When two pilots share a cockpit, safety depends on more than the sum of their individual skills. Each crew member continuously builds an internal picture of the aircraft's state, its trajectory, and the threats that lie ahead. When both pilots hold the same picture—the same assumptions about the clearance in effect, the same awareness of the weather building off the nose, the same understanding of who will do what if the engine quits at V1—that convergent cognitive state is called a shared mental model. The FAA's Risk Management Handbook (FAA-H-8083-2) identifies the shared mental model as a foundational element of Crew Resource Management (CRM): effective crews do not merely divide labor, they actively synchronize their cognitive frameworks so that neither pilot is ever genuinely surprised by the other's actions or decisions. For the Airline Transport Pilot certificate—and for safe multi-crew operations throughout a career—understanding how shared mental models are built, maintained, and repaired is indispensable.
What a Mental Model Actually Is
A mental model is the internal representation a pilot constructs from every available input: instrument indications, radio calls, visual cues outside the windscreen, memory of the briefing, and years of pattern recognition. It answers a continuous stream of implicit questions: What altitude are we cleared to? Which runway is active and what is our rejected-takeoff plan? Is the fuel state normal for this phase of flight? What does ATC expect next? A shared mental model exists when both the Pilot Flying (PF) and the Pilot Monitoring (PM) hold consistent, accurate answers to those same questions at the same moment. The model is never static—it must update in real time as the flight evolves—and that ongoing synchronization is precisely where multi-crew coordination either succeeds or fails.
The FAA-H-8083-2 distinguishes between individual situational awareness (SA) and shared SA. A captain can have superb personal awareness of a developing thunderstorm while the first officer's mental model still reflects the last weather picture from an hour ago. Those two pilots are not a coordinated crew; they are two individuals occupying the same airframe. Accidents have resulted from exactly this mismatch, which is why the ATP Airman Certification Standards place CRM—including the shared mental model—as a tested competency, not a soft skill left to good intentions.
Why Shared Mental Models Break Down
Model divergence is not a character flaw; it is a predictable consequence of normal cognitive limitations amplified by cockpit workload. Several mechanisms cause breakdown:
- Unannounced automation inputs: When one pilot silently changes a flight management system (FMS) entry or selects a new autopilot mode, the other pilot's mental model does not update. Mode confusion—one of the most studied problems in transport-category accidents—is almost always traceable to a model mismatch about what the automation is currently doing or about to do.
- Ambiguous communication: Phrases like "I've got it" or "you have the aircraft" without an explicit handoff challenge and response leave both pilots uncertain about who is flying. This directly erodes the shared model of task allocation.
- Interruptions during briefings: A departure or approach brief that is cut short by an ATC frequency change or a passenger call leaves gaps in the shared plan. Those gaps resurface at the worst possible moment—during a non-normal event when the crew needs a pre-agreed response.
- High workload and stress: Under stress, experienced pilots tend to revert to individual decision-making and reduce the vocalizations that keep the shared model current. FAA CRM literature notes that this regression toward solo behavior is predictable and must be trained against specifically.
- Complacency on routine flights: Crews who have flown together extensively sometimes abbreviate briefings and callouts, assuming the other pilot knows what they know. That assumption is the enemy of the shared model.
How Crews Build and Maintain Shared Mental Models
Structured Briefings
A thorough departure, approach, or contingency briefing is the primary tool for establishing an initial shared model. When a captain briefs the expected routing, the critical altitudes, the missed approach procedure, and the specific threats for today's conditions—and the first officer acknowledges and adds relevant information—both pilots encode the same cognitive baseline before workload increases. The FAA-H-8083-2 stresses that briefings must include not only the normal plan but also "what if" scenarios: what is the plan if a go-around is required below 500 feet AGL? What altitude will be maintained if communications are lost? Verbalizing these contingencies ensures both pilots' models include the same branch-points.
Closed-Loop Communication
Every challenge-and-response exchange in a standard operating procedure (SOP) is a model-synchronization event. When the PM calls "Flaps five" and the PF responds "Flaps five, selected," both pilots' models simultaneously register the same aircraft configuration. Silent actions—setting an altitude without a callout, selecting a mode without announcing it—update only one pilot's model. The AIM requires altitude and heading readbacks to ATC for the same fundamental reason: the readback is a verbal checkpoint that ensures both the crew and the controller are working from an identical clearance.
Inquiry, Advocacy, and Assertiveness
When a crew member's internal model diverges from what they are hearing or seeing—"I thought we were cleared to Flight Level 240, not 280"—immediately voicing that discrepancy is not an interruption; it is a model-repair action. FAA CRM doctrine, reflected throughout FAA-H-8083-2 and the Pilot's Handbook of Aeronautical Knowledge (FAA-H-8083-25), holds that assertive advocacy by a first officer or second-in-command is a safety behavior, not insubordination. Cultures that suppress it statistically produce more controlled-flight-into-terrain and unstabilized-approach accidents.
Verbalized Automation Management
Transport-category aircraft are managed as much through FMS inputs and autopilot mode selections as through direct control inputs. Every mode change—VNAV to FLCH, LNAV to heading select, autothrottle armed to engaged—must be announced, cross-checked, and confirmed. The phrase "FLCH selected, climbing to one-eight-thousand" does three things: it updates the PM's model, it invites verification, and it creates an auditory record that both pilots processed the same transition. This habit directly counters mode confusion.
Sterile Cockpit Discipline
Under 14 CFR 121.542, flight crewmembers operating under Part 121 must restrict cockpit conversation below 10,000 feet MSL to duties essential to the safe operation of the aircraft. This regulation exists because non-essential conversation is the most common mechanism by which distraction corrupts the shared model during the highest-workload phases of flight. Critically, the sterile cockpit rule applies during the climb as well as the approach—a trap that appears regularly on ATP knowledge test questions.
Key Numbers and Regulatory Anchors
- 10,000 feet MSL: The sterile cockpit altitude threshold under 14 CFR 121.542 (and 135.100 for applicable Part 135 operations).
- 14 CFR Part 121 and Part 135: Both require formal, recurrent CRM training programs because the shared mental model degrades without deliberate practice.
- AIM Chapter 4: Contains ATC communication procedures, including readback requirements, that directly support shared-model maintenance between the crew and the controlling facility.
- FAA-H-8083-2, Chapters 1 and 8: The primary handbook source for CRM concepts including shared SA, threat and error management, and the shared mental model in multi-crew operations.
Common Test Traps
- Individual SA is not the same as shared SA. Both concepts appear on ATP knowledge test questions. Individual SA is one pilot's awareness; shared SA requires that awareness to be consistent and mutual across the crew.
- Briefings are operationally mandatory, not optional courtesies. The FAA treats a complete brief as the mechanism that establishes the initial shared model—omitting contingency items is itself a CRM failure.
- Sterile cockpit covers the entire sub-10,000-foot regime. Many candidates know the rule applies to approach; fewer remember it applies equally during initial climb.
- Automation mode changes require verbalization. A silent FMS entry or mode selection is a model divergence event waiting to happen; the test specifically probes whether candidates understand this link between callout discipline and shared awareness.
- Stress and fatigue regress crews toward individual behavior. Recognizing this tendency—and compensating with deliberate communication—is itself an ACS-tested judgment competency.