Vulnerability Assessments of Urban Rail Transit Networks Based on Redundant Recovery

: Urban rail transit has received much attention in the last two decades, and a signiﬁcant number of cities have established urban rail transit networks (URTNs). Although URTNs have brought enormous convenience to the daily life of citizens, system failures still frequently occur, therefore the vulnerability of URTNs must be a concern. In this paper, we propose a novel measurement called the node strength parameter to assess the importance of nodes and present a redundant recovery scheme to imitate the system recovery of URTNs subjected to failures. Employing three malicious attacks and taking the Nanjing subway network as the case study, we investigated the network vulnerability under scenarios of di ﬀ erent simulated attacks. The results illustrate that passenger in-ﬂow shows the negligible impact on the vulnerability of the node, while out-ﬂow plays a considerable role in the largest strength node-based attack. Further, we ﬁnd that vulnerability will decrease as passenger out-ﬂow increases, and the vulnerability characteristics are the same with the increase in the construction cost of URTNs. Considering di ﬀ erent attack scenarios, the results indicate that the highest betweenness node-based attack will cause the most damage to the system, and increasing the construction cost can improve the robustness of URTNs.


Introduction
In 1863, the UK opened the first subway line in the world, in London; since then, many metropolises have constructed their own urban rail transit systems.In the 21st century, more and more people have immigrated to cities, which have expanded rapidly, hence urban rail transit has been given increasing attention in recent decades.To relieve traffic congestion, improve living conditions and decrease urban pollution, many cities have constructed their own URTNs.Taking China as an example, more than 40 cities have built URTNs in the last thirty years.Urban rail transit is an extraordinarily complicated system, and minor incidents may lead to unacceptable results, such as injuries, deaths, or property loss.It is known that accidents involving URTNs around the world may cause serious results; therefore, more attention should be given to this topic, as well as more effort made in studies to decrease the intensity and frequency of accidents.
Many studies have discussed the vulnerability and robustness of URTNs, and many useful results have been obtained in the last two decades, which can be divided into two categories.In the first category, researchers mainly focus on the vulnerability and robustness of the topological structures of URTNs.Derrible and Kennedy [1] took 33 subway networks as examples to analyze the complexity and robustness of URTNs, and presented a method to improve their robustness.Zhang et al. [2] applied complex network theory and methods to analyze networked characteristics and considered Shanghai subway network as an example to investigate the vulnerability of URTNs subjected to failures.Sun and Guan [3] assessed the vulnerability of the Shanghai subway network by coupling station degree and betweenness as the station intensity; Sun et al. [4] also studied the vulnerability of the Beijing metro network based on the multi-static weighted method.Sun et al. [5] analyzed the vulnerability of the Shanghai urban rail network, while Yang et al. [6] used complex network theory to assess the robustness of the Beijing subway network.Zhang and Wang [7] investigated the transportation functionality vulnerability of URTNs based on moving block technology and took the Nanjing subway network as an example to illustrate the feasibility and effectiveness of the presented model.De-Los-Santos et al. [8] evaluated the passenger robustness of rail transit networks from two aspects, i.e., without-bridging and with-bridging interruptions; Lu [9] modeled the resilience of URTNs based on operational incidents, while Wang et al. [10] considered the Shanghai subway network as an example to investigate robustness using a multiple perspective method.Zhang et al. [11] proposed a framework to assess resilience based on the performance loss of triangle stations and quantified the vulnerability of the Shanghai subway network subjected to random and intentional attacks.Sun et al. [12] employed the tap-in and tap-out data on passenger distribution to estimate the influences of three common disruptions of URTNs.Shang et al. [13] integrated Lagrangian and Eulerian observations to estimate the passenger flow state according to a space-time-state, hyper-network-based assignment approach.
In the second perspective, many contributions studied the associated systems when evaluating network vulnerability and robustness indirectly.Sun et al. [14] proposed an integrated Bayesian approach to assign passenger flow in URTNs; Wei and Chen [15] used empirical mode decomposition and neural network methods to forecast the short-term passenger flow of URTNs.The above two studies employed mathematical theory and methods to analyze and predict passenger flow to improve the robustness of URTNs.Yang et al. [16] took the Beijing subway network as an example to measure route diversity; Saidi et al. [17] analyzed the long-term planning for ring-radial rail systems, and Raveau et al. [18] compared the passenger behavior for route choice in URTNs from five aspects.These three studies investigated route-planning to boost robustness.
Certainly, there are many related studies which analyze the delays, disruptions, and line utilization of rail transit systems.Luxton et al. [19] used software packages to conduct risk assessment analysis on different sections of the railway station, and formulated mitigation measures to eliminate these weaknesses in the system to prevent terrorist attacks.Potti et al. [20] used SIMUL8 computer software to establish a railway system simulation model, and analyzed the scope when moving an urban freight on rail by evaluating the utilization levels of the Cross-City railway line in the UK.Wales et al. [21] addressed these issues by first developing an event-based simulation using Simul8 software to analyze the current system's performance and its response to delays.Marinov et al. [22] studied the organization, plan, and management of train movements, and described the analytical methods, simulation techniques and specific computer packages for analyzing and evaluating the behavior of rail systems and networks.The aforementioned studies indicate that rail transit networks have been given increasing attention from many perspectives in the last two decades, which shows their importance in the daily life of citizens.
Although many methodologies have been applied to study the vulnerability of URTNs subjected to various failure types, most studies have only considered topology and few studies have focused on redundancy.Therefore, this paper will adopt a real passenger flow and redundant system to analyze the vulnerability of URTNs.The rest of the paper is organized as follows: Section 2 analyzes topological characteristics and takes the Nanjing subway network as an example to discuss network characteristics.Section 3 presents a new assessment model of network vulnerability using a redundant system, and the node strength is redefined based on passenger flow.Section 4 employs three types of malicious attacks to assess network vulnerability and the Nanjing subway network is considered as an example to illustrate the feasibility and effectiveness of the proposed model.Finally, conclusions are drawn in Section 5.

