Project On-line Deliverables: D09.0

Case Study Report: Switzerland

Programme name:	ESPRIT
Domain:	HPCN
Project acronym:	HITERM
Contract number:	22723
Project title:	High-Performance Computing and Networking for Technological and Environmental Risk Management
Project Deliverable:	D09.0
Related Work Package:	WP 9
Type of Deliverable:	Technical Report
Dissemination level:	project internal
Document Author:	Nikolaus Seifert, Michael Huegi, Reto Siegenthaler, ASIT
Edited by:	Kurt Fedra, ESS
Document Version:	2.0
First Availability:	1999 02 22
Last Modification:	2000 01 25

EXECUTIVE SUMMARY

Table of Contents

1 The Swiss Case Study

1.1 The study area

1.1.1 Reuss Valley

2. Accident scenario specifications

2.1 Atmospheric dispersion

2.2 Groundwater contamination

3. Decision Support System (DSS) for dangerous goods emergency management

3.1 General situation and requirements

3.1.1 General situation of the decision making process

3.1.2 Requirements for a DSS

3.2 The HITERM-Decision Support System

3.2.1 General structure

3.2.2 Main tasks of ISC

4. Data sources

4.1 Railway operation center and CIS (Cargo Information System)

4.1.1 Railway operation center

4.1.2 CIS (Cargo Information System)

4.2 CEMT values

4.3 Meteorological Data

5 System Implementation and Validation of the Swiss Demonstrator

5.1 System implementation

5.2 Validation of the Swiss Demonstrator

5.2.1 Objectives and critera of the validation

5.2.2 Validation experiments

5.2.3 Results of the validation

The Swiss Case Study

The Swiss case study covers the application of the HITERM-system after transportation accidents on road or railway - putting the main emphasis on railway accidents - with a release of dangerous goods (DG). In contrast to emergencies in fixed installations (chemical plants, see Italian case study) transportation accidents can take place at every possible location on the traffic routes and with every transported substance. Therefore some important questions have to be answered or cleared before emergency response can start

• Where is the exact locality of the accident?
• Which are the exact identites of the released substances?
• How big is the amount of the substances being released?

HITERM must therefore be a tool to provide the emergency forces and all the other involved people with the information needed in every phase of the emergency.

1.1 The study area

1. Test site Reuss Valley
2. Test site Aare Valley

In the test site Aare Valley (2), the demonstrator was planned to be used for the application for emergencies with release of chemicals hazardous for groundwater. Due to conceptional considerations, the test site Aare Valley was dropped and the application with which the (vertical) infiltration of hazardous fluids through the soil into the groundwater body can be derived, was integrated in the Reuss Valley test site.

The originally planned integration of a complex horizontal 3-dimensional groundwater-flow model had to be dropped because of the expenditures had not been considered to be realistic within the project. So in the test site Reuss Valley (1), the demonstrator cannot only be applied for emergency management of accidents with hazards for the population (atmospheric dispersion of toxic gases in complex terrain; alpine topographie) but also for groundwater.

Figure 1: Situation of the Swiss test sites The main purposes in the test site Reuss Valley are real time support of the emergency management in case of accidents or training focussing on train accidents.

1.1.1 Reuss Valley

The Test Site Reuss Valley is situated in the center of Switzerland in the Canton Uri. The Reuss Valley has a south - north direction and with the motorway A2 and the SBB (Swiss Federal Railway) railway line. It is part of the Gotthard route, a principal European transit corridor through the Alps. The Reuss Valley can be divided into two parts with different topographic characteristics:

The northern part, from the lake of Uri to Amsteg, is characerised by a broad, flat valley bottom of 1 - 3 km width and steep mountain flanks, which are about 2000 m higher than the valley bottom. In this part of the valley, the population density is partially high (presence of the towns Fluelen, Altdorf, Erstfeld) and there are some industral objects and public buildings in the neighbourhood of the motorway and the railway.

The southern part of the Reuss Valley is characterised by its V-shaped cross section. Because of the steep mountain flanks the transportation routes are concentrated to the narrow valley bottom. There are only few small villages, the population density is small. Due to the steep alpine topography, the railway and the motorway routes need many bridges and tunnels.

