Improving the resilience of metro vehicle and passengers for an effective emergency response to terrorist attacks

Safety Science 62 (2014) 37–45

Contents lists available at ScienceDirect

Safety Science journal homepage: www.elsevier.com/locate/ssci

Improving the resilience of metro vehicle and passengers for an effective emergency response to terrorist attacks Jean-Luc Bruyelle a,⇑, Conor O’Neill b, El-Miloudi El-Koursi a, Fabrice Hamelin c, Nicolò Sartori d, Louahdi Khoudour e,1 a

IFSTTAR-ESTAS, 20, rue Elisée Reclus, BP 70317, 59666 Villeneuve d’Ascq Cedex, France NewRail – Newcastle Centre for Railway Research, Faculty of Science, Agriculture and Engineering, Newcastle University, Newcastle Upon Tyne NE1 7RU, United Kingdom IFSTTAR-DEST, 14-20, boulevard Newton, Cité Descartes, Champs sur Marne, 77447 Marne la Vallée Cedex 2, France d IAI Istituto Affari Internazionali, Via Angelo Brunetti, 9, 00186 Roma, Italy e IFSTTAR-LEOST, 20, rue Elisée Reclus, BP 70317, 59666 Villeneuve d’Ascq Cedex, France b c

a r t i c l e

i n f o

Article history: Received 27 April 2012 Received in revised form 7 March 2013 Accepted 19 July 2013 Available online 28 August 2013 Keywords: Terrorism Bomb attack mitigation Metro safety Resilience SecureMetro project

a b s t r a c t In the framework of the European FP7 project SecureMetro, the authors have studied the occurrences of terrorist attacks against rail-based vehicles, in particular Underground trains, with the goal to reduce the number of attacks by making transport systems a less attractive target. Many counter-measures have already been implemented in a multi-layered manner to increase the resilience to terrorism, such as depot security, detection of explosives or passenger screening. The SecureMetro project adds another layer aimed at mitigating the effects of an attack to the vehicles, should the other layers fail to avoid it. The case of interest, a metro train blocked in a tunnel due to a bombing, has been chosen as representative of the attacks perpetrated in the recent years, and of the most difficult case to cope with. Based on the experience of the 7/7 London bombings and other emergency situations, as well as the currently admitted behaviour models, this paper identifies critical systems and proposes improvements to the design of metro coaches, in order to improve the management of the emergency situation, assist the evacuation and rescue to passengers. Ó 2013 Elsevier Ltd. All rights reserved.

1. Introduction Considerable effort is being devoted by the researchers and stakeholders in order to improve the safety of metro transport systems with respect to such incidents as terrorist attacks. The issue has been addressed by many researchers, taking into account the bow-tie model of safety management, in which the node is the terrorist attack, with on one side the causes of the attack (e.g. political issues, and technical weaknesses), and on the other side the consequences (human, organisational, and economical). The general goal is to devise and implement a line of defence to isolate these causes and consequences, in order to prevent the attack from occurring and, should it happen, to mitigate its consequences as much as possible (Khoudour et al., 2011). Several research projects have addressed specific elements, or full sets of integrated solutions implementing technological and ⇑ Corresponding author. Tel.: +33 3 20 43 83 24. E-mail addresses: [email protected] (J.-L. Bruyelle), conor.oneill@newcastle. ac.uk (C. O’Neill), [email protected] (E.-M. El-Koursi), fabrice.hamelin@ ifsttar.fr (F. Hamelin), [email protected] (N. Sartori), louahdi.khoudour@developpement-durable. gouv.fr (L. Khoudour). 1 Present address: CETE du sud-ouest, 12, rue Edouard Belin, 31400 Toulouse, France. 0925-7535/$ - see front matter Ó 2013 Elsevier Ltd. All rights reserved. http://dx.doi.org/10.1016/j.ssci.2013.07.022

organisational measures to increase the effectiveness of this line of defence. Among others, current projects are SECUR-ED (http:// www.secur-ed.eu) which aims at providing a full, interoperable set of tools, and demonstrating them in four major European cities, Protectrail project (http://protectrail.eu) which aims at designing a scalable solution integrating a modular set of sub-mission protection tools (e.g. passenger clearance control, electrical or communication systems) for railway security, and MODsafe project (http:// www.modsafe.eu) which focuses on the establishment of a common European strategy, integrating a common approach to safety and security measures. In this scheme, our goal is to improve the preparedness by mitigating the consequences of an attack to metro vehicles, which we show to be a particularly sensitive target in terms of both attractiveness and consequences. In the framework of the European FP7 project SecureMetro (http://www.securemetro.com/), researchers from different fields and countries are studying various improvements to metro vehicles in order to improve the resilience and survivability of the vehicle, its passengers, and the transport system as a whole, in order to minimise the material and human damage caused by a bomb or a fire, to improve the capacity to resume normal operation, and thus to make public transport systems a less attractive target for terrorist attacks. A notable part of the efforts is

