By Austin VornhagenYou just landed, and nothing happened.
No bang. No lurch. No captain on the intercom sounding a little too calm. The wheels found a painted stripe in the rain and the airplane slowed down. You probably didn’t look up from your phone.
That boring landing is one of the most elaborate things people have ever built. Somebody assembled the airplane and somebody else checked the work. A meteorologist in a room you will never see decided where the storms would be. A controller with a scope full of other airplanes lined you up for the approach. Equipment that in some places has been in service for decades tracked you the whole way. And the runway was empty because a web of lights, rules, and people made sure it was.
Lately a lot of people have started to wonder whether that web is coming apart. You’ve probably seen the comment under some video of a near miss: deregulation broke flying, and it’s only a matter of time.
It’s a reasonable fear pinned to the wrong cause. And the usual comeback, “flying is still the safest way to travel,” is true while quietly dodging the question. Both sides are staring at the same gauge: how many planes crashed. That is the one gauge that can’t answer what they’re arguing about.
Crashes are the last number to move. By the time it moves, the story is already over.
So set aside “is flying safe?” For now the answer is still broadly yes. The useful question is harder: are the walls that keep it safe being repaired faster than they’re cracking?
Deregulation didn’t deregulate safety
The Airline Deregulation Act of 1978 is the villain of a thousand comment threads, so it’s worth knowing what it actually did. It ended federal control over fares, routes, and which airlines could enter which markets. It did not touch the rules for how airplanes are designed, built, maintained, or flown. The FAA kept regulating all of that.
What deregulation did change was the workload. Cheaper tickets and new airlines meant far more flying, and every one of those flights still had to be certified, inspected, and kept apart from every other flight. The rules stayed. The amount of work the rules demanded exploded.
The real story is older and much quieter. It’s about who does the checking.
Since at least 1927, federal aviation agencies have relied on private individuals to examine, test, and inspect aircraft on the government’s behalf. There was never going to be a federal engineer standing over every rivet. Over the decades those “designees” multiplied, and in 2005 the FAA folded the company-level versions into one program: Organization Designation Authorization, or ODA. Under it, approved employees inside a manufacturer do certification work on the FAA’s behalf. GAO has reported that designees perform more than 90 percent of the FAA’s certification activities.
That sounds alarming. It isn’t crazy. Think of a teacher with 400 students who lets the best ones grade the homework, then spends their own time on the hardest problems and the spot checks. It works well, right up until the student graders are also being graded on how fast the homework gets turned in.
That was the worry from the start. In 2004, before ODA even launched, GAO was already warning that the FAA’s oversight of its designees was inconsistent. The question underneath has never gone away: who watches the people doing the regulator’s job, when their paycheck comes from the company that wants the airplane out the door?
Follow one piece of paper and you can watch that question play out.
Who gets to sign for the airplane, from 1978 to 2026
Prices go free. Safety rules don’t.
Airlines can now set fares and pick routes. The standards for airplanes, pilots, and maintenance stay exactly where they were. What grows is the volume of flying those standards have to cover.
The checking moves inside the company
Designees have been part of the system for close to a century. In 2005 the ODA program standardizes it at the company level. By GAO’s count, designees end up performing more than 90% of certification activities.
346 people
The FAA certified the 737 MAX 8 in 2017. Lion Air Flight 610 crashed in October 2018; Ethiopian Airlines Flight 302 in March 2019. The investigations reached past one flawed flight-control system into how hazards were assessed, what pilots were told, and how independent the company’s designees really were. The fleet was grounded, and the FAA stopped letting Boeing issue airworthiness certificates for new MAX airplanes.
Congress rewrites the rules
The Aircraft Certification, Safety, and Accountability Act tightens certification and adds protections meant to let company designees talk to the FAA without their employer in the way. In 2022 the FAA also takes back sign-off on new 787s, over production quality problems.
Four bolts that were never put back
A door plug blows out of an Alaska Airlines 737 MAX 9 at about 16,000 feet. Nobody dies; the two seats beside it happened to be empty. The NTSB traces it to four bolts removed in the factory and never reinstalled, and finds that because the work wasn’t documented, no quality inspection of that closure ever happened. The FAA grounds 171 MAX 9s and caps MAX production.
