Aviation safety risk management with every hazard owned, scored on this week's evidence and ready for the FAA
Every hazard owned, scored on this week's evidence, and ready for the FAA.
See one case, screen by screen ↓Aviation safety risk management software holds an airline's hazard register and tracks how each risk is scored and controlled under its SMS. Safety Risk Management keeps that register live, scoring risk and tracking mitigations, for SMS managers. Each hazard is a bowtie whose barriers seven agents measure every night from safety reports, flight-data events, audit findings and maintenance alerts; when a barrier weakens they re-score the risk on your matrix, challenge it and draft mitigations with a test. Hazard owners approve, edit or reject and sign.
How to choose AI for airlines: a buyer's guide to agentic AI solutions →
Updated
Aviation safety risk management under 14 CFR Part 5 asks an airline to identify hazards, assess and control the risk, and show that its risk controls work. In many SMS offices the hazard register is a spreadsheet or a module reviewed once a quarter. Barriers are rated once in a workshop, and the evidence that would show one slipping — an ASAP report, three flight-data exceedances, a NOTAM, an audit finding, a reliability alert — sits in other systems that nobody reads against the register.
So the register says “effective” while the line says otherwise. The same hazard is opened again under a new name, and an acquisition doubles the problem. Mitigations close without a test of whether they worked, and the Safety Review Board papers and the FAA and IOSA evidence are rebuilt by hand every month. The first sign that a barrier failed is often the next report.
Estimated split for the Safety Risk Manager's office at a network carrier with about 150 hazards, by hand and with the solution.
Seven agents link the evidence, measure every barrier, re-score and challenge the risk and draft mitigations; hazard owners decide.
Corvane Airways, a fictional network carrier with 312 aircraft, keeps 146 hazards and 412 barriers. In the week of October 6 it rained three days at SFO and the ILS 28L glideslope was out of service. On Thursday, October 15, here is what happens, screen by screen, in the working solution.
Renata's day starts with the agents' note: 148 new items read, 61 linked to their hazards on their own, and at SFO three unstable approaches in one week continued to landing. Three hazards moved this week, 27 new items wait for her, and 7 mitigations are overdue. “Needs you” lists 7 decisions, each with one next step.
“7 decisions · agents never act unseen.”
The Linking Agent reads safety reports, flight-data events, audit findings and reliability alerts from seven sources. It links on its own only at 0.90 confidence or above and only onto a barrier that is holding. Everything else waits in New evidence with its reason: a DEN stop-bar report filed under ground collision that reads as a runway incursion precursor, four GPS reports near OAK that fit no hazard, and three hazards someone opened twice.
“Waits for you: B1 on HZ-0117 is weakening since 02:48 tonight (rule L2).”
On HZ-0117, runway excursion on landing, wet runway, barrier B1 is “Stable by 1,000 ft, go around if not” from FOM 4.12.3. At SFO three unstable approaches were continued in 7 days with no go-around, against 0.4 a week, and the network go-around rate on unstable approaches fell from 71% (141 of 198, April to June) to 58% (124 of 214). Each event on the barrier — an A321neo at Vref +19 kt at 1,000 ft, a de-identified 787-9 crew report, a 737-8 1.4 dots high at 700 ft — opens its source passage, and the 28L glideslope NOTAM hangs from the barrier it weakens.
“At about 800 ft we were high and fast. I called it but we continued.” — ASAP-26-3317, de-identified
The Risk Scoring Agent moves likelihood from Remote to Occasional — Occasional in SMS Manual 3.4 covers events seen more than once in a quarter at one station, and this one was seen three times in a week — and keeps severity at Catastrophic: 3A, Unacceptable, confidence 0.86. The Challenge Agent reads the same evidence on its own and agrees with the direction, but notes two of the three events came after the glideslope went out and sets a re-score review for October 26, a week after the NOTAM ends.
A severity change needs two independent reasons (rule R6). Disagreement is always shown, never averaged away.
M-0117-07, an SFO wet-runway brief with the go-around gate called at 1,000 ft by the pilot monitoring (bulletin FOB-26-31). M-0117-08, a daily flight-data watch of every SFO approach for 30 days, owned by Lena Kovac. M-0117-09, a recurrent simulator scenario on the high-energy wet approach, owned by Capt. Owen Marsh. The predicted residual risk is 2A Tolerable. Once approved, each sits on the mitigations list with its owner, due date and test of success.
