Sean says.

The challenge for any contamination detection system is reducing the number of false alarms and making data meaningful amidst a “noisy” background of information caused by the environment and within the infrastructure itself.

Specially designed algorithms

CANARY researchers used specially designed numerical algorithms to analyze data coming from multiple sensors and differentiate between natural variability and unusual patterns that indicate a problem. For example, the Multivariate-Nearest Neighbor algorithm groups data into clusters based on time and distance, says Kate, a numerical analyst. When new data is received, CANARY decides whether it’s close enough to a known cluster to be considered normal or whether it’s far enough away to be deemed anomalous. In the latter case, CANARY alerts the utility operator, Kate says.

The software looks at subtle changes in water quality, using multiple sensors and time series analysis, which tracks data over successive time intervals to obtain meaningful characteristics, Kate says.

“We wanted to move beyond the idea where there are certain thresholds of water quality. We wanted to consider multiple signals at one time because contaminants could affect different measures in different ways,” Kate says.

The computer program uses a moving 1.5- to two-day window of past data to detect abnormal events by comparing predicted water characteristics with current observations. But to minimize costly and inefficient false positives, the alarm is not sounded when only a single outlier is noted. CANARY aggregates information over multiple 2- to 5-minute time steps to build evidence that water quality has undergone a significant change, Sean says.

“We’ve taken techniques from different fields and put those together in a way they haven’t been put together before and certainly the application of those techniques to water quality monitoring hasn’t been done before,” Sean says.

CANARY also provides information about gradual changes in the water, Sean says.

The unintended benefit of the software is that when utility operators better understood the data being sent by their sensors, they could make changes to the management of the water systems to improve its overall quality, Sean says.

“A better-managed system is more secure and a more secure system is better managed, is what we found from utilities we work with,” Sean says.

A ‘quantum leap’ for Singapore utility

Harry Seah, director of the Technology and Water Quality Office at the Public Utilities Board (PUB), Singapore’s national water authority, wrote in a letter supporting CANARY that the software provided a “quantum leap” in the utility’s practices.

In the past, Seah wrote, the utility depended on preset limits of three water characteristics to determine water quality.

“With the implementation of CANARY, relative changes in the patterns of these three parameters can be used to uncover water quality events, even if each individual parameter lies within the alarm limits,” Seah wrote. “This dramatically improves PUB’s ability to respond to water quality changes, and allows PUB to arrest poor quality water before [it reaches] the consumers.”

As the software is increasingly being installed at water utilities, researchers are working on new application areas for CANARY, such as computer network traffic logs and geophysical log analysis used by oil drillers to analyze rocks at different depths.