Two signers, one factory
The FAA proposes $3.1 million in penalties, including over a Boeing employee who pressured a designee to sign off on a MAX that the designee found didn’t meet standards. Then it runs a clever test: Boeing and the FAA issue certificates on alternating weeks. If Boeing’s weeks look worse, everyone will see it.
Trust, re-earned with data
After eight months the FAA reports comparable quality findings in both groups, and on July 20, 2026 lets Boeing resume certificates for all new 737 MAX and 787 airplanes, while inspectors keep auditing the line. When the MAX 7 is certified in August, the FAA says it performed or directly reviewed the flight-control, human-factors, and system-safety work itself.
Notice the shape of that story. It isn’t “regulation went away.” It’s a pendulum of trust: hand off the checking, find out the hard way where it failed, pull it back, then hand it off again only when the data earns it. The last swing is the encouraging one. It is also one wall out of several.
02 How safety actually worksEvery wall has holes. That’s the design.
In 1990 the psychologist James Reason offered a picture of how accidents happen in complicated systems that stuck so well it now has a nickname: the Swiss cheese model.
Imagine each defense as a slice of cheese. Every slice has holes: a tired mechanic, a missed step, an old radar, a controller juggling too much traffic. No slice is perfect and none is expected to be. Safety comes from stacking them. A hazard only becomes an accident when the holes in every slice line up at the same moment.
Here are the six walls this essay grades, in the order a flight meets them, plus one more you don’t want to need.
The Swiss cheese model applied to six walls of aviation safety
Most hazards hit cheese
A mis-drilled part, a sloppy torque, a forecast that’s a little late. The overwhelming majority of problems die in the first wall they touch, and nobody outside the building ever hears about them.
One hole is not an accident
Sometimes a problem slips through a hole in one wall. The next wall catches it. An inspector finds it, a check flags it, a second set of eyes asks a question. The system worked, and it looks exactly like nothing happened.
Two walls failed. Luck didn’t.
The missing bolts went straight through the build wall and the oversight wall: no record of the work meant no inspection. Weather, controllers, equipment, and runway were never in its path. What held was the last line: the plug let go at about 16,000 feet rather than at cruise, and the seats next to it were empty.
When the holes line up
On January 29, 2025, an Army helicopter and a regional jet collided near Washington, D.C. All 67 people aboard died. The NTSB’s final report named holes in several walls at once: a helicopter route the FAA had placed close to an approach path and failed to re-evaluate despite the data, a controller who lost situational awareness under high workload, and, in the last line, the helicopter crew and the Army’s training on altimeter error.
Holes can grow without a sound
Now picture three walls whose holes get wider: fewer forecasters, stretched controllers, older equipment. On most days the next wall still catches everything. Nothing crashes, and no headline gets written. But the chance that the holes line up has gone up, and not by a little.
Three slightly worse walls aren’t slightly worse
Here is where intuition goes wrong. Most of us picture risk as a sum: three walls got a bit weaker, so the system got a bit weaker. But a hazard has to get through every wall, and the chances of getting through multiply.
Suppose each wall lets 1 in 10 hazards through. The chance one slips past all six is a tenth of a tenth of a tenth, six times over: one in a million. Now crack a wall so it lets 2 in 10 through. Tap the walls below and watch what happens to the bottom line.
Every wall healthy. This is the baseline.
An illustration of the arithmetic, not real accident probabilities. Real walls aren’t fully independent, which is part of the point: one understaffed night can weaken several at once.
Crack the three red walls and the odds get eight times worse, even though each wall only got “a little” worse. That’s why a scorecard matters more than a crash count. The walls can deteriorate a lot before the bottom line shows anything, because the bottom line is so tiny to begin with.
It also cuts the other way, which is the hopeful part. Add a genuinely new wall and the odds improve tenfold. Keep that in mind for the end.
Six walls, graded, September 2026
Air traffic controllers have long tracked each airplane on a paper flight strip, slid into a rack in the order the flights will reach them. Here is each wall on its own strip. Each one gets three marks: how damaged it is now, which way it’s heading, and the only question that really matters, is the repair fast enough? Tap a strip for the evidence.
