A Hybrid Fault Tree–Fuzzy Bayesian Network Framework for Ferry Accident Risk Assessment in Tanzania: Lessons from the 2018 MV Nyerere Disaster

Abstract

Domestic ferry operations in Tanzania present a distinctive safety challenge, marked by a history of severe accidents, fragmented causal evidence, and scarce operating-exposure data, which together render conventional frequency-based risk assessment methods impractical. This study develops and applies a hybrid Fault Tree Analysis–Fuzzy Bayesian Network (FTA–FBN) framework to assess the risk of serious ferry accidents in Tanzanian domestic operations. A comprehensive review of documentary evidence from 1996 to 2025 was conducted to identify and harmonize causal factors and to construct a compact fault tree. This structure was subsequently validated by fifteen maritime experts, who also provided linguistic probability judgments. Expert competence was quantified using four established criteria, while linguistic assessments were represented as triangular fuzzy numbers, then competence-weighted, aggregated, and defuzzified to derive five root priors and 32 conditional probability conditions. The resulting 14-node Bayesian network was implemented in GeNIe and subjected to baseline, forward, backward, sensitivity, and behavioral validation analyses. The model yielded a baseline Serious Ferry Accident probability of 72.40%, interpreted as an expert-informed measure of model risk propensity rather than an observed voyage-level accident frequency. Forward analysis revealed that setting improper loading to “No” yielded the largest individual root-level risk reduction, while setting all five root risks to “No” reduced the top-event probability to 54.83%. Sensitivity analyses consistently emphasized the stability/capsize pathway and loading-related parameters as dominant contributors. In a retrospective consistency check using the MV Nyerere case, when overloading and capsize/sinking were used as evidence, the posterior probability of Loss of Stability rose to 96.8%. The present study provides a transparent and updateable approach for risk diagnosis and intervention prioritization within a data-constrained domestic ferry system.

1. Introduction

Domestic ferries serve as vital transport links for countries where islands, lakes, rivers, and coastal communities depend on short-sea or inland-water connections. Despite their social importance, these vessels persistently face significant safety challenges. According to the International Maritime Organization (IMO), approximately 95% of ferry-related casualties occur during domestic voyages, and its Model Regulations on Domestic Ferry Safety identify vessel construction, safety management, crew training, and operational procedures as mutually reinforcing pillars of safe operations [1]. A global review of 232 major ferry accidents between 2000 and 2014 similarly found recurring involvement of human error, hazardous weather, overcrowding/overloading, inadequate training, and unsuitable or substandard vessels [2].

Tanzania offers a particularly instructive case for examining domestic ferry safety, given a ferry network that spans Lake Victoria, other inland waters, coastal routes, and Zanzibar’s inter-island services. A scoping study by the World Maritime University identified Tanzania as one of seven high-risk domestic-ferry countries, documenting a pronounced history of capsize and sinking events alongside persistent operational, technical, and regulatory concerns [3]. More recent national audit findings further point to systemic deficiencies, including ineffective management of passenger flow and databases, weak compliance with safety and operational standards, inadequate maintenance procedures, and insufficient oversight of ferry operations [4]. These institutional weaknesses have unfolded against a backdrop of catastrophic accidents, notably MV Bukoba (1996), Spice Islander I (2011), MV Skagit (2012), and MV Nyerere (2018).

The MV Nyerere disaster illustrates the analytical challenge. On 20 September 2018, the ferry capsized and sank near Ukara Island. Subsequent national disaster-management documentation recorded 227 fatalities [5], while contemporaneous government reports identified 41 survivors. A presidential statement issued the day after the accident cited overloading of passengers and cargo as a clear preliminary indication of cause; however, the full investigation report submitted to the Prime Minister in October 2018 has not been made publicly accessible within the evidence reviewed for this study. Additionally, two months prior to the incident, TEMESA had documented the replacement of heavily worn engine systems—relevant technical context that nonetheless does not establish propulsion failure as a causal factor. Therefore, these circumstances underscore the necessity for accident modeling frameworks that explicitly distinguish among confirmed evidence, official preliminary findings, corroborated contextual information, and unverified narrative claims.

While conventional descriptive accident reviews offer valuable insights into recurring hazards, they remain limited in their capacity to quantify interrelationships among causal factors, update risk assessments as new evidence emerges, or diagnose probable upstream conditions following an accident. Bayesian Networks (BNs) provide a robust alternative to address these limitations: they represent causal dependencies probabilistically, integrate heterogeneous evidence with expert knowledge, and support both predictive and diagnostic reasoning [6,7]. Over the past two decades, maritime applications of BNs have expanded considerably, although challenges persist in expert elicitation, conditional probability specification, and model validation [8].

Fuzzy logic offers a complementary approach for capturing the epistemic uncertainty inherent in expert judgment. A growing body of recent maritime research has combined fuzzy probability elicitation with BNs for evidence-based accident modeling [9], FTA-to-FBN transformation [10], and domestic ferry risk assessment [11]. Song [12] further demonstrated the utility of fuzzy Bayesian modeling for capsizing, sinking, and flooding accidents, highlighting the significance of adverse weather, improper loading, and maintenance deficiencies as contributing factors. Nevertheless, the literature reviewed for this study reveals a notable gap: no existing framework integrates documentary evidence, FTA-based causal structuring, competence-weighted fuzzy probability elicitation, Bayesian forward/backward inference, sensitivity analysis, and a retrospective application to the MV Nyerere case within a Tanzania-wide context.

Accordingly, this study develops and applies a hybrid FTA–FBN framework for assessing serious ferry accident risk in Tanzania. The specific objectives are to: (1) identify and structure key human, operational, technical, organizational, and environmental risk factors; (2) quantify uncertain root and conditional probabilities through competence-weighted fuzzy expert elicitation; (3) analyze the resulting Bayesian network using baseline, forward, backward, and sensitivity reasoning; and (4) examine the model’s practical relevance through a retrospective MV Nyerere application. The present work contributes both methodologically—by integrating FTA, fuzzy expert elicitation, and Bayesian network inference—and practically, by delivering an updateable risk model suited to a domestic ferry environment where comprehensive empirical exposure data remain unavailable.

2. Literature Review and Research Gap

2.1. Ferry Accident Factors

Ferry safety is inherently systemic in nature. Lu and Tseng [13] identified six key assessment dimensions for passenger-ferry services—safety equipment, ship structure, documentation inspection, safety instructions, navigation and communication, and crew ability—among which crew ability was assigned particularly high importance. At a global level, Golden and Weisbrod [2] demonstrated that major ferry accidents recurrently involve human error, hazardous weather, and overcrowding. Subsequent work by Xu et al. [14] using the Ferry-SAFEDB database further revealed that incomplete and inconsistent accident data constrain evidence-based ferry safety research, particularly in regions heavily dependent on inland and coastal ferry transport.

