A Three-Axis Nine-Cell Framework for Venue-Layer Crowd Safety Assessment: Necessary Conditions, a Control Loop, and What the Method Cannot Yet Determine

This paper proposes a nine-cell framework for venue-layer crowd safety assessment. Its rows are the three elements of a control loop — the plant, the sensor, and the controller, realised as the venue's built form, its instrumentation, and its operational provision. Its columns are three separately necessary conditions for the dangerous state: that the geometry admit a coherent path of sufficient extent, that the scene generate sufficient load along it, and that the accumulation run long enough. Danger requires all three; safety requires the failure of any one. The paper argues that identifying the rows as a control loop, rather than as three parallel domains of concern, is what allows the governing analytic principle to be derived rather than asserted: a perfect plant with no sensor is not a well-controlled system with a weak component but an uncontrolled one. From this the Non-Contradiction Principle follows, with three canonical failure modes — sensor against plant, controller against sensor, controller against plant — each corresponding to an identifiable class of pre-existing documentary contradiction that a pairwise check surfaces. Because each cell records what the venue supplies and what the event demands, a single matrix carries both objects of analysis, and the event-layer DIM ICE analysis is positioned beneath it rather than beside it as a second matrix of the same kind; DIM ICE is preserved unchanged in the domain for which it was designed. Cell readings are ordinal and fourfold: clear, marginal, not clear, or no data — the last being not a fourth level but the statement that the scale was not applied. Two consequences of the column structure bear on adversarial use. The burden of asserting danger is heavier than the burden of asserting safety, because the first is a conjunction and the second a disjunction of three exits; and the time column cannot be closed from either the venue side or the event side alone, so a report generated from one side must record that limitation in terms. The paper states what the method does not presently determine: of the three columns, only the geometric one is determinable in the general case, and three cells will return no data for most venues under the present method. Application to four documented configurations illustrates each failure mode together with the null case in which no assessment exists at either layer. Assessments produced under the framework are treated as productive assets rather than compliance overhead, subject to a condition the framework makes structural: because their findings cannot be selectively invoked, adoption without remediation is worse than non-adoption.