Human Factors and the SHELL Model

Human factors (HF) is the study of people as part of the aviation system. It asks what pilots, controllers, engineers and cabin crew can and cannot do, and how well the aircraft, procedures, working environment and organisation fit them. Its goal is not to blame people for errors but to design the system so that errors are less likely, easier to catch and less harmful.

The subject matters because people are both the strength and the weak point of the system. The crew is the most valuable and flexible component, able to cope with situations no designer foresaw, but human performance also has limits and varies from day to day. About 70 per cent of aviation accidents are commonly attributed to human error, a figure that has driven much of the work on training, procedures and automation. ICAO has required human factors knowledge for professional pilot licences since 1989, and EASA teaches it as Human Performance and Limitations. The FAA covers the same ground in its aeromedical and aeronautical decision-making material.

What human factors is

ICAO's first Human Factors Digest, published in 1989, describes the field as the study of people in their living and working situations. It covers their relationship with machines, procedures and the environment around them, and their relationships with other people. It gives the discipline twin objectives: safety and efficiency. Human factors draws on psychology, physiology, medicine and engineering, and applies them to the design of aircraft and procedures, to selection and training, and to the organisations in which people work.

Human factors is sometimes confused with human error. Error is one of its concerns, but the field looks further: at why an error was likely, what would have caught it, and how the design of equipment, documents and rosters affects performance long before anything goes wrong. The SHELL model described below, threat and error management, crew resource management and Reason's Swiss cheese model of accident causation are different lenses on the same problem.

Human performance and limitations

Human Performance and Limitations (HPL) is the part of human factors that every pilot studies for a licence. It covers:

• Aviation physiology. The atmosphere and respiration, hypoxia, the effects of pressure change such as barotrauma and decompression sickness, vision, hearing, balance and spatial disorientation, and acceleration.
• Health and fitness. Diet, alcohol and drugs, medication and incapacitation.
• Aviation psychology. Information processing, memory and attention, error, decision-making, stress, fatigue, workload and communication.

At the centre of it all is the central nervous system (CNS), the brain and spinal cord. It is served by the peripheral nervous system, the sensory and motor nerves, and works alongside the autonomic nervous system, which controls involuntary functions such as heart rate, breathing and sweating and triggers the stress response. Nerve impulses travel electrochemically: electrically along the nerve cells and chemically across the synapses between them.

The CNS sets hard limits on performance. A simple reaction, such as pressing a button when a light comes on, takes about 0.2 seconds. Anything that needs a decision takes longer, because every choice loads a central decision-maker of limited capacity. Reflexes are faster because the signal loops through the spinal cord without waiting for the brain. Even on simple, repetitive tasks people typically make about one error in a hundred attempts. Practice improves this greatly, while stress, fatigue and low morale make it worse.

The SHELL model

The SHELL model is a conceptual model of the aviation system. It was first developed by Elwyn Edwards in 1972, and Frank Hawkins produced a modified diagram of it in 1975, the form now familiar from ICAO material, where it is written SHEL. Its name comes from the initials of its components:

• S, Software: procedures, checklists, manuals, charts and maps, symbology and computer programs.
• H, Hardware: the aircraft and its equipment, including controls, displays, seats and switches.
• E, Environment: the conditions inside and outside the flight deck, from noise, heat and lighting to weather, traffic and the organisational and economic setting.
• L, Liveware: the person at the centre of the model, typically the pilot.
• L, Liveware: the other people the central person works with, such as the other pilot, cabin crew, controllers and engineers.

Hawkins drew the components as blocks with irregular edges, fitted around the central Liveware block. The edges show that the components do not match automatically: each must be matched to the human, whose basic characteristics cannot be redesigned. Errors and accidents tend to arise at the interfaces, where a component does not fit the person using it. The model directs the investigator, designer or trainer to the interface to find the mismatch, rather than stopping at "pilot error".

