Specifying the explosion-resistant railway carriage—a ‘bench’ test of the Security Function Framework

Abstract

Anyone trying to devise counter-terrorist designs for railway carriages faces a range of issues. In particular, designers need a framework for thinking about security. This article explores the specific practical design problem of securing railway carriages against explosive terrorist attacks and assesses the benefits of articulating such exploration through the use of the Security Function Framework (SFF). We present the SFF framework, apply it to the ExRes carriage and evaluate it according to defined criteria. Our evaluation shows that the SFF framework is clearly expressed, aids the designer in communicating design requirements, facilitates systematic creativity without necessarily generating completely new ideas, and appears practically applicable. However, we emphasize that ours have been ‘bench tests’; such tests are really no substitute for trying the SFF out with real life designers.

Introduction

Railway sites are attractive targets for terrorists: they are both crowded and easily accessible, and offer the prospect of highly-disruptive and high-profile outcomes. Several of the deadliest attacks in European history have actually targeted passenger traffic on railways (Lia and Nesser 2005: 37–38). Attack methods range from derailing (e.g. the attempted derailing of the high-speed railway between Madrid and Seville in 2004) to poison gas (Japan) to suicide bombing (London). Explosive attacks are particularly attractive; they can damage structures and bring down buildings, as well as kill people. Furthermore, media coverage of bombings is considerably more graphic than coverage of, say, a shooting (Clarke and Newman 2006: 109). This article thus focuses on attacks using explosives, whether carried onto the train by pedestrians or vehicle-borne at the trackside, and whether suicidal or not.

Terrorism has diverse causes at many levels (Roach et al. 2005), and correspondingly many kinds of intervention exist. Situational crime prevention (e.g. Clarke and Newman (2006)) works through increasing the (real and perceived) risk and effort of committing terrorist acts, and reducing the reward, by changing the targets and environments of terrorism and influencing the behaviour of preventive agents such as guardians and place managers. One sector which can contribute to situational prevention is the industrial design, construction and manufacture of places and products. A specific domain within this sector is the design and construction of railway carriages. In the 2004 Madrid train bombings the carriages withstood relatively powerful blasts maintaining almost full structural integrity, while the roofing and interior framing deformed around the initial blast wave. The Madrid trains’ integrity was conferred by their deliberately crash-resistant design. However, it is debatable whether, in comparison to the London bus bombed in 2005—whose skin peeled off, relieving rather than reflecting the blast—they served the victims as well as they could; indeed, we are led to wonder whether a design might be developed that was simultaneously crash-resistant and capable of reducing the probability and harm from a bomb attack. The first purpose of this article is to explore the specific, and challenging, practical problem of designing explosion-resistant railway carriages.

Anyone trying to devise such designs faces a range of issues. For example, the designs must be effective, and they must minimally interfere with everyday running of the railway or passenger safety, comfort and convenience. The designs must also be implementable, whether in terms of practical/technological constraints on manufacture, or in terms of appeal and feasibility to the diverse decision-makers. In the complex, privatised world of railways (Design Council 2000) responsibility for decisions is divided (in the UK for example) between train operating companies, rolling stock hire companies (who own the carriages and rent them to operators), carriage designers and builders, and the track provider (National Rail).

In this context it is easy for designers to lose their way. To help designers build their capacity to innovate and communicate with their clients and users, a language and framework of security is needed. Such a framework should articulate the requirements of security, integrating these with all the other aspects of design.¹ The second purpose of this article is thus to assess the benefits of a particular language and framework, the Security Function Framework (SFF), which has been developed in a very different context, covering the design of secure bike parking facilities (Thorpe et al. 2009) and of anti-theft clips to secure customers’ bags to tables in bars (Ekblom 2012a, b).

The rest of the paper proceeds as follows. “Assessment criteria” describes how the value-added contribution of a security framework might be assessed. “The Security Function Framework” introduces the SFF. “The ExRes carriage” applies the SFF to explosion-resistant carriages, leading to an analysis of the problem and a design specification for solutions. “Assessing the framework” assesses the SFF as a means of generating good design specifications with regard to its application and, finally, “Conclusion” summarizes this paper.

Assessment criteria

Assessment can cover both the ExRes design specification we have produced, and the performance of the SFF in generating that specification. In both cases an ideal approach would include trying out the specification and the framework on real designers (neither of us are practising industrial designers, although one of us regularly works with them), and preferably those from the rail industry.

