Zero-Probability Accident
Chapter One | Passenger Throughput Above the Mandatory Review Threshold
At 9:17 a.m., Xu Anhe ran the data for Luwan International Airport Intermodal Center for the third time.
The number on the screen had not changed.
72,000.
It sat at the far right of the chart, above the red line marking the threshold for mandatory escalation review. Beside the line was the figure 60,000, with a string of version dates and data load times beneath it. The two numbers were not far apart, and in an intermodal center handling nearly 400,000 passengers a day, they were not particularly conspicuous.
But Xu Anhe knew that a threshold's significance had never depended on how conspicuous it was.
She was a risk-model validation analyst at Veer Commercial Insurance Group. Her job was not to prove that a model was always right, but to identify what could not yet be trusted before anyone else prepared to believe it.
The office was entering its busiest period of the day. Someone at the next desk was checking the policy renewal conditions for medical facilities. The sound of presentation slides changing came from the conference room, and the business department had already begun asking about several cases that had to be completed before the end of the month. The Luwan Intermodal Center case was also near the front of the policy renewal list. Once she checked it off as approved, the data would move through the established process to the insurance rates and underwriting departments, and almost no one would look back at that inconspicuous red line.
Xu Anhe temporarily disabled the alerts from her messaging software. She was not unaware of the pressure to meet deadlines; she simply did not want reminder messages deciding which field she looked at first. A model could produce an answer in seconds. Validation, however, had to confirm exactly what question that answer had answered.
She did not immediately click rerun. Instead, she expanded the data period field on her computer screen.
Weekdays, from 7:00 to 8:30 a.m., covering the transfer rush for the airport express, intercity rail, and two city subway lines. No weekends had been mixed in, and the most congested 90 minutes had not been diluted with a full-day average.
She opened the second inspection tab on the left side of the model validation system: Passenger Classification.
The 72,000 did not represent the number of people standing in one hall at the same time. It was the cumulative exposure count formed by passengers passing through the platforms, transfer level, security-transition area, and primary evacuation routes over 90 minutes. The same person might be recorded once in each of two different risk zones. The figure could not be used to claim that 72,000 people had been packed inside the building, but it could be used to assess how many people's movements would obstruct one another if some routes failed.
She checked the model version, the digital digest of the raw data, and the load time again.
All three matched.
In the model validation system, she added a temporary test tab. The original settings remained intact. In the test copy, she lowered the weight for “brief pass-through,” then shifted the start and end of the peak period by five minutes each. This was the most common kind of sensitivity test: not an attempt to find the desired answer, but a way to see whether the conclusion would reverse completely after a small change.
The curve dipped slightly but remained above the red line.
She raised the weight for brief pass-through again, confirming that the curve rose as expected. Then she shifted only the data start time. None of the different combinations brought the result below 60,000. After each test, she first checked whether the direction of change was reasonable, then checked whether the system had misread a stale cache. Several temporary results remained on the right side of the screen. Not one could turn the escalation condition into a negligible margin of error.
She restored the parameters. If one reasonable minor adjustment could make the result jump up and down, the model itself was unsuitable for deciding whether to escalate. If every reasonable range produced the same direction, a reviewer could not simply choose the most favorable run. She did not write those words into the conclusion. She marked only this in the validation field: “Threshold determination is insensitive to a single-parameter adjustment.”
Xu Anhe picked up a pen and wrote two lines on a sticky note:
72,000 − 60,000 = 12,000.
12,000 ÷ 60,000 = 20%.
She drew a line beneath the 20%.
This did not mean the probability of an accident had increased by 20 percent, nor could it prove that something would collapse today. It meant only one thing: the data exceeded the review threshold by 20 percent. Under the intermodal center's safety certification, operating permits, and insurance conditions, the next step was not to find a better-looking name for the number, but to initiate escalation review.
The phone on her desk rang.
The caller ID showed the Risk Management Office of Luwan International Airport Intermodal Center. Xu Anhe put on her headset, her eyes still fixed on the red line.
As soon as the contact connected, he asked, “Analyst Xu, do you have the results?”
He spoke quickly. In the background were announcements and the rumble of suitcase wheels rolling across the floor one after another. He had worked with Xu Anhe for two years and rarely pressured her. When there was a data problem, he usually organized the version, source, and reason for each change into a single page before calling.
Not today.
“I reran it three times. All three were 72,000,” Xu Anhe said.
There was a two-second pause on the other end. “What if we classify the passengers who only passed through the transfer level and didn't stop separately?”
Xu Anhe left the cursor over the classification field. “Tell me the basis for the classification first.”
“They think passing through isn't the same as staying. Passengers are only there for a few minutes. They shouldn't have the same weight as people waiting.”
Xu Anhe pressed him. “Which operating guideline?”
He lowered his voice. “They're still putting it together.”
Xu Anhe glanced at the creation time for the data version. “Who asked them to put it together?”
The background announcement changed trains. He did not answer immediately. It sounded as if he had stepped into a quieter space, and his voice dropped lower as well.
“The operating unit held a meeting this morning. They want to redraw the peak period and move some of the transfer records out. The reasoning isn't completely unfounded. The risks of passing through and staying are indeed different.”
Xu Anhe watched the curve, still above the red line. “Different, so they can have different weights. That doesn't mean they can simply be excluded.”
“I know.” His voice grew even lower.
