A Hybrid Model Integrating HFACS and BN for Analyzing Human Factors in CFIT Accidents

Abstract

Controlled flight into terrain (CFIT) is considered a typical accident category of “low-probability-high consequence”. Human factors play an important role in CFIT accidents in such a complex and high-risk system. This study aims to explore the causal relationship and inherent correlation of CFIT accidents by the Human Factors Analysis and Classification System (HFACS) and Bayesian network (BN). A total of 74 global CFIT accident investigation reports from 2001 to 2020 were collected, and the main contributing factors were classified and analyzed based on the Human Factors Analysis and Classification System. Then, the model was transformed into a Bayesian network topology structure. To ensure accuracy, the prior probability of each root node was computed by the fuzzy number theory. Afterward, using the bidirectional reasoning ability of the Bayesian network under uncertainty, this study performed a systematic quantitative analysis of the controlled flight into terrain accidents, including causal reasoning analysis, diagnostic analysis, sensitivity analysis, most probable explanation, and scenario analysis. The results demonstrate that the precondition for unsafe acts (30.5%) has the greatest impact on the controlled flight into terrain accidents among the four levels of contributing factors. Inadequate supervision, intentional noncompliance with SOPs/cross-check, GPWS not installed or failure, adverse meteorological environment, and ground-based navigation aid malfunction or not being available are recognized as the top significant contributing factors. The contributing factors of the high sensitivity and most likely failure are identified, and the coupling effect between the different contributing factors is verified. This study can provide guidance for CFIT accident analysis and prevention.

1. Introduction

The International Civil Aviation Organization (ICAO) and the International Air Transport Association (IATA) define controlled flight into terrain (CFIT) as “an in-flight collision with terrain, water, or obstacle, without indication of loss of control.” In other words, when a CFIT accident occurs, the aircraft is airworthy and fully under the control of the flight crew [1,2]. Based on accident analysis data, ICAO identifies runway safety-related events, loss of control in-flight (LOC-I), and controlled flight into terrain (CFIT) as three high-risk accident occurrence categories in the 2013–2020 annual ICAO safety report [3]. Aviation safety experts have reached a consensus that CFIT is not the most common category of accidents, but it is one of the main contributors to high-fatality accidents. Research shows that CFIT accidents have been the second-largest fatal accident category, and 89% of CFIT accidents incur fatalities. Statistics indicate that among 837 flight accidents, only 6% of all accidents are classified as CFIT accidents, but the death toll from CFIT accidents accounts for 22% of all fatal accident deaths (892 out of 4070) during the period 2008–2017 [4]. Similarly, according to the analysis results of ICAO, CFIT accidents cause nearly a quarter of the death toll in aviation accidents worldwide, even though they account for only 3% of accidents [5]. Therefore, the CFIT accidents deserve the attention of the civil aviation industry.

Research has found that CFIT accidents usually have the following notable characteristics [4,6,7]:

• Low incidence but high fatality rate;
• The phase of flight with the highest frequency of CFIT accidents is approach and landing, accounting for 66% of all CFIT accidents and 62% of fatal CFIT accidents;
• Most CFIT accidents result from the pilot’s loss of situational awareness (SA). That is to say, in most cases, pilots can completely avoid these accidents.

Present studies indicate that human factors in flight are an important cause of aviation unsafe events and have gradually become the focus of research in the field of aviation safety [8,9]. Statistics show that more than 70% of aviation unsafe events are related to human errors [10,11,12]. Some scholars even claim that the causes of all aviation accidents are related to some kind of human error [13]. Therefore, human factors in flight are considered to be the biggest hidden danger to aviation safety today. In any case, it seems incredible that an airworthy aircraft capable of a safe flight can be flown into terrain while completely under the control of the pilot. From the definition of CFIT, multiple human performance deficiencies and undesirable behaviors are indicated in all CFIT accidents, which constitute the largest group of contributing factors in the CFIT accidents set [14].

Civil aviation transportation is a very complex system composed of the flight crew, various equipment, operating environment, organization management, etc. It is recognized that civil aviation accidents are generally not caused by a single factor or, in most cases, not by a single person [15]. Therefore, there are numerous contributing factors leading to CFIT accidents, and they are complex and changeable. The factors interact with each other, resulting in a nonlinear and dynamic complex system for its risk evolution. Risks may be incubated and transmitted at multiple nodes in the system at the same time and eventually evolve unpredictable results [16,17]. An early study believes that CFIT accidents are closely related to factors such as pilot-controller communication, cockpit workload, noise reduction procedures, government regulation, and visual hallucinations [18]. Some researchers have statistically analyzed 50 CFIT accidents from 2007 to 2017 based on the HFACS model, and results show that although human factors represent a major component of CFIT accidents, regulatory factors and organizational influences cannot be ignored [19]. A recent statistical report by IATA implies the most frequent contributing factors to CFIT accidents include regulatory oversights, SOP Adherence/SOP cross-verification, technology and equipment, environmental threats, safety management, etc. [4]. A disturbing finding is that every CFIT accident is more or less connected to the pilot’s lack of situational awareness, including misperception, misunderstanding, and misprediction, which can lead to the pilots’ visual illusion, spatial disorientation, decreased vigilance, etc. [14]. Research indicates that 75% of the planes involved in CFIT accidents were not equipped with the Ground Proximity Warning System (GPWS) [20]. Consequently, describing an aviation accident as a “human error” of the flight crew is an oversimplified analysis result. After all, it is only an active failure (with immediate severe consequences) [21,22]. The research on the mechanism of human factors and other contributing factors should become an urgent problem to be solved in CFIT accidents.

