Safety Science 45 (2007) 920–940 www.elsevier.com/locate/ssci Design of formative evacuation plans using agent-based simulation Nikos Zarboutis, Nicolas Marmaras ¤ National Technical University of Athens, School of Mechanical Engineering, Ergonomics Unit, 9 Iroon Polytechneiou Street, Zografou, Athens GR-15780, Greece Received 9 January 2006; received in revised form 23 August 2006; accepted 31 August 2006 Abstract The article presents a methodological framework for the design of formative evacuation plans for complex socio-technical systems in crisis. The framework adopts the Complex Adaptive Systems modelling approach, and proposes the agent-based simulation as cognitive tool for the team which designs the plans. The formative evacuation plans, which are developed using the proposed framework, do not prescribe normative procedures but provide recommendations that decrease the problem space of the personnel, and at the same time permit them to adapt to the particularities of the situation at hand. The framework is demonstrated through an application in a metro system, for the case of a Xaming train stalled between two stations.  2006 Elsevier Ltd. All rights reserved. Keywords: Agent-based modelling; Complexity theory; Emergency management; Formative design; Crowd safety; Cognitive systems engineering 1. Introduction In the past, several places have associated their names with disasters. The Theatre of Chicago, USA in 1903, the King’s Cross Wre in London metro, UK in 1987, the Hillsborough stadium disaster in SheYeld, UK in 1989, the Baku metro Wre, Azerbaijan in 1995, * Corresponding author. Tel.: +30 210 772 3492; fax: +30 210 772 3571. E-mail address: marmaras@central.ntua.gr (N. Marmaras). 0925-7535/$ - see front matter  2006 Elsevier Ltd. All rights reserved. doi:10.1016/j.ssci.2006.08.029 N. Zarboutis, N. Marmaras / Safety Science 45 (2007) 920–940 921 the Kaprun funicular train incident in 2000, the Samina Express ferry shipwreck outside Paros island, Greece in 2000 and others, they all share a common characteristic: people, in the form of crowds, failed to safely escape from an enclosure, whether it was a sinking ferry, a railway tunnel, a theatre or a stadium. Today, more than ever, the evacuation of a more or less large amount of people from a hazardous area, under temporal and physical constraints, is a major issue that can be met in multiple Welds of modern life. Despite the fact that the hazards that threaten the life or the well-being of the people have evolved, and the high-tech barriers installed have set a new picture for safety management, still, the model of evacuation is more or less the same, involving the evacuees, the hazard and, no matter of the technology used, some authority(-ies) whose members are trained and expected to lead and/or facilitate the evacuation. Thus, the personnel in charge of such crises (e.g. a ferry’s crew, the personnel of an underground Metro, the security in a stadium, etc.) has to cope with a diYcult, highly dynamic, safety–critical problem, involving at least two sources of uncertainty, namely the evacuees’ behaviour and the evolution of the hazard per se (e.g. the spread of the Wre, the smoke or some other toxic substance in an enclosure such as a tunnel or a building; the water covering the watertight compartments of a sinking ship). In fact, the collective behaviour of the evacuees, who are emotional and untrained individuals, has a signiWcant impact on the decision-making process of the personnel, as their unordered behaviour constantly changes the space to evacuate, reshaping their short-term goals. The same stands for the ever changing evolution of the hazard. Safety Engineering research and applications provide two complementary directions aiming to ensure safe evacuation. The Wrst one deals with interventions at the infrastructure, aiming at designing resistant to the hazard structures, appropriate escape routes, other facilitating devices, etc. (see for example, Smith and Dickie, 1995; Mallett et al., 1993; Graat et al., 1999). Typically, such interventions aim at the facilitation of the evacuees’ escape and/or of the task of the personnel in charge of the crisis, (e.g. increase the available time to manage the situation by using non-Xammable materials in the case of Wres or stalling the evolution of the hazard; facilitation of the communication among the personnel and the evacuees through telecommunication devices so as to ensure the early notiWcation and diagnosis, etc.). The second direction deals with the organisational issues of the personnel. The main problem here is to conceive eYcient evacuation procedures for managing highly dynamic, safety–critical and uncertain situations. In most cases, following the classical analytic paradigm and the positivist thinking, that axiomatically presume predictability, the plans determine in a quite detailed way who should do what, when, where and how. At the same time, in order to deal with the uncertainties, usually a central decision maker is assigned (see for example, the “horizontal” evacuation plan described by Johnson, 2006), the contingency plans that are used for management of natural disasters such as those described in Urbina and Wolshon (2003), OSHAs guide on the design of Emergency Action Plans for the case of workplaces (OSHA, 2002) etc. In order to support the design of both the infrastructure of the spaces and the evacuation procedures for buildings on Wre, a number of simulators have been developed. Examples of such simulators are the Glasgow Evacuation Simulator (Johnson, 2005, 2006; Ashraf et al., 2005), the EXODUS system and its clones (Owen et al., 1996), the Egress Simulator of the UK Atomic Energy Authority (2002) and the GridFlow and the CRISP tools of the UK Building Research Establishment (2004). These simulators use various 922 N. Zarboutis, N. Marmaras / Safety Science 45 (2007) 920–940 mathematical models for the movement of the evacuees in space. The models are developed using diVerent methods such as Monte Carlo techniques, queuing and network theories. Data from past incidents as well as from “live” Wre drills have been used to develop and Wne-tune the simulations (Johnson, 2005, 2006). The metric used to asses the simulated scenarios is the evacuation time. Most of these simulators dispose interactive user interfaces for adjusting a number of open variables (e.g. number of evacuees, their moving speed, etc.). Furthermore, appropriate graphical representations of the evacuation permit the users to form an image of the evolution of the evacuation. Past accidents have shown that plans are rarely followed as prescribed during crises. In the Channel Tunnel Wre, for example, the personnel of the Eurotunnel did not make use of written procedures. As the investigation board concluded about the passengers’ evacuation of the shuttle that caught Wre, (Channel Tunnel Safety Authority, 1997, p. 45): During the incident on 18 November 1996, those instructions were either forgotten, incorrectly applied, applied too late or applied in a diVerent order to that prescribed. In other words, the personnel of the shuttle, because of the dynamic changes they were confronting (the Wre propagated rapidly and if the train kept on moving to the rear end, the Wre could have reached the passenger cabin), adapted to the situation (making a controlled stop next to an emergency exit, instead of bringing the train out of the tunnel and evacuating it there, as procedures dictated), building a plan ad hoc, which proved to be very eYcient. On another case, during the metro Wre in the Baku subway, the personnel chose to adjust the ventilation system in an exhaust mode, and as a result “much of the smoke was drawn on the same side that the evacuation was going” (Andersen and Paaske, 2002). Although it is unclear whether this was stated in a procedure or not, the choice of the personnel to perform an action irrespective of