Assessing the ExRes Carriage

How might we evaluate the ExRes Carriage specification that we develop in this article? Obviously we cannot yet assess the quality and the performance of any real-world prototypes or production models that the specification has engendered. Nor can we assess the final technical design realisation as it might appear in Computer-Aided Design (for example using ‘walk-through, think terrorist’ exercises based on a virtual reality simulation of a carriage interior; or a computerised simulation of blast effects).

But we can, as designers say, ‘correlate’ the final specification in terms of the original requirement, with our suggestions for intervention mechanisms and methods: how well do the suggestions reflect the purpose? We can also correlate the specification with situational crime prevention, to see how theoretically and empirically plausible it is. We can also offer the specification for criticism to those (such as transport police) responsible for rail security or counter-terrorism and (one hopes) possessed of a wealth of practical experience.² In this way the rationale of the design can be subjected to scrutiny. This may be a modest step forwards, but we believe this kind of appraisal is an important discipline. Without it, designers could risk an un-self-critical rush straight into intensive design and prototyping work, at considerable expense, which might prove wasteful.

Assessing SFF

We’re perhaps in a better position to assess the performance of SFF in helping to generate and communicate design specifications in a domain (counter-terrorist design in a large-scale product and extremely large-scale system), far from its origins in addressing everyday crimes through small-scale interventions. Although even here we have only a single case study, and again a self-assessment, it is a starting point, albeit an unconventional one, to more research- and practice-based assessments.

What requirements should a security framework fulfil? Drawing on Cropley’s (2010)) functional treatment of creativity, it should support the generation of designs that are effective and relevant, novel and surprising, elegant and generalisable. It should be deliberative in fostering close and careful attention to detail. It should also be systematic and rigorous, supportive of use of research evidence and theory. It should be practical in leading from theory and research to the design of real working products, places and systems. Many of these requirements are difficult to assess in the current brief exercise, so more modest criteria for our initial self-assessment are that the SFF framework should be:

• clearly expressed,

• fertile, and

• practically applicable.

We report on this self-assessment in “Assessing the framework”, drawing particularly on the experience of one of us who was a newcomer to SFF. Further answers cannot be given until we have a suite of case studies of specification generations, leading to actual design realisations and drawing on the experience of designers.

The Security Function Framework

Here we introduce a four-level framework, under development by Ekblom and colleagues (e.g. Ekblom 2009; Ekblom 2010; Ekblom 2012a, b) for describing a product’s ‘security function’. Security function is taken to mean:

The properties of a product which, interacting through causal mechanisms with entities, agents and systems within its environment, serve the purpose of reducing the risk of crime and increasing security and community safety. The properties in question may be deliberately conferred, amplified or directed through the design, materials and construction of the product and/or its environment. Risk is taken to include possibility of particular kinds of adverse events occurring, their probability and the harm they may cause.

The four-level framework consists of:

• 1. The product’s purpose;

• 2. The product’s security niche;

• 3. The product’s mechanisms;

• 4. The technical description of the product.

Describing purpose covers several distinct aspects.

• (I) What is the designed product for? This is its principal purpose. But this isn’t the end of the story.

• (II) What, if any, subsidiary purpose/s does it have? The security purpose may be principal or subsidiary, as elaborated under ‘niche’ below.

• (III) What other desire requirements must it meet, that are beneficial to the immediate users and manufacturers; expressed alternatively, what other drivers must it satisfy?

• (IV) Finally, what ‘hygiene’ or social responsibility requirements must it meet, referring to other societal values which the product should not interfere with, or should positively boost?

In generic terms, the designer’s major task in preventing crime is to identify and resolve the contradictions in the design requirement and exploit synergies. Strategic contradictions relate to fundamentals of the crime problem (keep passengers and property safe whilst maintaining an efficient, attractive and economic rail service). Tactical ones include ‘troublesome tradeoffs’ (Ekblom 2005) with other drivers (such as energy efficiency or social inclusion), or within crime prevention itself (e.g. facilitating surveillance of a site versus physically blocking access with a fence).

The concept of security niche attempts to characterise how the security function within a given product relates to other products, people and places in the human ecosystem.

