Human performance and limitation

SHELL Model

The SHELL Model is a conceptual tool used to analyze the interaction of multiple system components. The SHELL Model
contains the following four components:

- Liveware (L): At the center of the model is the pilot. Man - the most valuable and flexible component of the system.
The second ‘L’ represents other humans whether inside or outside the aircraft.
- Software (S): Includes procedures, training, support, manuals, checklist layouts, maps and charts, computer
programs.
- Hardware (H): Relates to machines and equipment. Including cockpit layout, physical aircraft structure, instruments
presentation and position of controls.
- Environment (E): The working environment in which the rest of the L-H-S system must function - conditions both
inside and outside the cockpit.

Threat Error and Management system [TEM]

Threats are predicted | Errors are prevented

Threats [LEO]

Events or errors occurring beyond the influence of the line personnel (ATC or Flight crew), increasing operational complexity
and must be managed to maintain margin of safety.

- Latent Threats: Not immediately obvious to, or observable by flight crews [poor equipment design, visual illusions or
quick turn-around schedules]
- Environmental Threats: Those occurring during actual operations [weather, terrain, ATC, airport]
- Organizational Threats: Operational pressure, aircraft type, cabin design, maintenance, dispatch, documentation

Errors [APC]

Actions or lack of actions (inaction) by the flight crew that lead to deviations from organisational or flight crew intentions or
expectations.

- Aircraft Handling Errors: Manual handling, automatic systems, ground navigation.

- Procedural Errors: SOPs, checklists, briefing documentation.
- Communication Errors: Crew to external, pilot to pilot.

Undesired Aircraft States

Flight crew induced aircraft speed or position deviations, misapplication of flight controls, incorrect system configurations,
associated with a reduction in safety margins.

- Aircraft handling
- Ground navigation
- Incorrect configuration

Counter Measures: All flight crew MUST employ counter measures in order to keep threats, errors and undesired aircraft
states from reducing safety margins in flight operations. 2 different types of counter measures are:

Hard Resources

- Airborne Collision Avoidance Systems (ACAS) [systemic]

- Ground Proximity Warning Systems (GPWS) [systemic]
- Standard Operation Procedures (SOPs)
- Checklists
- Briefings
- Training
Human Resources [Avoid - Trap - Mitigate (ATM)]

- Avoid: An attempt to foresee potential problems. Best achieved at times of low workload.
- Trap: Deal with threats and hazards as they occur.
- Mitigate: Deal with the consequences of an error that has occurred

Other counter measures are:

- Planning countermeasures: essential for managing anticipated and unexpected threats

- Execution countermeasures: essential for error detection and error response
- Review countermeasures: essential for managing the changing condition of a flight

Safety Culture

The safety culture of an organization is the product of individual and group values, attitudes, perceptions, competencies and
patterns of behaviour that determine the commitment to, and the style and proficiency of, an organization’s health and
safety management.

A safety culture is relatively enduring, stable and resistant to change.

- Open Culture: Where all levels of an organization play an active part in the improvement of the safety culture.
- Closed Culture: Where an organization is reluctant to release information on threats, errors or undesired aircraft states
to other agencies.
- National Culture: Both government and ethnic factors influence attitudes towards safety culture.

Factors that Promote a Good Safety Culture: Leadership | Commitment | Good example

In an organization with good safety culture:

- The individual is responsible (responsibility)

- The management is accountable (accountability)

The Five Elements which form safety culture (according to James Reason) are:

- Informed culture: the organisation collects and analyses relevant data and actively disseminates safety information
- Reporting culture: an organizational climate in which people are prepared to report their errors and near-misses.
- Learning culture: an organization must possess the willingness and the competence to draw the right conclusion from
its safety information system and the will to implement major reforms.
- Flexible culture: a culture in which an organisation is able to reconfigure themselves in the face of high temporary
operations or certain kinds of danger, shifting from conventional hierarchical mode to a flatter mode.
- Just Culture: Errors and unsafe acts will not be punished if the error was unintentional. Those who act recklessly or take
deliberate and unjustifiable risks will be subject to disciplinary action.
- Non-Punitive Culture: Errors and unsafe acts will not be punished thus encouraging an atmosphere where people have
the confidence to report safety concerns.