Structural Characteristics of URTNs
In this section, we analyzed topological features of URTNs and topological networks can be abstracted from URTNs.In a URTN, the station and rail are represented by the node and edge of a complex network, respectively, and the edge can reflect an interaction between two directly connected nodes.In general, a subway network can be represented by an graph G = {V, E} , where V = { v i |i = 1, 2, • • • , N} is the set of nodes and E = e ij e ij = v i , v j is the set of edges, N is the number of nodes, e ij = 1 if the node v i is directly connected with node v j , and e ij = 0 if node v i is not directly connected with node v j .
This section takes the Nanjing subway network as an example case to analyze the topological characteristics of URTNs.The first line of Nanjing subway opened on May 15, 2005, and there are seven operation lines (including 1, 2, 3, 4, 10, S1, S8), 129 stations, and 133 rails in Nanjing subway network, shown in Figure 1.It can also be found that the largest degree station (or node) is Nanjingnan station, with degree 5, while there are eight stations with degree 4, one station with degree 3, one hundred and seven stations with degree 2 and twelve stations with degree 1.
cted from URTNs.In a URTN, the station and rail are represented by the node and edge lex network, respectively, and the edge can reflect an interaction between two dir cted nodes.In general, a subway network can be represented by an graph N is the set of nodes and

Network Property on Station
In this subsection, two network parameters are employed to analyze network properties.Node degree indicates the number of edges connected to the node, and the degree of the i-th node v i is defined as follows where the degree k i indicates the number of nodes directly connected to the node v i , hence the degree of station reflects the local connectivity of URTNs.
Node betweenness is described by the number of shortest paths between all pairs of nodes passing this node, and reflects the importance of the node over the network, and the node betweenness [6,9,23] of the i-th node v i is denoted by where L jm is the number of shortest paths between v j and v m , L jm (v i ) is the number of shortest paths from v j to v m through the node v i in V.The betweenness is often used to describe the transport ability of the station of URTNs, and therefore nodes with a high betweennesses play vital roles in the transport ability of URTNs.

