Guidelines for Establishing a Safety
Management System on Aerodromes
DASS Publication 11/2006-A
APPENDIX 9
HUMAN FACTORS 1,2 AND THE SHELL MODEL
A9.1 In a high-technology industry such as aviation, the focus of problem
solving is often on technology. However, the accident record repeatedly
demonstrates that at least three out of four accidents involve performance
errors made by apparently healthy and appropriately qualified individuals. In
the rush to embrace new technologies, the people who must interface with and
use this equipment are often overlooked.
A9.2 The sources of some of the problems causing or contributing to these
accidents may be traced to poor equipment or procedure design, or to
inadequate training or operating instructions.
Whatever the origin,
understanding normal human performance capabilities, limitations and behavior
in the operational context is central to understanding safety management. An
intuitive approach to Human Factors is no longer appropriate.
A9.3 The human element is the most flexible and adaptable part of the
aviation system, but it is also the most vulnerable to influences that can
adversely affect its performance. With the majority of accidents resulting from
less than optimum human performance, there has been a tendency to merely
attribute them to human error. However, the term “human error” is of little help
in safety management. Although it may indicate where in the system the
breakdown occurred, it provides no guidance as to why it occurred.
A9.4 An error attributed to humans may have been design-induced or
stimulated by inadequate equipment or training, badly designed procedures, or
a poor layout of checklists or manuals.
Furthermore, the term “human
error” allows concealment of the underlying factors that must be brought to the
fore if accidents are to be prevented. In modern safety thinking, human error is
the starting point rather than the stopping point. Safety management initiatives
seek ways of preventing human errors that might jeopardize safety, and ways
of minimizing the adverse safety consequences of the errors that will inevitably
occur. This requires an understanding of the operating context in which
humans err (i.e. an understanding of the factors and conditions affecting human
performance in the workplace).
SHEL model
A9.5 The workplace typically involves a complex set of interrelated factors
and conditions, which may affect human performance. The SHEL model
(sometimes
Amendment: Re-issue
April 1st, 2007
Page no.: App. 9-1
Guidelines for Establishing a Safety
Management System on Aerodromes
DASS Publication 11/2006-A
1. Adapted from the ICAO Human Factors Guidelines for Safety Audits Manual (Doc 9806),
Chapter 2.
2. Refer to the ICAO Human Factors Training Manual (Doc 9683) for a more comprehensive
coverage of the theoretical and practical aspects of Human Factors.
referred to as the SHELL model) can be used to help visualize the interrelationships
among the various components of the aviation system. This model is a development
of the traditional “man-machine-environment” system. It places emphasis on the
human being and the human’s interfaces with the other components of the aviation
system. The SHEL model’s name is derived from the initial letters of its four
components:
a)
Liveware (L) (humans in the workplace);
b)
Hardware (H) (machine and equipment);
c)
Software (S) (procedures, training, support,
etc); and
d)
Environment
(E)
(the
operating
circumstances in which the rest of the L-H-S
system must function)
A9.6 Figure A9-1 depicts the SHEL model. This building block diagram is
intended to provide a basic understanding of the relationship of the human to
other factors in the workplace.
Amendment: Re-issue
April 1st, 2007
Page no.: App. 9-2
Guidelines for Establishing a Safety
Management System on Aerodromes
DASS Publication 11/2006-A
Figure A9-1
SHELL MODEL
A9.7 Liveware. In the center of the SHEL model are those persons at the
front line of operations. Although people are remarkably adaptable, they are
subject to considerable variations in performance.
Humans are not
standardized to the same degree as hardware, so the edges of this block are
not simple and straight. People do not interface perfectly with the various
components of the world in which they work. To avoid tensions that may
compromise human performance, the effects of irregularities at the interfaces
between the various SHEL blocks and the central Liveware block must be
understood. The other components of the system must be carefully matched to
humans if stresses in the system are to be avoided.
A9.8 Several different factors put the rough edges on the Liveware block.
Some of the more important factors affecting individual performance are listed
below:
a)
b)
Physical Factors:
These include the
individual’s physical capabilities to perform the
required tasks, e.g. strength, height, reach,
vision and hearing.