38

J.-L. Bruyelle et al. / Safety Science 62 (2014) 37–45

devoted to improving the immediate response after the blast, in order to ensure the capacity of the survivors to alleviate fear, avoid panic, facilitate rescue, and more generally to improve the crisis management. In this general framework, the work described here aims to take into account the existing knowledge gathered during bomb attacks and more generally emergency situations involving aspects similar to a bomb attack in a closed place, such as building or train fires, and stampedes, to identify the critical features of the design of a metro vehicle that are susceptible to play a role in the way the survivors tackle with the situation and are able to cope with it in the best possible way, in order to ensure their survivability, ease the rescue and evacuation. Longer-term effects, such as post-traumatic stress disorder, are out of the scope of this study. 2. Nature and evolution of terrorist acts Over the last decades, the number and the nature of terrorist attacks in rail-based transports appear to have evolved in considerable proportions. An exhaustive survey, based on two databases covering the 1960–2010 period (Database of Worldwide Terrorism Incidents; Global Terrorism Database), has found that in 50 years 833 attacks killed about 3500 persons and injured more than 15,000. Moreover, the number of both attacks and victims have known a sharp increase since around 1980 (Fig. 1). The mode of perpetration is of particular importance to devise ways to mitigate the effects of the attack, so the survey concentrated on classifying the tactics used. Out of the 833 attacks in the data bases, bombing is used in 57% of the cases, followed by sabotage (20%), armed attacks (7%), arson (5%), and threat (5%). The other types of attacks are marginal (Fig. 2). These proportions do not seem to have evolved significantly over the last decade. Bombing thus appears to be by far the prominent method of attack. This result is further reinforced in the number of victims, with 70% of the fatalities (2541 out of 3457) and 77% of the injuries (7832 out of 10,682) during the considered period, making bombing the deadliest type of attack. Again, the trend remains stable in the recent period, which leads to expect a continuing increase of the number of attacks, with a vast majority of acts and victims caused by bombings. We therefore chose to concentrate our efforts on this type of attack. 3. Data sources for case analysis It is worth noting here that, although we strove to base our work on case studies, a lot of first-hand data is unavailable due

Fig. 2. Weapons used to carry out attacks.

to the policy of some countries to classify information related to terrorism. It is in particular the case of France, where the data regarding attacks led against RER (regional express rail network) in 1995 would be of interest but cannot be used due to the obvious difficulties of obtaining classified information and disseminating conclusions without being able to mention how they are justified. However our discussions with people involved in the French attacks led us to conclude that there is no significant difference between the mechanisms observed in France and in other countries, so we chose to base our work on the available data in countries where the secrecy policy is less stringent, and consider that our conclusions are valid in France too since RATP, the Paris Underground operator participating in the SecureMetro project, read our conclusions and did not raise objections. A particularly rich source of information is the bombings attack that took place in London on July 7th, 2005, in three different Underground trains and in a bus, both for their representativeness with regard to bombing in underground trains as being the most deadly type of attack in the foreseeable future, and for the amount of information that was gathered and made available. Substantial direct accounts of survivors are available, in particular in the minutes of the public investigation carried out by Greater London Authority (2006a,b,c). These direct accounts are of exceptional interest to our work, allowing to better understanding the context

10000 9000 8000 7000 6000

Attacks

5000 4000

Fatalities

3000

Injuries

2000 1000 0

1960s

1970s

1980s

1990s

2000s

Year Fig. 1. Historical evolution of attacks, fatalities and injuries.

J.-L. Bruyelle et al. / Safety Science 62 (2014) 37–45

of a blasted train, the condition and capabilities of the survivors isolated in a tunnel for up to a half-hour or so, their needs and strategies to cope with the situation. As a side note, it is noteworthy that there were survivors even in the carriages directly hit by the bombs, some of them mentioning having been able to assess the situation, help others and organising as a group, which bears consequences on the crisis management scheme. This contrasts widely with the Madrid 3/11/2004 bombings, which led to an investigation by the Cortes, but not devoted to the rescues or the fate of the passengers. Other valuable data sources in our work include investigation reports on various events when people were blocked or had to evacuate from an immediate danger (Fahy and Proulx, 2002; Best, 1978), and scientific or technical studies using simulations of such situations (Drury and Cocking, 2007; Oswald et al., 2005; Proulx and Sime, 1991). These sources provided useful insight on how this behaviour can be taken advantage of, or influenced, for a better crisis management. Since many of these cases are in different fields from bombings in underground trains, such as building fires, stampedes, hurricanes, we took care to check the consistency of these cases, and the conclusions, with the observations gathered during the London attacks, so they can be applied to any incident similar in its consequences to a terrorist bombing. For clarity, and to keep the length of this paper within reasonable limits, this paper will mainly focus on the case of the 7/7/ 2005 London bombings, although the conclusions used in our work are not based only on the 7/7 bombings but also many other events as said above, for which sources will be provided as they appear in the text. As mentioned above, no difference has been found by the researchers between all those kinds of events as regards the behaviour of the evacuating crowd, which justifies this choice.

4. Case study: 7/7/2005 London bombing Prior to studying the behaviour of the survivors and rescuers during the events of that day, it seems interesting to describe the events themselves, from a purely factual point of view, in order to understand the situation they faced. This part is devoted to the events in the three trains on which bombs exploded. A fourth bomb exploded on a bus, but we will not consider it here since this event did not involve the Tube.  The first bomb exploded at 8:50 AM on eastbound Circle Line train 204, going from Liverpool Street to Aldgate station. It killed 8 people including the suicide bomber, and injured 171.  The second bomb exploded less than a minute later on Circle line train 216, travelling westbound from Edgware road to Paddington, as the train was less than 50 m into the tunnel. It killed seven people including the bomber, and injured 163. Another train going in the opposite direction had to stop and remained blocked next to the bombed train; its crew and passengers played a role as secondary victims – uninjured but blocked in the tunnel – eyewitnesses and helpers, and gave accounts available in the Greater London Authority review.  The third bomb was detonated about 2 min later, on a southbound Piccadilly Line train number 311, travelling southbound from King’s Cross-St. Pancras to Russell Square. The train was crowded, with 127 people in the first carriage, where the bomb was located. The explosion killed 27 people including the bomber, and injured over 340. This section gives a closer examination of what happened during the bombing, based on the accounts given by survivors,

