Aviation safety investigation management that replays the event, cites every finding and answers the NTSB question in the first hour
Reports drafted in days, not weeks, with every finding tied to its evidence.
See one case, screen by screen ↓Aviation safety investigation management is how an airline's safety department runs an incident or accident investigation: collecting the evidence, building the sequence of events, finding contributing factors and root causes, deciding NTSB and FAA notifications, and tracking recommendations to closure. Under a US carrier's safety management system it is one of the safety assurance processes in 14 CFR 5.71. As safety investigation management software, Safety Investigation Management adds seven agents that replay the event with every source lined up, find where sources disagree, propose factors and fixes and draft the report and filings, while the investigator decides each finding and the Director of Safety signs.
How to choose AI for airlines: a buyer's guide to agentic AI solutions →
Updated
After a rejected takeoff, a tail strike or a flight attendant hurt in turbulence, the investigator copies times out of the flight data export, listens to the ATC tape, types up crew statements, pulls logbook pages and work orders from the maintenance system, and builds the sequence of events by hand in a spreadsheet. The NTSB question is read against 49 CFR 830.2 and 830.5 once, at the start, and rarely re-read when new facts arrive. Contributing factors, recommendations and the report follow over weeks, and fixes are chased by email.
The cause hides in the seams between sources. A captain recalls 125 knots when the data says 134. Maintenance control says the engine had no prior history, while the tech log shows the same engine written up two days earlier and closed as could not duplicate. Analyses that stop at the crew miss the organization: the DOT Inspector General found 171 of 185 root-cause analyses accepted at one US carrier did not identify the true root cause.
Estimated split for a Level 2 investigation at a network carrier, by hand and with the solution. The first-draft target in the working solution is 3 days against a 30-day company standard.
Seven agents build the timeline, find contradictions and propose causes and fixes; the investigator decides each one.
On Tuesday, October 6, Corvane flight 404, a Boeing 737-8 (N812CV) with 162 passengers and 6 crew, rejected its takeoff from LaGuardia runway 13 after the right engine surged. It is Friday, October 16, day 10 of a 30-day Level 2 investigation. Here is how the safety investigation runs, screen by screen, in the working solution: the investigator works with the agents in conversation, decides every finding, and sees the evidence behind each one.
Rachel leads four of the eight open investigations. Her Today screen opens on CV 404: maintenance control said “no prior history”, but the same engine was written up two days before and closed as could not duplicate. Four proposed factors and two contradictions wait for her; three deadlines fall in the next seven days, and three recommendations are overdue.
“The agents propose it as a contributing factor. 4 factors and 2 contradictions are waiting for you.”
The event is drawn on runway 13 from line-up to the stop, with time ticks on the path. At 07:14:22 ENG 2 N1 drops from 94.8% to 71.3% and EGT jumps from 912 to 1,018 °C, limit 1,060, at 132 knots. The captain brings the thrust levers to idle at 134 knots, 7 below V1, and the aircraft stops with 1,180 feet of runway left. Under each tick sit the flight data, the ATC tape, the crew, the weather and maintenance, each linked to its source.
Timeline Builder: “41 entries from 11 sources. The tower clock ran 2 seconds ahead of the flight data; I aligned it.”
A dashed tick before the flight shows the October 4 pilot report: an ENG 2 EGT fluctuation of +40 °C in the climb at FL180. Work order WO-88213 records one ground run, could not duplicate, returned to service. The engine trend shows the margin falling from 42 °C to 24 °C in 9 days, with no alert because the alert fires only below 20 °C. On October 6 maintenance control logged “no prior ENG 2 history”.
The maintenance card is marked “Differs · C2”.
Capt. Marcus Hale's statement is split into seven claims. Five agree with the flight data and the tower tape. “At about 125 knots there was a loud bang” differs: the surge came at 132 knots, the reject at 134. “First thought we had hit a bird” cannot be checked from the data. The agent drafts neutral follow-up questions for the claims that differ.
“The agent drafts neutral questions about the claims that differ or cannot be checked. Nothing is sent without you.”
The agent compared 21 claims from 4 statements with the flight data, the tower tape, the logs and each other, and found five disagreements; two are still open. For C2 it proposes, with high confidence, that the logbook is the record: maintenance control looked only at open deferrals, not closed write-ups. Rachel can resolve with a reason, ask a follow-up or open the proposed factor.
“The report cannot go for signature while one is open.”
