The SHELL Model

It is a framework describing how the flight crew (Liveware) interacts with different components in the
aviation system.
The word SHELL is an acronym:

1. S → Software

o Refers to non-physical systems:

 Procedures
 Checklists
 Manuals
 Charts, symbology, SOPs
o Errors in software (like unclear checklists) can cause confusion.

2. H → Hardware

o The physical equipment:

 Cockpit layout
 Seats
 Instruments and displays
 Switches, levers, flight controls
o Poor ergonomics or design can increase workload and errors.

3. E → Environment

o The operating conditions:

 Aircraft environment (noise, vibration, lighting)
 Weather
 Airspace and ATC structure
 Runway/airport design
o Stressful environment affects crew performance.

4. L → Liveware

o The human element = the pilot/flight crew.

o Center of the model → everything interfaces with humans.
o Includes factors like fatigue, stress, workload, decision-making.

5. L–L → Liveware/Liveware interface

o The interaction between humans:

 Cockpit crew coordination (CRM – Crew Resource Management)
 Communication with ATC, engineers, cabin crew.
o Miscommunication is a major cause of incidents.
Purpose of SHELL Model

 Shows that safety depends on smooth interfaces between people, machines, software, and
environment.
 If there is a mismatch (e.g., poor checklist design, bad cockpit layout, ATC misunderstanding),
errors occur.
 Guides aviation safety training, ergonomics, and CRM.
In short:

 Liveware (pilot) is central.

 S, H, E, L are all interfaces that must be well-matched.
 Any weak interface can become the cause of human error in aviation.
Examples of SHELL Components

 Hardware (H):
Example → 3-pointer altimeter

o Human error can arise if the altimeter design is hard to read (e.g., misreading altitude by
1,000 ft).

o Shows how cockpit layout, controls, and instruments affect human performance.

 Software (S):
Example → Memory mismatch

o Refers to non-physical systems (procedures, SOPs, checklists).

o If procedures are poorly designed or not aligned with human memory capacity, errors
result.

 Environment (E):
Example → Biological sleep/wake cycle

o Fatigue due to circadian rhythm mismatch.

o External factors like lighting, noise, or temperature also influence performance.

 Liveware (L):
Example → Eating and drinking habits

o Human physical/psychological condition affects alertness, concentration, hydration.

o Central to SHELL because the human is at the core.

Interfaces (Human + Other Elements)

1. Liveware–Hardware (humans and machines)

 o Example: Pilot using instruments, flight controls.
o Poorly designed equipment can confuse or fatigue the pilot.
o Misreading 3-pointer altimeter = Liveware–Hardware mismatch.
2. Liveware–Software (humans and procedures/manuals)

o Example: Using a checklist or memory items.

o If checklist is too complex or not user-friendly → error risk.
o Memory mismatch = Liveware–Software issue.

3. Liveware–Liveware (humans and colleagues)

o Example: Cockpit Resource Management (CRM), ATC-Pilot communication.

o Miscommunication or poor teamwork → errors.
o Example: misunderstanding ATC clearance.

4. Liveware–Environment (humans and surroundings)

o Example: Weather, fatigue, sleep cycle, noise, lighting.

o Harsh environment → stress or misjudgment.
o Sleep/wake cycle disruption = Liveware–Environment issue.
In summary:

 SHELL = central human (Liveware) interacting with Hardware, Software, Environment, and
other Liveware.
 Accidents often come from interface mismatches (bad design, poor communication, fatigue,
faulty procedure).

Memory & Information Processing

1. Short-term (working) memory — “~7 items for ~20 s.”

o Working memory is the scratchpad you use to hold about 7 chunks (±2) for ~15–30 s.
o It’s fragile: distraction, radio calls, or task switching can erase it.
o Example: Holding a taxi route or frequency long enough to read it back.

2. Long-term memory — “remember a clearance long enough to write it down.”

o Long-term memory stores skills and knowledge (SOPs, flows, limitations).

o In practice, you keep a clearance in working memory to write it down; repeated use and
rehearsal then consolidate it into long-term memory so you can recall it later without
notes.

3. “The first stage of information processing is sensory stimulation.”

o Information first hits the sensory registers: vision (instruments/outside), hearing (ATC),
touch (control forces).
 o Only what you attend to moves forward to working memory.