To better understand the research status, we collected the representative literature on CFIT from 2017 to 2022 and summarized the main research topics and research approaches, as shown in

Table 1. Summary of CFIT research topics and methods.

Research Topics	Approaches	Type	References
Classification and analysis of causes of CFIT accidents	HFACS, Threat and Error Management, “2–4” Model, Statistical investigation	Qualitative	[4,23,24,25]
Application of new technology to prevent CFIT accidents	Analysis of flight simulation experiment	Quantitative	[26,27]
Safety assessment of flight procedures	Fuzzy logic methods	Quantitative	[28,29]
Flight training	Fuzzy analytic hierarchy process	Quantitative	[30]

. Existing studies mainly focus on the classification and qualitative analysis of the causes of CFIT accidents, the application of new technology to prevent CFIT accidents, the safety assessment of flight procedures and the improvement of flight training, etc., but few involve the quantitative analysis of the internal mechanism of the contributing factors of CFIT accidents. The main reason is that CFIT accidents occur less frequently, which makes it difficult to obtain sufficient historical accident data, especially for commercial transport aviation. To overcome these limitations, this study comprehensively used HFACS, the Bayesian network, expert evaluation, and fuzzy numbers for quantitative analysis of the causal relationship and inherent correlation of CFIT accidents. The integrated approach has a powerful ability for learning, reasoning, and fuzzy processing, which makes the multi-dimensional analysis of CFIT accidents under the condition of limited data and uncertain information. This paper provides a new framework for the analysis of accidents with a low probability, which could be used as a decision-making tool for safety management to formulate various intervention strategies.

The rest of the study is structured as follows. Section 2 develops a hybrid HFACS-BN for CFIT accident analysis. Section 3 illustrates the application of the HFACS-BN model for CFIT accidents. The analysis results are presented in Section 4. The discussion and conclusion are shown in Section 5 and Section 6.

2. Materials and Methods

2.1. Human Factors Analysis and Classification System (HFACS)

The Human Factors Analysis and Classification System (HFACS) was originally developed for military aviation [31] but has since been widely used for human factors analysis in safety-critical areas, including coal mine production [32], railway transportation [33], marine transportation [34], etc. The HFACS model is further optimized based on Reason’s “Swiss cheese” model and believed that aviation is a complex production system, and all accidents are caused by four levels of failures: unsafe acts, a precondition for unsafe acts, unsafe supervision, and organizational influences, as presented in Figure 1 [22]. The HFACS model makes a retrospective analysis from the direct factor of the unsafe acts of the operator and finally obtains all the latent failures and active failures that lead to the accident [35].

2.2. Bayesian Network (BN)

The BN is one of the most powerful theoretical models in the field of uncertain reasoning proposed by Pearl [36,37]. It is a directed acyclic graph (DAG) model based on network structure, which represents random variables and their conditional dependencies by nodes and arcs to discover potential relationships. The nodes of the Bayesian network represent variables, and the arrows represent the conditional dependencies between the variables [38,39]. The nodes towards which arrows are directed are child nodes, whereas the nodes away from the arrows are parent nodes. In addition, nodes without any child nodes are called leaf nodes, and nodes without any parent nodes are called root nodes. An intermediate node acts as both a parent node and a child node in the BN [40,41].

A BN is applied to the reasoning and probability calculation based on the Bayesian theorem. Dependencies between the child nodes and their parent nodes can be quantified by conditional probability distributions from conditional probability tables (CPTs). For nodes without a parent, the probability is not conditioned on other nodes, and their prior probabilities or unconditional probabilities are specified [42]. The prior probability refers to the probability assigned to an event, which is usually obtained through historical data or expert judgment. Conditional probability is interpreted as the likelihood that an event will occur based on the occurrence of previous events or outcomes. Joint probability refers to the probability that two or more events occur at the same time [43,44].

Consider a graph G = (V, E) with a set of variables V = {X₁, X₂,..., X_n}. E represents the set of arcs. Then, the joint probability distribution of each variable can be expressed in Equation (1), where Parent X_i represents the parent node of X_i.

$$P\left(X_1,X_2,\cdots ,X_n\right)=\underset{i=1}{\overset{n}{{\displaystyle \Pi }}}P(X_i\left|parent\right.(X_i)),$$

(1)

After obtaining the new additional information (also known as evidence), the prior probability of the event needs to be updated to get a more realistic probability [40,45], as presented in Equation (2), where P(α) and P(β) refer to the prior probability of occurring for α and β, respectively; P(α|β) refers to the probability of α given β; P(β|α) is the probability of β given α.

$$P(\alpha \left|\beta \right.)=\frac{P(\beta \left|\alpha \right.)P\left(\alpha \right)}{P\left(\beta \right)},$$

(2)

A typical BN diagram is shown in Figure 2, where node “A” is a parent node, and nodes “B” and “C” are child nodes.