Node Strength on Station
In the current approaches, the cross-section passenger flow is regarded as passenger flow of a station, however, the cross-section passenger flow cannot give a detailed representation of the real passenger flow of the node.In this subsection, the passenger flow of a station is described by the passenger in-flow and out-flow, and given as follows where F i (v i ) represents the passenger flow of node v i , F in (v i ) and F out (v i ) denote the in-flow and out-flow of node v i , respectively.There are few studies discussing the node strength which is represented by the original passenger flow [4], and as the actual node strength is larger than the original passenger flow, it can reflect the robustness of URTNs subjected to congestions.Therefore, the node strength of node v i is described by the following formula where n i is the number of nodes directly connected to the node i, F ij in denotes the passenger in-flow from the node v j to node v i , F ij out denotes the out-flow from the node v i to node v j , and α, β ∈ [1,2] are tunable parameters and used to measure the node strength of URTNs, when α = β = 1, the node strength is the original passenger flow of the station and Table 1 shows that the largest strength node is Zhujianglu station.In this paper, the parameters α and β reflect the changes in the passenger in-flow and out-flow.Meanwhile, passenger in-flow and out flow will increase with the increase in citizens, and the node strength must be given a large redundancy for future safety from congestions or disturbances.Although this study is theoretical, it will present some constructive suggestions for new URTNs.Figure 2 presents the node strength of Zhujianglu station with different parameters α, β ∈ [1,2]; when α = β = 1, the node strength denotes the original passenger flow.Figure 2 gives a visualization of the node strength and shows that the node strength becomes larger and larger with the increase in tunable parameters α, β, and the increase rates of node strength are different to each other, which indicates that there is not a linear increase in node strength with the increase in tunable parameters.
Sustainability 2020, 12, x FOR PEER REVIEW 5 of 14 Although this study is theoretical, it will present some constructive suggestions for new URTNs.when  = =1, the node strength denotes the original passenger flow.Figure 2 gives a visualization of the node strength and shows that the node strength becomes larger and larger with the increase in tunable parameters  ， , and the increase rates of node strength are different to each other, which indicates that there is not a linear increase in node strength with the increase in tunable parameters.Table 2 gives the top five stations about node strength with different parameters α and β, and it shows that the largest strength nodes are Zhuajinglu station and Xinjiekou station under all scenarios.It is known that node strength reflects the transport ability of the station; therefore, these top five stations must be given prior concerns and protections to improve the robustness of Nanjing subway network.

Failure Model with Redundant Recovery
It is well known that the subway network is very fragile when suffering malicious attacks, which illustrates that failures will cause many damages to subway network, and serious failure sometimes may lead to injuries or even deaths.Therefore, the subway should pay more attention to improving this situation.In this section, a new methodology is proposed to assess the vulnerability of URTNs based on emergency management, and the node capacity, failure propagation, and redundant recovery are analyzed to construct the failure model of URTNs subjected to malicious attacks.

Node Capacity of Station
Node capacity, referring to the maximum flow tolerance of a station in UTRNs, can often reflect the collection and dispersion ability.In the existing study, the node capacity was discussed by the degree and betweenness, and the coupled relationship between degree and betweenness.In this study, the coupling relationship between degree and is used to discuss the vulnerability of rail transit.In this paper, the node capacity of station is described by the real passenger flow and can reflect the actual station state [4].The node capacity on station of subway network is defined as follows [4,10,24] C i where γ denotes the tolerance parameter, which can describe the construction cost of the station, ranging from [0, 1], and F i (v i ) is the original passenger flow of the station v i .Meanwhile, the node capacity equals the original passenger flow when γ = 0, hence the node capacity will increase with the increase in the tolerance parameter γ.Equation ( 5) has been widely accepted in studies focusing on the vulnerability and robustness of complex networks.

Failure Mechanism
In this subsection, the failure mechanism of network is analyzed to address cascading dynamics of failures.In other words, when a node suffers from failures or attacks, there will always be a redistributing process of passenger flow, and the visualization graph of redistribution is illustrated in Figure 3, which is a direct graph and similar to the graph discussed in [22].For instance, when the i-th node v i fails, the related in-flow edges will be disconnected from this node according to the model of passenger flow, which means that no more passengers could arrive at the i-th node, but passengers on out-flow edges still could depart to neighbor nodes, such as the j-th node.Therefore, it can be directly observed that the neighbor node will suffer increasing flow pressure, and then this pressure will be transferred to the second neighbor nodes.
Sustainability 2020, 12, x FOR PEER REVIEW 7 of 14 based on emergency management, and the node capacity, failure propagation, and redundant recovery are analyzed to construct the failure model of URTNs subjected to malicious attacks.

Node Capacity of Station
Node capacity, referring to the maximum flow tolerance of a station in UTRNs, can often reflect the collection and dispersion ability.In the existing study, the node capacity was discussed by the degree and betweenness, and the coupled relationship between degree and betweenness.In this study, the coupling relationship between degree and betweenness is used to discuss the vulnerability of rail transit.In this paper, the node capacity of station is described by the real passenger flow and can reflect the actual station state [4].The node capacity on station of subway network is defined as follows [4,10,24] ( ) ( ) ( ) where  denotes the tolerance parameter, which can describe the construction cost of the station, ranging from [0,1], and ii Fv is the original passenger flow of the station i v .Meanwhile, the node capacity equals the original passenger flow when  =0 , hence the node capacity will increase with the increase in the tolerance parameter  .Equation ( 5) has been widely accepted in studies focusing on the vulnerability and robustness of complex networks.

