Assessing network cognition in the Dutch railway system: insights into network situation awareness and workload using social network analysis

This study takes upon a group cognition perspective and investigates the cognition of railway traffic operations, in particular railway traffic and passenger traffic control. A table-top simulation environment is used to conduct the study, in which its design principles are elaborated upon. Network cognition is operationalized through communication content and flow and studied through social network analysis (SNA). SNA centrality metrics, such as degree, closeness and betweenness, are assessed in these networks. As part of the study, two cases are compared where operational procedures for disruption mitigation are varied. The dependent variables are the different types of communication network structures that are conceptualized for communication flow and semantic network structures for communication content. Although the quantitative comparisons between the two operational procedures regarding their communication flow and semantic networks showed no significant differences, this study provides a methodology to compare different conditions.


Introduction
When train traffic and network operations become disrupted, railway traffic control is mostly a job for humans, sometimes with the help of decision-support tools. Railway traffic controllers are challenged since the interpretation of a situation implies coupling a large number of often fuzzy indications, of which the consequences are combinatorially explosive. Next to these complex and ill-defined situations, the work that railway traffic controllers carry out is under high time pressure and with high stakes, often in close collaboration with other operators in different locations (Farrington-Darby et al. 2006;Funke 2001).
The application of computer simulation is rather limited when one wishes to make claims regarding the impact of certain innovations, namely changes in the railway system on, e.g., operations in railway traffic control (Van den Hoogen and ). An important indicator in the assessment of these changes is the implication for the cognition and decision making of railway traffic controllers. The introduced innovations are mostly related to process optimizations to solve railway track capacity issues in a highly dense and space-constrained country such as the Netherlands. As there is a need to test the impact of alternative modes of the system, the Dutch railway infrastructure organization ProRail turns to single-actor human-in-the-loop and multiactor table-top simulation environments as a platform to test future configurations of the system and to train personnel to work with them. Multi-actor table-top simulation environments are the most commonly used due to their short development time and low development costs and were used in the current study (e.g., Meijer 2012).
Understanding the cognition of operators in complex socio-technical systems is crucial for training, safety, 1 3 performance management, but also for the design of the system in terms of level of automation and interface design (Farrington-Darby and Wilson 2009;Wilson and Norris 2006). More specifically, cognitive constructs such as situation awareness (SA) and workload can be seen as focal concepts. SA was originally introduced as a predictor of good decision making. It is defined in a broader sense as the ability to see the 'big picture' and to 'know what is going on', which is a result of an individual's cognitive processes (Endsley 1988(Endsley , 1995Tenney and Pew 2006). As with other complex control tasks such as in air traffic control, the development and maintenance of SA in railway traffic operations are crucial for operators (Farrington-Darby et al. 2006;Golightly et al. 2010). In contrast to studies on SA, however, in the railway sector a stronger focus has been put on the role of workload and its understanding, due to its strong link with safety and performance (Pickup et al. 2005;Young et al. 2015).
Research on SA has also been facing challenges in finding a convergent measurement approach, particularly when it comes to analysis on a team or network level. These challenges are particularly caused by fundamentally different theoretical and methodological approaches for individual and team cognition ). As such, it has been argued that cognitive structures, such as SA in a group setting, do not necessarily reside solely in the individual, but rather as a whole in the team (e.g., team or group cognition) or additionally including non-human artefacts in the system (e.g., distributed situation awareness following distributed cognition) (Endsley 1995;Cooke and Gorman 2006;Letsky and Warner 2008;Salmon et al. 2009;Stanton et al. 2010). It has also been stated that interactions between operators in a network are more relevant than for instance the maintenance of an operator's situation awareness (Salmon et al. 2009). Therefore, team process behaviors as communication and coordination are identified as possible indicators of cognition within the team or system (e.g., Cooke and Gorman 2009;Letsky and Warner 2008). As such, following macrocognition as theoretical paradigm, cognition should be measured at its respective unit of analyses. This implies that beyond the individual level itself, cognition resides on higher abstraction levels. For instance, communication can be an indicator of cognition on a team level (interrelations between co-workers) or on a network level (interrelations of a set of teams). When analyzing on a system level, nonhuman artefacts such as automation or decision support tools should also be considered as cognition on this level. In the current study, multiple dyadic teams and human interactions, not including artefacts, will be investigated, taking upon a team/group cognition theoretical stream and focusing on insights at a network level.
Although there have so far been only limited studies on network SA using social network analysis (SNA), the potential of SNA has been identified as a tool to study the network situation awareness by analyzing patterns of communication or content flow between actors within the system (Foltz and Martin 2008;Houghton et al. 2006;Sorensen and Stanton 2011;Stanton et al. 2006;Weil et al. 2008). Through SNA metrics such as 'centrality' or 'closeness', positions of individuals in a communication network can be analyzed. This can be achieved by identifying an individual's central position in the network based on the number of communication exchanges with other individuals in quantitative terms or in qualitative terms using the graphical representation of the network. For instance, with measures of 'centrality', certain individuals can, therefore, be pinpointed as key figures in a network of individuals, who maintains contact with many individuals in that network. As such, these findings provide insights into the interaction, the performance of teams and organizations and ultimately situation awareness (Houghton et al. 2006;Weil et al. 2008).
The present study utilized table-top or paper-based simulation environments in which the emphasis is on the exploration of the socio-cognitive dynamics of, for example, the network situation awareness of a team of professionals within a part of the Dutch railway system. These multi-actor table-top simulations are predominantly low-tech in the sense that they make use of analogue materials to represent components of the systems and they can also be found in emergency services simulations (e.g., Houghton et al. 2006). Operators often perform their own role in these simulated environments. Additionally, given the purpose of the table-top simulation to test different types of procedures in a subset of the railway system, the aim of the study was threefold: (1) to explore the cognition of the current railway network through different communication flow and content network structures, namely as indicators of network situation awareness and workload, (2) to explore the analysis of comparing two types of procedures through quantitative measures using SNA as a method, and (3) to provide insights into the use and design of table-top simulations.

