Analysis of Controller-Caused Aviation Accidents Based on Association Rule Algorithm and Bayesian Network

Abstract

Unsafe behavior among air traffic controllers is a significant causal factor in civil aviation safety incidents. To explore the risks and pathways associated with controller-induced aviation accidents, this study develops an analytical model of controller unsafe behavior based on association rules and fault tree Bayesian networks. First, the Human Factors Analysis and Classification System (HFACS) was applied to identify and categorize aviation incident reports attributed to controller errors. Next, association rule algorithms were employed to uncover potential associations between controller unsafe behaviors and related risk factors, and a fault tree Bayesian network (FT-BN) model of controller unsafe behaviors was constructed based on these associations. The results revealed that the most likely unsafe behaviors were: improper allocation of aircraft spacing (30.5%), failure to take necessary intervention measures (28.4%), and improper transfer of control (27.8%). Backward analysis of the FT-BN indicated that improper allocation of aircraft spacing was most likely triggered by failure to provide adequate controller training, failure to take necessary intervention measures was most often caused by forgotten information, and improper transfer of control was most frequently associated with controller fatigue and failure to put risk management efforts in place. This study provides an important framework for the analysis and evaluation of controller behavior management and offers key insights for improving air traffic safety.

1. Introduction

Aviation safety has always been a central concern for the civil aviation industry [1]. However, the tragic events of the Azerbaijan Airlines passenger plane crash [2] and the Jeju Air passenger plane explosion upon landing in South Korea [3] in December 2024 have made 2024 the deadliest year for commercial aviation since 2018. These incidents underscore the persistent and critical challenges in aviation safety, particularly within the domain of air traffic control. Notably, in January 2025, a mid-air collision occurred in Washington, D.C., between a Black Hawk helicopter and an American Airlines CRJ700 passenger aircraft, resulting in the deaths of all 67 individuals aboard [4]. The event exposed significant lapses in air traffic control procedures and coordination. Investigations revealed that the position, which was intended to be staffed by two controllers, was covered by only one due to staffing shortages. Additionally, air traffic control failed to require military aircraft to activate their ADS-B collision avoidance systems, and the issued instructions were vague. Moreover, a malfunction in radio communications hindered the full transmission of critical directives. These errors and coordination failures were direct contributors to the tragedy. In January 2024, an air collision occurred at Haneda Airport due to an air traffic control scheduling error [5]. A Japan Airlines Airbus A350, en route from New Chitose Airport in Hokkaido to Haneda Airport in Tokyo, collided with a Japan Coast Guard aircraft during landing, resulting in a fire and explosion on the passenger plane. Investigations revealed that the accident occurred during the New Year holiday period, when air traffic control personnel were understaffed, causing delays in scheduling and communication. This ultimately led to the failure to resolve flight conflicts promptly, contributing to the tragedy. A similar incident occurred at Shanghai Hongqiao Airport in 2016, when a China Eastern Airlines flight nearly collided with a taxiing aircraft [6]. Investigations found that air traffic controllers failed to promptly exchange flight status information, leading to incorrect assumptions about aircraft spacing and resulting in a runway incursion.

These incidents brought to light the critical role of air traffic controllers in ensuring flight safety, as even a single error—such as misreading radar signs or forgetting aircraft movements—can lead to catastrophic consequences. Isaac’s analysis of air traffic control safety events concluded that 90% of such incidents are closely linked to human errors [7]. Consequently, understanding the factors and pathways of human error among controllers is crucial for developing effective preventive measures and enhancing aviation safety.

In recent years, numerous scholars have focused on exploring the factors that lead to unsafe behaviors by air traffic controllers and on devising effective intervention strategies. The Human Factors Analysis and Classification System (HFACS) is a comprehensive method for analyzing human-caused accidents. It defines four levels of failure: unsafe behaviors, prerequisites of unsafe behaviors, unsafe supervision, and organizational impacts [8]. Xu employed HFACS in conjunction with grounded theory to comprehensively identify the risk factors associated with unsafe controller behaviors, organizing the relationships between core and secondary categories into a storyline [9]. Grounded theory is a qualitative analysis method that can delve deeply into potential patterns in data, but it lacks quantitative assessment and systematic probability analysis, and may not be able to fully quantify the relationships between various factors. Zhu combined the HFACS framework with the Analytic Hierarchy Process (AHP) method to establish an air traffic control human error classification system [10]. AHP relies on the subjective judgment of experts, especially in weight calculation, which may introduce significant subjective bias. It mainly focuses on the classification and weighting of human errors, lacking in-depth exploration and quantitative assessment of causal relationships. Xu analyzed the causal relationships between environmental, organizational, and supervisory factors and unsafe controller behaviors, and constructed a risk control model for these behaviors based on system dynamics [11]. System dynamics methods focus on macro-level process simulation. Although they can demonstrate changes in the behavior of the overall system, they lack detailed quantitative analysis of specific causal chains. Subsequently, Xu used association rule mining and random forest algorithms to predict and warn of unsafe behaviors by air traffic controllers, achieving good results [12]. However, this approach relies on large amounts of training data and makes it difficult to explain the intrinsic causal relationships within the model. It also lacks clear causal reasoning capabilities, making it difficult to reveal the underlying risk factors behind unsafe behaviors and their interactions. While these studies effectively identified the systematic risks and causality of unsafe behaviors, they predominantly relied on qualitative methods, failing to eliminate the influence of subjectivity, and lacked quantitative assessment.

The Fault Tree Bayesian Network (FT-BN) network effectively bridges the HFACS framework and provides a quantitative evaluation. Li integrated HFACS and Bayesian networks to derive the causal factors and global causal chain of ship collisions [13]. FT-BNs, which combine the probabilistic inference capabilities of Bayesian networks with a structured fault tree analysis approach, have been widely applied in accident analysis and system failure evaluation [14,15]. Bayesian networks, a probabilistic graphical model-based approach, offer a powerful framework for uncertainty modeling [16] and are extensively used in risk assessment across aviation [17] and rail transport [18]. However, traditional FT-BN models face certain challenges: (1) fault tree models often depend on expert reasoning, which can introduce subjective bias [19]; (2) constructing Bayesian networks requires determining prior probability tables, which also rely heavily on expert knowledge and subjective judgment. Association rule mining, a machine learning algorithm designed to uncover associations between variables in a dataset, is well-suited to mitigate the influence of subjective factors that can lead to biased risk assessments. It is widely used in market analysis, recommender systems, and text mining [20], and many researchers have applied association rule algorithms to extract valuable insights from accident and risk data [21,22]. In this study, association rules are utilized to construct fault tree models and derive prior probabilities, resulting in the development of an AR-FT-BN. This network identifies the latent factors behind unsafe controller behaviors and their propagation paths, facilitating the formulation of preventive strategies.

In conclusion, this paper proposes a quantitative analysis model of controller unsafe behaviors that integrates HFACS, association rules, and FT-BN. HFACS offers a systematic classification of unsafe behaviors and a comprehensive set of risk factors for the FT-BN. The association rule algorithm supports the construction of the network and the determination of prior probabilities. Through the AR-FT-BN, forward reasoning uncovers the implicit relationships between risk factors and controller behaviors, while reverse reasoning illuminates the propagation paths of these risk factors, offering targeted preventive measures. This approach provides essential theoretical support for air traffic control safety management and improves operational safety among controllers.