Failure Mechanism
In this subsection, the failure mechanism of network is analyzed to address cascading dynamics of failures.In other words, when a node suffers from failures or attacks, there will always be a redistributing process of passenger flow, and the visualization graph of redistribution is illustrated in Figure 3, which is a direct graph and similar to the graph discussed in [22].For instance, when the i-th node i v fails, the related in-flow edges will be disconnected from this node according to the model of passenger flow, which means that no more passengers could arrive at the i-th node, but passengers on out-flow edges still could depart to neighbor nodes, such as the j-th node.Therefore, it can be directly observed that the neighbor node will suffer increasing flow pressure, and then this pressure will be transferred to the second neighbor nodes.In this paper, the extra pressure →  jm F from node j v to m v due to the failure of i v could be defined in the form of passenger flow as follows where the notation → denotes the redistributing direction from the departure node to the destination node, and is the passenger flow from node i v to j v , j n is the current number of In this paper, the extra pressure ∆F j→m from node v j to v m due to the failure of v i could be defined in the form of passenger flow as follows where the notation → denotes the redistributing direction from the departure node to the destination node, and F i→j is the passenger flow from node v i to v j , n j is the current number of neighbor nodes of the node v j after the failure of node v i .When the total flow exceeds its tolerance, namely F m + ∆F j→m > C m , cascading failures will be triggered.Otherwise, it will be safe.

Recovery Mechanism
As many studies demonstrations, the node under failures not get healed by itself, and it needs external materials to recover and function again.However, this also shows that, given enough time, nodes could recover from congestion disturbances by passenger self-organization.When the node passenger flow exceeds the node capacity, a self-recovery function depicted by passenger flow with a time variable F i (t), is required to describe the self-healing process.Through this function, it is clearly illustrated how the extra or overloaded passenger flow will be redistributed.Therefore, when F i (t) > C i , the function could be defined as follows where Γ i (t) represents the self-recovery function, and τ i denotes the self-healing factor.δ i represents flow rate without failures, ξ i denotes the passenger flow rate under cascading failures.F i (t) describes the current passenger flow at the time t.

Vulnerability Assessments of URTNs
In this section, the vulnerability of URTNs is assessed under cascading failures.Three malicious attacks are employed to discuss characteristic changes in the maximum effective group (MEG) of URTNs, and MEG is described as follows where N(t) is the number of nodes in MEG after cascading failures, and N is the total number of nodes.

Vulnerability Analysis under the Largest Strength Node-Based Attack
This subsection discusses the vulnerability of URTNs subjected to the largest strength node-based attack (LSA), and LSA is the attack of the node with the largest strength.Meanwhile, the Nanjing subway network is taken as an example to analyze characteristic changes in MEG based on different parameters.Figures 4 and 5 present characteristic changes in MEG when γ = 0.1 and γ = 0.2, respectively, for the Nanjing subway network.From these two figures, it can be found that for the same tolerance parameter γ and the same tunable parameter β, the Nanjing subway network displays a great vulnerability and shows the same vulnerability as when subjected to LSA for a different parameter α, which indicates that different parameter α will have little effect on the characteristic changes in URTNs.Meanwhile, it could be observed that the robustness of Nanjing subway network when γ = 0.2 is better than when γ = 0.1.different  of Nanjing subway network subjected to LSA respectively, and they also indicate that URTNs are very vulnerability when suffering malicious attacks.Figure 6 illustrates that the vulnerability characteristics of URTNs possess the same changing trends when  =0.1 , and it shows that MEG increases as the tunable parameter  increases with a fixed  , which demonstrates that URTNs become more robust during the redundant recovery.Figure 7 addresses the vulnerability characteristics of URTNs for  =0.2 ; it shows that URTNs are very vulnerable under the LSA, and the MEG exhibits the same vulnerability for a fixed tunable parameter  and different tunable parameter  .Taking both Figure 6 and Figure 7 into consideration, it can be found that the vulnerability of URTNs becomes more similar as the tolerance parameter  increases.different  of Nanjing subway network subjected to LSA respectively, and they also indicate that URTNs are very vulnerability when suffering malicious attacks.Figure 6 illustrates that the vulnerability characteristics of URTNs possess the same changing trends when  =0.1 , and it shows that MEG increases as the tunable parameter  increases with a fixed  , which demonstrates that URTNs become more robust during the redundant recovery.Figure 7 addresses the vulnerability characteristics of URTNs for  =0.2 ; it shows that URTNs are very vulnerable under the LSA, and the MEG exhibits the same vulnerability for a fixed tunable parameter  and different tunable parameter  .Taking both Figure 6 and Figure 7 into consideration, it can be found that the vulnerability of URTNs becomes more similar as the tolerance parameter  increases.6 illustrates that the vulnerability characteristics of URTNs possess the same changing trends when γ = 0.1, and it shows that MEG increases as the tunable parameter β increases with a fixed α, which demonstrates that URTNs become more robust during the redundant recovery.Figure 7 addresses the vulnerability characteristics of URTNs for γ = 0.2; it shows that URTNs are very vulnerable under the LSA, and the MEG exhibits the same vulnerability for a fixed tunable parameter α and different tunable parameter β.Taking both Figures 6  and 7 into consideration, it can be found that the vulnerability of URTNs becomes more similar as the tolerance parameter γ increases.

