1 Introduction

Driving a train in the urban environment to provide a passenger rail service is a particularly complex task [1], and train drivers of metropolitan rail systems (MRSs) work in highly dynamic socio-technical settings [2]. Research has shown that drivers function in a state of current and immediate knowledge of the driving environment. In the literature, it has been described as the state of “now” [3], where they try and meet multiple and often contradictory goals [4, 5].

In recent times, train drivers have been increasingly relied upon by their companies to perform security tasks that did not form a part of the traditional train driving job profile. The reason behind this is the growing threat of improvised explosive devices (IEDs) to urban passenger rail where the number of people killed by terrorists using bombs has been steadily growing in the last two decades [6].

The Railway Safety and Standards Board [7] of UK listed the primary goals of train drivers as follows: ensure safety (this duty takes priority over all other duties); maintain the schedule of the service (as far as possible), and if the above are covered; improve energy efficiency of service delivery and passenger comfort, while respecting standard operating procedures set by the railways union.

Security is not listed as a primary goal, and little research has been conducted on train drivers’ responsibility towards the security of passengers and their companies’ assets. Research into security has been limited for two reasons. Firstly, many of the security systems in MRSs have only been recently employed following a surge in terrorist incidents in the last few decades. Secondly, data from security procedures are not easily available to researchers because they are often sensitive and even classified [8].

Models of train driving behaviour have concentrated on safely and punctuality by studying how train drivers manage multiple workloads such as time pressure, cognitive demands of procedural tasks, and behavioural conflict between tasks.

Security needs its own specialist set of studies for the following reasons:

  • Accident risks related to safety procedures are for the most part known to train drivers. For example, they are connected to the regular characteristics of the system (e.g., brake failure, missing a signal on the track)—and can be localised due to continuous experiential learning. Security risks, on the other hand, are generally related to a potentially unknown external actor that, for the purposes of creating terror, might carry out random attacks. To that extent there is lack of reliable knowledge amongst train drivers about the nature and degree of risk posed by security threats.

  • In security operations, false and nuisance alarms are inherent to procedures [8]. Unlike in case of safety, train drivers are aware that security procedures are often performed with no certainty about the reality of the threat. Reports of suspicious items on trains almost always turn out to be innocuous [9].

  • Security domain is unique in that the immediate consequences of both excellent and poor implementation of procedures can be identical—that nothing happens, as long as there is no malicious actor present to exploit the weaknesses. Therefore, security procedures can be more susceptible to incubation of mishaps [10] than safety.

  • Performance of security procedures is a socio-technical task that requires train drivers to interact with passengers and is not limited to performing a set of purely technical tasks like braking or speed control.

This study was conducted in a Metro Rail System (MRS) in South Asia to better understand the nuances, and context-shaping features of multiple goal management by train drivers in responding to reports of a suspicious item on a moving train.

The MRS operated under a constant threat of terrorist attacks using IEDs, and on average train drivers responded to five reports of suspicious items every week. They were expected to follow a specific 20-step standard operating procedure (SOP) to assist the management of the item (usually its removal) through coordination with members of the Operations Control Centre (OCC) and the station team [11]. Discussion with other operators suggests this procedure is now widely adopted across MRSs in the region.

2 Materials and Methods

2.1 Research Approach

The study required an approach capable of eliciting knowledge of a highly skilled work process from train drivers. Other studies in this domain have shown that this type of knowledge is difficult to extract because it is wielded tacitly [12] through repetition, and rapid and automated actions in a dynamic work environment [13]. The literature endorses converging multiple techniques as the best method for eliciting expert knowledge in these real-world environments [14]. Thus, the study adopted a mixed methods approach involving observation of work in a simulator and cab rides, observation of work using videos and training media, focus groups interviews, and one-to-one interviews with experts. The field work was conducted over a 6-month period with an exploratory and “bootstrapped” research approach as part of a longer research project into conduct of security procedures on MRSs.

2.1.1 Observation of Work in a Simulator and Cab Rides

The MRS where the research was conducted used a fixed platform train driving simulator for training purposes. The simulator was built to specifications of a real-life train driving cab, with similar controls and sounds that mimicked a real train. The software in the simulator depicted the actual train driving route, and a typical practice session for a train driver in the simulator lasted 45–50 min.