View full schematic

Liveware-hardware interface

The Liveware-hardware (L-H) interface is the relationship between people and the physical equipment they use, the traditional territory of ergonomics. It covers the design of seats to fit the body, controls that move in the expected direction and can be told apart by shape and position, and displays that can be read quickly and correctly. For an instrument, that means considering its position relative to the pilot, the design of its scale, its lighting and colour coding, the viewing angle, the time needed to take in the information and the risk of misreading it at a glance.

A classic mismatch comes from the UK Confidential Human Factors Incident Reporting Programme (CHIRP). On some Fokker F27s, the switches for water-methanol injection and pitot heat were in each other's positions compared with the rest of the fleet. A first officer selected water-methanol instead of pitot heat during the after-start checks, and the error came to light only when the captain heard the water-methanol cut in on take-off. Standardising the layout across the fleet removes that trap.

Automation adds a newer layer to the L-H interface, because the pilot must understand what the systems are doing as well as operate the controls. EASA describes its design philosophy for avionics and automation in three principles: the system should help detect crew errors, tolerate them without dangerous consequences, and support recovery from them.

Liveware-software interface

The Liveware-software (L-S) interface is the relationship between people and the non-physical parts of the system: procedures, checklists, manuals, charts, symbology and the logic of computer programs. Reading a checklist, interpreting an approach chart or programming a flight management system are all L-S tasks.

Mismatches arise when information is easy to misread or misinterpret: an ambiguous checklist layout, a cluttered chart, an abbreviation used in two senses, or a computer mode whose behaviour is not what the pilot expects. Errors here can also lie dormant. In the 1979 Air New Zealand DC-10 accident on Mount Erebus, an error in the navigation data entered on the ground went unnoticed until it took the aircraft towards the mountain in poor visibility.

Standard operating procedures (SOPs) are the main defence at this interface. When strictly followed they turn routine tasks into habits that need less attention, and they give both pilots the same expectations. Their limitation is that no set of procedures can cover every situation.

Liveware-environment interface

The Liveware-environment (L-E) interface is where the person meets the conditions in which the work is done. Inside the aircraft that means noise, vibration, temperature, humidity, lighting, cabin altitude and acceleration. Outside it means weather, terrain, darkness and time zones. In the wider sense used in ICAO material, it also includes the political, economic and organisational constraints under which the aviation system operates.

Much of the environment cannot be changed, so the system adapts the person to it or shields the person from it. Pressurisation, air conditioning, oxygen equipment, noise-attenuating headsets and sunglasses protect against the physical environment. Flight time limitations and fatigue management address the effect of duty hours and the body clock.

Liveware-liveware interface

The Liveware-liveware (L-L) interface is the relationship between the central person and the other people in the system: the other pilot, the cabin crew, controllers, engineers, dispatchers and management. It covers leadership, teamwork, communication, personality and the balance of authority on the flight deck. Hawkins observed that selection, training and checking can ensure that a pilot is able to perform well, but motivation decides whether the pilot actually does so.

Many accidents of the 1970s happened to serviceable aircraft whose crews failed to share what they knew, and crew resource management grew out of this interface. Briefings, standard phraseology, cross-checking and graded assertiveness are its practical tools.

ICAO human factors guidance

ICAO's human factors programme dates from the late 1980s. Amendment 159 to Annex 1, Personnel Licensing, which came into force on 16 November 1989, made human factors knowledge a requirement for professional pilot licences. ICAO then published a series of Human Factors Digests, beginning with Digest No. 1 on fundamental human factors concepts in 1989, which presented the SHELL model. Much of this material was later brought together in the Human Factors Training Manual (Doc 9683), first published in 1998.

The same thinking runs through later ICAO work on threat and error management, line operations safety audits and safety management systems. In Europe, Human Performance and Limitations is a theoretical knowledge subject for every pilot licence, and commercial operators must give their crews CRM training. In the United States, the FAA covers the subject in the aeromedical and decision-making chapters of its Pilot's Handbook of Aeronautical Knowledge and in its CRM advisory circular.

Library articles are written for study and exam preparation. They do not replace your aircraft's approved documentation, your operator's procedures or the regulations themselves.