Research Highlights

Threat Ensemble Vulnerability Assessment: CANARY, Event Detection Software

The figure shows water quality data in a distribution system over a period of 12 hours. Near hour 8, a contamination incident has occurred, and the changes in the water quality signals are evident.

CANARY software has been piloted using data from two drinking water systems. In 2007, it was deployed at a Water Security Initiative* pilot utility, where it is operating in real time. Based on data analysis performed by CANARY, the pilot utility has incorporated new guidelines into its emergency response and consequence management plans.

CANARY Software Information and Availability

The CANARY software allows for:

• The use of a standard data format for input and output of water quality and operations data
• The ability to select different detection algorithms (CANARY contains three different mathematical approaches for analyzing the data)
• The ability to select various water utility and location-specific configuration options   
• An online operations mode and an off-line evaluation mode 
• The ability to generate data needed to establish performance metrics (e.g., false alarm rates)

CANARY assists water utilities in understanding the significance of large volumes of water quality data. It can automatically review incoming data regarding anomalous conditions and alert the water utility if further action is required. Not only can CANARY detect anomalous conditions resulting from contamination incidents, but it can detect unexpected “normal” events, such as a sensor malfunction or a pipe break.

CANARY is a Windows program that runs on nearly any computer. It is written in the MATLAB® m-code language but also employs some Java programming language. The typical user will not need to know MATLAB®; however, modifications to the source code require knowledge of MATLAB® and/or Java.

The CANARY software is expected to be available to a wider audience in 2008. It is not intended to replace commercially available software but to supplement existing software and motivate commercial development of similar products. It is hoped that the release of CANARY will also motivate additional research and development in this field.

Future CANARY Updates

• An automated configuring approach within a water distribution system is being developed. This approach will use a set of “normal” historical data from a water distribution system and automatically find a set of “good” parameters to be used in the configuration process. Because event detection software has an inherent trade-off between detection sensitivity and the false alarm rate, each user must eventually decide what the best parameters will be for a specific use of CANARY.
• Researchers are investigating different ways to interface with water utilities’ Supervisory Control and Data Acquisition (SCADA) systems to improve the performance of CANARY. SCADA refers to a large-scale, distributed measurement and control system that controls components such as pumps and valves, and records data from sensors.
• Researchers are pursuing methods to use information collected simultaneously from multiple locations (rather than each location separately) to increase the sensitivity of detecting contamination incidents. By incorporating information from several sensor stations, along with information about hydraulic connectivity, CANARY may be able to more accurately and rapidly detect contamination incidents.

Contact: Regan Murray

Feedback/Questions

*The Water Security Initiative is an EPA-led project whose goal is to develop a robust monitoring and surveillance system that can improve contaminant detection at water utilities nationwide.