Observation of drivers was undertaken in the simulator, and in three cab rides on actual trains. Notes about train driving were taken, and three informal interviews were performed with train drivers, while they were driving the simulated train, and through observation of work during the train ride. The direct methods of talking to the drivers and watching them at work were used to conceptualise the issue in the problem domain [15], and as a means of framing the ensuing focus groups.

2.1.2 Observation of Work Using Videos and Training Media

The researchers also viewed several hours of video footage of train drivers operating trains on the network. Data in the form of industry documentation were also obtained and included training media, and route diagrams. The training media were classroom presentations, text books, and copies of the security procedure that were given to all train drivers during the year-long training session at the MRS.

2.1.3 Focus Groups

A total of six focus groups were conducted with five train drivers in each group, resulting in a total sample of 30 drivers. Each session with the focus groups lasted approximately one hour. Table 1 shows an overview of the focus group protocol that was used to structure the interviews.

Table 1 Overview of the semi-structured focus group interviews
Full size table

2.2 Participants

Thirty train drivers (male = 28; female = 2) gave informed consent to participate in the study. Their age was in the range of 24–34 years, with a mean age and median age of approximately 26 years. Given that the retirement age is sixty in this country, this convenient sample was therefore relatively young.

The participants had volunteered to take part in the study from a total pool of sixty drivers who were working for this organisation. At the time of the study, the participants had undergone 12-month classroom training to prepare them in driving MRS trains, another 6-month training on a simulator to gain train driving experience (range 40–45 h, Mdn 42 h, mean 42.25 h, SD 1.72), spent 3 months on trial runs where they drove MRS trains without any passengers, and another 6 months driving the MRS trains in real-life working conditions with passengers on board.

Both during their classroom training, and while driving the simulated train, the participants rehearsed various SOPs, including the procedure corresponding to the report of a suspicious item on the train. In real-life working conditions, all the participants had received the report of a suspicious item on the train at least once, with a maximum of six reports received by two participants.

2.3 Ethical Issues

The researchers were aware that the participants in the focus groups would discuss deliberate rule violations, make comments critical of procedures framed by the management, and admit to their inability to meet all the demands of their job. Therefore, every care was taken to ensure that the responses could not be traced back to individual participants. The participants were informed that their names would be removed from individual data units, and specific comments that could unintentionally identify a participant were not reported verbatim in the dataset.

3 Theory/Calculation

3.1 Data Transcription

The foundation of the focus group sessions was a specially designed scenario simulation task adapted from route invention task technique to elicit knowledge from train drivers [16]. The task was introduced 15 min after the start of the interview and required each participant to generate a hypothetical scenario starting with the report of a suspicious item from a passenger while driving a train. The participant then voiced details of situational assessment, goals that they were expected to fulfil, strategies adopted to meet those goals, decision points in the process, trade-offs between goals, and rule violations. Each participant walked through the scenario in a mix of English and the local vernacular language with the rest of the group listening and contributing their viewpoint through comments.

By asking participants to simulate their role in such a scenario, the task stimulated knowledge acquisition from situational insight. It drew on principles from the critical decision method [17], describing the steps in problem solving on the way [15]. The “invention task” technique has been used by researchers to study Signal Passed at Danger (SPAD) scenarios, and gaining insight into driver decision-making in multiple environments of urban commuter rail, passenger trains, and freight rail [16].

Transcripts were generated for each of the six focus groups, resulting in thirty individual scenarios describing what drivers would do following the report of a suspicious item on board by a passenger. The entire dataset was collected by a single individual. The participants’ statements were recorded verbatim. Because the sentences included words in the local vernacular language as well as in English, all the quotes were first translated into English and the grammatical structure improved in several cases. Although all efforts were made to keep the original meaning, some of the nuances in the sentences could have been lost in translation. No information was added, however, and we do not feel the message was significantly changed.

3.2 Data Analysis

The analysis followed a process of open coding, category development, and thematic coding. Categories were drawn from the open coding process, including coding of phrases, comments, and features of the transcripts, which grounded findings in the data [18]. Qualitative analysis methods have been used to study performance of operatives in the railway domain in safety studies [19, 20]. The purpose of the analytical process was to present the findings in a clear model of explanation. There were 38 units found in the data. The units were used to develop categories that were grouped into themes. Figure 1 represents the key themes that emerged for managing reports of suspicious items on a moving train and the units of analysis.