Consider some product, such as a handbag or laptop carrier, which is at risk of being a target of, or a tool for, crime. Security can be conferred in several ways, singly or in combination (cf. Ekblom 2005):

• The bag could be safe—not in itself needing explicit security because it is used only in secure environments, protected by enclosures and/or people acting as crime preventers such as guardians or place managers (Clarke and Eck 2003).

• A bag that was in fact exposed to significant risk could be protected by separate security products or securing products. A security product’s principal purpose is protecting some other target, person or property against crime—an example could be an audible alarm lanyard that is triggered if the bag is snatched. Securing products by contrast have a subsidiary security purpose additional to their principal purpose. For example the Stop Thief chair www.stopthiefchair.com is primarily for sitting on e.g. in pubs but a pair of notches cut in the front of the seat enables a bag to be securely hitched beneath the owner’s knees.

Deploying the above approaches makes for a secured product, protected by external means. But the product itself could be designed to be a secure one, that protects itself either by the incorporation of security or securing components, or by deliberate security adaptations (Ekblom and Sidebottom 2007) to its inherent causal properties, realised through constructional features and/or materials, such as armour plating.

The same product can act as both object of crime, and in-function. Thus our bag can be stolen for its own value, as well as for the contents it contains and endeavours to protect.

Purpose must link to more practical aspects of design. But it is best not to leap straight to a technical specification as described below. Rather, smarter understanding (and more efficient knowledge transfer to other design tasks) requires an intermediate consideration of the causal mechanisms—how the design intervention works by interrupting, diverting or weakening those causes. An understanding of immediate causal mechanisms of crime and its prevention is the royal road to analysing risk and reducing it through design. More generally, this is fundamental to replicating the core principles of successful crime prevention in ways that are intelligently and perhaps innovatively customised to new contexts (Pawson and Tilley 1997; Ekblom 2005).

A useful parallel perspective to straight causal mechanisms, that emphasises the agency of offenders (Ekblom 2011) is that of scripts (Cornish 1994; Freilich and Chermak 2009). This can be supplemented by knowledge of offenders’ perpetrator techniques (or modus operandi) and their resources (Ekblom and Tilley 2000; Gill 2005). For example, the offender has to seek a crime target (say a handbag), see and select the target, approach without arousing suspicion, steal the bag and escape preferably un-noticed, before converting and/or enjoying the value of the loot and perhaps covering tracks. Ekblom (2012b) extends this in design terms to the concept of script clashes—where the offender’s script engages with the user or preventer’s script in such issues as surveillance versus concealment, challenge versus excuse, pursuit versus escape. These are, as it were, the pivots on which designers and other professional crime preventers have to tip the design of products, environments and procedures in favour of the good party.

Technical descriptions state how the causal properties of the product, which contribute to the mechanisms of prevention described above, are realised through construction, manufacture and operation. Construction is about materials and distinguishable structural features of the design. Manufacture is about how it’s made. Operation is about how it acts in tangible terms with human action such as keys turned, cards swiped or actuators releasing locks.

Further examples of the SFF in action, covering bag clips, bags and bike stands, are in Ekblom (2012a, b) and Ekblom et al. (2012). The complete description of the design of secure or securing products in particular must of course go well beyond security considerations. Key to the wider design process is how the design satisfies other purposes and requirements, perhaps resolving troublesome tradeoffs between security and desire/hygiene factors such as convenience, safety, economy and style. The consequences of poor security design are that fewer people buy the relevant product; but experience has suggested that good design can turn security into a Unique Selling Proposition.

The ExRes carriage

Having developed the SFF in the context of everyday crimes and modest design interventions, how does it fare when handling design against extreme and rare crimes against which radical interventions have been contemplated and sometimes implemented? This section tests out the Security Function Framework just introduced, to describe a suggested specification for an explosion-resistant railway carriage; the ExRes carriage.

The ExRes carriage’s purpose

The principal purpose of the ExRes carriage is, obviously enough, to transport the passengers from one station to another.

