How modern air travel, with its complicated logistics and complex technology, remains one of the safest modes of transportation is a mystery to most people.
So when Ben Cosgrove, Boeing's widely admired, sometimes-imperious top commercial-airplane engineer, explains it to outsiders, he uses a simplistic analogy.
Cosgrove tells aviation neophytes that traveling by air is statistically safe because aircraft manufacturers, the airlines and the Federal Aviation Administration work together, like three equal legs of a sturdy milkstool, to keep it that way.
What he doesn't tell them, safety experts say, is that aviation history is replete with calamities that underscore how two of the legs - the profit-driven manufacturers and airlines - have come to dominate and skew the thinking of the FAA, the leg charged with establishing and enforcing public-safety standards.
And now, with Boeing and the FAA refusing to shed much light publicly on troublesome safety questions raised by the crash of a state-of-the-art, nearly new Lauda Air 767-300ER twinjet in Thailand last May, there is a growing sense of deja vu among aviation-safety experts.
Several major crashes of McDonnell Douglas DC-10 jetliners in the '70s and '80s, and the tearing off of a cargo door on a United Airlines 747, which sucked nine passengers to their deaths two years ago near Hawaii, trace back to similar earlier incidents that the FAA was aware of but moved slowly to address, safety experts say.
"We know commercial-aviation safety has a superlative record, but we also know that when a failure exists, the government and the industry historically have been unwilling to read the tea leaves and get serious about doing the obvious things to solve the problem," said Richard Livingston, president of the Airline Passenger Association of North America.
Once again, the experts say, the industry and the FAA appear to be ponderously grappling with a rapidly emerging safety concern - completely outside of the public eye.
Once again, they say, the manufacturer and the airlines appear to be dictating the ground rules, with self-serving economic and legal considerations at least partly factored into decisions about how much risk the public should prudently be exposed to.
"The FAA has been criticized by a lot of people for a long time for being essentially a public relations tool for the industry, instead of an effective consumer-protection advocate," said Robert Besco, a Dallas-based aviation-safety consultant and former airline pilot who has been critical of the FAA.
This basic weakness of the U.S. aviation system is no secret. It is the subject of several books and numerous government white papers and congressional probes, which paint the FAA as a plodding, highly politicized bureaucracy hamstrung by a conflicting dual mandate to both foster aviation safety and promote commercial aviation.
The agency's actions thus far in the Lauda case, including an open feud with the National Transportation Safety Board, have done little to quiet its critics.
And now a major question is brewing about whether a dangerously flawed part, unveiled as part of the investigation into the Lauda crash, may be posing a hazard to millions of people flying every day on more than 1,600 newer Boeing jetliners.
Case in point: Boeing and FAA officials, to date, have said very little publicly about a revelation a few weeks ago that the central suspect in the Lauda crash - an electronically controlled thrust reverser with a flawed valve - is "common to" most late-model 747s, 757s, 737s and 767s.
The Lauda crash occurred after the plane's left-side thrust reverser - designed by Boeing to remain safely tucked away during flight - inexplicably deployed as the jet was climbing under high power away from Bangkok.
A thrust reverser works by diverting jet thrust in a forward direction through an opening in the engine cowling. It is designed to be used only on the ground to augment the wheel brakes.
Investigators are looking into the possibility that the deployed reverser may have flipped the Lauda plane into an uncontrollable crash dive. All 223 passengers and crew on board were killed.
Although an official cause of the accident has yet to be determined, Boeing discovered in lab tests that a safety device designed to restow the reversers, should they become unlocked in flight, relies on a flawed valve.
Boeing engineers placed a deteriorated O-ring seal on the valve and discovered that bits of the seal could work into the hydraulic lines and contaminate the valve in such way as to misalign it and cause it to deploy the reversers when the computer was actually commanding it to automatically restow and relock the reversers.
An NTSB source says Boeing is now running other tests to determine if a stray electrical signal, vibration or some other phenomenon could similarly misalign the valve, which the company had billed as a fail-safe replacement for an older-generation valve that uses more mechanical parts.
In earlier Boeing aircraft, the valve was physically prevented from becoming misaligned in flight by a mechanical part. But newer Boeing jets use lightweight electronic systems in which movement of the valve is controlled entirely by computer signals, sources said.