Comparison Analysis on Vulnerability under Different Attacks
In this subsection, the largest degree node-based attack (LDA), the highest betweenness nodebased attack (HBA) and the largest strength node-based attack (LSA) are employed to analyze the cascading failures of URTNs with redundant recovery based on the proposed methodology, LDA is the attack to the node with the largest degree, and HBA is the attack to the node with the highest betweenness.Moreover, the Nanjing subway network is used as the example to investigate the vulnerability of URTNs subjected to three malicious attacks with a different tolerance parameter  and the same tunable parameters  = =1.
Figure 8 presents characteristic changes in MEG with a different tolerance parameter  and different attacks, and it shows that three malicious attacks will lead to the same damages to Nanjing subway network for  =0.1 .Meanwhile, it can be found that HBA will cause the most damage to the Nanjing subway network for  ， =0.2,0.3 0.4 , which means that HBA is the most effective method to

Comparison Analysis on Vulnerability under Different Attacks
In this subsection, the largest degree node-based attack (LDA), the highest betweenness nodebased attack (HBA) and the largest strength node-based attack (LSA) are employed to analyze the cascading failures of URTNs with redundant recovery based on the proposed methodology, LDA is the attack to the node with the largest degree, and HBA is the attack to the node with the highest betweenness.Moreover, the Nanjing subway network is used as the example to investigate the vulnerability of URTNs subjected to three malicious attacks with a different tolerance parameter  and the same tunable parameters  = =1.
Figure 8 presents characteristic changes in MEG with a different tolerance parameter  and different attacks, and it shows that three malicious attacks will lead to the same damages to Nanjing subway network for  =0.1 .Meanwhile, it can be found that HBA will cause the most damage to the Nanjing subway network for  ， =0.2,0.3 0.4 , which means that HBA is the most effective method to