the topology of the evacuees (passengers had already begun evacuating the train), but possibly due to some other criteria (e.g. creating an escape route clear of smoke), led to a decision that aggravated, instead of facilitating, the evacuation process. Similar remarks are made by Johnson (2005) studying the report of the September 11th attack at the World Trade Centre, New York, USA. In such cases in particular where safety is aVected by security, the evolution of the hazards that an agency is confronting can deliberately become more complicated. As it appeared for example in the recent London bombings in July 7, 2005, the terroristic plot involved a situation where the attacks aimed both at primary as well as secondary escape routes (i.e. both at the metro and at buses used to drive away people evacuating the metro). In such cases thus, the personnel in command have to cope with situations where a major source of uncertainty is intentionally imposed to them and which can render the application of a plan insuYcient or even disastrous (i.e. leading people to an area that is about to become equally hazardous). To explain the non-application of the prescribed plans, after the incidents, the investigators usually make reference to human error, the “catch-all” explanation according to Vicente (2004). At the same time, based on the experience gained by the incidents, as well as by emergency drills, the plans are reviewed, usually on the “logic of patchwork”. Based on the assumption of predictability, as raised earlier, a typical doctrine is that “everything has not been predicted yet”, followed by, “all is needed is just some more prescriptions to close the gaps of the plan!” (Woods et al., 2002). In conclusion, we can argue that usually the designers of the organisational settings disregard or at most oversimplify the complexity of the phenomena they deal with, and therefore, their non-linearity and their non-predictability. N. Zarboutis, N. Marmaras / Safety Science 45 (2007) 920–940 923 At the same time, the rarity and the criticality of such crises do not permit to seriously contest the adopted solutions and to experiment with alternatives based on knowledge acquired in the Weld. In order to overcome the weaknesses of the usually adopted design paradigm and the diYculties that arise during the development of evacuation plans, in the present paper we propose a methodological framework, inspired by the Complexity Theory (Holland, 1995, 1998; Simon, 1996). The system to be studied is modelled as Complex Adaptive System. Using the formalisms of agent-based modelling, appropriate simulations are developed. These simulations enable the observation of the emerging evolution of the studied system, under alternative organisational settings and probable decisions of the personnel regarding the evacuation, as well as under diVerent initial conditions. According to the principles of the complexity paradigm, the simulation of a complex system is not a replication of a repeatable process that could lead to a prediction, and later to a normative design; instead, we can have images of the system’s future probable behaviour. Consequently, instead of predictions, we can only have prognoses, and the same scenario, under the same initial conditions, can lead to diVerent outputs. Additionally, the complexity paradigm should lead us away from the rationale of the “average performance”. Such bottom-up modelling and simulations can reveal hidden interactions and other unknown aspects of the problem that are usually the product of combinations of structural and environmental changes (Pavard and Salembier, 2003). Consequently, the designers of alternative evacuation plans may gain valuable experience about the system’s behaviour, which is otherwise impossible in real-life situations. Furthermore, the methodological framework can lead to the identiWcation of emergent patterns of the agent’s collective behaviour at the micro-level, which lead to sub-optimal performance of the whole system. Appropriate analysis of these patterns can suggest interventions that would constrain their emergence. Through iterations, we can therefore come up with a web of personnel’s actions, which constrain the emergence of the aforementioned patterns, and in this way, ensure an unobstructed evacuation. This web of actions may constitute a formative evacuation plan, as opposed to a normative one. Such a plan does not prescribe exactly when or even how an agent should act, but provides recommendations which decrease the problem space of the personnel, alleviating the decision making process, and at the same time permits them to adapt to the particularities of the situation at hand. Consequently, evacuation plans designed in this way acknowledge the non-predictability of the evolution of complex systems and produce what Rasmussen et al. (1994) describe as adaptive work systems. The rest of the paper is structured as follows: in the next section we present the basic stages of the methodological framework, providing at the same time certain basic elements of the Complexity Theory. In the third section we demonstrate the framework through an application from the domain of railways. More speciWcally, the application concerns the design of a formative evacuation plan in the case of a metro Wre. Finally, in the last section we make a synopsis on the usefulness of the proposed framework and comment on its strengths and weaknesses. 2. The methodological framework The proposed methodological framework for the design of formative evacuation plans comprises Wve main stages and is presented schematically in Fig. 1. 924 N. Zarboutis, N. Marmaras / Safety Science 45 (2007) 920–940 Fig. 1. The Wve stages of the methodological framework. 2.1. Initial analysis The Wrst stage of the framework consists of an initial analysis aiming at the familiarisation with the basic properties of the domain, as well as an in depth understanding of the problems that the personnel of the system will face when a crisis occurs. Among the main issues that should be studied at this stage are: – – – – – – – the existing work organisation during the normal operation of the system, the diVerent types of hazards that could call for an evacuation, the diVerent elements of the technological system, the possible states it can fall in during crises, the goals to be achieved by the diVerent members of the personnel during crises, the artefacts used by the personnel and/or the evacuees, the eventual position, number and demographic characteristics of people to be evacuated. Task analysis methods such as Hierarchical Task Analysis, Goals-Means Analysis, Event Trees, or “What-if” analyses can be used to support the analysts (for an overview, see Kirwan and Ainsworth, 1992). Although this is not an easy task, especially if security is N. Zarboutis, N. Marmaras / Safety Science 45 (2007) 920–940 925 a factor that needs to be included in the study, increasing thus the complexity of the scenarios to be studied, the application of the typical techniques mentioned above can set up the general picture. At the end of this stage, the design team may start thinking possible alternative evacuation plans, i.e. personnel’s alternative strategies, sequence and timing of diVerent actions, etc. The investigation of the eYciency of these alternatives is not evident, due to the complexity of the system, i.e. the dynamism of the phenomena involved and the multiple interactions among the participating agents (personnel, evacuees, etc.). An appropriate model of the system is therefore required to support such an investigation. This is the scope of the following stages. 