Human and organizational influences extend well beyond individual operator error. Using the HFACS-MA framework to compare the Eastern Star, Sewol, and Phoenix disasters, Wang et al. [15] identified legislation gaps, organizational processes, and inadequate supervision as recurring contributing factors. Related research further found that technology does not automatically improve safety behavior unless supported by training, knowledge, procedures, and safety management [16]. Consequently, Baig et al. [17] conceptualized domestic ferry safety challenges across operations, technology, the human element, policy/regulation, and economics, rather than as a purely technical reliability problem.

Tanzania-specific evidence is consistent with this systems perspective. Hebbar et al. [3] described a domestic ferry context shaped by overloading, lifesaving and maintenance concerns, survey and inspection capacity, operator practices, and governance conditions. The 2025 National Audit Office performance audit similarly reported weaknesses in passenger-flow management, maintenance, compliance, and monitoring [4]. Collectively, these findings support a causal structure that integrates operational, technical, human, and environmental conditions, while avoiding the assumption that any single factor universally dominates all ferry accidents.

2.2. Bayesian and Fuzzy Approaches in Maritime Risk

Bayesian Networks have become increasingly prominent in maritime safety research due to their capacity to represent conditional dependencies, integrate multiple data sources, and update probabilities as new evidence emerges. Hänninen [6] highlighted their suitability for complex and uncertain maritime safety problems, while also drawing attention to persistent challenges in expert elicitation and model validation. Zhang and Thai [7] further observed that expert knowledge remains central to maritime BN construction, given that serious accidents are rare and accident databases are often incompatible or incomplete. Fan et al. [18] demonstrated a complementary data-driven approach, using accident reports to learn a BN and incorporate human factors, whereas Animah [8], reviewing 115 maritime BN studies, documented their expanding application in risk assessment, accident investigation, and reliability analysis.

FTA and BN are particularly complementary in this context. FTA offers a transparent top-down causal skeleton, whereas a Bayesian network provides the probabilistic machinery for updating beliefs and reasoning under uncertainty. This methodological synergy was demonstrated in a recent domestic-ferry study from the Likoni channel [11], which combined FTA and fuzzy Bayesian inference to model accident scenarios. The model produced a 39.1% baseline accident probability and identified propulsion-system failure as a dominant contributing factor. The present study does not, however, transfer that structure directly to Tanzania, as causal importance is expected to vary by operating environment and evidence base. Rather, the Likoni study serves as methodological evidence that domestic-ferry FBNs can support baseline estimation, intervention analysis, and diagnostic reasoning.

Furthermore, fuzzy sets help solve the problem that experts often cannot defend precise point probabilities. Song [12] and other recent marine FBN studies translate linguistic likelihood judgments into triangular fuzzy numbers (TFNs), aggregate expert opinions using competence or reliability weights, and then defuzzify the result into crisp probabilities for BN parameterization. The present study adopts this principle but intentionally keeps the linguistic scale and network compact to reduce cognitive burden and avoid excessive CPT elicitation.

Recent studies further illustrate the role of Bayesian methods in supporting navigational safety. Qu and Wang [19] combined maritime data, expert knowledge, fuzzy logic, Bayesian networks, and utility theory to assess navigation risk across areas of the South China Sea. Vairo et al. [20] combined hazard analysis with a dynamic Bayesian network to update tanker navigation risk across successive transit phases in Venice channels. These studies address spatial and temporal variations in risk. By contrast, the present study employs a static, competence-weighted FTA–FBN for scenario analysis and diagnosis in Tanzanian domestic ferry operations; it does not, however, model changes across voyage phases.

2.3. Research Gap

The reviewed evidence reveals three interlinked gaps that this study seeks to address. First, the existing literature on Tanzanian ferry safety remains largely descriptive, audit-oriented, or case-specific in nature, offering no quantified national-level causal network that links stability-related and navigation-control pathways. Second, while international maritime FBN studies provide sophisticated analytical techniques, purely expert-driven network construction is susceptible to subjectivity and excessive CPT burdens, whereas purely data-driven approaches are rarely feasible when exposure denominators and complete causal records are unavailable. Third, no study identified in this review has simultaneously integrated Tanzania-specific evidence, an expert-validated compact FTA, competence-weighted fuzzy priors and CPTs, Bayesian forward and backward reasoning, sensitivity and behavioral validation, and an evidence-graded retrospective application to the MV Nyerere disaster within a single analytical framework. The present study is designed to fill this methodological and empirical gap without asserting that its compact network exhaustively captures every possible ferry accident mechanism.

3. Materials and Methods

3.1. Research Design and Analytical Workflow

This study employed a sequential hybrid design. The process began with documentary and literature evidence to develop the causal structure, followed by expert validation to assess technical relevance, then fuzzy elicitation to quantify uncertain probabilities, and finally implementation of the resulting model as a BN for inference and validation. This ordering was deliberately chosen to avoid constructing the BN directly from unstructured expert opinion and to minimize the risk that the landmark MV Nyerere case would disproportionately shape the model structure. Figure 1 presents the overall workflow.

Figure 1. Hybrid FTA–FBN research framework used in the study.

3.2. Scope, Top Event and Evidence Base

This study focuses on domestic passenger ferry operations in the United Republic of Tanzania, covering the Mainland and Zanzibar, as well as inland waters and coastal/inter-island services. The scope is defined functionally rather than by vessel class, encompassing passenger-only and Ro-Pax ferries operating on domestic routes. Excluded from the analysis are cargo-only ships, fishing vessels, leisure/cruise vessels, military craft, international passenger voyages, and informal unregulated small craft.

The documentary evidence reviewed spans the period 1996–2025. Core historical cases examined include MV Bukoba (1996), an Ulanga/Kilombero ferry casualty (2002), Spice Islander I (2011), MV Skagit (2012), MV Kilombero II (2016), and MV Nyerere (2018), supplemented by recent breakdowns, steering failures, vehicle-loss events, and audit findings. Evidence was hierarchically graded according to source type: official contemporaneous sources, official retrospective/audit sources, international institutional sources, high-quality news reporting, and other secondary material. Case statements were further classified as confirmed, official preliminary, corroborated, or reported/unverified.

The top event is defined as a binary variable—Serious Ferry Accident (Yes/No). This construct is anchored analytically to the scope of “accident” under Tanzania’s Merchant Shipping (Accident Reporting and Investigation) Rules, 2019 [21], which encompasses death or serious injury, loss or abandonment of a ship, material damage, stranding/disabling, and collision. The term “Serious Ferry Accident” is thus employed as an analytical device rather than presented as an exact statutory phrase.

3.3. Risk-Factor Identification and Fault Tree Analysis

An initial pool of 25 harmonized candidate factors was identified across human, technical, operational, management, regulatory, and environmental categories. Candidate retention was guided by five criteria: recurrence in Tanzanian evidence, support in the international ferry and maritime literature, generalizability across domestic ferry environments, causal relevance to accident occurrence, and elicitation burden. Consequence-mitigation factors—such as lifesaving equipment and post-accident rescue—were acknowledged as important safety concerns but deliberately excluded from the occurrence-focused core FTA. Vessel-design characteristics were retained as documented secondary factors yet excluded from the compact national model due to vessel-specificity and limited generalizability.

