SHELL Model Interface Errors

The following real-life aviation accident examples are the result of errors or mismatches at SHELL model interfaces.

Liveware-Software

• On December 20, 1995 Tower Air flight 41, a B747, lost control while taking off in snowy weather and slippery runway conditions at John F Kennedy International Airport, New York. A contributory factor was inadequate B747 slippery runway operating procedures (Dismukes, Berman & Loukopoulos, 2007 1).

• On March 22, 1992 USAir flight 405, a Fokker F-28 jet, stalled and crashed while taking off at LaGuardia Airport in New York as a result of ice contamination on the airplane's wings. A probable cause was that the crew had not been provided with adequate procedures to detect wing icing compatible with departure delays in icing conditions (Dismukes et al., 2007 1).

• In 1984, a DC-10 overran the runway at John F Kennedy Airport in New York. A probable contributory factor was excessive reliance on automation by the operator (ICAO, 2002 3).

• In 1980, the Tri-Star accident at Riyadh resulted in a number of fatalities when passengers and crew died from the effects of a cargo fire because the flight crew spent too much time looking through documentation for the aft cargo smoke warning procedure (Green, Muir, James, Gradwell & Green, 1996 2). This accident highlights the need for good information accessibility in manuals.

• On May 25, 1979 American Airlines flight 191, a DC-10, crashed during take-off from Chicago O'Hare Airport because the engine and pylon assembly tore loose from the airplane. The probable cause was improper maintenance procedures used by maintenance engineers that created fatigue cracking and fractures on the engine pylon (Reason, 1997 6).

• On December 1, 1974 TWA flight 514, a B727, crashed in Virginia while descending in instrument meteorological conditions. A probable cause was the flight crew's decision to descend to 1,800 feet prior to reaching the approach segment where minimum altitude applied. The reason for this decision may be explained by an apparent deficiency in the approach chart used by the crew where the profile view did not portray minimum altitudes. Further explanation is provided by inadequacies and lack of clarity in air traffic control procedures (O'Hare & Roscoe, 1990 5).

Liveware-Hardware

• On February 1, 1994 Simmons Airlines flight 3641, a Saab 340B turboprop, performed an emergency power-out landing after a dual-engine flame-out at False River Air Park, Louisiana. A probable cause was the design of the airplane's power levers that allowed the operator to move the levers into the beta (ground operating) range while in flight, below the flight idle position (Dismukes et al., 2007 1).

• In 1983 an Airbus A300 accident occurred in Kuala Lumpur, Malaysia. The accident report suggests that variations in panel layout among the aircraft in the fleet had adversely affected flight crew performance and played a part in the occurrence (ICAO, 2002 3).

• In January 1982 a B737 crashed in Washington D.C. A contributory factor was that engine-related displays presented information in a manner that confused the pilots (Strauch, 2004 7).

• On September 11, 1974 Eastern Airlines flight 212 crashed short of the runway at Charlotte, North Carolina. A contributory cause was that the flight crew ignored the terrain warning alarm, possibly because it was regarded as more of a nuisance than a warning (O'Hare & Roscoe, 1990 5).

• During the 1970s the DC-9 type aircraft was involved in a number of mid-air collisions where pilot visibility of external traffic was obstructed by window supports in windshield design (O'Hare & Roscoe, 1990 5). For example, the mid-air collision between a British Airways Trident and an Inex-Adria DC-9 over Zagreb, Yugoslavia in 1976 was found to be caused by defective DC-9 windshield design (O'Hare & Roscoe, 1990 5).

Liveware-Environment

• On June 1, 1999 American Airlines flight 1420, an MD-80 airplane, crashed into an approach light structure after landing fast and long on the runway in thunderstorm conditions at Little Rock, Arkansas. A probable cause was the flight crew's failure to abort the approach when severe thunderstorms and associated flight operations hazards had moved into the airport area (Dismukes et al., 2007 1).

• In 1997, Korean Air flight 801, a B747, crashed during a non-precision approach landing in Guam. A contributory factor was that operators were expected to rely on rote memorisation in training and not on a deeper understanding of principles. The pilots had practiced a non-precision approach in only one repeated simulator scenario and when they executed a non-precision approach in the accident situation (that was different) they were unable to apply the same skills to the new circumstances (Strauch, 2004 7).

• On February 17, 1991, Ryan International Airlines flight 590, a DC-9, stalled and crashed while attempting to take-off from Cleveland-Hopkins International Airport. A probable cause was failure of the flight crew to detect and remove wing ice contamination that largely resulted from lack of appropriate response by the Federal Aviation Administration, Douglas Aircraft Company and Ryan International Airlines to the known critical effect that even minimal ice contamination has on the stall characteristics of the airplane type involved in the accident (Dismukes et al., 2007 1).

• On September 23, 1985 Henson Airlines flight 1517, a Beech 99 airplane, crashed during an instrument approach in Virginia. A factor that contributed to the flight crew's errors was communication difficulties associated with high ambient noise levels in the cockpit (O'Hare & Roscoe, 1990 5).

