SHELL Model
After the publication of the Staines crash report, Dr. Elwyn Edwards wrote a paper and presented his new model at the British Airlines Pilots Association, Outlook for safety. Man and Machine: systems for safety. This new model explained the interactions and complexities that surround significant events - known as the SHELL model (Figure 6.2).
Figure 6.2 illustrates the SHELL model and indicates that the human in the centre of the diagram, shown as 'Liveware' (Figure 6.2, centre box), has
FIGURE 6.2
SHELL Model, Dr Elwyn Edwards (1972.) various interactions with four other components. The principal assumption is that an accident is not a single event, but rather a series of events and interactions, and this new concept was used to explain the Staines crash.
Humans are considered complex, and we base our performance on multiple factors; thus, if sufficient negative events take place, a significant negative outcome would be possible in an aviation context. Basically, as a professional flight crew member (in the centre box), they will have interactions with Software, Hardware, Environment and Liveware. A brief description of each of these SHELL elements is as follows:
Liveware (box 1) represents the dynamic interactions with the subject to other staff in the context of the company. In an aviation context, this would include other pilots, ground staff, engineers, cabin crew, etc. Clearly, the Keys Liveware-Liveware links with other colleagues were ineffective, as demonstrated with the violent argument witnessed by other employees of the BEA. Additional evidence of such a breakdown is the graffiti found in both the crashed aircraft and operational aircraft, where fellow staff felt it acceptable to write strong-worded language detrimental to Key's character, such was the depth of feeling.
Software (box 2, Figure 6.2) represents the rules, requirements and regulations that are present in any employment. This would include company procedures; navigation data, including charts; policies, etc. In summary, Software is the non-physical aspects that define how activities and systems are organised. An underlying factor for this accident would be the noise abatement procedure (to retard the power levers as the aircraft passes over the perimeter fence). Another factor would be Key's strong dislike of strikes, along with him using his rank and seniority to force his beliefs on others.
Hardware (box 3, Figure 6.2) represents the physical aspects of aviation, such as type of aircraft; the flight controls (including the ergonomics); all the machine systems fitting within the aircraft, etc. A limitation of the Trident aircraft is the two separate levers that control the leading edge and trailing edge flaps, as both levers are required to be operated separated after take-off at the correct time, to ensure the aircraft performs correctly. It could also be argued that the ergonomic design of the lever in question is flawed. Post-Second World War, the end of the landing gear lever was redesigned to resemble a wheel. When selecting landing gear up or down, the pilot would feel for the distinct shape. The levers for the edge flaps also resembled wheels - clearly this similar experience was not considered by the Original Aircraft Manufacturer at the time of certification.
Environment (box 4, Figure 6.2) explains the physical conditions in which pilots work, such as temperature, humidity, pressurisation, noise, vibrations, etc. Additionally, political and social impact variables could also be included to represent the traumatic changes in society that have a bearing.
In addition to the four S, H, E, L components, the interactions between the centre box 'Us' and each of the four was proposed by Edwards as a boundary condition, and these boundaries and components are useful to explain human complex aviation accidents. Edwards's SHELL model was very appropriate for identifying the long list of contribution factors that were highlighted as causes in both the AIB findings and the subsequent government inquiry.
The SHELL model is very useful for analysing factors in complex aircraft accidents, providing explanations of how multi-layered interactions come together to form a complex failure. However, the model does not provide mitigation - such as a safety net that would allow a member of the flight crew to prevent the next Staines accident. As with all models, new versions were subsequently developed, with these allowing for alternate evaluations and a means of evaluating mitigation.
The Impossible Accident - Tenerife, 1977
Much of the worlds' aircraft fleet insurance is underwritten in some form through the Lloyds of London (UK) insurance market. In the early 1970s, the insurance market recognised the aviation risks and as a matter of course, considered worst-case accidents. The introduction of the Boeing B747 aircraft resulted in a new aircraft that can carry up to 550 passengers in a single 'economy' class configuration. The Insurance Underwriters in the Lloyds of London insurance market considered (prior to 1977) that the worst possible aviation accident scenario imaginable would be two B747s colliding with a total loss of the aircraft and passengers - and thus it was considered an impossible accident. Unfortunately, as history will demonstrate, the impossible worst-case events imaginable can occur.
The Tenerife accident occurred on 27 March 1977 on the Spanish Island of Tenerife in the Atlantic Ocean. Two passenger B747s collided at Los Rodeos airport (now known as Tenerife North Airport), one aircraft was KLM flight number 4805 and the other Pan Am flight number 1736. In total, 583 persons perished in the world's worst accident disaster, with a mere 61 passengers surviving the ground impact in the Pan Am aircraft. There were no survivors in the KLM aircraft. The view of the airport approach in recent times is shown as Figure 6.3.
The general background to this accident is interesting, as the events differ significantly from the Staines accident and thus the SHELL model is not as useful in terms of analysis.