Railway traffic and passenger traffic control in the Netherlands
Worldwide reforms in the governance of, amongst others, the railway sector took place during the 1990s with different implementations in terms of structure (horizontally and/ or vertically separated) and ownership (franchises, government, private, etc.) (Owens 2004). This diversity is not only reflected in the organization of train traffic operations, but also in the automation of control and interaction with control (Golightly et al. 2013). For instance, in Great Britain automatic route setting (ARS) is used widely, however not entirely across the country. As a result, the role of a train 1 3 traffic controller in these areas is divided between a dispatcher and a signaller. More differences in railway traffic control characteristics exist between countries, but remain limited (e.g., Golightly et al. 2013;Schipper and Gerrits 2018). In 1995, the Dutch government de-bundled the national railways into rail infrastructure management-ProRail-and Dutch Railways (Nederlandse Spoorwegen; NS), the principle train service (Algemene Rekenkamer 2012). Since then, ProRail has been a separate organization focusing on the rail network's governance (e.g., extension, maintenance, safety and capacity allocation). As such, one of its tasks is train traffic control. Railway traffic operations have a decentralized command and control structure as the hierarchical structure is informal, i.e., there is a distributed responsibility. The three main functions within the Dutch railway traffic control are (see also Fig. 1) (e.g., Aydoğan et al. 2014): • Train traffic controller (TTC): Based at a regional control center and responsible for a sub-region. A TTC ensures the availability and safety of the infrastructure capacity in the current situation. In the Netherlands, the roles of signaller and train dispatcher are combined into the role of TTC. A TTC uses a traffic management system (TMS), which means that in normal conditions the train traffic flow is regulated automatically according to the planned time table, and the TTC only needs to monitor for deviations. The number of TTCs per regional control center depends on the size and complexity of the regional area. • Regional network controller (RNC): Responsible for optimizing and managing train activities at a regional level through planning and coordination. The contact between an RNC and TTCs is, therefore, mostly related to ad hoc changes to the time table or train traffic flow (e.g., order requests) or disruptions in the railway network. In more complex regional areas, two RNCs may be present to share the workload. Both TTCs and RNCs operate from the same operational control room in a regional control center. There are currently 13 regional control centers in the Netherlands. • National network controller (NNC): Responsible for optimizing and managing train activities at a national level through planning and coordination. An NNC coordinates activities between RNCs in the case of failures, incidents and emergencies, or ad hoc requests from the railway network. An NNC also handles all long-distance trains within and beyond the country's borders. Two NNCs operate from the Operational Control Center Rail (OCCR), where they report to a directing NNC, who is the contact point for passenger and freight traffic operators. These parties all operate from the same operational control room. Although the organizational structure of railway traffic operations may seem hierarchical, these parties do not formally report to each other (Werkwijze Verkeersleider 2012).
Other operational roles within ProRail are the operators that coordinate with emergency services in the control room (back office, BO) and the emergency coordinator (EC). The BO is in contact with the EC, who will be present at the physical location of the emergency, for instance in the case of a collision.
However, disruption management within the railways also implies the involvement of other parties due to the dispersion of responsibilities within the railway system. As such, Dutch Railways is responsible for the rolling stock and crew management. Previous research has investigated the consequences of debundling the railway sector, which resulted in, among others, an 'archipelago' of operators (Van den Top and Steenhuisen 2009). In its current form, traffic control in the railway sector can be characterized in terms of multi-agency coordination (Salmon et al. 2011). Due to the historical ties between the two organizations, the organizational structure of Dutch Railways' passenger traffic control resembles that of the described roles within railway traffic control; that is, the TTC coordinates with the regional passenger traffic junction coordinator (RPTJC). The contact for the RNC is the regional passenger traffic monitor (RPTM) and the NNC coordinates with the national passenger traffic controller (NPTC). Similarly, the first two operators work in the same regional control center, of which there are five (NS 2014). Both the NPTC and the NNC operate from the Operational Control Center Rail. The regional passenger traffic material and passenger coordinator (RPTMPC) is an additional role that coordinates with train drivers (TD) and coordinates activities related to the availability of rolling stock during disruptions. The passenger information dispatcher (PID) is part of the passenger traffic organization; however, he or she is co-located with the train traffic controllers to understand and timely inform about the situation and consequences for passengers.