2. Research Methodology

2.1. HFACS Analytical Framework

HFACS is able to specifically define and classify causal factors, tracing them from surface behavioral causes to deeper organizational root causes. Stanton reviewed ergonomics and human factors in the aviation field and concluded that HFACS is currently the most widely used human error coding framework for accident analysis in the aviation industry [23]. Building on existing research [9,24], this paper identifies and classifies aviation accident datasets caused by air traffic controllers, determining that the primary indicators within the HFACS framework include unsafe behavior, preconditions for unsafe behavior, unsafe supervision, and organizational influence. Secondary indicators of unsafe behavior include: skill errors, decision errors, and violations; secondary indicators of preconditions for unsafe behavior include: environmental factors, controller factors, and controller status; secondary indicators of unsafe supervision include: inadequate supervision, improper planning, failure to correct problems, and supervision violations; secondary indicators of organizational influence include: resource management, organizational atmosphere, and organizational procedures.

To obtain a comprehensive and consistent human factors analysis framework for air traffic controllers, this paper combines the HFACS model with expert interviews. We first formed an expert panel to classify the causes in accident reports using HFACS theory, resulting in a preliminary framework for air traffic controller unsafe behaviors. The expert panel members included PhD and master’s degree students with years of experience in aviation, air traffic control, and aviation safety analysis. The expert panel then discussed and refined the preliminary HFACS framework based on accident reports and reached consensus through multiple rounds of feedback to ensure the consistency and reliability of the classification criteria.

The dataset comprises 85 unsafe aviation incidents caused by air traffic controller errors, sourced from Skybrary platform (https://skybrary.aero/). The data is shown in

Table A1. Aviation accident report dataset. Types of aviation accidents include: LOS, LB, RI, LOC, AW, CFIF, RE, GND, RE; Refer to Table A2.

ID	Event	Event Type
1	A310/C421, en route, northeast of Montréal Canada, 2018	LOS
2	A319/C337, St Petersburg-Clearwater USA, 2021	LB, LOS
3	A320 (2)/CRJX (2)/B738 (3)/A332, vicinity Madrid Barajas Spain, 2018	LOS
4	A320/A320, en route, east of Nashik India, 2022	LB, LOS,
5	A320/A320, en route, northeast of Surabaya Indonesia, 2018	LOS
6	A320/B738, Barcelona, Spain, 2022	LOS
7	A320/B738, vicinity Barcelona, Spain 2018	LOS
8	A20N/A320, Amsterdam Netherlands, 2019	RI
9	A20N/Vehicle, Lima Peru, 2022	RI
10	A20N, en-route, northwest Colombia, 2022	LOC
11	A319, Helsinki Finland, 2018	AW
12	A320/DR40, Bordeaux, France, 2022	RI
13	A320/E145, vicinity Barcelona Spain, 2019	LOS
14	A320/E195, vicinity Brussels Belgium, 2018	LOS
15	A320/P28A, Seville Spain, 2022	RI
16	A320/Vehicle, London Gatwick UK, 2018	RI
17	A320, Macau SAR China, 2018 (2)	RI
18	A320, Malé Maldives, 2018	CFIF
19	A320, Sharjah UAE, 2018	RI, RE
20	A320, Singapore Changi Singapore, 2021	GND
21	A320, vicinity Karachi Pakistan, 2020	LOC
22	A320, vicinity Paris CDG, France, 2022	CFIT
23	A333/B738, Barcelona Spain, 2022	RI
24	A333/C550, vicinity Madrid Barajas Spain, 2022	LOS
25	A333/GL5T, Dubai UAE, 2024	RI
26	A359, vicinity Paris Orly France, 2020	LOS
27	AT75, vicinity Pokhara, Nepal, 2023	LOC
28	AT76, Canberra Australia, 2019	RI
29	B38M, en-route, northeast of Jakarta Indonesia, 2018	LOC
30	B38M, Helsinki Finland, 2019	RI
31	B712/CRJ7, vicinity Strasbourg France, 2019	LOS
32	B734/Vehicle, Porto Portugal, 2021	RI
33	B737/B738, vicinity Amsterdam Netherlands, 2018	LOS
34	B737/B763, Austin USA, 2023	LOS, RI
35	B738/A320, Edinburgh UK, 2018	LOS
36	B738/A321, Venice Italy, 2022	RI
37	B738/B738/B752, Birmingham UK, 2020	RI
38	B738/B738, en-route, south of Écija Spain, 2019	LOS
39	B738/B738, Malaga Spain, 2019	RI
40	B738/B738, vicinity Sydney Australia, 2023	LOS
41	B738/DV20, vicinity Reus Spain, 2019	LOS
42	B738/E110, Brasilia Brazil, 2018	RI
43	B738/E195, Sao Paulo Congonhas, Brasil, 2020	RI, LOS
44	B738/E75L, San Diego USA, 2021	RI
45	B738/GL5T, Hong Kong China, 2018	RI
46	B738/Vehicle, Kansai, Japan, 2023	RI
47	B738/Vehicle, Palma Spain, 2020	RI
48	B738, Alicante Spain, 2018	RI
49	B738, Amsterdam Netherlands, 2019	RE
50	B738, Calicut (Kozhikode) India, 2020	RE
51	B738, Kuusamo Finland, 2021	LOC
52	B738, Lyon Saint-Exupéry France, 2019	RI
53	B738, vicinity Palma de Mallorca, Spain, 2023	LOC
54	B744/B773/B773, en-route, Delhi India, 2018	LOS
55	B752, Keflavik Iceland, 2019	CFIT
56	B752, Tulsa USA, 2022	RI
57	B763/B737, Tel Aviv Israel, 2018	GND
58	B763, Halifax NS Canada, 2019	GND, RE
59	B772/B739, New York JFK USA, 2023	RI
60	B773/E190, Toronto Canada, 2020	RI
61	B788, en-route, northern UK, 2023	LOC
62	B789/A332, vicinity Sydney Australia, 2022	LOS
63	B789/B744, Amsterdam Netherlands, 2019	GND
64	B78X/A320, Paris CDG France, 2020	RI
65	B78X, vicinity Abu Dhabi UAE, 2020	CFIT
66	C25A/Vehicle, Reykjavik Iceland, 2018	RE
67	CL30/Vehicle, Subang Malaysia, 2019	RI
68	CRJ2/DA40, en-route, east northeast of Sion, Switzerland, 2020	LOS
69	CRJ2/Vehicles, Montréal Canada, 2019	RI
70	CRJX, Nantes France, 2021	CFIT
71	DH8D/P180, en-route, near Kelowna BC Canada, 2019	LOS
72	DH8D, Belagavi India, 2021	RI
73	DH8D, Kathmandu Nepal, 2018	RE
74	E170/A320, vicinity Paris CDG France, 2020	LOS, LOC
75	E170/C525, en-route, south of Auxerre France, 2022	LB, LOS
76	E190/B738, Amsterdam Netherlands, 2018	RI
77	E190, Comodoro Rivadavia Argentina, 2019	RI
78	F100, Paraburdoo Australia, 2021	CFIT
79	L410, Dubrovnik Croatia, 2018	CFIT
80	MD83/AT76, Isfahan Iran, 2018	RI
81	MD83, Port Harcourt Nigeria, 2018	RE
82	SF34/PA27, Nassau Bahamas, 2018	RI, LOS
83	SH36, Ndola Zambia, 2021	RI
84	Vehicle, Singapore Changi Singapore, 2022	RI
85	A320/A333, Shanghai Hongqiao China, 2016	RI

. Types of aviation incidents include runway incursions and loss of separation, among others, as shown in

Table A2. Types of Aviation Accidents.