The subsidiary, security, purpose is to protect passengers against injuries from explosive attacks by (1) decreasing the probability of anyone committing an explosive attack (primary security ³); (2) decreasing the probability of an attack’s being successful (primary security); and (3) decreasing the harm, intended or otherwise, inflicted by an explosive attack (secondary security ⁴). It helps at this point to switch to the perspective of the offender. Assuming that the offender wants to maximize the expected harm⁵ of an explosive attack while minimizing the cost of attacking, the probability of a possible offender committing an explosive attack depends on the offender’s perceptions of the probability of an attack’s being successful, the harm inflicted by an explosive attack and the cost of attacking.^{6 , 7}

The ExRes Carriage must furthermore have some other desire qualities. The passenger wants it to be aesthetic, comfortable, safe and easy to enter/exit. The railway operator wants it to be economical to purchase, service and operate, safe, aesthetic, easy to clean, durable, easy to operate, spacious and appealing to passengers (including feeling safe). The manufacturer wants it to be relatively inexpensive to produce, suitable for a wide range of railway systems and safe for passengers (at least to the extent that the manufacturer might be liable should an event happen; more generously speaking, motivated by broader ethical considerations).

In addition, the ExRes carriage should meet some ‘hygiene’ or social responsibility requirements: it should be environmentally sustainable, energy effective, inclusive etc. As with cars, there’s also a major concern with fail-safe and safety in crashes, some of which may synergise or conflict with anti-explosion requirements.

The ExRes carriage’s security niche

The ExRes carriage is a securing product: it has a principal purpose of safely and comfortably transporting passengers plus a subsidiary security purpose of protecting passengers against injury from explosive attacks whilst on board or adjacent to the carriage (for example on the platform or in another passing train).

As valued assets in themselves, ordinary railway carriages additionally need security against the possibility that they, and not just the people they contain, are the target of crime (such as vandalism or theft of fittings) or terrorism. This reflects the distinction noted in “The ExRes carriage” between a product as object of crime and product in-function. Altogether, then, carriages could take the following niches (examples are illustrative more than necessarily practical):

• (1) Safe if sited in a secure environment where all personnel and passengers with belongings were screened for explosives before entering the railway carriage and both sidings and running tracks enclosed by physical barriers with access control and/or guarded. Planting of dense spiny bushes like blackthorn (Prunus spinosa) alongside the track could hinder access to both pedestrian and Vehicle Borne explosives whilst improving aesthetics (these would be securing ‘products’). Anything approaching complete safety is of course unlikely but a certain minimally secure environment is needed if constructing and operating a railway is to be a feasible proposition.⁸

• (2) Secured if protected by

  • separate security products, dedicated to minimizing harm from explosive attacks against the carriages—for example, a sniffer for detecting explosives that the train guard carries while inspecting tickets.

  • separate securing products, minimizing harm from explosive attacks against the railway carriage as a sideline.—for example, the practice of having season or multi-use tickets carrying personal identification, principally for revenue protection, could increase the risks to the offender.

• (3) Secure if protected by

  • security or securing components, for example if a warning system for suspicious behaviour or vapours were installed in the railway carriages.

  • deliberate security adaptations, for example if carriage walls were made of blast-absorbing materials.

The securing function of the carriage, protecting the passengers it conveys, is conferred by (2) and (3) above.

Mechanisms

To design a railway carriage that protects passengers against injuries from explosive attacks we must understand the immediate causal mechanisms that allow those attacks to take place; and thus how these causal mechanisms can be interrupted such that the passengers’ injuries are avoided or minimized in case of an explosive attack. As mentioned earlier, injuries can be minimized by (1) reducing the probability of anyone attempting an explosive attack; (2) reducing the probability of an attack’s being successful; and (3) reducing the harm inflicted by an explosive attack. The probability of a possible offender attempting an explosive attack depends on the offenders’ perceptions of the probability of an attack’s being successful, the harm inflicted by an explosive attack and the cost of attacking given that the offender wants to maximize harm and minimize the cost of attacking.

Visualising dynamic mechanisms requires considering scripts and perpetrator techniques. When targeting a railway carriage, an explosive device can be delivered either by backpack/suitcase/shopping bag (person borne), or by car/truck (vehicle borne). A person borne explosive can be left to detonate, inside a carriage by a passenger/employee or on the rail track, or detonated while carried, i.e. suicide attack (Meyer 2011). Some abbreviated examples follow. A crime script⁹ for an offender when leaving a device inside a railway carriage could go something like this:

• 1. Enter station without being detected or challenged.

• 2. Wait for suitable railway carriage while keeping the explosives safe from weather or accidental premature detonation.