In a company with a Fatigue Risk Management System (FRMS) a learning culture is the best choice because this system is
based on a computer model which anticipate the expected performance capability from its sleep/awake history. This model
needs to be continuously updated, so the learning culture is the best.

Reason’s Swiss Cheese Model

Likens human systems to multiple slices of Swiss cheese, stacked together, side by side.

An organization’s defences against failure are modelled as a series of barriers (the Swiss cheese slices). The holes in the
cheese slices represent individual weaknesses in each part of the system and are continually varying in position and size in
each slice.

The system as a whole will produce failures when all of the holes in each slice momentarily align. A hazard will pass through
all of the holes in all of the defences leading to a failure.
Safety Management System [SMS]

A systematic and explicit approach defining the activities by which safety management is undertaken by an organisation in
order to achieve acceptable or tolerable safety. SMS also provides the organisational framework to establish and foster the
development of a positive corporate safety culture.

It comprises:

- Safety policy: defines the generic principles upon which the SMS is built and operated. Defines the methods, processes,
and organizational structure needed to meet safety goals.
- Safety risk management/planning: designed to mitigate and contain risk in operations.
- Safety assurance: ensure that planning achieve the intended objectives and, where they fail, improve them.
- Safety promotion: Means, processes and procedures that ensure that aviation personnel are trained and competent to
perform their safety management duties and are prepared for effective two-way communication of safety issues
between operational personnel and the organisation’s management.

Basics of flight physiology

Respiratory

Physiological thresholds:

- Reaction threshold [0-7000 ft]: Deterioration of night vision and beginning of hypoxia (on certain subjects)
- Disturbance threshold [10000-12000 ft]: Performance reduced and flight safety + short term memory may be impaired
- Critical threshold [>22000 ft]: Mental performance and coordination degradation within 5 minutes

A healthy individual is usually capable of compensating for lack of O2 up to 10000-12000 ft

Breathing:

- Healthy person: 70 BPM | Sporty person: 50 BPM

- Breathing rate: 10-15 breath/min | 15-20 breath/min (2 versions of the question)

The first symptoms of carbon monoxide [CO] poisoning are:

- Headache (or tightness across the forehead)

- Nausea
- Dizziness
- Cherry red lips

Several days are necessary to recover from CO poisoning

Time of useful consciousness [TUC] is the length of time during which and individual can act with both mental and physical
efficiency after pressure loss:

- 25 000 ft: 2 min

- 30 000 ft: 1 min
- 35 000 ft: 30s
- 40 000 ft: 15s

Effective Performance Time EPT < TUC. It varies between individual and stress has a considerable impact on it.

Decompression sickness [DCS] occurs when nitrogen comes out as small bubbles. Primary symptoms are:

- Bends (joints)
- Creeps (skin)
- Chokes (lungs)
- Staggers (brain)

Equivalent air altitude for 100% O2 = Given altitude – 30000 ft

breathing O2 100% with pressurization is required above 38000 ft

Types of hypoxias:

- Hypoxic: caused by altitude (no additional O2 or cabin depressurization)

- Anemic: caused by smoking
- Histotoxic: caused by alcohol and drugs

Hypoxia symptoms:

- Cyanosis (Cyan is blue)

- Lack of concentration
- Fatigue
- Euphoria

Hypoxia can be caused by:

- Malfunction of the body cells to metabolize O2

- Low partial pressure of O2 in the atmosphere at high altitude without pressurization and supplemental O2
- A decreased saturation of O2 in the blood due to CO attached to the hemoglobin

Factors increasing the effects or lowering the threshold of hypoxic hypoxia:

- Alcohol
- Duration of exposure
- Pressure altitude > 20000 ft
- Physical exertion at altitude
- High temperature
- Fatigue
- Nausea

Lungs:

- Total volume not fully usable

- 5/6 liters of average volume
- The process of gas exchange in the lungs is carried by passive diffusion

Hyperventilation:

- Blood is more alkaline (acidity level reduces)

- The brain detects an excess of CO2 in the blood  hyperventilation  too much CO2 expelled
- Breath in a bag to restore required level of CO2

Symptoms:

- Dizziness
- Tingling sensation
- Nausea
- Blurred vision

Concentration of ozone at high altitudes should be below defined limits, particularly if the aircraft is equipped with ozone
removers

Circulatory

Veins  CO2 | Pulmonary Veins  O2

Arteries  O2 | Pulmonary arteries  CO2

Systolic pressure is generated by the contraction of the heart pumping blood towards the periphery.