Moreover, there were other problems discovered with electronic reversers on 767s inspected after the Lauda crash, including chafed wires and out-of-adjustment auto-restow sensors, which tell the computer when to activate the flawed auto-restow valve.
In a brief message sent to airlines around the world two weeks ago, Boeing indicated that most of the jetliners that have rolled off the factory floor in Everett and Renton the past few years have electronically controlled reversers "common to" the system used on the Lauda aircraft.
The company indicated it may ask airlines to inspect the reversers on these models, which include: all 747-400s, 757s, 737-300s, 737-400s and 737-500s, as well as 747-200s and 747-300s powered by General Electric CF6-80C2 engines.
"It looks to me like, at some point a few years ago, Boeing bought the idea that electronically controlled auto restow was a terrific concept and began putting it on all their planes," said a source close to the Lauda investigation.
Officials at Boeing and the FAA decline to elaborate beyond the brief message Boeing sent to airlines two weeks ago.
Boeing refers all questions to the FAA. The agency's spokesman, Dave Duff, says it is "inappropriate to discuss manufacturers' systems in detail."
The agency's top safety official, Leroy Keith, who is based in Seattle, continues to decline repeated requests from The Times for an interview.
Duff's response to questions about wider safety implications is: "If the FAA has any evidence that there is a problem, we will take appropriate action."
The most recent action taken by the FAA - after weeks of prodding by the NTSB - was to ban use of reversers on 767s with electronic reversers. Initially, that emergency order covered 168 jets, nearly half the 767 fleet.
But later, at Boeing's urging, the FAA scaled back the order to the 82 jets that, like the Lauda plane, have electronic reversers actuated by pressurized oil. Eighty-six planes with electronic reversers were permitted to reactivate the systems because they use pressurized air, not oil.
However, this reasoning side steps the issue of the flawed auto-restow valve lacking any mechanical lockout feature and possibly becoming misaligned in a variety of ways, regardless of whether air or oil is used to move parts, safety experts said.
Yet Boeing apparently persuaded the FAA that the fewer planes banned from using reversers the better, since not having reversers makes landings trickier on wet or snowy runways, sources said.
"On 767s, the thrust reversers are extremely significant when it comes to slowing the airplane down quickly," said Jimmy Powers, a 767 pilot and spokesman for Aviation Safety Institute, a watchdog group. "If you don't have 'em, it puts a big burden on the brakes; on wet runways, you don't know where you're going to stop."
Another consideration would have been that the airlines likely would have to limit cargo and passenger loads on some flights, cutting into revenues, as well as face increased maintenance expenses because of wear and tear on expensive wheel brakes, sources said.
This tendency to be swayed by the industry, and to let broad concerns go unaddressed while focusing on narrow and incremental improvements, is typical of the FAA, said passenger safety advocate Livingston, a former FAA official himself for 31 years.
The agency has a legacy of rejecting, delaying and watering down sensible proposals that could broadly improve the margin of safety for passengers, Livingston said.
One vivid example is the case of dangerously exposed hydraulic lines on DC-10 tri-jets, a weakness revealed soon after the aircraft entered commercial service in the early 1970s.
After scores of non-fatal incidents and two major disasters in which severed hydraulic lines played a significant role, safety advocates went to court to force the FAA to ground DC-10s until the plane's hydraulic system was made safer.
The disasters were the 1975 crash of a Turkish Airlines jet near Paris and the 1979 crash of an American Airlines plane in Chicago. Nearly 700 died in those two crashes.
Although some improvements were made, the FAA steadfastly refused to order McDonnell Douglas to either improve shielding of the hydraulic lines or install a mundane safety device, called a cut-off valve, on the lines, said Livingston.
Years later, McDonnell Douglas finally agreed that a cut-off valve was a good idea and began installing them on DC-10s. This was in late 1989 - a few months after all three hydraulic systems were severed by an engine breakup on a United Airlines DC-10.
The pilot, Al Haynes of Seattle, managed to nurse the jet, using engine power, to a cartwheeling crash-landing in Sioux City, Iowa. Miraculously, more than half the 296 on board survived.
"If that plane had had cut-off valves, the pilot would have been in fat city, relatively speaking, because chances are he would have had at least one hydraulic system left to help him control the aircraft," Livingston said. "There's a good chance everybody would have survived. . . . If I had any relatives who died in Sioux City, I would be outraged at the FAA."