4. “Long-term memory is essential to pilot expertise; pre-activate it.”

o Experience lives here (checklists, memory items, callouts).

o Pre-activation/priming = briefings, chair-flying, mental rehearsal—so the right
knowledge is already ‘warmed up’ when needed (e.g., go-around callouts).

Stress & Performance

5. “Stress occurs when the pilot must revise the plan and has no immediate solution.”

o Stress = perceived mismatch between demands and resources/time (unexpected weather

change, abnormal).

o Uncertainty and time pressure spike workload.

6. “A moderate level of stress may improve performance.”

o Yerkes–Dodson principle: a moderate arousal sharpens focus and reaction—especially

for well-practiced tasks. Too little = sluggish; too much = errors.

7. “Stress promotes physical strength rather than mental performance.”

o The fight/flight response boosts heart rate and muscle readiness, but can narrow attention,
degrade working memory, and impair fine motor control/decision-making.

Typical signs of an overstressed pilot

 Mental blocks/confusion/frustration/rage → cognitive overload.

 Deterioration in motor coordination → shaky hand-flying, fumbled switches.
 High-pitch/fast speech → sympathetic activation, poor radio discipline.
“Accident rate ~1 per million movements.”

 A “movement” = one takeoff or landing. It highlights that commercial aviation risk is very low—
but non-zero—so human-factors defenses matter.

Motor Programs & Skill Learning

8. Motor program — “central representation that organizes many degrees of freedom.”

o A motor program is the brain’s stored plan for a movement sequence (hands, eyes, feet)
so you don’t micromanage every muscle.
o Example: Your before-landing flow or the flare becomes a smooth, pre-wired action.

Stages of motor learning

 9. Cognitive stage (What to do?)

o You’re figuring out steps and goals; high mental effort; many errors.
o Example: Early ILS approaches—heavy checklist dependence.

10. Associative stage (How to do it better?)

o Movements become smoother, errors drop, you use feedback to refine.

o Example: Hand-flying holds altitude within ±100 ft consistently.

11. Autonomous/Automatic stage (Do it fluidly.)

o Skill runs mostly automatically, freeing attention for monitoring and threats.
o Watch-out: habit capture/complacency—always back it with SOPs and callouts.

G-Forces & Vision

12. Grey-out — “+3 to +4 g; tunnel vision; blood flows to legs.”

o Positive Gz (head-to-foot) pulls blood downward → less blood to the retina/brain.

o Vision dims/greys, tunnel vision may occur; hearing may dull.
o Countermeasures: Anti-G straining, G-suit, avoid abrupt pull-ups.

13. Blackout — “above ~+5 g; loss of consciousness.”

o Cerebral blood flow drops enough to cause G-LOC (G-induced Loss Of Consciousness).
o Tolerance varies (training, hydration, G-suit, body position).

14. Red-out — “blood pools in brain/eyes.”

o Negative Gz (foot-to-head) drives blood upwards → eyes engorge; vision can look
reddish; severe cases risk retinal damage.
o Humans tolerate negative G poorly (often only around –2 to –3 g).

MCQs (SET 1)

Q1. In the SHELL model, the central element is:

a) Hardware
b) Software
c) Liveware
d) Environment

Q2. Misreading a 3-pointer altimeter is an example of mismatch in:

a) Liveware–Environment
b) Liveware–Software
c) Liveware–Hardware
d) Liveware–Liveware

Q3. A confusing checklist is an example of:

a) Liveware–Environment mismatch
b) Liveware–Software mismatch
c) Liveware–Hardware mismatch
d) Liveware–Liveware mismatch

Q4. Fatigue due to circadian rhythm disruption is linked with:

a) Liveware–Software
b) Liveware–Hardware
c) Liveware–Environment
d) Liveware–Liveware

Q5. Crew miscommunication leading to error is a failure in:

a) Liveware–Liveware
b) Liveware–Hardware
c) Liveware–Software
d) Liveware–Environment

Q6. Which SHELL component includes weather and airspace structure?

a) Liveware
b) Software
c) Hardware
d) Environment

Q7. Which SHELL element does “eating and drinking habits” fall under?
a) Environment
b) Software
c) Liveware
d) Hardware

Q8. Which SHELL component includes manuals and SOPs?