2.3. Combination of HFACS and BN

The HFACS model takes into account the various factors involved at different levels in an aviation accident. However, there are some shortcomings. First, HFACS involves so many factors, especially some latent threats (unsafe supervision and organizational influences), and it is extremely difficult to collect such information, even with detailed accident reports [46,47]. In addition, the HFACS model mainly relies on correlation analysis, and many reasoning processes depend on the analytical ability and work experience of investigators. The results are more conducive to qualitative analysis but lack the ability of a quantitative risk assessment, and it is difficult to analyze the evolution process of accident causes [48]. Many scholars have combined the HFACS model with other risk analysis methods to make it more suitable for applications in different fields. For example, James J. H. Liou et al. [49] integrated FMEA and HFACS to assess the risk of inter-city bus accidents for calculating the risk degree and putting forward the improvement measures. Li et al. [50] used the HFACS model to analyze the influencing factors of ship collision accidents and transform them into the graphic structure of the BN to obtain the causal relationship and causal chain of ship collision accidents. M. Karthick et al. [51] integrated HFACS and FAHP to determine the key factors affecting the occurrence of human errors in the nuclear plant control room and quantitatively assessed nuclear accidents.

To overcome these limitations and further research the causal relationship and evolution process of the contributing factors of CFIT accidents, this study used a hybrid HFACS–BN model to analyze CFIT accidents. The process diagram of the proposed methodology used in the present study is shown in Figure 3.

3. Application of the Methodology

3.1. Analysis of the Main Contributing Factors to CFIT Accidents

It is considered that CFIT accidents are caused by a series of chain events triggered by the improper coupling of humans, equipment, organization, and other complex factors in a specific environment. To ensure the reliability and credibility of the analysis, we conducted a retrospective search mainly through the aviation safety information systems of the International Civil Aviation Organization (ICAO), the International Air Transport Association (IATA), the Civil Aviation Administration of China (CAAC), and the National Transportation Safety Board (NTSB), and obtained 74 CFIT accident investigation reports from 2001 to 2020, involving 58 commercial transportation aviation flight accidents and 16 general aviation flight accidents. Based on the existing research [4,19], we analyzed these CFIT accidents based on the CFIT model and completed the extraction of the main contributing factors, as shown in

Table 2. The main contributing factors to CFIT accidents.

Code	Contributing Factors	Code	Contributing Factors
T0	CFIT accident	X7	Unfavorable terrain/obstacles
M1	Unsafe acts	X8	Ground-based navigation aid malfunction or not available
M2	Precondition for unsafe acts	X9	GPWS not installed or GPWS failure
M3	Unsafe supervision	X10	Blind confidence
M4	Organizational influences	X11	Yield to authority or distrust of the alarm system
N1	Errors	X12	Over-reliance on automation
N2	Violations	X13	Fatigue
N3	Environmental factors	X14	Poor leadership
N4	Conditions of the flight crew	X15	Poor teamwork ability
N5	Personnel factors	X16	Failed to communicate/coordinate
N6	Resource management	X17	Inadequate supervision
N7	Organizational climate	X18	Improper operation plan
N8	Operational processes	X19	Failed to correct a known problem
N9	Physical environment	X20	Inadequate Management decision
N10	Technological environment	X21	Lack of training
X1	Skill-based errors	X22	Bad organizational culture/values
X2	Decision errors	X23	Insufficient rules and regulations
X3	Perceptual errors	X24	Incorrect or unclear aeronautical chart or flight procedure
X4	Intentional noncompliance with SOPs/cross-check	X25	Terrain database error
X5	Failed to GOA after destabilization on approach	X26	Absent or deficient safety management
X6	Adverse meteorological environment

.

3.2. Construction of the BN Model for the CFIT Risk

3.2.1. Transformation HFACS into BN

According to the hierarchical structure of the HFACS model, the nodes in Table 2 were transformed, where the T₀ node was set as the leaf node, M₁~M₅ and N₁~N₁₀ were set as intermediate nodes, and X₁~X₂₆ were set as root nodes. Finally, the HFACS model of CFIT accidents was transformed into the topological network structure of BN, as shown in Figure 4.

3.2.2. Estimation of Prior Probabilities

The prior probabilities of root nodes can usually be obtained by analyzing historical data or by expert judgment [52]. Considering the small number of CFIT accident samples and the limited historical data, the prior probabilities of the root nodes cannot be accurately calculated. Therefore, we used the combination of the fuzzy number and expert judgment to estimate the prior probability of the root node. The fuzzy number has been widely used to solve uncertain and incomplete information, which provides an effective mathematical means for describing and dealing with fuzzy problems [53].

Generally, experts prefer to use linguistic variables, such as “Extremely low (EL)”, “Low (L)”, “Fairly low (FL)”, “Medium (M)”, “Fairly high (FH)”, “High (H)” and “Extremely high (EH)”, to describe the possibility of an event [54]. Considering that the triangular fuzzy number and trapezoidal fuzzy number had a strong ability to describe fuzziness and uncertainty, according to previous research [55,56], these linguistic variables are represented in Figure 5.