Fig. 1
figure 1

Key themes for managing reports of suspicious items on a moving train (items identified in interviews in italics)

Full size image

The themes were then used to answer the research question identified in the introduction:

What are the nuances, and context-shaping features of multiple goal management by train drivers in responding to reports of a suspicious item on a moving train?

The analysis was carried out using a method inspired from the Delphi technique, a widely used and accepted method for achieving convergence of findings concerned with real-world expert knowledge [21].

While the overarching themes were derived deductively, analysis within each of the themes was inductive (following [22]). Table 2 gives a non-exhaustive list of primary theoretical sources that were used to draw overarching themes using deductive knowledge, and accompanying inductive findings from the data.

Table 2 Sources of deductive analysis (with examples in brackets) and accompanying inductive findings from data
Full size table

3.3 Data Validation

Data validity was assessed by a reference group of subject-matter experts. This approach has already been used in studies involving train driver data [37, 38]. A panel of five train driving instructors with a minimum experience of ten years in driving trains reviewed the coding, category development, and thematic analysis of the data. Experience gained throughout ten years of practice conferred on them the status of experts in this field [42]. They cross-checked the data analysis in multiple rounds to ensure consistency in the process.

4 Results

The collected data provide critical insights into how train drivers of the MRS were managing reports of suspicious items on a train. The analysis revealed four major themes:

  1. 1.

    Perceived pressure from multiple goals in conducting the security procedure, which featured in 93% or 28 out of 30 scenarios.

  2. 2.

    Perceived conflicts between goals, which featured in 83% or 25 out of 30 scenarios.

  3. 3.

    Relationship between perceived pressure from goals and the conditions within which the security procedure was expected to be performed, which featured in 90% or 27 out of 30 scenarios.

  4. 4.

    Perceived effort in performing a task in the security procedure, which featured in 76% or 23 out of 30 scenarios.

These themes and the subordinate categories are represented in Fig. 1. Each of the themes is discussed, and sample data (direct quotes of participants) are provided in support where necessary.

4.1 Goals

4.1.1 Individual Goals

The drivers considered certain parts of the security procedure closely aligned to their primary role as a train driver, and therefore were self-motivated to make no errors in those parts of the procedure. One driver described the task of stopping the train at the station as follows: “I have to stop the train at exactly the right spot on the track dozens of times every day. It is something that I should be able to do without error even in my sleep. It is a basic part of train driving irrespective of whether it is part of a security procedure or not”.

At an individual level, the drivers also feared penalty or censure from the management if they made errors on certain other parts of the procedure. Penalty in the form of formal warning given by managers, issuance of a show-cause notice, loss of pay, suspension from work for a certain period of time, and in extreme cases even dismissal from service were listed by drivers as negative consequences of failure to perform certain tasks in the security procedure. The drivers therefore avoided making errors on these parts of the procedure to escape punishment.

One driver was quoted in the focus group saying, “The managers expect us to receive calls made by passengers. If we do not even register that there is a suspicious item on the train then clearly it is a serious lapse that can lead to casualties. Consequently, the errant driver can be punished with a fine or temporary suspension from work”.

4.1.2 Organisational Goals

4.1.2.1 Safety

All the train drivers in the focus groups were unanimous in their belief that safety of passengers using the MRS was a primary goal of the organisation. Even minor injuries to passengers due to falls from sudden braking or jerky driving were considered unacceptable from an organisational point of view. The drivers’ emphasis on absolutely safe transit of passengers could be understood as an organisational core task (OCT), as discussed by Reiman and Oedewald [29]. The drivers admitted that any injury to passengers during operations was considered a serious mishap by the managers, and invited personal penalty and disciplinary action in the short term, and negative consequences for drivers’ career progression in the longer term.

While holding that they were responsible for safety of all passengers using the system, the drivers felt that their primary responsibility was towards the passengers already on board the train, and secondly for those waiting at stations to board the train.

The company has zero tolerance for even minor injury to passengers using the system. All the employees who work in operations have received extensive training to prevent injury to passengers. Station managers, and platform teams are responsible for passengers waiting for trains. As drivers, every person on board the train is our responsibility—if anything untoward happens then we are the ones answerable.

