Cooperative passenger flow control in an oversaturated metro network with operational risk thresholds. (October 2019)