Abbreviation	Full Term	Description
LOS	Loss of Separation	Simultaneous infringement of both horizontal and vertical separation minima between airborne aircraft operating in controlled airspace, as prescribed by the competent ATS authority in accordance with ICAO standards.
LB	Level Bust	Any unauthorized vertical deviation of ≥300 ft from the ATC-assigned flight level, or ≥200 ft within Reduced Vertical Separation Minima (RVSM) airspace, by an aircraft under radar or procedural control.
RI	Runway Incursion	Any occurrence at an aerodrome involving the incorrect presence of an aircraft, vehicle, or person on the protected area of a surface designated for the landing and take-off of aircraft (ICAO definition).
LOC	Loss of Control	An in-flight event in which an aircraft unintentionally departs from its intended flight envelope or attitude, potentially resulting in an unrecoverable flight condition; LOC-I is a leading cause of fatal aviation accidents.
AW	Airworthiness Issue	Any condition in which an aircraft, engine, propeller, or component fails to conform to its approved type design or is otherwise in a state unfit for safe operation, as defined by ICAO Annex 8.
CFIF	Controlled Flight Into Terrain	An accident or serious incident wherein an airworthy aircraft, under the complete control of the flight crew, is unintentionally flown into terrain, water, or an obstacle with no prior awareness of the impending collision.
RE	Runway Excursion	A veer-off or overrun event in which an aircraft departs the lateral confines or the end of the runway surface during the take-off or landing phase, whether intentional or unintentional (ICAO).
GND	Ground Operations Event	Any safety-relevant occurrence during aircraft handling, taxiing, or servicing on the airport movement area, excluding active-runway incursions, which poses a risk to personnel, aircraft, or facilities.

. The data covers incidents occurring between 2018 and 2024. Skybrary is an online platform dedicated to aviation safety and accident analysis, offering detailed aviation accident reports, accident precursor reports, and other relevant aviation safety data. Using Skybrary’s accident database filtering function, we selected incidents that were partially or entirely caused by controller errors. All incidents included detailed accident backgrounds, descriptions of controller behavior, specific incident processes, accident consequences, and related controller behavior analyses. The expert panel paid particular attention to the types of controller errors, accident types, and their impacts during the selection process to ensure that the selected incident data was representative and had research value. This study is based on the following assumptions: all aviation accident reports accurately and completely reconstruct the accident process. Additionally, it is assumed that the HFACS framework cannot cover all unsafe controller behaviors. The expert panel supplemented the relevant unsafe behaviors through analysis and research and classified them within the HFACS framework.

In this process, we assess the correlation between factors. For example, adverse weather conditions (such as thunderstorms, rain, and snow) and sudden weather changes often produce similar risk impacts under certain circumstances, so we classify them as “weather factors.” Considering that the focus of our research should be on human error by air traffic controllers and their work environment, we have integrated some risk factors to reduce the difficulty of data collection and the redundancy of subsequent correlation rules. For example, the absence of emergency facilities, equipment failures and obsolescence, improper cockpit resource management, runway lighting issues, and the lack of standardized airport signage are all described as “deficiencies in equipment resource management.” In such cases of equipment failure, air traffic controllers are more likely to make judgment errors or omissions during operations. Finally, an HFACS framework containing 51 accident factor controllers was established based on accident factors (

Table A3. Controller HFACS Framework.

HFCAS Level	Subcategory	Human Factors
A-Organizational Influence	A1-Resource Management	A11-Leaks in Equipment Resource Management
	A2-Organizational Climate	A21-Failure to Form an Effective Safety Culture in Control Units
		A22-Failure to Put Risk Management Efforts in Place
	A3-Organizational Procedures	A31-Irrational Control Pre-planning
		A32-Improvement of Risk Assessment Mechanisms
		A33-Improper Definition of Rights with Relevant Units
B -Unsafe Supervision	B1-Inadequate Supervision	B11-Failure to Set Up Monitoring Seats as Required
	B2-Improper Planning	B21-Failure to Reasonably Assign Tasks
		B22-Improper Flight Plans
		B23-Failure to Provide Adequate Controller Training
		B24-Improper Shift Matching
	B3-Failure to Correct Problems	B31-Monitoring Seats Failure to Detect Controller Erroneous Orders for Timely Correction
		B32-Controllers Failure to Report Unsafe Trends in a Timely Manner
		B33 -Controller fails to correct pilot instruction recitation errors
	B4-Supervisory Violations	B41-Failure to supervise as required
C-Prerequisites for Unsafe Behavior	C1-Environmental Factors	C11-Equipment malfunctions resulting in poor ground-to-air communications
		C12-Weather Factors
		C13-Airfield Bird Damage
		C14-Airfield Design Defects
		C15-Mechanical Malfunctions
		C16-Crew Factors
		C17-Ground Handling Factors
	C2-Controller Status	C21-Physical/mental fatigue
		C22-Improper distribution of the controller’s energy not effectively monitoring aircraft dynamics
		C23-High load
		C24-Misinterpretation of information
		C25-Forgotten information
		C26-Message confusion/Confusion of information about the aircraft
		C27-Misunderstanding of expectations
		C28-Negligence/laxity
		C29-Weak safety awareness
	C3-Controller factor	C31-Lack of experience in control
		C32-Substandard English proficiency
		C33-Poor special case handling
		C34-Inadequate operational level
		C35-Lack of control qualification
U-Unsafe behavior	U1-Errors in skills	U11-Improper handling of special cases
		U12-Lagging communication with military air traffic control
		U13-Erroneous landing/departure clearance
		U14-Mislocutionary error in issuing incorrect instructions
		U15-Existence of miscommunication with flight crews
		U16-Failure to take the necessary intervention measures
	U2-Errors in decision-making	U21-Improper allocation of aircraft spacing
		U22-Improper sequencing scheme
		U23-Improper redeployment of flight conflicts
		U24-Improper transfer of control
		U25-Failure to make a timely decision
	U3-Incompliance with regulations	U31-Control terminology violation
		U32-Failure to carry out a control transfer in accordance with the regulations
		U33-Violation of the work rules of the control room
		U34-Serious disciplinary violation

). In Table A3, the factors are categorized according to unsafe behaviors, prerequisites for unsafe behaviors, unsafe regulation, and organizational influence, where Ui represents unsafe behaviors, Ai represents organizational influence, Bi represents unsafe regulation, and Ci represents prerequisites for unsafe behaviors.