• 3. Enter railway carriage while keeping the explosives safe from weather or accidental premature detonation.

• 4. Search for suitable hiding place while keeping the explosives safe from weather or accidental premature detonation and without being spotted or challenged.

• 5. Leave container with explosive at hiding place without being spotted or challenged.

• 6. Exit carriage without being challenged.

• 7. Leave station without being challenged.

• 8. Detonate explosive if it is remote controlled (and without automatic timer) without being spotted and frustrated, or (for bombers who wish to survive) getting injured from the explosion.

A crime script for an offender when leaving an explosive on the railway track could be:

• 1. Search for unguarded entrance to tracks, or create one by cutting fence.

• 2. Enter tracks through unguarded entrance without being spotted or challenged.

• 3. Search for suitable spot to leave explosive without being run down by train.

• 4. Leave explosive at suitable spot without being spotted.

• 5. Exit tracks through unguarded entrance without being spotted or challenged.

• 6. Leave site before railway carriage hits the explosive(s) without being spotted.

A crime script for a person borne suicide attack could be:

• 1. Enter station without being spotted or challenged.

• 2. Wait for suitable railway carriage while keeping the explosives safe from weather or accidental premature detonation.

• 3. Enter railway carriage while keeping explosives safe from weather or accidental premature detonation.

• 4. Sit down or stand in carriage while keeping explosives safe from accidental premature detonation.

• 5. Wait for suitable moment in terms of crowded carriage, location in tunnel or high-visibility place (e.g. on a bridge) and detonate explosives.

A person borne explosive is limited by the weight an individual can carry, while a vehicle borne explosive can obviously be much larger. A vehicle can be parked along the track or crashed into the carriage. The crime script for an offender parking a vehicle along or, if possible, on the track might be:

• 1. Find suitable spot for the explosive(s) and for nearby viewing point for detonation without being spotted or challenged.

• 2. Remove any physical obstacles at detonation site without being spotted or challenged.

• 3. Arm device and leave vehicle without being spotted or challenged.

• 4. Leave area and/or go to viewing point.

• 5. Detonate device if remote controlled without being spotted or getting injured from explosion.

The crime script for an offender crashing into a railway carriage with a vehicle borne explosive could be:

• 1. Find suitable spot for crashing vehicle into carriage without being spotted or challenged.

• 2. Remove any physical obstacles without being spotted or challenged.

• 3. Arm device and await train without being spotted or challenged.

• 4. Crash into carriage while detonating the explosives.

The passenger script is:

• 1. Enter station.

• 2. Wait for train while keeping comfortable.

• 3. Enter railway carriage.

• 4. Sit down or find place to stand.

• 5. Wait for right station, with or without entertainment, or other mental strategies for occupying time and/or shutting out what may be noisy, crowded surroundings.

• 6. Exit railway carriage.

• 7. Exit station.

The employee script would vary with work tasks, but may include looking out for suspicious behaviour and left-behind items.

Script clashes here include

• surveillance by employees versus offender hiding explosives in carriage or on track

• surveillance by passengers versus offender hiding explosives in carriage

• driver stopping train if spotting vehicle or explosive device on the track

Applying the above scripts, the following mechanisms for minimizing passenger injuries from explosive attacks against railway carriages can be distinguished:

• One way of decreasing the probability (and the offender’s perception of the probability) of an attack with explosives left inside carriage’s being successful is to minimize the number of forgotten items: if the design prevents people from forgetting items, a left-behind object will be more suspicious and, accordingly, more resources will be available to investigate whether the left object might be an explosive. It should also be easy for passengers to spot their own forgotten luggage when leaving their seat.

• A second way to decrease the probability (and the offender’s perception of the probability) that an attack with explosives left inside the carriage is successful is to maximize the ability to spot any left item: if the left item is spotted, passengers can alert employees and the employees might thus implement suitable responses. Accordingly, the carriage should be designed with no hiding places and it should be easy surveillable.

