Data & methodology

1Where the data comes from

Aircraft accident and incident histories are compiled from public investigation records (NTSB and equivalent international agencies) and public reporting. Airline certification and oversight context comes from ICAO audit programs, IOSA registration status, and EU air-safety listings.

Live airport weather comes straight from NOAA's Aviation Weather Center (METAR observations, typically updated hourly). Live aircraft positions come from the OpenSky Network. The route turbulence forecast is one we compute ourselves, from NOAA GFS model winds at cruise altitude (via the Open-Meteo API), sampled along the route's actual great-circle path. It is a model forecast, and we label it as one.

2The ranking model

Search results are ranked by safety, not departure time, using an explicit event-rate model rather than a blended 0–100 index. Heterogeneous indices share no common scale, and a composite with no uncertainty statement is a vibe, so we model the thing itself: an estimated λ, the severity-weighted fatal-equivalent rate per flight. The exposure unit is flights, not flight-hours, because the real risk concentrates in takeoff and landing.

2.1  Operator base rate

Each carrier’s base per-flight fatal-equivalent rate λ is continuous, with no fixed tiers. We start from a baseline rate, multiply by transparent, individually validated factors, clamp the result to a published three-population range for world airline safety, then shrink it by operating scale (below). The band labels (Elite, Strong, and so on) are bins on the resulting number, not inputs that set it.

Band labels, bins on the per-flight rate after shrinkage:

• ▸Elite  < 0.10 ×10⁻⁶
• ▸Strong  < 0.25 ×10⁻⁶
• ▸Watch  < 0.50 ×10⁻⁶
• ▸Elevated  < 0.90 ×10⁻⁶
• ▸High-risk  ≥ 0.90 ×10⁻⁶

Every factor earns its place by predicting outcomes and separating whole populations of airlines: IOSA-registry carriers run several times lower accident rates, an EU listing or a below-standard home regulator is a hard population-level flag, and a recent fatal accident is a real, if only coarse, one, since the timing of a single past accident barely predicts the future. A June 2026 review removed two things that used to multiply this rate but could not be defended: a subjective editorial “score,” and a carrier-level fleet-age term. Fleet age is now context and a tiebreak only (see §2.5), never a factor in the rate.

Earning a clean record: maturity shrinkage

The base rate is continuous (the band labels above are bins on it), and it carries one more correction, the one that matters most when you compare a budget carrier with a legacy one. A spotless accident record only reassures if the airline has flown enough to earn it: zero accidents over a few hundred thousand flights is mostly “not enough history to have crashed yet,” not proof of safety. So a below-average rate is shrunk back toward the industry average until exposure justifies it:

Applied one-sided: a young, small carrier’s clean record cannot buy a top rating, but a penalty (EU list, no IOSA, a recent fatal, meaning a rate at or above average) is hard evidence and passes through in full. A large, long-established clean carrier keeps its credit; a thin one is tempered, and the flight card says so.

2.2  Aircraft-type modifier (empirical Bayes, bounded)

Fatal accidents for a type are modeled as Poisson in the number of flights; with a weak Gamma prior, the posterior mean rate strikes the maturity balance: a young type is held near the industry average until its own record earns weight, in whichever direction it points. Zero-event types get a finite, honest rate instead of an impossible zero.

k

fatal events recorded for this type

n

flights flown by this type

α₀, β₀

Gamma prior worth 5,000,000 flights of pseudo-exposure; its mean (α₀/β₀ ≈ 0.126 per million) is the pooled fatal rate of our own 20-type panel, derived by a committed script (scripts/calibrate_type_prior.py), not asserted

We then severity-weight, folding in hull losses without fatalities at a declared 0.25 weight, and convert the result to a bounded hazard ratio against a fixed industry reference:

λ_ref

severity-weighted reference = 0.151 ×10⁻⁶ per flight, the pooled rate of the 20-type panel itself (fatal 0.126 + 0.25 × hull-only 0.098 per million; derived, not asserted), so ×1.00 means a typical record

f

the calm-side floor, a flat ×0.55: with the reference centered on the panel, a zero-data type reads ≈×1.00 from the prior on its own, measured records spread on both sides of 1, and the floor only bounds how much safety credit any airframe can claim. The ceiling stays ×1.4. The airframe is a far smaller lever than the operator either way.

2.3  Engineering modifiers (declared assumptions)

A small engineering modifier admits judgment without faking data: it is capped and printed in the interface as an assumption, not a measurement. Structure (composite vs aluminium) and fleet age are shown for context but do not move the rate. All types certify to the same standard, and a well-maintained old jet is no less safe than a new one.