39

rescuers and other persons directly involved in the events, in order to draw lessons useful to the project. We will organise the section thematically, restraining the contents to the aspects directly useful to the purpose of our work dealing with what happened in the carriages, and jump directly to the conclusions rather than detail the line of reasoning, which would exceed the allowed space for an article. Excerpts from the accounts and examples for other sources are provided when useful to clarify or exemplify a point. Unless otherwise specified, the accounts are from the hearings of the Greater London Authority 7 July Review Committee. 4.1. The lack of communication In the first minutes after the blast, the passengers were plunged into total darkness, both because the emergency lights were not working, preventing them to evaluate the conditions in the train and their own condition, and because communication with the outside world was not possible: London Underground’s own radio, using leaky feeders, was damaged by the blast, and the mobile phones did not work in the Underground. Communication between the drivers and the passengers were impaired by the damages caused by the explosion to the train. This caused confusion and fear among the passengers: ‘We assumed the train driver was dead as he didn’t make contact with us. We waited for help, we [were] expecting someone to bang on the window and tell us it would be ok and that there wasn’t a fire. That was the main concern [. . .]. If people had known there was no fire (through someone making contact with us) the situation could have been a lot calmer. I think the most important thing that needs to be recognised is us not having contact with anyone. [. . .] That was the scariest part of it [. . .] – not knowing whether anyone was aware of what had happened to us and not knowing if help was on its way.’ (Greater London Authority, 2006c, p. 230) The lack of communication was not only a problem for the passengers. It also caused confusion in London Underground’s response to the emergency, as the staff in the Control Centre was not properly informed of what had happened, or where, in the first stages of the event: ‘Sitting at Broadway [London Underground Network Control Centre] at 8.52 am you are virtually blind and you are confused for a while as these multiple reports come in. It would be over-egging our own capabilities to pretend that we have instantaneous appreciation of what is happening. We do not, and the reports that come in conflict with one another.’ (Greater London Authority, 2006b, p. 9) Since no underground radio communication systems were available, with the exception of BTP (British Transport Police), all the other emergency services had to use runners going back and forth between trains, platforms and the surface to communicate, which hampered the operations (Greater London Authority, 2006a, p. 16). At Russell Square, the leaky feeder used by BTP was damaged by debris so even they had to do the 15-min journey to the surface. A temporary leaky feeder could be installed only 11 h after the blast, showing the lack of resilience of this technology in these conditions. 4.2. The need for directions and information The lack of communication highlights another issue, which is the need, when people are in an emergency, to have with them someone who knows what to do. In the case of the bombed trains, the drivers were the obvious knowledgeable figure:

40

J.-L. Bruyelle et al. / Safety Science 62 (2014) 37–45

‘Then, somebody said, in a very commanding voice, ‘‘Right, the driver has said. . .’’ When he mentioned this word ‘‘driver’’ my spirits were lifted, because up to that point I thought I was a goner anyway. I thought we had hit another train. If we hit another train, he is dead; he is finished. We no longer have guards, so we have no guard, no driver, you’re stuck down in the tunnel, you have this black smoke pouring in, what do you do? When this guy said ‘‘The driver said’’, I thought, ‘‘The driver is alive’’.’ (Greater London Authority, 2006c, p. 128) Incidentally, a study carried out in the Newcastle Metro found that more information on the situation allows a more effective evacuation, contrary to the usual design of evacuation procedures that calls for not risking to trigger a panic by giving as little information as possible, or even withholding it completely through the use of coded words such as ‘Mr. Sands’ for a fire, or ‘Mr. Pebbles’ for a bomb. People are more likely to make the right decision if they are informed clearly and without delay (Proulx and Sime, 1991). 4.3. The need for suitable equipment A first equipment failure is already reported above: due to the damage caused by the bombs, the lights went out immediately, and the emergency lighting did not work. As a result, some passengers tried to use whatever they had in their pockets, such as mobile phones, to get some light. Another already mentioned failure is the communication equipment that was inoperative after the blast, both between the driver and the control centre, and between the driver and the passengers. Under this respect, it is to be noted that, in the case of automatic vehicles in which there is no driver, only a public address system and an intercom for bidirectional emergency communications, the role of both systems can become crucial in similar circumstances. Other failures were mentioned by the survivors. Obviously, the lack of light, added to the smoke that filled the air after the explosions, prevented them from seeing emergency instruction panels (which, incidentally, did not exist). The signage visibility issue was also raised in a train evacuation test (Oswald et al., 2005), in which the passengers were not able to see the signage due to the smoke, yielding an evacuation time of as much as 16 min. In this case too, the conclusion was that the signalling and instructions had to be improved. Inspiration might possibly be found in the signage of airplane cabins, in which illuminated lines and arrows indicate the direction of the nearest exit. In airplanes, signage is located on the floor, so the passengers can still see it in case of smoke forcing them to crawl, which would have helped in the case of the 7/7 bombings. Another problem that was pointed out is the absence of first aid equipment in the Tube trains. Many passengers were very badly injured, and people with medical training were present and would have been able to help. Instead, they had to improvise bandages or tourniquets with pieces of clothes. Another issue to which the passengers were confronted was the inability to open the doors: (Greater London Authority, 2006a, p. 66) mentions that the impossibility for the passengers to use the doors is a deliberate choice, aimed at preventing accidents caused by exiting trains while the track is live or by another train passing while people evacuate by the side doors. Evacuation is to be carried out through the end doors. In the absence of instructions, the passengers did not know this fact, and did not know what to do.