Macrocognition in socio-technical work environments
The importance of studies on teams has become more pronounced as team-based systems are increasingly implemented ). In addition, because work environments have become more complex and dynamic, teams more often work in virtual or geographically distributed environments and are more reliant on technology, and team compositions are more heterogeneous (Tannenbaum et al. 2012). Especially in decentralized command and control structures where team process behaviors, such as communication and coordination, are crucial for team performance, teams often consist of heterogeneous skilled operators . As such, the traditional information-processing approach that uses aggregation methods on internalized (individual) knowledge to capture the cognitive structures and processes within teams may be seen as too simple (Cooke et al. , 2013Millot 2015). Instead, measurement of mental processes at the team or higher levels of analysis can be linked to externalized representations, i.e., observable actions. This theoretical stream stresses the existence of macrocognitive processes, in which a number of theories are connected, such as distributed cognition, activity theory, and group cognition (Letsky and Warner 2008). These theories differ from one another in the role that cognitive functions and knowledge play, e.g., distributed cognition states that knowledge can reside in non-human artefacts vs. knowledge as a holistic entity in a group of humans in accordance with group cognition. Similar to group cognition theory, team cognition theory recognizes that cognition is more than the sum of individuals, and, therefore, should be measured and studied at the team level (Cooke et al. 2013). In essence, these theories share the same theoretical paradigm and, however, are used interchangeably by researchers (e.g., Letsky and Warner 2008). For consistency reasons, the term group cognition is predominantly used throughout the article. Consequently, depending on how cognition in teams is approached, different measurement techniques can be applied (Wildman et al. 2013). The group cognition perspective emphasizes that team cognition is team interaction and should, therefore, be directly measureable through dynamic communication and patterns in coordination (Cooke et al. , 2013Letsky and Warner 2008;Stahl 2006). Using communication analysis as a reflection of team cognition can be compared to using verbal protocol or think-aloud procedures to derive knowledge from individuals Cooke and Gorman 2009). Communication can also be seen as an important indicator of team behavior that affects the development of team 1 3 SA (Salas et al. 1995). From a macrocognitive approach, team SA can be measured by observing the coordinated response of the team to a situational change, organization SA through network representations in terms of semantics and flow analysis, and system SA through the analysis of propositional networks Stanton et al. 2006;Weil et al. 2008).
As for the unit of analysis for railway traffic operations, railway traffic and passenger traffic control consist of many small, often dyadic teams. Because the table-top simulation environments involve many of these small teams, the level of analysis was conducted at the network level, thus investigating network cognition using a group cognition perspective.

Communication analysis
The operationalization of communication has resulted in a number of types in terms of communication content (what is said), communication flow (who talks to whom) and communication manner (how it is said in a verbal and non-verbal manner), in which the first two types have been primarily investigated through static or sequential communication aspects (Cooke and Gorman 2009;Cooke et al. 2008). An example of static communication flow is the total amount of time that person A talks to person B, whereas a sequential communication flow can be illustrated by the number of times that person A talks, followed by person B. Static communication content can be exemplified by the number of arguments, whereas sequential communication content would be the number of arguments followed by insults. In the current study, the focus is on the use of static characteristics of communications, through the use of SNA as a tool that can provide quantitative measures for the communication network holistically (e.g., Houghton et al. 2006;McMaster et al. 2005).

Communication flow
Although the analysis of the communication flow seems less rich compared to the analysis of communication content, there are preliminary indications that the former is as promising as the latter (Cooke and Gorman 2009). Methods of analyzing communication flow are: dominance (speech quantity among team members), flow quantity (amount of speech to and from team members), flow sequence (sequential patterns of speech), stability (variations in speech quantity) and flow as a team process surrogate (an estimation of team process behavior through communication data) (Cooke et al. 2005;Kiekel et al. 2004). Haythornthwaite (1996) posits SNA as an approach and technique to investigate exchanges between actors (e.g., individuals, groups or organizations) regarding resources. Resources can be understood in terms of both tangible matters, such as money or services, and information. Thus, the exchange of patterns of information could be revealed as a social network, in which actors represent the nodes and the ties that connect the nodes represent information exchange. The connection between communicators in the network can be assessed in terms of direction (directed vs. undirected flow of information) and strength (e.g., frequency and duration of the contact) between nodes. A number of studies used the flow of information to study different actor-to-actor network structures and their performance using SNA, since this can also provide insights into the division of labour in a network (Baber et al. 2013;Houghton et al. 2006;McMaster et al. 2005;Weil et al. 2008). Herein, communication flow is captured through the communication between actors. Investigations on the communication flow in emergency service operations with SNA used social network metrics, such as degree and closeness as centrality measures (e.g., Houghton et al. 2006). Centrality measures can be related to, for example, the extent to which a certain operator contributes to the flow of communications.

