20.2 Emergency Plans and Incident Response
Key Takeaways
- An emergency response plan connects credible scenarios to triggers, authority, communications, resources, continuity actions, and recovery criteria.
- Operators protect people and treatment barriers first, verify information without entering hazards, and make only the changes authorized by the current plan and SOPs.
- Process upset, equipment failure, spills, natural disasters, and suspected contamination require different technical actions but the same disciplined command-and-documentation structure.
- Return to normal service is an authorized decision based on defined criteria and evidence, not simply the disappearance of an alarm.
Turn a binder into decisions
The WPI Class I outline requires operators to review and update facility emergency response plans and respond to facility upsets, equipment failures, spills, natural disasters, and system contamination. An emergency response plan (ERP) is not a generic instruction to "handle the emergency." It identifies who decides, what triggers action, how people communicate, which resources and alternate operations are available, and what evidence permits recovery. The current plan and incident authority govern; this section does not authorize hazardous work or return to service.
EPA's current water-utility ERP resources are a useful U.S. model. In the United States, Safe Drinking Water Act section 1433(b) requires community water systems serving more than 3,300 people to develop or update an ERP that incorporates their risk-and-resilience assessment. That legal threshold is U.S.-specific, not a universal WPI exam rule.
What a usable plan answers
Before an incident, an operator should be able to locate the controlled plan and answer:
- Activation: Which observations, alarms, reports, or loss of capability trigger notification or plan activation?
- Authority: Who leads, who can change treatment or sources, and who approves regulatory and public communication?
- Life safety: What alarms, evacuation or shelter actions, accountability methods, access controls, and medical contacts apply?
- Water protection: Which treatment barriers, source options, sampling capabilities, and critical control points must be preserved?
- Continuity: What backup power, communications, suppliers, alternate equipment, emergency-water arrangements, and mutual aid are available?
- Information: Where are current drawings, contacts, inventories, SDSs, maps, customer priorities, and reporting forms?
- Recovery: What inspection, water-quality, regulatory, operational, and authorization criteria must be met before restrictions end?
Plans become unreliable when phone numbers, staff roles, contractors, hazards, software, inventories, or system configurations change. Use version control, name an owner, test contacts and communications, exercise assigned roles, document deficiencies, and track corrective actions. A drill is valuable only if the plan changes when the drill exposes a gap. Security-sensitive plan details belong only in the approved channel.
A disciplined incident cycle
Use protect → notify → verify → operate within authority → reassess → recover. First protect people and avoid creating a second victim. Activate the correct chain early and state what is observed, what remains unknown, and which barriers or capabilities may be affected. Verify alarms with safe, independent information when available; verification never requires entering a hazard or delaying an urgent warning. Preserve water-quality barriers and service using only approved actions. Reassess as evidence changes, keep a time-stamped decision log, and hand off open issues explicitly.
| Event | First decision questions | Plan-based operator contribution |
|---|---|---|
| Process upset | Is the indication valid? Which barrier and downstream water may be affected? | Compare safe independent indicators, notify the operating authority, preserve barriers, and implement only approved control or diversion actions. |
| Equipment failure | What critical function is lost, and what secondary hazards or capacity limits follow? | Protect personnel, report actual capability, and support the approved standby, alternate train, storage, demand, or mutual-aid decision. |
| Chemical spill | Is anyone exposed? Is the substance known? Does the release exceed onsite training and capability? | Alarm and isolate from a safe position, relay facts and SDS location, and defer control to the assigned response organization. |
| Natural disaster | Are personnel accounted for? What source, power, communications, access, structure, and supply-chain functions remain? | Complete the plan's damage and capability checks without entering unsafe areas, then report priorities and resource needs. |
| Suspected contamination | What triggered concern, where and when, and could affected water have moved? | Preserve records and evidence, follow the contamination-response protocol, support authorized sampling and operational controls, and avoid unapproved public conclusions. |
Contamination scenario
A credible caller reports possible contamination near a storage facility while an online water-quality signal also changes. The operator should capture caller details and exact timing, preserve alarm and operating records, verify the instrument through the approved safe check, and notify the designated incident authority. The plan may call for access control, hydraulic or source actions, specific sampling with chain of custody, laboratory coordination, regulator and public-health consultation, alternate supply, or public communication. The operator does not announce that contamination is confirmed, flush the system, change treatment blindly, or collect risky samples outside the protocol. EPA's drinking-water response toolbox emphasizes a structured response to contamination threats and incidents rather than a guessed remedy.
Failure and disaster scenario
During severe weather, utility power fails, telemetry becomes intermittent, and the standby system reports a fault. Treat this as a changing capability problem, not three independent alarms. Account for staff, maintain safe access restrictions, establish the plan's backup communication method, and report which source, treatment, storage, pumping, laboratory, and monitoring functions are actually available. Incident command can then prioritize qualified electrical support, mutual aid, emergency supply, production limits, or public actions. Operators must not bypass protective devices, energize damaged equipment, or enter flooded electrical areas to restore service.
Recovery closes the loop
The end of visible trouble is not the end of an incident. Recovery may require inspection by qualified personnel, validated instruments, acceptable water-quality results, restored treatment and communications, replenished chemicals, regulator concurrence, public updates, and documented authorization. The exact criteria are event- and jurisdiction-specific. Record who made each decision, the evidence used, notifications, samples, operational changes, affected water, customer impacts, resource requests, and unresolved follow-up.
Afterward, conduct a structured review: What happened? What was expected? What differed? Which control worked or failed? What action, owner, and due date will correct the gap? Update the ERP, SOP, training, inventory, or mutual-aid arrangement as appropriate. For the exam, remember that effective response is not improvisation under pressure; it is verified information moving through a practiced authority structure to protect people, treatment barriers, and the public.
A critical process alarm appears during a storm, but remote telemetry has also become unreliable. What should the operator do first?
Which feature most clearly makes an emergency response plan operational rather than merely descriptive?
An alarm has cleared after a suspected contamination incident. What is the best basis for returning the affected system to normal service?