4.1.2.2 Security

The train drivers recognised that like safety, secure transit of passengers was a key organisational goal. “The security procedure is performed because the consequences of a bomb explosion on a train will be catastrophic. It will cause death and injury to passengers, and the result will be very similar to a major incident like a train derailment”. The focus groups emphasised that they understood the serious nature of meeting security goals because the MRS operated in an environment where there was a credible terrorist threat based on past attacks on other rail networks in the city. “The presence of guards at the stations is a constant reminder that security of passengers is of constant concern to everyone in the system”.

4.1.2.3 Service

Train punctuality was an important operational goal that train drivers are required to satisfy in their conventional role [43]. If trains were delayed on the network, then the whole MRS could be thrown out of schedule, which in turn would have negative commercial consequences for the railway company [4]. Under the train services agreement in place, the train drivers could face disciplinary action if they regularly failed to drive according to their schedule. In practice, train drivers could be asked for a written explanation if they drove behind schedule more than three times a month; during the interviews drivers admitted that seven of them had actually been asked to do so by their managers. The importance of the punctuality goal was also reflected in the presence of potential financial sanctions: drivers’ managers could even lose a part of their monthly income in extreme cases.

One driver described train punctuality as a “basic performance indicator for any train driver. Every time we finish a journey around the network behind schedule, we are expected to give a written report listing reasons for the delay. The subsequent action by the management is taken on basis of the report, and if the reasons given by the driver are not found satisfactory then he or she can face disciplinary action. Therefore, we aim to remain absolutely punctual in all journeys”.

4.2 Perceived Conflict Between Goals

It should be stated here that the perception of organisational goals while performing the security procedure was not straightforward in actual driving conditions. Analysis of data from the focus groups revealed that the train drivers often perceived a conflict between security and the other two goals of safety and service.

4.2.1 Safety–Security Conflict

Train drivers believed that certain tasks in the security procedure held potentially negative consequences for the safety of passengers. This included making an announcement to warn passengers of a potential explosive device on the train, and increasing the speed of the train to reach the next station quicker. “If I make an announcement to warn passengers on the train of a likely explosive device then there is a good chance that the passengers may panic. When the train is crowded during peak hours, the passengers will try to rush out at the next station which can lead to injuries, and even a stampede”.

Procedure dictates that I increase the speed of the train so that we reach the next station quickly where the suspicious item can be removed from the train. But in reality increasing the speed of the train changes all the calculations for braking, and there is a risk that the train may not come to a halt at the right spot, stop with a big jerk, and in extreme cases even get derailed. All this poses a real risk of injury to passengers.

The drivers said in focus groups that the security threat from a suspicious item on the train was conditional on its being an actual explosive device—the likelihood of which they rated as extremely low. At the same time, they felt that the perceived impact from carrying out certain security tasks, such as panic amongst passengers, was both more immediate and probable.

The drivers made it clear that they prioritised safety of passengers as their primary responsibility even while conducting security procedures. Therefore, when faced with a conflict, the drivers preferred not to perform security tasks that they perceived negative to passenger safety.

4.2.2 Service–Security Conflict

Train drivers emphasised that every time a suspicious item is reported on the train the subsequent security procedure to remove it almost always affected the punctuality of the train. “At the least, the dwell time at the next platform increases from the regulation period of 30 s. It always takes more time than that for the station team to locate the suspicious item and remove it”. Therefore, the drivers admitted that whenever a suspicious item was reported they perceived a negative effect on punctuality of the train. “Suspicious items are a headache. The train gets delayed, and in my experience it has always been because of something that a passenger forgot, and not an actual explosive”.

4.3 Driving Conditions

Drivers said that the driving conditions in which they received the report of a suspicious item had an impact on their conduct of the security procedure. The attributes of specific driving conditions that have an impact on the themes discussed so far are listed in Table 3.

Table 3 Attributes of different driving conditions
Full size table

4.3.1 Train Driving During Peak Hours of Operation

Drivers identified train driving during peak hours of operation as more stressful than driving during non-peak hours. Rail agencies describe peak hours of operation as periods running up to three or four hours during the day in which ridership on the network is well above passenger demand levels outside this period [44]. In the MRS under study, the number of trains operating on the network was doubled during peak hours to meet the increased demand from the ridership.