2.2. Determination of the system boundaries and identiWcation of comprising wholes This stage aims at framing the world-to-study (Marmaras and Nathanael, 2005), that is, delimiting the boundaries of the system that will be modelled. Without any doubt this process is inXuenced by the intentionality of the design team and of what seems convenient for them to see in the modelled system. However, the reduction of the world into the world-tostudy, should meet a number of internal validity criteria. Under the complexity paradigm the unit of analysis is placed on wholes (Checkland, 1984). Generally, we can deWne a whole as an autonomous entity in the world that may comprise other parts, it has a border, through which it interacts with the external environment and is discernible by an observer placed outside it. In this case, for any observer in the world, the complex system (i.e. the world-to-study) consists of multiple interacting and co-evolving wholes that she/he can distinguish or perceive as autonomous (e.g. other humans, discrete homogeneous groups of humans, cars, the Wre, etc.). Reducing thus the world into the world-to-study, is a process equivalent to the sorting of the wholes colonising the world, placing some inside the system and leaving others outside of it, considering them as members of the system’s external environment. In this fashion, we achieve to deWne a complex adaptive system as a set of many autonomous, self-organising and coevolving wholes which are placed within an environment, and interacting with it at all times. However, in order for this reduction to be valid (i.e. all the knowledge that is produced and held within the interactions to be included in the model), the analysts have to ensure that in the time frame that embraces the incident under study, each of the wholes that colonise the system is functionally independent of all the wholes in the environment. In complex systems research, this examination is achieved by ensuring the fulWlment of two criteria, raised by Herbert Simon (1996): (i) The short-term behaviour of each of the wholes in the system is roughly independent of the short-term behaviour of the others outside the system. (ii) The long-term behaviour of each of the wholes in the system is aVected by the behaviour of the others in the environment, only as an aggregate eVect. Consequently, according to the speciWcities of the alternative evacuation plans to be investigated, the wholes of the world-to-study may consist of the people to be evacuated, the hazard, the diVerent members of the personnel, etc., while their environment may be the space and its infrastructure where the evacuation takes place. 926 N. Zarboutis, N. Marmaras / Safety Science 45 (2007) 920–940 2.3. Modelling At this stage the design team has to decide at which level to model the behaviour of the agents constituting the diVerent wholes of the world-to-study. The practicability and the ecological validity of the model are two important criteria that should guide this decision. Indeed, a very generic model might not reveal all the probable future performance of the system, while a very detailed model might lead to such a variety in system’s performance that could be impractical for design purposes. At the same time, the model should dispose theoretical and/or empirical validity (e.g. from Weld observations). As mentioned above, the scope of the model is to be used as a test-bed for experimentation with alternative evacuation plans or personnel decisions. Consequently, the personnel’s actions, the evacuees’ movement, and the hazards evolution, as resulting from the interactions between them and the environment, are candidate entities for modelling. Modelling human agents’ behaviour is not a simple task. Depending on the situation and the ability of meta-cognition to come into play, the models describing human agents’ behaviour may be from quite simple to complicated ones. For example, people escaping from an enclosure during a Wre, could be considered as exhibiting event-driven behaviour. Consequently, the evacuees can be modelled as reXexive agents, whose transition between two consecutive states can be described by a set of simple rules (Zarboutis and Marmaras, 2004, 2005). On the contrary, in the case of trained personnel, cognition and meta-cognition play a much more important role. From the perception of an eVective stimulus from their environment, until the execution of an action, multiple feedback loops might intervene, and depending on the level of control that these agents have upon the situation, many loops of meta-cognition might also take place (Hollnagel, 1998, 2004). Consequently, the modelling of such agents is a matter of highly sophisticated cognitive models (see for example, the Cognitive Simulation Models – COSIMO, Cacciabue et al., 1992, 1998; the Cognitive Environment Simulator – CES, Woods et al., 1987). 2.4. Agent-based simulation The aim of this stage is the development and use of the simulation of the Complex Adaptive System that has been modelled at the previous stage. The important issues here concern both the simulation programming as well as the type of the obtained results and their interpretation. Object-oriented languages such as C++, Objective-C or Java are appropriate candidates for programming the model. However, building a simulation from scratch requires advanced programming skills. Luckily, this task is facilitated by some special toolkits, such as SWARM (http://www.swarm.org) or RePast (http://repast.sourceforge.net). Nevertheless, even using such libraries, certain programming skills are still required. The contents of possible evacuation plans, i.e. personnel’s alternative strategies, actions’ sequence or timing, generated during the Wrst stage, constitute the scenarios for which the simulation will be executed. Besides this, some other domain speciWc variables, such as the number of evacuees or the properties of the hazard, may be left open for experimentation. The explicit modelling of self-organisation brings out a speciWc property of this type of simulation; besides the variables that are left open, and which are used to structure the investigated scenarios, most of the other variables change dynamically as the simulation N. Zarboutis, N. Marmaras / Safety Science 45 (2007) 920–940 927 evolves (e.g. evacuees’ vision as a result of smoke concentration; evacuees’ speed as a function of the inhaled smoke and of physical obstacles; etc.). This means that the same scenario, under the same initial conditions can lead to entirely diVerent results, as we would expect from every real complex system. Thus, the diversity of the obtained results moves us away from the typical repeatable experiments of analytical science (Casti, 1998). In other words, even if consecutive simulation runs under certain scenarios tend to provide better results, one cannot rely upon them. However, as stressed in Section 1, the true virtue of an agent-based simulation lays on its use “as a tool of prognosis”. This type of knowledge concerns the structural changes caused by the interactions among the agents and their environment, and involves the union of two worlds: the individual performance of the micro-world and the collective observable phenomena of the macro-world. Consequently, by linking these two worlds, bottom-up in the simulation, one can identify dynamic structures at the micro-world (i.e. local interactions between agents adapting to their environment) that favour the emergence of particular performance of the whole at the macro-level. In other worlds, by consecutive runs of the simulation, the design team can gain valuable knowledge about patterns of the agents’ behaviour that lead to the emergence of particular performance of the whole system. Based on this knowledge, the design team may search afterwards for appropriate solutions to control undesirable emerging phenomena. This is exactly the primary advantage of agent-based simulations. By explicitly modelling emergence, through the interaction of agents by low-level simple rules, we obtain emergent behaviours and collective schemata. Therefore, in contrast to other tools which simulate directly such emerged