Rachel asks in the conversation beside the replay. The Theory Tester plans the check and shows its five steps: 128 engines on the 64 737-8s read for an EGT margin drop of 10 °C or more within 10 days. Two more match: N809CV ENG 1, 13 °C in 8 days, and N826CV ENG 2, 11 °C in 10 days. N809CV also had a could-not-duplicate write-up on October 9. Borescope requests are drafted as interim action R4.
The requests go to Maria Castell only when Rachel clicks “Send to Maria Castell”.
Rachel clicks “Add to the file”. The sentence appears highlighted in section 4 of the investigation file: the October 4 write-up was closed as could not duplicate after one ground run, without a trend review or borescope, while the margin had fallen 18 °C in 9 days. Each clause carries its citation to the tech log, the work order, the trend and the maintenance manual.
“F2 added to the file with R1.”
Factors sit under what was done, conditions, supervision and procedures, and the organization, each with evidence and confidence. F2 is in the file with R1: change Maintenance Manual 5.7.3 to require 30 days of trend review before a could-not-duplicate closure, owner Gary Lindqvist, due December 15. The bird-ingestion idea is tested and ruled out with confidence 0.92: no organic matter at the inlet, no remains on the runway, no bird activity reported.
Factor Analyst: “I propose; you decide, with a reason when you reject.”
No one was hurt, and damage limited to one engine and to tires and brakes is not substantial damage under 830.2. Section 830.5(a)(3) needs debris to escape other than through the exhaust; the borescope found none. A service difficulty report was owed under 14 CFR 121.703(c) and filed October 8 by Thomas Greer, inside the 96 hours. The test re-runs on its own when the engine teardown report arrives, expected October 28.
“What would change it: the teardown finding uncontained debris.”
The draft follows the Corvane Investigation Report format, with 41 of 41 sentences linked to evidence. The Report Checker runs nine checks: no blame words, no confidential source used, the NTSB decision current. Two items block sign-off until Rachel decides them: an open contradiction and factors still proposed. The direct cause is marked provisional until the teardown. Thomas Greer then approves or returns the report with a reason.
“I sign it only if I can click any sentence and see where it came from.” — Thomas Greer
The same rejected takeoff, seen by four of the people who carry an airline incident investigation — what the work looked like, and what it looks like now.
Seven agents build the timeline, find contradictions and propose causes and fixes; the investigator decides each one.
Pulls flight data, the ATC transcript, weather, the logbook, work orders, engine trend data and station logs the moment an investigation opens, records custody and a fingerprint for each item, and puts recorder data and maintenance records on hold.
Places every fact on the aircraft's path at its time, reconciles clocks between sources, and writes the investigation file in the airline's report format with every sentence cited.
Splits each crew and witness statement into claims, matches each claim to the data, and drafts neutral follow-up questions.
Finds where statements, data and logs disagree and proposes a resolution with its reason and confidence.
Proposes contributing factors at four levels — what was done, conditions, supervision and procedures, the organization — and, as the Theory Tester, checks the investigator's theories with citations and confidence, across the fleet when asked.
Writes a fix for each accepted factor with an owner, a due date and an effectiveness check, and chases owners until the action is done and shown to work.
Tests every event against 49 CFR 830 and 14 CFR 121.703, re-tests when new evidence arrives, drafts the Form 6120.1 and service difficulty reports, and, as the Report Checker, checks the report before sign-off.
Accept, edit or reject every finding; sign the report and the NTSB filings. The agents propose; a named person decides.
Ask about any event, factor, theory or deadline from the Today screen or beside the replay. Every answer cites its source and offers the next step.
Why is CV 404 not reportable to the NTSB?
No one was hurt, and damage limited to one engine, and to tires and brakes, is not substantial damage. The borescope shows no debris escaped other than through the exhaust, so 830.5(a)(3) is not met. The service difficulty report was filed on October 8, inside 96 hours. I will re-check when the teardown report arrives, expected October 28.
Could a bird have caused the CV 404 surge?
Bird ingestion is ruled out. The borescope found no organic matter or feathers at the inlet or fan, the runway inspection found no remains, and the tower reported no bird activity in the hour before. Confidence 0.92 that it was not a bird.
Did the CV 404 crew reject in time?
The crew acted on time. The surge was at 07:14:22.1 and the thrust levers reached idle at 07:14:23.4 — 1.3 seconds. The operations manual expects the decision within about 2 seconds and allows a reject above 100 knots for an engine failure. Capt. Whitford accepted this as safety-positive (F5).