Systolic pressure is the highest pressure value

Diastolic pressure is the lowest pressure value

Blood Oxygen saturation affects pilot judgement from 10000 ft

Cardiac output = Heart rate x Stroke volume | 5-6 liters/min

Internal respiration is the exchange of gases O2 and CO2 inside cells of the body

Hypertension is the major factor of strokes

Pressure measured as mmHg

Hearing and vestibular

The inner ear is responsible for sound perception in the fluid-filled

cochlea.

NIHL involves damage to the receptors (sensitive hair cells in the

cochlea) [1 time +120 dB or continuous +85 dB]

Conductive deafness: blockage of the outer or middle ear (e.g. wax)

Semicircular canals can be: anterior, posterior and lateral

Vestibular apparatus is formed by:

- Semicircular canals [angular accelerations]

- Otolith (including utricle [horizontal acceleration] and saccule
[vertical acceleration (gravity)])

Balance or disorientation problems are:

- Somatogravic effect: occurs during linear acceleration or deceleration giving a climb/descent sensation
- Somatogyral illusion | Leans: inability of the semicircular canals to register accurately a prolonged rotation. After a
prolonged turn, when levelling the pilot has a sensation of turning in the opposite direction
- Graveyard spin: during a prolonged spin, the pilot has a sensation of a spin in the opposite direction (caused by Leans)
- Vertigo: loss of spatial awareness where the individual experiences the illusion of a rotation or a turn or tumble
- Coriolis effect: in a turn if a sudden movement of the head is detected, there is an illusion of change in turn rate

Sound perception: Cochlea

Sound reception: Tympanic membrane

Motion sickness is caused by a mismatch between the visual and vestibular signals

Visual

Order from outer to inner: [CIPLR – Can I Properly Look Right]

- Cornea
- Iris and Pupil
- Lens
- Retina

Contact lenses are used only when near-sighted (myopia)

Accommodation is the ability of the eye to alter its focal length

In the retina the center is called fovea and only cones are present, while going away from it are presents rods.

Rods are responsible for peripheral vision.

The fovea is responsible for central vision and is the place where everything that needs to be brought on focus goes.

The ability to read alphanumeric information is limited to the foveal area of the retina.

Vision through rods is called scotopic vision (black and white) and is more sensitive at lower lights level.

Vision through cones is called photopic vision and is used for direct vision in good light and are colour sensitive
Mesopic vision is when both cones and rod are used

Visual acuity is the ability to discriminate at varying distances.

Reading information is limited to the foveal area of the retina

Contact lenses may increase corneal damage due to mild hypoxia and dehydration.

The function of photosensitive cells is NOT impaired by high speed

Aerial perspective encompasses a visual phenomenon in which distant objects, such as mountains, can appear deceptively
closer than their actual distance

Night vision:

- 7 minutes to adapt for cones

- 30 minutes to adapt for rods
- Sensitivity reduced with increased altitude
- Most sensitive function to lack of oxygen

10 seconds for the eyes to adjust to bright light

Autokinesis:

- Wide or Downslope runway = Overshoot [WDO]

- Narrow or Upslope runway = Undershoot [UNU]
- Wide runway = early or high round out (flare)

Perceptual illusion:

- Visual (blind spots)

- Kinesthetic (leans)
- Auditory (missed radio calls)

During fog, the objects appear to be further away leading to a steeper approach

Black hole effect: when flying over featureless terrain the pilot think he is higher than he actually is (risk of undershooting)

Empty field myopia: In the absence of specific focal points, the human eye tends to focus at a close distance. It is useful to
focus on distant points to avoid its onset.