4CTRLController staffingNow: understaffed · Trend: improvingDelayed
At the end of fiscal 2025 the FAA had 13,164 controllers, about 6% fewer than in 2015, while flights using the system grew about 10% between 2015 and 2024. Budget lapses in the 2010s and the pandemic cut hiring and pushed people out. A 2023 Inspector General audit found 20 of 26 critical facilities staffed below the FAA’s own 85% threshold.
Hiring has risen every year since 2021. As of April 2026 the FAA counted about 11,000 fully certified controllers and 4,000 in training, and plans to hire 2,200 this year. But certification takes up to two years, and the target itself moved: the new plan calls for 12,563 certified controllers, down from the 14,633 the FAA forecast it needed in 2024. Even against the lower bar, the gap is about 1,500 people.
Fast enough? Not yet. The pipeline is full, but we are in the middle of the arrow.
5EQPTATC equipmentNow: large legacy backlog · Trend: acceleratingDelayed
In January 2023 the failure of an aging notice system halted departures nationwide. The FAA then assessed its 138 air traffic control systems and rated 51 unsustainable and 54 more potentially unsustainable: 105 in all, about three in four. Of those, 58 have critical effects on safety and efficiency, 40 were deployed more than 30 years ago, and six more than 60 years ago.
The replacement effort is real and moving fast. But on September 14, 2026, GAO reported that the FAA’s new modernization program still lacks a reliable lifecycle cost estimate and an integrated master schedule. It is running on 11,389 separate project schedules that don’t talk to each other, and the FAA’s own phase-one figure of about $16 billion exceeds the $12.5 billion Congress provided.
Fast enough? Not demonstrably. Speed without a schedule is how big projects stall.
3WXAviation weatherNow: badly strained · Trend: no clear fixHolding
Each of the FAA’s 21 en route centers, the facilities that handle high-altitude traffic, has a small National Weather Service unit that tells controllers where the storms, ice, and turbulence will be. An FAA and Weather Service agreement set a target of 81 meteorologists. As of June 2025 there were 69, and GAO found them working overtime, avoiding leave, and reporting burnout and fatigue.
The FAA’s plan for fiscal 2026 is a new service model with even fewer, 64, leaning on technology and centralization. GAO titled its report “Urgent Actions Needed.” I could not find evidence that the gap has closed or that the new model has been shown to provide the same protection.
Fast enough? No. This is the sleeper: the wall that fails quietly until the night storms, short staffing, and heavy traffic arrive together.
6RWYRunway safetyNow: elevated concern · Trend: improved, then slippedWatch
The most dangerous close calls on the ground are the Category A and B runway incursions, where a collision was narrowly avoided. After a frightening run in 2023 there were 22 of them that fiscal year. The FAA held a safety summit, pushed new warning technology to towers, and redesigned confusing taxiways. In fiscal 2024 the count fell to nine, the lowest since 2019.
Then it bounced. An FAA Safety Team notice reported that serious incursions rose 44% in 2025, even as total incursions dipped slightly. Still well below 2023, but not the clean trend line the 2024 numbers promised.
Fast enough? Proof the playbook works: spot the pattern, fix the mechanism, measure. The rebound says it needs to keep running.
1BLDBuild qualityNow: serious past failures · Trend: measurably betterBoarding
After the door plug this strip would have been solid red. The NTSB found Boeing had failed to give factory workers adequate training, guidance, and oversight, and that the FAA’s oversight had been ineffective. The FAA grounded 171 MAX 9s, capped production, and moved inspectors into Boeing and Spirit AeroSystems plants.
What moved it to yellow is evidence, not promises: eight months of alternating-week certificates with comparable quality findings whether Boeing or the FAA signed, and a MAX 7 certification in which the FAA says it did or directly reviewed the riskiest engineering itself.
Fast enough? Tentatively yes. Not solved. A serious problem with concrete evidence of improvement, which is different.
2OVSTFAA oversight workforceNow: incomplete fixes · Trend: unclearUnproven
The people who oversee everyone else are a wall too. In 2020 GAO warned that more than half of the FAA’s safety inspectors and engineers would be eligible to retire by 2025, and recommended the agency regularly assess whether those workforces have the skills modern aircraft demand. The FAA agreed.
I could not confirm from the public record that those assessments are complete on the certification side, the office that reviews the most complex designs. And the Reagan National report is a reminder that this wall is more than factory visits: part of the probable cause was the FAA’s own failure to review a helicopter route and the data about it.