In the early afternoon of 27 March, a terrorist organisation seeking independence planted a bomb at the main islands' airport, at the time known
FIGURE 6.3
Tenerife Airport Los Rodeos Airport on approach. (Ismael Jorda.)
as Las Palmas Airport (now Gran Canaria International Airport) which caused it to close immediately. All incoming flights were diverted from the Las Palmas, as per standard security protocols. Los Rodeos airport is located on the same island of Tenerife, so it seemed like a good diversion airfield. Unfortunately, Los Rodeos was a much smaller airport than the main airport (see Figure 6.3), and as such was not prepared for the high levels of traffic, having had very little preparation time further to the security bomb alert. Los Rodeos airport had no ground radar coverage, and under good weather conditions that would not necessarily be an issue, except on the day in question thick fog was moving in patches, which impeded visibility. There were lots of diverted aircraft at this small airport on the day in question, and the arrivals of large B747s complicated the ground movements significantly as other aircraft were obstructed by the much larger B747 aircraft.
The KLM aircraft that was at Los Rodeos airport was delayed, in part due to a lengthy refuelling activity. Additionally, KLM as an airline had recently introduced new directives for their pilots to limit their duty times, to prevent pilots from operating too long and being fatigued. The KLM flight crews were keen to load fuel, passengers, and take-off. The complication was the crews recognised that their duty time was going to be exceeded if they failed to take-off. The KLM PI Captain, Veldhuyzen van Zanten, was a very senior member of the KLM flight operations staff, holding the rank of Chief Flight
Instructor, and spent much of his duties in the flight simulators for KLM, conducting flight assessments. These flight simulation assessments in practice meant that Zanten was controlling the flight simulators for his students, in addition to playing the role of Air Traffic Control (АТС). What is relevant here is Zanten's in-simulator use of non-standard phraseology and take-off procedures. The question that arises from this non-standard phraseology and take-off procedure is: who in the airline is correcting the Chief Flight Instructor's deviation from agreed practice? The KLM First Officer and Flight Engineer were also very experienced professionals with significant total recorded flight times, being in their 40s. The First Officer had only 95 recorded type hours on the B747 variant, but this was offset with 9,200 total flight hours.
The Pan Am flight crew had changed at Los Rodeos (unlike the KLM crews), and the Pan Am crew, comprising the Captain, First Officer and Flight Engineer were equally experienced in terms of total flight hours and type hours.
Another significant factor in this event was the departure of both aircraft from the stand, as illustrated in the simplified Figure 6.4.
The Pan Am flight (Figure 6.4 - Diamond shaped icon) was unable to depart off stand because the apron was full of other parked aircraft, and the KLM aircraft (Figure 6.4 - Triangle shape icon) was delayed by the fuelling activity. When KLM departed from the stand, the KLM taxied onto the active runway for the full length, and performed a 180° turn, in order to use the whole runway for the subsequent take-off. As the KLM aircraft departed onto the runway to position for departure, the Pan Am flight followed the KLM lead aircraft. АТС instructed Pan Am to depart from the runway when they reached exit 3, and then to continue via the taxiway, thus allowing the KLM aircraft to depart unimpeded. The weather was poor on the day in question, with lots of thick ground fog and cloud coverage, and coupled with this АТС had no ground radar to monitor the aircraft or vehicle movements.
FIGURE 6.4
Simplified map of Los Rodeos airport showing the aircraft and the approximate point of impact on the runway.
The Pan Am aircraft, while taxiing on the active runway, missed the difficult 148° turn off the runway for exit 3 (due to impeded visibility), and attempted to remedy the ground navigation failure by seeking to depart the active runway at the next exit, 4. The KLM aircraft was already at the end of the runway, ready to start the take-off roll. The heavily reduced visibility due to fog continued, and neither of the aircraft could see one another. АТС was relying exclusively on giving radio instructions for all ground movements.
The KLM aircraft, keen to depart, commenced the take-off roll. Communication between АТС and aircraft had been unclear. ATCs spoken English was poor and the instructions to the aircraft contained non-standard commands. The First Officer of the KLM flight queried the take-off clearance, and АТС responded with the climb routing information, but included the term 'after take-off.... ' in the instructions. The KLM aircraft started the take-off roll and, during the read-back of instructions, included the words ‘we are now at take-off. АТС responded with 'Standby for take-off, I will call you.' However, due to heterodyne, a phenomenon where two radio stations transmit on the same frequency simultaneously, the KLM aircraft were unable to hear the other station's transmissions.
While the KLM aircraft started the take-off roll, the Pan Am aircraft desperately tried to radio the tower to inform all users they were still on the active runway. In the ensuing seconds, both the KLM and Pan Am crews realised the full scale of the impending danger, but as the KLM aircraft was taking- off the aircraft only had around 4 seconds to react, and attempted to rotate. Unfortunately, the KLM aircraft impacted the rear section of the Pan Am aircraft, killing the rear Pan Am passengers. The KLM aircraft then crashed to the ground, killing all occupants.
In total, 61 passengers and crew located at the front of the Pan Am aircraft were able to escape from the damaged plane, although the ensuing postcrash fire claimed many lives.