Figure 2: Motorway A2 in the southern part of the Reuss Valley near Wassen

The Reuss Valley has been chosen as HITERM demonstrator test site because of the following aspects:

• The valley-situation leads to a concentration of transporation routes in a partially strongly populated region. The risk for population due to a transportation accident is quite high. In case of an emergency, the intervention forces need therefore information about the emergency with a degree of detail, which corresponds to the actual situation of the intervention. The executive authorities show a strong interest in HITERM as a system providing fast information about the emergency situation and about the hazard potential of the involved dangerous goods.

• The Gotthard route (railway and motorway) is a principal european transportation corridor for goods with a quite big portion of dangerous goods.

• The windfield is strongly influenced by the complex alpine topography. The windfield model and the Lagrangian dispersion models of HITERM can provide a much more realistic modelling of a dispersion of toxic gas in this terrain than conventional Gaussian models.

Accident scenario specifications

Due to the broad variety of dangerous goods transported, there are many possible accident scenarios with different possible consequences. Nevertheless, the scenarios can be divided into two principal groups:

• scenarios with direct effects and severe consequences for life and health of man and animals, as explosion, fire and release of toxic gas.

• scenarios with consequences for the environment, as a release of water hazardous substances.

In the Swiss demonstrator, both types of scenarios are represented in test site Reuss Valley: a release of toxic gas after a train accident (section 2.1) and an emergency planning, also assuming scenarios of releases of water hazardous substances. The main importance here is attached on the accident scenario with toxic gas. Therefore, this scenario is described below in detail.

2.1 Atmospheric dispersion

In the eyes of the executive authorities as potential end users of the system, the DSS of the HITERM system should provide fast and reliable information on the emergency. In case of a train accident, it is important to know which substances are present in the train in order to estimate the hazard potential.

The process of DSS is described in the next chapter. In order to demonstrate the functionality of the DSS, the subsequently described scenario is assumed.

2.1.1 Description of the model train for HITERM-Demonstrator

The model train composition, which is assumed for the demonstration of DSS and the dispersion of the toxic cloud, corresponds to a train of mixed freight typical for a train of the SBB Gotthard route. It contains waggons with different hazardous substances as well as waggons with inert freight as listed below.

waggon nr	freight	mass [kg]	waggon type
1	inert parcel freight	26440	box car, 4 axles
2	propane, liquified	55000	LPG-car, 95 m3, 4-axles
3	propane, liquified	55000	LPG-car, 95 m3, 4-axles
4	inert parcel freight	31360	box car, 2 axles
5	epichlorhydrine	27870	chemical tank car, 37.5 m3, 2 axles
6	inert parcel freight	23450	box car, 4 axles
7	bromine, liquid	25970	special chemical tank car, 22 m3, 2 axles
8	nitrogen, liquified	20050	tank container car, 2-axles
9	hydrogen chloride	24800	special chemical tank car, 22 m3, 2 axles
10	inert parcel freight	23450	box car, 4 axles
11	benzine	65750	petroleum car, 95 m3, 4-axles
12	benzine	65600	petroleum car, 95 m3, 4-axles
13	benzine	65600	petroleum car, 95 m3, 4-axles
14	phenol solution	33080	chemical tank car, 37.5 m3, 2 axles
15	inert parcel freight	19870	box car, 4 axles
16	sodium cyanide solution	1600	2 IBC (800 kg) in box car, 4 axles
17	inert parcel freight	19870	box car, 4 axles
18	steel	45900	flatbed car, 4 axles
19	steel	54800	flatbed car, 4 axles
20	inert parcel freight	19870	box car, 4 axles

2.1.2 Release scenario

For the test site Reuss Valley, a release of anhydrous hydrogen chloride (waggon nr.9) after a train accident on the Gotthard railway line near the village Erstfeld is assumed. The accident story can be described as follows:

The accident starts from the derailment of the waggon Nr. 6, which itself causes the derailment of the waggons numbers 7 to 10. The sequence of the waggons in the train after the crash is still intact, although the derailed waggons 8 (tank container with liquified nitrogen) and 9 (hydrogen chloride) overturn. Waggon number 8 shows no evidence of a leakage, whereas the number 9 is severly ruptured at the bottom of the car on a length of ca. 2 meters, the width of the rupture is in average 30 cm. This rupture causes a complete release of 24.8 tons of anhydrous hydrogen chloride within ca. 20 seconds. The liquified gas vaporises instanteously, causing a white acid cloud around the accident site by reaction with the air humidity. Due to the relatively small difference in specific gravity between hydrogen chloride and air (1.3 vs. 1.0), the dispersion of the gas is influenced mainly by the windfield; gravitational effects can be neglected.