Incident counts are deliberately excluded from the rate, since definitions and reporting vary too much across jurisdictions to use honestly, and remain visible only as context.

2.4  The headline rate

The final estimated per-flight rate is the operator base, scaled by every bounded modifier:

The interpretable output is that rate, printed as odds (“1 in X million flights”). For sorting and at-a-glance grading only, we map it to a 0–100 display score with a documented monotone transform:

λ_M

the final rate expressed as events per million flights

S

display score, 0–100, monotone in λ, used for ordering and grade labels only, never as a probability

2.5  What moves the score, and what doesn’t

A factor earns the right to move the rate only if it separates whole populations of airlines or aircraft, the one thing rare-event data can support. If it merely reshuffles options the data cannot tell apart, it is shown as context or used to break a tie, but it never moves the number. Everything we use, and everything we deliberately don’t, in one place:

The honest gaps are named, not filled: an airline’s safety culture is plausibly the biggest real differentiator among top carriers, but no comparable public metric exists, so we reach it only indirectly, through IOSA. Where a factor can’t be sourced, the answer is the gap, not an invented number.

3Uncertainty

We report one honest 90% range on the final per-flight rate by treating it as lognormal with a declared geometric standard deviation of 2.2. That spread is deliberately wide: the operator term is a signal-based index of a 1-in-millions event, and its real uncertainty dwarfs the airframe's bounded contribution. A sampling-only (pure Poisson) interval would read far too narrow, so we don't print one.

We also disclose the data-vs-prior split: how much of an estimate is the type's own record versus the borrowed industry prior:

So a type with 5,000,000 flights of its own history rests roughly ~50% on its record and ~50% on the prior; a 95M-flight workhorse is dominated by its own record; a brand-new type leans almost entirely on the prior, which is exactly the honest behaviour. Modifiers are treated as fixed in the interval, a stated limitation.

4Statistical ties

Ranking uses the continuous per-trip rate: each segment carries its own takeoff-and-landing exposure, so a trip's rate is the per-flight rate × the number of segments. A connection therefore can't beat a nonstop on a noise-level per-leg gap. How meaningful a gap is, is reported separately as P(one is truly safer), computed from the same lognormal spread as the range above. The “essentially a coin flip” verdict appears when that probability is under 0.6, or equivalently when the trip rates sit within roughly a factor of 1.3 of each other:

For two IOSA-registered, EU-clean carriers whose trip rates sit within 1.5× of each other, we additionally cap the probability toward a coin flip: the data genuinely cannot separate them. Larger gaps report as what they are, even between audited carriers. Only a genuinely exact rate tie is then decided by legible, declared facts, in this priority: longest clean record → newer-generation airframe → better data quality (a measured fleet age outranks an estimated one, so a guess never out-ranks a known figure) → younger fleet → and, last of all and as comfort only, a daylight arrival over a dark or dawn one. That final step decides nothing but an otherwise-exact tie, and never makes a safety claim.

Internally we also compute a probability of superiority: given each estimate and its uncertainty (a lognormal whose geometric spread, ÷/×2.2, also sets the published odds range), the chance one flight’s true rate is actually the lower of the two. It is self-policing: a real gap reads high; between two audited carriers with comparably clean records it iscapped toward 50% (the data cannot separate them), but never when one side has a recent fatal accident, which is a real, legible difference. We surface this as plain equivalence language (“statistically tied”), not a bare percentage, because a number near 50% reliably reads to an anxious mind as “even odds something goes wrong” rather than “both are one-in-millions safe.”

5Worked examples

Two carriers flying the same clean composite type, to show which lever actually moves the answer:

6Time of day: not scored, comfort only

Time of day is real but easy to overstate. The dramatic “night is several times more dangerous” figures come from general aviation (single-pilot, non-precision approaches, unlit fields) and do not transfer to scheduled jets. The honest commercial signal is the Flight Safety Foundation approach-and-landing study: 53% of those accidents occurred in darkness or twilight. But an accident share only implies elevated risk once you know how much flying already happens in the dark, and a solar-position simulation over our own airport network (full year, realistic departure times) gives a darkness exposure d ≈ 0.38. Inverting accident-share against exposure:

Modest, not the 3–4× folklore. The factors are then made exposure-neutral: daytime and night factors r_day and r_dark satisfy a redistribution constraint, so they shuffle risk around a carrier's existing average and never change its rate:

We further shrink RR toward 1 (the 1984–97 data predates modern terrain warning, satellite approaches and fatigue rules, and is confounded by airport, weather and crew). Because the effect is small, old, confounded, and exposure-neutral by construction, we deliberately exclude it from the safety score: it never changes an airline or aircraft rate. It surfaces as a comfort-and-awareness note on each flight (a daylight versus a dark or dawn landing), and enters the ordering in exactly one place, as the final comfort tiebreak, to choose between flights that are otherwise identical on every safety factor (say, the same airline and aircraft at two times of day). Because it sits after every safety key, it can never override a safety difference; it only replaces an arbitrary alphabetical tie-break with a mild daylight preference. The calibration script ships in the repository, so the figure is reproducible rather than asserted.