phenomena encountered in “similar” situations, the design team disposes a tool that is able to generate during run-time a greater variety of the system’s probable behaviour. Furthermore, one does not run the risk to use invalidated data originating from “similar” systems (i.e. data that lack “setting validity”; Cook and Campbell, 1979), in order to calibrate the simulator as to account for such phenomena as it is uncertain whether they can be generalised across diVerent settings (e.g. drawing metaphors from hotel Wres to stadiums’ evacuations, as for the evacuees’ behaviour etc.). Consequently, agent-based simulations of emergency evacuations can prove to be more reliable as for the representation of the world-to-study (Dugdale et al., 2000). Finally, such a simulation unveils some of the phenomena that remain hidden in the quality of the triple interaction between the passengers, the personnel and the evolving hazards, and therefore usually escape pure reductionistic analyses. Validation of agent-based simulations may be problematic (ibid.), if sought through the analytic perspective that favours the repeatability of simulated Wndings. However, if we deWne validation as “the process of determining the degree to which a model is an accurate representation of the real world from the perspective of the intended uses of the model” (AAIA, 1998 in Oberkampf and Trucano, 2002), the use of the model is an essential part of its validity. Thus, the statistical use of simulated data, lacks theoretical validity (i.e. compliance to the theory of complex systems, that rejects the “repeatability hypothesis” inherent in the statistical use of the model’s outputs). Even if in some cases statistics may have been proven reliable in the aftermath of certain events, especially if the sample is fairly rich, there is no guarantee that such statistics are reliable in any case. Furthermore, a number indicating for example 90% probability of success implies also a 10% probability of failure, which is unacceptable in emergency planning. In fact, the safety–critical nature of emergency evacuations demands precise solutions for any eVect that might arise, and strength- 928 N. Zarboutis, N. Marmaras / Safety Science 45 (2007) 920–940 ens the view that even the least probable cases are very important. Therefore, because of the questionable validity of the statistical use of agent-based simulations, in the following section we propose a diVerent path, so that the use of the agent-based simulation to be valid as for its intended scope. 2.5. Towards the generation of formative plans The model of the world-to-study and the agent-based simulation developed in the previous stages can be used to investigate the eYciency of the evacuation plans generated during the Wrst stage, as well as to give them a more concrete form. This can be done in the following iterative way: – The design team runs consecutive simulations, under diVerent scenarios implementing the possible alternative evacuation plans generated during the Wrst stage, and identiWes patterns of the evacuees’ collective behaviour that, upon emerged, lead to suboptimal results of the whole system (non-eYcient evacuation). – Those scenarios that do not generate patterns leading to suboptimal results are gathered. Personnel’s actions or other interventions to the technological system which could constrain these patterns from emerging are searched for the rest of the scenarios. This can be facilitated using top-down analysis methods such as fault-tree analysis. – New simulations, incorporating the personnel’s actions (or the interventions) that were generated at the previous phase, are run in order to asses their eVects on the evacuation. Multiple iterations of the process described above may be performed, in order to generate a satisfactory web of personnel’s actions, as well as interventions to the technological system, that would reduce the emergence of patterns which are known to lead to non-eYcient evacuation. The web of personnel’s actions will form a formative evacuation plan. 3. An application A typical example of a complex system during crisis is the evacuation of a metro train on Wre. Any incident that takes place within a tunnel involves the exploitation of many resources (material and informational), multiple agencies pursuing diVerent goals under strict temporal constraints, (e.g. the metro personnel, Wre brigade, paramedics, police etc.), and an overall uncertainty stemming both from the phenomenon to deal with, as well as from the passengers. During a Wre, the personnel of the metro will have to conduct an emergency evacuation, from the tunnel to a nearby station, assisting the passengers in their eVort to save themselves, through the exploitation of the available resources that the work system provides them. The method presented in the previous section has been applied to the Athens metro for the case of a tunnel Wre. The goal was to assess and improve the existing evacuation plans. An extensive summary of the application is presented below (see also Zarboutis and Marmaras, 2002, 2004). 929 N. Zarboutis, N. Marmaras / Safety Science 45 (2007) 920–940 Formation of a safe escape route for the passengers Plan1 to 2 (random order) Fire fighting – Fire Brigade Support Passenger Support Plan 1 to 5 (random order) Evacuation preparation Prevention from electrocution Opening the train doors Cut off of power from the Line Protection Protection from Protection from from overstep smoke inhalation heatstroke by other trains Leading away other trains from the area of the incident Activation of the ventilation system Flassover avoidance Coordination of Personnel & Fire Brigade Pre-conditions fulfillment (e.g. open water supply) Fig. 2. Hierarchical task analysis of the metro on Wre. 3.1. Initial analysis of the metro system on Wre A Hierarchical Task Analysis reveals the prototypical work situations that the metro personnel are expected to be engaged in, no matter how the incident might evolve (Fig. 2): – The train driver should eventually open the doors, so that the evacuation could be initiated. In case the driver is not physically able to do so (e.g. due to the accident that led to the Wre, she/he might be injured or unconscious), this action should not be expected and passengers will have to act on their own. – The TraYc Regulator should lead away the forthcoming trains, by making a general call to all train drivers travelling in the tunnel, so as to avoid the entrapment of a fully functional train in a hazardous area that could probably lead to an unwilling second emergency evacuation, instead of just one! – The Power Controller should cut-oV the power from the line, so as to prevent electrocution of the passengers during the evacuation. This action however, if done too early can lead to an entrapment of other trains (see above). – The Power Controller should activate the ventilation system. Care has to be taken that the airXow created should not send the smoke in the direction that the evacuation is going. Given that each of the evacuees moves on her/his own personal criteria, this kind of uniformity on behalf of the group of passengers is uncertain. All the actions of the metro personnel are interdependent, and their implementation involves the recognition of multiple eVects on the same or multiple agents. For example, opening the train doors immediately after the Wre is detected would jeopardise passengers’ lives risking electrocution. Cutting oV the power immediately, would remove the danger of electrocution but would increase the probability of stalling other trains in the tunnel, thus jeopardising the lives of the passengers on other trains. Guiding the other trains, then cutting the power oV before opening the train doors, would lead to a situation where the tunnel would already be full of smoke, and evacuation might be more diYcult. It should be noted that the ventilation system cannot be operated at velocities greater than 11 m/s, since 930 N. Zarboutis, N. Marmaras / Safety Science 45 (2007) 920–940 people will experience diYculty in moving, as the airXow will be very strong. Furthermore, if the metro personnel delays opening the doors, it is highly probable that passengers will make use of the manual door release handles. The passengers of the train are able to perform the following actions: – They can stay in the train or they can use the emergency door release handle, open any door and exit the train. – They can move in any of the two directions of the tunnel, given that it is free of hazards (i.e. Wre, debris, etc.). – They can use the automatic current switch, installed in several places in the tunnel, and have the power cut-oV from the power sector around the train. Each passenger is constrained by multiple factors, such as the Wre, the smoke, the inXuence of the crowd on their performance, the topology of other agents, limiting their degrees of freedom. In this sense, the evacuation process for the passengers resembles the movement of someone on a rugged landscape, where both the constraints and aVordances change dynamically. 