In a multi-casualty incident straddling a border, what delays shared triage is not the number of available ambulances but the translation of clinical and logistical data between control rooms that use different vocabularies, triage codes and message formats. The physical resources — vehicles, teams, beds — have been sized by decades of civil-protection planning. What stays fragile is the informational layer: who has already been categorised, where they are headed, which hospital still has capacity.

Context

A mass casualty incident (MCI, an incident whose casualties exceed the immediately available resources) imposes a known sequence: categorisation at the scene, collection at sorting points, re-categorisation, distribution to definitive facilities. When the event sits near a border — a derailment, an industrial accident, a building collapse — the responders who converge belong to distinct national health systems. Each has its own triage scale (START, CESIRA, local variants), its own patient identifiers, its own rules on handling health data.

The European institutional frame for this convergence is the Union Civil Protection Mechanism, established by Decision No 1313/2013/EU and coordinated by the Emergency Response Coordination Centre (ERCC), active around the clock. Decision (EU) 2019/420 added the rescEU reserve as a last-resort capacity, for when national resources and those pre-committed to the European pool are not enough. This level governs who sends the assets and under which request procedures; it does not normalise the format of the messages that assets and control rooms exchange once on the ground.

The problem

The problem is semantic before it is technical. Two control rooms can be joined by a working network and still be unable to cooperate if “red patient” in one does not correspond unambiguously to a category in the other, if the identifier assigned to a casualty at a sorting point is not recognised at the receiving point, if bed availability is expressed in units that cannot be compared.

The established answer to this class of problem is decoupling through exchange standards. The EDXL (Emergency Data Exchange Language) family from OASIS addresses precisely this: XML messages with defined semantics, independent of the application that produces or consumes them.

  • The Common Alerting Protocol (CAP) v1.2, an OASIS Standard since 1 July 2010, defines an all-hazard alert format that can be disseminated simultaneously across heterogeneous channels.
  • EDXL-TEP (Tracking of Emergency Patients), in its 1.1 revision of 2018, structures the tracking of the individual patient from first contact at the scene through to admission or field release.
  • EDXL-HAVE (Hospital AVailability Exchange) describes hospital availability in comparable terms — beds, specialities, reception capacity.

Above these formats, ISO 22320:2018 (“Security and resilience — Emergency management — Guidelines for incident management”) sets the organisational requirements of the response: defined roles, command structure, coordinated handling of operational information. The standard constrains how information is managed; EDXL constrains how it is represented on the wire.

Architecture

The resulting design is layered, and the separation between layers is what makes the system composable.

The transport layer moves bytes between nodes and, by design assumption, is taken as unreliable, because in an MCI public networks are congested or degraded: redundant channels are preferred and delayed delivery is tolerated. The representation layer is EDXL: each message is self-contained, timestamped, carries global identifiers, so that a node receiving it out of sequence can still place it. The semantic layer is the mapping between triage scales and between national vocabularies, the element that requires prior agreement between systems and cannot be improvised during the event.

The architectural point that recurs in these systems is the refusal of point-to-point integration. Connecting n control rooms pairwise produces a number of adapters that grows with the square of n and becomes unmanageable in a cross-border scenario with several countries. A common exchange format replaces the n² bilateral adapters with n adapters to a single canonical representation. It is the same argument that justifies a message broker over a graph of direct connections, applied to a domain where the cost of error is clinical.

Critical point

The critical point is not any single standard, but the semantic mapping between them under legal constraint. A casualty’s clinical data are health data, a special category under Regulation (EU) 2016/679 (GDPR). Processing for life-saving response has its legal bases — the data subject’s vital interest, a task in the public interest — but transferring the data across a border, between distinct controllers and with systems that retain it for different durations, must remain traceable and minimised.

This gives rise to a design tension that does not dissolve by choosing “more data” or “less data”. Enough information is needed for the receiving point to treat the patient correctly; the data must not spread beyond the nodes that have an operational need for it; once the event is closed, it must be possible to reconstruct who saw what. EDXL-TEP carries the identifier and the clinical state, but it is the design of the flow — which fields cross the border, towards which controllers, with what retention — that decides whether the system is compliant.

Implications

For whoever designs the software layer, the hard part sits upstream of the code. The decisions that weigh are the correspondence table between the triage scales of the countries involved, the patient identification scheme agreed before the event, the matrix of who may read which fields. Once these are written, the EDXL implementation is mechanical: serialise, validate against the schema, route.

Then there is verifiability. An emergency exchange system must be exercised with synthetic data before it is trusted: out-of-order messages, nodes that fail and rejoin, identifiers duplicated through human error in the field. The properties that weigh — an EDXL message stays interpretable out of sequence, a duplicate identifier is detectable, a control room that rejoins realigns — are measured in exercises, not inferred from the diagram.

Limits

Exchange standards solve representation, not the source. If categorisation at the scene is wrong, EDXL transports it faithfully wrong: no format corrects a mistaken triage. The semantic mapping between national scales is an approximation, because the scales are not in bijection and the borderline category stays open to interpretation. Network continuity in a degraded scenario is guaranteed by no standard: it is an infrastructural requirement in its own right, independent of the data model.

What stands is that, in an incident straddling a border, the first thing to break is not the vehicle but the shared meaning of a data field — and that failure is prevented long before the event, in correspondence tables agreed in calm conditions.

This coordination layer between first-response vehicles and operations centres is what noze works on within the European VALKYRIES project, described in the insight published by noze: https://www.noze.it/en/insights/valkyries/.

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32013D1313 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019D0420 https://docs.oasis-open.org/emergency/cap/v1.2/CAP-v1.2-os.html https://docs.oasis-open.org/emergency/edxl-tep/v1.1/edxl-tep-v1.1.html https://docs.oasis-open.org/emergency/edxl-have/v2.0/edxl-have-v2.0.html https://www.iso.org/standard/67851.html

Cover image: Color-coded emergency triage tags (red, yellow, green, black) used to categorise casualties, laid out side by side — photo by Genppy, public domain — https://commons.wikimedia.org/wiki/File:Triage_tags_(Tokyo_Fire_Department).jpg