After sorting out the errors caused by the lack of controller situational awareness, we found that these errors are strongly correlated with the controller’s unsafe states. Therefore, our research focuses on categorizing these unsafe states to explore their impact. We identified five distinct controller states that lead to the lack of situational awareness: improper allocation of attention without effective monitoring of aircraft dynamics, misinterpretation of information, forgetting of information, confusion of information, and false expectations. Misinterpretation of information refers to errors that occur during the process of obtaining information, including misreading aircraft dynamics, misinterpreting process order, and misunderstanding aircraft-related information. Forgetting information involves failing to recall necessary details, such as forgetting instructions, runway conditions, or the need to hand over an aircraft in flight. Confusion of information occurs during the association or matching phase, where information is received correctly but is incorrectly linked to the wrong object, such as confusing an aircraft’s callsign or misinterpreting aircraft dynamics. False anticipation refers to errors in scenario prediction or situational awareness, where the controller correctly receives and associates the information but introduces bias in predicting or rehearsing the scenario. This can manifest as errors in four-dimensional dynamics modeling or misjudgments of the system’s state.

2.2. Association Rule Mining

The concept of association rule algorithms was first introduced by Agrawal et al. [25] in 1993, initially applied to the retail industry. By analyzing customer purchasing behavior, retailers were able to uncover the intrinsic relationships between different items. The core principle of the algorithm is to derive association rules from frequent itemsets. The three key metrics central to this algorithm are: support, confidence, and lift. These metrics help assess the strength, likelihood, and relevance of the discovered rules in revealing meaningful associations between items within the dataset.

$$Support(X)={\displaystyle \frac{\left|T_X\right|}{\left|T\right|}}$$

(1)

where $Support\left(X\right)$ represents the support of an association rule, indicating the probability that a particular rule appears across all transactions. Let T denote the total number of transactions, and T_x represent the set of transactions that contain the itemset. The support of a rule is calculated as the ratio of the number of transactions containing the itemset to the total number of transactions, providing a measure of how frequently the rule occurs within the dataset.

The formula for the confidence level, in terms of $\left\{A\right\}\to \left\{B\right\}$:

$$Con(\{A\}\to \{B\})={\displaystyle \frac{Sub(\{A,B\})}{Sub(\{A\})}}$$

(2)

Confidence denotes the probability that a posterior term will occur given the occurrence of a prior term, and it serves as a measure of the rule’s accuracy.

$$Lift(\{A\}\to \{B\})={\displaystyle \frac{Con(\{A\}\to \{B\})}{Sub(\{B\})}}$$

(3)

$Lift\left(\left\{A\right\}\to \left\{B\right\}\right)$ is the lift of an association rule, representing the ratio of the probability of the latter item occurring in the presence of the former item to the probability of the latter item occurring independently. It measures the validity of the rule; if the lift is greater than 1, then $\left\{A\right\}\to \left\{B\right\}$ is considered a valid association rule.

In this paper, we first use association rule algorithms to uncover potential associations between unsafe behaviors of air traffic controllers and related risk factors. The purpose of this step is to provide data support for subsequent modeling using the FT model. To ensure the validity and standardization of the data, it is necessary to classify the statistical data according to attributes. We use the values “T” and “F” to indicate whether a risk factor played a role in a specific event, where ‘F’ means the risk factor did not have an impact on the event, and “T” indicates it did play a role. By arranging each event horizontally and accident causes vertically, we obtain an 85 × 51 association matrix. The organized data is then input into SPSS Modeler 18.0 software for analysis.

In association rule algorithms, there are no explicit threshold standards for minimum support and minimum confidence. Researchers generally use dynamic adjustment methods to find appropriate thresholds [26,27]. By setting risk factors as the antecedents of association rules and controller errors and violations as the consequents, we initially set the minimum confidence to 50%, the minimum support to 3%, and the maximum number of antecedent items to 5, resulting in 235 association rules. To test the effectiveness of the association rule mining model, we adjusted the thresholds for minimum support and minimum confidence to observe the stability and generation effectiveness of the rules. During the threshold adjustment process, if new association rules appeared, they were added to the existing rule set until no new rules were generated. Ultimately, the minimum support was adjusted to 2%.

Invalid association rules can affect the accuracy of analysis results [25]. We prune high-dimensional association rules to remove invalid rules. For example, if a two-dimensional rule “{B41, A21} ⇒ {U11}” has a confidence level of 50%, and a three-dimensional rule “{B41, A21, C32} ⇒ {U11}” also has a confidence level of 50%, then the three-dimensional rule is considered redundant because it does not add any additional information and should therefore be deleted. Finally, 125 strong association rules are obtained, as shown in

Table A4. Strong association rules table.

Post-Term	Pre-Term	Support (%)	Confidence (%)	Post-Term	Pre-Term	Support (%)	Confidence (%)
U12	A33	2.35	100.00	U21	B32 and A21	3.53	66.67
U15	B33	2.35	100.00	U23	C26 and C16	3.53	66.67
U11	C15	2.35	100.00	U24	C21 and C28	3.53	66.67
U22	B11	3.53	100.00	U16	C25 and C16	3.53	66.67
U15	C32	4.71	100.00	U23	C23 and C27	3.53	66.67
U12	A33 and A22	2.35	100.00	U23	A11 and C12	3.53	66.67
U12	A33 and C31	2.35	100.00	U23	A11 and C16	3.53	66.67
U12	A22 and C31	2.35	100.00	U11	C33 and A31	3.53	66.67
U11	C15 and C33	2.35	100.00	U11	C33 and B23	3.53	66.67
U11	C15 and A31	2.35	100.00	U13	A31 and B31	3.53	66.67
U11	C15 and B23	2.35	100.00	U11	A31 and B23	3.53	66.67
U22	B11 and C24	2.35	100.00	U21	C21 and A21	3.53	66.67
U22	B11 and C29	2.35	100.00	U21	A21 and C16	3.53	66.67
U11	B22 and C12	2.35	100.00	U21	C12 and B23	3.53	66.67
U11	B22 and C16	2.35	100.00	U15	B24 and A21	3.53	66.67
U21	B32 and C21	2.35	100.00	U23	B31 and C16	3.53	66.67
U21	B32 and C16	2.35	100.00	U23	C27 and C16	3.53	66.67
U22	C24 and C29	2.35	100.00	U13	C27 and C31	5.88	60.00
U23	C26 and B31	2.35	100.00	U11	C33	8.24	57.14
U15	C32 and B21	2.35	100.00	U13	C17	8.24	57.14
U15	C32 and B24	2.35	100.00	U21	C31 and B23	10.59	55.56
U15	C32 and A21	2.35	100.00	U24	C25	11.76	50.00
U13	C22 and C34	2.35	100.00	U23	B31	11.76	50.00
U13	C22 and B23	2.35	100.00	U23	B24	11.76	50.00
U13	C22 and C16	2.35	100.00	U33	B41 and A21	2.35	50.00
U23	B21 and C34	2.35	100.00	U25	C11 and C12	4.71	50.00
U15	B21 and A21	2.35	100.00	U31	C14 and C28	2.35	50.00
U23	B21 and B31	2.35	100.00	U31	C14 and A21	2.35	50.00
U16	C11 and C29	2.35	100.00	U31	C14 and B23	2.35	50.00
U13	C24 and C34	2.35	100.00	U23	C14 and C28	2.35	50.00
U13	C24 and A21	2.35	100.00	U23	C14 and A21	2.35	50.00
U24	C25 and C21	4.71	100.00	U23	C14 and B23	2.35	50.00
U24	C25 and A22	3.53	100.00	U22	A32 and C27	2.35	50.00
U24	C21 and A22	3.53	100.00	U22	C22 and C31	2.35	50.00
U16	C29 and C12	2.35	100.00	U11	B41 and A21	2.35	50.00
U16	C29 and C16	2.35	100.00	U31	C29 and B23	2.35	50.00
U11	C23 and A22	2.35	100.00	U31	C34 and C16	4.71	50.00
U23	C23 and B24	2.35	100.00	U23	A32 and C27	2.35	50.00
U23	C23 and A22	2.35	100.00	U11	C22 and C31	2.35	50.00
U23	A11 and C33	2.35	100.00	U15	B21 and B24	4.71	50.00
U15	C17 and A22	3.53	100.00	U23	B21 and B24	4.71	50.00
U13	C17 and C27	2.35	100.00	U16	C11 and C12	4.71	50.00
U13	C17 and C31	2.35	100.00	U16	C11 and C16	4.71	50.00
U13	A31 and C25	2.35	100.00	U24	C29 and B23	2.35	50.00
U13	A31 and C12	2.35	100.00	U24	C25 and C28	4.71	50.00
U23	C34 and B31	2.35	100.00	U24	A22 and C28	4.71	50.00
U23	C34 and B24	2.35	100.00	U16	C25 and C28	4.71	50.00
U13	C34 and A21	2.35	100.00	U16	C28 and C16	4.71	50.00
U13	C34 and B23	2.35	100.00	U11	C33 and C12	4.71	50.00
U21	C21 and C16	2.35	100.00	U11	C33 and C16	4.71	50.00
U21	B24 and C31	2.35	100.00	U23	C33 and C12	4.71	50.00
U21	B24 and B23	2.35	100.00	U23	C33 and C16	4.71	50.00
U15	A22 and B23	2.35	100.00	U15	C17 and C28	4.71	50.00
U13	C25 and C12	2.35	100.00	U15	C17 and B23	4.71	50.00
U23	B31 and B24	3.53	100.00	U13	C17 and C28	4.71	50.00
U13	B31 and C12	2.35	100.00	U13	C17 and B23	4.71	50.00
U23	B24 and C27	2.35	100.00	U13	C34 and C16	4.71	50.00
U23	C26	4.71	75.00	U21	C31 and C12	4.71	50.00
U13	C25 and B31	4.71	75.00	U15	A22 and C28	4.71	50.00
U23	C23	8.24	71.43	U15	C28 and B23	4.71	50.00
U11	B22	3.53	66.67	U11	C21 and C27	2.35	50.00
U21	B32	3.53	66.67	U13	C21 and C27	2.35	50.00
				U13	B23 and C16	4.71	50.00