3.2. Determination of the metro system boundaries and identiWcation of comprising wholes Standing outside the metro system on Wre, we can see various wholes, such as the metro personnel, the passengers, various elements of the technological system, the paramedics, the Wre brigade etc. However, for the time frame that embraces the activity of the personnel regarding the evacuation, it is valid to reduce the system into a more practical level, leaving out the Wre brigade and the paramedics. In fact, the metro personnel is expected to be over with all the requisite actions described earlier, by the time either the Wre brigade or the paramedics might get involved in the aftermath of the incident. In other words, the paramedics and the Wre brigade form two wholes whose short-term behaviour can be considered as functionally independent of the behaviour of the passengers or the personnel, in compliance to Simon’s criteria, mentioned above, for the time frame that embraces the metro personnel’s activity of interest. Under this scheme, the world-to-study was modelled as a Complex Adaptive System (mCAS), comprising three interacting and co-evolving wholes: (i) the Group of Passengers (GoP), (ii) the Metro Personnel (MP) and (iii) the Fire (F), which is being mediated by the Technological System, as shown in Fig. 3. For each of these wholes, the environment is the complex of the other two. In this sense, for the personnel, its environment is the complex of the Fire and the Group of Passengers (i.e. the passengers that avoid the Wre, in every point in time and space). For the passengers, their environment is the Fire and the Personnel (i.e. the Wre as it is being fought by the personnel; the smoke as it is aVected by the ventilation system, set by the personnel). In this sense, passengers and personnel interact indirectly, through modiWcations on their common environment, a phenomenon known as stigmergy. Thus, both the personnel and the passengers act and get aVected by their environment, causing changes at each other, leading to respective alterations in their internal organisation (i.e. the topology of the passengers in the tunnel; the actions to be taken by the personnel, through the choice or not to act at a given moment, etc.). N. Zarboutis, N. Marmaras / Safety Science 45 (2007) 920–940 931 Technological System Group of Passengers Organisational Structure, Distribution of Knowledge, Authority and Technological Capacity Fire Environment Personnel’s Tasks, Agents, Goals to Achieve Metro Personnel Sequence of actions, Duration,Topology of Agent sand Actions Joint Cognitive System Fig. 3. The metro on Wre as a complex adaptive system. 3.3. Modelling of the metro on Wre As the scope of the model was to experiment with alternative evacuation plans, i.e. alternative metro personnel actions, we did not develop an executable model for them. The direct eVects of their possible actions as well the execution time constitute inputs to the simulated system. As far as the passengers are concerned, we considered them as adaptive agents, exhibiting reXexive, event-driven behaviour, responding to environmental stimuli at every point in time and space. Therefore, they were modelled as adaptive agents, obeying simple rules of behaviour. Examples of such rules are the following: (i) A passenger moves only if the space around her/him is free. (ii) When in the train, a passenger moves towards the nearest door; if it is open, she/he exits the train; if it is closed, she/he waits until a suYcient time passes (patience time), and then opens the door on her/his own and then exits the train. (iii) When out of the train, a passenger heads to the sidewalks and then to the station. (iv) If a passenger is near the Wre, she/he moves towards the opposite direction. (v) If the atmosphere is full of smoke, passengers move towards the direction less charged with smoke. (vi) If alone, a passenger heads towards the nearest person(s). This rule is based on a model describing the inXuence of crowd on individual’s performance (see more in Zarboutis and Marmaras, 2005). The rules describe the behaviour of passengers as it has been many times observed in past incidents, as well as during emergency drills. Furthermore, passengers were modelled to have certain demographic and physical characteristics (age, moving speed according to age, resistance to smoke inhalation, etc.). 932 N. Zarboutis, N. Marmaras / Safety Science 45 (2007) 920–940 The space of the tunnel was modelled as a Cellular Automaton, divided in a grid of cells. Each cell represents a speciWc piece of the infrastructure (e.g. sidewalk, train, power line etc.), having the ability to store variables such as an amount of smoke, whether it is Xammable or not, whether it is on Wre or not etc. Passengers, being given their basic motor abilities, were wandering on this grid altering their variables (e.g. value of inhaled smoke, maximum speed), as well as the variables of the cells they colonised (from the state of being not-occupied, to being occupied), at each point in time and space. For simplicity reasons, when the ventilation system was inactive, Wre was modelled as propagating randomly in direction (inheriting a method from the RePast toolkit, as for the generation of random numbers) and on a constant – user deWned – propagation rate. During the setup of the model, the cells representing the train were assigned by the user a variable indicating a certain degree of Xammability, simulating diVerent amounts of “fuel” on board of the train. In this way, cases such as a train going to an airport where a great proportion of the “fuel” is in the baggage of the travellers, may be simulated. Fire was initiated on a Xammable cell by the user of the simulator (giving him the opportunity to initiate the Wre either at the front/back or in the middle of the train), and it propagated among Xammable cells. Smoke propagation on the other hand was modelled using a basic model of diVusion, according to which, at each point in time, each cell diVuses a percentage of the mounted smoke to its eight neighbouring cells. As Wre propagated, the more cells on Wre, the more the smoke produced, and given the diVusion model, the more the smoke covering the tunnel. The initial randomness of the Xammable cells, thus, ultimately gives rise to a non-deterministic environment, both for the passengers and the personnel, as someone would expect in a real situation. The eVect of ventilation was modelled through appropriate modiWcations in the propagation rate and direction of both Wre and smoke amount, between neighbouring cells. Passengers’ intoxication was modelled on the basis of the dose received, instead of the exposure concentration in the environment (Purser, 1992). Initially the rules that