NISTIR 7295

An Integrated Gaming and Simulation 

Architecture for Incident Management Training

Sanjay Jain

Charles R. McLean

 
NISTIR 7295

An Integrated Gaming and Simulation 

Architecture for Incident Management Training

Sanjay Jain 

Department of Decision Sciences 

School of Business 

George Washington University 

Washington, DC 20052

jain@gwu.edu 

Charles R. McLean

Manufacturing Systems Integration Division 

Manufacturing Engineering Laboratory 

National Institute of Standards and Technology 

Gaithersburg, MD 20899-8260 

mclean@cme.nist.gov 

March 2006

U.S. DEPARTMENT OF COMMERCE 

Carlos M. Gutierrez, Secretary 

TECHNOLOGY ADMINISTRATION 

Michelle O’Neill, Acting Under Secretary of Commerce for Technology 

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY 

William Jeffrey, Director 

 
Contents 

Abstract........................................................................................................................................... 1 

1. Motivation............................................................................................................................... 1 

2. Background............................................................................................................................. 2 

2.1 Modeling & Simulation tools for Incident management ................................................ 3 

2.1.1 Incident Impact Modeling Tools............................................................................. 3 

2.1.2 Emergency Response Planning Tools..................................................................... 3 

2.1.3 Tools for Incident management Training ............................................................... 3 

2.1.4 Tools for Identification and Detection.................................................................... 4 

2.2 Integration Efforts and Architectures.............................................................................. 4 

3. Framework for Incident management..................................................................................... 5 

3.1 Incident ........................................................................................................................... 5 

3.2 Domain............................................................................................................................ 6 

3.3 Life cycle phase .............................................................................................................. 7 

3.3.1 Prevention ............................................................................................................... 7 

3.3.2 Preparedness ........................................................................................................... 7 

3.3.3 Response ................................................................................................................. 7 

3.3.4 Recovery ................................................................................................................. 7 

3.3.5 Mitigation................................................................................................................ 8 

4. Architecture............................................................................................................................. 9 

4.1 Requirements .................................................................................................................. 9 

4.2 Concept ........................................................................................................................... 9 

4.3 Issues............................................................................................................................. 11 

5. Subsystems............................................................................................................................ 11 

5.1 Simulation subsystem ................................................................................................... 11 

5.1.1 Social Behavior Simulators................................................................................... 12 

5.1.2 Physical Phenomena Simulators........................................................................... 13 

5.1.3 Environmental Simulators .................................................................................... 15 

5.1.4 Organizational Simulators .................................................................................... 15 

5.1.5 Infrastructure System Simulators.......................................................................... 17 

5.2 Gaming Subsystem ....................................................................................................... 18 

5.2.1 Game Applications................................................................................................ 19 

5.2.2 Core Game Engine................................................................................................ 20 

5.2.3 Game Integration Infrastructure............................................................................ 21 

5.2.4 Game Management and Data Servers................................................................... 22 

5.2.5 Game Information Model ..................................................................................... 23 

6. Modes of operation ............................................................................................................... 23 

7. Concept Demonstration Prototype........................................................................................ 26 

7.1 Simulation Modules...................................................................................................... 26 

7.2 Gaming Modules........................................................................................................... 27 

8. Conclusions........................................................................................................................... 27 

9. Acknowledgement ................................................................................................................ 28 

10. Disclaimer............................................................................................................................. 28 

References..................................................................................................................................... 28 
Abstract 

The nation’s emergency responders need to work in a coordinated, well-planned manner to best mitigate 

the impact of an emergency incident. They need to be trained and be ready to act in view of the increased 

security threat. The training has been traditionally provided using live exercises at a great expense. 

Simulation and gaming systems could provide a wider range of training at a much lower expense. The 

incident management simulation-based training systems that are available or under development today are 

typically focused on a macro level sequence of events. A few systems targeted at individual responders are 

under development using gaming environments. Separate uses of such systems provide disparate 

experiences to decision makers and individual responders. There is a need to provide a common training 

experience to these groups for better effectiveness. This paper presents a novel approach integrating 

gaming and simulation systems for training of decision makers and responders on the same scenarios 

preparing them to work together as a team. An integrated systems architecture is proposed for this purpose. 

Major modules in gaming and simulation subsystems are defined and interaction mechanisms established. 

Advanced visualization, human interaction, data access and management capabilities needed for meeting 

the training objectives are described. Research and standards issues for implementation of the proposed 

architecture are discussed. 

Keywords: modeling, simulation, gaming, training, architecture, incident management, emergency 

response, integration. 

1. Motivation 

There is a growing need for improved management of both man-made and natural incidents. The man-made 

disaster risk has increased due to a rise in possibility of terrorist attacks against the United States. Effective incident 

management through all its phases, that is, prevention, preparedness, response, recovery and mitigation, presents a 

number of challenges to the responsible agencies. One major challenge is the lack of opportunities to train the 

emergency responders and the decision makers in dealing with the emergencies. An on the job training approach is 

not useful given the thankfully infrequent occurrences of such events. The responsible agencies have tried to meet 

the need through organization of live exercises, but such events are hard to organize and expensive. 

 Modeling, simulation,1

 and gaming techniques can help address many of the challenges brought forth by the 

need for improved incident management. What is simulation? In the “Handbook of Simulation”, Jerry Banks [1] 

defines simulation as: 

“.... the imitation of the operation of a real-world process or system over time. Simulation involves the 

generation of an artificial history to draw inferences concerning the operational characteristics of the realsystem that is represented. Simulation is an indispensable problem-solving methodology for the solution of 

many real-world problems. Simulation is used to describe and analyze the behavior of a system, ask whatif questions about the real system, and aid in the design of the real system. Both existing and conceptual 

systems can be modeled with simulation.” 

Gaming is the use of computer-based simulations to engage in interactions that use highly realistic scenes and allow 

the player to earn rewards through winning under defined rules. Game technology has primarily been used for 

entertainment rather than educational purposes in the past. A number of changes will be required to support incident 

management training needs. New functionality will need to be incorporated into game software to make it suitable 

for training applications. A common development strategy, a standard architecture, and neutral data interfaces will 

also be required to ensure that the game components are highly reusable. 

 Video game technology could be used to create virtual environments for the incident management trainee. 

These environments would contain realistic three-dimensional graphics and sound that could significantly enhance 

the learning experience (for examples, see [2]). Learning applications might address theory and operation of 

incident management actions and equipment. They also might include various operational scenarios where 

strategies and tactics are covered. Training could be developed for all facets of the incident management including 

 

1

 Modeling and simulation in this paper refer to use of computer-based models and simulations. Live exercises are 

identified separately when their use is referred to. 

1
law enforcement, health care, fire department, and urban search and rescue. Decision makers and first responders 

alike could make effective use of these training capabilities. 

Simulation involves defining the rules of operation and the probabilities of paths of action and time duration 

and letting the events unfold. Gaming uses trainee’s actions in determining the course of events under defined rules 

and probabilities. In the context of incident management, the two can be used together such that simulations 

maintain the technical correctness of the scenario while gaming clients allow the interaction with the trainees. 

A recent survey [3] indicates that a number of modeling and simulation (M&S) applications for analyzing 

various disaster events exist. These need to be brought together for studying the impact of disaster events as a 

whole. Not only do we need to understand how will a radioactive plume released by terrorists disperse, we also 

need to plan what traffic routes will people use to evacuate the affected areas, what demands will be placed on the 

hospital resources in the area, etc. The individual simulation models such as those for studying the radiological 

release need to be integrated with those analyzing the traffic movement through the highways and arteries of the 

affected area, and with those analyzing the resource constraints of hospital systems among others. 

The integrated set of simulation tools should be used for training the emergency responders at all levels. It is 

important that the first responders and emergency managers go through training experiences on the same scenarios

to effectively work as a team. Human beings can make good decisions under a stressful situation if they can 

recognize the pattern as similar to something they have experienced in the past per a study by Klein [4]. If they 

have not experienced a similar situation in the past, their capability to make the right decisions is impaired as there 

isn’t enough time to evaluate all the possible options and select the right ones. The understanding of human 

decision making from the Klein study suggests two important directions for emergency response training. First, 

simulation should be used to expose the emergency responders to a range of situations based on the potential 

scenarios that may occur in their jurisdiction. This will prepare them to select the right responses when faced with 

an emergency. Second, the responder teams across all levels should go through similar scenarios to develop similar 

mental concepts. This will allow emergency managers to develop similar approaches and the emergency responders 

to fully support them having experienced the success of the approaches in past simulations. 

To provide the experience of the same scenarios across all levels of an emergency response team requires 

execution of large-scale live exercises such as those conducted under TOPOFF (Top Officials) series. These largescale exercises are hard to organize since they require coordination across a large number of agencies across 

multiple levels of hierarchy. With the large number of resources devoted to such exercises, each exercise cycle 

costs tens of millions of dollars. TOPOFF 3 conducted in April 2005 had a budget of $16 million [5]. And, even 

with all the effort and expenses they are able to expose the responders, emergency managers and government 

officials to a limited set of scenarios. The creations of emergency events are limited in realism to avoid risk. 

The limitations of live exercises can be overcome to a large extent through use of integrated gaming and 

simulation models that allow emergency response personnel across multiple levels in multiple agencies to get 

exposed to the same set of scenarios. The Department of Defense has found that use of simulations instead of live 

exercises for training can reduce the training costs by up to 90% [6]. Use of integrated gaming and simulation over 

a distributed network can allow people to participate from different locations and thus provide some flexibility in 

scheduling the resources. Most importantly, use of simulation will allow providing the responders with experience 

of a wide range of response scenarios and thus significantly improve the emergency preparedness. 

The development of integrated gaming and simulation for emergency response training is a challenging task 

that requires addressing technical, business, and social issues. This paper focuses on the technical aspect of 

developing an architecture for the integration. The integration of simulation models developed independently itself 

requires action on multiple aspects. Interoperability standards need to be defined that will allow the conforming 

models and data sources to be integrated. A framework and an architecture for integration needs to be agreed upon 

by the M&S community involved in developing applications in the area of emergency response. Infrastructure for 

development and deployment of the integrated solutions needs to be established. 

This paper proposes an architecture for integrated gaming and simulation for incident management training. 

Relevant reported frameworks and architectures for modeling and simulation are reviewed. The proposed overall 

approach for integrated gaming and simulation tools for incident management training is described. The proposed 

architecture itself is presented and its major components discussed. The paper concludes with discussion of further 

research for achieving the vision of the integrated gaming and simulation for incident management training. 

2. Background 

The applicability of modeling and simulation to different phases of incident management has been recognized for 

decades (see for example [7]). However, the idea of integrating the M&S tools for a more comprehensive modeling 

2
of the scenario is more recent. In this section, a few of the M&S tools for incident management are discussed 

followed by efforts for integration of such tools. A framework for M&S for incident management is presented to 

define the scope of their application and identify the training application as part of a continuum of applications 

through the incident management life cycle. 

2.1 Modeling & Simulation tools for Incident management 

This sub-section provides a classification for M&S tools for incident management using some of the efforts as 

examples. 

2.1.1 Incident Impact Modeling Tools 

Several efforts focus on studying and projecting the impact of an incident. The projections would help determine if 

the incident is an emergency event or a major disaster and can be used for planning the response to the incident. 

These tools do not provide any facilities to model potential response actions. Some of the tools in this category can 

be used in a mitigation role by iterating through modifications of configuration of systems under study and 

evaluations of the impact of the disaster event. Such tools typically use geographic information systems to combine 

the relevant data and overlay the impact of the disaster to identify population, infrastructure and resources affected 

immediately and those to be affected subsequently by the event. Examples of such tools include: Contaminant 

Transport (CT) Analyst for modeling plume dispersion developed at Naval Research Labs [8], National 

Atmospheric Release Advisory Center (NARAC) facility at Lawrence Livermore National Laboratory for modeling 

hazardous atmospheric release [9], and building fire simulation tools developed at National Institute of Standards 

and Technology [10]. A survey of 94 modeling tools for atmospheric dispersion is available in [11]. 