The resulting FTA comprises two principal first-level accident pathways: (i) Capsize/Sinking, associated with Loss of Stability; and (ii) Navigation-Related Accident (Collision/Contact/Grounding), associated with Loss of Navigational Control. Loss of Stability is directly conditioned by Overloading, Improper Loading/Load Distribution, and Adverse Weather, with Inadequate Passenger Counting/Control modeled as an upstream cause of Overloading. Loss of Navigational Control is directly conditioned by Propulsion Failure, Steering Failure, and Unsafe Maneuver. Inadequate Maintenance serves as a shared parent of Propulsion Failure and Steering Failure, while Inadequate Crew Competence is positioned upstream of Unsafe Maneuver. OR logic was adopted in the FTA on the grounds that no interaction was judged to be jointly indispensable; probabilistic interactions were subsequently captured through BN CPTs rather than deterministic gates. The finalized compact fault-tree structure is presented in Figure 2.

Figure 2. Final compact Fault Tree Analysis for serious ferry accident risk in Tanzania.

Collision, contact, and grounding are grouped within Navigation-Related Accident, while capsize and sinking are represented by the combined Capsize/Sinking node; separate probabilities are not estimated for these individual accident subtypes. Failures affecting vessel control are represented at a functional level by Propulsion Failure, Steering Failure, and Unsafe Maneuver, which feed Loss of Navigational Control.

3.4. Expert Panel, Structural Validation and Competence Weighting

Purposive expert sampling was employed to ensure multidisciplinary coverage across navigation/ferry operations, marine engineering and maintenance, survey/inspection/regulation, accident/safety practice, and maritime research. A total of fifteen experts participated in the study. Eligibility criteria required a relevant maritime qualification (professional license or academic credential) and preferably at least five years of relevant experience, including direct expertise in one or more domains represented by the FTA. Experts were coded E1–E15 and were permitted to select “Not within my expertise/unable to judge” for probability questions. No response was imputed when an expert abstained.

FTA structural validation employed a four-point relevance/technical-validity scale: 1 = not relevant/not valid, 2 = needs major revision, 3 = relevant/valid with possible minor revision, and 4 = highly relevant/technically valid. Validation covered nodes, causal links, and overall model suitability prior to probability elicitation. The Item-Level Content Validity Index (I-CVI) was computed as the proportion of experts rating an item 3 or 4. The consolidated validation record showed full relevance agreement for retained items (I-CVI = 1.00 and S-CVI/Ave = 1.00), surpassing the commonly used 0.78 threshold for good content validity [22]. Expert feedback led to a terminology refinement—from “Serious Navigation-Related Accident” to “Navigation-Related Accident (Collision/Contact/Grounding)”—to avoid tautological overlap with the top event definition.

Expert competence weights were introduced to prevent treating all judgments as equally informative when expertise varied across domains. Four criteria were scored on a 1–5 scale: relevant maritime experience (C1), relevant professional/academic competence (C2), direct ferry/passenger-vessel relevance (C3), and applied domain expertise relevant to the FTA (C4). Senior professional licenses—such as Master Mariner or Chief Engineer—were regarded as evidence of advanced professional competence rather than automatically ranked below academic doctorates.

s_k = C1_k + C2_k + C3_k + C4_k,

(1)

where s_k is the total competence score for expert k. Scores ranged from 4 to 20. Normalized expert weights were calculated as:

$$w_k=s_k/{\sum }_j{s}_j,$$

(2)

The 15 experts collectively attained a total competence score of 216. In cases where an expert abstained from a specific probability item, that expert was excluded solely for that item, and the remaining weights were renormalized to sum to one. The expert profiles, competence scores, and normalized weights are summarized in Table 1.

Table 1. Expert panel profile and competence weights.

Code	Role	Years	Highest Relevant Profile	sk	wk
E1	Senior Ferry Master	17	Master Mariner CoC Class 1	19	0.0880
E2	Ferry Master/Chief Officer	12	Senior deck/master-level CoC	15	0.0694
E3	Senior Deck Officer/Ferry Operations	12	Deck CoC Class 2/equivalent	15	0.0694
E4	Chief Engineer	16	Chief Engineer CoC Class 1	19	0.0880
E5	Marine Engineer/Second Engineer	13	Marine Engineer CoC Class 2	15	0.0694
E6	Maintenance/Technical Superintendent	9	Marine Engineering Class 2/equivalent	14	0.0648
E7	Senior Marine Surveyor/Inspector	10	Marine technical inspector/survey	14	0.0648
E8	Survey/Stability Specialist	8	Marine technical/survey qualification	13	0.0602
E9	Maritime Safety Inspector/Regulator	8	Inspection/regulatory qualification	13	0.0602
E10	Marine Accident/Safety Specialist	10	Safety/investigation specialist	16	0.0741
E11	Ferry Operations/Safety Manager	10	Operational maritime qualification	14	0.0648
E12	Maritime Safety Academic	8	MSc-level maritime qualification	12	0.0556
E13	Marine Engineering Academic	8	MSc Marine Engineering/equivalent	12	0.0556
E14	Navigation/Operations Academic	7	MSc Maritime/Navigation/equivalent	12	0.0556
E15	Maritime Risk/Accident Researcher	8	Postgraduate maritime risk profile	13	0.0602

The competence criteria describe the experts’ backgrounds, not their confidence in individual answers. The questionnaire did not collect separate confidence ratings. Experts could abstain by selecting “Not within my expertise/unable to judge,” but this option did not measure confidence among those who answered. The linguistic probability categories describe event likelihood. Answers were therefore combined using competence weights, renormalized for each item after abstentions, without an additional confidence weight.

3.5. Fuzzy Probability Elicitation and Defuzzification

The probability questionnaire was administered following structural validation and employed a five-level linguistic scale to alleviate the cognitive burden associated with exact probability assignment. This scale was selected for its ability to provide adequate probability resolution while remaining practical for a multidisciplinary expert panel. Linguistic responses were subsequently converted into TFNs, as summarized in Table 2. The same fuzzy scale was applied uniformly to both root-node occurrence judgments and conditional child-state judgments, but it was deliberately not used for expert competence scoring. This design choice balances cognitive load against probability resolution, and centroid defuzzification—the most widely adopted and interpretable method in maritime FBN studies—was used for transformation [9,10].

Table 2. Linguistic probability scale and triangular fuzzy numbers.

Linguistic Term	TFN (a, m, b)	Single-Term Centroid
Very Low (VL)	(0.00, 0.10, 0.20)	0.100
Low (L)	(0.10, 0.30, 0.50)	0.300
Medium (M)	(0.30, 0.50, 0.70)	0.500
High (H)	(0.50, 0.70, 0.90)	0.700
Very High (VH)	(0.70, 0.90, 1.00)	0.867

In this study, probabilities are interpreted as general expert-assessed likelihoods within the Tanzanian domestic ferry conditions represented by the model. They are not expressed per voyage, per vessel-year, or over another fixed period. Root probabilities describe the likelihood of the modeled risk conditions; conditional probabilities describe an event’s likelihood when its parent conditions are specified. The 1996–2025 period refers to the documentary evidence reviewed, not the period over which these probabilities apply.