7Absolute risk, in perspective

8Known limitations

Stated plainly: the model treats flights as the exposure unit (appropriate because risk concentrates in takeoff and landing), ignores correlations between factors, uses public aggregate data rather than per-airframe histories, and its modifiers are assumptions, not measurements. It estimates population-level rates. No model can predict an individual flight, and the absolute numbers all converge on the same conclusion above.

One gap we name explicitly, on the roadmap rather than hidden: we do not yet score arrival-airport approach and runway-safety-area risk, a proven, survivability-relevant factor (non-precision approaches carry several times the approach-accident exposure of a precision ILS). It appears only as context today.

On national oversight: the carrier’s home-regulator status is now partially folded in. A state on FAA IASA Category 2 (below ICAO oversight standard) carries a bounded penalty (see §2.1 and §2.5). The finer-grained ICAO USOAP effective-implementation score is still on the roadmap; it needs live, sourced data. Within a set of internationally-audited carriers the signal moves little, but on a mixed route it is among the most discriminating public signals.

9What we refuse to do

We do not publish numbers we cannot source. In our June 2026 audit we removed per-airport “incident rates” and average-crosswind figures that could not be verified, and we labeled every estimate as an estimate. When a panel has no real data behind it, it says so. The gap is the honest answer.

Safety scores summarize public records; they are context, not predictions. No tool can predict an individual flight, and anyone claiming otherwise is selling something.

10Primary sources: FAA and NTSB feeds, and why counts are not scores

Beyond press coverage, flight pages carry a regulatory wire built straight from government databases. FAA Airworthiness Directives stream live from the Federal Register API. NTSB accident and incident records sync nightly from the NTSB's public CAROL export, filtered to the airline-jet types we cover, minor events deliberately included, because patterns matter more than headlines. FAA Service Difficulty Reports (the maintenance defect filings US operators must submit) are aggregated weekly into per-type counts, top affected systems, and raw excerpts.

None of these live counts feed the safety score, and that is a deliberate statistical decision, not an oversight. Three reasons. Exposure: a raw count means nothing without dividing by flights flown, and mixing sources with different denominators manufactures false precision. Reporting culture: a carrier that files many SDRs usually runs a healthier maintenance organization than one that files few, so scoring raw counts would punish honesty, the exact opposite of what this site stands for. Double counting: engine-related directives are already priced into the score through the engine service-history class, so re-counting them as “regulatory pressure” would charge the same risk twice.

So the wire is evidence, not arithmetic: read it, click through to the originals, and weigh it alongside the score. As our fleet-size data matures we may publish properly normalized rates (events per aircraft-year, with intervals). When we do, the math lands on this page first.

11How often things update

Whistleblower and regulatory report listings carry their last-review date right in the interface.

12Crew & pilots

Pilots are one of the largest factors in flight safety, so the honest question is how much of it we can actually measure. Per-airline pilot statistics (average hours, age, training recency) are not published in any consistent, comparable form, and licensing minimums (an airline-transport-pilot certificate runs on the order of 1,500 hours) are set by regulators, so the floor barely differs between major carriers. We do not invent a “pilot score” from numbers that do not exist.

Instead, crew quality enters the model where it is genuinely observable. First, IOSA registration (already a factor in the operator rate, §2) audits an airline’s flight-crew training, checking, and safety-management systems; registry carriers run several times lower accident rates, so a weaker training culture shows up as a worse rate, not as a guess. Second, the accident record itself: crew performance is where most preventable accidents are decided, so that history is carried in an airline’s fatal-accident recency, which the continuous operator rate weights directly.

What remains, the regulatory training and duty-time standards a crew must meet, we show as context, the same way we treat time of day (§6): real and worth knowing, but not turned into a per-airline multiplier we cannot source. If a crew-quality difference is real, it is already in the record and the audit; if it is in neither, we do not have the data to claim it.

13Who this is for

ihateflying exists for nervous flyers. The product decision behind every page: anxiety shrinks when the unknown becomes known. So we show the actual record: usually reassuring, occasionally uncomfortable, always sourced.

Questions, corrections, or a dataset we should add? Tell us. The site improves fastest when users point at what's missing.