A fuzzy number is a normal fuzzy subset of a real line with upper semi-continuous and quasi-concave membership functions [57]. A fuzzy number A is defined as a subset of real numbers whose membership function μ_A(x) is a continuous mapping from the real line R to a closed interval [0,1]. The triangular fuzzy number can be defined as μ_A(x) = (a,b,c) [58], as expressed in Equation (3).

$${\mu }_A(x,a,b,c)=\left\{\begin{array}{c}\frac{x-a}{b-a}, a\le x\le b\\ \frac{c-x}{c-b}, b<x\le c\\ 0, otherwise\end{array}\right.,$$

(3)

The trapezoidal fuzzy number can be defined as μ_A(x) = (a, b, c, d) [59], as presented in Equation (4).

$${\mu }_A(x,a,b,c,d)=\left\{\begin{array}{l}\frac{x-a}{b-a}, a\le x\le b\hfill \\ 1, b<x<c\hfill \\ \frac{d-x}{d-c}, c\le x\le d\hfill \\ 0, otherwise\hfill \end{array}\right.,$$

(4)

Suppose A∈F(U), λ∈[0, 1], A_λ is called a λ-cut set and can be expressed in Equation (5).

$$A_{\lambda }=\left\{x|u_A(x)\ge \lambda ,x\in U,\lambda \in \left[0,1\right]\right\},$$

(5)

Each class of the fuzzy set is divided into two subsets by λ-cut. The cut set intervals of the triangular fuzzy number and the trapezoidal fuzzy number can be calculated by Equations (6) and (7).

$$A_{\lambda }=\left[a+\left(b-a\right)\lambda ,c-\left(c-b\right)\lambda \right],$$

(6)

$$A_{\lambda }=\left[a+\left(b-a\right)\lambda ,d-\left(d-c\right)\lambda \right],$$

(7)

The fuzzy number and λ-cut set are shown in

Table 3. The fuzzy number and λ-cut set.

Linguistic Variable	Fuzzy Number	λ-Cut Set
Extremely low (EL)	fVL = (0, 0, 0.1, 0.2)	$A_{VL}^{\lambda }$ = [0, 0.2 − 0.1λ]
Low (L)	fL = (0.1, 0.2, 0.3)	$A_L^{\lambda }$ = [0.1 + 0.1λ, 0.3 − 0.1λ]
Fairly low (FL)	fFL = (0.2, 0.3, 0.4, 0.5)	$A_{FL}^{\lambda }$ = [0.2 + 0.1λ, 0.5 − 0.1λ]
Medium (M)	fM = (0.4, 0.5, 0.6)	$A_M^{\lambda }$ = [0.4 + 0.1λ, 0.6 − 0.1λ]
Fairly high (FH)	fFH = (0.5, 0.6, 0.7, 0.8)	$A_{FH}^{\lambda }$ = [0.5 + 0.1λ, 0.8 − 0.1λ]
High (H)	fH = (0.7, 0.8, 0.9)	$A_H^{\lambda }$ = [0.7 + 0.1λ, 0.9 − 0.1λ]
Extremely high (EH)	fEH = (0.8, 0.9, 1, 1)	$A_{EH}^{\lambda }$ = [0.8 + 0.1λ, 1]

.

The calculation process of the root node prior probability was as follows: firstly, we invited five experts with similar experiences to make a judgment on the possibility of the root nodes according to Figure 5, including two aviation accident investigators from the Civil Aviation Administration of China, two airline safety managers, and one scholar in the field of aviation human factors. Then, the λ-cut set of fuzzy sets was selected to combine expert opinions, and the average fuzzy number of expert opinions was obtained. Finally, the average fuzzy number was converted to the fuzzy possibility score (FPS), and then the fuzzy possibility score (FPS) was converted into a fuzzy failure probability (FFR), which was the probability of the root node.

• Calculating the fuzzy number. Taking root node X_15, “poor teamwork ability”, as an example, the evaluation languages of the five experts were “Fairly low”, “Fairly low”, “Medium”, “Medium”, and “Fairly high”. Since the five experts had similar experiences, we believed that the weights of the experts’ opinions were equal. According to the fuzzy numbers and λ-cut sets shown in Table 3, the evaluation opinions of the five experts were averaged as presented in Equation (8).

  $$W_{X_{15}}=\frac{A_L^{\lambda }+A_{FL}^{\lambda }+A_L^{\lambda }+A_M^{\lambda }+A_L^{\lambda }}{5}=[0.34+0.1\lambda , 0.6-0.1\lambda ],$$

  (8)
  According to the extension theory of fuzzy sets, W was also a fuzzy set as presented in Equation (9).

  $$W_{\lambda }=\left[z_1,z_2\right]=[0.34+0.1\lambda , 0.6-0.1\lambda ],$$

  (9)
  The relation function of the average fuzzy number W could be expressed as Equation (10).

  $$A_W(z)=\left\{\begin{array}{l}\frac{z-0.34}{0.1}, 0.34<z\le 0.44\hfill \\ 1, 0.44<z\le 0.5\hfill \\ \frac{0.6-z}{0.1}, 0.5\le x\le 0.6\hfill \\ 0, otherwise\hfill \end{array}\right.,$$

  (10)
• Converting the fuzzy number into FPS. The left-right fuzzy sorting method was used to defuzzify the fuzzy number [60], and the maximum fuzzy set and minimum fuzzy set were defined by Equations (11) and (12).

  $$f_{\max }=\left\{\begin{array}{l}x, 0<x<1\hfill \\ 0, otherwise\hfill \end{array}\right.,$$

  (11)

  $$f_{\min }=\left\{\begin{array}{l}1-x, 0<x<1\hfill \\ 0, otherwise\hfill \end{array}\right.,$$

  (12)
  The left boundary fuzzy possibility score FPS_L and the right boundary fuzzy possibility score FPS_R of the fuzzy number W were expressed as Equations (13) and (14).