Communication content
One way to analyze communication content is to use latent semantic analysis (LSA), in which indications have been found a strong relation with performance-based scores (Cooke and Gorman 2009). Alternative methods that can be used for communication content evaluation include both word counts and keyword indexing (KWI). Word count looks into, e.g., the average number of words in transcripts or per utterance and is correlated with LSA vector length, whereas keyword indexing uses mathematical approaches to, for instance, compute vector lengths and distances between utterances in a transcript (Cooke et al. 2005). Following this method, indications for group cognition could be found in conceptualizations, such as the mean of the similarity matrix based on all utterances and similarities between subsequent utterances.
Another way to conceptualize communication content is to create concept maps that capture a network structure of the task knowledge holistically . A number of studies apply network or social network analysis to the assessment of concept maps or propositional networks and semantic networks (or knowledge-to-knowledge networks), in which communication transcripts might be used (e.g., Weil et al. 2008;Stanton 2011, 2012). The difference between the use of propositional networks and semantic networks is that the former entail propositions in terms of a basic statement and links between nodes are labelled (Salmon et al. 2009). The use of SNA on this type of network has shown to be a sensitive measure to assess distributed situation awareness, that is SA on a system level, 1 3 by identifying differences between two scenarios (Sorensen and Stanton 2011).
In the present study, the focus is on the selection of various SNA metrics to provide an in-depth analysis of the communication flow and communication content between railway and passenger traffic operators in two scenarios with different but equally severe disruptions. The emphasis also lays on analyzing group cognition as part of interactions between humans; i.e., through their communication and information exchange.

Design of the table-top simulation environment
Many of the studies that investigate the workload, situation awareness and decision making of operators in complex socio-technical systems have been heavily researched in highly realistic settings, such as human-in-the-loop simulators, or in naturalistic environments (e.g., Hauland 2008;Klein 2008;Mogford 1997). The notion that close-to-real environments provide the ability to portray the naturalistic behavior of individuals has been a strong driving force for the development of simulators (Caro 1973). However, human-in-the-loop simulators are often accompanied by high development costs. On the contrary, the development of table-top simulation environments is in general rather rapid and low cost. However, designing table-top simulation environments as an alternative to close-to-real simulators is no trivial path. This section provides a description of the design of a table-top simulation environment, as the design of the simulation environment is usually not that elaborately touched upon in studies (e.g., Houghton et al. 2006). The focus in the present study was on designing a tabletop simulation in which parts of the system would be changed and then tested with human operators. The challenge of using this type of simulation environment for research purposes lies in obtaining a high degree of structural and process validity, such that participants experience the simulated environment as their normal work environment; that is, obtaining a psychological reality (Raser 1969). Provided the fulfilment of these three validity types, a high predictive validity can be assumed. The use of indexical and symbolic simulation principles may capture the essence of the actual work environment such that participants experience a high psychological reality and the external validity of the simulation outcomes can be ensured (Dormans 2011). Indexical simulation refers to the degree of the causal relation between rules of the simulated and the actual work environment. Symbolic simulation refers to the resembling mechanisms of the actual work environment in the simulation environment. Also non-tangible elements, such as (organizational) culture, can be captured in these types of simulated environments (Duke and Geurts 2004;Meijer et al. 2006). Subsequently, a number of practical guidelines for its development are followed: 1. Identification of the purpose of the simulation-which parameters of the system, (e.g., infrastructure, roles, procedures) should be changed. 2. Assessment of the impact of the changed parameters on the railway system-which part of the railway system should be included in the simulation and which operators are responsible for these parts of the system. 3. Selection of scenario-which conditions can be identified to fulfil the requirements of the research question on testing changes in the system. 4. Identification of the information needs of operatorswhat information do they need to build their situation awareness. The goal-directed task analysis (GDTA) is a type of cognitive task analysis that is specifically designed to uncover situation awareness requirements (Endsley et al. 2003). This technique maps operators' goals, their related decisions and their information needs. Therefore, this technique may help in identifying necessary information requirements related to the scenario.
For the table-top simulation, the following choices were made in collaboration with subject matter experts (SMEs) (see Table 1). About 8 weeks were needed between the initial meeting and the session to design and prepare the tabletop simulation. The design of the simulated environment (e.g., setup of the room layout, scenarios, etc.) was intended to be as much representative to the actual work environment as possible in order to maximize its validity. Figure 2 shows the setup of the table-top simulation. It included four control centers comprising two regional control centers of the railway traffic organization, one regional control center of the passenger traffic organization and one national control center (OCCR). As also described in Table 1, automation of the train traffic flow was represented by facilitators, who moved the trains. The trains were represented by pegs bearing information about train number and length of delay. Operators received all the necessary information. Some was translated into shared information displays on laptops, for example delays of trains on long-distance routes for the RNC and NNC, and logged communication on the status and details of the disruption. Operators interacted with the traffic flow by providing orders to the facilitators to for instance, hold, turn and/or cancel trains. Facilitators would dynamically adapt the status of the train traffic flow and of a single train by moving trains each minute and adding the amount of delay in relevant cases. As such, crucial functions of the train traffic management system could be translated and supported in an analogue simulated environment. For an elaborate description of the  (2013) Core aspect Description