a) Hardware
b) Software
c) Environment
d) Liveware

Q9. Poor cockpit ergonomics belong to:

a) Hardware
b) Liveware
c) Environment
d) Software

Q10. Which interface mismatch best explains an ATC misunderstanding?

a) Liveware–Software
b) Liveware–Hardware
c) Liveware–Liveware
d) Liveware–Environment

Q11. Runway lighting and airport layout fall under:

a) Environment
b) Hardware
c) Liveware
d) Software

Q12. Misinterpretation of symbology on a chart is:

a) Liveware–Environment
b) Liveware–Hardware
c) Liveware–Software
d) Liveware–Liveware

Q13. Which SHELL interface is most affected by CRM training?

a) Liveware–Software
b) Liveware–Liveware
c) Liveware–Environment
d) Liveware–Hardware

Q14. SHELL model highlights:

a) Only equipment issues
b) Interaction between human and all system elements
c) ATC procedures only
d) Only environmental stress

Q15. SHELL mismatches often lead to:

a) Human error and accidents
b) Better performance
c) Mechanical failures only
d) Reduced training

Q16. Short-term memory can hold about:

a) 20 items, 7 minutes
b) 7 items, 20 seconds
c) 5 items, 5 minutes
d) 10 items, 1 hour

Q17. Holding a taxi clearance until you write it down uses:

a) Long-term memory
b) Short-term memory
c) Sensory memory
d) Motor program
Q18. Knowledge of SOPs and flows is stored in:
a) Long-term memory
b) Short-term memory
c) Sensory buffer
d) Working memory

Q19. First stage of information processing is:

a) Working memory
b) Long-term memory
c) Sensory stimulation
d) Motor program

Q20. Pre-activation of memory is achieved by:

a) Ignoring SOPs
b) Briefings and mental rehearsal
c) Fatigue and stress
d) Seat-of-pants flying

Q21. Stress occurs when:

a) Pilot must revise plan without immediate solution
b) Pilot has too much free time
c) ATC provides accurate clearance
d) Aircraft is in stable cruise

Q22. Moderate stress can:

a) Always degrade performance
b) Never affect pilot
c) Improve performance (Yerkes–Dodson law)
d) Eliminate errors completely

Q23. Stress response improves:

a) Physical strength more than mental performance
b) Long-term memory
c) Decision-making
d) Instrument scan

Q24. Confusion, frustration, and motor deterioration are signs of:

a) Normal workload
b) Overstress
c) Good performance
d) Sensory overload only

Q25. Accident rate in commercial aviation is about:

a) 1 in 100 flights
b) 1 in 10,000 flights
c) 1 in 1,000,000 movements
d) 1 in 100,000 movements

Q26. Working memory is fragile because of:

a) Training
b) Distraction and task switching
c) Sleep
d) Fatigue only

Q27. Long-term memory requires consolidation by:

a) Fatigue
b) Practice and rehearsal
c) Sleep deprivation
d) Distraction

Q28. Sensory register includes:

a) CRM and ATC
b) Vision, hearing, touch
c) Long-term knowledge
d) Stress hormones

Q29. Motor program is:

a) Central plan organizing many degrees of freedom in movement
b) Short-term memory process
c) Stress response
d) G-force effect

Q30. Example of motor program in pilots:

a) Flare during landing
b) Reading a checklist
c) Weather forecast
d) Filing a flight plan

Q31. In cognitive stage, learner:

a) Has smooth skills
b) Thinks through steps, makes errors
c) Performs automatically
d) Uses no feedback

Q32. Associative stage is marked by:

a) Errors increase
b) Refined movements, smoother performance
c) Zero feedback
d) Automaticity

Q33. Autonomous stage means:

a) Skill is mostly automatic, freeing mental resources
b) Errors are very frequent
c) No learning possible
d) Stress always occurs

Q34. Danger in autonomous stage is:

a) Skill decay
b) Complacency and habit capture
c) Excess errors
d) Poor feedback

Q35. Motor programs free up:

a) Long-term memory
b) Attention for monitoring and decision-making
c) Stress
d) Environment

Q36. Example of cognitive stage:

a) Early ILS approaches with heavy checklist dependence
b) Flare automatic
c) Smooth coordination
d) CRM error

Q37. Example of associative stage:

a) Holding altitude within ±100 ft after practice
b) Misreading altimeter
c) Seat-of-pants disorientation
d) Red-out

