Dear Subscribers,
After ten years of continuous engagement at Sita Air—serving proudly as Senior General Manager, CEO, and Accountable Manager—I am sharing that by the end of this June, I will be stepping down from my executive role.
Leading a domestic airline through the complex, unforgiving terrain of aviation has been the privilege of a lifetime.
While my daily operational duties in the corner office are drawing to a close, my lifelong commitment toward aviation safety remains entirely unchanged. In fact, this transition marks an acceleration.
By stepping away from the demands of day-to-day airline management, I am dedicating my focus entirely to training, writing, and developing tools to advance systemic resilience and human performance across our industry.
The Safety Layer is expanding, and I am honored to have you on this journey with me. To kick off this new chapter, let’s confront a profound shift that is quietly redefining how accidents actually happen.
Accidents are rarely born from rule-breaking—they are born from silence.
The Distance Between Us: Why Modern Systems Fail, and the Radical Cure of Listening
On an unseasonably warm afternoon, an aircraft descends toward a challenging runway. Inside the cockpit, a subtle but dangerous deviation is taking place. The first officer sees it. He feels it in the sudden, slight drop of his stomach. But he looks across the pedestal at the captain—a veteran with thousands of hours, a formidable figure of absolute authority—and he says nothing. Or worse—he says it too softly to be heard.
Moments later, the system fails. The aircraft suffers a catastrophic runway excursion.
In the aftermath, the regulatory machinery roars to life. Investigators comb through the wreckage, extract the black boxes, and point to a familiar, comforting culprit: Human Error. The prescriptive remedy is swift and predictable: write a stricter Standard Operating Procedure (SOP), mandate a new checklist, and penalize the survivor.
But what if we’ve been solving the wrong problem all along?
What if the crash didn’t happen because a pilot deviated from a rule, but because the system itself had grown deaf to its own frontline reality?
"Organization’s that can't hear themselves," Hummerdal writes, "can't improve themselves." in his book An Invitation to Safety Conversations.
The Illusion of Control: From Safety-I to Safety-II
For decades, industrial safety has been dominated by what theorists call "Safety-I"—a philosophy that views human beings as the weakest link in the chain. In this view, safety is defined by a negative: the absence of incidents. To achieve it, management must restrict human variability through an endless bureaucracy of rules.
The problem, as Hummerdal reveals, is that this creates an immense chasm between Work-as-Imagined (how executives write manuals in pristine corporate offices) and Work-as-Done (how mechanics, pilots, and controllers dynamically adapt to missing tools, shifting weather, and severe time constraints).
When a system manages this distance purely through top-down control, it inadvertently triggers a chilling effect. Frontline workers stop reporting minor anomalies, undocumented workarounds, and everyday operational drift. They do this not out of malice, but out of basic self-preservation.
When compliance is the only metric of success, honesty becomes a liability.
Gradually, the organization loses its ability to have real conversations. The weak signals that precede a catastrophe stay buried at the bottom of the hierarchy until it is too late.
"When distance grows between leadership and the frontline, weak signals die. Not because people don't care, but because connection and conversation have been replaced by compliance theater."
The Pilot Turned Psychologist
Hummerdal’s insights carry a unique, pragmatic authority. Having spent years in the cockpit, he knows firsthand that when a system encounters unexpected variability, it is human adaptability—not a rigid binder of rules—that saves the day.
As a prominent voice in the "Safety Differently" movement alongside systemic thinkers like Sidney Dekker and Todd Conklin, Hummerdal has spent fifteen years embedded in mining, utilities, and aviation.
His diagnosis is clear: accidents do not happen because workers fail the system.
Accidents happen because the system fails to provide its workers with the capacity to absorb unexpected shocks.
To bridge this divide, Hummerdal introduces a practical framework designed to dismantle the steep authority gradients that silence the frontline. He argues that safety cannot be policed into existence; it must be conversed into existence.
Six Tools for Systemic Hearing
An Invitation to Safety Conversations provides a blueprint for operational leaders to build what Hummerdal calls a "host leadership" model. Instead of auditing the frontline, leaders must facilitate six distinct types of dialogue:
Connection Conversations: Rebuilding basic human trust between management and operations so workers feel safe enough to speak honestly.
Learning Conversations: Moving away from "who did it" to "what happened," using operational learning teams to map out the messy reality of daily tasks.
Appreciative Conversations: Analyzing why things go right 99% of the time, rather than only paying attention when something breaks.
Possibility Conversations: Jointly brainstorming system redesigns with the people who actually use the tools.
Accountability Conversations: Redefining accountability not as punishment, but as a shared responsibility to share lessons learned.
Restorative Conversations: Healing organizational trust after an incident, ensuring that psychological safety is restored rather than destroyed.
The Way Forward for The Safety Layer
As we look at the future of aviation and high-risk industries, the lesson of Hummerdal’s work is vital. As technological systems become increasingly complex, our reliance on human-to-human communication becomes more, not less, critical.
We must have the courage to move past the comforting illusion of zero-error checklists. True systemic resilience requires us to lower our defenses, step out from behind the barrier of corporate prose, and sit down at the table for a real conversation.
The next time an incident occurs in your operation, do not ask which rule was broken. Ask your frontline where the system pinched them, what made the safe path difficult, and what would make it easier to succeed.
Listen carefully.
Because the moment your system goes quiet… is the moment risk takes control.
What are your thoughts on this shift from compliance to conversation?
Have you noticed a gap between "Work-as-Imagined" and "Work-as-Done" in your own operations?
Drop your insights in the comments section below—let’s start a real dialogue right here on The Safety Layer.