For expert k, a linguistic response was represented by the triangular fuzzy number A_k = (a_k, m_k, b_k). The competence-weighted aggregate for a given item was then calculated component-wise across the three fuzzy parameters:

$$A^{*}=({\sum }_k{W}_k{\mathrm{a}}_{k,}{\sum }_k{W}_k{m}_k,{\sum }_k{W}_k{b}_k),$$

(3)

The aggregated TFN was subsequently transformed into a crisp probability via centroid defuzzification:

$$p^{*}={\displaystyle \frac{(a\ast +m\ast +b\ast )}{3}},$$

(4)

The resulting value, denoted as p*, was assigned as the Bayesian network probability for the “Yes” state, while the complementary probability for the “No” state was computed as P(No) = 1 − p*. The elicitation process comprised five root-node prior questions and 32 conditional probability conditions. Although Noisy-OR approximations can markedly reduce parameter burden in larger maritime networks [23], the compact final network contained no child node with more than three binary parents, corresponding to a maximum of eight CPT combinations. Direct fuzzy CPT elicitation was therefore retained, enabling experts to explicitly judge asymmetric causal combinations while maintaining a manageable workload of 37 probability judgments per expert.

The 32 conditional probability conditions were derived from the complete set of parent-state combinations required to parameterize the nine non-root nodes in the final Bayesian network, rather than from 32 separate questionnaires. For each binary child node with n binary parents, 2ⁿ parent-state combinations were required. Accordingly, nodes with a single parent required two probability judgments, the Serious Ferry Accident node—with two parents—required four, and the Loss of Stability and Loss of Navigational Control nodes, each with three binary parents, required eight. Summed across all nodes, these requirements produced the 32 conditional probability conditions. Each condition was assessed by all 15 experts using the five linguistic categories defined in Table 2 and subsequently transformed via the competence-weighted fuzzy aggregation and centroid-defuzzification procedure described earlier.

To illustrate this process without reproducing the full set of 32 conditions, Loss of Stability was selected as a representative case. It is a central intermediate node with three causal parents—Overloading, Improper Loading/Load Distribution, and Adverse Weather—and was among the most influential intermediate variables in the subsequent sensitivity analysis. Its three binary parents generated eight parent-state combinations, permitting a complete demonstration of the elicitation and transformation procedure for a multi-parent CPT. For each combination, experts were asked to judge the likelihood of Loss of Stability occurring. For example, one condition was presented as: “Given that Overloading is present, Improper Loading/Load Distribution is present, and Adverse Weather is present, how likely is Loss of Stability to occur?” Experts responded using the five-level linguistic scale: Very Low (VL), Low (L), Medium (M), High (H), or Very High (VH). The same question structure was applied systematically to the remaining seven combinations of parent states.

The response distributions in Table 3 reflect the anticipated shift in expert judgment as hazardous conditions accumulate. When Overloading, Improper Loading/Load Distribution, and Adverse Weather were all absent, all 15 experts assessed the likelihood of Loss of Stability as Very Low. As one or more hazardous conditions were introduced, assessments progressively shifted from Medium and High toward Very High. Under the condition in which all three parent risks were present, 13 experts selected Very High and two selected High. These frequencies are reported for transparency regarding the elicited judgments; however, they were not treated as equally weighted votes during probability aggregation. Instead, the normalized competence weight of each expert, as reported in Table 1, was retained.

Table 3. Summary of expert linguistic responses for Loss of Stability CPT conditions.

Overloading	Improper Loading	Adverse Weather	VL	L	M	H	VH	Total
No	No	No	15	0	0	0	0	15
No	No	Yes	0	4	11	0	0	15
No	Yes	No	0	0	11	4	0	15
No	Yes	Yes	0	0	2	11	2	15
Yes	No	No	0	0	5	10	0	15
Yes	No	Yes	0	0	0	10	5	15
Yes	Yes	No	0	0	0	5	10	15
Yes	Yes	Yes	0	0	0	2	13	15

For each of the eight parent-state conditions, competence scores were combined across experts who selected the same linguistic category. These scores were then normalized against the total panel competence score of 216. The resulting category weights were subsequently applied to the corresponding TFNs in Table 2. Weighted fuzzy values were aggregated component-wise using Equation (3), and the resulting TFN was converted to a crisp conditional probability through centroid defuzzification in Equation (4). Table 4 summarizes the complete transformation for the eight Loss of Stability conditions.

Table 4. Competence-weighted fuzzy aggregation and final Loss of Stability CPT.

O	IL	AW	Competence-Weighted Linguistic Composition	Aggregated TFN (a*, m*, b*)	P(LS = Yes)	P(LS = No)
No	No	No	VL = 216/216	(0.0000, 0.1000, 0.2000)	0.1000	0.9000
No	No	Yes	L = 60/216; M = 156/216	(0.2444, 0.4444, 0.6444)	0.4444	0.5556
No	Yes	No	M = 160/216; H = 56/216	(0.3519, 0.5519, 0.7519)	0.5519	0.4481
No	Yes	Yes	M = 26/216; H = 163/216; VH = 27/216	(0.5009, 0.7009, 0.8884)	0.6968	0.3032
Yes	No	No	M = 72/216; H = 144/216	(0.4333, 0.6333, 0.8333)	0.6333	0.3667
Yes	No	Yes	H = 143/216; VH = 73/216	(0.5676, 0.7676, 0.9338)	0.7563	0.2437
Yes	Yes	No	H = 72/216; VH = 144/216	(0.6333, 0.8333, 0.9667)	0.8111	0.1889
Yes	Yes	Yes	H = 26/216; VH = 190/216	(0.6759, 0.8759, 0.9880)	0.8466	0.1534

Collectively, the eight Loss of Stability conditions illustrate the systematic transformation of expert linguistic judgments into the CPT probabilities underpinning the Bayesian Network. The summarized response distributions reveal a clear progression: expert assessments shifted from lower linguistic likelihood categories under safer parent-state combinations toward High and Very High categories as hazardous conditions accumulated. For each condition, individual expert competence weights were preserved during aggregation, linguistic judgments were mapped to the triangular fuzzy numbers defined in Table 2, and the competence-weighted fuzzy assessments were aggregated and defuzzified using Equations (3) and (4). This procedure yielded P(LS = Yes) values ranging from 0.1000 under the fully absent condition (Overloading, Improper Loading/Load Distribution, and Adverse Weather all absent) to 0.8466 when all three conditions were present, with complementary P(LS = No) values completing each CPT row. The same methodology was applied consistently across all remaining conditional nodes, generating the full set of 32 conditional probability conditions that parameterized the final Bayesian Network in GeNIe.