2.1.3 Properties of hydrogen chloride

Hydrogen chloride (HCl) is a colorless, toxic and corrosive gas. Its aqueous solution is known as hydrochloric acid. It has a boiling point of -85 xC and a vapour pressure of 43 bar at 20 xC. In contrast to chlorine gas, HCl is a relatively light gas and therefore it does not form dense gas cloud as chlorine gas when expanding.

According to the legal transport regulations for road and railway (ADR resp. RID), hydrogen chloride must be transported in pressure resistant containers as pressure-liquified gas (UN Nr. 1050), but it is not allowed to transport deep-cooled liquified HCl.

The pricipal hazard of HCl is its toxicity (LC50 = 3124 ppm /1h; IDLH = 50 ppm; Short-term Public Emergency Guidance Levels (SPEGLs): 1 ppm/1h). HCl gas is not flammable.

2.2 Groundwater contamination

As mentioned earlier, the infiltration of water hazardous fluids can be derived in the test site Reuss Valley using a simple and fast vertical soil infiltration model which had been inplemented in the Demonstrator. As input parameters, the user has to specify

• the soil conductivity along with the information about the uncertainity of the parameter,

• the viscosity of the pollutant according to the characteristics of the substance (database), again with the information about the uncertainity and

• the infiltration depth (distance from the surface to the level of the groundwater body).

As a result of the simulation run, the penetration time of a pollutant through the unsaturated zone until it reaches the groundwater level, is determined (the average infiltration time and the worst case time: = 5% probability).

The estimation of the flow direction and the flow speed of the groundwater pollutant after its infiltration into the groundwater body which originally dad been previeved in the demonstrator can`t be made with the Demonstrator in its present state.

For the future, the system can be supplemented with a corresponding tool, especially since complex sets of geological and hydrogeological data which are necessary as input parameters are available in some important areas in Switzerland (importance of drinking water resources).

3. Decision Support System (DSS) for dangerous goods emergency management

It is obvious that the emergency management of today needs a powerful tool for the acquisition of important informations about the emergency situation and the decisions to be made.

First we describe the present practise of the emergency management process in Switzerland (chapter 3.1.1) and then the resulting requirements for a HITERM system (chapter 3.1.2). In chapter 3.2 the proposed DSS is described.

3.1 General situation and requirements

3.1.1 General situation of the decision making process

In present practise during major emergency situations, the main actors of the intervention forces are:

• the emergency forces on site (fire brigades, police, chemical intervention forces) being alarmed directly involved in the emergency response at the accident site;

• the emergency staff, which will be constituated by special alarming in case of an emergency of a certain type or of high magnitude or high consequences. It may consist of different specialists being needed for domination of the specific emergency situation.

Every canton has ist emergency staff which takes over the administrative part of the emergency management, as for example the coordination of different intervention forces, information of the population and federal authorities.

The management of an emergency dealing with dangerous goods (DG) has three phases, as shown in figure 3.

Phase 1: Identification

In this first phase after the alarming and the identification of the accident site the following important questions have to be answered by the first responder:

• Are there any dangerous goods (DG) involved?
• Can the involved DGs be identified?

The process of identification is completely based on the observations of the intervention forces arriving at the accident site using informations from shipping documents or visible placards (identify at least hazard from labelling placards, UN-number, .), release effects as smell, gas-clouds, fumes, smoke etc..

The source terms of the specific chemical release situation can also only be determined by observation on site.

Phase 2: Evaluation

After having identified the involved DGs and the specific source terms, the chemical forces commander or the emergency staff evaluate the over all situation. This means they try to determine the hazard potentials in order to minimize exposure to people, environment and the intervention forces themselves.

The results of the evaluation are based on the input which the different members (specialists) of the emergency forces or staff can deliver.

Phase 3: Management support

After the evaluation the responsible actors have to make their decisions about the measures to be taken.

It can be possible that evaluation and mangement support phases are repeated in several iterative loops. In phase 1, after the alarming, the first responders at the accident site are the local intervention forces. The phase 1 of the intervention is characterised by a "chaotic situation", i.e. the intervention forces at the accident site have to decide very fast and under improvisatory conditions. In this phase, the most important tasks are to rescue people and to acquire informations on the accident (type of accident, hazards, involvement of dangerous goods etc.).