Train drivers identified the following reasons for why they considered driving during peak hours as more stressful than non-peak hours.

4.3.1.1 Passenger Safety

Large crowds on the network create more chances of injury to passengers on the train, waiting at platforms, and while boarding or leaving the train. “During peak hours there are more passengers both on the train, and at the stations. Passengers can get injured on the train if we brake suddenly. There may even be fatal incidents at the platforms if they are standing beyond the yellow line, and get hit by a train coming in too fast. So we have to be very careful while driving”.

The drivers emphasised that they were reluctant to perform security tasks that they perceived as negative to passenger safety during peak hours because of relatively large number of passengers on the train during the period.

4.3.1.2 Punctuality

Since the number of trains on the network is doubled during peak hours of operation, driving the train on time becomes even more important for the train drivers. “Minor departures from the timetable by one train can throw the whole network out of gear, adding to time pressure in which the drivers work”.

4.3.1.3 Fatigue

Drivers said in the focus groups that the amount of time they got to rest between two train journeys had a bearing upon their fatigue and stress levels. During peak hours of operation, this rest period was ten to fifteen minutes between two subsequent trips, as opposed to 25 min during non-peak hours.

“The relatively large number of passengers, time pressure, and reduced time to rest makes train driving during peak hours especially stressful. We do not get time to relax in the drivers’ room at the end of a round trip. There is just enough time to have a drink, and get back to the job. In contrast during off-peak hours we can have tea, chat with other drivers, watch some television and rest before going back to the next journey”. In the focus groups, the drivers said that owing to additional workload and fatigue, there was a greater likelihood that they made mistakes or took shortcuts in following a security SOP if a suspicious item was reported during peak hours.

4.3.2 Train Driving During Periods of Specific Warnings about Terrorist Attacks

On days that a specific warning was issued about a terrorist attack, the drivers believed that there was a greater probability of a suspicious item on the train being an actual explosive device than on other days of operation. “There is greater awareness of threat on such days because we believe that the likelihood that a suspicious item could be an actual explosive, and not a harmless piece of left luggage, is more”.

The change in threat perception of the drivers ties in with the psychometric paradigm that hypothesises people’s subjective risk assessment changes with the nature of information they are supplied. A specific warning about the likelihood of an attack increased its perceived probability in the minds of the drivers [45].

The drivers also indicated that they changed their security behaviour when their perception of the risk posed by the suspicious item increases. “It is very important on such days that we collect all the possible information about a suspicious item on the train. Everyone else in the procedure relies on the information we supply to remove the item from the train”.

4.4 Effort in Performing a Task

Drivers identified that certain parts of a security procedure were cognitively less demanding than others. These were tasks that are performed regularly under ordinary train driving conditions, and therefore open to practice effect through high frequency of mechanical performance.

We open doors of the train at every station. I must have done it thousands of times. The only difference during security procedures is that the door is opened not only for the passengers, but also for the station team to get on the train to remove the suspicious item.

The same driver contrasted this frequently performed part of the procedure with the less frequent corollary part.

The instinct is to close the door after 30 s since that is the usual dwell time at a station. However, in the security procedure we have to remember to keep the doors open until the station team has exited the train. That requires more concentration and engagement with the task. I admit that on this part of the procedure I have made mistakes, and closed the door without verifying if the station team has exited the train or not.

5 Discussion

SOPs are widely used in railway operations because they are explicit, finite instructions that provide detailed prescriptions to the operative staff on what to do in response to predicted emergency situations [46]. If implemented properly security SOPs mitigate the probability of harm to passengers and assets from a malicious actor. Poorly implemented strategies on the other hand may result in limited risk reduction at best, or can even create new risks that did not exist before [11].

Contemporary work is often complex because it is dynamic [47], and managers frame rules and procedures for workers in an effort to tame this complexity [48]. However, the workers may view the rules as inconvenient administrative tasks that take time away from achieving the real work and generate their own heuristics to manage uncertainty in the work process [49, 50]. This study was an effort to understand strategies adopted by train drivers to manage a security risk while performing their primary duty of providing safe, on time, and comfortable travel to their passengers.