2.1.2 Emergency Response Planning Tools 

Tools in this category allow evaluation of alternative strategies to respond to an incident. They may allow input of 

impact of the incident estimated by experts or determined by using tools in the previous category, or they may 

themselves include the capability for incident impact modeling. These tools may be used following the occurrence 

of an incident, or in preparedness role, that is, for planning the response for future potential incidents. Examples of 

tools in this category include the Threat Response Management System that utilizes an agent simulator to evaluate 

the planned response under various scenarios [12], and the map analysis software provided by Innovative GIS/ Berry 

& Associates /Spatial Information Systems (BASIS) that can be used for planning responses to such events as a 

forest fire [13]. Another example at a more detailed level is the Assisted Evacuation Simulation System by 

Takenaka Corporation of Japan that is designed to simulate evacuation of patients who need assistance to move [14]. 

2.1.3 Tools for Incident Management Training 

The simulation tools in this category mimic and present situations created by occurrence of an incident to human 

training subjects with the intent to improve their capabilities for incident management. These tools extend from 

those targeted at decision makers to those targeted at first responders. The simulation tools for training decisionmakers present the overall scenario and evaluate decision-maker’s approach for making high level decisions such as 

units of first responders to be deployed in different areas impacted by the incident. These tools abstract and execute 

the model at a macro-level. The tools at the macro level typically use one or more computer monitors to graphically 

display the simulated unfolding of a disaster event and the response actions. An example of such tools is the 

Weapons of Mass Destruction Decision Analysis Center developed by Sandia National Lab as a way to simulate a 

war-room environment in the event of a terrorist attack [15]. Another example is the Emergency Preparedness 

Incident Command Simulation (EPiCS), a computer-based, scenario-driven, high-resolution simulation tool [16]. 

Simulation tools for training first responders may abstract and execute the model at micro-level detail. These 

tools may use agent-based techniques to simulate the detailed actions of first responders and/or terrorists. In such 

use they are parallel to the use of troop level detailed simulation by the US Army to analyze the impact of tactical 

approaches for different scenarios. The micro level simulations require specification of behaviors of involved 

characters and detailed procedures. While they are more useful for planning purposes such as evaluating evacuation 

plans for a facility, they can be used for training through their use to iteratively evaluate suggested response 

approaches by incident management trainees. 

3
Detailed simulations are also used for supporting live exercises. For example, simulation has been used to 

model the spread of a chemical agent in a live exercise [17]. This allows the live exercise to be conducted without 

exposing the first responders to danger. While the use of simulation at a micro level of detail is useful for training 

first responders on successful approaches, they allow limited interaction. The first responders gain more when they 

are able to experience the emergency and respond to it. Gaming tools described next provide such capabilities. 

The computer based tools most suitable for first responder level training are the gaming tools. These may be 

immersive using advanced hardware configurations or based on the use of personal computers. The immersive tools 

use virtual reality (VR) that allows a first responder to enter the disaster zone and react to the simulated unfolding 

events at the detailed level. The tools may utilize accessories that provide physical feedback to the trainee or 

communicate with them using visual cues on the display. An example of tools in this category is BioSimMER, a 

VR application that immerses first responders in a computer-simulated setting of a small airport in which a 

biological warfare agent has been dispersed following a terrorist bombing [18]. 

The architecture presented in this paper has been designed to integrate both simulation and gaming tools for 

incident management training. 

2.1.4 Tools for Identification and Detection 

Simulations of disaster events can be used for detailed analysis and developing techniques for identification and 

detection of the occurrence prior to the event. The identification of factors that provide an early warning of 

impending disaster events can provide a valuable means to mitigate or even prevent the occurrence. An example of 

such a tool is Warning Decision Support System (WDSS) that has been developed by National Oceanic and 

Atmospheric Administration’s (NOAA) National Weather Service (NWS) and the National Severe Storms 

Laboratory (NSSL) to better detect the low-top, high-shear thunderstorms that are responsible for many of the shortlived events classified as weak tornadoes [19]. 

This sub-section described a number of categories of M&S tools with examples. A more detailed survey of 

such tools is provided in [3]. The full potential of M&S tools can be exploited when the tools can be brought 

together rapidly to study and analyze all major aspects of a disaster event. An emergency response scenario with 

and without the use of integrated M&S tools to highlight their value is described in [20]. 

2.2 Integration Efforts and Architectures 

A number of simulation tools have to be integrated to address multiple aspects of a single disaster event as described 

in section 1. The need for such integration in the incident management context has been recognized as evident by 

the urban security project at Los Alamos National Labs that integrates plume simulation and traffic simulation to 

compute exposures to the cars traveling through the plume [21]. The Simulation Object Framework for 

Infrastructure Analysis (SOFIA) project at Los Alamos National Laboratory is developing a high-quality, flexible, 

and extensible actor-based software framework for the modeling, simulation, and analysis of interdependent 

infrastructures [22]. 

A number of research efforts have been targeted at integration of simulation models outside the context of 

incident management. In particular, Department of Defense has spent a large effort in developing war gaming 

capabilities that integrate a number of simulation models and humans-in-the-loop. The United States (U.S.) 

Department of Defense (DoD) sponsored research in this area started in the late 1980’s with Simulation Networking 

(SIMNET) project for real-time battlefield simulations of tanks in a virtual training environment. Most recently one 

thread of the work is evolving into the Standard Simulation Architecture, designed as a combination of the High 

Level Architecture (HLA) and the Synchronous Parallel Environment for Emulation and Discrete-Event Simulation 

(SPEEDES) developed in the mid to late 1990’s [23]. Another group of researchers is proposing bringing HLA 

together with the Model Driven Architecture (MDA), a concept developed by the Object Management Group 

(OMG). The model driven architecture uses a language, vendor and platform independent meta-model as the core 

representation, with facilities defined to translate the representation for implementation. The combination of HLA 

and MDA offers benefits to both the developments and is recommended by Tolk [24]. Any proposed architecture 

based on HLA should weigh the alternate approaches and their support in the industry and accordingly plan the 

implementation. Overall, the focus of the DoD developments has been on war gaming involving a number of 

human decision-makers and actors. The associated research should prove to be very useful for integrated 

simulations for incident management, particularly for training applications. 

4
Simulation applications for homeland security can get a jump start through adaptation of DoD integrated 

simulations, in particular, for larger jurisdictions with sufficient funding availability. United States Joint Forces 

Command is carrying out a leading effort in this direction. The Joint Theatre Level Simulation (JTLS) and Joint 

Conflict and Tactical Simulation (JCATS) have been integrated for multi-resolution modeling for training of 

emergency management staff [25]. The integrated system was used successfully for the Determined Promise 2004 

homeland security exercise involving a large number of emergency response personnel across multiple locations. 

The integration of simulation models requires that the data is translated from one model to another model in the 

right context. Typically, human analysts have to spend some time ensuring that the translation of data is consistent 

based on the semantic understanding. Translation using syntactic grammar can be more efficient but not always 

possible. An agent-based architecture has been developed that uses object-oriented modeling techniques to 

encapsulate and organize the syntactic information while the semantic information of the objects is examined for 

data integration purposes [26]. The proposed architecture can provide value for interoperability of incident 

management simulations. 

The Dynamic Information Architecture System (DIAS) has been developed at Argonne National Laboratory as 

an object-oriented simulation system that provides an integrating framework for new and legacy applications and 

can adapt to different contexts [27]. The system has been used both for U.S. Department of Defense applications 

and civilian applications. It is frame-based and uses the concept of entity objects as analogs to the real world entities 

being studied. It uses an extensive library of entity objects that can be used in modeling environmental, 

transportation, and command and control applications. The requirements for building the library of objects may 

require a large effort for implementation of the system in an incident management context. 

HLA has been used for integrating distributed simulation models in the manufacturing domain. A neutral 

reference architecture was developed for integrating distributed manufacturing simulation systems with each other, 

with other manufacturing software applications, and with manufacturing data repositories [28]. The need for 

standardization of interfaces was highlighted. Experience from this past research may be useful in the development 

proposed here. 

This brief review of related research indicates the feasibility of developing an architecture for M&S of incident 

management and at the same time indicates a need for standardization of interfaces and semantic and syntactic 

representations.

3. Framework for Incident management 

An integrated framework for incident management is defined in this section to enable an organized approach to the 

use of M&S in this area. The proposed framework is based on an earlier work [20], but it goes beyond through use 

of terminology and concepts used in the National Response Plan (NRP) developed by the United States Department 

of Homeland Security [29]. The primary users of such a framework would be developers of M&S tools as they 

would gain from an organized approach to the incident management area. The framework identifies the scope of the 

incident management area, provides a scheme to map the current tools and determine the gaps, and helps identify the 

interfaces that the tools may have to other tools. It will thus help capture the interoperability requirements for the 

M&S tools. Although the framework has been designed to help guide the M&S efforts, it may be seen that it 

provides a general scheme for organizing the incident management area.

The incident management area can be classified using various criteria and various viewpoints. A high level 

framework is proposed to help organize the area. The framework is designed to be three dimensional for ease of 

understanding. Additional dimensions should be accommodated at more detailed levels of the framework. The 

three major dimensions are described below. 

3.1 Incident 

An incident is defined as “an occurrence or event, natural or human-caused, that requires an emergency response to 

protect life or property” [29]. The kind of incident will have a large influence on the kind of M&S capabilities that 

need to be brought together for response and its management. For example, a building explosion and fire event 

requires capabilities for modeling the impact of explosion and fire on the building structure and its occupants, while 

a hazardous release in the atmosphere requires capabilities to model the dispersion of the release in the atmosphere. 

Admittedly there are some capabilities that are required for a number of scenarios. These include capabilities such 

as traffic simulation and information flow simulation. Also, man-made and natural incidents may have similar 

5
impact. For example, forest fires can be initiated by intentional or unintentional actions of people or by natural 

causes. 

3.2 Domain 

A domain is defined as a group of entities that have similar characteristics with respect to incident management 

considerations. The incident may have an impact across different domains including civilian population, critical 

infrastructure, and environment. The response to and management of the incident may involve multiple domains 

including government agencies and private sector. Entities within domains may both suffer the impact of incidents 

and may be involved in response. The domains may be modeled at a level of detail appropriate to the objective of 

the study. Each of the domains represents multiple entities as discussed below. 

• The civilian population domain includes affected residential and commuter civilians in the incident area and 

identifies the capability to model individual and unorganized groups of human beings. Various aspects of 

civilian population may be of interest including casualties, social and psychological effects of the incident, 

behavior of groups before, during and after the incident. The civilian population behaviors would influence the 

extent of an incident such as spread of epidemics, exposure to and transmission of released biological or 

chemical agents, crowd movement, rioting, and evacuation patterns. The assets owned and operated by the 

civilian population, e.g., vehicles are also considered part of this domain. The civilian population domain 

would include the “unaffiliated volunteers” identified in the NRP. 

• Critical infrastructure domain includes transportation networks, electric power generation and distribution 

facilities, water filtration and distribution structure, and communication networks. and identifies the capability 

to model the behavior of such systems and associated organizations under peak, normal and damaged use. Both 

public and private elements of infrastructure are included. While there have been several different lists of 

critical infrastructures, this category is intended to include the most comprehensive list of twenty infrastructures 

defined in a report to U.S. Congress [30]. The organizations responsible for the operation and management of 

critical infrastructures are also included in this domain. The domain also includes the assets of such 

organizations. 

• The environment domain includes both the natural and built up components. The natural environment includes 

terrain, ocean, weather, and hydrology, together with the capability to model them in three dimensions and their 

respective behaviors. The built up environment includes buildings, structures, cultural and historical resources 

that are not part of critical infrastructures discussed above. It includes the capability to model building and 

structures in three dimensions with their features and the impact of disaster events on them. The environment 

may be modeled at anywhere from regional, state, county, city or block level as appropriate to the incident 

being studied. An incident in a national park may involved modeling of the natural environment at block level 

without including the built up environment. The reverse may be true for an incident in the downtown area of a 

city. 

• The government agencies domain includes all the government organizations that either play a role in incident 

management or are affected by the incident. This includes fire, police, and city management, and identifies the 

capability to model the organization and its people with their command and control structure and information 

flows. It also includes multi-agency organizations such as Emergency Operations Centers (EOCs) that may be 

temporarily formed for incident management. It also includes the assets that are owned and operated by the 

government agencies including fire trucks, personal protective equipment, and computer and communication 

equipment in the EOC. 

• The private sector domain includes all the private organizations, commercial and non-profit, that may be 

affected by and/or involved in the incident management activities. The entities in this domain may be modeled 

as a group, such as, the airline industry or as individual organizations, such as the individual airlines playing a 

role in evacuation efforts. In addition to understanding the impact of their roles in response, modeling this 

domain would also be needed if the objective is to study the financial and economic impact of large scale 

incidents. 