  $$FP{S}_L(W)=\underset{x}{\sup }\left[A_W(x)\wedge f_{\min }(x)\right]=0.6,$$

  (13)

  $$FP{S}_R(W)=\underset{x}{\sup }\left[A_W(x)\wedge f_{\max }(x)\right]=0.5455,$$

  (14)
  The fuzzy probability score of W was calculated by Equation (15).

  $$FPS(W)=\frac{1}{2}\left[FP{S}_R(W)+\left(1-FP{S}_L(W)\right)\right]=0.4728,$$

  (15)
• The FPS was converted to FFR using Equations (16) and (17) [54,61].

  $$FFR=\left\{\begin{array}{l}\frac{1}{{10}^K}, (FPS\ne 0)\hfill \\ 0, (FPS=0)\hfill \end{array}\right.,$$

  (16)

  $$K={\left[\frac{1-FPS}{FPS}\right]}^{\frac{1}{3}}\times 2.301,$$

  (17)

Finally, the calculation result of the FFR of the root node X₁₅, “poor teamwork ability”, was 4.1106 × 10⁻³, and the prior probability of the root node X₁₅ was 4.1106 × 10⁻³. Similarly, the prior probabilities of other root nodes could be calculated, as shown in

Table 4. The prior probabilities of the root nodes.

Node	State	Prior Probability	Node	State	Prior Probability	Node	State	Prior Probability
X1	Yes	1.9528 × 10−3	X10	Yes	1.5411 × 10−3	X19	Yes	1.9532 × 10−3
X2	Yes	2.4634 × 10−3	X11	Yes	1.1108 × 10−3	X20	Yes	5.3269 × 10−3
X3	Yes	1.1108 × 10−3	X12	Yes	1.1108 × 10−3	X21	Yes	3.9854 × 10−3
X4	Yes	6.2314 × 10−3	X13	Yes	1.8578 × 10−3	X22	Yes	1.5411 × 10−3
X5	Yes	1.9528 × 10−3	X14	Yes	3.3473 × 10−3	X23	Yes	1.3428 × 10−3
X6	Yes	7.2651 × 10−3	X15	Yes	4.1106 × 10−3	X24	Yes	4.1783 × 10−4
X7	Yes	1.3428 × 10−3	X16	Yes	2.2676 × 10−3	X25	Yes	1.8578 × 10−4
X8	Yes	2.4634 × 10−3	X17	Yes	1.3428 × 10−2	X26	Yes	5.9893 × 10−3
X9	Yes	3.3473 × 10−3	X18	Yes	3.3473 × 10−3

. To simplify the analysis, the two states of the root node were defined as “Yes” or “No” according to the characteristic of the root node.

3.2.3. Calculation of Conditional Probability Tables (CPTs)

Taking the 74 CFIT accidents in Section 3.1 as the sample data, using the learning ability of the Bayesian network, and combining the opinions of experts, 13 conditional probability tables were finally obtained. An example of the CPT of node M₂ is presented in

Table 5. The prior probabilities of the root nodes.

Environmental Factors (N3)	Conditions of the Flight Crew (N4)	Personnel Factors (N5)	Invalid Corrective Measures (M6) (%)
			Yes	No
Yes	Yes	Yes	89.14	10.86
Yes	Yes	No	60.62	39.38
Yes	No	Yes	59.37	40.63
Yes	No	No	30.09	69.91
No	Yes	Yes	61.15	38.85
No	Yes	No	31.11	68.89
No	No	Yes	32.25	67.75
No	No	No	0	100

.

4. Results

4.1. Causal Reasoning Analysis

The causal reasoning (forward) analysis is based on the prior probabilities of the root nodes and CPTs to obtain the probability of the result [38]. We input the prior probabilities into Table 4 into the BN model, used the Netica software for forward inference, and finally calculated the probability of a CFIT accident as 8.6166 × 10⁻⁸.

4.2. Diagnostic Analysis

The diagnostic (abductive reasoning) analysis refers to obtaining the cause of the result and the posterior probabilities of the nodes given some new evidence [62]. Using the function of BN fault diagnosis, the significant contributing factors leading to the CFIT risk can be analyzed. To this end, we set the value of T₀ to 100% to obtain the posterior probability of each node, as shown in Figure 6.

To find out the significant contributing factors leading to the CFIT accident, the posterior probabilities of the root nodes were sorted, and the results are shown in

Table 6. The posterior probabilities of the root nodes.

Node	Posterior Probability	Ranking	Node	Posterior Probability	Ranking	Node	Posterior Probability	Ranking
X17	0.18610	1	X21	0.04080	10	X16	0.01413	19
X4	0.13598	2	X1	0.03587	11	X3	0.01269	20
X9	0.07658	3	X15	0.03478	12	X7	0.01082	21
X6	0.07028	4	X19	0.02915	13	X11	0.00512	22
X8	0.06666	5	X14	0.02584	14	X12	0.00432	23
X20	0.06635	6	X5	0.02269	15	X13	0.00046	24
X26	0.06492	7	X10	0.02157	16	X24	0.00019	25
X2	0.06235	8	X22	0.02003	17	X25	0.00019	25
X18	0.05009	9	X23	0.01746	18

. The larger the probability value, the more significant the impact on the CFIT accident.

The comparison results of the prior probability and posterior probability of the root node are presented in Figure 7.

4.3. Sensitivity Analysis

In the Bayesian network model, the sensitivity analysis can reflect the quantification of the target node caused by the change in the local parameters of the network model and then identify the sensitivity factors in the model [63]. The Netica software takes mutual information (entropy reduction), percentage (comparison value), and variance (variance of belief) as important indicators to measure sensitivity analysis. The larger the value, the greater the impact [64].