.

Support represents the frequency of the simultaneous occurrence of the antecedent and consequent items, while confidence indicates the probability of the consequent item’s occurrence given the occurrence of the antecedent item. Ranking the support of the posterior term reveals the top five most likely unsafe behaviors for controllers: improper aircraft spacing assignment, improper flight conflict deployment, incorrect landing/takeoff clearance, improper control handover, and control terminology violation. Ranking the support of the association rules, the risk factors for the frequent item set are ordered as follows: C31 (lack of control experience), C27 (false expectation), C21 (physical/mental fatigue), C25 (information forgetting), B31 (monitor seat not noticing control seat misinstructions in time to correct them), B24 (improperly matched shifts), C25 (information forgetting), B31 (monitor seat not noticing control seat misinstructions in time to correct them), C34 (insufficient operational level), C29 (weak safety awareness), C23 (high load), C33 (poor special case handling ability), C17 (ground handling factor), C24 (misunderstanding of information), A11 (loopholes in equipment resource management), C22 (controllers’ inappropriate allocation of energy to monitor aircraft movements), B21 (failure to reasonably assign tasks), C32 (inadequate English language proficiency), C26 (confusion of information/aircraft information), B11 (failure to set up monitoring seats according to regulations), B22 (failure to set up monitoring seats according to regulations), B32 (controller failed to report the unsafe trend in time), C14 (airfield design defects), A33 (unclear definition of the rights with relevant units), B33 (controller failed to correct the error in reciting the pilot’s instructions), and C15 (mechanical failure).

The coupled errors in the air traffic control system can be observed through the correlation rules, generally revealing the transmission path of “organization-regulation-unsafe premise-unsafe behavior.” For instance, {A33, C31→U12} illustrates a three-level transmission characteristic of “organization-unsafe premise-error,” where the fuzzy division of authority and responsibility in airspace hinders inexperienced controllers from coordinating with military and aviation departments in a timely manner. In the case of {B33, C32→U15}, it demonstrates the transmission of “supervision-unsafe behavior prerequisite-error,” with non-native English-speaking controllers continuing to issue ambiguous instructions without a recitation correction mechanism. Additionally, risk patterns of high-frequency low-risk and low-frequency high-risk can be verified. Load states, although common, only 71.4% evolved into conflicting deployment errors due to inherent coping mechanisms (e.g., dual monitor seats). Mechanical failures and planning deficiencies, though supported by only 2.35%, lead to 100% confidence in special case disposition failures, highlighting a particularly critical risk to be aware of.

2.3. Determine the Structure of the Fault Tree

Controller unsafe behavior is the direct cause of aviation accidents, representing the first level of the fault tree. Once the direct factors are determined, it is essential to identify the specific intermediate events and logic gates [28]. This section uses U23, “Improper redeployment of flight conflicts” as an example. The risk factor is considered the antecedent of the association rule, while the controller’s unsafe behavior is the consequent. In the association rule algorithm, there is no fixed threshold for minimum support and minimum confidence. Literature indicates that these thresholds can be continuously adjusted to find an optimal value [27,29]. By adjusting the thresholds for minimum support and minimum confidence, we determined that a minimum support of 0.02 and a minimum confidence of 0.45 effectively identified risk factors strongly associated with “flight conflict misallocation” (

Table 1. Risk Factors and U23 Association Rules.

Post-Term	Pre-Term	Percent Support	Percent Confidence	Gain
U23	C35	1.1765	100.0000	6.0714
U23	C26	4.7059	75.0000	4.5536
U23	C23	8.2353	71.4286	4.3367
U23	B31	11.7647	50.0000	3.0357
U23	B24	11.7647	50.0000	3.0357
U23	B21	5.8824	40.0000	2.4286

).

The term “and-gate” is used to denote a situation in which multiple factors work together to cause a specific outcome, implying an inherent correlation and dependence between these factors. In contrast, the “or-gate” is used to describe a scenario where the occurrence or failure of any one of several factors may lead to a particular outcome, indicating a lack of direct connection or dependence between these factors [30]. The construction method is as follows: First, the association rules for combinations of factors contributing to flight conflict misallocation (

Table 2. Combination factors and U23 correlation rules.

Association Rule	Percent Support	Percent Confidence	Gain
C26 and C23→U23	1.1764	100.0000	6.0714
B21, B31 and B24→U23	2.3529	100.0000	6.0714

) are calculated, prioritizing those with significant correlations and dependencies. For example, in Table 2, the first association rule has a lift of 6.071, while the individual factors C26 and C23 have lifts of 4.5536 and 4.3367, respectively. The combination of C26 and C23 results in a higher lift (6.0714), indicating a stronger correlation compared to the individual factors. As a result, C26 and C23 are combined as an and-gate event X1. Similarly, B21, B31, and B24 are combined as an and-gate event X2. The fault tree structure leading to the Improper redeployment of flight conflicts is then constructed (Figure 1).