• The final category of “other” is defined to include entities that don’t clearly fit into one of the previous 

categories but may need to be modeled for specific cases. For example, it may be important to model farm 

animals for an attack on the food supply. 

6
3.3 Life cycle phase 

Incident management includes prevention, preparedness, response, recovery, and mitigation for emergency and 

disaster incidents [29]. The capabilities of the needed M&S tools may differ based on the incident management 

lifecycle phase they are designed for. Applications for the lifecycle phases in the incident management area are 

briefly described below. 

3.3.1 Prevention 

In the prevention phase, simulation-based applications can be used for vulnerability analysis and surveillance and 

detection. The vulnerability analysis applications would be focused on evaluation and assessment of physical 

security features and strategies, policies and procedures. M&S tools can be used to create a number of incident 

scenarios and evaluate the performance of physical security and strategies. The identified shortcomings can be 

reduced or eliminated. Examples of vulnerability analysis applications include evaluation of physical security and 

procedures at a nuclear plant and evaluation of cyber security for a government agency. 

The surveillance and detection applications will include use of tools that study given scenarios and determine 

the possibility of the occurrence of an incident. Actions can then be taken to prevent or mitigate the occurrence. It 

is anticipated that such tools will use pattern matching on past history databases to identify and detect potential 

threats. Examples of such applications include selection of security sweep targets in areas with majority of 

inhabitants from a target background and identification of the potential for tornado occurrence given the weather 

conditions. 

3.3.2 Preparedness 

In the preparedness phase, simulation-based applications can be used for planning, training and systems testing. The 

planning applications will include tools for determination of impact of an incident and the tools for aiding 

development of the response action plans and strategies. The planning applications can range from those for long 

term issues such as location of emergency response facilities and manpower to focused issues such as aiding 

development of specific response procedures. 

The training applications will include tools that allow training response personnel for handling emergency 

events. These may include interactive simulations where the tools create an imaginary scenario and the trainees 

input their response actions. The tools will help evaluate the response actions and thus help the trainee learn what 

works best for a given situation. These tools may range from interactive simulations using a monitor to totally 

immersive gaming environments including data gloves, helmets and force feedback devices. Examples of training 

applications include first responder resource deployment decisions following an incident, and fire fighting. 

The systems testing application will include tools that allow testing of systems and equipment used for 

emergency response. These may include applications that allow hardware emulation and software simulation to 

create a scenario where a part is simulated in software while the remaining is simulated in real live exercise. It will 

allow testing of systems such as those for tracking emergency response vehicles and those that provide information 

to emergency operations centers. It will also allow testing of hardware such as communication devices in 

emergency response situation with severe overloading of bandwidth. 

3.3.3 Response 

The response applications will include tools that evaluate the impact of an incident through real-time updates on the 

situation, and use the available information to project current and future impact of the disaster. It also includes tools 

for evaluating alternative response actions and strategies based on the current and projected impact. The evaluations 

are then used to direct the response actions on the ground. Examples of response applications include response to a 

large explosion at an office building, and response to a chemical agent release in the atmosphere. 

3.3.4 Recovery 

The recovery phase will require tools that evaluate the long-term impact of an incident and recovery actions. During 

this phase M&S tools can be used for evaluating alternative restoration actions and strategies based on the current 

and projected impact. Results of simulation will allow determining the best course for recovery. Examples of 

7
recovery applications include decontamination of the area affected by a chemical agent release in the atmosphere, 

and restoration of the damaged infrastructure following an earthquake. 

3.3.5 Mitigation 

Applications for mitigation may overlap in function and scope with other lifecycle phases since mitigation measures 

may be implemented prior to, during, or after an incident [29]. For the purpose of the proposed framework, the 

mitigation lifecycle phase is defined to focus on post-incident activities. M&S application in this phase can be used 

to evaluate alternative loss reduction measures using the data for past incidents. They can also be used to estimate 

the losses avoided due to the presence of previous mitigation measures. Examples of mitigation applications include 

selection of measures for reducing losses due to terrorist attack at a chemical plant, and, estimation of losses 

following a flood in the absence of a dam built around the city center. 

Figure 1 shows the concept of Framework for Incident Management (FIM). The three major dimensions 

described above form the three axes of the cube that is used to represent the incident management area. Each cell in 

the cube defines the management and/or impact of an incident type or a specific incident on a particular domain and 

the associated applications required in the phase defined along the lifecycle dimension. The cells will also include 

the modeling of results of actions by the entities within the domains. The location of the cell along the lifecycle 

phase dimension classifies the need for the affected domains. 

Civilian Population

Critical Infrastructure

Environment

Government Agencies

Private Sector

Other

DOMAIN

Prevention

Preparedness

Response

Recovery

LIFECYCLE PHASE

Mitigation

INCIDENT

MAN-MADE NATURAL

-Conventional bomb

Conventional bomb

-Hijacking

Hijackin

-...

...

-Hurricane

Hurricane

-...

...

-Flood

l

-Wild fire

Wild fire

-Tornado

Tornado

- NBC bomb

NBC bomb

-Fire

Civilian Population

Critical Infrastructure

Environment

Government Agencies

Private Sector

Other

DOMAIN

Prevention

Preparedness

Response

Recovery

LIFECYCLE PHASE

Mitigation

INCIDENT

MAN-MADE NATURAL

-Conventional bomb

Conventional bomb

-Hijacking

Hijackin

-...

...

-Hurricane

Hurricane

-...

...

-Flood

l

-Wild fire

Wild fire

-Tornado

Tornado

- NBC bomb

NBC bomb

-Fire

Figure 1. Framework for Incident Management (FIM) 

The Framework for Incident Management also defines the framework for M&S as it defines the needs that 

M&S applications should satisfy. Each cell of the FIM defines needs that M&S tools can fill or support. For 

example, incident management may need to address the training requirements for government agencies for a fire 

disaster event in preparedness lifecycle phase. M&S applications can provide models that train people for various 

aspects of dealing with a fire emergency, such as determining the escape route, determining the means to put out the 

8
fire at individual firefighter level and at the fire company level. The framework thus captures the needs for M&S 

applications for incident management. 

The framework also identifies the need for M&S applications for supporting an event at each phase in its 

totality. In the above example, M&S capabilities addressing each of the affected and involved domains can jointly 

provide the ability to analyze and support an event from a holistic viewpoint. The M&S capabilities for such a 

holistic approach may be provided in a monolithic application or more likely through a number of applications, each 

covering one or more of the entities within identified domains, integrated using a distributed simulation architecture 

such as the one proposed below. 

4. Architecture 

Simulation and gaming-based technologies can together provide a highly effective means for incident management 

training if integrated correctly using an appropriate architecture. 

4.1 Requirements 

The architecture for simulation and gaming for incident management training should provide the following major 

capabilities: 

• Creation of a federation of simulation and gaming modules appropriate to represent the selected incident 

management scenario. 

• Integration among heterogeneous simulation federates modeling interrelated aspects of the emergency 

event. 

• Integration among heterogeneous gaming modules with trainees role-playing within the same locale in the 

emergency event simulation. 

• Synchronization between the macro-level modeling of simulation and micro-level modeling of gaming 

modules. 

• Control over execution of both simulation and gaming modules through a training manager console. 

• Execution in Massively Multi-player Online Games (MMOG) mode to support a large multi-agency 

incident management exercise. 

• Access to heterogeneous data servers for supporting simulation and gaming modules. 

• Management of MMOG execution. 

• Management of simulation federation execution. 

• Reusability of simulation and gaming module components. 

4.2 Concept 

An architecture to meet the above requirements is conceptually presented in Figure 2. The architecture will have 

two major subsystems – one for simulation and the other for gaming. The simulation modules will each represent 

one of the major aspects of the emergency event or its response. The simulations will be based on defined behaviors 

of involved entities including the incident management organizations. The gaming modules will provide for roleplaying by emergency responders in roles represented in the figure. Simulation and gaming subsystems will have 

their individual communication integration infrastructure. The two infrastructures will be linked through a data 

synchronization and transfer processor as shown in the figure. 

The simulation communications infrastructure may be based on HLA. HLA is a standard, originally initiated by 

the DoD, for implementing distributed simulation [31]. In HLA terms, the individual simulations are called federates 

and the distributed simulation is referred to as a federation. The HLA defines a framework by which individually 

executing federates can be combined into a distributed simulation federation. 

The HLA framework has three major parts. The first part is a set of rules that federates and federations must 

adhere to ensure that a federation operates properly. The second part is a software system called the Run Time 

Infrastructure (RTI). The RTI defines an interface that provides a number of services that federates can use to 

communicate (i.e., exchange simulation data), and coordinate their execution (i.e., synchronize simulation clocks) 

with other federates in a federation. The third part of the HLA is called the Object Model Template (OMT). The 

OMT provides a means for describing the format of the data that will be exchanged between federates. For more 

information on distributed simulation using HLA, see [33]. 

9
Simulation Communications Integration Infrastructure

Organizational

Simulators

Social 

Behavior 

Simulators

Environmental 

Simulators

Physical 

Phenomena 

Simulators

Simulation 

Federation 

Management

Infrastructure

System

Simulators

Gaming Communications Integration Infrastructure

Live 

Elements MMOG 

Management

Support 

Institutions

 Response

Management

On Scene 

Response

Civilian 

Population 

and 

Opposing 

Forces

Data 

Synchronization 

and Transfer 

Processor

MMOG

Data 

Servers

Federation 

Data 

Servers

Figure 2. Architecture concept for Simulation and Gaming Incident management Training System 

HLA may need to be enhanced to meet the requirements for the incident management training environment 

including the need to synchronize with the gaming subsystem. For example, a pre-definition of the Federation 

Object Model (FOM) representing all the objects used by federates is required by HLA. This requires a large set up 

time for creation of the federation. A distributed scheme similar to that used in [32] may be useful to reduce the set 

up time and thus enable plug compatibility. 

The simulation subsystem will contain a number of modules within each of the groups shown in figure 2. The 

individual modules will model an aspect of the incident or response and will interact with other modules based on 

the scenario. The modules will also interact with the data servers and will be controlled by the simulation federation 

management. The data servers will include one for Geographical Information Systems (GIS) data. Such data will 

be used as input to simulation modules and for visualization of simulation outputs. All the interactions will go 

through the simulation communications integration infrastructure. 

The gaming communications integration infrastructure may be based on the Massively Multi-player Online 

Gaming (MMOG) architecture. Traditionally, MMOGs have used a client server architecture. The massive scale of 

these games has led to distributing the server load on a set of machines arranged in a grid or a cluster. Similar to 

the HLA discussion above, the MMOG architecture will need to be enhanced to meet the requirements of incident 

management training and the need to synchronize with the simulation subsystem modules. 

The gaming subsystem will also contain a number of modules within each of the groups shown in figure 2. 

Trainees will immerse themselves into the scenario using the modules as game clients. They may interact with other 

trainees on other game clients and with entities that are controlled by simulation modules. The gaming modules will 

also interact with the data servers for the required data to execute the games. The information would include the 

detailed 3-D descriptions of the locales at and around the location of emergency incident. The locale 3-D geometry 

data will be accessed as warranted by the simulated movement of the trainees around the simulated area. The 

interactions will occur logically in the game environment and physically over the gaming communications 

integration infrastructure. 

The proposed architecture will allow the training environment to be highly configurable. Simulation and 

gaming components can be selected and integrated based on a defined scenario. A scenario involving a terrorist 

attack using a dirty bomb during Independence Day fireworks on the National Mall in Washington DC can be 

modeled using components of the proposed system. The simulation modules employed for such a scenario may 

include crowd, traffic, explosion, plume, weather, fire, law enforcement, health care, transportation and 

communications. The gaming modules for the scenario may include victims, general public, terrorists, fire, police, 

emergency medical technicians (EMT), hazardous material (HAZMAT) professionals, hospitals, shelters and public 

transportation. A natural emergency event such as hurricane would require a different set of modules. The available 

modules in the proposed architecture can thus be configured to train incident management personnel across a range 

of scenarios. 

The architecture concept will also allow flexibility in hardware systems for executing the training environment. 

The system modules will be distributed across a network of machines when training a large team. They will be set 

up as multiple processes executing on a multi-tasking operating system such as Microsoft Windows on a standalone 

machine for training an individual. 

