Safety Performance Indicators
for airlines.

See the highlighted block above the contents list. The rest of this article walks through the SPI definition, the leading-vs-lagging split, a baseline library, and the governance pattern.

A Safety Performance Indicator (SPI) is the measurement layer of Safety Assurance. ICAO Annex 19 and ICAO Doc 9859 (Safety Management Manual, fourth edition, Section 4) define the discipline; the operator's SPI library is the implementation.

Four properties separate an SPI from a vanity metric:

1. Numeric. A count, a rate, a ratio. Not a sentence, not a colour code, not a star rating.
2. Time-bound. Measured over a defined window (per month, per 1000 sectors, per 100 flight hours, year-to-date).
3. Tied to a hazard or top event.Every SPI tracks something specific in the operation, not “safety in general”.
4. Has an alert threshold and a target. The threshold is where investigation triggers; the target is where the operation should be. Both are documented, not assumed.

“Unstable approaches per 1000 sectors” is an SPI. “Improve safety culture” is not. The fitness test: can the number be plotted on a chart with two horizontal lines (threshold and target)? If yes, it is an SPI.

Lagging SPIs count realised events — the things that already happened. They are easy to define and operationally honest. They are also inherently retrospective: a lagging SPI tells you the operation is drifting only after the drift has produced events.

Leading SPIs count precursors — the conditions that precede events. They are harder to define but more useful operationally because they detect drift before an event occurs. ICAO Doc 9859 recommends operators include leading SPIs as the SMS matures.

Examples of each:

Lagging: occurrences per 1000 sectors, runway excursion rate, ground damage rate, TCAS RA rate, MEL deferrals exceeding limits, closed safety actions per quarter.

Leading: FOQA-detected unstable approaches per 1000 sectors, expired barrier-relevant training per active fleet, open audit findings against barrier-backing procedures, fatigue-exposure days per pilot per quarter, percentage of CAPA closing on time.

A library biased toward lagging is reactive. A library biased toward leading is predictive but harder to defend against external review. A balanced library mixes both; the safety review board reads them together.

A baseline SPI library appropriate for most commercial airlines. Categories tied to top hazards, not arbitrary grouping. Each line is a starting point; the operator tailors the exact metric to the operation.

Flight operations.

• Unstable approaches per 1000 sectors (FOQA-derived where available)
• TCAS RA rate per 1000 sectors
• Runway excursion / incursion rate per 1000 sectors
• Hard landing rate per 1000 sectors
• EGPWS warning rate per 1000 sectors

Maintenance and engineering.

• Open MEL deferrals exceeding category limits
• Tech log entry quality rate (sample-audited)
• Unscheduled maintenance per 1000 flight hours

Ground operations.

• Aircraft ground damage per 1000 turns
• Ramp safety occurrences per 1000 turns

Safety system health (leading).

• Voluntary report rate per 100 active crew per quarter
• Percentage of CAPA closed on time
• Open audit findings exceeding overdue threshold
• Expired barrier-relevant training per active fleet
• Safety review board attendance by the accountable manager

Start small: pick 3 to 5 from the list at SMS implementation. Add carefully as the SMS matures. Retire any SPI that stops producing useful signal — carrying dead SPIs is more harmful than not having them.

An SPI without a threshold is a chart. An SPI without an owner is a decoration. Both fail the same way: nothing happens when the line moves.

Threshold setting.Use the operator's own 6-to-12 month baseline. Set the alert threshold above the operational variance the team considers normal — not above the highest single point in the baseline. Where industry benchmarks are available (ICAO regional safety reports, IATA safety reports, EASA Annual Safety Reviews), use them to sanity-check the threshold. Don't copy benchmarks blindly; the operator's context matters.

Target setting.The target is where the operation should be. It is below the alert threshold and reachable on the operator's improvement plan. Targets that the operation cannot plausibly reach in the planning horizon are demotivating; targets that the operation already consistently meets are uninformative.

Ownership.Every SPI has a named owner. The owner is the person who reviews the SPI at the safety review board, owns the investigation when the threshold is breached, and proposes the corrective action plan. SPIs without owners drift — the chart updates but nothing happens when it does.

Review cadence. Every SPI is reviewed at every safety review board (monthly minimum). The annual SMS review cycle is when thresholds and targets are revisited: are they still calibrated, are new SPIs needed, are old ones still producing signal.

eAviora ships SPIs as live artefacts on the same operational graph as occurrences, hazards, barriers, CAPA and the Safety Risk Profile. The governance pattern is structural, not narrative.

• Live counters. SPI counters update the moment an occurrence is classified or a barrier-relevant record changes. No nightly batch.
• Threshold breaches surface as alerts. The owner is notified; the safety review board pack reflects the breach automatically.
• Trend charts render on the safety analytics surface, visible to the safety manager and the accountable manager.
• Named ownership. Every SPI has a typed owner in the platform; the owner is who the system notifies and who appears in the review board pack.
• Audit-grade trail. The threshold and target history is immutable; the regulator three years later can see what threshold was in force at any past date.

See Safety analytics and SMS module for the relevant surfaces, or contact us to discuss your SPI library.