Fast enough? Not proven either way. Which, for the wall that checks all the other walls, is its own kind of yellow.
NTSB data show the fatal accident rate for U.S. airlines fell from 0.030 per 100,000 flight hours in 1983 to 2000 to 0.006 in 2001 to 2017, about one fatal accident every 16.3 million flight hours. Then came January 29, 2025, and 67 lives. One catastrophe doesn’t prove the whole system is sliding. It is a sentinel: proof the holes can still line up.
You can’t steer by a gauge that almost never moves
One fatal accident every 16 million flight hours is a triumph. It is also a terrible sensor. If crashes were your only warning light, you could go years between readings, and each reading would cost lives. So the people who run safety systems watch a chain of earlier signals instead. Climb it from the bottom.
The warning chain, from workforce capacity up to accidents
- 5Accidents
- 4Close calls
- 3Outages & errors
- 2Strain
- 1Capacity
Capacity: people and machines
How many certified controllers, forecasters, and inspectors exist, and how old the equipment is. It moves slowly, you can measure it any day you like, and it moves first. Every red wall on the scorecard lives on this rung.
Strain: overtime, fatigue, backlog
Short capacity doesn’t show up as danger. It shows up as mandatory overtime, skipped leave, training that slips a quarter. GAO’s meteorologists avoiding vacation to keep the lights on is a rung-two reading.
Slips: outages and operational errors
Strain turns into mistakes, and old equipment turns into failures. The January 2023 outage that stopped departures across the country is a rung-three reading. So is a controller losing track of traffic on a busy night.
Close calls
Losses of separation, serious runway incursions, near misses. These are the holes lining up with one wall left standing. Twenty-two serious incursions in 2023, nine in 2024, then up 44% in 2025: this is the rung where the system is supposed to learn before anyone gets hurt.
Accidents
The last indicator, and the only one on every front page. By the time this rung lights up, the four below it have usually been lit for a while.
Everyone is arguing about the top rung
“It’s getting dangerous” and “it’s still the safest way to travel” are both claims about rung five. The scorecard lives on rungs one through four, which is exactly why it can say something the crash count can’t: the bottom of the chain is lit.
What if the next door plug were impossible?
The standard fix for every problem above is “more oversight”: more inspectors in more factories, watching more closely. Necessary, and slow, and it runs straight into the same staffing wall. So here’s the more interesting question. What would it take to make aviation safe even when somebody is tired, a factory is behind schedule, and an inspector misses something?
Remember the Swiss cheese arithmetic: every genuinely independent wall you add divides the risk. Here are six candidates. Some already exist in pieces. None of them is “try harder.”
- New wall · A
Make the mistake impossible to build
Keyed parts that only fit one way, torque tools that record every fastener, fixtures that won’t close on a bad assembly, digital work instructions that won’t advance until the evidence exists. Programmers call this making bad states unrepresentable. Don’t catch the error later. Remove the path to it.
- New wall · B
Give every part a memory
A record that follows each safety-critical part: who made it, what batch, who removed it, who put it back, what the torque read. The door plug went through two walls precisely because no record existed, so no inspection was triggered. A missing entry should be as loud as a missing bolt.
- New wall · C
Inspect all the time, not now and then
Airplanes already stream data. Push further, toward a living model of each airframe that compares vibration, strain, and actuator behavior against what the design says they should be, plus drones and cameras that scan the skin the same way every time so a change stands out.
- New wall · D
Make single failures survivable
Assume something will break, then ask whether one bad sensor or one misinstalled part can still become a catastrophe. Part of the MAX story was flight-control software acting on a single angle-of-attack sensor. Independent sensors of different types, and systems that fail into a safe mode, turn one hole into a dead end.
- New wall · E
Watch the combinations, live
This aircraft is fine. These storms are fine. Tonight’s staffing is fine. Together they might not be. NASA researchers are developing what they call an In-time Aviation Safety Management System, meant to monitor, assess, and mitigate risks as they build, instead of reading about them in an accident report.
- New wall · F
Take load off the system
Every short-hop flight uses a runway slot and a controller’s attention. Fast trains tend to compete best on trips of a few hundred miles, where they skip the security line and land downtown. Move some of those trips to rails and the busiest airports get fewer movements. That’s a wall built out of subtraction.