10
4.3 Issues

Realization of the proposed architecture presents some challenges. The primary challenge is the development of 

mechanisms for communications and time synchronization between and among simulation modules and game 

modules. Major issues associated with distributed multi-player games are how and when players receive 

information on fellow players’ actions. Time lags may occur between when a player initiates an action and when 

other players see the action. This latency causes problems in the execution of distributed games. The HLA RTI 

technology does not require the use of servers for centralized management of game data but uses time 

synchronization mechanisms that may be unacceptable in a game environment. In the HLA RTI world, simulators 

publish and subscribe to data objects to communicate. Simulations may be time-regulating or time-constrained. 

An associated challenge is the management of the training of people from different levels of incident 

management hierarchy. The best mode for training the first responders using a game client is to execute in real-time 

(i.e., time progress in game environment same as wall clock time). The best mode for training the incident 

managers and other personnel operating in Emergency Operation Centers (EOCs) may be segments of real-time 

execution interspersed with accelerated time (i.e., time progress in simulation environment faster than wall clock 

time) and fast forwards (i.e., simulated time jumping to a few hours or a day later). This mode will allow the EOC 

team to train in decision making over few simulated days of an unfolding emergency event while spending only a 

day in wall clock time. Combined training of first responders and EOC teams would require careful orchestration 

of time segments and fast forwards. 

Distributed simulation architectures have come a long way. HLA is the current standard architecture for the 

purpose. However, HLA has grown from the background of war games executed in real-time. While HLA has 

been used for accelerated time execution to some extent, it may be a challenge to achieve speedups of 10 times and 

above with the large number of modules envisaged for a full scenario training. 

MMOG architecture is still evolving. There is no standardization in this field as each game provider is using its 

own proprietary architecture. An open MMOG architecture will need to be developed that would allow plug 

compatibility of different gaming modules. The architecture should also allow plug compatibility of components of 

the core game engine also. 

Massively Multi-Player (MMP) functionality involves the use of servers and is widely used in the gaming 

world. Due to its success as a commercial mechanism for distributed simulation and gaming, it should receive 

serious consideration for incident management applications. There have been security vulnerabilities associated 

with MMP games that have allowed players to cheat therefore appropriate safeguard must enacted. For more 

information on MMP technology, see [34]. 

Software licenses for game development systems and game distribution are often quite expensive. Pervasive 

use of this technology will require that many contractors of the United States Department of Homeland Security will 

need access to licenses to develop training applications. Perhaps hundreds of thousands of game-based training 

applications will ultimately be distributed. Game engine developers often collect royalties on each game sold. If 

commercial game engine software is used, the traditional business models of these software vendors may need to 

change.

5. Subsystems 

The architecture description in the previous section showed two major subsystems - simulation and gaming, each 

with a number of major groupings. This section provides descriptions of the two major subsystems and their major 

groups. 

5.1 Simulation subsystem 

The simulation subsystem includes simulators that model the major capabilities and phenomena involved in incident 

management as shown in Figure 3. Together these simulators will create the incident with all its major aspects and 

the responses by all the major agencies involved. The modeling of all the major aspects will capture the 

interactions, planned and random, that will create unanticipated situations that occur in the real world during an 

emergency incident. Thus the simulation subsystem will create the emergency incidents in the virtual world. The 

ability to represent the incident in the virtual world together with the associated major aspects and the creation of 

unanticipated interactions will provide a valuable training environment. 

11
Figure 3. Simulation subsystem and its modules. 

The simulators in the simulation subsystem will need to operate at a level appropriate to the training audience. 

It will be appropriate to simulate the incident and the response at a macro level for training of emergency managers 

if they are being trained alone. If only the emergency responders are being trained, the incident needs to be 

simulated at a micro level. To have both the emergency manager and responders experience the same incident a 

combination of simulations at macro and micro levels will be needed. For example, emergency managers would 

need to know the time it takes for response vehicles to get to an incident site. However they may not need to get 

into the detail of the traffic congestion they had to go through along the route to get there. The vehicle travel times 

can be determined through a macro level simulation that may require determining the route from dispatch point to 

incident site and determine the travel time based on the distance and congestion factors based on the time of the day. 

On the other hand, for training a responder in the same scenario, the actual drive may need to be modeled. The 

responding unit needs to experience going through the traffic and facing the movement of individual cars. A micro 

level simulation will be needed in this case. 

The description of the simulators below provides a brief description of their capabilities. For brevity, the 

functionality at macro and micro levels is not discussed. An increase in level of detail from macro to micro 

simulation similar to the traffic simulation example above can be envisaged. Each of the modules should include 

capability for empirical and detailed simulation. 

5.1.1 Social Behavior Simulators 

The social behavior simulators will simulate phenomenon based on actions of multiple individuals. These include 

modeling of crowd, traffic, epidemic and consumer behavior. Other additional modules may be defined for social 

behaviors that are needed for specific situations. Each of the defined modules involves interaction of individuals 

leading to a collective behavior or phenomena. These models are individually described below. 

1. Crowd Simulation should model crowd status and movement at locations of interest under different event 

scenarios, crowd behavior and crowd management strategies. The locations of interest may include areas 

around actual and potential emergency incident sites, major business, commercial and residential areas that 

may be affected by evacuation directives, and major public transportation points such as bus and train 

stations, local rail transport stations, and airports. Different event scenarios may include normal, rush hour, 

12
terrorist attack, accidental fire, natural disaster, etc. The models may predict crowd movement and crowd 

density variations along movement directions, predict occurrence of stampede and casualties, perform route 

planning through the crowd for selected individuals (such as first responders), determine location of 

individuals as a function of time, predict individual movement times between selected points. Inputs may 

include street layouts including pedestrian areas, layouts within public buildings such as train stations and 

public parks, crowd volumes and density data, probabilities for stampede and casualties, weather 

conditions, location of emergency incidents, behavioral models of individuals, sensor data, and 

communications. Outputs may include location and status of specific individuals in the crowd, crowd 

volumes and density by city block and passages within public buildings and parks, crowd movement times 

between selected points, and crowd management systems data. 

2. Traffic Simulation should provide models of general traffic flow and specific vehicle movements for a 

given region under different event scenarios (normal, rush hours, off-peak hours, terrorist attack, natural 

disaster, evacuation, etc.), driver behavioral models, and traffic management strategies. The model may 

perform automatic route planning for selected vehicles, generate random events that disrupt traffic flow 

(vehicle breakdowns, accidents, traffic management system failures), determine vehicle locations as a 

function of time, predict travel times between locations, etc. Inputs may include road network layout and 

characteristics, traffic management system description and status, individual vehicle locations and status, 

driver moods, historical traffic volume and vehicle density data, pedestrian data, probabilities for accidents, 

incidents, weather conditions, location of emergency incidents, behavioral models of vehicle operators, 

sensor data, and communications. Outputs may include locations and status of specific vehicles, traffic 

volume and densities by area or road segment, travel times between selected locations, accident data, and 

traffic management system data. 

3. Epidemic Simulation is included within social behavior simulation as the spread of epidemic is highly 

dependent on social interactions. This component should provide models on the spread of epidemics in a 

given region for different types of diseases under various initial conditions (exposure at public place such 

as shopping mall, at an event with a large gathering such as football games, at public schools etc) and under 

different public awareness scenarios (normal, heightened following the news of epidemic, very high 

following the imposition of movement restrictions by authorities). Inputs may include the demographic 

distribution in the region of interest, population interaction parameters, likelihood of epidemic spread under 

different conditions, strategies by health agencies for vaccination and containment, strategies by 

government agencies for public information and containment, and weather conditions. Outputs may 

include a time profile of the spread of an epidemic and resulting need for health care, law enforcement and 

other services. 

4. Consumer Simulation should model consumer behavior following the occurrence of an emergency event. It 

will model such phenomenon as stocking of food, fuel and other essential supplies and resulting shortages. 

The shortages can in turn lead to rioting situation unless checked. Inputs may include perceived and actual 

impact on essential supplies following an emergency event, consumer behavior patterns, demographic 

information together with purchasing power profiles, number, location, operating hours and inventory 

status for outlets of essential supplies. Outputs may include time profile of availability of essential 

supplies, consumer sentiment and behavior. 

5.1.2 Physical Phenomena Simulators 

These simulators will model the physical phenomena involved in the creation and growth of the emergency incident. 

These may include such physical phenomena as earthquake, explosions, fire, chemical, biological or radiological 

plume, etc. These simulators will provide the extent of the damage while other simulators may model the impact of 

the damage on the associated systems. For example, the earthquake simulators will predict the extent of damage to 

the road network; the transportation system simulator will model the impact on transportation at a high level while 

the traffic simulator will simulate the impact on traffic resulting from the damaged road network at a detailed level. 

The simulators described below include the major physical phenomenon relevant to incident management. Other 

modules may be defined as needed. 

13
1. Earthquake Simulation should provide modeling of an occurrence of an earthquake, the resulting damage to 

physical structures and associated casualties. Inputs may include description of critical infrastructure 

elements in the region of interest, their vulnerability to earthquakes, the description of major buildings and 

facilities and their human occupancy profile for different times of the day, the probability of occurrence of 

earthquakes of different magnitudes, the location of other assets of interest (vehicles, etc.) inside and 

around the structures. Outputs may include the identification of region affected by earthquake, the damage 

to different elements of infrastructure (road network, power distribution, communications, etc.), the damage 

to buildings and facilities, the number and kind of human casualties in the affected region, identification of 

damaged assets and the extent of damage. 

2. Explosion Simulation component should model the damage to structures and casualties resulting from 

explosions of different magnitudes. The structures may include critical infrastructure elements such as 

bridges, dams, power stations and communication towers, public facilities such as train stations, malls, and 

office buildings and structures of national significance such as monuments. Inputs may include description 

of physical structures, their vulnerability to explosions of different magnitudes, human occupancy profiles 

for different times of the day, the location of other assets of interest inside and around the structures. 

Outputs may include the identification of structures affected by the explosion(s), the damage to different 

elements of infrastructure (road network, power distribution, communications, etc.), the damage to 

buildings and facilities, resulting fires in the structures considered, resulting plumes from the explosion, the 

number and kind of human casualties within and around the affected structure, identification of damaged 

assets and the extent of damage. 

3. Fire Simulation should simulate the damage to structures and casualties resulting from fire. The structures 

may include critical infrastructure elements and public facilities as listed above. Inputs may include 

description of physical structures including characteristics relevant to spread of fire (contents and 

inflammability), initiation and location of fire (accidental, intentional with fire accelerants, fire bombs, 

explosions, etc), human occupancy profiles for different times of the day, location of other assets of interest 

inside and around the structures, and weather conditions. Outputs may be similar to the two modules in 

this group discussed above. 

4. Plume Simulation should model the dispersion of plumes of various kinds including chemical, biological 

and radiological agents. Inputs may include the characteristics of the agent released, release mechanism 

used, the location of release point, terrain and structures around the release point, and weather conditions. 

Inputs may alternately be based on the sensor readings over time in the area of interest indicating the 

presence of an agent and the direction(s) of the spreading plume. Outputs may include time profile of the 

plume, and exposure profile for the population in the region affected by the plume over time. 

5. Disease and Bio-agents Simulation should simulate spread of diseases and bio-agents based on physical 

phenomenon, such as release of a bio-agent using a crop duster plane over a populated area. For some 

diseases, this component may model the initial spread of the disease based on physical phenomenon 

followed by the use of epidemic simulation component to model further spread of the disease based on 

social behavior. Inputs may include the characteristics of the disease virus, bacteria or bio agent, method of 

release or introduction of the agent into the environment, location of release point, demographics of the 

region of interest including the vulnerability to the particular agent, and weather conditions. Outputs may 

include the spread of the agent and exposure profile for the population over time. 

6. Biotic Invasion Simulation should model the spread of biotic invasions such as malicious introduction of 

predatory species into the local environment with significant economic impact. Inputs may include the 

characteristics of the species, the description of land or water mass where the species was introduced, the 

land and water system interconnections, the population of local species that may be affected by the 

predatory species, and characteristics of efforts to stop the spread of the predatory species. Outputs may 

include the spread or decline of the biotic invasion over time. 

14
5.1.3 Environmental Simulators 

These simulators will model the environmental phenomena that may affect the growth or containment of the 

emergency incident, its impact on the population or the efforts by responding agencies. Such environmental 

phenomena include weather, watershed, indoor climate, and ecology. These simulators will model these phenomena 

and provide the outputs to other simulators for modeling the impact. For example, the weather simulator will model 

the weather pattern over the duration of simulation; the fire simulator will model the growth or reduction in the fire 

due to weather conditions, while the fire department simulator will model the impact on fire fighting efforts due to 

weather conditions. These simulators are described below. 

