Planned operations meet actual event reality.
Sport timing/results plus weather, safety, people, venues, mobility, IT, media and services converging into one Event Data Fabric. Time Control slows or accelerates both incoming demo events and visual animations without freezing the live view.
Sport · Weather · Safety · Teams · Sites · Transport · Services
Authenticate · Limit · Validate · Quarantine
Persist · Route · Replay · Normalize
Correlate · Alert · Decide · Learn
10 feed domains · click to zoom in
Pictograms give an immediate reading of the Event Data Fabric. Each tile opens its dedicated cockpit, then each feed can be inspected individually.
12 representative disciplines · continuous DT_CURRENT
All Selected disciplines come from the current Demo reference DEMO reference; live values are synthetic.
Message evidence
What needs attention now?
A calm synthesis replaces the scrolling bus. Open the Event Stream only when you need the chronology.
Operational variance radar
| Sport / discipline | Venue | Planned | Status | Progress | Δ Start | Live evidence |
|---|
All Selected disciplines from current Demo reference DEMO
Feed Control Center
Activate, isolate, inspect and simulate every feed, grouped by operational domain, before any real provider is connected.
EVENT-DEMO correlation scenarios
Coherent multi-feed situations that turn raw telemetry into operational context and decisions.
Latest correlated event
Run a scenario to see the EOS correlation output.
Secure Feed Exchange Zone + EDF Router
External feeds are treated as untrusted input. No provider, field device or public data source writes directly into the EOS core.
Three independent signals, one operational picture
National authority + European interoperability + observations
For Event area, Local weather remains the operational national authority. Regional weather alerts/Regional weather exchange provides the harmonised European CAP/EDR layer; forecast, radar and observations add anticipation and confirmation.
Assume every feed can be hostile
- Per-feed identity: mTLS/OAuth/API key; never one shared master secret.
- Deny-by-default network rules and separate Internet, security, OT and core zones.
- Strict content type, schema/profile and semantic validation.
- Hard message size, rate, burst, timeout and decompression-ratio limits.
- XXE disabled; no unsafe deserialization, eval or arbitrary callback URLs.
- Quarantine malformed, unsigned or unexpected data; kill-switch per feed.
Cut does not mean data loss
- ACK provider only after durable landing for push feeds.
- At-least-once ingestion with deterministic idempotency/deduplication.
- NATS Event router persistent streams, durable consumers and replay.
- Pull feeds keep cursor/ETag/watermark and reconcile after reconnect.
- Venue edge collectors spool locally and forward when WAN returns.
- Dead-letter/quarantine queues preserve evidence instead of dropping it.
Never expose field protocols to Internet
- BACnet, OPC UA, fire panels, lifts and power remain on venue OT networks.
- Read-only local gateway exports a canonical subset outbound over mTLS.
- VMS/radio/security feeds come from management gateways, not cameras/terminals directly.
- EOS is observational by default; actuation requires a separate governed path.
Metadata, not heavy essence
- Video/audio stay in ST 2110/AES67/VMS/broadcast fabrics.
- EOS receives flow state, alarms, timestamps and recording references.
- Photo-finish evidence is referenced and hashed; EOS does not become the homologated finish system.
Two components, not one
Feed Ingress Gateway protects and translates the boundary. EDF Event Router distributes accepted events internally. Collapsing both roles into the portal application would couple security, provider protocols and user-facing EOS logic — precisely what this architecture avoids.
Security Lab — receive, distrust, validate, isolate
Security and continuity are separate planes: a message can be replayable and still be hostile. Every replay re-enters the same validation chain.
Cut ≠ loss
- At-least-once ingestion + deterministic idempotency.
- ACK push only after durable acceptance policy.
- Pull feeds retain cursor/ETag/watermark.
- Venue edge collectors spool locally during WAN loss.
- Replay always re-enters validation; it never bypasses security.
Replayable ≠ trusted
- Credential/certificate scoped per feed and environment.
- Hard quotas prevent resource exhaustion and decompression bombs.
- Strict parser isolation protects the portal from malicious payloads.
- Quarantine is outside the operational bus.
- Kill-switch isolates one feed without stopping the EDF.
Outbound-only, read-only
- No Internet ingress to BACnet/OPC/fire/lift devices.
- EOS remains outside fire, access and power safety/control loops.
- Actuation, if ever needed, is a separate governed architecture.
Every decision leaves evidence
- Source identity + native message ID + timestamps.
- Raw immutable object + SHA-256.
- Adapter version, schema/rule version and canonical event ID.
- PASS / QUARANTINE / DROP reason codes.
- Security telemetry goes to SIEM/SOC; EOS receives only operational impact.