Q38. Example of autonomous stage:

a) Executing flows and callouts automatically
b) Forgetting checklists
c) Struggling to hold heading
d) Altimeter mismatch

Q39. Grey-out occurs at:

a) +1 g
b) +3–4 g
c) +5 g
d) –2 g

Q40. Grey-out is due to:

a) Blood to brain
b) Blood pooling in legs, less to retina/brain
c) Oxygen overload
d) High altitude
Q41. Blackout usually occurs above:
a) 2 g
b) 3 g
c) 5 g
d) 7 g

Q42. Blackout is:

a) Stress reaction
b) Loss of consciousness due to lack of brain blood flow
c) Red-tinged vision
d) Memory loss

Q43. Red-out is caused by:

a) Positive Gz
b) Negative Gz (blood to head/eyes)
c) Zero-G
d) Fatigue

Q44. Red-out causes:

a) Vision loss by grey
b) Reddish vision, possible retinal damage
c) Black tunnel vision
d) Mental confusion only

Q45. Human tolerance to negative G is about:

a) –5 g
b) –6 g
c) –2 to –3 g
d) 0 g

Q46. Anti-G straining maneuver prevents:

a) Red-out
b) Grey-out and blackout
c) Stress
d) Fatigue

Q47. Which is most dangerous in aerobatics?

a) Grey-out
b) Blackout
c) Red-out (retinal risk, poor tolerance)
d) Stress

Q48. G-LOC stands for:

a) General Loss of Control
b) G-induced Loss of Consciousness
c) General Lack of Consciousness
d) Gravity Lockout Condition

Q49. Tunnel vision is a symptom of:

a) Stress
b) Grey-out
c) Red-out
d) Memory mismatch

Q50. Which factor increases G tolerance?

a) Fatigue
b) Alcohol
c) Training, hydration, G-suit
d) Sleep deprivation

Detailed Answer Explanations

Q1. Central element in SHELL = Liveware (c).

 The model places the human (pilot) at the center interacting with Software, Hardware,
Environment, and other Liveware.

Q2. Misreading 3-pointer altimeter = Liveware–Hardware mismatch (c).

 The error comes from difficult instrument design (hardware).

Q3. Confusing checklist = Liveware–Software mismatch (b).

 Software refers to procedures/manuals.

Q4. Fatigue from circadian rhythm = Liveware–Environment (c).

 Biological sleep cycle is influenced by environmental demands (night flying).

Q5. Crew miscommunication = Liveware–Liveware (a).

 Interaction between people: pilots, ATC, engineers.

Q6. Weather/airspace are part of Environment (d).

 They shape operating conditions.

Q7. Eating/drinking habits = Liveware (c).

 Part of human physiology/behavior.

Q8. Manuals/SOPs = Software (b).

  Non-physical, procedural systems.

Q9. Poor cockpit ergonomics = Hardware (a).

 Physical design affects pilot use.

Q10. ATC misunderstanding = Liveware–Liveware (c).

 Human-to-human miscommunication.

Q11. Runway layout/lighting = Environment (a).

 External conditions in which pilot operates.

Q12. Misreading symbology on chart = Liveware–Software (c).

 Because charts are software.

Q13. CRM improves Liveware–Liveware (b).

 Enhances communication & teamwork.

Q14. SHELL highlights human–system interaction (b).

 Not just equipment but all interfaces.

Q15. Mismatches in SHELL → human error/accidents (a).

 Most accidents result from poor interface.

Q16. STM holds ~7 items for 20 s (b).

 Classic “7 ± 2 rule” by Miller.

Q17. Holding taxi clearance before writing = short-term memory (b).

 Temporary retention until recorded.

Q18. SOP knowledge stored in long-term memory (a).

 Stable storage of expertise.

Q19. First processing stage = sensory stimulation (c).

 Vision, hearing, touch before memory.

Q20. Pre-activation = briefing/mental rehearsal (b).

 Activates relevant knowledge ahead of time.

Q21. Stress occurs when plan revision has no immediate solution (a).
  Mismatch between demands and resources.

Q22. Moderate stress can improve performance (c).

 Yerkes–Dodson law: inverted U curve.

Q23. Stress response favors physical strength, not mental performance (a).

 Adrenaline enhances muscles but narrows thinking.