1. Weather Simulation should model the weather conditions during the simulation horizon. Inputs may 

include the initial conditions and the probability of incoming weather systems of different types (clouds, 

storms, winds, etc.). Outputs may include the change in weather conditions over the simulated horizon 

including wind speeds and directions, temperature, pressure changes, and precipitation. 

2. Watershed Simulation should simulate the watershed systems of the region of interest and its impact on the 

growth or containment of the emergency incident. This component will be needed for incidents such as 

release of toxic agents in water systems by terrorists, or release of predatory foreign species. The inputs 

may include the description of watershed systems in the region of interest, the links and flows between 

different parts of the watershed system, and the weather conditions. The outputs may include the spread of 

the introduced agents or species through the watershed system. 

3. Indoor Climate Simulation should model the climate systems within buildings and other structures 

occupied by people. This component should simulate the spread of air-borne agents introduced through 

indoor climate systems. Inputs may include the description of the duct systems including the intakes and 

vents, the capacity of the system, the location and sizes of door, windows and other openings, the method 

of introduction of air-borne agents (through air intake, through windows, doors), the characteristics of the 

air-borne agent and the occupancy profile of areas of the building/structure. Outputs may include the 

spread of the agent through the building/ structure over time and the extent and number of people exposed 

in different areas. 

4. Ecology Simulation should simulate the ecological system in the region affected by an emergency incident. 

For example, this component should model the effect of a toxic plume on the ecology of the area exposed. 

Inputs may include the characteristics of the toxic released in the region of interest, the composition of the 

ecology of the area including the landscape, watershed, plant and animal species in the area, and the 

weather patterns. Outputs may include the time profile of impact on the ecology due to the release of the 

toxic. 

5.1.4 Organizational Simulators

These simulators will model the actions of the organizations involved in any aspect associated with the incident. 

The organizations modeled may include the fire, law enforcement, health care, other government agencies and the 

terrorist organization. The simulator will model the flow of information within the organization, flow of authority 

and decisions and the resulting actions. It will utilize the relevant policies and procedures to model the behavior of 

the organization and its members. These simulators are described below. 

1. Fire Department Simulation should simulate the actions of the fire department in response to an emergency 

incident including the assignment of resources for response, the actions of the fire crew at the incident site, 

handling of any casualties among fire crew and any subsequent requests for additional resources. The 

model will determine the resources assigned based on the incident, and predict the time required to 

accomplish the rescue and/or subdue the fire. Inputs may include the description of the emergency incident 

(location, magnitude, etc.), the time profile of the incident (determined by other simulators such as the 

growth of a fire by the fire simulator), the number of people trapped inside the affected structure, the 

number and profile of assets of interest within and around the affected structures, the information available 

from the associated 911 call, availability of fire department resources at responding locations, probability 

of fire crew casualty associated with incident magnitude and the affected structures, and directives from 

15
law enforcements (such as presence of terrorists at the site preventing the fire crew from entering the 

incident zone). Outputs may include the number of people rescued from affected structure, the response 

time by the fire department, actions taken and the injuries suffered by the fire crew. Other simulators such 

as the fire simulator may model the impact of actions of the fire crew. For example, the fire department 

simulator will model the number of water hoses pointed at the fire, while the fire simulator will model the 

reduction in the spread of fire based on the water delivery rate and the magnitude of the fire. The two 

simulators will thus interact closely to model the unfolding events until the fire is put out completely. 

2. Law Enforcement Simulation should model the actions of law enforcement agencies in response to an 

emergency incident including the assignment of resources for response and investigation, the actions of 

personnel at the incident site including engaging in any shootouts and high-speed chases against terrorists, 

and request for additional resources based on the unfolding events. This component will thus model the 

action of multiple agencies involved in law enforcement including police department and the Federal 

Bureau of Investigation (FBI). The model logic will include the relevant policies and procedures to 

determine the roles and responsibility of the involved agencies. Inputs may include the description of the 

emergency incident (location, magnitude, etc.), the time profile of the incident (determined by other 

simulators such as the terrorist actions by the terrorist organization simulator), the number and location of 

civilians involved (such as hostages held by terrorists, the number and profile of other assets of interest 

within and around the affected structures, the information available from the associated 911 call, 

availability of law enforcement resources at responding locations (personnel at different skill levels such as 

sharp shooters, vehicles, weapons, etc.), probability of law enforcement personnel casualty associated with 

incident nature (shootouts, use of explosive, falling structures due to earthquake aftershocks), and 

information from other response organizations (such as magnitude of fire preventing law enforcement 

officials from entering a burning structure). Outputs may include the actions by the law enforcement 

agents over time including response times of different agencies. The impact of the actions may be 

determined through interactions between the law enforcement simulators and other associated simulators 

such as terrorist organization simulator, traffic simulator and crowd simulator. 

3. Health Care Simulation should model the actions of the health care organizations (including emergency 

medical technicians, hospitals) in response to an emergency incident including the deployment of resources 

and actions for triage and treatment of injured at the incident site, movement of casualties to hospitals, and 

treatment at the hospitals. The model logic will include relevant policies and procedures for emergency 

situations including calling in medical staff, using temporary accommodations for the injured, acquiring 

needed supplies and equipment. Inputs may include the number, location and type of casualties from an 

emergency incident, the availability of staff at work and off (on-call), the availability of resources (own and 

those that can be acquired quickly from surrounding jurisdictions), the time and resources required for 

attending to each casualty type, and the probabilities of death from different casualty types over time. 

Outputs may include the operation of the health care system over time including the number of people 

treated and released, admitted, dead, waiting for treatment, and the state of the staff and facilities (to 

determine their capability to deal with another incident). 

4. Government Agencies Simulation should model the operations of local, state and federal government 

agencies that are involved in incident management including state emergency management agency, Federal 

Emergency Management Agency (FEMA), Department of Health and Human Services (HHS), Center for 

Disease Control and Prevention (CDC). This component should simulate the actions of the government 

agencies. For example, it should model the processes and procedures followed by a state emergency 

management agency for organizing resources for various emergency support functions. The execution of 

the emergency support functions including communication, warnings, emergency public information, 

evacuation and mass care should be modeled. Inputs may include the role, processes and procedure 

followed by the agency and the number, characteristics and location of resources under its purview. 

Outputs may include the results of actions of the agencies modeled including the availability of emergency 

services to affected population over time. 

5. Military Simulation may be used for modeling military operations when the magnitude and nature of the 

incident requires military deployment. In particular, military resources may be requested in response to a 

Weapons of Mass Destruction (WMD) incident. This component should model the actions of the military 

16
to support the response effort. It should model the military support in arenas such as decontamination, 

medical support, rapid mobilization and mass logistics. Inputs may include the role, processes and 

procedure followed by the military and the number, characteristics and location of its resources. Outputs 

may include the results of actions of the military over time including such metrics as number of people 

decontaminated, number of casualties processed by the medical support team and people evacuated. 

6. Terrorists Simulation should model the actions of terrorist organizations for setting up and carrying out 

primary and secondary attacks. It should have the ability to model a range of attack scenarios including 

suicide bombing, use of WMD devices, conventional explosives, release of biological and chemical agents, 

and armed attacks. Inputs may include the primary and alternate action plans, the number and roles of 

terrorist resources, the number, type and location of resources available to the terrorist organization, and the 

level and percentage of sympathizers to the terrorist cause around the area of planned attack. Outputs may 

include the results of the terrorist actions defined by damage to critical infrastructure, damage to structures 

of significance, civilian and military casualties, terrorist casualties, and terrorist arrests. 

5.1.5 Infrastructure System Simulators

These simulators will model the behavior of the infrastructure systems following the occurrence of an emergency 

incident. They will model the propagation of the impact of damage through out the infrastructure system based on 

the damage to one part due to the emergency incident. For example, the earthquake simulator may predict the 

destruction of food warehouses in the affected region. The food supply simulator will model the diversion of food 

shipments from other regions to the affected region. These simulators are described below. 

1. Food Supply Simulation should model the behavior of the food supply infrastructure including the 

movement, storage and distribution of food supply to affected population. The model will be used to 

predict the time for supply of food shipments to affected areas, the deterioration of food supplies in storage, 

and the shortages. Inputs may include the damage to the food supply infrastructure, the availability of food 

supplies in the surrounding regions, probabilities of disruptions in food supply, probabilities of 

deterioration in food supplies, and the resources available for food supply distribution. Outputs may 

include the profile of food supply over time to the affected region. A crowd simulator, for example, may 

use the outputs from this simulator to model rioting situations caused by food shortages. 

2. Power Distribution Simulation should simulate the behavior of the power distribution infrastructure 

including the interruption and restoration of power supply to regions affected by an emergency incident. 

The model will be used to predict the behavior of the power grid following damage to one part, to 

determine the application of resources for restoration and to determine the time for power restoration. 

Inputs may include the description of power grid with its characteristics, the vulnerabilities in the power 

grid, and the resources available in immediate and surrounding regions. Outputs may include the profile of 

power supply and outages in the affected region over time. 

3. Water Supply Simulation should represent the behavior of the water supply infrastructure including the 

interruption, restricted operation and restoration of water supply to regions affected by an emergency event. 

It should also model the impact of a terrorist attack on the water supply system such as contamination of 

water supply. Inputs may include the description of the water supply system including the water sources, 

the collection, filtration and distribution system, the operation and maintenance resources available, the 

links to other critical infrastructure systems including power distribution, road and rail networks. Outputs 

may include the volume and quality profile of the water supply in the affected region over time. 

4. Transportation Simulation should mimic the transportation system infrastructure including highways and 

road network, rail network, waterways, marine and air transport. It should model the impact of man-made 

or natural disasters on the transportation infrastructure components. Inputs may include the description of 

the transportation system infrastructure together with its network, characteristics of node points, traffic 

volumes across arcs and through the nodes, traffic control mechanisms, failure characteristics of major 

control mechanism and equipment, operation and maintenance resources, multi-modal links and links to 

17
other critical infrastructure. Outputs may include the impact of modeled emergency events on the 

operation of the transportation infrastructure over time. 

5. Communications Simulation should reproduce the impact of emergency events on simulated 

communications infrastructure including wired and wireless telephone links, microwave and satellite based 

communications, and radio and television broadcasts. Inputs may include the description of the 

communications infrastructure together with the locations and types of assets such as phone lines, 

communication towers, radio and televisions stations, links to other critical infrastructure, failure 

characteristics, and operation and maintenance resources. Outputs may include the impact of modeled 

disaster events on the operation of the communication infrastructure over time defining interruptions, 

limited operation and restoration to full operation capabilities. 

6. Computer & Networks Simulation should model the computer and network operations under the impact of 

the modeled emergency events including any cyber-attacks. Inputs may include the description of the 

computing and network infrastructure together with the security mechanisms used, reliability information, 

links to physical components and critical locations, procedures for creating and using back-up systems, and 

operation and maintenance resources. Outputs may include the impact of the modeled event or cyberattack on the operation of the computing and networking infrastructure over time describing the interrupted 

capabilities and operations, limited operations, loss of data, restoration of data, and restoration of the 

systems to full operation capabilities. 

5.2 Gaming Subsystem 

The purpose of the gaming subsystem is to provide an immersive incident management environment in which 

users, i.e., players can interact with each other, and with simulated systems and organizations described in the 

previous section. The video game development community has become a leading innovator in the use of graphics, 

audio, and force feedback to create virtual worlds. Multiplayer game technology allows many players to interact in 

the same virtual world across the Internet. As such, it is only natural to look to the technology leaders for solutions 

to creating the front-end interface to a virtual incident management environment. 

Elements of the video game-based training systems would include, where appropriate, real-time computer 

generated graphics and audio. Objects represented would include the environment, the incident scene, various 

emergency response vehicles, affected population, equipment, emergency responders, etc. Emergency responders 

would include various characters that represent the fire department, urban search and rescue, health care, law 

enforcement and terrorists. Physics models and artificial intelligence would be used to give objects physically 

correct behaviors and movements, or enable them to act autonomously without human intervention. 

The game engine, associated simulation modules, and reusable learning objects would be tested for security and 

certified by appropriate testing facilities (please see [35] for definition of reusable learning objects). The software 

would be secure and prevent the introduction of any security holes, viruses, worms, etc. onto the trainee’s computer. 

The software also would not allow the student to achieve any unauthorized access to the host computer system areas 

or other networked systems as a result of the installation of the simulation-based training application. 