Similarly, a fault tree of unsafe controller behavior can be constructed (Figure 2).

2.4. Bayesian Network Modeling

A Bayesian network consists of a directed acyclic graph and a conditional probability table. For each node X_i in the Bayesian network, its conditional probability distribution P(X_i∣Parents(X_i)) describes the behavior of that node given its parents. The joint probability distribution P(X₁, X₂, …, X_n) can be expressed using the chain rule, as shown in Equation (4).

$$P(X_1,X_2,\dots ,X_n)={\displaystyle \prod _{i=1}^{n}P}(X_i\mid \mathrm{Parents}(X_i))$$

(4)

where X₁, X₂, ..., X_n denote all nodes in the Bayesian network, and Parents(X_i) denotes the set of parents of node X_i.

Bayes’ theorem is the core of Bayesian networks and is used to update the prior probability to the posterior probability, Equation (5).

$$P(H\mid E)={\displaystyle \frac{P(E\mid H)\cdot P(H)}{P(E)}}$$

(5)

where P(H) is the prior probability, P(H∣E) is the posterior probability, P(E∣H) is the likelihood, and P(E) is the evidence probability. The posterior probability of a node can be computed by Bayes’ theorem for a node X and its set of parent nodes Pa(X), then the posterior probability of node X can be expressed as Equation (6).

$$P(X=x\mid \mathrm{Pa}(X)=\mathrm{pa})={\displaystyle \frac{P(\mathrm{Pa}(X)=\mathrm{pa}\mid X=x)\cdot P(X=x)}{P(\mathrm{Pa}(X)=\mathrm{pa})}}={\displaystyle \frac{P(\mathrm{Pa}(X)=\mathrm{pa}\mid X=x)\cdot P(X=x)}{{\displaystyle \sum _{x^{\prime }\in \mathrm{Domain}(X)}P}(\mathrm{Pa}(X)=\mathrm{pa}\mid X=x^{\prime })\cdot P(X=x^{\prime })}}$$

(6)

2.4.1. Bayesian Modeling of Fault Trees

In this study, the logical gates of the fault tree correspond to the qualitative topology of the Bayesian network in the following way: the top event of the with-gate structure occurs only when all the input events occur, and the output event T of the or-gate occurs whenever one of the input events occurs.

The final constructed Bayesian qualitative topology is shown in Figure 3.

2.4.2. Determining the Prior Probability Table for Bayesian Networks

In the study of Bayesian networks, accurately obtaining the probability of basic events has been a persistent challenge. Although many scholars have attempted to estimate the probability of basic events by combining fuzzy triangular theory and expert inference [18,31], these methods, which rely on subjective evaluation, often reduce the prediction accuracy of the model. In this study, the probability of a basic event is set as the actual proportion of that event in the database, effectively minimizing the interference of subjective factors. For example, event A22 appeared 11 times in 86 aviation accidents, resulting in an a priori probability of 12.7907%. This approach yields a table of a priori probabilities for risk factors (

Table 3. A Priori Probability Table for Risk Factors.

Event	Priori Probability	Event	Priori Probability
U14	1.1628	U16	6.9767
U34	1.1628	A11	6.9767
U32	1.1628	C23	8.1395
C13	1.1628	C33	8.1395
U33	1.1628	C17	8.1395
C35	1.1628	A31	8.1395
U12	2.3256	C29	9.3023
A33	2.3256	C34	10.4651
B33	2.3256	U21	10.4651
C15	2.3256	U15	12.7907
U25	3.4884	C25	11.6279
B11	3.4884	B31	11.6279
B22	3.4884	U11	12.7907
C14	3.4884	C21	12.7907
B32	3.4884	B24	11.6279
U22	4.6512	A22	12.7907
B41	4.6512	C28	13.9535
C26	4.6512	C27	16.2791
C32	4.6512	C31	16.2791
U31	5.8140	U23	16.2791
A32	4.6512	U13	17.4419
C22	5.8140	A21	18.6047
B21	5.8140	C12	19.7674
C24	6.9767	B23	23.2558
U24	6.9767	C16	34.8837
C11	8.1395

).

The probability of an intermediate event can be determined by considering all the paths that lead to the occurrence of that event [32]. If an intermediate event can occur through more than one path, its probability is the sum of the probabilities of these paths. For example, event X11 is jointly determined by three sub-events—A32, C29, and C22. The conditional probability P(X11∣A32, C29, C22) of X11 occurring is calculated as shown in

Table 4. A priori probability table for intermediate event X11.

A32	C29	C22	Y	N
Y	Y	Y	0.0003	0.9997
		N	0.0048	0.9952
	N	Y	0.0030	0.9970
		N	0.0441	0.9559
N	Y	Y	0.0060	0.9940
		N	0.0877	0.9123
	N	Y	0.0546	0.9454
		N	0.2006	0.7994

.

In the top-level event controller’s error, event U22 consists of three parent nodes X11, X22 and B11. The a priori probability of converting them into U22 by the same reason is shown in

Table 5. Prior probability table for the top event U22.

X11	X12	B11	Y	N
Y	Y	Y	0.0008	0.9992
		N	0.0178	0.9822
	N	Y	0.0063	0.9937
		N	0.1482	0.8518
N	Y	Y	0.0036	0.9964
		N	0.0849	0.9151
	N	Y	0.0301	0.9699
		N	0.2916	0.7084

.

The probabilities of other paths can be similarly determined by the above method, and the final construction of the quantitative Bayesian network analysis model of controller unsafe behavior is completed in Figure 4.

3. Results and Discussion

3.1. Bayesian Network Forward Inference

The edge probabilities of the unsafe behavior nodes are calculated through Bayesian forward reasoning, without setting any evidence or altering the state of the nodes, as shown in

Table 6. Probability of occurrence of unsafe behaviors.

Unsafe Behavior	Association Rule Support (%)	Bayesian Edge Probability (%)
U21	10.47	30.51
U16	6.98	28.41
U24	6.98	27.84
U33	1.16	26.84
U32	1.16	26.50
U23	16.28	26.01
U12	2.33	24.43
U34	1.16	22.59
U14	1.16	20.95
U13	17.44	20.08
U15	12.79	17.42
U11	12.79	13.62
U31	5.81	13.28
U25	3.49	9.52
U22	4.65	6.25

. The association rule support represents the frequency of the actual occurrence in all the accidents, while the edge probabilities are computed by combining the node relationships in the Bayesian network with the prior probabilities.

The probability of occurrence of unsafe acts by the top five controllers is as follows: 30.51% for U21 (improper aircraft spacing allocation), 28.41% for U16 (failure to take necessary intervention measures), 27.84% for U24 (improper transfer of control), 26.84% for U33 (improper deployment of flight conflicts), and 26.50% for U32 (irrational sequencing scheme). Among these, the probability of improper aircraft spacing allocation is the highest for U21. Although U21 does not have the highest occurrence in historical data, the Bayesian inference model suggests that the risk of U21 increases due to the interaction of other factors, such as controllers’ workload and equipment failures.