First, T₀ was set as the target node, and the order of sensitivity was M₂ (10.60%), M₁ (10.10%), M₄ (8.54%), and M₃ (8.08%). Next, these nodes were set as the target nodes, and the main sensitive root nodes were obtained, as shown in Figure 8.

4.4. Most Probable Explanation

Bayesian network reasoning can not only deal with the problem of posterior probability but also solve the maximum a-posterior probability (MAP) and most probable explanation (MPE) [65]. MAP and MPE are considered to be the most reasonable explanations for the observations [66]. After the value of T₀ was set to 100%, the “Most Probable Expl” function of the Netica software was clicked, and the MAP and MPE of the CFIT accidents are shown in Figure 9.

4.5. Scenario Analysis

Scenario analysis is realized through the new evidence update function of BN. The probability value of the node state changes dynamically with different sets of accident scenarios, which can analyze the synergy among the root nodes in specific scenarios [67]. According to the HFACS model, the main contributing factors to CFIT accidents could be summarized into four levels: unsafe acts (M₁), a precondition for unsafe acts (M₂), unsafe supervision (M₃), and organizational influences (M₄). To further study the impact of the coupling of different levels on the CFIT risk, we selected the two more sensitive root nodes of M₁, M₂, M₃, and M₄, respectively, according to the results in Section 4.3, and the selected root nodes’ states were set as “Yes = 100%” to the scenario analysis. According to the calculation results in Section 4.1, the initial value of T₀ was 8.6166 × 10⁻⁸. The scenario analysis results are presented in

Table 7. Scenario analysis results.

Scenario	Scenario Description	Selected Root Nodes	Updated Value T0’	T0’/T0
I	Single-level impact on CFIT risk
1	Organizational influences (M4): inadequate management decision (X20). and absent or deficient safety management (X26).	X20, X26 →T0	1.8059 × 10−6	20.96
2	Unsafe supervision (M3): inadequate supervision (X17) and improper operation plan (X18).	X17, X18 →T0	2.7916 × 10−6	32.40
3	Precondition for unsafe acts (M2): ground-based navigation aid malfunction or not available (X6) and GPWS not installed or GPWS failure (X9).	X8, X9 →T0	2.6315 × 10−6	30.54
4	Unsafe acts of flight crew (M1): decision errors (X2) and intentional noncompliance with SOPs/cross-check (X4).	X2, X4 →T0	4.1835 × 10−6	48.55
II	Multi-level impact on CFIT risk
5	Scenario 1 and Scenario 4	X2, X4, X20, X26 →T0	5.8249 × 10−6	67.60
6	Scenario 2 and Scenario 4	X2, X4, X8, X9 →T0	6.5547 × 10−6	76.07
7	Scenario 3 and Scenario 4	X2, X4, X17, X18 →T0	6.9804 × 10−6	81.01
8	Scenario 1, Scenario 2, and Scenario 3	X2, X4, X8, X9, X17, X18 →T0	9.7963 × 10−6	113.69
9	Scenario 1, Scenario 2, Scenario 3, and Scenario 4	X2, X4, X8, X9, X17, X18, X20, X26→T0	1.1263 × 10−5	130.71
10	Case scenario analysis: 8·24 an airplane crash accident in Yichun, Heilongjiang	X2, X4, X5, X6, X7, X8, X10, X11, X15, X16, X17, X18, X20, X21, X23, X26→T0	2.1978 × 10−5	255.07

and Figure 10.

It should be noted that Scenario 10 was a typical case of the CFIT-Yichun plane crash accident. Accident introduction [68]: at 21:38 on 24 August 2010, Henan Airlines flight VD8387 performed a flight mission from Harbin to Yichun, and it crashed at a distance of 690 m from Runway 30 during the approach at Lindu Airport in Yichun City, which caused 44 deaths and 52 injuries. According to the official investigation report, the main reasons for the accident were as follows: the terrain of the Yichun Airport was complicated, and there was radiation fog and low visibility at that time; the airport lacked precise ground navigation equipment; the captain violated the regulations, ignored the radio altitude voice warning, and continued to approach blindly without establishing any visual references; the flight crew did not take go-around measures; the operation plan was improper, and the captain lacked technical skills and training; the coordination and cooperation among the crew members were not good. There was poor communication among members and failure to cross-check; the airline failed to supervise the captain’s qualification and ability; the airline did not formulate a safety policy for the operation of Yichun Airport; there was insufficient safety management and safety investment in the airline; there were supervisory violations by civil aviation management agencies.

5. Discussion

There are many factors contributing to CFIT accidents, and human factors have been identified as major contributing factors in CFIT accident investigations. However, due to the small sample size of CFIT accidents, the traditional CFIT analysis methods are mostly qualitative analyses. In this present study, the HFACS model was integrated with BN, and the uncertainty analysis ability and bidirectional reasoning ability of the BN theory were fully used for the quantitative analysis of human factors in CFIT accidents, which could not only clarify the relationship between the contributing factors but also analyze the critical factors most likely to lead to CFIT accidents.

The calculation results in Section 4.1 showed that the probability of CFIT accidents was 9.9325 × 10⁻⁸. That is why NASA and FAA consider CFIT a typical type of accident with a low probability but high consequence [69] According to statistical analysis, the average probability of CFIT accidents from 2010 to 2016 was about 1.414 × 10⁻⁷, and the study believes that the probability of CFIT accidents is between 3 × 10⁻⁸ and 3 × 10⁻⁷ [70]. Therefore, the calculation result is within this scope, which verifies the feasibility of this methodology.