Purpose
To study the impact of current and alternative procedures for the improvement of the speed and realization of railway infrastructure disruption mitigation Scenarios Two: (1) current procedure, (2) alternative procedure. The scenarios took place during peak hours and lasted 45 min Simulated world Railway system between Amsterdam Central Station and Alkmaar Station. Representation of train traffic flow on A0 foam board with schematic representation of the infrastructure, representation of train through pegs with information about train number and length of delay, automatic route setting simulated through facilitators. Train delays and status on national-wide corridors logged in a developed computer program. Time table information provided on A4 sheets, Simulation of co-location by room separation # of participants 12, excluding facilitator roles Roles (#) Train traffic controller (TTC) (4), regional network controller (RNC) (1), national network controller (NNC) (1), regional passenger traffic monitor (RPTM) (1), regional passenger traffic junction coordinator (RPTJC) (1), regional passenger traffic material and passenger coordinator (RPTMPC) (1), national passenger traffic controller (NPTC) (1), passenger information dispatcher (PID) (2). Facilitators took upon the roles of: train drivers (TD) responsible for passenger trains, train drivers responsible for shunting train, emergency coordinator (EC) and the back-office (BO) Type of role Similar or equal to their own roles Objectives Execution of tasks-same as in their daily work, only in scenario 2 with new procedures Constraints Inclusion of two regional traffic centers, exclusion of roles outside the defined infrastructure area, exclusion of train driver Load Two sequential medium impact disruptions; (1) train malfunction, (2) gas leak in a tunnel. These types of disruptions can be categorized as low to average in terms of frequency. Also, both disruptions may be interpreted within the same order magnitude / class of impact Situation (external influencing factors) The presence of individual observers seated next to or near the participant, facilitators, occasional attendance of observers from both railway organization Time model Continuous

Participants
Six operators from the railway infrastructure organization ProRail and six operators from the passenger traffic service organization participated in the study.

Materials
As the disruptions in the two scenarios were designed to be as much as similar as possible in severity and consequences for operational processes in the train traffic flow, the independent variable in this study was the type of procedure, namely the current procedure for dealing with disruption (scenario 1) and the alternative procedure for tackling the disruption (scenario 2). In essence, the alternative procedure for tackling the disruption differed in that there would be (1) a predefined protocol for the disruption management, (2) stronger emphasis on the operational process of isolating the disrupted area, (3) faster availability of the predefined disruption protocol and (4) (Gregoriades and Sutcliffe 2006). This is measured through unanswered phone calls, which due to a busy line or the operator ignoring the call. • Undirected average length of conversation: total duration of communication in seconds.
Another dependent variable was the communication content, which provides insights into network knowledge, represented by semantic networks that are created on the basis of transcribed communications between operators. Text files were created for a single operator on the basis of their verbal expressions. Firstly, the files were imported in AutoMap 3.0.10.36 and pre-processed with filters, a constructed generalization thesaurus and a deleted words list with prepositions, determiners, etc. (e.g., Freeman et al. 2006;Weil et al. 2008). Only relevant concepts based on a form of scree plot were selected (e.g., Walker et al. 2010a, b). A subject matter expert assessed the concepts for their relevance. Since the scenarios involved one large event as opposed to multiple large events, network situation awareness was qualitatively assessed by investigating connected concepts in the semantic network as a whole (Weil et al. 2008). The assumption for this approach is that the coordination stage after the disruption does not include a major event that affects a change in the situation awareness of the network.
Both communication flow and content were drawn from communication logs that were created on the basis of the video footage, in which verbal communication via telephone and within control centers was transcribed and coded. Multiple individuals in a co-located room were coded as recipients when an individual in that room was not explicitly addressed by his/her name or function, in line with the official communication protocol. Communication between participants and facilitators who performed multiple other roles were also included in the communication log files.
As the study focused on an in-depth analysis of the communication flow and content through the use of SNA, a number of frequently used centrality metrics were analyzed (Haythornthwaite 1996). For this, the software program UCINET 6 was used, in which normalized calculations were reported on: • Degree (Deg): the number of nodes that are connected to one specific node. For example, the amount of communication between one actor and all other actors in the network; in other words, which operator has the most contact with other operators in the railway network. For the directed connections, the degree in terms of 'inbound' and 'outbound' was used, in order to differentiate the initiating actor of the conversation from the receiving actor. For communication content, a high degree centrality implies a highly linked concept in the semantic network. This metric is comparable to 'sociometric status' (Houghton et al. 2006

Scenarios
Both scenarios were designed to take place during peak hours in the afternoon, starting at 16.40 and 16.25, respectively, for scenario 1 and scenario 2. In scenario 1, the Zaanlijn train traffic controller received a call at 16.48 from a train driver regarding engine problems. After 3 min, the driver confirmed the malfunction and reported that smoke was issuing from the engine. He advised that due to this, a number of tracks should be cleared and made unavailable at Uitgeest station.
In scenario 2, more time was allocated before the disruption was introduced, in case the operators needed to familiarize themselves with the newly introduced procedure. The TTC Zaanlijn received a call at around 17.02 from a train driver who reported smelling gas in the train tunnel. All train traffic was, therefore, put on hold until further notice.

Procedure
The simulation sessions were held on the same day and both were introduced and debriefed in plenary sessions. Prior to the second session, an in-depth explanation was provided of the similarities and differences between the old and the proposed disruption mitigation procedure. During the simulation sessions, video recordings were made of each control center and observers were present near participants, who were occasionally asked about their decisions or actions.