Approaching a runway perpendicular to the shore from the sea, may lead to undershooting/short landing (feels too high)

Monocular pilots MAY be assessed as fit to fly

Monocular cues for depth perception: [OTA]

- Obscuration
- Texture
- Atmospheric perspective

Eye defects:

- Short-sight (myopia) occurs when the image forms in front of the retina
- Long-sight (presbyopia) occurs when the image forms behind the retina
- Astigmatism occurs when cornea is not evenly shaped

Visual disturbances: [Hypertension according to EASA IS NOT a cause of visual disturbances]

- Hyperventilation
- Hypoxia
- Fatigue
Nervous system

- ANS involuntary controls organs

- PNS connects CNS to the rest of the body and transmits sensory information
- CNS processes and sends out motor commands

Health in flight

Annual radiation that may have adverse effects on health: 100 mSv

Galactic and Cosmic radiations are steady and reasonably predictable.

Crew receives yearly an amount of cosmic radiation = to the amount of background radiation

Galactic radiation  increase with increasing altitude

Cosmic radiation increase with increasing latitude

Relative humidity = % of water vapor in the air

Warm air can absorb less water than cold air, so it has a lower relative humidity.

To obtain the lowest relative humidity in the cabin, outside temperature need to be cold, while warm air inside the aircraft

Physiological effects of an acceleration of XG on the body depends on the:

- Duration of the G forces

- Onset rate of the G forces (how abrupt is the acceleration)
- Magnitude of the G forces

4 main factors influencing the level of radiation in order of importance:

- Altitude
- Latitude
- Normal solar activity
- Random solar activity (solar flares, …)

Greyout occurs at +2GZ (according to EASA)

Alpha radiation can be blocked by a sheet of paper

Anxiety contributes to the onset of motion sickness

General health and hygiene

According to EASA oil spilling in front of the landing gear is a fume event.

Fume event: anti ice spilling = YES | anti ice (without the word spilling) = NO

Overweight = BMI > 25 | Obese = BMI > 30

Obesity can cause:

- Sleep apnea
- Diabetes
- Coronary diseases

Gastrointestinal upset symptoms can include:

- Loss of appetite
- Heartburn
- Gastric and duodenal ulcers
- Pain in stomach
- Vomiting
- Nausea
General adaptation syndrome [GAS]: (psychosomatic reaction)

- Alarm phase: Adrenaline is released + fight of flight response

- Resistance phase: Cortisone is released (converting fats into sugar)
- Exhaustion phase: Result of prolonged or chronic stress. Adrenaline and cortisol generate waste matter which must be
eliminated.

Restorative processes regulating human body pattern of sleepiness and alertness:

- sleep/wake homeostasis
- circadian rhythm

Alcohol limit for crew: 20 mg/100 ml of blood [0.02%] | No alcohol at least 8 hours before starting the duty

Alcoholism symptoms: altered tolerance to alcohol, repeated withdrawal symptoms and conflict with the law

Otic Barotrauma worsen in a descent because outside pressure increases and the lower pressure of the air trapped within
the middle ear tends to also constrict the walls of the Eustachian tube

Aerodontalgia (tooth pain) mainly occurs during ascent due to gas expansion

Mosquitoes can spread Yellow fever and Malaria

Cholera can be transmitted through food or water which has been contaminated

Body temperature is  the same for all people if they are adapted to the place they are

When departing from places where infectious diseases are conducted by insects, spray insecticide in the cabin during the
flight

Type 2 diabetes mellitus is usually diagnosed in adulthood and a typical symptom is unexplained weight loss. Risk factors
are obesity and lack of physical activity

Anemia (red blood cells deficiency) can be caused by:

- Iron deficit
- Malaria
- Smoking

Hot Chocolate contains high level of caffeine

Excessive caffeine consumption: 250 mg/day

Tar is cancerogenic, not nicotine. Nicotine gives addiction.

Mercury is toxic

Nasal spray droplet size: 7 – 12 m

In case of back pain, quip a lumbar support.