3.6. FTA-to-BN Transformation and GeNIe Implementation

Each event in the fault tree was mapped to a binary node in the Bayesian network, with states Yes/No, and causal relationships were represented as directed arcs. Rather than reproducing FTA OR gates as separate BN nodes, their deterministic logic was replaced by CPTs that allow graded probabilistic interaction. Shared upstream causes—such as Inadequate Maintenance influencing both Propulsion Failure and Steering Failure—were represented by a single BN node with multiple outgoing arcs. The resulting directed acyclic graph comprised 14 nodes and 14 causal links.

The arrow directions follow the proposed causal order in the fault tree, based on documentary evidence, maritime knowledge, and expert review. For example, inadequate maintenance can contribute to steering failure, which can impair navigational control. The probability calculations use these relationships but do not independently prove them. The CPTs describe uncertainty in the relationships. Backward inference updates the likelihood of possible upstream conditions; it does not reverse the direction of cause or prove what caused a particular accident. Setting risk factors to “No” provides a conditional scenario comparison. Treating the calculated change as a real-world intervention effect requires further causal assumptions.

The joint probability distribution of the network follows the standard factorization:

$$P(X_1,\dots ,X_{\mathrm{n}})={\prod }_{\mathrm{i}}P\left(X_{\mathrm{i}}\right|\mathit{Pa}\left(X_{\mathrm{i}}\right)),$$

(5)

where Pa(Xi) denotes the parent set of the node Xi. The network was implemented in GeNIe Modeler 5.0.6522 (BayesFusion, LLC, 420 Fort Duquesne Blvd, Suite 1725, Pittsburgh, PA 15222-1455, USA). Root priors and all CPT values were entered manually, state ordering was verified, and the software baseline was cross-checked against independent probability propagation before subsequent analyses.

Supplementary Tables S1–S3 provide the node definitions and parent relationships, all five root probabilities, and all 32 conditional probability rows. Both Yes and No probabilities are included, using the numerical values entered into GeNIe, so readers can rebuild the network and reproduce the calculations.

3.7. Inference, Sensitivity and Validation

Four analytical nodes were employed in the analysis. Baseline inference calculated unconditional P(Yes) values without entering any evidence. Forward scenario inference set selected upstream risk conditions to “No” to compare specified control scenarios, quantifying the resulting changes in the probability of a Serious Ferry Accident. Backward diagnostic inference set Serious Ferry Accident = Yes and examined the posterior changes across upstream nodes. Node-state sensitivity was quantified as the probability swing, defined as P(SFA = Yes|X = Yes) − P(SFA = Yes|X = No), while GeNIe’s built-in parameter sensitivity and tornado diagram tools served as an independent software-based cross-check.

The model is a static, expert-informed Bayesian network used for descriptive assessment, scenario analysis, and diagnosis. Forward inference calculates accident probabilities under specified model conditions; it does not establish forecasting accuracy for future voyages. Evidence can update probabilities within the network, but changes over time are not explicitly modeled.

Model validation adopted a four-layer design: expert structural validation; numerical consistency checks between independent propagation results and GeNIe outputs; behavioral validation based on three axioms—monotonic causal response, stronger combined effects relative to constituent subsets, and directionally consistent CPT behavior; and consistency checks across forward inference, backward inference, and sensitivity results. This validation framework aligns with the logic used in evidence-based and FTA–FBN maritime research [9,10]. It is important to interpret these checks as structural, internal, and behavioral validation, rather than as evidence of prospective predictive accuracy.

3.8. MV Nyerere Retrospective Application Procedure

The MV Nyerere case was applied only after the generic Tanzania network had been finalized. In the principal retrospective scenario, two defensible case observations were entered: Overloading = Yes, based on the official preliminary statement that passengers and cargo exceeded capacity, and Capsize/Sinking = Yes, based on the documented accident outcome. Other nodes—Adverse Weather, Inadequate Maintenance, Inadequate Crew Competence, Unsafe Maneuver, and Improper Loading—were deliberately left unobserved unless directly supported by available case evidence. This restraint prevented the model from converting speculation into evidentiary input.

TEMESA’s July 2018 record indicating that the ferry’s aged engine systems were being replaced was treated as technical context rather than as proof of propulsion failure or inadequate maintenance at the time of the accident. Likewise, the existence of a government investigation report submitted in October 2018 was acknowledged, but its unavailable detailed findings were not reconstructed. The retrospective analysis therefore constitutes a behavioral and evidential-consistency application, not a substitute for an official forensic investigation.

The MV Nyerere application is a retrospective consistency check. It examines whether the model gives reasonable probability updates when selected evidence from the known accident is entered. Because the case was included in the documentary evidence reviewed during model development, it is not an independent validation test. The results do not establish forecasting accuracy or prove the causes of the accident.

4. Results and Discussion

4.1. Expert Validation and Finalized Causal Structure

Expert structural validation confirmed the retention of the compact two-pathway FTA. No core nodes needed to be removed, and the principal causal links were deemed technically relevant. The most significant refinement concerned the navigation branch: “Serious Navigation-Related Accident” was revised to “Navigation-Related Accident (Collision/Contact/Grounding)”. This adjustment clarified the distinction between accident occurrence and the seriousness threshold embedded in the top event, thereby improving the interpretability of the top-event CPT.

The final network retained five root risk factors: Inadequate Passenger Counting/Control, Improper Loading/Load Distribution, Adverse Weather, Inadequate Maintenance, and Inadequate Crew Competence. The stability branch propagated through Overloading and Loss of Stability to Capsize/Sinking, while the navigation branch extended through Propulsion Failure, Steering Failure, and Unsafe Maneuver to Loss of Navigational Control and Navigation-Related Accident. The resulting BN, including baseline probabilities, is presented in Figure 3.

Figure 3. Final 14-node Bayesian Network and baseline P(Yes) values. Arrows indicate the directed parent-to-child dependency relationships represented in the Bayesian network.

4.2. Root Priors and Baseline Inference

The competence-weighted fuzzy elicitation yielded the highest root probability for Inadequate Maintenance at 72.13%, followed by Inadequate Passenger Counting/Control (66.68%), Improper Loading/Load Distribution (64.34%), Inadequate Crew Competence (60.83%), and Adverse Weather (44.44%). The comparatively lower prior for adverse weather should not be interpreted as an indication of low consequence; rather, it reflects the episodic nature of weather-related hazards, whereas deficiencies in maintenance, passenger control, and crew competence may persist across multiple voyages.

With no evidence entered into the model, GeNIe produced a baseline Serious Ferry Accident probability of 72.40%. Among intermediate nodes, Loss of Navigational Control recorded the highest baseline value at 72.67%, while the immediate precursors to the top event—Capsize/Sinking and Navigation-Related Accident—registered 61.60% and 67.14%, respectively. These outputs were derived from the joint root priors and CPTs, rather than from simple accident frequency data.