determine the behaviour of the passengers were prioritised, based on experience gained form past Wre events in tunnels as well as on knowledge obtained through emergency drills. This prioritisation enables the resolution of conXicts among rules that lead to contradicting actions. For example, when a passenger is out of the train and under the inXuence of (a) a group heading towards some direction, being inclined by the rule vi (passengers do not stay isolated from the others) and (b) the rule iv (if a passenger is near the Wre, she/he moves towards the opposite direction), then the next move favours the direction opposite to the Wre, for the time step given. This priority was given as it has been found that passengers hesitate to pass through a small Wre, even if such an action could increase their chances of survivor in the long run. The set of rules that are applied for a given moment in time, change during the evolution of the incident and it is unique for every individual passenger, as someone would expect in reality. As the environmental parameters evolve, a rule may not be applied if the triggering pre-conditions are not met. For example, given that vision for every passenger is updated at every time step along with the smoke concentration in the tunnel, if there is a group of passengers heading towards some direction, but between them and some passenger there is such thick smoke that prevents the latter of perceiving the group, then the rule vi that determines the inXuence of the group would not be applied and the individual’s behaviour would result from the application of just the other rules. Thus, at every point in time and space, the impact of the environmental parameters on the individual abilities gives rise to a unique set of rules, for every passenger in the tunnel. In other words, as the 933 N. Zarboutis, N. Marmaras / Safety Science 45 (2007) 920–940 parameters of the environment aVect the individual parameters of each passenger (e.g. vision, speed), ultimately the next move for every passenger is original, under unique conditions in time and space. Given the described model, and in accordance with the complexity paradigm, the collective behaviour of the group emerges through the interaction of the autonomous passengers, between them and the environment, in time and space. The same stands for phenomena such as bypassing Wre, or the “Xocking” eVect (i.e. the attraction of people to already crowded areas; see Johnson, 2005). 3.4. Agent-based simulation of the metro on Wre From a programming perspective, the simulation was built on Java 2, using the RePast toolkit (http://repast.sourceforge.net). The personnel’s actions can be introduced in the simulation in the form of a temporal schedule. The users of the simulation can determine the sequence of the personnel’s actions, the moment of initiation for every action and its duration, respecting the constraints that the actual work system poses, as identiWed by the task analysis (e.g. the same controller cannot carry out two tasks simultaneously). Additionally, a number of parameters concerning both the passengers (e.g. number of passengers in the rain, distribution of their age) and the environment (e.g. smoke release rate, Wre propagation rate) were left open. In this fashion, a plethora of scenarios could be built, combining personnel-related, passenger-related and environmental parameters. The number of human fatalities due to smoke inhalation, burns or electrocution was used as a measure of the eYciency of the evacuation. 3.5. Towards the generation of formative plans for the metro on Wre Based on the initial analysis of the metro system on Wre, eight alternative metro personnel’s sequences of actions have been identiWed, aiming at facilitating passengers’ evacuation (see Table 1). The functional constraints of the actual technological system, as well as the experience of the metro personnel have been considered in order to generate these alternative plans and the required execution times. Evacuation plans that seemed not to be Table 1 Metro personnel’s alternative sequences of actions No. 1 2 3 4 5 6 7 8 a Possible sequence of actionsa Prototypical actions of the personnel Time to have power cut-oV (min) Time to activate the ventilation system (min) Time to open the gates by the train driver (min) Time to lead the other trains away (min) 3–4–1–2 3–4–2–1 4–3–2–1 4–3–1–2 4–2–3–1 4–2–1–3 4–1–3–2 4–1–2–3 14 11 13 16 10 10 16 13 6 6 10 10 13 16 13 16 11 14 16 13 16 13 10 10 8 8 7 7 7 7 7 7 1: Open doors, 2: power cut-oV, 3: activation of ventilation system, 4: lead away other trains. 934 N. Zarboutis, N. Marmaras / Safety Science 45 (2007) 920–940 reasonable have been excluded. For example, all probable actions sequences where the electric current in the area of the incident would be cut-oV before the arrangement of other trains (i.e. not on Wre), have not been examined, because in this case those trains could not be led away. Furthermore, a number of typical situations concerning the passengers, the relative position of the train on Wre in the tunnel and the Wre were considered, assigning appropriate values to the open variables of the simulation (see Table 2). In this way, we generated a set of ninety possible alternative scenarios for experimentation. Using the simulator, we ran each scenario for over twenty times assessing the eYciency of the alternative evacuation plans. As expected, the eYciency results for each scenario, varied signiWcantly (e.g. in some cases from 55% to 95%!), mainly due to the Table 2 Passengers- and hazard-related possible situations Environmental parameters Description and possible values Tunnel length The length of the tunnel, as it can vary from every two other consecutive stations. Determined during setup A percentage of the maximum capacity of the train. Four discrete options were made available, which correspond to diVerent actual situations (e.g. peak hours, non-peak hours, weekends, etc.): 25–50–75–100% of the train completeness Three classes of passengers were used whose age is assigned randomly during the setup of the model, though on a given analogy. The classes deWned where: 30% people below 20 years old, 40% between 21 and 65 years old and 30% above the age of 65 Time that the passengers will wait until they make use of any emergency door handle and open a door manually The maximum amount of smoke that a person can take before she/he becomes unable to escape. During the setup of the model, this variable was personalised for every passenger depending on her/his age The train could be set to be stalled either close to a station or under the ventilation shaft of the tunnel (i.e. close to the middle of the tube) Variable denoting the presence of other trains in the area of the incident Variable representing the expansion of the Wre and it is a measure of the number of Xammable cells of the Cellular Automaton, with regard to the total number of cells that represent the train. During set up, this variable is given a random value, from 50% to 80% The Wre could be ignited either at the rear cars of the train (i.e. 1st–2nd or 5th–6th) or in the middle cars (i.e. 3rd–4th) The Wre propagation rate between neighbouring Xaming and Xammable cells in the cellular automaton. Three possible values, representing small-, average- and high- propagating rates, were made available The percentage of the smoke that each cell diVuses to its eight neighbouring ones, according to the model used The amount of smoke that each Xaming cell releases per time unit The Train Driver was assumed to be alive and conscious (i.e. whatever event leading to the Wre was assumed not to have caused any harm to her/his ability to carry out the necessary tasks) The ventilation could be set either based on the principle of “the least travelled distance” (i.e. creating an escape route towards the nearest station, irrespective of the Wre ignition point or the