emergency is conceived when designing equipment or emergency plans, as seen above. In fact, it is not at all how the survivors reacted: ‘Despite everything that happened, everyone, including the injured, was still remarkably calm. It is a great credit to everyone that no one caused further problems by panicking’ (Greater London Authority, 2006c, p. 10) People did not panic even though the feeling of danger (of fire, of chemicals, of being hit by another train, of not being rescued) was very strong. On the contrary, they adopted a perfectly social behaviour, the exact opposite of the common conception of a madding crowd where everyone runs for himself. Several accounts mention cases of individual panic behaviour, such as screaming or crying. But the same accounts state that this panic never spread to become a mass panic, and other survivors provided reassurance: ‘A girl, Jennifer, contacted me afterwards to say thank you. I asked, ‘What for?’ and she said, ‘We had no idea what we were going to see.’ She said, ‘I started to have a panic attack at that point, and you turned round and said, ‘‘Hold my hand. Follow me.’ (Greater London Authority, 2006c, p. 21). One can note that the word ‘panic’ is often used in the accounts, but usually as a cliché to talk about fear (when used for oneself) or as a wrong interpretation of a perfectly sound reaction that does not actually match any admitted definition of panic. This is a general observation in such situations: for instance a quantitative study of the World Trade Center evacuation on 9/11/2001 concludes that ‘classic panic action or people behaving in an irrational manner was noted in 1/124 (0.8%) cases’ (Drury and Winter, 2004). The direct accounts often describe people acting in their usual social role: a driver, a fireman, or simply a first-aider. As a general rule it has been found that the social roles and skills endure in the emergency, in line with the current theories of mass emergencies that outline the role of social identity (Drury and Cocking, 2007; Drury and Winter, 2004). It thus appears important to recognise this enduring role, and take advantage of it when useful. Interestingly, some survivors accounts, as well as the tabloid press, talked about ‘‘British spirit’’, ‘‘spirit of the Blitz’’, ‘‘very English’’ as an explanation of the relative composure shown by the survivors of the 7/7 bombings. This is contradicted by the identical findings of 9/11 in New York, and other events outside UK. We have not found differences between countries under this respect in the existing studies. 4.5. Help as opposed to selfishness As seen above, not only did people not panic, they even reported a perfectly social behaviour of reassuring and helping each other, and trying to find out what had happened. This behaviour is further shown by accounts reproduced in (Cocking, 2008):  ‘Many people kept calm and tried to help one another to see if anyone was injured’  ‘I was very aware of people helping each other out and I was being helped myself’.  ‘Passengers with medical experience were found, I found a tool box and we smashed a window, allowing the medical guys to enter the other train’.

4.4. The absence of panic and the continuity of social identity The usual thinking in such circumstances is that people are bound to panic, i.e. to lose control of themselves and rush to the closest exits regardless of others. It is, in fact on this principle that

Expressions of concern and help to and from others abound in the accounts given by the survivors. Helping behaviour is not related to a feeling that the danger is out. Actually, helpers sometimes helped others at the risk of their own safety:

J.-L. Bruyelle et al. / Safety Science 62 (2014) 37–45

‘It was members of the LU station staff from that station who went running into the tunnel to try to pull people out once they saw what was happening. At this stage, they had no idea whether they were running into, as I said, a secondary set of devices, a bio attack or anything’ (Greater London Authority, 2006c, p. 60). In other cases, people were reported to die because they stayed behind to help others (Drury, 2008). Reports of selfish behaviour are rare, and often describe the own behaviour of the person describing the events. However, it usually appears to be caused by physical inability to help rather than real selfishness, and can be accounted for by a feeling of guilt associated to the psychological aftermath. The help and reassurance to each other was associated, in this and other emergencies, to a sense of togetherness not existing in the mundane commuting situation: ‘One of the things which struck me about this experience is that 1 min you are standing around strangers and the next minute they become the closest and most important people in your life. That feeling was quite extraordinary’ (Cocking, 2008) All the accounts point to the – already known – fact that panic and selfishness are not commonplace in emergencies, and that the planning should take into account the capability of the crowd to help itself, and take advantage of it, rather than rely on the assumption that people will not be able to help themselves. In particular, the conclusions of the Greater London Authority review committee (Greater London Authority, 2006a) pointed out several issues in the design of the Tube trains that may – at least in part – be caused by the assumption that in case of emergency the passengers would not be able to help themselves anyway, such as the inability to communicate or the absence of safety notices – although the 7/7 events proved this assumption to be false. 4.6. Training, and the consequences of its absence A clear example of the effectiveness of training is provided by the comparison of the two attacks against the World Trade Center in 1993 and 2001. After the 1993 bombing, in which the evacuation was slow with delays of as long as 3 h, a fire drill was established. As a result, 99% of the people located below the plane crashes in 2001 survived in spite of a total time of only 1 h 42 before tower 1 collapsed, and less than an hour for tower 2 (Fahy and Proulx, 2002). Knowing what to do, and less delay in starting evacuation, are considered key factors in this improvement. Further measures, such as the improvements to the egress system, lighting and voice communications, also contributed in achieving this result.

41

3. The self-categorisation approach, a new model of resilience which provides an explanation for observed solidarity and altruistic behaviour (Turner et al., 1987). In the ‘‘panic model’’, reactions to emergencies are understood as involving individualised panic in the crowd. According to this approach, threat causes such emotions that collective identity is broken, generating egoistic behaviours and trampling. Moreover, these behaviours are contagious and spread to the crowd as a whole. Although this model consistently fails to explain the observed social behaviour in such events as the 7/7 bombings and is no longer considered by researchers in the field, it is important to mention it here because it is still taken as granted in the general public (Clarke, 2002), in professional training (Schweingruber and Wohlstein, 2005) and in situation management policies – in which the survivors are considered unable to take care of themselves, to make any rational decision and even to assess their own situation, leaving all these tasks to the authorities. It is therefore on these grounds that equipment is quite often designed. Moreover, widespread panic is consistently taken for granted in the media after catastrophes, regardless of the actual facts (Tierney et al., 2006), further entertaining the preconception that panic is bound to occur – an idea that favours its actual occurrence as we will see in Section 5.1. In the social attachment model (Bowlby, 1969, 1973), people have an affiliative behaviour seeking out attachment figures, and social norms rarely break down. Although resulting from evidence of disasters (Cornwell, 2001), this model implies that panic is more likely in a crowd of strangers, and neglects the possibility that strangers can cooperate together. On the contrary, one can very often note spontaneous behaviours of solidarity and collective resilience among complete strangers in emergency situations, as shown in the case study of the London bombings above. The self-categorisation model goes a step further, and states that people can act as one and provide mutual aid without knowing one another personally, or even communicating (Williams and Drury, 2009). Disasters can create a common identity or sense of ‘‘we-ness’’ (Clarke, 2002), and result in orderly and altruistic behaviour as people escape common threat. Moreover, a sense of threat can enhance the common identity. This observation is very important in the domain of emergency management: if people do not panic in emergency situation, but act in accordance with their knowledge, then they can be able to help themselves and play an active part in their own rescuing, providing they are given the proper information to take the best decision. Current studies point out the usefulness of a new approach to mass emergency behaviour, based on the self-categorisation theory (Turner et al., 1987), in which one trusts the others to be supportive rather than competitive, which in turn reduces anxiety and stress (Drury et al., 2009).