Comparison Analysis on Vulnerability under Different Attacks
In this subsection, the largest degree node-based attack (LDA), the highest betweenness node-based attack (HBA) and the largest strength node-based attack (LSA) are employed to analyze the cascading failures of URTNs with redundant recovery based on the proposed methodology, LDA is the attack to the node with the largest degree, and HBA is the attack to the node with the highest betweenness.Moreover, the Nanjing subway network is used as the example to investigate the vulnerability of URTNs subjected to three malicious attacks with a different tolerance parameter γ and the same tunable parameters α = β = 1.
Figure 8 presents characteristic changes in MEG with a different tolerance parameter γ and different attacks, and it shows that three malicious attacks will lead to the same damages to Nanjing subway network for γ = 0.1.Meanwhile, it can be found that HBA will cause the most damage to the Nanjing subway network for γ = 0.2, 0.3, 0.4, which means that HBA is the most effective method to destroy UTRNs, hence the nodes with a higher betweennesses must be given more protections.Moreover, it can be discovered that the network becomes more robust as the tolerance parameter γ increases.Furthermore, Figure 8 illustrates that the Nanjing subway network exhibits some certain robustness subjected to LSA, and the MEG will not change when γ = 0.4 and MEG ≈ 1.Therefore, it is demonstrated in Figure 8 that the topology is a critical aspect to improve the robustness of URTNs, and nodes with larger degrees and a higher betweennesses are more important than nodes with merely a larger strength.
destroy UTRNs, hence the nodes with a higher betweennesses must be given more protections.
Moreover, it can be discovered that the network becomes more robust as the tolerance parameter  increases.Furthermore, Figure 8 illustrates that the Nanjing subway network exhibits some certain robustness subjected to LSA, and the MEG will not change when  =0.4 and  1 MEG shows that there are no cascading failures when   ; both results show that HBA and LDA may cause more serious damages than LSA.Therefore, nodes with larger degrees and higher betweennesses must be given more protections in the future.that there are no cascading failures when γ ≥ 0.5, and Figure 11 shows that there are no cascading failures when γ ≥ 0.4; both results show that HBA and LDA may cause more serious damages than LSA.Therefore, nodes with larger degrees and higher betweennesses must be given more protections in the future.destroy UTRNs, hence the nodes with a higher betweennesses must be given more protections.
Moreover, it can be discovered that the network becomes more robust as the tolerance parameter  increases.Furthermore, Figure 8 illustrates that the Nanjing subway network exhibits some certain robustness subjected to LSA, and the MEG will not change when  =0.4 and  1 MEG shows that there are no cascading failures when   0.4 ; both results show that HBA and LDA may cause more serious damages than LSA.Therefore, nodes with larger degrees and higher betweennesses must be given more protections in the future.This section analyzes the vulnerability of URTNs, and we found that URTNs are very vulnerable subjected to three malicious attacks.The results show that the passenger in-flow has a small influence on the vulnerability, while the passenger out-flow has a large influence on the vulnerability under the proposed model.Therefore, the critical nodes of URTNs must be given advanced protections and the management for passenger out-flow must be planned in the early design program.Moreover, the results indicate that the highest betweenness node-based attack is the most effective destroy URTNs, which also tell us that the node with the highest betweenness must be given the most protection in UTRNs.Furthermore, results also show that the robustness will increase with the increase in the node capacity of URTNs, which illustrates that increasing the node capacity will improve the robustness of URTNs; that is to say, increasing the construction cost will improve the robustness of the URTNs.In actual URTNs, the robustness can be improved by increasing the construction costs, which can expand the node capacity and improve the emergent ability of urban rail transit systems.

Conclusion
In this paper, a novel node strength indicator is proposed to measure the importance of nodes by the passenger flow of URTNs, and a redundant recovery scheme is applied to simulate the recovery system of URTNs subjected to failures.Meanwhile, malicious attacks, including HBA, HBA and LSA, are employed to model the three most severe failures of nodes, and the Nanjing subway network is taken as the example to prove the feasibility and effectiveness of the proposed model.The   This section analyzes the vulnerability of URTNs, and we found that URTNs are very vulnerable subjected to three malicious attacks.The results show that the passenger in-flow has a small influence on the vulnerability, while the passenger out-flow has a large influence on the vulnerability under the proposed model.Therefore, the critical nodes of URTNs must be given advanced protections and the emergency management for passenger out-flow must be planned in the early design program.Moreover, the results indicate that the highest betweenness node-based attack is the most effective destroy URTNs, which also tell us that the node with the highest betweenness must be given the most protection in UTRNs.Furthermore, results also show that the robustness will increase with the increase in the node capacity of URTNs, which illustrates that increasing the node capacity will improve the robustness of URTNs; that is to say, increasing the construction cost will improve the robustness of the URTNs.In actual URTNs, the robustness can be improved by increasing the construction costs, which can expand the node capacity and improve the emergent ability of urban rail transit systems.

Conclusion
In this paper, a novel node strength indicator is proposed to measure the importance of nodes by the passenger flow of URTNs, and a redundant recovery scheme is applied to simulate the recovery system of URTNs subjected to failures.Meanwhile, malicious attacks, including HBA, HBA and LSA, are employed to model the three most severe failures of nodes, and the Nanjing subway network is taken as the example to prove the feasibility and effectiveness of the proposed model.The This section analyzes the vulnerability of URTNs, and we found that URTNs are very vulnerable subjected to three malicious attacks.The results show that the passenger in-flow has a small influence on the vulnerability, while the passenger out-flow has a large influence on the vulnerability under the proposed model.Therefore, the critical nodes of URTNs must be given advanced protections and the emergency management for passenger out-flow must be planned in the early design program.Moreover, the results indicate that the highest betweenness node-based attack is the most effective destroy URTNs, which also tell us that the node with the highest betweenness must be given the most protection in UTRNs.Furthermore, results also show that the robustness will increase with the increase in the node capacity of URTNs, which illustrates that increasing the node capacity will improve the robustness of URTNs; that is to say, increasing the construction cost will improve the robustness of the URTNs.In actual URTNs, the robustness can be improved by increasing the construction costs, which can expand the node capacity and improve the emergent ability of urban rail transit systems.