• On November 28, 1979 an Air New Zealand DC-10 flew into the side of Mount Erebus in Antarctica. One probable cause is that the crew failed to see the slopes of Erebus due to the effects of visible and invisible texture on visual perception and visual illusion caused by sector whiteout (O'Hare & Roscoe, 1990 5).

• In 1974 an incident occurred involving a British Airways B747 that was on approach to Nairobi. The aircraft was cleared to descend to 7,500 but this was incorrectly read back by the co-pilot as 5,000 feet and not corrected. The aircraft descended to 70 feet above ground before pulling up. At the time of the incident, the crew members had been on duty for 9 hours and the incident occurred during what was normally a sleep period (0500 hours) therefore flight crew fatigue and circadian rhythms probably played a part in the occurrence (O'Hare & Roscoe, 1990 5).

Liveware-Liveware

• On November 12, 1995 American Airlines flight 1572, an MD-83 airplane, struck trees on a ridge of terrain on approach to Bradley International Airport, Conneticut. A contributing factor was communication failure between the air traffic controller and flight crew where the flight crew were not provided with, nor did they ask for, current altimeter settings (Dismukes et al., 2007 1). Similarly, in January 1977, a Lear Jet 24B left Palm Springs and struck a hillside after take-off. A probable cause was the breakdown in communication between the flight crew and the air traffic controller (O'Hare & Roscoe, 1990 5).

• On July 2, 1994 USAir flight 1016, a DC-9, crashed into a residential neighbourhood shortly after encountering microburst-induced windshear during a missing approach at Charlotte/Douglas International Airport in Charlotte, North Carolina. One cause was that real-time adverse weather and windshear hazard information was not provided to the flight crew from air traffic control (Dismukes et al., 2007 1).

• On July 30, 1992 TWA flight 843, a Lockheed L-1011 airplane, sustained damage and fire as a result of a hard landing arising from a rejected take-off at John F Kennedy International Airport in New York. A probable cause was inadequate coordination between captain and first officer that resulted in an inappropriate response to a false stall warning (Dismukes et al., 2007 1).

• In December 1990, a DC-9 and a B727 collided at Detroit Metropolitan Airport. A contributory factor was the captain's reliance on an overly assertive first officer (Strauch, 2004 7).

• Captain failure to adequately respond to fellow crew member's concerns or comments and lack of co-pilot assertiveness was highlighted as a probable cause in the December 1978 accident of United Airlines flight 173 in Oregon and the January 1982 accident of Air Florida flight 90 in Washington (Keightley, 2004 4). Lack of co-pilot assertiveness also contributed to the double 747 accident at Los Rodeos Airport, Tenerife in May 1977 when a KLM B747 collided with a Pan American B747 on the runway. The KLM co-pilot did not challenge the KLM captain's incorrect belief that clearance for take-off had been given (Keightley, 2004 4).

• In 1978, an Allegheny Airlines BAC1-11 airplane overran the end of the runway at Rochester, New York. Crew coordination was a contributory factor where the first officer failed to provide required call-outs that may have alerted the captain to airspeed and sink rate deviations (O'Hare & Roscoe, 1990 5).

• In January 1977 a Japan Airlines DC-8 cargo plane crashed in Anchorage, Alaska after the captain mishandled the controls during take-off. Authority-distance was a contributory factor where the subordinate pilots failed to even attempt to prevent the alcohol-intoxicated captain from flying (Strauch, 2004 7).

• In 1972, a Lockheed L-1011 crashed into the Florida Everglades after the flight crew became preoccupied with an indicator failure and did not attend to the airplane's flight path. The flight crew failed to delegate team duties and responsibilities (Strauch, 2004 7).

References

1. Dismukes, R.K., Berman, B.A., & Loukopoulos, L.D. (2007). The limits of expertise: Rethinking pilot error and the causes of airline accidents. England: Ashgate Publishing Ltd, 2007.

2. Green, R.G., Muir, H., James, M., Gradwell, D., & Green, R.L. (1996). Human factors for pilots (2nd ed.). England: Ashgate Publishing Ltd, 1996.

3. ICAO - International Civil Aviation Organisation. (2002). CAP 719: Fundamental human factors concepts. UK: CAA, 2002. Retrieved from CAA on 12 September 2009.

4. Keightley, A. (2004). 190216 human factors study guide. Palmerston North: Massey University, 2004.

5. O'Hare, D., & Roscoe, S. (1990). Flight deck performance: The human factor. USA: Iowa State University Press, 1990.

6. Reason, J. (1997). Managing the risks of organizational accidents. England: Ashgate Publishing Ltd, 1997.

7. Strauch, B. (2004). Investigating human error: Incidents, accidents and complex systems. England: Ashgate Publishing Ltd, 2004.

Want to know more?

AviationKnowledge - SHELL Model of Human Factors

This AviationKnowledge page provides a good overview of the SHELL Model

---

Contributors to this page

Authors / Editors

MJPerry