5. Main conclusions and considerations from the case studies and current theories on human behaviour in crisis This section addresses the general theory describing the behaviour description that stems from the case study in Section 4, and will be used to define the criteria according to which the critical functions after a blast will be defined. Crowd behaviour has been the object of many studies in multiple fields, and has developed over time. As a very rough summary, three types of models have emerged to account for the behaviour of survivors: 1. In the 19th century, the irrationalist approach or ‘‘panic model’’ (Le Bon, 1895). 2. In the 1960s and 1970s, a more rationalist approach, from the social attachment model (Mawson, 2005), which is an improvement of the ‘‘panic model’’.

5.1. Behaviour model Recognising that the self-categorisation model provides a good description of the observations done in such events as the 7/7 bombings, this section discusses the rationale that led us in defining the measures to promote the resilience of the vehicle and passengers during and after the event, in order to carry out the best possible evacuation and rescue operations. The aim is to ensure that the conditions for a panic are not met, and to enable the survivors and authorities to co-operate for the best management of the situation. The design of such strategies involves both crisis management policies and equipment able to enable the implementation of such policies:

42

J.-L. Bruyelle et al. / Safety Science 62 (2014) 37–45

 To provide survivable equipment that is able to support vital requirements after a blast.  To help the surviving passengers to make the best choices, in order to ensure their survival and to ensure the most effective resolution of the crisis.

5.2. Panic is rare, and does not spread This point was emphasised above. 5.3. Co-operation and help far outweigh selfishness

The current school of thought, reinforced by experimental evidence gathered during terrorist attacks as well as natural catastrophes, emphasises the natural resilience of victims, who have been consistently found to keep a social behaviour, help themselves and others, sometimes to the point of selfsacrifice (Best, 1978), be able to assess the situation and follow instructions. Although cases of individual panic do happen, they usually remains confined to withdrawal attitudes (freezing up, sobbing, confusion) or denial of the danger, and do not spread. Actually they are most often mitigated by nearby persons (Greater London Authority, 2006c, notably pp. 9, 21, 24). The currently admitted model (Drury and Cocking, 2007) states a number of necessary conditions that are simultaneously present in all the reported cases of collective panic:

People in charge (drivers, police officers, and firemen) or knowledgeable of the place (long-time users) or with skills useful to the survival of the group (e.g. first-aiders) are more inclined to help than others. This further emphasises the role of training such as fire drills or first-aider training in the management of such events. The urge to help has been reported to exist both in the survivors themselves and among bystanders (Drury et al., 2009, p. 84).

 Possible entrapment. The key word here is possible, as the fear of being trapped, even without the actual impossibility to escape, can be sufficient. In fact, collective panic is not reported, even in desperate situations, in closed places from where any kind of escape is impossible, such as submarines or collapsed coal mines (Quarantelli, 2002).  Fear of immediate consequences. It has been further found that it is only when actual or presumed blockage of escape is related to immediate consequences that the feeling of entrapment can play a part in the triggering of a panic.  Helplessness. The other specific condition is the feeling of helplessness, which is a mixture of powerlessness and ‘‘aloneness’’ or isolation. Helplessness, or impotency, can be described as the feeling of being unable to prevent the consequences of the danger from occurring.  Isolation. The sense of sole dependency on one’s own action, without the possibility to receive any help, is reported to be present to some degree in all cases of panic. The individual feeling of powerlessness can be either reinforced or alleviated by the social interactions in the course of the events: if another individual is identified as able to find a solution, then the feeling of being in danger is relieved and the possibility of a panic is considerably reduced. If nobody knows what to do, then panic becomes more probable.  Preconceptions. The existence of a prejudice that the current situation is prone to create a panic is itself a contributory panic condition. This prejudice can originate in the socially admitted common belief. However, the actual occurrence of panic is not automatic and depends mostly on the interactions during the course of the events.

The role of ‘natural leaders’ can be important, to provide informed guidance as well as reassurance that things are taken care of. In emergency situations, people tend to look for someone who knows what to do. Such people can be trained professionals, but ad hoc leaders can emerge from the crowd. All those who might have to play this role need to be trained to know what to do, if only lead the survivors to safe exits, and to provide the information in a credible way so the survivors believe them and trust them. A specific case is an automatic vehicle, in which there is no driver. In this case the communications with the outside world may be the only way to reach someone able to play this role.

The goal of the present work is therefore to ensure that these conditions for a panic are not met, and to enable the survivors and authorities to co-operate for the best management of the situation. The design of such strategies involves both crisis management policies and equipment able to enable the implementation of such policies. More generally, the case study summarised in Section 4 and the behaviour model outlined in Section 5 led us to the following conclusions regarding the human factors involved in the crisis management strategy. Supplemental considerations regarding the specific case of a blasted metro coach are provided too here.