• A third way to decrease the probability (and the offender’s perception of the probability) that an attack with explosives inside the carriage is successful is installing explosive detectors at the entrances. An explosives detector is “a device capable of detecting the presence of certain types of explosives” (Garcia 2008: 331). The current technology is, however, too space demanding (and perhaps also too people intensive) to make it a viable option for now. Cost and speed of the current technology also makes the option less viable.¹⁰

The offender’s perception of his/her cost of attacking depends on his perception of the probability of being caught: if an explosive attack is committed by leaving an explosive device on site, the preventers’ capability of identifying the offender increases the cost of attacking. CCTV can help solve this problem [The fact that in-carriage CCTV has been deployed to prevent conventional crimes and antisocial behaviour gives a ‘free ride’ to the anti-terrorist function].

Whether an explosive is left before detonation or the offender commits a suicide attack, it is desirable to minimize the harm inflicted from an explosive detonated inside the carriage. One way of doing this is to minimize injuries from (secondary) fragments. Other ways of minimizing human injuries are to reduce the internal blast and use materials that do not ignite in an explosion or in a fire.

In addition to protecting the passengers from an internal blast, the carriage ideally should be constructed to withstand external blasts. Current technology, however, can only strengthen a carriage structure to withstand small charges or detonations at some distance; making a carriage able to withstand a vehicle borne explosive crashing into the carriage is not feasible.

To summarise preventive mechanisms, the ExRes carriage should be specified to minimize passenger injuries from explosives by (1) minimizing the number of forgotten items; (2) maximizing the surveillability of the carriage; (3) increasing the offender’s perception of the probability of being caught; (4) preventing injuries from fragments; (5) aiming for a design which absorbs the blast energy from explosives detonated internally; and (6) strengthening the carriage structure to withstand an externally generated blast (only realistic for small charges or detonations at some distance). There may be additional requirements and assumptions about the security of the operating environment that these requirements for the carriage have to dovetail with.

The designers would of course have to simultaneously consider all the other, non-terrorism requirements of the carriage in its principal function as a conveyance, as previously described.

Technicalities

Describing the technicalities is primarily the designers’ and engineers’ task—where they exercise their skill, discipline and creativity to develop, through various iteration-and-test procedures,¹¹ and practical renditions of requirements such as those set out above. Indeed, stating requirements in such a way as to maximise design freedom is important not just as a general principle of industrial design but as a specific strategy to keep ahead of adaptive terrorists (Ekblom 2005, 2008). This usually relates to ‘performance standards’ rather than ‘construction standards’.

In developing technical solutions designers would need to be able to state how the causal properties of their design of carriage (in conjunction with influences from passengers, luggage, bomb etc) realised each preventive mechanism in terms of materials, structure, operation etc, without interfering with the other requirements (and maybe actually synergising with them). They would also have to give an account in terms of blocking offender scripts and biasing script clashes to favour preventers. There is also the crime-specific possibility of design contradictions within the security requirements—for example, bigger windows to facilitate surveillance may weaken blast-resistance. In fact, from the designers’ perspective, clearly-stated contradictions serve to sharpen and orientate their thinking (Ekblom 2008).

Some general guidelines may be distinguished from the above discussion¹²:

The number of forgotten items might be minimized by removing storage areas, especially areas where it is not evident who owns the luggage like for example shelf areas close to the entrances. Ideally, the passengers should keep their luggage on their lap or between their feet (if small and light) or close by in their ‘personal space’ (if bulky or heavy). The seats should be formed in such a way that anyone leaving their seat plus fellow passengers should immediately spot any left item. Ideally all seats should face some other seat to maximize passenger surveillance. Design contradictions include removing storage areas versus supporting accessibility and comfort. For instance, absence of areas to put luggage might force passengers to leave it in the walkway such that it hinders movement through the carriage. Absence of shelving might also force passengers to keep luggage on the lap and thus decrease their comfort. Reducing the number of forgotten items can also have positive externalities; forgotten items can cause false alarms which also can reduce passengers’ feeling of safety and disrupt services, both of which could deter passengers from train travel.

The surveillability of the carriage can be maximized by removing all unnecessary clutter and designing seats and other interior that does not hinder sight more than necessary. (Unfortunately, the rush-hour crowding that is so attractive to terrorists for boosting their kill, also serves to block this technique.) Interior walls should be transparent and seats designed so they do not unnecessarily decrease surveillability. Rubbish bins should ideally be removed (some operators have a rubbish collecting service during the journey) or made blast-resistant (which is very expensive). Hiding places should be designed out. An important contradiction is minimizing litter bins versus passenger comfort. A shortage of bins might cause passengers to throw their litter on the floor and, accordingly, decrease cleanliness. A possible solution is to increase the frequency of cleaning, but that would also lead to increased operating costs.