Simulation-based learning applications could be developed for use in stand-alone mode or distributed multiplayer mode to enable team training. Multi-student training applications would need distributed simulation 

capabilities to synchronize the software running on different platforms. Servers would be needed to store and 

distribute data to support these training exercises. 

What functions does the gaming subsystem need to provide? Some of the key functions that need to be 

supported: 

• Allow the creation of different game genres such as strategy, role-playing, and puzzle solving based on 

individual training needs 

• Provide user interfaces that allow a variety of user input devices 

• Animate characters and other objects 

• Render graphics scenes, generate audio, and provide force feedback 

• Sequence all processes in a timely fashion 

• Implement intelligent behaviors for both player and non-player characters 

• Coordinate multi-player game play across the Internet 

18
• Enable user modifications, commonly referred to as “modding” in the computer gaming community, of the 

game environment through high level scripts 

• Compile high level scripts into more efficient low level code 

• Manage user sessions and security 

• Provide a central repository for game assets or resources 

Figure 4 shows the major elements of the manufacturing gaming subsystem, i.e., clusters of game applications, game 

management, data servers, and communications infrastructure. The next sections discuss these elements in more 

detail. 

Others

Video, Sound 

and Data Feeds Others

Public 

Transportation

Others

Military 

Command

Gaming Communications Integration Infrastructure

Support

 Institutions

Government 

Agencies

Fire and Rescue

Police

FEMA

Shelters

Utility 

Companies

Hospitals

Response

Management

Live 

Elements

MMOG 

Management

MMOG

Data 

Servers

Communications 

System

Emulator 

Devices

Manual Data 

Interface

Scenes and 

Props

Actors

On Scene 

Response

Others

Military 

Forces

Rescue

HAZMAT

Civil Support

EMT

Police

Fire

Others

Media

Terrorists

General Public

Victims

Civilian

Population and 

Opposing Forces

Figure 4. Gaming subsystem and its modules. 

5.2.1 Game Applications 

Incident management gaming applications should be created to support the roles that users may need to play during 

an incident for training purposes. Five groups of roles and game interfaces have been initially identified as shown in 

figure 4. Other roles and interfaces might also be defined in the future. Each group is briefly described below: 

• Civilian Population and Opposing Forces – Allows players to assume various roles of the civilian population 

affected by an incident and the opposing forces that may be involved in the case of a man-made incident. The 

opposing forces, that is, the terrorists, would normally mingle within the civilian population and may require 

several features that are common with other entities in this group. Some of the possible roles in this group 

include victims, general public, terrorists, and media personnel. 

• On Scene Response – Players take on the roles of responders on an incident scene. They should be able to 

execute response tasks such as securing the perimeter of the affected area, crowd control, attending to victims, 

identify continued threats, and containing spread of fire. Some possible roles include fire, police, EMT, civil 

support, HAZMAT, rescue, and military personnel. 

19
• Response Management – Players assume the roles of management personnel of the responding agencies. They 

should be able to participate in a simulated Emergency Operations Center setting, have access to information 

and displays similar to a real life EOC at the appropriate level (local, state, federal), and make and communicate 

decisions. The decisions may be communicated to simulations executing the responses or to other players 

playing the role of first responders at the scene of the incident. Some possible roles include Federal Emergency 

Management Agency (FEMA), police, fire and rescue, other government agencies and military command. 

• Support Institutions – These roles and interfaces allow the players to execute tasks carried out by personnel of 

institutions that play a supporting role in incident management. Players may treat victims at the emergency 

department, perform repairs on utility services affected by an incident, set up a shelter for people affected by an 

incident, set up and run transportation services for evacuation, etc. The possible roles include hospital, utility 

services, shelter, and public transportation. 

• Live elements – The roles and interfaces enable the incorporation of live game play (outside of the virtual 

world), video feed, external communications channels, etc. 

The above list of player roles and interfaces is only intended to be a sampling of what is possible. A game-style 

interface could be devised for almost any role within an incident management setting. Incident management 

resources include many case study scenarios that could form the basis for engaging game interactions in each of 

these areas. 

5.2.2 Core Game Engine 

The Core Game Engine (CGE) provides the basic functionality required to play video games in stand-alone mode 

and in distributed mode using remote servers, and networks. The CGE executes the game content, outputs graphics 

to display devices, sound to speakers, and receives user input from different types of peripherals. The architecture of 

the CGE defines its major modules and the relationships of those modules to each other. 

Figure 5 illustrates the major modules of the CGE and their general relationships to each other (Client Interface 

Module is not shown). The component modules of the CGE are briefly described below: 

• Game Content Module (GCM) - consists of the scripts and objects of a particular game-based training 

application that are created by the content developer. 

• Supervisory Controller Module (SCM) - provides an operating system that sequences processes and executes 

game content scripts and other internal subsystem functions. 

• Script Interpreter-Compiler Module (SICM) - translates game content scripts into an internal computer program 

that invokes internal system services and functions of other modules within the game engine 

• User Input Module (UIM) - processes and redirects user inputs from various peripheral devices 

• Data Management Module (DMM) - provides support functions for maintaining and accessing shared data 

• Data Import/Export Module (DIEM) - moves and translates data between external files and internal data stores 

• Artificial Intelligence Module (AIM) - performs various decision-making or problem-solving processes that are 

normally associated with human or animal intelligence 

• Physics Module (PM) - models behaviors of objects associated with various physical phenomena, e.g., 

collisions, gravity, buoyancy, aerodynamics 

• Animation Module (AM) - manipulates various characteristics of objects over time to effect graphic, audio, and 

force renditions 

• Graphics (GM), Sound (SM), and Haptics Modules (HM) - output information to displays, speakers, and force 

feedback devices 

• Client Interface Module (CIM) – provides mechanisms for synchronizing timing and data interactions with 

other players via communications networks and remote data servers. 

The development of the game engine architecture was carried out in collaboration with the U.S. Naval 

Education and Training Command to support the Navy’s future simulation-based training needs. For a more 

detailed discussion of the game architecture, see [36]. 

20
Supervisory Controller

Module (SCM)

Force Module

(FM)

Graphics

Module(GM)

Sound Module

(SM)

Script

Interpreter -

Compiler

Module (SICM)

Data

Management

Module (DMM)

Data Import -

Export Module

(DIEM)

Physics Module

(PM)

Artificial

Intelligence

Module (AIM)

User Input

Module (UIM)

Game Logic

Module (GLM)

Animation

Module (AM)

Game Engine Internal Data Store

- Supervisory Controller Data

- User Input Data

- Game Logic Scripts and Data

- Script Compiler Data

- Artificial Intelligence Data

- Physics Data

- Animation Data

- Graphics Data

- Sound Data

- Force Data

- Data Directory, Definitions & Templates

- Data Import/Export Buffers

Figure 5. Major modules of the core game engine and their general relationships to each other. 

5.2.3 Game Integration Infrastructure 

Unlike distributed simulation, there is no standard for integrating distributed multi-player games. In the simulation 

world, a number of implementations of the HLA Run-Time Infrastructure (RTI) have been developed. In order to 

integrate a set of distributed simulations, one vendor’s RTI implementation must be selected and software must be 

adapted to work with that RTI. 

In the game world, there is no standard approach corresponding to the HLA RTI that can be used to integrate 

multi-player games. For various reasons including cost, performance and complexity, the HLA RTIs have been 

considered unsuitable by game developers. Perhaps the primary reason that the game world has been less than 

enthusiastic about HLA is their need for real-time performance. HLA can help guarantee that simulations behave in 

a technically correct manner, e.g., messages arrive at recipient in proper order, but in doing so HLA 

implementations may sacrifice efficiency and performance to achieve technically correct behavior. Also in the HLA 

world, there is no requirement for centralized control or persistent data storage. Multi-player games typically need 

to centralize control and maintain game state data for long periods of time. 

Although a common gaming integration infrastructure does not exist, there are some features that are typically 

used to integrate multi-player games. Features that will be briefly discussed include the client-server interaction 

model, proxies, arbitration, and socket-based communications. 

• Client-server interaction model – The primary mechanism used for integrating multi-player games today is the 

client-server model. Peer-to-peer games have been implemented in the past, but it is unlikely that they will be 

used in the future. Players do not communicate with each other, but rather with the server. The client-server 

model is capable of supporting a large number of players, where the peer-to-peer model does not. In clientserver game implementations, the server acts as a centralized control point for the game. Game action takes 

place on the server, but is reflected in the player’s display on the local platform. The server is responsible for 

determining the advancement of time. 

• Proxies and arbitration – The characters and action that the player views on the local platform is just a proxy 

for the real characters and actions that exist on the server. When the player moves a proxy character on the local 

platform, the server must verify that the move is acceptable. The server can later adjust the movement and 

21
location of the character, if it determines that the move is not right. An action taken by a player on the local 

platform must be confirmed by the action on the server. The server as an arbitrator of game interaction and is 

the ultimate authority on determining game state. For example, if two players are involved in a battle, the 

server ultimately determines who wins and who loses. 

• Socket-based communications – The most common mechanism used for communications between clients and 

servers in multi-player games are sockets. A socket is an endpoint of a two-way communication link between 

two programs running on a communications network. A socket is bound to a particular port number on a 

networked computer. The client and server programs write message packets to the socket for delivery to each 

other. Sockets guarantee the delivery of game data packets across the Internet. 

It appears unlikely that the integration infrastructure requirements of the gaming and simulation worlds will be 

reconciled any time soon. For the purpose of the proposed reference architecture, a separate local integration 

infrastructure has been identified for each world. A bridge has been defined to join the two worlds, i.e., simulation 

and gaming. The bridge does not guarantee that the two worlds can be successfully integrated in all circumstances. 

Time synchronization between the two worlds is perhaps the major problem. If the simulation world can keep up 

with real-time or generate and store data in advance of game play, integration may be achievable. If a game is turnbased, its performance requirements are not severe, or its execution can be slowed for synchronization purposes, 

integration may also be achievable. Otherwise, a mutually acceptable integration solution must be found between 

the two worlds. 

5.2.4 Game Management and Data Servers 

Because of the extensive use of the client-server-computing model in multi-player gaming, data servers perhaps play 

a more important role in gaming than they do in simulation. Servers are needed to establish connections for players 

joining a game session, manage and distribute content, and maintain game state and arbitrate interactions between 

game players. 

These servers may be implemented using the relational, object-oriented, or web-based technologies. In addition 

to the purely game-based servers, two other types of servers may be used to support educational games: learning 

content management system (LCMS), and learning management systems (LMS) servers. Each of the four major 

types of gaming and educational servers is described below: 

• Game Connection Server – Large multi-player games may require multiple game world servers to run 

concurrently in order to support the large number of players involved. Rather than connect directly to the game 

world, the player first contacts a connection server that acts as operator. The connection server validates the 

player’s identity and routes the player to an appropriate game world server. As such, the connection server may 

perform load balancing to ensure an appropriate number of players are being supported by each game world 

server. 

• Game World Server – The game world server is typically a powerful computer that hosts the game for many 

players. It is responsible for maintaining game state data for all players. It maintains persistent data between 

game play sessions. It arbitrates interactions between players. It provides security mechanisms to ensure that 

players cannot hack or unfairly manipulate game play. Game world servers may divide the regions of game play 

into cells. As players move around the world, they may move into different cells and be routed to new servers. 

As programmers update game worlds over time, the preferred approach is to patch the code on the servers rather 

than on client computers. This simplifies software updates since code does not need to be distributed to clients, 

rather only game world data is transferred. 

• Learning Content Management System Server – The LCMS is a development environment where multiple 

learning content authors can create, store, reuse, manage, and deliver digital learning content. The LCMS 

provides a central repository for the storage and retrieval of learning content objects. The LCMS may include 

Learning Management System (LMS) and Course Authoring System (CAS) functions. The LCMS may also 

interact with external LMS and CAS systems developed by other software vendors. 

22
• Learning Management System Server - The LMS server is a system for managing learners, keeping track of 

their progress and performance across all types of training activities. Other functions of the LMS may include 

publishing a catalog of course offerings, providing communications connectivity and interact with the LCMS to 

obtain course content, providing access control to courses including mechanisms for course enrollment and 

checking of prerequisites, managing personalize learning plans, launching and tracking progress on learning 

applications. It also provides instructor interfaces for grading, retaking courses, setting up courses, maintaining 

transcripts for the student population, taking required tests and assessments online, track student progress, 

scores, completion, etc. The LMS may also enable collaboration and communication between students and 

instructors, and enable virtual classrooms. It also may provide an Application Programmer’s Interface to enable 

interactions between courseware and the LMS. 