Among the four levels of contributing factors, the precondition for unsafe acts (M₂) accounted for the largest proportion, reaching 30.5%, followed by unsafe acts of the flight crew (M₁) (25.7%), unsafe supervision (M₃) (25.1%), and organizational influences (M₄) (19.1%), as presented in Figure 6. The results indicate that CFIT accidents are directly triggered by these preconditions, including environmental factors (N₃), flight crew conditions (N₄), and personal factors (N₅). Some other studies have produced results essentially in agreement with the statement. Harris et al. [71] used an artificial neural network to model the relationship between preconditions for unsafe acts and unsafe acts and an average overall classification rate of circa 74% for all the unsafe acts from the information derived from the pre-conditions. This result also verifies that accidents are the final result of many potential failures and active failures [72].

The diagnostic analysis results also showed that the top significant factors for CFIT accidents were inadequate supervision (X₁₇), intentional noncompliance with SOPs/cross-check (X₄), GPWS not installed or GPWS failure (X₉), adverse meteorological environments (X₆), and ground-based navigation aid malfunctions or not available (X₈), etc., which are listed in Table 6 and Figure 7. The prior probability refers to the probability obtained from previous experiences or statistical analysis, which is the probability before the result occurs. The posterior probability is used to calculate and analyze the most likely causes after the result occurs. Therefore, the posterior probabilities of most contributing factors had higher values than the prior probabilities. Since the inference result of BN largely depends on the prior probabilities, the posterior probabilities of each contributing factor were consistent with the trend of the prior probabilities, as shown in Figure 7. The identified top significant factors were highly consistent with the existing relevant research. IATA used the threat and error management (TEM) framework to statistically analyze the frequency of the contributing factors of 47 CFIT accidents from 2008 to 2017, and the results indicated that the most frequent contributing factors to CFIT accidents were regulatory oversight (72%), SOP adherence/SOP cross-verification (56%), technology and equipment (54%), meteorology (51%), and nav Aids (51%), etc. Facts have proved that the lack of guidance and supervision is the breeding ground for many violations that sneak into the cockpit [31]. Safety supervision is considered to be the most important front-end control link of risk management. Once this crucial defense fails, the threats will be very serious. This is because superficial and formalistic supervision will connive at the occurrence of intentional violations by the flight crew, which will make the flight crew form an illusion that some unsafe behaviors are not violations and can be tolerated. If the risks found cannot be solved or corrected, a closed-loop safety management system will not be formed [73]. Intentional noncompliance with SOPs/cross-check is an unforced error made by the flight crew when performing routine tasks, often accompanied by unhealthy psychological states, such as blind self-confidence and fluke [74]. A study concluded that 54% of human errors in LOSA (Line Operations Safety Audit) observations were intentional noncompliance [75]. We believe that the consequences of intentional noncompliance with SOPs/cross-checks are more serious, especially in the accident category of CFIT. Another notable contributing factor was that GPWS was not installed or GPWS failed (X₉). One disturbing finding was that 75% of the CFIT accident aircraft were not equipped with a GPWS (Ground Proximity Warning System) or EGPWS (Enhanced Ground Proximity Warning System), which can monitor an aircraft’s height/descent rate and provide a warning if an undesirable trend develops [20,76]. Airbus considers that the application of collision avoidance technology is a key measure to reduce CFIT accidents [77]. According to statistical analysis, more than half of the CFIT accidents are closely related to the adverse meteorological environment, including poor visibility/IMC (52%), wind/wind shear/gusty wind (12%), thunderstorms (8%) [78]. Research shows that an adverse meteorological environment will sharply increase the workload of the flight crew, making it difficult to maintain a high situational awareness level, and it is likely to cause the flight crew spatial disorientation or make the aircraft out of control [79]. Another noteworthy factor was unavailable or malfunctioning ground-based navigation aids (X₈), which involve a lot of equipment, such as runway lighting systems, Precision Approach Path Indicators (PAPI), and the precision of ground navigation equipment (e.g., the absence of instrument landing systems), etc. These devices could provide the flight crew with the following important cues during the approach: identification, alignment, roll guidance, deviation correction, flight guidance, distance, and positive threshold definition, which could help address CFIT concerns in certain conditions. An FAA report shows that approach lighting systems provide the bridge for the transition from instrument flights to visual landing operations, which is crucial to flight safety in low visibility [80].

Another major finding of our study was that we had identified the high sensitivity factors of the four levels that lead to CFIT accidents based on the BN’s sensitivity analysis function. The high sensitivity contributing factors of the prerequisite for unsafe behavior (M2) were as follows: intentional noncompliance with SOPs/cross-check (X₄), decision errors (X₂), skill-based errors (X₁), failed to GOA (go around) after destabilization on approach (X₅), and perceptual errors (X₃). The high sensitivity contributing factors of the precondition for unsafe acts (M₂) included GPWS not installed or GPWS failure (X₉), ground-based navigation aid malfunction or not available (X₈), adverse meteorological environment (X₆), poor teamwork ability (X₁₅), and blind confidence (X₁₀). Unsafe supervision (M3), inadequate supervision (X₁₇), improper operation plan (X₁₈), and failure to correct a known problem (X₁₉) were all sensitive contributing factors. The high sensitivity contributing factors of organizational influences (M4) were absent or deficient safety management (X₂₆), inadequate management decisions (X₂₀), lack of training (X₂₁), bad organizational culture/values (X₂₂), and insufficient rules and regulations (X₂₃).