The offender’s perception of the probability of being caught after the event (if still alive) might be increased by installing CCTV and/or dummy CCTV at all carriage entrances—all entrances must appear to be under surveillance or the offender would just avoid the unmonitored entrances. The real CCTV-cameras should store all pictures and have a high enough picture quality to enable identity recognition of offenders. The CCTV coverage should either be immediately stored at an external server or the storing unit needs to be blast resistant. Installing high quality CCTV would however probably increase both the production costs and the operating costs drastically. Passenger privacy would also suffer with high density of CCTV coverage.

Injuries from fragments can be prevented by removing clutter that might be ‘weaponised’, turning into hazardous fragments in an explosion. Necessary interior structures, including glazing, should be blast-resistant or, at least, not form dangerous fragments in case of an explosion. This can be done by securing glass and using appropriate materials in the interior in an explosion. Internal sectioning might also hinder fragments from harming people over a large radius. High passenger density will, however, limit the circulation of fragments in itself (albeit unfortunately for those nearest the blast).

Other ways of minimizing human injuries are to reduce the internal blast (to some extent) by ensuring rapid and sufficient ventilation of explosive gases, e.g through the windows and/or to use materials that do not ignite in an explosion or in a fire.

Injuries from explosives outside the carriage can be minimized by strengthening both carriage walls and carriage floors against external blasts. (Strengthening ribs to keep the compartment intact in case of derailment may confer some anti-blast or -ram benefit incidentally). Strengthening floors and walls might, however, increase the weight of the carriages and thus the energy consumed when moving the carriage. There is, furthermore, a tradeoff between securing against explosives from external and internal blasts; strengthened walls can hinder the ventilation of gases, increase the blast reflection and thus the injuries caused by an internal blasts. This is a contradiction to challenge designers’ ingenuity.

In sum, the ExRes carriage’s design should (1) minimize storage areas; (2) remove unnecessary clutter and only include interior that does not hinder surveillance more than necessary; (3) possibly install CCTV at entrances; (4) only include interior that resists fragmentation and fire; (5) ensure rapid and sufficient ventilation of explosive gases; and (6) strengthen carriage walls and floors.

Summary of SFF description

The abbreviated four-level description of the security function of the ExRes carriage specification translates to:

• 1 (Purpose) The ExRes carriage is specified with principal purpose to serve as a fully functional and appropriately-adapted railway carriage, and subsidiary purpose to minimize passenger injuries from explosives detonated either inside or outside of the carriage.

• 2 (Security niche) ExRes is above all a securing product: its security function is subsidiary to its principal purpose as a conveyance. As an asset to be protected in itself it is also a secured product to the extent it has security conferred by external means linked to the carriage and the people within it; and a secure product to the extent that it is designed and constructed to prevent and resist damage. It is only to a very limited extent a safe product given the difficulty of creating a secure environment around a target as geographically extended, complex and accessible to users as the railway.

• 3 (Mechanism) The security function of ExRes is realised by (1) minimizing the number of forgotten items; (2) maximizing the surveillability of the carriage; (3) increasing the offender’s perception of the probability of being caught; (4) preventing injuries from fragments; (5) absorbing the blast energy from explosives detonated internally; and (6) strengthening the carriage structure such that it can withstand an externally generated blast and thus minimize passenger injuries (only realistic for small charges or detonations at some distance).

• 4 (Technically) These mechanisms may be realised by (1) minimizing storage areas; (2) removing unnecessary clutter and only including interior that does not hinder sight more than necessary; (3) installing CCTV at entrances; (4) only including interior that resist fragmentation and fire; (5) ensuring rapid and sufficient ventilation of explosive gases; and (6) strengthening carriage walls and floors.

Assessing the framework

“The Security Function Framework” formulated three criteria for the SFF framework: it should be (1) clearly expressed, (2) fertile and (3) practically applicable. This section attempts to assess the framework’s performance on paper with regard to these criteria.

Clear expression

Clear expression; requires that SFF should articulate the design problem so as to facilitate communication, knowledge transfer and accumulation. It should thus only use terms that (1) are easily accessible to all SFF framework users regardless of field of expertise and (2) have unambiguous meanings such that all users interpret the terms similarly. When introducing new terms, the framework must include appropriate guidance on definitions. We include this criterion since each product description should be read with a single meaning, and no ambiguity.