5.2.5 Game Information Model 

A common information model will help facilitate integration of gaming systems with each other and with incident 

management simulators. Currently no such model exists. If a common model did exist, developers working on 

different aspects of a game development could reasonably expect to be able to share information with modules 

created by other developers. NIST staff has begun to identify the major kinds of data that would be required in a 

common incident management information model, as well as the data required to support game-based training in 

two other application areas, i.e., manufacturing and Navy training applications. At the highest level, the major types 

of data required for gaming within the core game engine and/or on the server include: 

• Supervisory controller data – information about internal game processes and scripts, priority, and status. 

• User input data – information about the configuration of user input devices (e.g., game controller, keyboard, 

mouse, camera), input data stream, and status. 

• Game scripts and data – structures to store program and data information such as game levels, objects, game 

world and character state in languages used for game scripting, including Python, Lua, Ruby, Perl, and C++ 

• Script compiler data – data structures used in the translation of high level scripts into low level executable code 

• Artificial intelligence data – data structures used to model intelligent behavior and decision making processes 

based on various techniques such as finite state machines, genetic algorithms, fuzzy logic, and general problem 

solvers 

• Physics data – various physical parameters of game objects and the environment including geometry, mass, 

location, and velocity 

• Animation data – animation plan, key frames definitions, interpolation parameters, motion and morphing 

algorithms and data 

• Graphics data – scene structures, object geometry, textures, lighting, special effects such as smoke and fog 

• Sound data – audio clips, playing parameters, audio source location, environmental parameters, special effects 

• Force data – force feedback, vibration, etc. 

• Data import/export buffers – directories and files, file types, translators, mapping of file data to internal data 

structures 

The above list of data types is not exhaustive, but is indicative of the various types of data that must be 

incorporated into a common information model that supports gaming. 

6. Modes of operation 

The architecture described above can be used as the basis for development of a Simulation-based Incident 

Management Training system (SIMTrainer). Such a training system can provide for the needs across multiple 

domains in preparedness phase of incident management for both man-made and natural incidents. It can thus 

address a large part of the preparedness “slice” of the Framework for Incident Management presented in Figure 1. 

The SIMTrainer should support the following modes of operation: 

• Individual trainees at responder or management level 

• Training of teams from one agency involving only responders, only management level personnel, or 

responders and management level personnel together 

• Training of large teams from multiple agencies involving only responders, only management level 

personnel, or responders and management level personnel together 

23
The system should allow training of an individual or a team. The value of the system will be fully exploited for 

training teams involving both emergency management and responder level personnel representing multiple agencies. 

For individual training, the game environment should run on PC family computer systems including workstation, 

desktop, laptop, hand held, and PDA variety computers. The computers used to run the software could be available 

hardware in offices of emergency responders or the trainee’s personal computer at home. The software could also 

be used for classroom and team training at centralized training facilities. The software engine, simulations, and 

other course content would all be delivered over the Internet via a Web browser interface. The software would 

install and run automatically without requiring special computer support expertise on the part of the student. 

Updates to software and course materials could be routinely disseminated over the Internet without resorting to the 

distribution of physical media, such as CD-ROMs. 

The training administrators will configure SIMTrainer to present the training scenarios selected by the users. 

For example, the Washington DC police may request training to respond to potential attack scenarios at the national 

mall during July 4 fireworks event. SIMTrainer will be configured using data and graphics files describing the 

national mall area, and the response resources and organizations to be modeled. It will utilize the modules and 

subsystems corresponding to the mode of operation and the scenario. For an individual responder level training for 

a simultaneous attack scenario involving conventional explosives at multiple locations followed by sarin gas attacks 

at surrounding metro stations in Washington DC, the corresponding responder level game client module will be used 

while other elements in the scenario will be modeled using modules in the simulation sub-system. That is, for 

training a policeman the police game client in the gaming sub-system will be used. Corresponding simulation 

subsystem modules will generate the behavior of other entities in the scenario, such as victims, general public, and 

EMTs. 

The SIMTrainer system will allow training the responders and emergency managers in a range of capabilities. 

For the example scenario, the police personnel at the responder level can be trained to deal with an unfolding 

emergency situation including: 

• Quick decisions to select next action until specific commands are provided by the command center 

• Direct crowd in the right direction and handling people in panic 

• Keep an eye open for more attacks 

• Decide on how to deal with suspects in the crowd 

• Identify casualties and call in medical help 

• Perform informal triage to identify those who should move to exit points by themselves and those who 

should stay until help arrives 

Command level personnel can be trained in management and decision-making skills for issues such as: 

• Deployment of responder level personnel and resources (e.g., number and locations of policemen on foot, 

on bicycles, and in police cruisers) 

• Mutual aid requests to surrounding jurisdictions 

• Decision on cordoning off the affected area to identify people who were exposed to radiations and bioagents. Also, to identify potential suspects. 

• Decisions on controlling mobility outside the immediate area, such as, shutting down the metro system to 

avoid exposed people from contaminating other people, or shutting down the bridges going out of the 

district. 

The discussion below addresses the system modules that may be utilized to train the personnel in capabilities listed 

here. 

6.1 Responder Level Training 

The scenario will initially unfold based on a basic script and will take the path determined by trainee actions 

executed through the game client. The scenario will be set up using historical data on crowd densities at the 

selected time and with other parameters such as police presence and EMT stations as specified by the trainers. As 

the scenario begins, the corresponding simulation module will model the explosion and its impact on surrounding 

structures and the crowd. The behavior of the crowd following the explosion will be modeled using another 

simulation module. The simulation modules will be executed in real time and at micro level for the entities in the 

vicinity of the game clients in the scenario. The policeman may be placed in the scenario near one of the explosive 

blast locations and expected to react in assisting the victims while also being on guard for additional attacks by 

nearby terrorists. The visualization component of the game client will show him the scene of the blast with victims 

24
lying around and the crowd rushing in multiple directions in panic mode. He may have to decide between assisting 

the victims and chasing a suspect. The modules utilized in this scenario and modes of operation include: 

• Gaming sub-system: 

 On scene response: police game client 

• Simulation sub-system (real-time; micro level): 

 Social behavior simulators: Crowd 

 Physical phenomena simulators: Explosion 

 Environmental simulator: Weather 

 Organizational simulators: Law enforcement, health care, and fire. More may be included based on 

scenario definition and the duration of the training session. 

 Infrastructure system simulators: Communications 

Multiple responder level trainees from the police department for the same scenario will utilize multiple police 

game clients and the simulation modules listed above. They will be able to work jointly within the scenario using 

their game clients. For more variability in scenario, the trainers may decide to include other players playing the role 

of victims, bystanders, media and terrorists using respective game client modules. A number of terrorist game 

clients may be included for “red teaming” training approach. 

6.2 Management Level Training 

If the individual trainee were to be a police department on-scene commander, or the department representative at the 

Emergency Operations Center, the game client will be at the response management level. The trainee will be 

presented with the on-scene command post or the EOC including available information screens and communications 

that describe the unfolding scenario. The simulation modules in this case can execute at macro level and can be run 

at varying execution speeds. Initially, the simulations will execute at a speed to provide a real-time information 

stream to the command post. Once the trainee has made his decisions regarding responder deployments, the 

executions can be speeded up to model the consequences of the decisions. The trainers will control the pace of 

execution appropriate for achieving the training objectives. The modules utilized for incident management level 

trainee for the above scenario are as below. 

• Gaming sub-system: 

 Response management: police game client 

• Simulation sub-system (real and/or accelerated time; macro level): 

 Social behavior simulators: Crowd 

 Physical phenomena simulators: Explosion 

 Environmental simulator: Weather 

 Organizational simulators: Law enforcement, health care, and fire. More may be included based on 

scenario definition and the duration of the training session. 

 Infrastructure system simulators: Communications, computers and, networks 

6.3 Joint Management and Responder Level Training 

As mentioned earlier, the maximum benefit of the proposed architecture will be derived by allowing responders, 

commanders and emergency management personnel to train on the same scenario to develop shared experiences and 

understanding. A training involving both responder and management level trainees will require multi-resolution 

modeling. The areas in the vicinity of the game clients will be modeled at a micro level while other areas in the 

scenario will be modeled at a macro level. The modules included in this case will be as below. 

• Gaming sub-system: 

 On scene response: police game client 

 Response management: police game client 

• Simulation sub-system (real and/or accelerated time; macro level): 

 Social behavior simulators: Crowd 

 Physical phenomena simulators: Explosion 

25
 Environmental simulator: Weather 

 Organizational simulators: Law enforcement, health care, and fire. More may be included based on 

scenario definition and the duration of the training session. 

 Infrastructure system simulators: Communications, computers, and networks 

Finally, when multiple agencies are involved in the training for such a scenario, corresponding game clients will 

be included. For example, if the agencies involved include fire, EMT and police trainees and management, the 

gaming sub-system will include game clients for the on-scene and response management game clients for these 

agencies. 

The system will be thus highly configurable to the composition and needs of the individual and/or groups that 

are being trained. The proposed architecture will provide the configurability and plug compatibility needed to 

support the concept of operations described in this section. 

7. Concept Demonstration Prototype 

A concept demonstration prototype has been developed to explore the issues involved in implementing the 

architecture proposed above. The prototype is also intended to help communicate the concept to potential users of 

such a capability in the emergency response community. It has been developed around a hypothetical scenario of a 

radiological dispersion device (RDD, commonly known as dirty bomb) explosion by terrorists during the July 4 

fireworks in Washington DC. A number of simulation and gaming modules have been developed to model the 

consequences and help address the training needs to prepare for such a scenario. With respect to the Framework for 

Incident Management presented in Figure 1, the implemented modules address the sections framed by preparedness 

phase, dirty bomb incident, and part of the following domains: civilian population, environment, government 

agencies and private sector. Specifically the following modules have been implemented: 

7.1 Simulation Modules 

• Plume Simulation is used to determine the path and growth over time of the area affected by the radiological 

plume generated by the dirty bomb. This will help determine the areas that need to be evacuated to prevent or 

minimize the exposure to the population present there. The simulation module has been implemented using the 

software, CT-Analyst, developed at the Naval Research Labs. 

• Crowd Simulation is used to determine the directions and volumes of people movement to plan the containment 

and evacuation efforts. The module has been developed by the researchers at University of Arizona using an 

agent-based modeling approach implemented using the simulation software, AnyLogic. 

• Emergency Vehicles Response Simulation is used to plan and evaluate response times by emergency vehicles 

(e.g. police, fire, ambulances, etc.) to get to the scene. For ambulances, the evaluation may include the times for 

multiple trips for ferrying victims to hospitals. The module has been developed by NIST researchers using Java 

and GeoTools, an open source GIS toolkit. The modeling approach is similar to that used by macro level 

traffic simulation tools. 

• Incident Area Traffic Simulation is used to plan and evaluate traffic planning strategies for evacuation and 

emergency vehicle routing in the immediate area surrounding the incident scene. This module is also used to 

estimate the congestion factors that are used in the macro traffic simulation. The model was developed by 

George Washington University utilizing the Traffic Software Integrated System (TSIS). The approach used is 

micro-level traffic simulation. 

• Metro Simulation is used to plan and evaluate metro rail system strategies for evacuation and for support actions 

such as taking trains to decontamination stations. The model has been developed using AutoMod simulation 

software by NIST researchers with assistance from Brooks Software, the software vendor. 

• Emergency Room Simulation will be useful for planning and evaluating the deployment of emergency room 

resources. It will also help identify the situations that may lead to overloading of emergency rooms of hospitals 

near the incident site requiring the redirecting of incoming ambulances to hospitals further away. The model 

has been developed by NIST researchers using the discrete event simulation software, ProModel. 

26
7.2 Gaming Modules 

• Strategy Gaming Client for Event Planning helps develop the strategy for pre-deployments of emergency 

response assets. Management personnel of first responders can use the tool to interactively place the assets in a 

3D display of an event site. The first version for this module was developed by NIST researchers using 

GLEST, an open source real-time strategy game engine written in C++. A second version is being designed for 

improved functionality. 

• Triage Gaming Client is targeted for use at the first responder level, specifically, the emergency medical 

technicians (EMTs). It allows EMTs to walk through an incident site in virtual mode; locate, examine and 

interview victims, and based on their assessment attach the appropriate triage tag for further action. This 

application was built jointly by researchers from NIST and the Institute of Security and Technology Studies at 

the Dartmouth College. A 3D gaming approach is used with the game being built on the Unreal game engine. 