Conclusions
In this paper, a novel node strength indicator is proposed to measure the importance of nodes by the passenger flow of URTNs, and a redundant recovery scheme is applied to simulate the recovery system of URTNs subjected to failures.Meanwhile, malicious attacks, including HBA, HBA and LSA, are employed to model the three most severe failures of nodes, and the Nanjing subway network is taken as the example to prove the feasibility and effectiveness of the proposed model.The results indicate that the in-flow exhibits an ignorable impact on the vulnerability, and the out-flow plays an essential role in the vulnerability of URTNs.Moreover, conclusions could also be drawn that nodes with larger degrees and higher betweennesses are more important than those with larger strength, which means these important nodes should be given more protection in the future.

Figure 1 .
Figure 1.The operation route of Nanjing subway network.

Figure 1 .
Figure 1.The operation route of Nanjing subway network.

Figure 2 .
Figure 2. Node strength on Zhujianglu station versus different tunable parameters.

Figure 2 .
Figure 2. Node strength on Zhujianglu station versus different tunable parameters.

Figure 3 .
Figure 3. Visualization of the passenger flow redistribution after the node failure.

Figure 3 .
Figure 3. Visualization of the passenger flow redistribution after the node failure.

Figure 4 .
Figure 4.The maximum effective group changes for  =0.1 and different  .

Figure 5 .
Figure 5.The maximum effective group changes for  =0.2 and different  .

Figure 6 and
Figure 6 and Figure 7 describe characteristic changes in MEG when  =0.1 and  =0.2 with

Figure 4 .
Figure 4.The maximum effective group changes for γ = 0.1 and different β.

Figure 4 .
Figure 4.The maximum effective group changes for  =0.1 and different  .

Figure 5 .
Figure 5.The maximum effective group changes for  =0.2 and different  .

Figure 6 and
Figure 6 and Figure 7 describe characteristic changes in MEG when  =0.1 and  =0.2 with

Figure 5 .
Figure 5.The maximum effective group changes for γ = 0.2 and different β.

Figures 6 and 7
Figures 6 and 7 describe characteristic changes in MEG when γ = 0.1 and γ = 0.2 with different α of Nanjing subway network subjected to LSA respectively, and they also indicate that URTNs are very vulnerability when suffering malicious attacks.Figure6illustrates that the vulnerability characteristics of URTNs possess the same changing trends when γ = 0.1, and it shows that MEG increases as the tunable parameter β increases with a fixed α, which demonstrates that URTNs become more robust during the redundant recovery.Figure7addresses the vulnerability characteristics of URTNs for γ = 0.2; it shows that URTNs are very vulnerable under the LSA, and the MEG exhibits the same vulnerability for a fixed tunable parameter α and different tunable parameter β.Taking both Figures6 and 7into consideration, it can be found that the vulnerability of URTNs becomes more similar as the tolerance parameter γ increases.

Figure
Figures 6 and 7 describe characteristic changes in MEG when γ = 0.1 and γ = 0.2 with different α of Nanjing subway network subjected to LSA respectively, and they also indicate that URTNs are very vulnerability when suffering malicious attacks.Figure6illustrates that the vulnerability characteristics of URTNs possess the same changing trends when γ = 0.1, and it shows that MEG increases as the tunable parameter β increases with a fixed α, which demonstrates that URTNs become more robust during the redundant recovery.Figure7addresses the vulnerability characteristics of URTNs for γ = 0.2; it shows that URTNs are very vulnerable under the LSA, and the MEG exhibits the same vulnerability for a fixed tunable parameter α and different tunable parameter β.Taking both Figures6 and 7into consideration, it can be found that the vulnerability of URTNs becomes more similar as the tolerance parameter γ increases.

Figure 6 .
Figure 6.The maximum effective group changes for  =0.1 and different  .

Figure 7 .
Figure 7.The maximum effective group changes for  =0.2 and different  .

Figure 6 .
Figure 6.The maximum effective group changes for γ = 0.1 and different α.