In case the emergency staff has been constituted, it has to make decisions about mid- to long-term actions. The only informations it can rely in this early stage on are those given by the intervention forces on the site during emergency development.

The following aspects characterize the situation:

• In most cases, the intervention forces or emergency staff get the information about the hazard potential of the accident only step-by-step and as bits-and-pieces.

• The emergency staff is not able to verify the information coming from the intervention forces on site, because there is no immediate access to other information sources.

• In case of an escalation of the emergency situation, the intervention forces or the emergency staff are forced to immediate response under new conditions; step by step forwardplanning is nearly impossible.

• The informations given by the intervention forces do not always correspond to the actual management needs of the emergency staff, they may be too detailled, or may be given too early or too late.

3.1.2 Requirements for a DSS

Based on the present practise some most important requirements for DSS can be pointed out:

• The DSS has to be an information tool mainly for the emergency staff but also for the intervention forces on site. That means that DSS is necessary only for intervention in case of emergencies with a certain hazard potential.

• The application of the DSS is focused on the identication phase and on the evaluation phase of the emergency management process.

• The DSS must help the decision makers to decide but it must not intefere too much automatically with the decision process.

• The DSS should provide during the development of the emergency for every phase the best information about the possible consequences (worst-case scenarios).

3.2 The HITERM-Decision Support System

3.2.1 General structure

• Intervention forces
• Emergency management
• Information support

The figure 4 shows the structure of the DSS taking into account the tasks of the actors. As shown, there is an important process called information support, which is not directly integrated to intervention forces or the emergency management. We think that the HITERM main-server should be run within that information process element. Therefore it makes sense to establish an Information Support Center (ISC) which operates the HITERM main-server.

For the operation of a ISC an institution with technical infrastructure is needed. Possible locations of the ISC could be:

• a railway operation center (ROC) for railway accidents;
• a cantonal traffic information center (RTIC) or cantonal police intervention center (POL) for road accidents.

• Identification Support: Support on identification of transported dangerous goods in a train or a road-truck and their hazards.
• Continous support: Support in the evaluation of the emergency szenarios and unknown parameters; modelling.

Figure 4: DSS structure

3.2.2 Main tasks of ISC

A Identification support

The HITERM main-server in the ISC is connected to external information suppliers (for example road traffic information center, railway operation center, or others). In the following chapter we will only focus on the situation having a ROC as information supplier.

In principle, the DSS can also be used for road accident emergency management. For the case of a railway accident, such an information source for identification support in Switzerland can be the railway operation center (ROC) of the federal railways (or private railways) which can deliver train-related data as:

1. the actual position of every train;
2. the type of every train (passenger train, goods train, .)
3. the goods being transported in every goods train (-> Cargo Information System CIS).

The railway operation center is able to notice any accident immediately. In case of an accident, the ISC could be alerted directly from the ROC.

In a first step, the HITERM-system will check by contacting the CIS in the ROC , if there is any DG on the train. In case of there are any relevant amounts of DG loaded in the train, the system will ask the ISC-operator to alert the emergency management in order to call in the chemical intervention forces.

If the alarm comes from other external local emergency services the chemical intervention forces will be alerted (in general this will be the task of the cantonal police intervention center) and the ISC will be called as well.

If DGs in the train are evident (-> information from CIS) the HITERM-system will evaluate for each DG the catastrophic potential of the transported masses. In the Chem DB there is a catastrophic emergency mass threshold (CEMT) available (see chapter 4).

Together with the informations from the intervention forces having arrived at the accident site, the emergency management can use the HITERM-system for the indentification of the DGs involved in the accident. Using the CIS-data the identification of the waggon(s) affected by the crash can be made by a step- by - step approach describing their relative position in the train. Then the loaded DG of the involved derailed, destroyed, or damaged waggon(s) can be identified as shown in figure 5. It may be possible that several wagons with different DGs are damaged or leaking so that the load can be indentified for every involved DG-wagon.

Figure 5 shows an example of the identifaction process of DG using the observed wagon position in the train After the identification of the involved DGs, the task of continous support will start.

B Continuous support

In any case an underestimation of the emergency situation should be avoided. Therefore it is necessary that the DSS will always evaluate the possible worst-case scenarios. The modelling of the worst-case scenarios starts when the check about DG on the train is positive.

In a first step, the emergency management needs to have a quick and coarse indication of the maximal possible effect radius of any DG in the train, without looking at topography and weather situation. For this purpose, the system will give indications about the maximum worst-case radii for each DG loaded on the train (substances and amounts are given in the CIS-database), assuming the worst-case source terms.