The test: no unstable approach continued below 1,000 ft at SFO for 30 days, and a network go-around rate of at least 70% over 60 days.
Elena asks the agents in the same thread. The Challenge Agent answers with its sources: the barrier was already weak before the outage — the go-around rate fell from 71% to 58% since July — and the SFO airport brief has no entry for flying with the 28L glideslope out. If SFO is clean by October 26, the score can come back to 2A.
Every answer is cited; each number opens the passage it came from.
Elena opens Edit and brings the SFO brief forward from October 17 to October 16; the agents re-check the residual risk with her edit — still 2A Tolerable. She approves with reason code A2 — Approved with edits — and signs. The register now carries 3A Unacceptable, approved by her, and the Mitigation Agent sends the bulletin to Flight Standards, starts the SFO flight-data watch and tells Malcolm Ashby.
“I, Capt. Elena Voss, sign this decision. It is recorded with the time, the reason and the sources.”
Every step — the link at 02:31, the barrier at 02:48, the re-score, the challenge, the drafts, Elena's edit and her signed approval at 08:20, the Board item at 08:12 — is on the audit trail with the person or agent, the time, the reason code and the sources. The trail is kept seven years and cannot be edited.
Because the score is Unacceptable and the residual risk keeps Catastrophic severity, only the Accountable Executive may accept it. The Board Secretary Agent has already put HZ-0117 first on the October 21 agenda, with a one-paragraph case citing the three events and the go-around rate, next to five other items. Malcolm accepts, returns or defers each with a reason and a signature, and the minutes are drafted from the signed decisions.
“Residual 2A with Catastrophic severity is yours to accept.”
The same register, seen by five of the people who answer for it — what their month looked like, and what it looks like now.
Seven agents link the evidence, measure every barrier, re-score and challenge the risk and draft mitigations; hazard owners decide.
Reads every new safety report, flight-data event, audit finding and reliability alert each night, links it to the hazard and barrier it touches, proposes a new hazard when nothing fits, and flags two hazards that describe one risk.
Recomputes the health of every barrier each night from the linked evidence against its baseline — Holding, Watch, Weakening or Failed — and says what changed in one sentence, with escalation factors such as NOTAMs or system changes.
Re-scores likelihood and severity on the airline's own 5×5 matrix when a barrier weakens or fails, and explains the move with the manual passage behind it.
Reads the same evidence on its own, without the proposer's reasoning first, and agrees or disagrees with every re-score and mitigation before a person sees it.
Drafts mitigations with an owner, a due date, a predicted residual risk and a measurable test of success; reminds owners, escalates late actions and runs the effectiveness test when its window ends.
For each operational change, proposes the hazards from the register that apply and the new ones it lacks; runs the merge of an acquired airline's hazard register by top event, threats, barriers and evidence.
Drafts the Safety Review Board agenda, each item's one-paragraph cited case, the minutes from the signed decisions, the monthly risk profile and the FAA and IOSA evidence.
Decide every score, mitigation and acceptance. The agents propose; a named person decides.
Ask about any hazard, barrier, mitigation or Board item, or tell the agents what to do. Every answer points to its source, and every instruction is logged.
Why is the runway excursion hazard now Unacceptable?
Because barrier B1, “stable by 1,000 ft, go around if not”, is weakening: three unstable approaches at SFO in one week were continued to landing, and the network go-around rate fell from 71% to 58%. Seen three times at one station in a week is “Occasional” in your manual, and Occasional × Catastrophic is 3A, Unacceptable.
Why not wait for the glideslope to return?
Because the barrier was already weak before the outage: the network go-around rate on unstable approaches fell from 71% to 58% since July, and the SFO brief has no entry for flying with the 28L glideslope out. The outage ends Oct 19. The Challenge Agent has set a re-score review for Oct 26; if SFO is clean by then, the score can come back to 2A.
Which barriers are weakening this week?
Nine are weakening and one has failed. The ones that matter most: HZ-0117 B1, the stabilized approach at SFO; HZ-0073 B2, the MEL interval reminder, failed after the Sep 1 system merge; HZ-0142 B2, the layover hotel standard; and HZ-0031 B1, two wing walkers at night.
Show me what is overdue
Seven mitigations are overdue: M-0067-02 shipper screening (13 days, escalated), M-0098-03 turbulence briefing (9 days), M-0012-03 ramp telematics (7 days) and M-0073-04 MEL reminders (6 days), plus three on track for an extension.
13 screens from the working solution, on its sample data. Pick one to see it large.