Results
Two passenger information dispatchers were excluded from the analysis as their role in the simulation environment was solely to investigate how the two procedures affected their work, which in this case was limited to that of an observer. Additionally, four roles-namely passenger train driver (TD passenger), driver for shunting trains at stations (TD shunting), one back office coordinator (BO) and an emergency coordinator (EC)-were performed by two facilitators and included in the analysis. The average work experience of the six railway traffic controllers and the four passenger traffic controllers was, respectively, 20.2 years, SD 11.38, and 10.7 years, SD 9.43. Figure 3 illustrates the communication network of railway and passenger traffic operators. The nodes are ordered in such a way to easily visualize the informal hierarchical structure in terms of operational levels, that is, operational duties in the field (train drivers, emergency coordinator), followed by control room operations at a local (TTC and RPTJC), regional (RNC and RPTM) or national level (NNC, NPTC and back office). The different node colors represent the different control rooms. The values in between the nodes indicate the undirected communication flow in terms of frequency. The values in brackets represent the undirected failed communication attempts.

Communication flow
The values highlighted in bold in Table 2 indicate central actors with regard to a specific centrality metric. The results for the undirected communication flow show that the RNC, RPTM and RPTJC are mostly in contact with different operators within the network and, therefore, have a high degree centrality. However, the RNC is the most central in how many steps within the network he or she needs to take to reach other operators in the network, i.e., is able to most efficiently obtain information (closeness centrality). Further on, the betweenness score shows that the RNC and TTC Zaanlijn are key actors in passing on information.
Regarding the directed communication flow, the RNC and the RPTJC are most central in initiating and receiving conversations within the communication network, as is the RPTM in contacting other actors. The RPTM, RPTJC and RPTMPC show relatively high centrality scores in this network, which might be explained by the collocation of these actors as underlined by the video recordings. It can also be noted from the values in the directed communication flow that the facilitators have a less active role in the communication network.
Further on, the findings on the directed flow of failed communication attempts show that the RNC and TTC Zaanlijn have high scores on the degree centrality in their incoming and outgoing communication network. Video recording observations and communication logs explain failed communication attempts, as other operators were in another telephone conversation or on some occasions were too busy to answer their phone. In some cases, an operator tried to reach the unresponsive operator until he or she was reached, but in the meantime also continued with their work. By looking at failed or unresponsive calls and linking this to the communication network, possible bottlenecks can be identified. This also can be seen as an indicator of an increased workload and inefficiency in the task work.
Finally, the results for the undirected average length of conversation indicate that the TTC Zaanlijn and RPTJC on average have longer conversations compared to other operators in the network.

3
Thus, the findings from the four communication networks provide unique insights into which operator plays a key role. More specifically, the RNC and TTC Zaanlijn are, given the current circumstances, the overall key operators: they act as gatekeepers for exchanging information, but are also potential bottlenecks as they are not always reachable. To illustrate the latter inefficiency, which may affect operators' workload, the relative value between failed communication attempts in relation to the actual conversations could provide an indicator of the workload of an operator, that is, 37% of incoming and 6% of outgoing communications attempts for the RNC fail, respectively, to 25% of incoming and 33% of outgoing communications attempts for the TTC Zaanlijn. The RPTMPC is not included in this assessment as the train driver's communication overload can be explained by one facilitator performing three roles (also as train driver for shunting and as the EC).

Communication content
Analysis of the communication transcripts resulted in the semantic network depicted in Fig. 4.
It is notable that the key concepts addressed relate to larger train stations in the area that is affected, rolling stock and its status, track availability and turning possibilities. Quantitative results for the degree centrality strength of nodes in the network are also depicted in Table 3. As expected from the visual representation of the network, the conversations between operators mainly focused on Uitgeest station.
To provide a qualitative approach to facilitate the understanding of the constructed semantic network, the transcripts were assessed to relate the entire coordination activity to concepts in the semantic network, therefore, providing insights into network situation awareness. In the current network, three groups of connected nodes or clusters can be identified. It was observed that at the start of the disruption, six calls were needed throughout the network to inform all operators of the disruption. Operators then focused on the consequences of the train malfunction at Uitgeest station, by adapting the train traffic flow to fit with the reduced infrastructure capacity and available rolling stock and crew in the changed conditions, that is, mainly between Amsterdam and Zaandam. The portion of rolling stock that could not be allocated to a station track or shunted to a yard is the main challenge that operators have to deal with. A third cluster that can be identified possibly related to the turning of rolling stock between Amsterdam and Zaandam. As the concepts are not related, however, it might indicate that the operators did not explicitly mention the stations in their communication. It is notable from the qualitative assessment of the transcripts that except for operators at the national control center (NNC and NPTC), operators shared highly detailed information regarding, for example, newly assigned numbers of rolling stock, the availability of tracks and the location of certain rolling stock.