Figure 6 .
Figure 6.The maximum effective group changes for  =0.1 and different  .

Figure 7 .
Figure 7.The maximum effective group changes for  =0.2 and different  .

Figure 7 .
Figure 7.The maximum effective group changes for γ = 0.2 and different α.

Figure 8 .
Figure 8.The maximum effective group changes under different attacks.

Figure 9
Figure 9 presents characteristic changes in the vulnerability of URTNs subjected to HBA, while Figure 10 and Figure 11 exhibit characteristic changes in the vulnerability of URTNs subjected to LDA and HBA, respectively.It is observed that URTNs become more robust as the tolerance parameter  increases, which indicates that the large construction cost could improve the robustness of the network.Meanwhile, Figure 9 and Figure 10 indicate that there are no cascading failures when   0.5 , and Figure11shows that there are no cascading failures when   ; both results show that HBA and LDA may cause more serious damages than LSA.Therefore, nodes with larger degrees and higher betweennesses must be given more protections in the future.

Figure 9 .
Figure 9.The maximum effective group changes subjected to highest betweenness node-based attack (HBA).

Figure 8 .
Figure 8.The maximum effective group changes under different attacks.

Figure 9
Figure 9 presents characteristic changes in the vulnerability of URTNs subjected to HBA, while Figures 10 and 11 exhibit characteristic changes in the vulnerability of URTNs subjected to LDA and HBA, respectively.It is observed that URTNs become more robust as the tolerance parameter γ increases, which indicates that the large construction cost could improve the robustness of the network.Meanwhile, Figures 9 and 10indicate that there are no cascading failures when γ ≥ 0.5, and Figure11shows that there are no cascading failures when γ ≥ 0.4; both results show that HBA and LDA may cause more serious damages than LSA.Therefore, nodes with larger degrees and higher betweennesses must be given more protections in the future.
Figure 9 presents characteristic changes in the vulnerability of URTNs subjected to HBA, while Figures 10 and 11 exhibit characteristic changes in the vulnerability of URTNs subjected to LDA and HBA, respectively.It is observed that URTNs become more robust as the tolerance parameter γ increases, which indicates that the large construction cost could improve the robustness of the network.Meanwhile, Figures 9 and 10indicate that there are no cascading failures when γ ≥ 0.5, and Figure11shows that there are no cascading failures when γ ≥ 0.4; both results show that HBA and LDA may cause more serious damages than LSA.Therefore, nodes with larger degrees and higher betweennesses must be given more protections in the future.

Figure 8 .
Figure 8.The maximum effective group changes under different attacks.

Figure 9
Figure 9 presents characteristic changes in the vulnerability of URTNs subjected to HBA, while Figure 10 and Figure 11 exhibit characteristic changes in the vulnerability of URTNs subjected to LDA and HBA, respectively.It is observed that URTNs become more robust as the tolerance parameter  increases, which indicates that the large construction cost could improve the robustness of the network.Meanwhile, Figure 9 and Figure 10 indicate that there are no cascading failures when   0.5 , and Figure11shows that there are no cascading failures when   0.4 ; both results show that HBA and LDA may cause more serious damages than LSA.Therefore, nodes with larger degrees and higher betweennesses must be given more protections in the future.

Figure 9 .
Figure 9.The maximum effective group changes subjected to highest betweenness node-based attack (HBA).

Figure 9 .
Figure 9.The maximum effective group changes subjected to highest betweenness node-based attack.

Figure 10 .
Figure 10.The maximum effective group changes subjected to largest degree node-based attack (LDA).

Figure 11 .
Figure 11.The maximum effective group changes subjected to largest strength node-based attack (LSA).

Figure 10 .
Figure 10.The maximum effective group changes subjected to largest degree node-based attack.

Figure 10 .
Figure 10.The maximum effective group changes subjected to largest degree node-based attack (LDA).

Figure 11 .
Figure 11.The maximum effective group changes subjected to largest strength node-based attack (LSA).

Figure 11 .
Figure 11.The maximum effective group changes subjected to largest strength node-based attack.

Table 1 .
Top five stations based on network parameters of Nanjing subway.

Table 2
gives the top five stations about node strength with different parameters  and  , and it shows that the largest strength nodes are Zhuajinglu station and Xinjiekou station under all scenarios.It is known that node strength reflects the transport ability of the station; therefore, these top five stations must be given prior concerns and protections to improve the robustness of Nanjing subway network.

Table 2 .
Top five stations based on strength with tunable parameters.