5.4. The role of social identity Help is more common among pre-existing groups (family, colleagues, and friends), but it is commonly reported among complete strangers. 5.5. The role of ‘natural leaders’

5.6. The role of information In the absence of clear instructions regarding the best way to reach the exit, most people use the path they know, i.e. usually go back to where they come from, even when it has become impracticable. Clear guidance, as far as possible adaptive to the present situation, are of crucial importance, both to avoid creating more harm (e.g. by leading people to go to a closed door), and to allow a smoother evacuation. Emergency instructions and signs, usable even in case of fire, smoke and/or darkness, are a requirement. When technical equipment is in the way, such as doors, it must be easy to operate, even without previous knowledge (Oswald et al., 2005). Training is of particular importance to deal effectively with emergencies, so people know what to do in case of emergency (Drury and Cocking, 2007). The problems associated to communication with the occupants in crisis situations requiring evacuation, such as a fire, have been studied for a long time. The general goal is to ensure fast and safe evacuation in response to a situation demanding immediate egressing from a building or another closed place (Proulx and Sime, 1991). It has been shown that it is best to provide messages that contain three pieces of information:  What is happening – so people know there is a threat, and which one.  Where it is happening – so they know where to go, or how endangered they are.  What to do – so they know what is expected from them, e.g. evacuate, stay where they are and wait for rescue.

J.-L. Bruyelle et al. / Safety Science 62 (2014) 37–45

In the case of surviving passengers in a metro coach after a bomb attack or in a fire, this scheme takes a specific shape: they know what the situation is and where it happens, so it is not necessary to make them aware of it. On the other hand, they do not know how to handle the situation, so the third point becomes particularly important. Live communication with the staff, either on board or (in the case of driverless systems) in the control room allows the best communication. The origin of the message is important in the process of decision making: a live announcement by a person in charge, containing credible information, emphasises the fact that the situation is serious, and that it is being handled by proficient people, creating a feeling of both stress and confidence that is best for a cool, informed decision making. On the other hand, an automatic or prerecorded announcement implicitly says that there is no one making the decisions. All this is in line with the basic principle that people make their own decisions, and that the authorities can only help them in making a correct decision. Under this respect, instructions cannot be seen as orders that will be automatically obeyed, but need to be trusted as accurate to the perceived situation in order to be followed. It is the authority’s responsibility to ensure that the public’s perception matches the reality. On the other hand, only persons knowing the big picture can make informed choices, and those persons are necessarily located in the control room – providing they receive the appropriate information from the people on location.

5.7. The role of communications Communication is important in both directions: to inform the authorities of the situation and speed the organisation of the rescue, but also to provide the passengers and on-board staff with reassurance and the information they need to react to the situation, acknowledging the fact that they are able to help themselves – and quite often are the only available resource during the first minutes after the attack. In this regard, of particular importance is the availability of communication equipment able to survive and to be operated by passengers, even after an explosion or in a fire, even if ground equipment has been destroyed. This equipment must be underground-enabled in the case of an Underground transport system. The possibility that too many talkers on the same frequency may cause jamming should also be taken into consideration. In some cases, a mere megaphone can make a difference. An example of suitable communication system might be TETRA (Wikipedia, 2013), which now equips both the London Underground staff and British London Police (London Regional Resilience Forum, 2006, 4.11 & 4.12). TETRA offers both improved mobile underground capabilities and advanced addressing capabilities, even though survival to a blast can never be 100% guaranteed. However we are not aware of a current implementation of TETRA or similar systems for driver or passengers to ground communications. Following the 7/7 bombings, (London Regional Resilience Forum, 2006, 4.13) recognises the issue of passengers to driver communication in the case of the 7/7 bombings, and states that such capabilities would be added to new trains, although survivability to a blast does not seem to be considered.

6. Critical functions after an attack Taking into account the behaviour model above, the cases studies have allowed us to identify a set of key systems requiring survivability in order:

43

 For the team in charge of the crisis management, to gather information on the status and location of the damaged train or trains and their occupants, in order to manage efficiently the rescue operations.  For the surviving passengers, to assess their condition, help themselves and each other, and allow rescue access and evacuation. Note that the mere fact to be able of taking care of oneself relieves the feeling of helplessness, one of the conditions identified above as contributing to panic. The functionalities considered to require survivability are those that ensure the following functions:  Alleviate the risk of panic, and more generally the sense of fear or despair among the survivors.  Allow the survivors to assess their situation and provide the authority in charge of the crisis management with information.  Allow the authority to provide information and instructions to the survivors.  Allow the survivors to help themselves while waiting for rescue.  Allow the evacuation, if/when necessary. Note that the usability of equipment is a very important point that must be checked in realistic conditions, a point that can be overlooked by designers: in another instance (Oswald et al., 2005), the doors were supposed to be used in case of evacuation, but their operation was too unfamiliar to be usable in a rush and in smoke. 6.1. Equipment that needs to be survivable The list of critical systems requiring survivability was established to meet the considerations above, in the dual purpose to avoid fulfilling as much as possible the conditions that might lead to panic or psychological distress, and to ease the management of the crisis. Following the considerations above, the list of critical systems has thus been established as follows:  Lighting. The first need of the survivors is to assess their condition, reach for safe places, try to communicate with the outside world and bring rescue (experience shows that survivors may have medical training). All this is only possible if they are able to see. Blast-resistant emergency lighting therefore ranks very high in the list of priorities. Provision should be made to ensure visibility in smoke and soot (Greater London Authority, 2006c, p. 225). Flashlights should be available if the emergency lighting fails (Greater London Authority, 2006a, p. 132). Tunnel lighting, when available, was reported to allow asserting the damage when the lighting of the carriage failed (Greater London Authority, 2006c, p. 9). Besides improving the management itself, lighting also relieves the sense of helplessness which is one of the conditions for a panic listed in Section 5.1.  Passengers to driver communications. The presence of the driver is of paramount importance in the case of an emergency requiring following procedures and knowing indepth the train and the system. Moreover, the presence of a knowledgeable person relieves the sense of isolation (which is the second condition for a panic). Hence the need for such measures as a shielded driver’s cabin and a survivable intercom system between the driver and the passengers. In driverless metro systems, the same function can