The baseline value of 72.40% is an expert-informed model result under the general conditions described in Section 3.5. It should not be interpreted as the percentage of voyages or vessels expected to experience an accident. Its use here is to compare modeled scenarios and examine probability updates when evidence is entered. This distinction is particularly important when comparing the result with Wamugi et al. [11], whose Likoni FBN produced a 39.1% baseline accident probability. The two values are not directly comparable, as the networks differ in scope, top-event definition, causal architecture, expert elicitation methodology, and operating context. The root priors and baseline Bayesian probabilities are summarized in Table 5.

Table 5. Root priors and baseline Bayesian probabilities.

Node	Root Prior P(Yes), %	Baseline P(Yes), %
Inadequate Passenger Counting/Control	66.68	66.68
Improper Loading/Load Distribution	64.34	64.34
Adverse Weather	44.44	44.44
Inadequate Maintenance	72.13	72.13
Inadequate Crew Competence	60.83	60.83
Overloading	—	64.08
Propulsion Failure	—	60.47
Steering Failure	—	46.51
Unsafe Maneuver	—	57.59
Loss of Stability	—	67.30
Capsize/Sinking	—	61.60
Loss of Navigational Control	—	72.67
Navigation-Related Accident	—	67.14
Serious Ferry Accident	—	72.40

The high priors for maintenance, passenger control, and improper loading are nevertheless consistent with Tanzania-specific institutional evidence. The National Audit Office [4] documented weaknesses in ferry maintenance, passenger flow and database management, safety compliance, and monitoring. The model therefore captures vulnerabilities already evident in the administrative record while quantifying how they interact downstream.

4.3. Forward Scenario Inference

Forward inference identified setting Improper Loading/Load Distribution to “No” as the single root scenario with the largest modeled reduction, reducing the top-event probability by 4.02 percentage points. Controlling inadequate passenger counting yielded a 2.82-point reduction, while eliminating inadequate maintenance produced a 1.95-point decrease. The comparatively modest top-event impact of maintenance should not be read as technical insignificance: setting Inadequate Maintenance = No reduced Propulsion Failure from 60.47% to 22.25%, Steering Failure from 46.51% to 17.43%, and Loss of Navigational Control to approximately 55.8%. Its influence attenuated only because the independent stability/capsize pathway remained active.

Setting passenger counting/control inadequacy, improper loading, and adverse weather to “No” reduced SFA to 60.64%, an 11.76-point decrease. Setting all five root risks to “No” reduced it to 54.83%, a 17.57-point decrease. The remaining value arises from nonzero entries in the CPTs. Overloading remains at 30.00% when inadequate passenger control is absent; propulsion and steering failure remain at 22.25% and 17.43% when inadequate maintenance is absent. These probabilities pass through the network, giving 29.93% for Capsize/Sinking and 53.06% for Navigation-Related Accident. The fuzzy scale also maps “Very Low” to 0.10 rather than zero. Thus, the remaining probability reflects the elicited table values and scale. It is not an observed accident rate or a measured contribution from hazards outside the model.

These findings align with the systems perspective in domestic-ferry research. Wamugi et al. [11] similarly demonstrated that forward-looking risk-control scenarios can substantially reduce modelled ferry accident probability. However, the present Tanzania model places greater emphasis on loading and stability controls than the Likoni model, where propulsion-system failure dominated. This divergence reinforces the need for context-specific rather than transplanted ferry-risk frameworks. The complete forward-scenario results are reported in Table 6.

Table 6. Forward inference and intervention scenarios.

Scenario	P(SFA = Yes), %	Change from Baseline, Percentage Points
Baseline (no evidence)	72.40	—
Inadequate Maintenance = No	70.45	−1.95
Passenger Counting/Control Inadequate = No	69.58	−2.82
Improper Loading = No	68.38	−4.02
Adverse Weather = No	70.88	−1.52
Inadequate Crew Competence = No	71.82	−0.59
PCF + Improper Loading + Weather = No	60.64	−11.76
Maintenance + Crew Competence = No	69.22	−3.18
All five root risks = No	54.83	−17.57

4.4. Backward Diagnostic Inference

When Serious Ferry Accident = Yes was entered as evidence, the most pronounced posterior update occurred at Capsize/Sinking, which rose from 61.60% to 73.73%. Loss of Stability increased to 75.95%, and Navigation-Related Accident to 74.03%. These nodes along the immediate accident pathway exhibited stronger posterior responses because they are directly or near-directly connected to the top event. In contrast, root nodes showed comparatively smaller changes, as evidence must propagate through multiple intermediate causal relationships before reaching them. The corresponding posterior updates are summarized in Table 7.

Table 7. Backward diagnostic inference after setting Serious Ferry Accident = Yes.

Upstream Node	Baseline, %	Posterior, %	Change, pp
Capsize/Sinking	61.60	73.73	+12.14
Loss of Stability	67.30	75.95	+8.66
Navigation-Related Accident	67.14	74.03	+6.89
Loss of Navigational Control	72.67	75.84	+3.17
Overloading	64.08	66.71	+2.63
Improper Loading	64.34	66.32	+1.98
Passenger Control Inadequate	66.68	67.98	+1.30
Adverse Weather	44.44	45.61	+1.17
Propulsion Failure	60.47	61.60	+1.13
Steering Failure	46.51	47.37	+0.85
Inadequate Maintenance	72.13	72.88	+0.75
Unsafe Maneuver	57.59	58.31	+0.72
Inadequate Crew Competence	60.83	61.15	+0.32

These results should not be interpreted as causal attribution percentages. For instance, P(Capsize/Sinking = Yes|SFA = Yes) = 73.73% means that, conditional on the top-event evidence, the posterior probability of a capsize/sinking outcome is 73.73%—it does not imply that capsizing “caused” 73.73% of serious accidents. Diagnostic inference is thus best regarded as a structured method for revising the plausibility of candidate explanations after an incident, rather than as a basis for assigning legal or forensic causation.

4.5. Sensitivity Analysis

Node-state sensitivity analysis identified Capsize/Sinking, Loss of Stability, and Navigation-Related Accident as the strongest determinants of top-event probability, with probability variations of 37.15, 28.48, and 22.60 percentage points, respectively. Much of this influence can be attributed to their structural proximity to SFA. Among upstream controllable factors, Improper Loading/Load Distribution and Passenger Counting/Control exhibited the largest sensitivity swings, further corroborating the intervention findings reported earlier. The complete node-state sensitivity results are presented in Table 8.

Table 8. Node-state sensitivity of Serious Ferry Accident probability.

Rank	Variable	P(SFA|X = No), %	P(SFA|X = Yes),%	Swing, pp
1	Capsize/Sinking	49.52	86.67	37.15
2	Loss of Stability	53.23	81.72	28.48
3	Navigation-Related Accident	57.23	79.83	22.60
4	Loss of Navigational Control	64.01	75.56	11.55
5	Overloading	67.10	75.38	8.28
6	Improper Loading/Load Distribution	68.38	74.63	6.25
7	Passenger Counting/Control	69.58	73.81	4.23
8	Adverse Weather	70.88	74.31	3.43
9	Propulsion Failure	70.34	73.75	3.42
10	Inadequate Maintenance	70.45	73.16	2.71

GeNIe’s built-in parameter sensitivity provided an independent numerical check on the results. The tornado analysis targeted Serious Ferry Accident = Yes as the outcome, with a parameter spread of 10% of the current value. The baseline target value stood at 0.724026, and the displayed reachable range spanned approximately 0.688–0.760. The most sensitive parameters included the top-event CPT under combined Capsize/Sinking and Navigation-Related Accident, P(Capsize/Sinking = Yes|Loss of Stability = Yes), and the revised top-event condition in which a Navigation-Related Accident occurred without Capsize/Sinking. Loading, overloading, and passenger-control parameters also ranked among the top ten, confirming that the practical upstream findings are not artifacts of a single sensitivity metric.

