The Human Factors SHELL Model

Captain De Vere Michael Kiss, ATP, MS, Ph.D.

INTRODUCTION
The SHELL model is a conceptual model of human factors that clarifies the scope of aviation
human factors and assists in understanding the human factor relationships between aviation
system resources/environment (the flying subsystem) and the human component in the aviation
system (the human subsystem) (Hawkins & Orlady, 1993; Keightley, 2004). The SHELL model
was first developed by Edwards (1972) and later modified into a 'building block' structure by
Hawkins (1984) (Hawkins & Orlady, 1993). The model is named after the initial letters of its
components (software, hardware, environment, liveware) and places emphasis on the human
being and human interfaces with other components of the aviation system (Johnston, McDonald
& Fuller, 2001).

The SHELL model adopts a systems perspective that suggests the human is rarely, if ever,
the sole cause of an accident (Wiegmann & Shappell, 2003). The systems perspective considers a
variety of contextual and task-related factors that interact with the human operator within the
aviation system and how the interactions affect operator performance (Wiegmann & Shappell,
2003). As a result, the SHELL model considers both active and latent failures in the aviation
system. However, it should be noted that the model can be applied to other human-machine
interaction systems with minor adjustments.

THE SHELL MODEL

The SHELL model consists of four components: 1. Software, 2. Hardware, 3. Environment,
and 4. Liveware. For this paper, each component represents a building block of human factors
studies within aviation (ICAO, 1993).
 Figure 1. The SHELL Model
As modified by Hawkins (image embedded from Atlas Aviation on 24 Aug 2009)

The human element or worker (also known as the user or operator) of interest is at the center
or hub of the SHELL model that represents the modern air transportation system. The human
element is the most critical and flexible component in the system, interacting directly with other
system components, namely software, hardware, environment and liveware (Hawkins & Orlady,
1993).

However, the edges of the central human component block are varied and represent different
human limitations and variations in user performance. Therefore, the other system component
blocks must be carefully adapted and matched to this central component. This is to accommodate
human limitations and avoid stressors and/or breakdowns (incidents/accidents) in the aviation
system (Hawkins & Orlady, 1993). To achieve the necessary matching, certain characteristics, or
general capabilities and limitations, of the central human component must be understood. They
are described below.
 1. HUMAN CHARACTERISTICS

A. Physical Size and Shape

In the design of aviation workplaces and equipment, such as the flight station or passenger
cabin, body measurements and movement are a vital factor (Hawkins & Orlady, 1993) when
designing. This is known as ergonomics. Differences in ethnicity, age and gender also apply and
must be considered. Further, design decisions must take into account anthropometric dimensions
and population percentages (number of passengers) the design is intended to address (Hawkins &
Orlady, 1993). Human size and shape are relevant in the design and location of aircraft cabin
equipment, emergency equipment, seats and furnishings as well as access doors, emergency
exits, and space requirements for cargo compartments.

B. Fuel Requirements
Humans require food, water and oxygen to function efficiently. Any deficits can affect
cognitive function, physical performance and emotional well-being (Hawkins & Orlady, 1993).
Thus, water storage and access, food storage containers, beverage carts etc. must be considered.

C. Input Characteristics
Human senses are responsible for collecting vital task and environmental information.
However, they are subject to limitations and degradation. Anthropologic senses are incapable of
perceiving the entire range of available sensory information (Keightley, 2004). For example, the
human eye cannot see a dim object at night when low illumination is present. Therefore,
accommodations must be made to enhance pilot performance during night flying, i.e., proper
lighting must be incorporated into the design of the flight station. Additionally, the four other
senses sound, smell, taste and touch must also be considered. Further, gauges, annunciators, and
indicators must be provided to supply information the human sense cannot perceive.

D. Information Processing
Humans have limitations in information processing capabilities (such as working memory
capacity, time and retrieval considerations). These limitations can influence individuals to make
false hypotheses degrading decision making. Other factors include motivation and stress or high
workload and time constraints (Hawkins & Orlady, 1993). Aircraft display, instrument and
alerting/warning system design must be taken into account with a thorough understanding of the
anthropometric limitations of human information processing. This helps to prevent human error.

E. Output Characteristics
After perceiving and processing information, the output involves making a decision, taking
action and finally, verification through a feedback loop to ensure proper action was taken. When
considering appropriate design, one should include aircraft control-display movement
relationship, correct direction of control movement and tactile feel, precise switch resistance and
nomenclature, acceptable forces when operating aircraft exits, hatches and cargo equipment and
speech characteristics in the design of voice communication procedures (Hawkins & Orlady,
1993).