The SFF framework description in “The ExRes carriage” does include clear definitions of the terms used, which facilitates easier use of the framework. It furthermore distinguishes between the different aspects of the product’s purpose and thus forces the designer to make explicit all the purposes the product needs to fulfil. In the example of the ExRes carriage, the SFF framework highlights the carriage’s security purpose while also emphasizing that the carriage’s main purpose is to transport passengers. The SFF framework furthermore introduces the term security niche to force the designer to formulate how a given product relates to other products, people and places with a security function. In the description of the ExRes carriage, the framework shows how the ExRes carriage both can be protected as a valued asset and protect people. The SFF framework also makes explicit the mechanisms that increase security and helps aids the designer in clearly expressing product requirements.

Hence, the SFF framework is both clearly expressed and aids the designer in communicating the design requirements.

Fertile

The second criterion requires that the SFF framework is fertile: it should maximise design freedom and creativity so as to facilitate production of new ideas, ideally even innovative, which can solve real-world security problems, help out-innovate adaptive criminals, and keep up with social and technological change. The ideas generated should also be quite plausible and/or assist the designer in filtering out ideas with flaws. We include this criterion since we want the SFF framework to support the making of new solutions that enhance security.

The emphasis on mechanisms in the SFF framework aids the designer in thinking through different ways of increasing security, systematically pairing old ideas and combining them to form new ideas, and thus fosters creativity. However, have any completely new ideas been developed through this exercise? The authors do not have full overview over which ideas has been developed for enhancing security in carriages. We do, however, know that maximizing surveillability, preventing injuries from fragments and increasing structural redundancy have elsewhere been used to secure buildings against explosives. In rail transport public address messages about keeping belongings close, increased CCTV-coverage and increased presence of security personnel have been employed, which can be interpreted as strategies to minimize number of forgotten items and increasing the offender’s perception of the probability of being caught. We have thus no reason to believe that this exercise has resulted in any revolutionary new ideas.

Hence, the SFF framework may facilitate structured creativity rather than fostering completely new ideas. A new award-winning idea would probably depend more on a designer’s creativity and posing questions from unusual and original angles than a specific framework. But for designers both highly creative and less creative, the SFF framework would at least tell them where to focus their thoughts.

Practical applicability

The third criterion requires that the SFF framework is practically applicable; it should systematically facilitate spelling out all facets necessary before designing the product. It should thus (1) make strong links from purpose to practical product, (2) systematically cover an appropriately-wide range of requirements and possibilities, and (3) highlight design contradictions, tradeoffs and context-dependencies. We include this criterion because we want the SFF framework to contribute to the making of physical objects in the messy and complicated real world rather than abstract ideas.

This criterion is difficult to evaluate with regard to the ExRes carriage since no designers have endeavoured to realize the specification and no prototype has been made. However, the SFF framework facilitates exploring design contradictions when discussing technicalities. In the ExRes carriage example, the design contradictions of removing storage versus supporting accessibility and comfort and minimizing litter bins versus passenger comfort are brought to attention. The SFF framework has furthermore been developed in contexts where prototypes have been developed; secure bike parking facilities and anti-theft clips to secure customers’ bags to tables in bars.

Hence, the SFF framework seemingly is quite practically applicable.

Conclusion

Anyone trying to devise counter-terrorist designs in railway carriages (or anything else) faces a range of issues. To help designers through these processes and to build their capacity to innovate and communicate in this field, a framework of security is needed. The purpose of this article was twofold: both to explore the specific practical problem of designing railway carriages against explosive attacks by terrorists; and to assess the benefits of articulating this exploration through the use of a particular language and framework, the Security Function Framework (SFF).

This article has presented the SFF framework, applied it to the ExRes carriage and assessed the SFF framework with regard to defined criteria. The assessment shows that the SFF framework is clearly expressed and thus aids the designer in communicating the design requirements, facilitates systematic creativity without necessarily generating completely new ideas and seems practically applicable. In our opinion it also meets Cropley’s broader criteria of being deliberative (attending to detail), systematic and rigorous, and drawing on research and theory. But these have been ‘bench tests’ and there is really no substitute for trying it out with real live designers on real live projects.