NEXUS puts generative AI at the centre of the control room and gives it no authority over safety. Everything below is what the system actually runs — these numbers are imported from the engine, not transcribed onto this page.
The AI cannot express a severity
The obvious design is to let the model triage an incident and have the engine override it when it gets one wrong. NEXUS does not do that, because an override is only ever as good as the list of cases you thought to override.
Instead the model’s output schema has no severity field and no team field. There is no shape in which it can express a triage decision. It reports what language a message is in, what it says in English, and which of six categories it falls under. The engine decides severity and routing from a keyword table, scanning both the original text and the translation — so a mistranslation cannot launder an emergency into a routine report.
The consequence is testable, and tested: AI mode and rule-based mode reach identical severity on life-safety reports across English, Spanish, Bengali and Hindi. With Gemini switched off entirely, a report of “hay una persona desmayada” is still SEV-1, still routed to Medical Response. The AI makes the system easier to understand. It cannot make it less safe.
Crowd density thresholds
Density is a percentage of a zone’s safe capacity, not its fire-code maximum. Safe capacity is set so 100% corresponds to roughly 4 people per square metre — the point, in established crowd-safety guidance (UK SGSA Green Guide; Fruin’s Level of Service), at which involuntary contact begins and pressure waves become possible.
| Band | Density | Meaning |
|---|---|---|
| Normal | Below 70% | Free movement. No action needed. |
| Elevated | 70–85% | Comfortable movement ends. Monitor the trend. |
| High | 85–95% | Movement is constrained. Intervene before it compounds. |
| Critical | 95% and above | Approaching unsafe crowd pressure. Act immediately. |
A gate is assessed on utilisation — arrivals as a percentage of what it can process — with bands at 80%, 95% and 105%. A queue of 800 people is critical on its own, whatever the rate: a gate that has caught up can still be holding a dangerous mass of people.
Above 32°C with humidity at or above 60%, every crowd risk is raised one band. Both are required, because dry heat is far better tolerated by a standing crowd than the same temperature when humid.
Severity rules
Applied in order. A rule can only raise severity above the category’s floor, never lower it. 38 life-safety terms are matched, including common non-English forms so the interlock holds even when no translation is available.
| If | Then |
|---|---|
| A life-safety term appears (unconscious, not breathing, crush, fire, weapon, …) | SEV-1 — Medical Response dispatched alongside the category’s own team |
| The incident is in a zone already at critical density | SEV-1 — a minor report inside crowd pressure is a potential trigger |
| A vulnerable person is named (child, elderly, wheelchair user, pregnant) | SEV-2 floor — raised above the category default |
| Category: medical, crowd, security, or lost person | SEV-2 floor |
| Category: facilities or transport | SEV-3 floor |
How the impact numbers are computed
Every figure beside a recommendation — the “122% → 85%” — comes from a conservation-of-people flow model, never from the language model. Rerouting a share of a gate’s arrivals moves exactly those people to another gate and recomputes both utilisations; the queue drains at the surplus of throughput over the reduced inflow, and if there is no surplus the model says the queue never clears rather than inventing an optimistic time.
Opening an overflow lane is modelled as +20% throughput, surging stewards as +15%. Projected time to critical is extrapolated from current net flow and suppressed beyond 30 minutes, where it stops being operationally useful.
It is a first-order estimate and does not pretend otherwise. It is not a microsimulation of pedestrian movement. What it is, is defensible, deterministic, and identical every time you run it.
The venue and the feed
Meridian Stadium is a fictional 82,500-capacity World Cup venue with 8 zones and 6 gates. The operational feed is simulated, and the simulator is a pure function of scenario and elapsed time over a seeded random source: the same scenario always produces the same match, so a demo is reproducible and a failing test is debuggable.
The simulation conserves people. A scenario redistributes the crowd or shifts when it arrives; it never conjures extra spectators to manufacture a crisis. A transit delay means the same people arrive later and in a tighter window — which is what a transit delay actually does.