Sleep

Circadian rhythm: ~ 25 hours

5 stages of sleep: 1-4 stage + REM

4/5 REM stages during the night occurring every 90/120 min and the brain is highly active

Hours Slept x 2 = Hours of Sleep Credit [8 h of sleep = 16 h of activity]

Low body temperature = Harder to sleep

Restorative processes regulating human body’s pattern of sleepiness and alertness during the day: sleep/wake homeostasis
and circadian rhythm

Jet leg is easier to recover when flying westbound

Flying eastbound, to reduce jet leg effects (not adapting to time zone): seek bright light in evening and dark in the morning

Jet leg rate of adaptation depends on the number of time zones crossed and the direction of travel

Basic Aviation Psychology

Human information processing

Vigilance is a state of sustained close attention in uneventful, monotonous periods (e.g. continuously scan and monitor the
flight instruments)

Attention describes the assignment of cognitive resources to a specific content

Cocktail party effect is associated with attention mechanism

Perception is extremely resistant to correction

Insight/Cognitive learning: Sudden grasping of the solution, a flash of understanding, without any process of trial and error.

Classical conditioning: Based on the association between stimuli and physiological responses (for example an experienced
pilot's automatic response to a fire warning signal)

Operant Conditioning: The recipient is taught through, principally, physiological responses (a particular stimuli). It involves
changing behavior through the use of consequences. It requires reinforcement.

Imitation/modeling: The data from an outside source is replicated.

Trial and error: This is the random application of behavior that has been successful in similar situations in the past, until one
of the actions eventually gives the desired result.

Attention is a cognitive process and is affected by:

- Environmental factors
- Psychological factors (sleep loss, hunger, body temperature,…)
- Motivation
- Task factors (intensity/frequency of the signal: the more intense a stimulus, the easier it will attract attention)

Divided attention is the ability to process 2 OR MORE responses or react to two or more different demands simultaneously.

Selective attention is the ability to select from many factors or stimuli and to focus on only the ONE that you want while
filtering out other distractions

Mental schema for a familiar but complex task:

- Advantage: allows the pilot to plain actions based on past experience

- Disadvantage: may encourage rigid ways of thinking

Retrograde amnesia: loss of memory of events (episodic memory)

Skills are stored in long term memory. When not practiced for a certain period, they become less automated and re-training
is required.

Strong motivation to achieve is a cognitive stressor and it can negatively affect performance

Top-down process: Comparing data stored in the brain with the new precepted information, critically disguising
inconsistent details

Bottom-up process: Stimulus influences our perception (data driven, because you see and judge it)

Long term memory types: [SEP]

- Semantic memory (stores general knowledge)

- Episodic memory (stores info about past events)
- Procedural memory (Motor program)

During perceptual processes (conversion of sensory information into an interpretation of that sensed information) some of
the sensory information is filtered out and lost by our brain to prevent sensory overload.
 Anderson stages of learning: [CAA]

- Cognitive phase: the learner thinks consciously about each individual action. In this phase, movements are slow,
inconsistent, and inefficient. The learner might need to recite mentally or aloud the steps which need to be taken
- Associative phase: the separate components of the overall action become integrated. Movements become more fluid,
reliable, and some parts of the action are controlled automatically.
- Automatic phase: the maneuver can be executed smoothly without conscious control. At this stage, trying to
consciously monitor its execution will slow it down and increase rate of error.

Rasmussen behaviors:

- Skilled based behavior is shown when performing skills. It is based on practice and prior learning to become part of
motor programs. Reactions are mostly unconscious and automatic.
Errors associated with such behavior are known as routine errors:
o Environmental capture
o Action slip
- Rule based behavior requires a bit more thinking still can be done fairly fast and automatic.
Errors associated with such behavior are:
o Commissions (doing something that should not have been done)
o Not following the rules right
o Violations
o Interruptions
- Knowledge based behavior requires the highest level of thinking and attention. It comes from unfamiliar situations and
need to use recall stuff from long term memory.
Errors associated with such behavior is: Confirmation bias

Short term memory:

- Store up to 7 digits
- Very sensitive to interruptions
- Limited size
- Information is lost in about 30 seconds if not placed into long term memory

Human error and reliability

3 main sources of external error generation in the cockpit:

- Ergonomics
- Economics
- Social environment

Different categories of errors [James Reason]:

- Slips: occur as the result of minor errors of execution (correct execution of a wrong procedure).
- Lapses: occur when a pilot becomes distracted and doesn’t complete a task or omits a step whilst performing it.
- Mistakes/Faults
- Violation