Communication flow
The communication network structure for scenario 2 is shown in Fig. 5.
The main actors with high values on degree centrality are the same as in scenario 1; that is, the RNC and the RPTM made the largest contribution to the flow of communications (see Table 4). The RPTMPC also appears to be a more central actor in terms of total number of interactions. The TTC Zaanlijn and the TTC Almere show a higher degree of closeness centrality in addition to the RNC, which is still the most central in efficiently obtaining information within the network. As in scenario 1, the RNC and TTC Zaanlijn control the information flow to other parts of the network; that is, they have a high betweenness centrality.
The RNC and the RPTMPC are central actors for outgoing communication, while the passenger train driver and the RPTM have a high degree centrality for receiving incoming communications. As in scenario 1, the RNC has the highest centrality when it comes to operators who want to reach

3
As in scenario 1, the RNC and the TTC Zaanlijn control the information flow. This position in relation to failed communication attempts indicates that the operators' workload is possibly affected by the 50% of failed incoming and 5% of failed outgoing communications attempts for the RNC, respectively, to 10% of failed incoming and 44% of failed outgoing communications attempts for the TTC Zaanlijn. Operators also acted in a similar way as in scenario 1 when they could not reach another operator; occasionally, they tried to reach the unresponsive operator until they reached him or her, while continuing their work.

Communication content
The semantic network in scenario 2 shows concepts that are identical to those in scenario 1 (see Fig. 6). The current network, however, shows more interrelated nodes. This indicates a higher degree of the shared information behavior on these concepts between operators, although similarly focusing on turning possibilities and running rolling stock at major train stations.
The results on the degree centrality metric for the current semantic network are depicted in Table 5. In comparison to scenario 1, the key concept in scenario 2 involved the activities around Zaandam station, as is to be expected.
A qualitative assessment regarding clusters in the semantic network in relation to the coordination of operators showed results similar to those in scenario 1, in which the communication initially focused on a gas leak in a tunnel between Zaandam and Amsterdam. Similarly, throughout the scenario, the coordination focused on identifying and ensuring the capacity in the disrupted area by dealing with the portion of rolling stock that was difficult to allocate to a station track or shunt to a yard. Since the disruption affected Zaandam station, which is located between Uitgeest and Amsterdam, the focus was clearly stronger on turning options, unlike in scenario 1. Operators may have often discussed the track options for specific train numbers, which might explain the disconnected node 'track'. The linkage of concepts to parts of the coordination provides insights into the developments of the network situation awareness in scenarios 1 and 2.

Comparisons between networks
The discrepancies between the two communication network structures were also investigated. A paired t test was used (i.e., a density test in UCINET) to analyze whether there is a significant difference between two networks with similar actors.
t Tests were conducted to investigate the difference between the networks related to the undirected communication flow, the directed communication flow, the directed flow of failed communication attempts and the average length of the conversations in scenarios 1 and 2. No significant results were found, indicating that all four types of communication networks are not significantly different between scenarios. This may indicate that the alternative procedure is not significantly different when it comes to the communication flow, in comparison to the current procedures.
Although it is fairly remarkable that identical concepts in scenarios 1 and 2 were found, there was a discrepancy in the number of relations between nodes. However, no significant difference was found for the conducted t test, indicating that the introduced disruptions and differences in procedures did not change the overall information exchange between operators.

Discussion and conclusion
In the current work, a macrocognitive paradigm was taken upon, following group cognition as a theoretical stream. This study focused on investigating similarities and differences in the network cognition between two types of procedures, i.e., the current and proposed way of working during a disruption. Quantitative social network analysis measures were  used as an explorative technique to investigate the network cognition in the Dutch railway and passenger traffic control. This was conducted through communication flow and content, which was in line with the group cognition perspective that emphasized on interactions rather than on individual knowledge. Social network theory and analysis were applied to quantify and visualize the communication structures within the railway network.

Communication flow and content network structures
Different communication network structures were explored that were conceptualized through the four communication flow variables. The findings also show that each centrality metric in a network follows different interpretations of centrality and, therefore, different implications are related to the analysis. For example, the Zaanlijn train traffic controller may not be that central in terms of the number of contacts with other operators, but nonetheless serves as an important node as gatekeeper of information between different subgroups in the network. The identification of gatekeepers in decentralized command and control structures in relation to the number of failed communication attempts proves to be an important indicator of the possible inefficiency in operations and of an increased workload. As illustrated from the findings, operators occasionally called the RNC a couple of times before they were successful in reaching the operator. It should be noted that this issue only occurred with operators that were not co-located. The inability to reach an operator, especially the RNC, was not only caused by a busy line, but also due to the fact that an operator ignored the call, being too busy. The load of the RNC also has been reflected by the high centrality values in both scenarios, being the so-called 'spider' in the traffic control network. Given these findings, it would be interesting to conduct a more elaborate workload analysis for this role, in order to investigate other task load next to the communication load during a disruption. In terms of overall values, predominantly the RNC and TTC Zaanlijn have high centrality values. This might be explained by the phase of the disruption, in which operators from the railway infrastructure manager (ProRail) need to mitigate the situation, especially in the first moments of a disruptions. It would be interesting to investigate if and how network values for different organizations would change when the disruption goes into a next phase, i.e., when traffic control operations run in accordance to an adapted time table and the final phase, i.e., when traffic control operations are scaling up train traffic to run in accordance with the regular time table.
Each conceptualization of communication flow provided unique insights into the communication and collaboration structure in terms of the centrality of operators, as also identified in earlier research (e.g., Houghton et al. 2006). It is notable that efficiency in terms of communication is a structural issue that is independent of the type of disruption mitigation procedure. As such, the synchronization of communication between operators in a decentralized command and control network is a key element for the coordination and optimization of performance .
Further on, the current study looked into the assessment of semantic networks through communication content in relation to the coordination of the railway traffic and passenger traffic operations to provide insights into different activations of knowledge for network situation awareness. One major assumption for this qualitative assessment was that only one major event was introduced during the scenario. The key information elements were identified, which mainly focus on the train stations (location) and rolling stock, and on the actions, such as running or turning possibilities. It was also identified that the entire coordination revolves around capacity allocation, in which similar information is largely shared across the entire network. The need to share highly detailed information can be explained by its traces in the historical development of the current command and control structure. As such, the current ways of coordination may be seen as a reflection of an organization culture that has been observed to be rather resistant to the change (Steenhuisen 2009). It is, however, difficult to draw firm conclusions on the basis of a qualitative analysis. Therefore, it is emphasized that research focusing on investigations of network situation awareness should analyze patterns of communication content and flow altogether, in order to be able to relate certain communication flow to communication content to identify network situation awareness. This linking of the communication flow and the content network structure can be performed using the EAST method (e.g., Stanton 2014).
All in all, with the increased demands on higher infrastructure capacity in the future, developments in traffic management system are considered imminent. The current findings indicated that it takes six calls to inform the entire network about a disruption. Especially in the first moments of a disruption, every second counts to conduct safety measures in the traffic control system and to hold trains at stations that would leave towards the disrupted area. One obvious finding from this study is to reduce the communication overload, which can be realized by providing operators with newly and more specific shared (display) information to reduce the amount of verbal communication. For instance, a communication system could be used that is accessible by all operators, including TTCs and TDs which is currently not the case. Also in the light of improving operational efficiency during the first moments of a disruption, other 1 3 developments could be in the automation of certain demanding tasks of the TTC, e.g., by letting the system take safety measures to alarm other nearby trains, revoke signals and/ or holding trains towards the disrupted area.