44

J.-L. Bruyelle et al. / Safety Science 62 (2014) 37–45

be fulfilled by the control centre, so in this case the intercom and the associated radio link take a particularly vital role.  Train to ground communications. This link is used both to allow the staff in charge of crisis management to gather information from the driver or the passengers, and to communicate information and instructions. The role of communicating with the outside world is extremely important not only from the practical point of view, but also to relieve the sense of powerlessness and isolation which are two of the conditions to result in a panic.  Door operating systems. The capability to egress the train after a blast is unquestionably a basic requirement. Even when egress is not a good option, knowing that it is possible relieves the sense of entrapment which is one of the conditions for a panic. The technical problem here is threefold: the doors slides must be guaranteed to be operative (also in taking measures against the blockage of the mechanism by pieces of glass, for example), and the unlocking mechanism must be usable even if unpowered. Also, one must be able to open the doors from the inside of the train – this includes being operated by passengers, which implies being intuitive. An instruction sheet next to the door can be useful, providing the designers are aware that in an emergency it will not necessarily be read (Oswald et al., 2005). Windows can be used as an egress way too: in some instances, such as the Kaprun funicular fire in 2000 (Wikipedia, 2011), the twelve surviving passengers were those who could egress by smashing a window, whereas in London. From a design point of view, emergency windows appear as a difficulty in case of blast, since they conflict with the need to avoid flying glass debris from windows shattered by the blast. In London, where survivors smashed windows. As a general rule, any function involving a display screen has been ruled out from this list, as such screens are thin and offer a wide surface, and thus are easily destroyed by a blast. Shielding them is possible, and even necessary to prevent their turning into shrapnel, but all the necessary information and reassurance can be provided most effectively through live voice, so the interest of screens appears secondary compared to a survivable audio communication system. 6.2. Equipment to be provided in case of emergency Other functions, which do not usually exist in Underground coaches, become necessary after a blast due to the likely need to evacuate and to provide medical first aid:  Rescue kits. The need for these was shown by the London bombing, where the survivors and staff were led to improvise tourniquets and bandages with their clothes by lack of proper rescue equipment. Of course, having access to a rescue kit also has the effect of alleviating the sense of helplessness. The contents and location of these kits are out of the scope of this article.  Evacuation guidance signs. Equivalent to the luminescent exit and directional signs in buildings or airplanes, these allow the confused passengers to locate the exit. Due to possible loss of power and lighting despite protection measures, passive signage is best. A difficulty is that, in the case of a train damaged by an explosion, the actual location of the safe exit depends heavily on the location and power of the blast, so defining a unique predefined path gives rise

to the risk of leading to a dangerous area (Comeau, 1996; NFPA, 1998). Also, visibility problems caused by soot, smoke and overcrowding should be taken into account.  Instruction posters and labels. These are intended to explain to the passengers how to use e.g. the doors for emergency opening. Care should be taken to ensure that passengers are able to operate the doors despite poor visibility, stress and likely emergency of a blasted train (Oswald et al., 2005), so the presence of a label cannot replace an easyto-use actuating mechanism, as said above. Finally, prior knowledge of the evacuation and rescue system is important, both from a cognitive point of view (knowing how to access the rescue kit and how to place a call on the intercom can save a valuable time) and to promote the assuredness feeling that alleviates the anguish. Fire drills have proven their effectiveness in major crises (National Research Council, 2003) and are normally part of the training of the staff. Extending such training to passengers could prove effective as well – this is especially true where the metro systems are automatic, since in this case there is no driver to rely upon. It would also be an effective way to counterbalance the prejudice that an emergency situation necessarily leads to panic – the fifth condition that, ironically, can lead to a panic. 7. Conclusion The present study has led to the design of technological solutions and behaviour management in order to improve the design of future metro vehicles taking into account the past experience for resilience to bomb attacks. Consideration of the immediate aftermath of the London bombings and other similar events, as well as the current theories regarding the human behaviour in such situations, have led us to propose improvements specifically dedicated to improving the survivability of the passengers and the access to rescue. These improvements can be summarised as the addition of several features that do not exist in the current vehicles, or already exist but should be made able to survive and be operable after a blast: Several pieces of equipment from the above list are already available or under development. For instance, the partners of the SecureMetro project have successfully field-tested LED-based emergency lighting designed to survive in blast situation. The linear shape of this lighting also allows its use as directional signs. Also, robust underground-enabled radio communication systems are readily available, albeit not currently deployed for train to ground communications as far as we know, and not guaranteed by design to be survivable in similar conditions. The integration of survivable equipment in a metro coach requires the use of survivable solutions too. For instance electrical equipment should be self-powered with internal batteries, antennae should be as close as possible to the equipment they are associated to, and cables should be protected in shielded tubes. All these details are not part of the current design of metro vehicles and raise new specific difficulties, such as the management of numerous, ageing-prone batteries. Discussions with the metro operator partners of the project have taken place in order to take into account the necessities of the day-to-day operation and maintenance of the vehicles in the design. The SecureMetro partners have built a demonstrator vehicle equipped with the solutions designed in the project, in order to submit it to blast tests to assess the improvement brought, in comparison with an existing vehicle representative of the current generation of rolling stock. An objective is also that the new measures can be made available as a retrofit for present vehicles for a fast and cost-effective implementation of the improved design.