Put A through E together and you get something bigger than any one of them. Today an airplane leaves because qualified people declared it safe. Imagine it could only leave because the system could prove it was: every critical part with a complete history, sensors inside their modeled limits, crew rest valid, weather and controller capacity inside the margin. Try it.
- Crew rest and duty timeWithin limits
- Weather on routeInside margin
- Controller capacity at arrivalAvailable
- Airframe sensors vs. modelNominal
- Parts record: left mid-exit door plugOpened on the line. No closure record on file.
Five checks stand between this airplane and the runway.
A made-up system for illustration, not a description of any real airline or FAA tool. The failure it catches is modeled on what the NTSB found in the real 2024 case: the door plug work wasn’t documented, so no inspection happened.
Inspectors don’t disappear in that world. They become the last backstop, the people who catch what the designers never imagined, instead of the main thing standing between a missing bolt and 16,000 feet.
The walls that are cracking are made of people and time
Line the six strips up and a pattern jumps out that no single one shows.
The walls that are improving, build quality and runway safety, are the ones you can fix with attention: procedures, audits, a summit, a clever alternating-week test. They respond in months.
The walls that are cracking, controllers, equipment, and weather, are made of things you can’t rush. A controller takes up to two years to certify after you hire them. A radar replacement takes a funded, scheduled program. A forecaster who burns out takes years of expertise with them. These walls respond in years, and they sit on the bottom rung of the warning chain, which means they’re lit long before anything crashes and repaired long after anyone notices.
That is the real answer to the Reddit comment. U.S. aviation doesn’t look like a system in collapse. It looks like an exceptionally safe system carrying years of workforce and equipment debt, paying it down on several fronts at once. The feedback loop that makes aviation great still works: problems get found, investigated, and fixed, and in two areas we can watch the fix land in the data. But the slow walls are behind, and the arithmetic of multiplying holes means “behind” matters more than it sounds.
Repair is underway. The evidence that it’s outrunning the backlog isn’t in yet.
Flying is safe the way a bank balance is healthy. The crash rate tells you the balance. The scorecard tells you whether you’re spending the margin faster than you’re putting it back. You can overdraw quietly for a long time before the number on the statement changes.
So the next time you land and nothing happens, don’t take it as proof that everything is fine. Take it as the product of six walls and a lot of people, most of whom you’ll never see. Nothing happening is the hardest thing in aviation to build. It is also the easiest thing to stop paying for.
This essay grew out of a long conversation with an AI that started with a Reddit comment blaming deregulation, then got checked against primary sources. Staffing figures are from GAO’s December 2025 report on the controller workforce and the FAA’s 2026 to 2028 workforce plan. Equipment figures are from GAO’s 2024 report on aging systems and its September 2026 report on the modernization program. Meteorologist figures are from GAO’s August 2025 report. Runway incursion counts are from the DOT Inspector General and an FAA Safety Team notice. The door plug and Reagan National findings are the NTSB’s. Boeing certificate history is from FAA announcements. The fatal-accident rates are from the NTSB’s study of Part 121 airline accidents. The wall grades are my own judgment from that evidence, and the multiplication tool and pushback checklist are illustrations, not real systems.
If the multiplication problem stuck with you
AI Needs Nine Dominoes to Fall
The same chain logic applied to a very different fear: a catastrophe that needs many separate links to fail, and which links we can actually hold.
Read the essay →Essay · Content PilotsThe Plant Doesn’t Remember
Another wall made of people and time: what walks out the door when a generation of water operators retires, and why it’s so hard to count.
Read the essay →Primary source · GAOThe controller workforce report
Why a decade of effort left the FAA with fewer controllers than in 2015, and what GAO says would fix the hiring pipeline.
Read the report →Primary source · FAABoeing’s certificates, earned back
The FAA’s own account of the alternating-week experiment and what oversight stays in place.
Read the announcement →
Is your business steering by the last gauge?
Most businesses find out something broke from the lagging number: the customer who never came back. I build websites for service businesses at Content Pilots, with scheduling and payments built in, so the early readings, who visited, who booked, who didn’t, are in front of you before revenue moves. And if you think I graded a wall wrong, tell me. I’ll update the strip.