It is remarkable that the root nodes identified by the most probable explanation also include intentional noncompliance with SOPs/cross-check (X₄), GPWS not installed or GPWS failure (X₉), inadequate supervision (X₁₇), and absent or deficient safety management (X₂₆), which fully illustrates the importance of these contributing factors. In addition, according to Figure 9, it can also reflect the most likely and critical risk evolution paths leading to CFIT accidents. Therefore, the results of the high-sensitivity analysis and most probable explanation can offer valuable insights for safety management by focusing on these sensitive contributing factors and prioritizing management when taking preventive measures.

Moreover, to further explore the cause mechanism of CFIT accidents, we also conducted a scenario analysis on highly sensitive factors of four levels. Scenario analysis was divided into three categories: single-level impact on CFIT risk, multi-level impact on CFIT risk, and case scenario analysis, including a total of 10 scenarios. According to Table 7 and Figure 10, the following findings could be obtained. First of all, the two more sensitive factors of a single level were set to “yes = 100%”, that is, when these two more sensitive factors failed, the CFIT risk levels of scenarios 1~4 increased by 20.96–48.55 times. Secondly, when setting the high sensitivity factors of two different levels as “yes = 100%”, the CFIT risk levels of scenario 5~7 increased by 67.60–81.01 times. When three or four levels of high sensitivity factors failed, the levels of CFIT risk increased by 113.69~130.71 times, such as in scenarios 8 and 9. Worryingly, when multiple contributing factors of the four levels were coupled, the level of CFIT risk would increase sharply, such as in scenario 10. Assuming that the risk level of CFIT in scenarios 1–9 was a linear increase, then the risk level of CFIT in scenario 10 was an exponential increase. This finding was also confirmed by multiple studies. For example, the flight mission is carried out in a complex and high-risk system, and the flight crew’s situational awareness is the result of the high interaction between various elements of “human-equipment-environment-organization”. The more adverse factors, the lower the flight crew’s situational awareness [16]. It is obvious that most CFIT accidents are caused by the pilots’ situational awareness failure [4]. Another study reveals that the coupling between various factors has a significant impact on the safety risk system, especially when the system is in a highly coupled state of unsafe factors it is very prone to destructive accidents [81].

Based on the above findings, the following recommendations are put forward to reduce CFIT risks. First, CFIT has many factors that can be attributed to human errors, and the safety management of CFIT should be targeted and prioritized, especially for the contributing factors with high posterior probability and high sensitivity. Secondly, organizational management should be safety oriented for CFIT risk management, such as strengthening safety supervision, establishing a good safety culture atmosphere, installing anti-collision equipment (GPWS/EGPWS), etc. Thirdly, it is necessary to incorporate CFIT into the CRM training programs. CRM training has been recognized as the most effective means to improve the situational awareness and resource management ability of the flight crew. When carrying out CRM training for flight crews, air operators should strengthen situational awareness training to avoid imminent CFIT situations in the following complex situations, including harsh meteorological environments, lack of high-precision navigation equipment, unstable approach, etc. Additionally, the flight crew should recognize the importance of effective situational awareness and pay attention to identifying potential CFIT situations during flight.

6. Conclusions

CFIT accidents have always been considered the main cause of fatal aviation accidents, and there are numerous contributing factors. The purpose of this study is to clarify the significant factors leading to CFIT accidents and explore their causal relationships and interaction mechanisms by a hybrid HFACS-BN model. As a powerful quantitative tool, the model conducts an in-depth and systematic analysis of CFIT accidents, including causal reasoning analysis, diagnostic analysis, sensitivity analysis, scenario analysis, etc. Finally, combining theoretical and empirical analysis, the following conclusions are drawn: (1) Inadequate supervision, intentional noncompliance with SOPs/cross-check, GPWS not installed or GPWS failure, adverse meteorological environment, and ground-based navigation aid malfunction or not available are recognized as the top significant contributing factors for CFIT accidents; (2) Four levels of high sensitivity contributing factors are identified, including decision errors, intentional noncompliance with SOPs/cross-check, ground-based navigation aid malfunction or not available, GPWS not installed or GPWS failure, inadequate supervision, improper operation plan, inadequate management decision, and absent or deficient safety management, etc. (3) Meanwhile, intentional noncompliance with SOPs/cross-check, GPWS not installed or GPWS failure, inadequate supervision, and absent or deficient safety management are also considered to be the contributing factors most likely to fail. (4) The failure of some contributing factors at a single level has relatively little impact on the level of CFIT risk, but multiple contributing factors at different levels will sharply increase the level of the CFIT risk under the coupling effect. Collectively, these conclusions have very important theoretical significance and practical value, which is helpful to further understand the mechanism of CFIT accidents and provide valuable insights for safety management.

Due to the small number of CFIT accidents, it is difficult to obtain enough data to calculate the prior probabilities of contributing factors and the CPTs of BN. Therefore, we combined expert opinions in the study, and there would inevitably be some subjective judgments. In the future, we will expand the research samples. In addition to the CFIT accidents, we will also combine the CFIT incident to obtain sufficient data support, and the analysis results will be more accurate.