The study showed that drivers take shortcuts in completing certain tasks in the security procedure when they work under time constraints, or if a task is perceived to have a negative impact on other goals. They feel the pressure of maintaining punctuality while performing security tasks. In that sense like safety, drivers perceive security too as an “eternal killjoy” [51, p. 114].

A key finding of the study was the perceived conflict by train drivers between meeting safety and security goals. It emerged in the interviews that the drivers prioritise safety of passengers over performance of certain tasks that are listed by the management for mitigation of a potential security risk. More so if they perceive a conflict between the completion of a security task and safety of passengers on board the train, the drivers deliberately choose not to perform the security task.

The analysis of interview data reveals that the perceived conflict between goals, the pressure under which train drivers find themselves, the decisions that they take to perform or not perform tasks in the security procedure, and their threat perception are contextualised within changing driving conditions. The change in driving conditions takes place on a daily basis as hours of operation alter between peak to off-peak passenger load. The conditions also change every few months when the drivers are informed of a specific terrorist threat to the rail network.

5.1 Recommendations

The managers could consider relaxing the emphasis on punctuality, and the subsequent penalty clauses for train drivers if the train is delayed due to a security incident. In practice though, it will be harder for the management to accept delays if a large number of suspicious items are reported on the MRS network every day.

Train operators could also consider improving the realistic nature of driving conditions in simulators when drivers train for reports of suspicious items. Drivers who were interviewed for this study said that a simulator did not artificially recreate the pressures of a realistic driving environment in terms of receiving the reports of a potential explosive on the train. Therefore, even though the simulation environment could look convincing for ordinary train driving, and technical tasks associated with it, it was not sufficiently realistic to generate the same level of stress and motivational pressure [52] that would exist with the threat of a potential explosive device on board a train.

In the classroom environment, trainers could emphasise the big picture of trying to meet multiple goals in a dynamic, high-pressure railway environment. This would encourage discussion on prioritisation of goals and deliberate rule violation by drivers to meet the demands of their job. The trainers should also ask drivers to openly state if they consider certain parts of a management-mandated procedure to be impractical, and not implementable in actual driving conditions. This will be in contrast to traditional methods of teaching where drivers are expected to learn ideal work procedures with an expectation that they will follow them to the letter in working conditions.

5.2 Limitations of the Study

The data collected during the study reflected the opinions, prejudices, and nuances of 30 train drivers from a single MRS organisation. To that extent there is a limitation on how accurately the views of the participants reflected the reality of train drivers’ response to reports of a suspicious item on a train. Moreover, all the drivers who participated in the study were relatively young and fresh out of training. Therefore, it is possible that their views on management of a suspicious item on the train were different from older, more seasoned drivers with a longer experience of driving trains and responding to a large number of security incidents.

The focus group format of the interviews facilitated discussion amongst the participants, but it suffered from the widely recognised drawbacks of the technique. We cannot discount the possibility that some drivers could have resisted giving a complete account of the pressures they felt, or the shortcuts they take on the security procedure because they wanted to maintain a certain self-image of efficiency in front of their peers. The drivers may also have felt the pressure to maintain group consensus, agree with their peers and that in turn could have drowned individual dissenting views. Therefore, the focus group data used to generate themes for the study cannot be considered an exhaustive and completely accurate description of train driver behaviour in a dynamic work environment.

An important part of the focus group interviews was generation of a hypothetical scenario that required each participant to imagine the report of a suspicious item on the train, and then talk through it. The contribution of participants was dependent on how rich an imagery they could generate, and their individual creativity. This may have restricted some of the participants from contributing as much as other participants who could be more imaginative, and vocal in generating the scenario. The result was that the study could have missed out on eliciting exhaustive information from some of the participants.

Cab rides were undertaken as part of the research work, but there was no report of a suspicious item during this part of data collection. The researchers had to rely on train drivers’ description of a hypothetical security situation, and their views on what they would do if they had to perform the security procedure. Again there is a non-negligible possibility that the drivers were understating or overstating their coping strategies.

6 Conclusion

This study presented findings associated with management of a security threat by train drivers in real-life operational conditions of a MRS. The link between risk perception and subsequent risk mitigation behaviour has been empirically shown to exist in many fields, such as nuclear engineering [53], epidemiology [54], automobile safety [55], and construction safety [56]. This is the first study of its kind on risk perception by train drivers while dealing with reports of a potential explosive device on the train.