Xu Anhe heard someone on his end call him by his title, followed by a burst of hurried footsteps. He did not turn to answer. Instead, he seemed to cover the microphone with his palm, and the surrounding noise suddenly became muffled. A few seconds later, he moved back toward the phone.
“Do you have the versions from before and after the changes?” Xu Anhe asked.
“I do, but I need to export the version history first.”
Xu Anhe moved the sticky note beside her keyboard. “I can't say anyone is changing the numbers right now. The classification method is open to discussion, and it's possible the data definitions weren't synchronized. But 72,000 has already crossed the threshold. Unless you can provide a reproducible new method, the review can't be downgraded.”
He still was not giving up. “What if we reclassify the people who passed through from exposed passengers to mobile passengers?”
“The report will change. The site won't,” Xu Anhe said.
He said nothing.
She continued, “Moving people waiting in line from one table to another won't make an exit wider. During an earthquake, power outage, or signal interruption, they still have to use the same route.”
A very soft exhalation came through the headset. “You're still going to submit an escalation recommendation?”
“Yes,” Xu Anhe replied.
He warned her, “They may call your business supervisor directly.”
“That is something they can do.”
The silence lasted longer this time. Finally, he said, “I'll send you the complete version history. Give me half an hour.”
Xu Anhe added, “Don't send just the report. I need the raw fields, classification rules, and the time of every change.”
“Understood. I'll be at the center all day. I'll confirm with you after I export it.”
Before the call ended, Xu Anhe heard another arrival announcement. The sound echoed through the high-ceilinged public space, as if it had repeated itself somewhere in the distance.
She took off her headset. A message from the business side had already popped up in the internal chat window. It read: “Luwan Intermodal Center is a key policy renewal case this quarter. Escalation review may affect insurance rates, reinsurance conditions, and the operational remediation period. Please confirm whether it is necessary to submit today.”
Less than a minute later, the head of the validation team poked his head out of the conference room and gestured for her to come over.
“Business says you're preparing to escalate?” The supervisor set his tablet on the table. He did not sound accusatory, but he pushed the policy renewal schedule in front of her. Only three days remained before the conditions could be confirmed. Once escalation review began, the site's evacuation conditions during the peak period might have to be reassessed, and the underwriting conditions would have to be put on hold.
“The original result exceeds the threshold by 20 percent,” Xu Anhe said.
The supervisor pointed to the passenger classification field. “Could it simply be a different classification standard?”
“Possibly, which is why I requested the version history. But the classification standard is still disputed. We can't treat the problem as resolved in advance.”
The supervisor looked at her for several seconds. “Can you prove the center is unsafe?”
“No,” Xu Anhe said.
“Can you prove an accident will happen?”
“No,” Xu Anhe answered again.
She turned the validation page toward him. “What I can prove is that, under the currently approved classification standard, the escalation conditions have been met. The purpose of a review is precisely to investigate again what cannot be ignored while we still can't prove that something will go wrong.”
The supervisor did not make the decision for her. He only said, “Write down clearly everything you can and cannot prove.”
When Xu Anhe returned to her desk, two more reminders had appeared in the internal chat window. She read them one by one without deleting them, but she did not treat them as evidence of pressure. The business side's concern about the policy renewal schedule did not mean anyone was asking her to falsify data. What truly needed to remain was the data basis for each judgment she made, and who altered that basis afterward.
She arranged the three morning reruns and the sensitivity tests chronologically, so that anyone taking over could retrace the same steps from the raw data. If the conclusion held only on her computer, it was not validation. It was merely personal judgment.
After reading it through, Xu Anhe did not reply with a slogan like “Safety first.” She knew premiums were not punishments, and models were not verdicts. If every result that crossed a threshold was treated as a prophecy of disaster, the threshold would soon lose its function. But if the data were renamed every time the result became inconvenient, the threshold would be nothing more than decoration.
She attached the validation record: data period correct; classification still following the approved rules; version reproducible; result exceeding the escalation threshold by 20 percent.
The final field required a recommendation.
She entered: “Initiate escalation review. Until the basis for passenger classification, evacuation capacity, and version history have been reviewed, a reduction in the risk level is not recommended.”
The Submit button glowed.
Xu Anhe paused for one second—not because she doubted whether the calculation was correct, but to make sure she had not allowed the calculation to say something it could not prove. The 72,000 could not predict an earthquake or a collapse, nor could it identify anyone. All it could prove was that the review conditions had been met.
She clicked Submit.
The system displayed: Submission successful. She saved a separate copy of the working version and recorded the time: 9:46 a.m.
Half an hour passed. The file the contact had promised did not appear.
Xu Anhe sent a message: “Did you run into a problem exporting the version history?”
There was no read receipt.
She was about to redial when a ring of fine ripples suddenly spread across the water in the glass beside her desk.
At first, no one in the office noticed. The air conditioning blew, a distant printer fed out sheets of paper, and the water in the glass trembled lightly once more. A sign hanging beneath the ceiling tilted to one side and did not immediately right itself.
Xu Anhe placed a hand on the desktop.
An extremely faint vibration rose from deep beneath the floor. It did not feel like a large vehicle passing by. It was more like someone had pushed the entire building from far away.
The next second, every phone in the office sounded a shrill alarm at once.
An earthquake warning popped up on the screens. The distance to the epicenter, estimated intensity, and countdown were still updating, the numbers changing rapidly.
Xu Anhe stood up. Her call screen was still on the Risk Management Office of the intermodal center, with the unpressed call button layered over the 72,000.
The countdown had not yet ended when the first light began to swing violently.