passengers’ escaping direction) or based on the “adaptive” principle, based on the passengers’ distribution in the tunnel and the position of the Wre, determined ad hoc Number of passengers Passengers age Patience Max resistance to smoke Train position in tunnel Other trains in the area Cell Xammability distribution Ignition point on train Fire propagation rate Smoke diVusion rate Smoke release rate Train driver health status Ventilation strategy Smoke Flow Clean Air Ventilation Flow Smoke Flow Trapped Passengers Passengers Caged in Train Clean Air Ventilation Flow N. Zarboutis, N. Marmaras / Safety Science 45 (2007) 920–940 935 Passengers in Deadlock Passengers in Bottleneck Passengers capable of escaping Passengers trapped between fire and smoke Passengers moving on the “wrong side” Passengers incapacitaded of escape (dead or unconsious) Fig. 4. Patterns leading to sub-optimal performance of the whole system. non-determinism of the simulated complex adapted system. Consequently, no alternative plan could be considered as the most eYcient one. However, using the graphical interface of the simulation program showing the evolution of the evacuation process, we observed a number of repeatable patterns at the level of passengers’ behaviour, leading to suboptimal performance of the whole system (Fig. 4). Examples of such patterns are the following: – Pattern #1 (Fig. 4a) emerges when one or more passengers are trapped in an area of the sidewalk which is full of smoke, and both the presence of Wre and the direction of the ventilation Xow, constrain them from moving towards a safe area. – Pattern #2 (Fig. 4b) emerges when one or more passengers are caged in a car of the train, the exit of which is constrained or prohibited by the presence of some obstacles (e.g. the passengers inside the train in Fig. 5b are constrained by incapacitated passengers blocking the train doors). – Pattern #3 (Fig. 4c) emerges when one or more passengers are found in an area where the chance of escaping is reduced, due to the smoke Xow that aggravates the atmosphere of the particular side of the tunnel, towards which they are moving. In this case, the passengers are moving as if they are heading towards the “wrong direction” (i.e. against the escape route that the adjustment of the ventilation system creates in the tunnel). – Pattern #4 (Fig. 4d) involves a physical bottleneck which emerges when one or more physically capable passengers cannot move towards a speciWc location, due to the presence of obstacles, geometrical constraints etc. Further analyses of these patterns were then carried out, in order to Wnd out personnel’s actions that would constrain their emergence. For example, Fig. 5 presents a fault-tree analysis for the Pattern #1. As it can be seen, by activating the ventilation system in the opposite direction, this pattern could be blocked. In this way, the overall goal can be 936 N. Zarboutis, N. Marmaras / Safety Science 45 (2007) 920–940 Pattern #1 (passengers are trapped between smoke and fire in the sidewalk) Ventilation System creates airflow towards the direction thatthe fire is propagating Passengers are unconscious or incapable of moving Passengers out of the train Train Driver Opens Doors Passenger Opens Door Fire Fig. 5. Fault-tree analysis for the Pattern #1. The ‘X’ marks represent possible interventions that could block the emergence of the pattern. reduced in a methodologically valid fashion, that is, identifying causal relationships between patterns and structures, and not between agents and events. Furthermore, combining the results of the analyses of all the patterns leading to suboptimal performance of the evacuation, a generic relation between basic personnel’s actions has been identiWed. This relation indicates that the eYciency of the evacuation is a function of the relative diVerence between the time the doors were opened by the train driver and the time the ventilation system was activated, given that it was adjusted on an adaptive mode (i.e. creating an escape route based on the passengers’ actual distribution in the tunnel, instead of clearing the path towards the closest station, without any consideration for the passenger’s behaviour). In fact, given the results obtained by the scenarios that were tested by the simulation, the space which favours optimal adaptation is delimited by the triangle shown in Fig. 6. The side (AB) implies a sequence in the execution of actions; it can easily be transformed into a functional constraint (i.e. the Train Driver should not open the train doors unless she/he is aware of the activation of the ventilation system). The side (AC) implies N. Zarboutis, N. Marmaras / Safety Science 45 (2007) 920–940 937 Fig. 6. The triangle which delimits the space of optimal adaptation. that it is essential for some delay in the massive exit of the passengers, through an action of the Train Driver, as this enables the avoidance of critical congestion phenomena. Finally, the side (BC) implies that the activation of the ventilation system should take place within a temporal interval, which should not be very long. However it is diYcult to turn a temporal constraint of this kind into a functional constraint, unless a set of artiWcial functional constraints are introduced in the problem, designed in such a manner as to last for as long as it is necessary, in order for the criteria posed by the triangle to be fulWlled. In this way, we came up with a web of recommendations for the metro personnel’s actions, which if combined altogether along with other elements of the designed adaptive plan, they can prevent the emergence of the aforementioned patterns that have been proved to lead to suboptimal evacuation. Such recommendations for example as for the previous pattern discussed above have the following form: – The Train Driver should not open the doors, before she/he has an image of the location of the Wre. – The Train Driver should not open the doors, before she/he has realised the activation of the ventilation system. – The Train Driver should not open the doors immediately if there is an indication that one gate has been opened. – The gates of the train should not be opened, until all other trains have been led away from the area of the incident. – The Ventilation System should not be activated according to the criterion of creating an escape route towards the nearest station. As already mentioned, this web of recommendations constitutes a formative evacuation plan, as opposed to a normative one. Such a plan does not prescribe procedures to be carried out by the metro personnel, but instead, provides suggestions for action which 938 N. Zarboutis, N. Marmaras / Safety Science 45 (2007) 920–940 decrease their problem space, and at the same time permits them to adapt to the particularities of the situation at hand. 4. Epilogue The problem of designing evacuation plans has been discussed throughout this paper. The main argument of the paper was that in order for the plans to be eYcient, they have to comply with the complex mechanisms that drive the socio-technical system in crisis. Thus, any design based on predictions of future performance cannot be applied, since the dynamic character of the situation at hand can rarely meet the presuppositions of any normative plan. The proposed framework makes use of agent-based modelling. Based on the Complexity Theory, it was argued that this formalism can explicitly account for the co-evolving phenomena encountered in evacuations, oVering a formal way of modelling the triple interaction personnel-hazard-evacuees. In this fashion, more Xexible, formative designs can be developed, implementing the constrained-based approach, which is in compliance with the complex nature of the phenomena that take place during an evacuation. This framework was applied in a metro system, for the case of a Xaming train stalled between two stations. The metro on Wre has been modelled