How can this be? It turns out that the very factor that makes modern air travel so unpleasant for all but the superpremium customers explains—in reverse—what has made it so safe.

The grinding unpleasantness of the modern airline experience comes from its ruthless, lean efficiency. Every bit of slack has been carved out of the system. Does a member of the flight crew show up late, or cancel at the last minute because of sickness? There’s not a spare crew member waiting to fill in. Is a plane missing a part that’s on the pre-takeoff checklist? There’s no spare part, or spare plane, to be swapped as a substitute. Has fog or a thunderstorm canceled your flight? Too bad—the next available flight is not till tomorrow, because all the rest today are fully booked. And so on. These Gradgrind-style efficiencies have made the airline industry profitable (as has its consolidating into a few dominant carriers), and they’ve transferred the inconvenience of the unexpected onto its customers.

That’s the part of air travel passengers see. What they don’t see is the safety system that—even now—operates on the opposite of the leanest-possible-resources model.

For instance: You probably can’t see this from seat 23D on United or Delta, but every commercial-flight airport has its own fire station, within a few seconds’ drive of the runway. A fire crew is standing by, every time you take off or land. That’s based on What if? thinking. What if five minutes from now, a plane comes in hard, and has a post-touchdown fire, which could threaten the passengers trapped inside? What if an airplane’s engine catches fire on the runway, and a hundred passengers have to get off all at once?

Every pilot has heard the following exchange over the radio, more than once: A pilot announces an unusual circumstance—say, a need for a quick return to the departure airport after takeoff, because something’s wrong with the airplane, or a forced landing because of a mechanical problem or onboard emergency. Once the pilot explains the situation, the next words from the controller will inevitably be: “Flight XXX, cleared for landing, runway YYY. Do you require equipment?”

This last phrase means: Should the fire truck and rescue vehicles roll out to the taxiway? It’s a way of asking, What if? (I’ve personally had to ask for unusual landings half-a-dozen times over the years, but so far have always been able to reply: “Negative, no equipment necessary.”) I’m sure there are airports where the “equipment” has never been used in a real emergency, or not in many years. But it’s there and ready, every minute, because: What if?

What if? is the idea behind the certification and inspection of airplanes, and regular testing and training of pilots. At the design stage, the question is: What if the main navigation systems fail? Well, there are these backup systems. What if one engine goes out? Well, here is the other engine(s) that would keep the plane aloft. (It is obvious that a failure of What if? procedures—on the part of Boeing and the FAA and some airlines—lay behind the 737 Max disasters.) At the operators’ level every pilot, before every training or check flight, knows that most of it will involve responses to What if? What if your engine failed right now, and you had to land? What if all your electric equipment failed, right now? What if the airport where you’re about to land gets closed, right now, because the plane you’re following has a bad landing and is blocking the runway? What if, what if, what if?