Physiological factors: These include those
factors which affect the human’s internal
Amendment: Re-issue
April 1st, 2007
Page no.: App. 9-3
Guidelines for Establishing a Safety
Management System on Aerodromes
DASS Publication 11/2006-A
physical processes, which can compromise a
person’s physical and cognitive performance,
e.g. oxygen availability, general health and
fitness, disease or illness, tobacco, drug or
alcohol use, personal stress, fatigue and
pregnancy.
c)
Psychological factors: These include those
factors
affecting
the
psychological
preparedness of the individual to meet all the
circumstances that might occur, e.g.
adequacy of training, knowledge and
experience, and workload. The individual’s
psychological fitness includes motivation and
judgment, attitude towards risky behavior,
confidence and stress.
d)
Psycho-social factors: These include all
those external factors in the social system of
individuals that bring pressure to bear on them
in their work and non-work environments, e.g.
an argument with a supervisor, labormanagement disputes, a death in the family,
personal financial problems or other domestic
tension.
A9.9 The SHEL model is particularly useful in visualizing the interfaces
between the various components of the aviation system. These include:
a)
Liveware-Hardware (L-H).
The interface
between the human and the machine
(ergonomics) is the one most commonly
considered when speaking of Human Factors.
It determines how the human interfaces with
the physical work environment, e.g. the design
of seats to fit the sitting characteristics of the
human body, displays to match the sensory
and information processing characteristics of
the user, and proper movement, coding and
location of controls for the user. However,
there is a natural human tendency to adapt to
L-H mismatches. This tendency may mask
serious deficiencies, which may only become
evident after an accident.
Amendment: Re-issue
April 1st, 2007
Page no.: App. 9-4
Guidelines for Establishing a Safety
Management System on Aerodromes
DASS Publication 11/2006-A
b)
Liveware-Software (L-S). The L-S interface
is the relationship between the individual and
the supporting systems found in the
workplace, e.g. the regulations, manuals,
checklists, publications, SOPs and computer
software. It includes such “user friendliness”
issues as currency, accuracy, format and
presentation,
vocabulary,
clarity
and
symbology.
c)
Liveware-Liveware (L-L). The L-L interface
is the relationship between the individual and
other persons in the workplace. Flight crew,
ATCOs, AMEs and other operational
personnel function as group, and group
influences play a role in determining human
behavior and performance. This interface is
concerned with leadership, cooperation,
teamwork and personality interactions. The
advent of crew resource management (CRM)
has resulted in considerable focus on this
interface. CRM training and its extension to
ATS (team resource management (TRM)) and
maintenance
(maintenance
resource
management (MRM)) promote teamwork and
focus on the management of normal human
errors. Staff/management relationships are
also within the scope of this interface, as are
corporate culture, corporate climate and
company operating pressures, which can all
significantly affect human performance.
d)
Liveware-Environment (L-E). This interface
involves the relationship between the
individual and the internal and external
environments.
The internal workplace
environment
includes
such
physical
considerations as temperature, ambient light,
noise, vibration and air quality. The external
environment (for pilots) includes such things
as
visibility,
turbulence
and
terrain.
Increasingly,
the
24/7
aviation
work
environment includes disturbances to normal
biological rhythms, e.g. sleep constraints,
which in turn affect the overall corporate
Amendment: Re-issue
April 1st, 2007
Page no.: App. 9-5
Guidelines for Establishing a Safety
Management System on Aerodromes
DASS Publication 11/2006-A
environment. Included here are such factors
as the adequacy of physical facilities and
supporting infrastructure, the local financial
situation, and regulatory effectiveness. Just
as the immediate work environment may
create pressures to take short cuts,
inadequate infrastructure support may also
compromise the quality of decision-making.
A9.10 Care needs to be taken in order that problems (hazards) do not “fall
through the cracks” at the interfaces. For the most part, the rough edges of
these interfaces can be managed, for example:
a)
The designer can ensure the performance
reliability of the equipment under specified
operating conditions.
b)
Adhering to JCAA’s defined conditions under
which the equipment may be used.
c)
The airport operator’s management can
specify SOPs and provide initial and
recurrent training for the safe use of the
equipment.
d)
Individual equipment operators can ensure
their familiarity and confidence in using the
equipment safely under all required operating
conditions.
Amendment: Re-issue
April 1st, 2007
Page no.: App. 9-6