Error management and strategies: [PReDaToR - PRDTR]

- Error Prevention
- Error Reduction
- Error Detection
- Error Tolerance
- Error Recovery

Active errors: produced by the operator (pilot, ATC,…), has an immediate effect and can be rapidly detected

Positive stress: the perceived demand is ≤ than the perceived ability (it’s difficult but I know I have the ability to do it)

Negative stress: the perceived demand is ≥ than the perceived ability (I don’t think I have the competency to do it)
Decision making

Stages of decision making: [DPDAF]

- Detection
- Perception
- Decision
- Action
- Feedback

DECIDE model:

- Detect
- Estimate
- Choose
- Identify
- Do
- Evaluate

Risky shift: group decisions are riskier than individuals on their own because blame will be “shared”

Avoiding and managing errors: cockpit management

Communication uses up resources, thus limiting the resources allocated to work in progress.

Metacommunication: aids, other than actual words, which complement those words in order to communicate

Non-assertive personality: a reluctance or inability to express one's needs, opinions, and desires in a direct and assertive
manner. Individuals often exhibit submissive or passive behavior, avoiding confrontation and prioritizing the needs of others
over their own.

Followership: openly express any uncertainties or anxieties without delay. When asked for your point of view, provide it
fully and clearly, without worrying about whether it aligns with others' expectations.

Groupthink: occurs when a group of individuals reaches a consensus without critical reasoning or evaluation of the
consequences or alternatives.

Behavior of a group can be affected by:

- Persuasion
- Conformity
- Compliance
- Obedience

3 types of authority gradient in the cockpit:

- Autocratic
- Laisser-faire
- Synergistic

Checklists should be not done simultaneously with other actions. Pages should be divided by protruding thumb-locators.

SOP are an effective aid to decision making for the flight crew, reducing their workload and reducing the probability of
taking poor decisions and making errors. They are performed as skill-based and rule-based behaviors.

Arousal: readiness of the mind and body for action. Also the degree of activation of the central nervous system

Intrapersonal: A conflict within oneself.

Interpersonal: A conflict between two or more people.

Cooperation: joining forces for a common purpose.

Coaction: each person carries out their assigned part

Main objectives of CRM and MCC training:

- Cross checking and monitoring

- Communication
- Leadership
- PF and PM concept

Hazardous attitudes:

- Anti-authority
- Impulsivity
- Invulnerability
- Macho
- Resignation

Attitudes are the product of personal disposition and past experience with reference to an object or a situation.

Habits change with the change in behavior

Motivation affects the direction and intensity of a person’s behavior

Stress: the response to unfavorable environmental conditions and how the body reacts to demands placed upon it

Main categories of stressors are:

- Environmental
- Domestic
- Organizational | Occupational
- Psychological
- Physiological

Experiencing an acute stressor during flight, auditory information is discarded first

If a stressful situation cannot be changed, to reduce the emotional and physiological impact of stress, cognitive coping
should be used. This involves identifying negative thoughts, behaviors and situations where stress occurs and making the
conscious effort to change the way of thinking about a situation.

Short term fatigue effect (acute):

- Tiredness and failing asleep for short periods without being aware
- Reduced concentration and vigilance
- Increased error rate and slowed reaction times
- Increased irritability

Long term fatigue effects:

- General reduction in performance

- Inability to sleep
- Increase in physiological and mental health problem

Fatigue Risk Management System (FRMS) is a data driven means of monitoring and managing fatigue related safety risk
and can be different for every employer.

Stress exposure training (SET) is a long-term stress management method that can improve performance in flight operations
if integrated in a continuous professional training program.

Blinkered attention: concentrating on a particular aspect of a system instead of monitoring the whole system

Passive monitoring: watching what is going on rather than analyzing and constantly checking

Mode awareness: be aware of the automation mode under which the aircraft is operating and understand the interaction
between a mode of automation and a particular phase of flight or pilot input
Irony of automation:

- Irony 1: Designers are human too  humans are not removed from the system
- Irony 2: Tasks that are not automated rely on humans
- Irony 3: The human may have to take over if the system fails