The matrix, the acceptance levels and the rules the agents follow are settings the SMS administrator owns. Every change is signed, applies from that night and is on the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| Link evidence on its own at confidence of at least | 0.90 | 0.85 · 0.90 · 0.95 |
| A person confirms links to a barrier on watch, weakening or failed, or to an Unacceptable hazard | Always | Always · Only Unacceptable hazards · Never |
| A barrier is weakening when its rate drops by | 10 points | 5 · 10 · 15 points |
| Look back for the baseline | 90 days | 60 · 90 · 180 days |
| The Challenge Agent reviews every re-score and mitigation | Always | Cannot be turned off |
| Hazard owner decides a proposal within | 3 business days | 3 · 5 business days |
| Escalate a late mitigation to the Accountable Executive after | 10 days | 5 · 10 · 14 days |
| Risk matrix and who accepts each level | 5×5, ICAO Doc 9859 example, adapted in SMS Manual 3.4 and 3.6 | Tolerability set per cell; acceptance set for Acceptable, Tolerable, Unacceptable and any Catastrophic residual |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (IATA runway excursion data 2013–2022, via ICAO MID ASRG5 WP5 — 125 accidents; Burin, Flight Safety Foundation, ICAO GRSS 2011, and ESC28 — 1.4% to about 3% of unstable approaches end in a go-around; Safe-runway GmbH, cited by EASA GAPPRE — more than $4 billion in 2019). Rules named: 14 CFR Part 5 §§5.51–5.57 and 5.71–5.75 (89 FR 33068, Apr 26, 2024); FAA AC 120-92D; ICAO Doc 9859; IOSA ORG 3. Corvane Airways, Halvard Air and the people named on this page are fictional — characters and sample data in the working solution.
Aviation safety risk management software holds an airline's hazard register and tracks how each risk is scored and controlled under its SMS. Safety Risk Management keeps that register live, scoring risk and tracking mitigations, for SMS managers. Each hazard is a bowtie whose barriers seven agents measure every night from safety reports, flight-data events, audit findings and maintenance alerts; when a barrier weakens they re-score the risk on your matrix, challenge it and draft mitigations with a test. Hazard owners approve, edit or reject and sign.
Subpart C asks an operator to apply safety risk management to changes (§5.51), identify hazards (§5.53), assess and control the risk (§5.55) and notify interfacing organizations of hazards they must mitigate (§5.57). Subpart D asks it to monitor safety performance and assess whether its risk controls are effective (§5.71–5.73). The solution maps the register and its evidence to each of these, and shows any gap.
Each barrier's health is recomputed every night from the evidence linked to it, against its own baseline, and marked Holding, Watch, Weakening or Failed. Each mitigation carries a measurable test of success agreed when it is approved; when the window ends the Mitigation Agent runs the test and proposes effective or reopen, for a person to decide.
A bowtie draws one hazard with its threats on the left, the top event in the middle and the consequences on the right, with the barriers that prevent and recover in between. In Safety Risk Management each barrier carries health measured from evidence, the events that hit it this week and the factors that weaken it, and each opens its source.
People decide everything. Agents propose; hazard owners approve, edit or reject with a reason code and a signature. A Tolerable risk may be accepted by its owner, while only the Accountable Executive at the Safety Review Board accepts Unacceptable risk or any residual risk with Catastrophic severity. The agents never close a mitigation or lower a score without a person.
Yes. For each operational change — a new route, station or handler — the Change Assessment Agent proposes the hazards from the register that apply and the new ones, for sign-off before the change goes live. For an acquisition it compares the other airline's hazard register with yours and proposes matches and new hazards for the two safety managers to decide.
Yes. The 5×5 tolerability matrix, who accepts each level, the auto-link threshold, the weakening threshold and baseline look-back, decision clocks, reminders and escalation are settings owned by your SMS administrator, signed and logged. You can start by importing your current spreadsheet register.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your SMS Manual, risk matrix, hazard register and connections to your reporting, flight-data, audit and maintenance systems — and it goes live once every quality gate has passed. We will walk you through it on your own register first.
Every report routed the same day, every repeat linked before it is scored.
1-min demoAviation Safety Action Program (ASAP)Every ASAP report ready before the ERC meets, every action tracked to closure.
1-min demoSafety Investigation ManagementReports drafted in days, not weeks, with every finding tied to its evidence.
1-min demoWe'll run Safety Risk Management on your own hazard register and a month of your safety reports and flight-data events.