GeNIe 4.0 software was manufactured by Bayes Fusion, LLC, and was able to reveal the strength of conditional probability distributions and path dependencies.

Table 7. Pathway Strength Ranking.

Parent Node	Child Node	Average	Maximum	Weighting
B11	U22	0.679402	0.679402	0.679402
A33	U12	0.228852	0.235704	0.228852
X8	U16	0.213833	0.247061	0.213833
B23	X9	0.198181	0.238372	0.198181
C26	U14	0.176473	0.186217	0.176473
B32	U21	0.17641	0.367788	0.17641
A21	U34	0.172898	0.19186	0.172898
A21	U32	0.159512	0.19186	0.159512
X17	U33	0.15829	0.19186	0.15829
C35	U23	0.157962	0.321531	0.157962

summarizes the causal pathways with the top ten path strengths in the Bayesian network, showing the main risk transmission chain from risk factors to unsafe behaviors. The path B11→U22 exhibits the highest strength, where failure to set up the monitoring seat according to regulations is likely to lead to errors in the controller’s sequencing scheme. One reason for its significantly higher strength compared to other paths is the limited number of samples in this path within the dataset; the values are expected to return to a normal range as the sample size increases. Additionally, the path with the second-highest intensity is A33→U12, where an unclear definition of authority between the control unit and related units may lead to communication errors.

3.2. Bayesian Network Reverse Inference

Using GeNIe 4.0 software for backward reasoning, a specific unsafe act node is set as observed, meaning the node status of the unsafe act layer is set to 100%. The posterior probability of the parent node is then observed to change, allowing us to determine which unsafe acts are most likely to lead to the occurrence of further unsafe behaviors. The Bayesian model is updated to obtain both the prior probability before evidence is set and the posterior probability after evidence is set. The risk factors of unsafe behaviors by controllers caused by poor decision-making are illustrated in Figure 5.

Among the changes in the relationships of U21’s parent nodes, the intermediate event X9 shows the largest change, from 28.5% to 45.2%, followed by C31, which increases from 16.8% to 30.1%, and B23, which increases from 23.8% to 29.2%. Notably, C31 and B23 are also the parent nodes of X9. Other changes include B32, which increases from 4% to 12%, A32, which increases from 5.2% to 7.1%, X10, which decreases from 11.6% to 10.1%, and C24, which decreases from 7.5% to 6.2%. These results indicate that X9 is the most likely risk factor leading to the occurrence of U21. B23 and C31 are the risk factors contributing to the occurrence of the intermediate event X9, leading to the identification of an accident path. Similarly, the accident paths for other unsafe behaviors can be determined.

Combining these findings with the prior probability of controller unsafe behaviors, the three causal paths most likely leading to controller errors are as follows:

• Path 1: C31 and B23 → X9 → U21
• Path 2: C28, C29, and C25 → X7 → U16
• Path 3: C21 and A22 → X16 → U24

Path 1 highlights that the lack of control experience is a primary factor triggering aircraft spacing configuration errors. Inexperienced controllers often struggle to establish clear airspace conflict models when confronted with complex traffic scenarios, such as high traffic volume, significant speed differentials, and intersecting flight paths. This can lead to delayed critical judgments or erroneous instructions. For instance, on 4 February 2023, a serious runway conflict occurred at Austin-Bergstrom International Airport, nearly resulting in a collision between a FedEx cargo aircraft and a Southwest Airlines passenger jet. During the incident, air traffic controllers failed to effectively coordinate the takeoff and landing of the two aircraft, causing both planes to enter the same runway at nearly the same time. An investigation revealed that the Austin tower had not undergone low-visibility operations training for two years prior to the incident. Furthermore, the controllers at the time were overworked and lacked sufficient experience and emergency response capabilities. On one hand, the training content did not adequately address the real-world needs of controllers in complex situations, making it difficult for inexperienced controllers to effectively manage emergencies. On the other hand, the monitoring system exhibited gaps, as shift controllers failed to detect and correct the erroneous instructions of trainee controllers in a timely manner. Consequently, the implementation of scenario-based training, simulating complex traffic flows and emergencies, is essential to better prepare controllers for such high-pressure scenarios.

Path 2 represents a typical developmental trajectory of aviation safety incidents triggered by situational awareness errors. Factors such as information forgetfulness, negligence, and weak safety awareness converge to undermine the controller’s ability to perceive the flight situation accurately. Cognitive overload and a lack of individual vigilance further impair the capacity to maintain situational awareness, especially when controllers are inundated with tasks and information. In high-pressure or high-intensity operational environments, insufficient concentration and alertness increase the likelihood of negligence. Such lapses are not indicative of a deficiency in skill but rather result from the imbalance in the allocation of attentional resources and task redundancy. This leads to the failure of controllers to accurately identify changes in-flight situations at critical junctures, causing a distortion of situational awareness that ultimately manifests as situational awareness errors. Effective maintenance of situational awareness requires controllers to dynamically integrate and continuously update information from various sources. Negligence often results in delayed updates to the situational model or information gaps, which leads to biased judgments on key variables such as airspace conflicts, flight intentions, and weather disturbances [33]. For instance, on 11 October 2016, a serious runway incursion occurred at Hongqiao International Airport in Shanghai, China, where China Eastern Airlines flight MU5643 came dangerously close to colliding with taxiing flight MU5106 during takeoff. The investigation revealed that tower controllers failed to update and share flight dynamic information in a timely manner during the coordination process, leading to errors in assessing the real-time positions and statuses of the two aircraft. In this high-intensity work environment, controllers were unable to effectively monitor and coordinate the movements of multiple flights, resulting in delays in the transmission and execution of instructions. Consequently, the development of a monitoring mechanism that can detect minor behavioral deviations, the enhancement of hierarchical buffers for task allocation, and the creation of decision-support tools based on brain fatigue sensing techniques have emerged as critical strategies for improving controllers’ ability to maintain situational awareness [34,35].

Path 3 shows that prolonged high-intensity work reduces controllers’ cognitive sensitivity and information response rate, which in turn affects the accurate communication of flight position, intention, and airspace status during the handover process. The role of A22 highlights the lack of shift assessment mechanisms, status detection methods, and proactive intervention strategies at the organizational level. As a result, fatigued controllers are assigned to high-load positions, amplifying the associated risks. For example, on 18 March 2019, a serious runway collision occurred at Sultan Abdul Aziz Shah Airport in Kuala Lumpur, Malaysia, nearly involving a Challenger 300 business jet and an airport engineering vehicle. The investigation found that during the handover, the outgoing ATC team failed to communicate ongoing runway painting operations, causing the incoming team to misjudge runway occupancy and leading to the collision. This incident demonstrates the inadequacies in information transfer during handovers, particularly when controllers are fatigued and overburdened, which can distort their perception of the flight situation. The implementation of a scientifically structured shift system to ensure sufficient rest for controllers has therefore become a focus of scholarly research, as it not only tests the scientific validity of shift scheduling but also the reasonableness of work arrangements and personnel matching by shift supervisors [36,37].

3.3. Sensitivity Analysis

GeNIe has a sensitivity analysis function that identifies factors that significantly affect the target node. In this study, the controller’s unsafe behavior node is set as the target node for sensitivity analysis. Here, the example of improper allocation of U21 aircraft spacing is taken, and the results are shown in Figure 6.