Comparison of two procedures
No significant differences were found between the two operating procedures on each of the four communication flow networks and the semantic networks, indicating that the different procedures did not have a significant impact on the way that operators communicated with each other, such as the communication frequency and length, or on the information they shared. The non-significant difference might be explained by the method that projects at ProRail adhere in designing and testing the newly created disruption mitigation procedure: new designs are often simplified and mostly remain proof-of-concepts before they are tested in a simulated environment (Van den Hoogen and Meijer 2012). As such, independent of the outcome the application of social network analysis metrics provides useful support in testing the difference amongst alternative modes of the railway system as they can quantify the network and support the qualitative assessment of the network graph (e.g., Houghton et al. 2006).

The use and design of table-top simulations
The current study showed how table-top simulations can be applied to investigate operational processes. Although tabletop design might be faster and cost-friendlier than the development of a human-in-the-loop simulation, careful design choices need to be made, such as the identification of information needs of operators and their routines in operational activities. Some operators can more easily adopt simulation environments that are more abstract, while others prefer to have a simulated system that is fully comparable to their real system. This difference might be related to how individual operators develop their situation awareness, which for some may be more in line with the information processing or distributed cognition perspective (e.g., Endsley 1988;Stanton et al. 2015).
Another design choice that can be seen as a limitation in this study is the use of non-identical scenarios. Table-top simulation designers considered slightly different disruptions, that were developed by SMEs, to avoid learning effects. Operators may have dealt with the disruption in a faster and improved manner. For the current study, careful considerations were made to limit the converging implications of the chosen scenarios.

Limitations of this study
A limitation of the study is that only one composition of a network was assessed. Given possible variations between different team compositions, more research is needed into factors that influence team process behaviors within railway traffic operations.
The few available facilitators were a limiting factor in this study, particularly for the role of train driver. As only one facilitator was available for the role of TD shunting and TD passenger, he was in contact with six operators. This may have resulted in that the number of outgoing calls as TD passenger was lower than preferred, so that the TTCs received less calls from TD passenger. A consequence would be that TTCs' workload would be lower in comparison to an actual real-life disruption.
Although table-top simulation environments have proven their value in providing insights into the team processes and interactions, a limitation is the difficulty of collecting objective data (e.g., performance) through log files. Initial indications regarding the validity of the current table-top simulation are discussed by . However, the validity of these isomorphic rule-based simulation environments should be more elaborately assessed in subsequent studies.

Future work
Further studies could also investigate the role of nonverbal communication, which might play a role especially in work environments where there are many operators. For instance, little explicit communication was observed between operators in some co-located rooms, which might be because operators listened to each other's conversations. In relation to nonverbal communications, operators could, for example, signal to one another to confirm that they heard a certain update without explicitly talking to each other at all.
Future work could also analyze the situation awareness of the railway traffic system or a subset thereof in terms of systemic SA, which is operationalized through the distributed situation awareness approach (e.g., Sorensen and Stanton 2011;Salmon et al. 2009;Stanton et al. 2015). A comparison between the findings would indicate the contribution of information held in non-human components of the system. Also, further research should focus on obtaining broader insights into the system's characteristics in different scenarios and in the actual work environment using the EAST method or dynamic network analysis (e.g., Schipper et al. 2015;Stanton 2014). Comparisons between outcomes in an actual work environment and a simulated (table-top) environment could also provide indications in the validity of the used simulated environment.