During the development of the emergency the amount of true information about the accident will increase due to the facts which the intervention forces will find on place, or to the informations being collected from other external suppliers (toxicological data, meteorological data). In the subsequent steps, the DSS will recalculate the worst-case scenario according to the actual state of true information and with respect to topography, population density, weather situation etc. It is most important that the detail of the results of each of these iterative steps corresponds to the the actual needs of the emergency management.

The evaluation system of the DSS should always give the worst-case estimations first, which -with increasing knowledge about the emergency- leads to cases with less severe consequences. Additional information can be given during the subsequent continuous support concerning the escalation potential of the emergency by possible chemical reactivities (domino effect).

4. Data sources

4.1 Railway operation center and CIS (Cargo Information System)

4.1.1 Railway operation center

The railway operation center (ROC) has the information about the locality and the identity of the trains.

The HITERM Operator gets this information from the ROC by telephone.

Train localisation

Each railway line is segmented into units between signals, the so called ,blocks". On the Gotthard route, the lenght of a block lies between few hundred meters to about one kilometer. The train can be localised in the ROC by the number of the block, in which the train has entered. The number of the block also provides the information of the direction of the train.

Train identity

Each train in the railway network can be identified by its ID-number. By the ID-number, the type of train, its schedule and route can be determined.

4.1.2 CIS (Cargo Information System)

The information obtained by the CIS is crucial for the HITERM DSS. With the use of CIS, the complete replacement of the freight papers by electronic data processing is intended. CIS data provided the following information, which is important for the HITERM DSS:

• Number of waggons and their position in the train
• type of waggon
• freight (type and amount) loaded on each waggon
• unambiguous identification of dangerous substances

The CIS data are directly available by a modem connection of the HITERM main server to the CIS network. The CIS train list has the following structure:

CIS train list for the ,demonstrator train"

Z nr	waggon	freight	mass	UNOG	UNOS	RID	substance
1	0180 2458 5004	990200	26440				parcel freight, inert
2	3324 3456 1675	192228	55000	23	1978	2 2F	propane, liquified
3	3324 3456 1254	192228	55000	23	1978	2 2F	propan, verflüssigt
4	2908 4537 3647	746491	31360				parcel freight, inert
5	2385 7366 8567	730892	27870	63	2023	6.1 16b	epichlorhydine
6	0180 2458 3788	260902	23450				parcel freight, inert
7	2385 7368 2016	240876	25970	886	1744	8 14	bromine
8	2345 5467 2465	380002	20050	22	1977	2 3A	nitrogen, liquified
9	3385 7368 2003	250801	24800	268	1050	2 2TC	hydrogen chloride, liquified
10	0180 2458 2342	230982	23450				parcel freight, inert
11	2385 6378 3899	300472	65760	33	1203	3 3b	benzine
12	2385 6378 3465	300472	65600	33	1203	3 3b	benzine
13	2385 6378 2334	300472	65660	33	1203	3 3b	benzine
14	5363 7366 3748	270786	33080	68	2821	6.1 13b	phenol solution
15	0180 2458 3444	459867	19870				parcel freight, inert
16	0180 2458 2435	620799	1600	66	1689	6.1 41a	sodium cyanide solution
	17		0180 2458 2343		459867		19870								parcel freight, inert
18	6278 4563 3648	530777	45900				steel
19	6278 4563 456	530777	54800				steel
20	0180 2458 3455	459867	19870				parcel freight, inert

Explanation of the CIS data base structure:

4.2 CEMT values

The CEMT (Catastrophic Event Mass Threshold) value is integrated in the HITERM Chemical Database. It describes the minimal mass of a dangerous substance, which can cause catastrophic consequences in a worst-case emergency.

The CEMT is calculated by a radius of the worst case event (explosion or toxic gas release), which causes 45 casualties ( = definition of catastrophic event according to the manual III of the Swiss federal ordinance for protection against major accidents) in a dense populated aera (8'000 habitants / km2).

The CEMT value is an important information for the emergency management, as it indicates a possible catastrophic potential of the freight.

4.3 Meteorological data

The weather situation is available from the measure stations of the national weather service "SMI-Meteo Swiss". There are two stations located in the test site Reuss Valley, which automatically send the meteorological data every 10 minutes to the main center of the SMI in Zurich.

