The aviation risk model,
in the box.

See the highlighted block above the contents list. The rest of this article explains the difference between shipping a model and shipping a blank canvas, exactly what is in the box, and how an airline uses it on day one.

Open almost any legacy safety tool and you find the same thing: a blank bow-tie editor, a blank barrier table, and a blank indicator form. The software is a canvas. Before it does anything useful, the airline has to build the entire risk model itself — draw every diagram, name every barrier, define every indicator, and write every scoring rule.

That is not a small task. It is the work of a risk specialist for months, often outsourced to a consultancy. And it has three problems that never go away:

• It rarely finishes. Most safety offices populate a handful of bow-ties for their top hazards and never complete the set. The blank canvas stays mostly blank.
• It is bespoke and hard to audit. Two analysts modelling the same scenario invent two different barrier sets. A regulator cannot tell whether a missing barrier is a real gap or just a naming choice.
• It drifts. A model built by hand in a drawing tool ages the moment someone copies the file. There is no single source of truth and no guarantee the diagram on screen matches the one in the manual.

The configure-it-yourself approach makes the airline pay the modelling cost before it gets any value — and then live with a model that is unique, unaudited, and slowly going stale. eAviora was built to invert that.

eAviora ships the aviation risk model itself, ready on day one and aligned to ICAO method. It is not a canvas to fill; it is a knowledge base to switch on. In the box:

• 101 bow-tie models — one per recognised aviation risk family.
• 1,727 elements — the threats, consequences and controls that make up those diagrams.
• 804 named barriers — the preventive and recovery defences, named once and shared everywhere.
• 210 scenarios — the modelled ways a hazard plays out.
• 15 risk themes — the families that group the model for oversight.
• A 610-indicator SPI library — Safety Performance Indicators ready to activate.

The whole model is generated from a single master taxonomy workbook and checksum-pinned in the build. The checksum is the guarantee against drift: if anything in the model changed, the build would fail. So the 101 bow-ties and 804 barriers one airline rates against are the same as every other airline's — stable, shared, and ICAO-aligned.

That stability is what makes the model worth more than a custom one. Because every barrier has a canonical name and every scenario a canonical shape, a rating means the same thing across every record and over time. The airline tailors this model to its operation rather than building it from a blank page — and it is prod-verified at airline scale before the first occurrence is ever logged.

The model is not a reference document that sits beside the work. It is wired into every record. When an occurrence is logged, it maps to a bow-tie family from the 101 in the box, and the diagram comes with its named preventive barriers (the defences left of the top event) and recovery barriers (the defences right of it) already in place.

Barrier rating. On each record, each barrier is rated for that event: effective, partially effective, ineffective, or missing. The safety analyst is not inventing barriers; they are assessing the ones the model already names. That rating colours the diagram, so anyone reading the record sees at a glance which defences held and which failed.

From a degraded barrier to an action.A barrier rated ineffective or missing is a real, named gap in the operation's defences. eAviora turns that gap into work: a degraded barrier drives a corrective action against the named defence, not a free-text note. The action closes the loop between detecting the weakness and fixing it.

Because the barrier names are shared across the whole library, the same defence rated ineffective on three occurrences is visibly the same defence — a pattern the safety office can act on, rather than three unrelated notes. The shared model is what turns isolated ratings into a picture of where the operation's defences are weakening.

The same in-the-box principle runs the measurement layer. eAviora ships a 610-indicator Safety Performance Indicator library— not a blank form that asks the airline to define its own indicators, but a ready library to switch on.

Activatable by maturity tier.A new safety office does not need all 610 indicators on the first day, and a mature one wants the full set. The library is tiered, so an airline turns on a starter set early and expands as its safety management matures — without redefining anything.

Real statistical process control, not coloured bars. Each active indicator is evaluated monthly with genuine statistical process control: control charts, the Western Electric Rules, and the method set out in ICAO Doc 9859. That is the difference between an indicator that alerts when the data truly moves outside its expected envelope and a trend bar that turns amber because this month's number happens to be higher than last month's.

The contrast with the configure-it-yourself tool is the whole point. There, the airline writes 610 indicators and their statistical rules by hand before the tool measures anything. Here, the library is already in the box, ICAO-aligned and statistically sound, so measurement starts on day one rather than after a year of definition work.

This article is one of five suites that make up the platform — safety management, quality and compliance, documents, training and actions — all running on the same shared model. See the SMS module for where the bow-ties live, or contact us to walk the model against your operation.