The modules together allow study of multiple major aspects of the emergency incident and the response. The 

concept of the integrated simulation is depicted in Figure 6. 

Plume 

Dispersion 

Simulation

Triage 

simulation

Metro system 

simulation

Traffic 

flow 

simulation

Hospital 

system 

simulation

City Map with Street Availability Population Federal, State,

details, Police, Fire, of response in the vicinity Local authority

Hospital Locations personnel for fireworks resources.

Emergency 

vehicles 

response 

simulation

Crowd 

simulation

Strategy 

Planning

Plume 

Dispersion 

Simulation

Triage 

simulation

Metro system 

simulation

Traffic 

flow 

simulation

Hospital 

system 

simulation

City Map with Street Availability Population Federal, State,

details, Police, Fire, of response in the vicinity Local authority

Hospital Locations personnel for fireworks resources.

Emergency 

vehicles 

response 

simulation

Crowd 

simulation

Strategy 

Planning

Figure 6. Modules of the concept demonstration prototype 

8. Conclusions 

This paper presented an architecture for integrating gaming and simulation for incident management training. This 

integration will bring together the interactive environment provided by gaming for taking actions and making 

decisions for a situation with the capability to use simulation to produce technically correct impact of the actions 

taken and decisions made. The integration allows the use of gaming for serious applications for the incident 

management community. Such serious gaming applications are expected to be quite effective for the coming 

generations of workforce that have grown up playing video games. 

The integration of gaming and simulation will also allow training of personnel and testing of applications that 

simultaneously address different levels of incident management hierarchy. Such simultaneous involvement of 

hierarchically diverse personnel and applications will provide improved opportunities for team training. The 

capability to train responders and commanders together on a wide range of scenarios will enable development of 

effective incident management teams. These teams can build on their shared sets of experiences developed through 

incident management training using the integrated simulation and gaming modules. The shared experiences will 

27
develop understanding of capabilities and command decisions in the team resulting in increased cohesiveness and 

effectiveness. 

It is proposed that the architecture be implemented as a common infrastructure that can be used to integrate 

independently-developed simulation and gaming modules. The availability of such an infrastructure will strongly 

encourage development of gaming and simulation modules covering the breadth and depth of the incident 

management applications. Incident management personnel can select the modules applicable to their environment to 

create a capability to serve their training needs. 

An implementation of the architecture will provide a test bed for the Homeland and Industrial Control Security 

Program at NIST and other standards organizations. It can be used to test the interoperability of incident 

management simulation and gaming applications. It can also be used to test the interfaces for such applications. 

The proposed test bed will be highly effective if supported with repositories for templates and test case data. 

Academic and commercial researchers can use the templates and test case data to quickly test out new 

developments. The test case data can also serve as a benchmark for comparison of alternate approaches for similar 

applications and thus further spur development and help incident management personnel by providing a common 

scale to rank vendor offerings. 

Implementation of the architecture as a common infrastructure will require development of standards at several 

fronts including the data models, interfaces, distribution and synchronization mechanisms and user interaction 

devices. Current work in progress on integration of gaming and simulation is expected to lead to more such activity 

in the future. 

9. Acknowledgement 

Work described in this report was sponsored by the National Institute of Standards and Technology (NIST), 

Gaithersburg, Maryland under Manufacturing Interoperability and Homeland and Industrial Control Security 

Programs, and in part by the Naval Education Training Command, Pensacola, Florida. The Manufacturing 

Interoperability Program supports NIST projects applying information technologies and standards-based approaches 

to manufacturing software integration problems. The Homeland and Industrial Control Security program supports 

NIST projects that enhance preparation for, prevention of, defense against, and response to threats and aggressions 

against the domestic population and infrastructure of the United States and effectiveness of domestic emergency 

response and law enforcement. The work described was funded by the United States Government and is not subject 

to copyright. 

10. Disclaimer 

Software architecture, models, languages and software are identified in context in this paper. This does not imply a 

recommendation or endorsement of the associated commercial software products by the authors or NIST, nor does it 

imply that such software products are necessarily the best available for the purpose. 

The work described was funded by the United States Government and is not subject to copyright. 

References 

[1] Bank, J. (ed.), 1998, Handbook of Simulation: Principles, Methodology, Advances, Applications, and 

Practice, John Wiley and Sons, New York, NY. 

[2] CMP Game Group, 2005, Proceedings of Serious Games Summit D.C., Oct. 31-Nov. 1, 2005, Washington 

DC. Available on line at http://www.seriousgamessummit.com/conference/proceedings.html; last accessed on 

Feb. 8, 2006. 

[3] Jain, S. and C.R. McLean, 2003, Modeling and Simulation of Emergency Response: Workshop Report, 

Relevant Standards and Tools, National Institute of Standards and Technology Internal Report, NISTIR-7071. 

(Available on line at www.nist.gov/msidlibrary/doc/nistir7071.pdf)

[4] Klein, G.A., 1989. "Recognition-Primed Decisions" in William B. Rouse (ed.), Advances in Man-Machine 

System Research (Greenwich, CT: Jai Press, 1989). 

[5] Department of Homeland Security, 2006, TOPOFF 3 Frequently Asked Questions, available on-line at 

http://www.dhs.gov/dhspublic/display?theme=43&content=4406&print=true, last accessed on Jan. 19, 2006. 

28
[6] Robinson, C.W., Lt. Col. (Retd.), 2004. Input provided during discussions at workshop on “A Roadmap for 

Modeling and Simulation for Emergency Response.” National Institute for Standards and Technology, March 

2-3. 

[7] Sullivan, Thomas J., 1985, Modeling and Simulation for Emergency Response, Lawrence Livermore National 

Laboratory, Report No. UCRL 92001 Preprint. 

[8] Boris, J.P., K. Obenschain, G. Patnaik, T.R. Young, Jr., “CT-Analyst: Portable Tool for Dispersion Prediction 

with Zero Delay and High Fidelity.” Proceedings of Fourth George Mason University Transport and 

Dispersion Modeling Workshop, George Mason University, Fairfax VA. July 11-12, 2002. 

[9] NARAC, 2006, http://narac.llnl.gov/ers.html, last accessed on Jan. 19, 2006. 

[10] BFRL 2006, NIST Fire Dynamics Simulator, http://fire.nist.gov/fds/, last accessed on Jan. 19, 2006. 

[11] Mazzola, C.A., Addis, R.P., and Emergency Management Laboratory, 1995, Atmospheric Dispersion 

Modeling Resources, available at http://www.msiac.dmso.mil/wmd_documents/ADMResources.pdf, last 

accessed on February 27, 2006. 

[12] Benjamin, P. and S. Ramachandran, 2003. “Threat response management system (TRMS),” International 

Conference on Integration of Knowledge Intensive Multi-Agent Systems, Boston, USA, Sept. 30-Oct. 4, 

2003. pp 547 – 554. 

[13] Innovative GIS, 2006, “Mapping Wildfire Response,” 

http://www.innovativegis.com/basis/Senarios/Fire_response_senario.htm, last accessed on Jan. 19, 2006. 

[14] Takenaka Corporation, 2001. “Assisted Evacuation Simulation System.” 

http://www.takenaka.co.jp/takenaka_e/techno/n08_kaijyo/n08_kaijyo.htm, last accessed Jan. 19, 2006. 

[15] San Francisco Chronicle, 2002, Software simulates terror hit - Sandia develops program as tool for public 

officials, http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2002/08/19/BU133752.DTL&type=business, 

August 19, 2002. 

[16] ASTI 2005, “Emergency Preparedness Incident Command Simulation,” http://epics.astcorp.com/index.html, 

last accessed on Jan. 19, 2006. 

[17] Jenvald, J. and M. Morin, 2004. “Simulation-supported live training for emergency response in hazardous 

environments,” Simulation & Gaming, Vol. 35, Nov. 3, September 2004, pp 363-377. 

[18] German, J., 1999, Virtual reality training tool pits rescue teams against computerized terrorist attack, Sandia 

Lab News ,Vol. 51, No. 15, available online at http://www.sandia.gov/LabNews/LN07-30-99/vr_story.html, 

last accessed on Jan. 19, 2006. 

[19] NSSL 2003, National Severe Storms Laboratory's Warning Decision Support System (WDSS), 

http://www.nssl.noaa.gov/wrd/msd/wdss.html, last accessed on November 21, 2003. 

[20] Jain, S. and C.R. McLean, 2003. “A Framework for Modeling and Simulation of Emergency Response,” 

Proceedings of the 2003 Winter Simulation Conference, Dec. 7-10, New Orleans, Louisiana, 1068-1076. 

[21] LANL, 2001, “Urban Security Project,” http://www.lanl.gov/orgs/d/d4/aquality/urban.html, last accessed on 

Jan. 19, 2006. 

[22] LANL, 2000, “Interdependent Infrastructure Modeling, Simulation, and Analysis Project (SOFIA),” 

http://www.lanl.gov/orgs/d/d4/infra/sofia.html, last accessed on Jan. 19, 2006. 

[23] Steinman, J.S. and J.W. Wong, 2003, “The SPEEDES Persistence Framework and the Standard Simulation 

Architecture,” Proceedings of the Seventeenth Workshop on Parallel and Distributed Simulation (PADS’03), 

June 10-13, San Diego, California, 11-20. 

[24] Tolk, A., 2002, “Avoiding Another Green Elephant – a Proposal for the Next Generation HLA based on the 

Model Driven Architecture,” 2002 Fall Simulation Interoperability Workshop, September 8-13, Orlando, FL. 

[25] Bowers III, F.A. and D.L. Prochnow, 2003. “JTLS-JCATS Federation Support of Emergency Response 

Training”, in: Proceedings of the 2003 Winter Simulation Conference, eds: S. Chick, P.J. Sanchez, D. Ferrin 

and D.J. Morrice. Institute of Electrical and Electronics Engineers, Piscataway, New Jersey. pp 1052-1060. 

[26] McDonald, J.T. and M.L. Talbert, “Agent-based Architecture for Modeling and Simulation Integration,” 

Proceedings of the National Aerospace & Electronics Conference (NAECON 2000), Oct. 10-12, Dayton, 

Ohio. 

[27] Campbell, A.P. and J.R. Hummel, 1998, “The Dynamic Information Architecture System: An Advanced 

Simulation Framework For Military And Civilian Applications,” 

http://www.dis.anl.gov/DIAS/papers/SCS/SCS.html, last accessed on January 20, 2004. 

[28] McLean, C.R., S. Leong and F. Riddick, 2000, “Integration of Manufacturing Simulations using High Level 

Architecture (HLA),” Proceedings of the 2000 Advanced Simulation Technologies Conference, April 16-20, 

Washington DC. 

29
[29] U.S. Department of Homeland Security, 2004, National Response Plan, Available on line at 

http://www.dhs.gov/interweb/assetlibrary/NRP_FullText.pdf, last accessed on January 5, 2006. 

[30] Moteff, J., Copeland, C. and Fischer, J., 2003, Critical Infrastructures: What makes an Infrastructure Critical?, 

Congressional Research Service, Report No. RL31556, The Library of Congress. Available on line at 

http://www.fas.org/irp/crs/RL31556.pdf, last accessed on January 5, 2006. 

[31] IEEE, 2000, IEEE 1516 Standard for Modeling and Simulation (M&S) High Level Architecture (HLA) – 

Framework and Rules, Institute of Electrical and Electronics Engineers, Piscataway, NJ, USA. 

[32] McLean, C.R. and F. Riddick, 2000, “The IMS Mission Architecture for Distributed Manufacturing 

Simulation,” in Proceedings of the 2000 Winter Simulation Conference, Orlando, FL. 

[33] Kuhl, F., R. Weatherly, and J. Dahmann, 1999, Creating Computer Simulations: An Introduction to the High 

Level Architecture, Prentice Hall, Upper Saddle River, NJ. 

[34] Alexander, T. (ed.), 2003, Massively Multiplayer Game Development, Charles River Media, Hingham, MA. 

[35] Polsani, P.R., 2003, “Use and abuse of reusable learning objects,” Journal of Digital Information, Volume 3 

Issue 4, Article No. 164, 2003-02-19. 

[36] McLean, C.R. and F. Riddick, 2004, “PC Modeling and Simulation Guidelines: Volume 1 – Overview,” 

National Institute of Standards and Technology Internal Report NISTIR 7131. 

30