F. Environmental Tolerances
In order for people to function effectively, the environment must be maintained within an
optimal window. If the environment exceeds human limits, the users’ cognitive function,
physical performance and emotional well-being can be negatively affected. Environmental
elements consist of: temperature, O2 levels, CO2 levels, humidity, vibration, noise, g-forces and
time of day as well as time zone transitions (circadian rhythms), stressful working environments,
high work load, time compression and enclosed spaces (Hawkins & Orlady, 1993).

2. COMPONENTS OF THE SHELL MODEL

A. Software
The software component includes the non-physical, intangible aspects of aviation which
regulate the aviation operational structure and how system information is organized, presented,
and transferred to the people operating within the system (Hawkins & Orlady, 1993). The
software component can include, but is not limited to, the software that controls the operations of
computer hardware (Johnston, McDonald & Fuller, 2001). Software includes rules, instructions,
regulations, emergency procedures, policies, norms, checklists, laws, orders, safety procedures,
standard operating procedures, customs, practices, conventions, habits, symbology, supervisor
commands and computer programs. Software also includes documents such as the contents of
charts, maps, publications, emergency operating manuals, training and procedural checklists
(Wiener & Nagel, 1988).

B. Hardware
Hardware includes the physical elements of the aviation operational system such as aircraft
(including controls, surfaces, displays, functional systems and seating), operator equipment,
tools, materials, buildings, vehicles, computers, conveyor belts etc. (Johnston et al, 2001 6;
Wiener & Nagel, 1988; Campbell & Bagshaw, 2002).

C. Environment
The context in which aircraft and the aviation operational system resources (software,
hardware, liveware) function, are made up of the physical, organizational, economic, regulatory,
political and social variables that impact the worker/operator (Wiener & Nagel, 1988; Johnston
et al, 2001). The internal air transport environment relates to the immediate work area and
includes physical factors such as cabin/cockpit temperature, air pressure, humidity, noise,
vibration and ambient light levels. The external air transport environment includes the physical
environment outside the immediate work area such as weather (visibility/turbulence), terrain,
congested airspace and the physical infrastructure, including airports as well as the
organizational, economic, regulatory, political and social elements (International Civil Aviation
Organization, 1993).

D. Liveware
The Liveware component of the SHELL model consists of the people operating in the
aviation system. This includes the flight crews, cabin personnel, ground crew, schedulers,
dispatchers, maintenance workers, and management and administration personnel. The liveware
component considers the users’ cognitive and physical performance, capabilities and limitations
(International Civil Aviation Organization, 1993).

The four components of the SHELL model do not function alone but, instead, interact with
the central human component affording several objective foundations of human factors analysis
(Wiegmann & Shappell, 2003). The SHELL model designates several relationships between the
users, the machine, and their interactions as well as other system components; therefore,
providing a framework which optimizes the relationships between the users’ and their activities
within the aviation system. Particularly those that are of primary concern to human factors. In
support of this concept, the ICAO has described human factors as the concept of people (the user
or operator) in their living and working situations; their interactions with the machines
(hardware), procedures (software) and the environment about them. Additionally, the
relationships and interactions that exist between the users and other people (Keightley, 2004).

According to the SHELL model, a disparity exists between the boundaries of the of the
different components. Thus, where the associated information of the different groups is
combined, a potential source of human error, or system vulnerability, that can lead to system
failure in the form of an incident/accident, can be identified (Johnston et al, 2001). Aviation
disasters are commonly characterized by incongruities of the interfaces between the system
components, rather than a catastrophic failure of an individual component (Wiener & Nagel,
1988).

3. SHELL MODEL INTERFACES

A. Liveware-Software (L-S)
L-S interactions are those between the human operator and the non-physical supporting
systems that exist within the workplace (Johnston, McDonald & Fuller, 2001). They involve
designing software to match the interactions of the human users, ensuring that the software (i.e.
proper rules and procedures) is capable of being implemented and addressing the human-system
behaviors (Hawkins & Orlady, 1993).

During training, flight crew members utilize the software (e.g. procedural knowledge)
associated with normal, abnormal, and emergency situations. This training provides practice that
places knowledge schemas into their memory, enhancing their skills. However, more information
is needed prior to the training. This is obtained through many hours of studying aircraft and
company manuals, normal, abnormal, and emergency checklists, and maps and charts. In a
physical sense, these informational documents are considered hardware. However, in the design
of these informational documents, adequate attention has to be paid to numerous aspects of the
L-S interface (Wiener & Nagel, 1988). This is needed to provide clear and concise instructions
of who will perform specific tasks and when they will perform them. This is to limit subjective
interpretation and enhance crew coordination. The vaguer something is, the more subjective it
becomes. Leaving the operator to subjectively infer what the informational document states. This
can lead to confusion, ambiguity, or misunderstanding, destabilizing operations. Thus, it is
important that the informational documents clearly and concisely state the information.