The convergence among forward intervention results, node-state sensitivity, and GeNIe parameter sensitivity is particularly notable. All three analytical approaches consistently identify the stability/capsize pathway as highly influential and repeatedly bring loading and passenger-control parameters to the foreground of risk-control deliberation. Song [12] similarly emphasizes improper loading, adverse weather, and maintenance-related conditions in fuzzy Bayesian analysis of capsizing, sinking, and flooding casualties. This alignment supports the broader plausibility of these factors, while not implying identical probability magnitudes across different national contexts.

4.6. Model Validation

The validation results confirm the internal logical and probabilistic consistency of the FBN. The model satisfies the three behavioral axioms applied in comparable maritime FBN studies [9,10]. For example, a 10% decrease in each root prior produced a corresponding drop in its immediate descendant and in SFA, while combined reductions across stability-related roots yielded a larger SFA decrease than any individual subset. CPT monotonicity was likewise preserved across progressively hazardous parent-state configurations.

The three axioms were then examined numerically. For Axiom 1, a 10% reduction in the Improper Loading/Load Distribution prior lowered Loss of Stability from 67.30% to 65.88% and SFA from 72.40% to 72.00%; a 10% increase raised these values to 68.71% and 72.80%, respectively, confirming a consistent directional response within the model. For Axiom 2, separate 10% reductions in Inadequate Passenger Counting/Control, Improper Loading/Load Distribution, and Adverse Weather decreased SFA by 0.28, 0.40, and 0.15 percentage points, respectively, whereas their simultaneous reduction diminished SFA by 0.87 percentage points, underscoring a cumulative effect stronger than any single intervention. For Axiom 3, the Loss of Stability CPT rose from 0.1000 with Overloading, Improper Loading/Load Distribution, and Adverse Weather all absent to 0.8466 when all three were present; similarly, Loss of Navigational Control increased from 0.1000 with Propulsion Failure, Steering Failure, and Unsafe Maneuver absent to 0.8667 under the highest-risk combinations. Therefore, these results demonstrate that the model follows the assumed direction of influence across increasingly hazardous combinations of parent states. The internal and behavioral validation checks are summarized in Table 9.

Table 9. Internal and behavioral model checks.

Validation Component	Result
Expert structural validity	Retained nodes/links achieved full relevance agreement in the consolidated record (I-CVI and S-CVI/Ave = 1.00).
Independent probability check	GeNIe baseline SFA = 0.724026 matched independent propagation.
Axiom 1: monotonic response	A ±10% perturbation of Improper Loading changed LS from 65.88% → 67.30% → 68.71% and SFA from 72.00% → 72.40% → 72.80%.
Axiom 2: cumulative influence	10% reductions in PCF, IL and AW individually reduced SFA by 0.28, 0.40 and 0.15 pp, whereas their combined reduction produced 0.87 pp.
Axiom 3: causal direction	P(LS) increased from 0.1000 under O = No, IL = No, AW = No to 0.8466 under O = Yes, IL = Yes, AW = Yes; LNC similarly increased from 0.1000 to 0.8667 across safe-to-high-risk combinations.
Inference/sensitivity consistency	Forward, backward and sensitivity results were directionally coherent with the final causal structure.

This validation is deliberately framed as internal and behavioral, rather than predictive, in nature. Robust external validation would require an independent dataset of sufficient detail, encompassing voyage exposure, accident occurrence, and causal-factor observations. Accordingly, the present model is best understood as an expert-informed causal decision framework—one that can be progressively refined as higher-quality operational data become available.

4.7. MV Nyerere Retrospective Consistency Check

The MV Nyerere application employed Overloading = Yes and Capsize/Sinking = Yes as the two case-evidence nodes. Overloading was grounded in the official preliminary government statement, while capsize/sinking reflects the documented accident outcome. No evidence was entered for maintenance, crew competence, unsafe maneuver, improper loading, or weather conditions. This deliberately conservative scenario enables the BN to infer upstream and intermediate states on its own, rather than steering the network toward a predetermined narrative.

Under the combined scenario, Loss of Stability rose from the 67.30% baseline to 96.80%, while Inadequate Passenger Counting/Control increased from 66.68% to approximately 84.40%. Improper Loading reached roughly 67.85%, and Adverse Weather 46.25%; these posterior increases, however, constitute model-based plausibility updates rather than historical proof. Serious Ferry Accident increased to 86.67%, a figure driven primarily by the top-event CPT once Capsize/Sinking = Yes is observed.

The most salient case-study finding is thus P(Loss of Stability = Yes|Overloading = Yes, Capsize/Sinking = Yes) = 96.8%. The model was not informed that Loss of Stability had occurred; it inferred the high posterior directly from the evidence. This behavior aligns with the final stability pathway and supports the model’s retrospective plausibility without claiming forensic reconstruction. The unavailability of the detailed investigation report remains a limitation, and any future access to that report should prompt a formal evidence update rather than a retroactive alteration of the present results. The resulting GeNIe posterior network is shown in Figure 4.

Figure 4. GeNIe posterior inference for the MV Nyerere retrospective scenario (Overloading = Yes; Capsize/Sinking = Yes). Arrows indicate the directed parent-to-child dependency relationships represented in the Bayesian network.

4.8. Overall Discussion and Implications

Taken together, these results suggest that serious ferry accident risk in Tanzania is better characterized as an interacting system of operational, technical, human, and environmental conditions than as a single-failure problem. The stability/capsize pathway is especially pronounced in the final model: it dominates node-state sensitivity, contains several of the most sensitive tornado parameters, and yields the largest modeled root-level scenario reduction through improper loading. This pattern aligns with Tanzania’s historical accident profile and with broader evidence from domestic ferry operations, which consistently point to overloading, loading practices, and adverse weather.

The navigation-control pathway remains a key contributor. Inadequate Maintenance exhibited the highest root prior and, under controlled conditions, substantially altered the states of Propulsion Failure and Steering Failure. Its comparatively smaller direct effect on the top event reflects causal dilution through intermediate nodes and the persistence of an independent stability branch—not a lack of substantive importance. This distinction among baseline prevalence, local causal effect, and top-event sensitivity is one of the core strengths of the Bayesian network framework: a factor may be relatively common yet weakly discriminating at the top event, or less prevalent but highly consequential once present.