Q24. Confusion/frustration = overstress (b).

 Too much workload → breakdown in performance.

Q25. Accident rate ≈ 1 per million movements (c).

 ICAO/ICA statistics.

Q26. Working memory is fragile due to distraction/task switching (b).

 Any interruption erases content.

Q27. Long-term memory requires practice/rehearsal (b).

 Consolidation strengthens neural pathways.

Q28. Sensory register = vision, hearing, touch (b).

 Input channels before processing.

Q29. Motor program = central plan for movement (a).

 Organizes complex multi-muscle tasks.

Q30. Example: flare during landing (a).

 Automatic sequence of control.

Q31. Cognitive stage = thinking, errors (b).

 Learner figuring out steps.

Q32. Associative = refined movement with feedback (b).

 Practice reduces errors.

Q33. Autonomous = automatic skill, frees attention (a).

 Little conscious thought.

Q34. Risk in autonomous = complacency/habit capture (b).

  Actions become automatic → risk of skipping checks.

Q35. Motor programs free attention for monitoring (b).

 So pilot can focus on big picture.

Q36. Example of cognitive = early ILS with heavy checklist use (a).

 Still consciously learning.

Q37. Example of associative = holding altitude ±100 ft (a).

 Practiced skill with refinement.

Q38. Example of autonomous = flows/callouts automatic (a).

 Performed without thinking.

Q39. Grey-out at +3–4 g (b).

 Vision dims, tunnel effect.

Q40. Grey-out cause = blood pooling in legs → less to retina/brain (b).

 Reduced ocular perfusion.

Q41. Blackout above +5 g (c).

 Brain blood flow insufficient.

Q42. Blackout = loss of consciousness (b).

 Brain deprived of oxygen.

Q43. Red-out = negative Gz, blood to head (b).

 Eyes engorge.

Q44. Red-out effect = reddish vision/retinal risk (b).

 Vessels congest, vision tinted red.

Q45. Negative G tolerance ≈ –2 to –3 g (c).

 Humans poorly tolerate negative G.

Q46. Anti-G straining prevents grey-out/blackout (b).

 Not useful for red-out.

Q47. Most dangerous in aerobatics = red-out (c).

  Can cause retinal damage and very low tolerance.

Q48. G-LOC = G-induced Loss of Consciousness (b).

 Not “General Loss of Control.”

Q49. Tunnel vision = grey-out (b).

 Peripheral vision fades first.

Q50. G tolerance improved by training, hydration, G-suit (c).

 Fatigue/alcohol lower tolerance.

MCQs (SET 2)
Question 1
“Accidents and engineering faults are …”
A. Insignificant and decreasing
B. Significant and increasing
C. Insignificant and increasing
 Answer: B — “significant and increasing”
Explanation: This is from the DGCA / EASA Module 9 human factors syllabus. CAP 715 / CAP
716 refer to the role of human error and maintenance contributions to accidents, which remain
significant and rising in influence.

 Question 2
“Murphy’s law is perpetuated mainly by …”
A. Violations
B. Poor aircraft design
C. Complacency
 Answer: C — “complacency”
Explanation: In DGCA human factors materials, Murphy’s Law (“anything that can go wrong
will”) is often tied to complacency—assuming things will go right leads to overlooking details.

 Question 3
“Which of the following sentences concerning crew performance is correct?”
A. The quality of crew performance is not dependent on the arousal level of the individual
B. Mistakes can always be detected and corrected by the individual, hence too much practice is
not needed
C. The quality of crew-performance depends on the practice done to improve reliability
 Answer: C
Explanation: This aligns with human factors teaching that training, rehearsal, and proficiency are
essential in reducing human error and improving crew performance.

 Question 4
“The risk of spatial disorientation increases when …”
A. The pilot is buckled tightly to their seat and cannot sense attitude changes by seat-of-pants
sense
B. The pilot is performing an effective instrument cross-check and is ignoring illusions
 C. There is contradictory information between the instruments and the vestibular organs
D. Information from the vestibular organ in the inner ear is ignored
 Correct answer: C — “There is contradictory information between the instruments and the
vestibular organs”
Explanation: Spatial disorientation arises when sensory inputs conflict (e.g., vestibular vs.
instrument). When the vestibular senses disagree with instrument readings, the brain can become
confused and the risk of disorientation increases.