The analysis results show that, in the event of “U21 aircraft spacing allocation”, “B32 controller did not report unsafe trend in time” has the greatest impact on the occurrence of the accident. Secondly, the intermediate events X10 and X9 also have a high influence. Therefore, it is necessary to prioritize the cultivation of controllers’ safety awareness and develop the habit of recognizing potential unsafe trends and reporting them in time through regular safety education and emergency response training. In the case of “U24 Improper control transfer”, the most sensitive factor is “C25 Controller information forgetting”. Short-term memory load and attention allocation mechanisms in information processing are decisive for the accuracy of the handover. It is recommended to reduce the impact of human forgetfulness on operational safety by structuring the handover process. In the path of “U16 failed to perform necessary actions”, the most sensitive node is the intermediate event ‘X8’, which is further influenced by “C11 equipment failure leading to poor ground and air communication” and “C11 equipment failure leading to poor ground and air communication”. It is further affected by “C11 equipment failure leading to poor ground-to-air communication” and “C22 controller’s improper allocation of energy and ineffective monitoring of aircraft dynamics”. It is recommended to start from two aspects: firstly, to regularly check whether the airport facilities and equipment failures and communication links are stable, to ensure that the most basic air-to-ground information communication can still be maintained in the event of equipment failures; secondly, to optimize the task allocation and the controller workload management system, to avoid over-concentration on the local targets, which may result in insufficient monitoring of the overall flight dynamics.

3.4. Model Validation

In order to verify the rationality and validity of the Bayesian network model, this study verifies the model based on the prior probabilities of each basic event in Table 3 through two axioms. If the Bayesian network model is reasonable, it should satisfy the following verification criteria [38].

Axiom 1: As the prior probability of the parent node increases or decreases, the occurrence probability of the child node should increase or decrease accordingly.

Axiom 2: The combined probability change from the evidence should have a greater overall impact on the target node than the combined probability change from the secondary evidence.

Basic event A21—the regulatory unit has not established an effective safety culture—occurred simultaneously in U32, U33, and U34. The results of the test of Axiom 1 are shown in Figure 7. The results indicate that the prior probabilities of the parent node and child nodes exhibit consistent fluctuations. When the probability of parent node A21 being in the “occurred” state is 0, the probabilities of child nodes U32 and U34 being in the “occurred” state are also 0, while the probability of U33 being in the ‘occurred’ state is not 0. This is because the dependency relationship between U32 and U34 and A21 forms an “AND gate.” This method can be used to verify that other nodes also comply with Axiom 1.

To verify Axiom 2 using the U22-sorting scheme as an example, we first need to determine which nodes are evidence nodes and which are secondary evidence nodes. Based on the fault tree model, X11, X12, and B11 are identified as evidence nodes, while A32, C29, C22, B22, and C24 are identified as secondary evidence nodes. The results are shown in

Table 8. Axiom 2 Verification Results.

Evidence Node	Change in U22 Probability (%)	Evidence Node	Change in U22 Probability (%)
X11	29	C22	16
X12	36	B22	14
B11	46	C24	18
A32	15	C29	20

. When new evidence is input into the Bayesian network and the probability of the evidence nodes being in the “occurred” state is set to 100%, the changes in the probability of the target nodes being in the “occurred” state are as follows: X11 is 29%, X12 is 36%, and B11 is 46%. These values are all greater than the changes in the probability of the target nodes caused by the changes in the secondary evidence nodes alone, thus satisfying the verification conditions of Axiom 2. Additionally, tests were conducted on other secondary evidence nodes, and they also met the verification conditions of Axiom 2.

The Bayesian network model of unsafe behavior by air traffic controllers constructed in this paper satisfies the two validation criteria of Bayesian networks, demonstrating the validity of the model.

4. Conclusions and Outlook

4.1. Conclusions

This paper presents a quantitative model of controller error, proposing the AR-FT-BN to reveal the multi-factor coupling mechanism and risk transmission pathways associated with unsafe controller behavior.

(1) The HFACS framework for controllers is developed based on 85 accident reports, and association rules (AR) are employed to uncover correlations between unsafe controller behaviors and risk factors. Through qualitative analysis, the fault tree structure leading to unsafe behaviors is identified, and the a priori probabilities of key risk factors are determined through quantitative analysis, transforming the fault tree (FT) model into a Bayesian network (BN) model. This approach introduces a novel theoretical framework for understanding controller errors and violations. Fault tree analysis clarifies the interactions and transfer effects between different factors, while sensitivity analysis further identifies key risk factors, highlighting areas requiring focused attention to enhance safety.

(2) The BN mitigates the impact of dataset variability by incorporating the interactions among factors. Based on forward reasoning, the five most likely unsafe controller behaviors were identified: improper aircraft spacing assignment (U21), failure to take necessary interventions (U16), improper control handover (U24), improper flight conflict deployment (U33), and irrational sequencing schemes (U32). Among these, U21 poses the greatest risk, with a probability of occurrence of 30.5%, driven by the interaction of multiple risk factors. Enhanced focus on these high-risk behaviors is crucial for improving risk management in air traffic control.

(3) The risk paths most likely to lead to the occurrence of ATC unsafe events were inferred through backward reasoning within the Bayesian network.

Path 1: C31 and B23 → X9 → U21

Path 2: C28, C29, and C25 → X7 → U16

Path 3: C21 and A22 → X16 → U24

Special attention should be directed toward these critical paths, with particular emphasis on strengthening the monitoring and management of the factors associated with C31, B23, C28, C29, and C25.

(4) The study concludes that controllers with insufficient experience are more prone to making incorrect judgments when handling complex air traffic scenarios, with these risks being exacerbated by inadequate training and monitoring systems, particularly in high-traffic or high-speed differential conditions. Moreover, the lack of situational awareness becomes particularly pronounced when controllers are subjected to high stress and task loads, which can lead to errors in critical decision-making. Finally, prolonged work schedules contribute to fatigue and cognitive impairment, making controllers more susceptible to errors during shift handovers. The sensitivity analysis further identifies key risk factors, highlighting areas that should be prioritized to enhance safety.

4.2. Outlook

(1) This study provides a quantitative model for analyzing controller errors. However, due to the small sample size, the empirical frequency of certain rare events is low, and the prior probability may be somewhat biased. As more accident data is accumulated in subsequent studies, the prior probability of these events can be further updated, thereby improving the accuracy of the model’s predictions.

(2) Currently, research on the AR-FT-BN model in the aviation field is relatively limited, but studies on human factors in accidents over the past two years have shown that this model has great potential in identifying and assessing risk pathways. Given the richness and detail of aviation accident reports, the AR-FT-BN model offers unique advantages in this field. Future research could integrate natural language processing or agent-based modeling to make aviation accident analysis and risk path identification more intelligent and automated, thereby providing more timely and effective support for aviation safety decision-making.

(3) This study analyzed 85 cases between 2018 and 2024. Given the limitations of the data, future research could collect data from different regions, countries, or airports to assess the applicability of the model and improve the accuracy of predictions. For example, analyzing accident data from specific airports or countries could help understand the characteristics of local air traffic controllers’ behavior, thereby providing more targeted recommendations for regional aviation safety management.