The results diverge from the Likoni ferry FBN, where propulsion-system failure dominated risk importance [11]. This contrast is analytically valuable, as it underscores that domestic-ferry risk structures should be context-specific. Tanzania’s evidence base reflects a pronounced history of capsize/sinking incidents and persistent concerns over loading and passenger control, whereas Likoni represents a distinct route with its own operational and machinery profile. The study thus advocates for locally grounded causal models over universal ferry-risk rankings.

From a policy standpoint, the combined scenario results carry greater weight than the ranking of any individual node. Passenger control, loading/stability, maintenance, crew competence, and weather assessment should be treated as components of an integrated safety framework. The finding that setting all five root nodes to “No” reduces the modeled probability by 17.57 percentage points illustrates the combined scenario within the model; it does not measure the effect of a real-world intervention. This approach aligns with the IMO’s Model Regulations on Domestic Ferry Safety [1] and resonates with the multi-dimensional operational challenges identified by Baig et al. [17].

The framework also offers an institutional advantage: it is inherently updatable. Root priors can be replaced or triangulated with empirical, exposure-based estimates as national ferry databases mature, and CPTs can be refined in response to new accident investigations, inspection records, or operational data. In this respect, the BN serves as a bridge between the current data-constrained environment and a future evidence-rich safety-management system.

The BN adds conditional inference to the failure pathways organized by the fault tree. Forward scenarios show how the modeled accident probability changes under specified upstream conditions. Backward diagnosis starts with an observed accident and updates possible contributing conditions. Section 4.4 enters Serious Ferry Accident = Yes, while Section 4.7 enters Overloading = Yes and Capsize/Sinking = Yes. The analysis therefore uses evidence at intermediate and outcome nodes, not only changes to root probabilities. Shared causes are represented once and linked to their affected events through the CPTs.

In the MV Nyerere check, the combined evidence raises Loss of Stability from 67.30% to 96.80% and inadequate passenger counting/control from 66.68% to approximately 84.40%. Such updates can help identify matters for further investigation, such as passenger records and loading practices, but do not prove that an unobserved condition occurred. New observations can be entered while the structure and CPTs remain fixed. This is evidence updating within a static network, not a model of how risk changes over time.

4.9. Limitations

Five limitations qualify the findings reported in this study. First, the numerical probabilities are substantially expert-informed, as complete voyage-exposure and causal-factor datasets are not currently available. Accordingly, these probabilities represent model beliefs—or risk propensity—rather than observed accident frequencies. Second, the compact network does not capture every conceivable mechanism. Factors such as flooding/water ingress, hull and watertight integrity, vessel design, fatigue, lookout performance, lifesaving equipment, emergency response, and regulatory or organizational conditions may prove decisive in specific accidents, yet they were excluded as separate nodes in the interest of generalizability and elicitation feasibility. The nonzero CPT entries under all-No parent conditions do not separately quantify the effects of omitted mechanisms. Third, competence weighting reduces but does not eliminate expert subjectivity. Fourth, the full detailed MV Nyerere investigation report was unavailable, which restricted the retrospective application to accessible official and corroborated evidence. Fifth, validation is primarily structural, internal, and behavioral; prospective predictive validation will require future incident and exposure data. These limitations do not invalidate the model. Rather, they delineate the boundaries within which its probabilities should be interpreted and identify clear priorities for future data development.

Confidence in individual answers was not collected, so tentative and confidently held judgments within the same linguistic category cannot be distinguished. Future questionnaires should collect confidence separately from event likelihood. The absence of a fixed voyage or time reference also limits interpretation of the probabilities as accident frequencies.

5. Conclusions and Recommendations

5.1. Conclusions

This study constructs and applies a hybrid FTA–FBN framework for assessing serious domestic ferry accident risk in Tanzania. The approach integrates Tanzania-specific documentary evidence, an expert-validated fault tree, competence-weighted fuzzy probability elicitation, and Bayesian inference. The resulting network comprises 14 binary nodes organized along stability/capsize and navigation-control pathways, and was successfully implemented in GeNIe.

The model yields a baseline Serious Ferry Accident probability of 72.40%, interpreted as an expert-informed baseline risk propensity rather than a voyage-level accident frequency. Among individual root-level scenarios, setting improper loading to “No” produced the largest reduction in top-event probability, while setting all five root risks to “No” lowered SFA to 54.83%. Backward diagnostic inference and sensitivity analysis consistently identified Capsize/Sinking, Loss of Stability, and Navigation-Related Accident as the most influential immediate pathways, with upstream loading and passenger-control factors emerging as prominent intervention points. GeNIe’s tornado analysis independently corroborated these findings.

The MV Nyerere application provided a retrospective consistency check, not independent validation. When Overloading and Capsize/Sinking were entered as case evidence, the posterior probability of Loss of Stability rose to 96.8%, demonstrating that the model responds coherently to historically defensible evidence without relying on unsupported assumptions about maintenance, crew competence, or maneuvering. Overall, the findings support a systems-based view of ferry safety in which operational loading, passenger management, maintenance, crew capability, and environmental assessment interact as interdependent components rather than operate in isolation.

5.2. Practical Recommendations

Ferry operators should strengthen passenger counting, ticketing/manifest reconciliation, and load-control procedures, ensuring that passenger, cargo, and vehicle quantities are verified against permitted capacity prior to departure. Loading responsibility should explicitly encompass distribution and stability considerations, extending beyond commercial embarkation efficiency. Planned maintenance, defect reporting, and timely repair of propulsion and steering systems should be documented and auditable.

Masters and crews should receive recurrent training in stability awareness, loading implications, adverse-weather decision-making, navigation and maneuvering, as well as passenger-control procedures. Departure authorization should remain contingent upon acceptable loading, passenger count, machinery condition, and prevailing environmental circumstances.

Regulatory and inspection authorities should prioritize risk-based oversight of capacity compliance, loading and stability practices, maintenance records, propulsion and steering reliability, and crew competence. Repeated deficiencies should trigger proportionate follow-up and enforcement. A structured national ferry-safety database should consolidate passenger counts, inspection outcomes, mechanical failures, incidents, accidents, and investigation findings, enabling future BN priors to be increasingly estimated from exposure-based evidence.

At the government and system-management level, safety interventions should be implemented as integrated packages rather than isolated measures. The model shows that combined scenarios involving passenger management, loading and stability, maintenance, crew competence, and operational weather assessment give larger modeled probability reductions than single-factor scenarios. Accident investigation findings should also be archived and made accessible for safety learning wherever legally permissible, allowing the network to be updated rather than rebuilt as new evidence emerges.

5.3. Future Research

Future research should estimate empirical priors from route- and voyage-level exposure data, extend the network to incorporate residual mechanisms—such as flooding/water ingress and watertight integrity—where justified, and evaluate separate models for Lake Victoria, Zanzibar/coastal, and other inland-waterway operating environments. Prospective validation using future incident and inspection records would yield a more robust assessment of predictive performance. Additionally, comparative applications to other East African ferry systems could help determine which causal relationships are transferable across contexts and which remain location-specific.