Therefore, the designer must consider:

• Currency and accuracy of information
• User-friendliness of format and vocabulary
• Clarity of information
• Subdivision and indexing to facilitate user retrieval of information
• Presentation of numerical data
• Use of abbreviations
• Symbolic codes and other language devices
• Presentation of instructions using diagrams and/or sentences etc.

The solutions implemented after considering these informational design factors play a
crucial role in effective human performance at the L-S interface (Wiener & Nagel, 1988). They
are imperative in building the resilience and robustness in the mitigation of risk.

Divergences of the L-S interface can occur through the following (Hawkins & Orlady, 1993):
• Insufficient or inappropriate procedures
• Misinterpretation of confusing or ambiguous symbology and checklists
• Confusing, misleading or cluttered documents, maps or charts
• Irrational indexing of an operations manual

B. Liveware-Hardware (L-H)
The L-H component consists of the interactions between the human operator and the
machine, better known as the Human-machine Interface or HMI. The L-H constituent involves
comparing and matching the physical features of the aircraft, cockpit or equipment with the
anthropological needs of the users. This also involves considering the different tasks to be
performed during normal, abnormal, and emergency procedures (Hawkins & Orlady, 1993). This
is usually accomplished through computer modeling and simulation in coordination with
Human-in-the-Loop Modeling and Simulation (HITLMS) where the behaviors of the user, the
machine, and the interface or observed and needed changes made during an iterative process.
The following is a list of some example variables made during this process (Hawkins & Orlady,
1993):
• PAX and crew seats to fit the sitting characteristics of the human body
• Cockpit displays, switches and controls
• Match the sensory, informational processing, tactile, and movement characteristics of
human users
• Facilitating the action sequencing
• Minimizing workload
• Safeguards for incorrect or inadvertent operation

Discrepancies at the L-H interface may occur through (Cacciabue, 2004):

• Poorly designed equipment
• Inappropriate or missing operational material
• Badly located or coded instruments and control devices
• Warning systems that fail in alerting, and providing correct informational or guidance
functions in abnormal situations etc.

C. Liveware-Environment (L-E)
The L-E section of the SHELL model involves the interaction that occurs between the human
operator and the internal and external environments (Johnston et al, 2001). It involves adapting
the environment to match human requirements. Originally, humans were adapted to the
environment. Some examples of this would be to apply oxygen masks to the pilots in
unpressurized aircraft or the wearing of warm clothing in unheated aircraft. Today, the
environment is adapted to the human. Pressurized aircraft provide both oxygen and warm
temperatures for the anthropological needs of the users.
 Other examples (Wiener & Nagel, 1988):
• Engineering systems to protect crews and passengers from discomfort, damage, stress
and distraction caused by the physical environment
• Air conditioning systems to control aircraft cabin temperature
• Sound-proofing to reduce noise
• Pressurization systems to control cabin air pressure
• Protective systems to combat ozone concentrations
• Using window shades to prevent circadian disruptions
• Expanding infrastructure, passenger terminals and airport facilities to accommodate more
people due to larger jets (e.g. Airbus A380) and the growth in air transport

Examples of divergences at the L-E interface include (Wiener & Nagel, 1988; Hawkins &
Orlady, 1993; and Johnston et al, 2001):
• Reduced performance and errors resulting from disturbed biological rhythms (jet lag) as a
result of long-range flying and irregular work-sleep patterns
• Pilot perceptual errors induced by environmental conditions such as visual illusions
during aircraft approach/landing at nighttime
• Flawed operator performance and errors as a result of management failure to properly
address issues at the L-E interface including:
▪ Operator stress due to changes in air transport demand and capacity during times of
economic boom and economic recession; i.e., reduction in force or furloughs,
mergers, bankruptcies, or liquidation
▪ Poor crew decision making and operator short-cuts inspired by the stress of economic
pressure from airline competition and cost-cutting measures linked with deregulation
▪ Inadequate or unhealthy organizational environment reflecting a flawed operating
philosophy, poor employee morale or negative organizational culture
 D. Liveware-Liveware (L-L)
The L-L component involves the interaction between the central human operator and any
other person in the aviation system during the performance of associated tasks (International
Civil Aviation Organization, 1993). It encompasses the interrelationships amongst the
individuals within and between the different operator groups including: maintenance personnel,
engineers, designers, ground crew, flight crew, cabin crew, operations personnel, air traffic
controllers, passengers, instructors, students, managers and supervisors.

