Dayton, Ohio Correspondent — The MAX showed gaps in how new systems were certified and in how internal schedule pressure was managed. Those are two different failures and the second one is the one my profession recognizes.
I’ve worked under a launch date. Everybody has. What keeps a launch date from killing somebody is a person in the room whose job survives saying no, and the certification structure had quietly stopped guaranteeing that person existed.
Tighter oversight of critical software and human-factors assumptions, stronger whistleblower protection, clearer accountability for certification decisions. Not a return to adversarial slow-motion review of every design change.
Owatonna, Minnesota Correspondent — Targeted strengthening of certification for new flight-control systems, and better separation between manufacturer and regulator incentives.
Broad slowdowns across every program would raise costs and delay safety improvements elsewhere, which is a real cost that never appears in the accounting because the accident that didn’t happen doesn’t generate a hearing.
Orange County, California Correspondent — Concentrate the additional scrutiny on novel automated systems and on the assumptions behind them. Keep the rest of the process moving.
I’d point out the commercial mechanics, since they explain the pressure. This aircraft existed on a schedule set by a competitor’s launch, and the training-cost promise made to customers was itself a design constraint. Once you’ve told an airline the type won’t require simulator time, you’ve narrowed what your engineers are allowed to do.
That’s not a certification problem. That’s a governance problem that arrived at certification.
Sheffield, Jamaica Correspondent — Tighter independent review of novel flight-control systems and clearer accountability for certification decisions can raise safety without turning every program into a multi-year ordeal.
I would raise a point that has not been much discussed in the American coverage. Both losses occurred outside the United States, and for a period the American regulator continued to certify the aircraft as safe after others had grounded it. Whatever the technical merits of that decision, it was noticed everywhere.
Regulatory authority rests on a presumption that the certifying body is not also representing the manufacturer’s country. That presumption took real damage, and rebuilding it is part of the task.
Knoxville, Tennessee Correspondent — I don’t design aircraft. I do live with inspection culture.
When a system can fail twice the same way and the paperwork still reads like a partnership, you don’t have enough independence in the room.
The answer isn’t a five-year delay on every rivet. The answer is a regulator that can say no to a delegated process that got comfortable. Put the safety-critical software and the assumptions behind it under eyes that don’t share the production bonus. Put clocks on the reviews that aren’t safety-critical. Those are two separate stacks and mixing them gets you either another accident or a fleet that never updates.
Tyler, Texas Correspondent — People in my counties fly the same single-aisle whether they care about Boeing or not. They want the airplane to be dull. Dull is the compliment.
After two losses you don’t restore dull by adding a thousand pages nobody reads. You restore it by ending the fiction that the builder grades its own exam on the parts that kill.
Faster reviews on interiors and cabin changes. Slower, meaner reviews on flight-control logic and anything that can fight the pilot. Split the queue. And pay the regulator’s technical staff enough that they don’t leave for the firm they’re reviewing, which costs money, and the other cost already came due twice.
Long Island, New York Correspondent — Liability and certification are supposed to make a firm nervous. Nervous firms document. Comfortable firms assume.
Rebuild the nervousness without turning the agency into a museum of process.
Require that safety-critical assumptions be tested against how the aircraft is actually flown rather than how the submission describes it. Require that a foreign regulator’s doubts be logged as signals rather than treated as insults. And keep a clock on everything else, because excessive delay is its own safety problem — old fleets, parts shortages, training that never updates.
Two risks. Manage both. Pretending there’s only one is how the last mistake got made.
Cheyenne, Wyoming Correspondent — Two crashes aren’t a public relations event.
Separate the life-critical systems from the rest. Inspect the first like it can kill you. Move the second on a clock.
Don’t hire a new building. Make the old building refuse the comfortable grade.
