SHELL model
The SHELL model is a conceptual model of human factors that clarifies the scope of aviation human factors and assists in understanding the human factor relationships between aviation system resources/environment and the human component in the aviation system.
The SHELL model was first developed by Elwyn Edwards and later modified into a 'building block' structure by Frank Hawkins. The model is named after the initial letters of its components and places emphasis on the human being and human interfaces with other components of the aviation system.
The SHELL model adopts a systems perspective that suggests the human is rarely, if ever, the sole cause of an accident. The systems perspective considers a variety of contextual and task-related factors that interact with the human operator within the aviation system to affect operator performance. As a result, the SHELL model considers both active and latent failures in the aviation system.
Description
Each component of the SHELL model represents a building block of human factors studies within aviation.The human element or worker of interest is at the centre or hub of the SHELL model that represents the modern air transportation system. The human element is the most critical and flexible component in the system, interacting directly with other system components, namely software, hardware, environment and liveware.
However, the edges of the central human component block are varied, to represent human limitations and variations in performance. Therefore, the other system component blocks must be carefully adapted and matched to this central component to accommodate human limitations and avoid stress and breakdowns in the aviation system. To accomplish this matching, the characteristics or general capabilities and limitations of this central human component must be understood.
Human characteristics
Physical size and shape
In the design of aviation workplaces and equipment, body measurements and movement are a vital factor. Differences occur according to ethnicity, age and gender for example. Design decisions must take into account the human dimensions and population percentage that the design is intended to satisfy.Human size and shape are relevant in the design and location of aircraft cabin equipment, emergency equipment, seats and furnishings as well as access and space requirements for cargo compartments.
Fuel requirements
Humans require food, water and oxygen to function effectively and deficiencies can affect performance and well-being.Input characteristics
The human senses for collecting vital task and environment-related information are subject to limitations and degradation. Human senses cannot detect the whole range of sensory information available. For example, the human eye cannot see an object at night due to low light levels. This produces implications for pilot performance during night flying. In addition to sight, other senses include sound, smell, taste and touch.Information processing
Humans have limitations in information processing capabilities that can also be influenced by other factors such as motivation and stress or high workload. Aircraft display, instrument and alerting/warning system design needs to take into account the capabilities and limitations of human information processing to prevent human error.Output characteristics
After sensing and processing information, the output involves decisions, muscular action and communication. Design considerations include aircraft control-display movement relationship, acceptable direction of movement of controls, control resistance and coding, acceptable human forces required to operate aircraft doors, hatches and cargo equipment and speech characteristics in the design of voice communication procedures.Environmental tolerances
People function effectively only within a narrow range of environmental conditions and therefore their performance and well-being is affected by physical environmental factors such as temperature, vibration, noise, g-forces and time of day as well as time zone transitions, boring/stressful working environments, heights and enclosed spaces.Components
Software
- Non-physical, intangible aspects of the aviation system that govern how the aviation system operates and how information within the system is organised.
- Software may be likened to the software that controls the operations of computer hardware.
- Software includes rules, instructions, Aviation regulations, policies, norms, laws, orders, safety procedures, standard operating procedures, customs, practices, conventions, habits, symbology, supervisor commands and computer programmes.
- Software can be included in a collection of documents such as the contents of charts, maps, publications, emergency operating manuals and procedural checklists.
Hardware
- Physical elements of the aviation system such as aircraft, operator equipment, tools, materials, buildings, vehicles, computers, conveyor belts etc.
Environment
- The context in which aircraft and aviation system resources operate, made up of physical, organisational, economic, regulatory, political and social variables that may impact on the worker/operator.
- Internal air transport environment relates to immediate work area and includes physical factors such as cabin/cockpit temperature, air pressure, humidity, noise, vibration and ambient light levels.
- External air transport environment includes the physical environment outside the immediate work area such as weather, terrain, congested airspace and physical facilities and infrastructure including airports as well as broad organisational, economic, regulatory, political and social factors.
Liveware
- Human element or people in the aviation system. For example, flight crew personnel who operate aircraft, cabin crew, ground crew, management and administration personnel.
- The liveware component considers human performance, capabilities and limitations.
According to the SHELL model, a mismatch at the interface of the blocks/components where energy and information is interchanged can be a source of human error or system vulnerability that can lead to system failure in the form of an incident/accident. Aviation disasters tend to be characterised by mismatches at interfaces between system components, rather than catastrophic failures of individual components.
Interfaces
Liveware-Software (L-S)
- Interaction between human operator and non-physical supporting systems in the workplace.
- Involves designing software to match the general characteristics of human users and ensuring that the software is capable of being implemented with ease.
- During training, flight crew members incorporate much of the software associated with flying and emergency situations into their memory in the form of knowledge and skills. However, more information is obtained by referring to manuals, checklists, maps and charts. In a physical sense these documents are regarded as hardware however in the information design of these documents adequate attention has to be paid to numerous aspects of the L-S interface.
- Mismatches at the L-S interface may occur through:
- A number of pilots have reported confusion in trying to maintain aircraft attitude through reference to the Head-Up-Display artificial horizon and 'pitch-ladder' symbology.
Liveware-Hardware (L-H)
- Interaction between human operator and machine
- Involves matching the physical features of the aircraft, cockpit or equipment with the general characteristics of human users while considering the task or job to be performed. Examples:
- Mismatches at the L-H interface may occur through:
- The old 3-pointer aircraft altimeter encouraged errors because it was very difficult for pilots to tell what information related to which pointer.
Liveware-Environment (L-E)
- Interaction between human operator and internal and external environments.
- Involves adapting the environment to match human requirements. Examples:
- Examples of mismatches at the L-E interface include:
Liveware-Liveware (L-L)
- Interaction between central human operator and any other person in the aviation system during performance of tasks.
- Involves interrelationships among individuals within and between groups including maintenance personnel, engineers, designers, ground crew, flight crew, cabin crew, operations personnel, air traffic controllers, passengers, instructors, students, managers and supervisors.
- Human-human/group interactions can positively or negatively influence behaviour and performance including the development and implementation of behavioural norms. Therefore, the L-L interface is largely concerned with:
- The importance of the L-L interface and the issues involved have contributed to the development of cockpit/crew resource management programmes in an attempt to reduce error at the interface between aviation professionals
- Examples of mismatches at the L-L interface include:
Aviation System Stability
Any change within the aviation SHELL system can have far-reaching repercussions. For example, a minor equipment change requires an assessment of the impact of the change on operations and maintenance personnel and the possibility of the need for alterations to procedures/training programmes. Unless all potential effects of a change in the aviation system are properly addressed, it is possible that even a small system modification may produce undesirable consequences. Similarly, the aviation system must be continually reviewed to adjust for changes at the Liveware-Environment interface.Uses
- **Safety analysis tool**: The SHELL model can be used as a framework for collecting data about human performance and contributory component mismatches during aviation incident/accident analysis or investigation as recommended by the International Civil Aviation Organisation. Similarly, the SHELL model can be used to understand systemic human factors relationships during operational audits with the aim of reducing error, enhancing safety and improving processes For example, LOSA is founded on Threat and Error Management that considers SHELL interfaces. For instance, aircraft handling errors involve liveware-hardware interactions, procedural errors involve liveware-software interactions and communication errors involve liveware-liveware interactions.
- **Licensing tool**: The SHELL model can be used to help clarify human performance needs, capabilities and limitations thereby enabling competencies to be defined from a safety management perspective.
- **Training tool**: The SHELL model can be used to help an aviation organisation improve training interventions and the effectiveness of organisation safeguards against error.