J.-L. Bruyelle et al. / Safety Science 62 (2014) 37–45

The final step of our work in the SecureMetro project will be to propose the inclusion of these results and developments as part of the effort to improve the operating procedures and relevant standards, in order to improve the safety and resilience of underground systems in case of blast or similar events. Acknowledgements The authors would like to thank the European Commission for supporting the funding for the ‘‘SecureMetro – Inherently secure blast resistant and fire safe metro vehicles’’ Project (Grant Agreement No. 234148), and would also wish to thank all participating project partners. References Best, R.L., 1978. Reconstruction of a Tragedy: the Beverly Hills supper Club fire. National Fire Protection Association, Boston, MA, (03.03.13). Bowlby, J., 1969. Attachment and Loss. Attachment, vol. 1. Basic Books, New York. Bowlby, J., 1973. Attachment and Loss. Separation, Anxiety and Anger. Basic Books, New York. Clarke, L., 2002. Panic, myth or reality? Contexts, vol. 1, no 3, pp. 21–26. (29.03.12). Cocking, C., 2008, ‘DON’T PANIC! Crowd behaviour in emergencies: implications for professionals (2008), Presentation for the EPC, March 9, 2008. (03.03.13). Comeau, E., 1996. Fire Investigation Report: Airport Terminal Fire Düsseldorf, Germany, April 11, 1996. NFPA Investigation Report, National Fire Protection Association, Quincy MA. Cornwell, B., 2001. Bonded Fatalities: Relational and ecological dimensions of a fire evacuation. The Sociological Quarterly 44, 617–638. Drury, J., 2008. The Mass Psychology of Emergency Evacuation. . Fahy, R.F., Proulx, G., 2002. A comparison of the 1993 and 2001 evacuations of the World Trade Center. In: Proceedings – Fire risk and Hazard Assessment Symposium, Baltimore, MD, July 24, 2002, pp. 111–117. (29.03.12). Drury, J., Cocking, C., 2007. The Mass Psychology of Disasters and Emergency Evacuations: a Research Report and Implications for Practice. (29.03.12). Drury, J., Winter, G., 2004. Social identity as a source of strength in mass emergencies and other crowd events. International Journal of Mental Health 32, 77–93, (03.03.13).. Drury, J., Cocking, C., Reicher, S., 2009a. Everyone for themselves? A comparative study of crowd solidarity among emergency survivors. British Journal of Social Psychology 48, 487–506. Drury, J. et al., 2009b. The nature of collective resilience: survivor reactions to the 2005 London bombings. International journal of Mass Emergencies and Disasters 27 (1), 66–95.

45

Greater London Authority, 2006a. Report of the 7th July Review Committee. (29.03.12). Greater London Authority, 2006b. Report of the 7th July Review Committee. Views and information from organisations, vol. 2. (29.03.12). Greater London Authority, 2006c. Report of the 7th July Review Committee. Views and Information from Individuals, vol. 3. (29.03.12). Khoudour, L. et al., 2011. An approach for protecting a critical transport infrastructure. Journal of Rail and Rapid Transit, Institution of Mechanical Engineers, Part F, 1–11. Le Bon, G., 1895. Psychologie des foules. Félix Alcan (Ed.), 9° édition (1905). (29.03.12). Available in English: http:// socserv.socsci.mcmaster.ca/~econ/ugcm/3ll3/lebon/Crowds.pdf (01.03.13). London Regional Resilience Forum, 2006. Looking Back, Moving Forward: the Multiagency Debrief, Lessons Identified and Progress Since the Terrorist Events of 7 July 2005. (01.03.13). Mawson, A.R., 2005. Understanding mass panic and other collective responses to threat and disaster. Psychiatry 68 (2), 95–113. National Research Council, 2003. Highlights – WTC Disaster Shows Value of Evacuation Drills. (13.04.12). NFPA, 1998. Hard Lessons Learned from the Dusseldorf Fire. Fire Prevention, vol. 312. Fire Protection Association, UK, pp. 32–33. Oswald, M. et al., 2005. Full-scale evacuation experiments in a smoke filled Rail Carriage – a detailed study of passenger behaviour under reduced visibility. In: Waldau, A., Gattermann, P., Knoflacher, H., Schreckenberg, M. (Eds.), Pedestrian and Evacuation Dynamics 2005. Springer-Verlag, Berlin Heidelberg, pp. 41–55. Proulx, G., Sime, J.D., 1991. To prevent ‘panic’ in an underground emergency: why not tell people the truth? In: Proc. 3rd int. Symposium on Fire Safety Science. Elsevier Applied Science, London, pp. 843–852. Quarantelli, E.L., 2002. The sociology of panic. In: Smelser, N.J., Baltes, P.B. (Eds.), International Encyclopedia of the Social and Behavioural Sciences. Elsevier Sciences Ltd., Oxford. Schweingruber, D., Wohlstein, R.T., 2005. The madding crowd goes to school: myths about crowds in introductory sociology textbooks. Teaching Sociology 33, 136– 153, (17.09.10). Tierney, K. et al., 2006. Metaphors matter: disaster myths, media frames, and their consequences in hurricane Katrina. Annals of the American Academy of Political and Social Science, vol. 604, no. 1, pp. 57–81. (03.03.13). Turner, J., Hogg, et al., 1987. Rediscovering the Social Group: a self-categorization theory. Blackwell, Oxford. Williams, R., Drury, J., 2009. Psychosocial resilience and its influence on managing mass emergencies and disasters. Psychiatry 8, 293–296.

Web references Database of Worldwide Terrorism Incidents. (30.03.12). Global Terrorism Database. (30.03.12). Wikipedia, 2011. Kaprun disaster. (03.03.13). Wikipedia, 2013. Terrestrial Trunked Radio. (03.03.13).