The station which provides the data for the dispersion modelling in the test site Reuss Valley is located in Altdorf (coordinates: 690 425 /190 600). The meteorological data are obtained by a cgi from the SMI main server. The data structure consists of wind speed, direction, stability class and air temperature.

5. System implementation and validation of the Swiss Demonstrator

5.1 System implementation

The Swiss Demonstrator runs at ASIT on one UNIX Server (SUN Sparc/Solaris; no clients). The Swiss Demonstrator was never expected to run on a parallel high performance computing system (like the Italian Demonstrator). Therefore, e.g. the atmospheric disperion model isn`t able to run very fast. But these restrictions don`t have a big influence on the functioning of the program for the user.

The installation of the Swiss Demonstrator at the ASIT-Office in Berne was made by ESS mainly. That`s why no reliable statement can be made from the part of ASIT to the ease of instalation as an example.

5.2 Validation of the Swiss Demonstrator

5.2.1 Objectives and critera of the validation

For the Swiss Demonstrator, as well as for the other two Demonstrators, a number of objectives for the validation had to be considered. With a set of objectives, a comparison of the three Demonstrators can be done easier. The validation objectives can be divided into subjects as follows:

• Technical feasibility
• Performance
• Accuracy
• Relevance

5.2.2 Validation experiments

For the validation of the performance and the accuracy of the system, the Swiss Demonstrater had been tested in detail and the results of the modelling calculations had been exactly investigated also with the help of experts in the various topics.

The relevance had been validated in launching a questionnaire, with all the important potential users of such a tool or system in industry and administration in Switzerland had been involved.

After analysing all the incoming answers of the potential users, presentations of the Swiss Demonstrator had been carried out (cantonal authorities) or are still planned (Federal Office of Transport, National Railway Company (SBB), chemical intervention forces of Zurich, etc.) for all those, who showed a deep interest in the new system.

5.2.3 Results of the Validation

Technical feasibility:

As mentioned above, we can`t say much about the installation and possible problems. But after the installation, the Swiss Demonstrator proved to be reliable concerning the installation. The installation of new timely limited licenses could be done without any problems.

Performance and Accuracy:

The test of the Swiss HITERM Demonstrator at the ASIT office showed very satisfactory results concerning the modelling of various chemical accident scenarios. All the tested scenarios and the used applications could bring out results which are very realistic in the eyes of the experts (windfield in the alpine topography, extents of various chemical accidents, etc).

So the Swiss Demonstrator can be considered to be a useful tool for simulation of accident scenarios and also as an information system for decision support for authorities.

Looking at the different (sub-)tools within the Swiss-Demonstrator, the remark has to be made that not everything seems to be very stable in the present version of the Swiss Demonstrator. Repeated error messages and unexpected program break downs happen more often than desirable.

Relevance:

The analyses of the questionnaire and the first Swiss-Demonstrator presentations led in a quite positive judgement so far. To be more specific, the results can be summarized the following way:

Most of the interested and involved potential users consider the System as very useful and important for the simulation of various chemical accident/incident scenarios for risk determinations, but also as an excellent information system for emergency forces for a fast and reliable decision support. Very often mentioned was also that the system would be a good training tool for emergency forces and very useful for the modeling of the extents of accidents with dangerous chemical goods, too. About half of all who answered our questions find it also a good tool for the evaluation of the requirements concerning safety arrangements and a practicable instrument for planning and strategical analyses.

A bit surprising was the fact that nobody valued the tool as useful as an alert-system for Emergency forces. Most of the potential users who gave us a feedback can imagine to use such a system at their office or company.

After our analyses, a big problem seems to be the expected costs for the purchase of such a system. Most of the interested authorities are on one hand according to their own informations actually not equipped with sufficient and suitable hardware to run such a system, so that they would have to buy the according hardware first. On the other hand, most of the authorities haven`t as big budgets to allow them to buy a system in the financial dimensions of Riskware. Only few potential users made a concrete statement what they are willing to pay for such a system. But their ideas about these costs (system, license and yearly maintenance) are in the region of some thousands of Swiss Francs, which we consider much too low.

As a first conclusion, the fact can be captured that Riskware as the product of HITERM was considered to be a very good and useful tool by potential users in industry and public administration, so that many responsibles could well imagine to use it, but only if the costs are quite low. So one of the main problems for the attractivity of the product seems to be the purchase price, or more correctly, the expected total cost of ownership of the system.