as a Complex Adaptive System. By bringing the complexity of the system out, as the product of the co-evolution of Personnel-Fire-Group of Passengers, an agent-based simulator was developed. Using this simulator, a formative evacuation plan consisting of a web of recommendations for the metro personnel’s actions was then developed. Such a plan is able to adapt to the dynamic changes during the evacuation process. The proposed methodological framework could be applied in a variety of domains. Typical examples are: – Aviation or maritime operations, involving evacuations from hazardous areas. The modelling of passengers used in the metro, could lead to solutions such as those presented in this paper. – Chemical and other large-scale installations (e.g. reWneries). The expansion of the model for hazards other than Wre, could lead to the development of evacuation plans for systems where a great number of employees would be involved. – Stadiums, Cinemas, Concert Halls and other areas of massive public accumulation. In such cases however, the simulation model will have to be three dimensional and consequently the programming of the model would be more diYcult. Additionally, it should be noted that in cases where the number of simulated agents used is large (e.g. in stadiums it could be 60.000), then the computing capacity required could be very high and the agent-based simulations can be very slow. However, for most of the situations described earlier, agent-based simulations are feasible using today’s computing capacity oVered by a personal computer. – The development of interactive applications for training and educational purposes, where actual training in the Weld is either impossible or expensive. The application of the proposed framework in other domains will also permit the assessment of its eYciency and the identiWcation of possible drawbacks that were not evident in its current implementation. N. Zarboutis, N. Marmaras / Safety Science 45 (2007) 920–940 939 References Andersen, T., Paaske, B.J., 2002. Safety in railway tunnels and selection of tunnel concept. ESReDA 23rd Seminar November 18–19, 2002, Delft University, Netherlands. Ashraf, F., Johnston, J., McAdam, C., Mckinlay G., Wilson M., 2005. The hospital evacuation simulator. Technical Report, Department of Computing Science, University of Glasgow. Cacciabue, P.C., 1998. Modelling and Simulation of human behavior for safety analysis and control of complex systems. Safety Science 28 (2), 97–110. Cacciabue, P.C., Decortis, F., Drozdowicz, B., Masson, M., Nordvik, J.P., 1992. COSIMO: a cognitive simulation model of human decision making and behaviour in accident management of complex plants. IEEE Transactions on Systems, Man and Cybernetics SMC-22 (5), 1058–1074. Casti, J.L., 1998. Would-be Worlds, How Simulation is Changing the Frontiers of Science. Wiley, New York. Channel Tunnel Safety Authority, 1997. Inquiry into the Wre on Heavy Goods Vehicle shuttle 7539 on 18 November 1996. Available from: <http://www.dft.gov.uk/stellent/groups/dft_railways/documents/page/dft_railways_ 504363-02.hcsp>. Checkland, P., 1984. Systems Thinking, Systems Practice. John Wiley & Sons, London. Cook, T.D., Campbell, D.T., 1979. Quasi-Experimentation: Design and Analysis Issues for Field Settings. Rand McNally, Chicago. Dugdale, J., Pavard, B., Soubie, J.-L., 2000. A pragmatic development of a computer simulation of an emergency call centre. In: Proceedings of the Fourth International Conference on the Design of Cooperative Systems, COOP’2000, Sophia-Antipolis, France, May 23rd–26th. Graat, E., Midden, C., Bockholts, P., 1999. Complex evacuation; eVects of motivation level and slope of stairs on emergency egress time in a sports stadium. Safety Science 31, 127–141. Holland, J., 1995. Hidden Order, How Adaptation Builds Complexity. Addisson-Wesley, Reading, MA. Holland, J., 1998. Emergence, From Order to Chaos. Oxford University Press, New York. Hollnagel, E., 1998. Cognitive Reliability and Error Analysis Method. Elsevier, Oxford. Hollnagel, E., 2004. Time and time again. Theoretical Issues in Ergonomics Science 3 (2), 143–158. Johnson, C., 2005. Lessons from the evacuation of the World Trade Center, Sept 11th 2001 for the future development of computer simulations. Cognition, Technology and Work 7, 214–240. Johnson, C.W., 2006. Using computer simulations to support a risk-based approach for hospital evacuation. Technical Report. Available from: <http://www.dcs.gla.ac.uk/~johnson/papers/G-HES.PDF>, Glasgow Accident Analysis Group, University of Glasgow. Kirwan, B., Ainsworth, L.K. (Eds.), 1992. A Guide to Task Analysis. Taylor & Francis, London. Mallett, L., Vaught, C., Brnich Jr., M.J., 1993. Sociotechnical communication in an underground mine Wre: a study of warning messages during an emergency evacuation. Safety Science 16, 709–728. Marmaras, N., Nathanael, D., 2005. Cognitive engineering practice: melting theory into reality. Theoretical Issues in Ergonomics Science 6 (2), 109–127. Oberkampf, W.L., Trucano, T.G., 2002. VeriWcation and validation in computational Xuid dynamics. Technical Report. SAND2002-0529, New Mexico, Sandia National Laboratories. OSHA, 2002. Occupational Heath and Safety Standards, Part 1910.38: Emergency Action Plans. Available from: <http://www.osha.gov/SLTC/etools/evacuation/implementation.html#authority>. Owen, M., Galea, E., Lawrence, P., 1996. The EXODUS evacuation model applied to building evacuation scenarios. Journal of Fire Protection Engineering 8 (2), 65–86. Pavard, B., Salembier, P., 2003. De l’ingénierie cognitive à la théorie des Systèmes Complexes. Un parcours d’analyse et de modélisation de l’activité centrée sur la conception. Actes du 38ieme congrès de la SELF, 24–26 September, Paris. Purser, D.A., 1992. The evolution of toxic eZuents in Wres and the assessment of toxic hazard. Toxicology Letters (64/65), 247–255. Rasmussen, J., Pejtersen, A.M., Goodstein, L.P., 1994. Cognitive Systems Engineering. John Wiley & Sons, New York. Simon, H., 1996. The Sciences of the ArtiWcial, third ed. MIT Press, Cambridge, MA. Smith, R.A., Dickie, J.F. (Eds.), 1995. Special issue: engineering for crowd safety. Safety Science 18, 237–344. UK Atomic Energy Authority, 2002. A Technical Summary of the AEA Egress Code. Technical Report AET/ NOIL/27812001/002(2), Issue 1, Warrington, UK. UK Building Research Establishment, 2004. Evacuation Modeling: GridFlow and CRISP, Watford, UK. Available from: <http://www.bre.co.uk/frs/>. 940 N. Zarboutis, N. Marmaras / Safety Science 45 (2007) 920–940 Urbina, E., Wolshon, B., 2003. National review of hurricane evacuation plans and policies: a comparison and contrast of state practices. Transportation Research Part A 37, 257–275. Vicente, K.J., 2004. The Human Factor Revolutionizing the Way People Live with Technology Routledge, New York. Woods, D.D., Roth, E.M., Pople, H., 1987. Cognitive environment simulation: an artiWcial intelligent system for human performance assessment. NUREG/CR-4862 (vol. 1&2). Nuclear Regulatory Commission, Washington, DC. Woods, D.D., Patterson, E.S., Roth, E.M., 2002. Can we ever escape from data overload? A cognitive systems diagnosis. Cognition, Technology & Work 4, 22–36. Zarboutis, N., Marmaras, N., 2002. Emergency management respecting system’s complexity: the case of Wre in a metro railway system. In: Bagnara, S., et al. (Eds.), Cognition, Culture & Design, Proceedings of the ECCE-11, September 8th–11th, Catania, Italy, pp. 275–282. Zarboutis, N., Marmaras, N., 2004. Searching for eYcient plans for emergency rescue through simulation: the case of a metro Wre. Cognition, Technology & Work 6, 117–126. Zarboutis, N., Marmaras, N., 2005. Investigating crowd behaviour during emergency evacuations using agentbased modelling. In: Proceedings of the 24th European Annual Conference on Human Decision Making and Manual Control – EAM 2005, October 17th–19th , Athens, Greece, PN19. View publication stats