Which other engines look like N812CV's before the event?
I swept the 128 engines of the 64 737-8s for an EGT margin drop of 10 °C or more within 10 days: N809CV ENG 1 (13 °C in 8 days) and N826CV ENG 2 (11 °C in 10 days). N812CV's engine fell 18 °C in 9 days before the surge. Borescope requests are drafted for Maria Castell.
13 screens from the working solution, on its sample data. Pick one to see it large.
Investigation levels, report clocks and the rules the agents apply are settings. A change needs the Director of Safety's approval and is logged.
| Setting | Default | Choose from |
|---|---|---|
| Level 1 · accident or serious incident | Report due in 20 days | Any number of days |
| Level 2 · major incident | Report due in 30 days | Any number of days |
| Level 3 · minor incident | Report due in 45 days | Any number of days |
| First draft target | 3 days after opening | Any number of days |
| Re-test the NTSB rules when new evidence arrives | On | On · Off |
| Block sign-off while a contradiction is open | On | On · Off |
| Treat a time difference over 3 seconds between sources as a contradiction | On | On · Off |
| Let agents propose factors about named individuals | Off | On · Off |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (DOT Office of Inspector General — 171 of 185 accepted root-cause analyses at one US carrier did not identify the true root cause; Boeing AERO — $12 million for one tail strike). Regulations named: 49 CFR 830.2, 830.5, 830.15 and 831.13; 14 CFR 121.703 and 14 CFR 5.71. People, Corvane Airways, its flights and aircraft named on this page are fictional — characters and sample data in the working solution.
Aviation safety investigation management is how an airline's safety department runs an incident or accident investigation: collecting the evidence, building the sequence of events, finding contributing factors and root causes, deciding NTSB and FAA notifications, and tracking recommendations to closure. Under a US carrier's safety management system it is one of the safety assurance processes in 14 CFR 5.71. As safety investigation management software, Safety Investigation Management adds seven agents that replay the event with every source lined up, find where sources disagree, propose factors and fixes and draft the report and filings, while the investigator decides each finding and the Director of Safety signs.
For NTSB notification under 49 CFR 830, the Notification Advisor tests every event against the accident definition in 830.2 and the serious incident list in 830.5, explains its answer clause by clause, and re-tests when new evidence arrives. When an event is an accident it drafts the NTSB Form 6120.1 from the records. It never notifies or files: in the demo, the Director of Safety called the NTSB for a turbulence injury 52 minutes after it happened and signs the form.
It depends on injuries, damage and what happened to the engine, and the agents show the test on every event. In the demo the rejected takeoff was not reportable: no one was hurt, damage limited to one engine and to tires and brakes is not substantial damage, and no debris escaped other than through the exhaust. A service difficulty report was still owed under 14 CFR 121.703(c) and filed inside the 96 hours.
The Factor Analyst runs the contributing factors analysis at four levels — what was done, conditions, supervision and procedures, and the organization — each factor with its evidence and confidence, and tests the investigator's theories across the fleet when asked. In the demo this root cause analysis traced a rejected takeoff past the crew to an engine write-up closed as could not duplicate without a trend review, and found two more engines with the same EGT margin drop.
The target is a first report draft in 3 days against a 30-day company standard for a Level 2 investigation; in the demo the first draft was ready on day 3. Report clocks for each level are settings, and notifications warn the Director of Safety and the lead investigator before a report, Form 6120.1 or service difficulty report falls due.
No. The cockpit voice recorder stays sealed and confidential safety reports are never read; the agents cannot open them, no role opens sealed items, and the evidence pack export leaves them out.
Yes. The agents propose; the investigator accepts, edits or rejects each factor with a reason, resolves each contradiction, and sends questions and borescope requests only when she says so. The Director of Safety signs the report and the NTSB filings, and every step is on the audit trail.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your safety management system manual, report format, operations and maintenance manuals and a sample of closed investigations — and it goes live once every quality gate has passed. We will walk you through it on one of your own events first.
Every report routed the same day, every repeat linked before it is scored.
1-min demoAviation Safety Action Program (ASAP)Every ASAP report ready before the ERC meets, every action tracked to closure.
1-min demoSafety Risk ManagementEvery hazard owned, scored on this week's evidence, and ready for the FAA.
1-min demoWe'll run Safety Investigation Management on one of your own closed investigations and its evidence.