Human-human group interactions can positively or negatively influence behavior and

performance including the development and implementation of behavioral norms. Therefore, the
L-L interface is largely concerned with (Hawkins & Orlady, 1993; Johnston et al, 2001):
• Interpersonal relations
• Leadership
• Crew cooperation, coordination and communication
• Dynamics of social interactions
• Teamwork
• Cultural interactions
• Personality and attitude interactions

The L-L interface and the issues involved have contributed to the development of
cockpit/crew resource management (CRM) programs in an attempt to reduce error at the
interface between aviation professionals

Examples of mismatches at the L-L interface include (Hawkins & Orlady, 1993):
• Communication errors due to misleading, ambiguous, inappropriate or poorly
constructed communication between individuals
• Reduced performance and error from an imbalanced authority relationship between
aircraft captain and first officer
• Poor structure of shared authority, i.e., who is responsible for specific actions and
when those actions will be performed
 It is important to understand that the SHELL Model does not utilize interfaces that are
beyond the scope of human factors. For instance, the hardware-hardware, hardware-environment
and hardware-software interfaces are not considered because they do not encompass the liveware
element.

4. AVIATION SYSTEM STABILITY

Any modification that occurs within the SHELL classification can have major impacts
(Wiener & Nagel, 1988). For example, a minor equipment change (Hardware) should require an
assessment of how the change could affect operations and maintenance personnel (Liveware-
Hardware) and the possibility of the need for alterations to procedures and training programs (to
optimize Liveware-Software interactions). If all of the possible effects of a change in system are
not adequately considered, it is possible that even a small system modification could lead to
undesirable consequences (Wiener & Nagel, 1988). Similarly, the aviation system must be
continually reviewed to adjust for any changes that occur at the Liveware-Environment interface
(Wiener & Nagel, 1988).

5. SHELL MODEL USES

A. Safety Analysis Tool
The SHELL Model can be used as a framework to collect data involving human performance
and related component incongruities during an aviation incident or accident investigation as
recommended by the ICAO (1993). Additionally, the SHELL Model can be used to discover
systemic human factors relationships during operational audits, such as a LOSA (Line
Operations Safety Audit), with the aim of reducing error and enhancing safety (Cacciabue,
2004). LOSAs were founded on the Threat and Error Management (TEM) model. TEM
considered the SHELL interfaces (Edkins & Pfister, 2003). For instance, aircraft handling errors
involve liveware-hardware interactions, procedural errors involve liveware-software interactions
and communication errors involve liveware-liveware interactions (Maurino, 2005).
 B. Licensing tool:
The SHELL Model can also be used to identify, support, and clarify human performance
needs, capabilities and limitations, and, in so doing, enable competencies which can be defined
within a safety management perspective (Maurino, 2005).

C. Training tool:
The SHELL Model can be used to help an aviation organization improve training
interventions and the effectiveness of organizational safeguards against error (Maurino, 2005).
References
1. Cacciabue, P.C. (2004). Guide to applying human factors methods: Human error and accident
management in safety critical systems. London: Springer-Verlag London Ltd, 2004.
2. Campbell, R.D., & Bagshaw, M. (2002). Human performance and limitations in aviation
(3rded.). United Kingdom: Blackwell Science Ltd, 2002.
3. Edkins, G., & Pfister, P. (Eds.). (2003). Innovation and consolidation in aviation: Selected
contributions to the Australian aviation psychology symposium 2000. England: Ashgate
Publishing Ltd, 2003.
4. Hawkins, F.H., & Orlady, H.W. (Ed.). (1993). Human factors in flight (2nd ed.). England:
Avebury Technical, 1993.
5. International Civil Aviation Organization (1993). Human factors digest no 7: Investigation of
human factors in accidents and incidents. Montreal: Author, 1993.
6. Johnston, N., McDonald, N., & Fuller, R. (Eds). (2001). Aviation psychology in practice.
England: Ashgate Publishing Ltd, 2001.
7. Keightley, A. (2004). 190.216 human factors study guide. Palmerston North: Massey
University, 2004.
8. Maurino, D. (2005). Threat and error management (TEM). Retrieved August 17, 2009 from
the World Wide Web: http://www.flightsafety.org/doc/tem/maurino.doc
9. Wiegmann, D.A., & Shappell, S.A. (2003). A human error approach to aviation accident
analysis: The human factors analysis and classification system. England: Ashgate Publishing
Ltd, 2003.
10. Wiener, E.L., & Nagel, D.C. (Eds). (1988). Human factors in aviation. California: Academic
Press Inc, 1988.