A Hybrid STPA-BN Framework for Quantitative Risk Assessment of Runway Incursions: A Case Study of the Austin–Bergstrom Incident

Abstract

The escalating complexity of airport surface operations challenges traditional risk quantification methods. Conventional linear models often fail to capture the non-linear interactions within sociotechnical systems. While hybrid System-Theoretic Process Analysis (STPA) and Bayesian Network (BN) models provide an alternative, existing integrations are frequently constrained by ad hoc structural translations and rare-event data sparsity. To address these methodological limitations, this study proposes an enhanced STPA-BN framework. A formalized mapping mechanism (M1–M4) translates qualitative STPA scenarios into a BN topology to quantify non-linear causal dependencies across environmental precursors, operator cognitive states, unsafe control actions, and systemic hazards. Parameterization is achieved via a logic-guided strategy, fusing historical incident data mining with deterministic physical constraints to correct rare-event probabilities. The framework is validated through a reconstruction of the 2023 Austin–Bergstrom runway incursion incident. Results indicate that under low visibility and degraded surveillance, incursion probability escalates to 86%. Sensitivity analysis reveals that while restoring surveillance infrastructure reduces collision risk by ~13%, communication compliance improvements prove insufficient in sensory-deprived environments. These findings quantitatively demonstrate that administrative controls cannot substitute for robust engineering safeguards in complex operations.

1. Introduction

As global air traffic recovers and approaches saturation, the pursuit of operational efficiency has transformed airport surface operations into complex sociotechnical systems [1]. These systems are characterized by deep coupling among Air Traffic Control (ATC), flight crews, ground vehicles, and automated surveillance technologies. Within this dynamic environment, despite the continuous evolution of safety management systems [2], Runway Incursion (RI) remains a persistent and critical threat to aviation safety [3]. Recent investigations highlight that such incidents increasingly arise not from simple component failures, but from complex human–system interactions and communication breakdowns under high-pressure scenarios [4,5].

Existing safety analysis paradigms face a dichotomy: traditional probabilistic methods (e.g., FTA and Bow-Tie methods) struggle to model non-linear interactions in sociotechnical systems, while modern systemic methods (e.g., STPA) excel at qualitative hazard identification but lack the quantitative capability required for risk prioritization [6]. While hybrid approaches integrating STPA with Bayesian Networks (BNs) have emerged as a promising solution, they currently face two significant methodological bottlenecks: the lack of a standardized mapping mechanism from qualitative control structures to quantitative network topologies, and the “data sparsity” challenge in parameterizing rare aviation accidents [7,8].

To address the methodological limitations of existing approaches, this study proposes a novel hybrid risk assessment framework. The distinct novelty of this research lies in its ability to reconcile objective statistical baselines derived from ASRS text mining with the deterministic safety logic of System-Theoretic Process Analysis (STPA). Unlike previous studies that often rely on ad hoc qualitative-to-quantitative translations or purely subjective expert elicitation, this work introduces a formalized and reproducible mapping protocol (M1–M4) paired with a logic-guided parameterization strategy. This novel approach effectively mitigates the data sparsity bottleneck inherent in small-sample aviation datasets. Operationally, the model provides quantitative validation of a counterintuitive phenomenon: in sensory-deprived environments (e.g., low visibility), procedural enhancements such as communication compliance yield diminishing returns. This provides novel data-driven evidence for prioritizing independent physical engineering safeguards over traditional administrative controls.

The core contributions of this study, aligning with recent advances in aerospace safety methodologies, are threefold:

• Methodological Advancement in Safety Quantification: We establish a standardized mapping mechanism that bridges qualitative System-Theoretic Process Analysis (STPA) and quantitative Bayesian Networks (BNs). This advances current risk assessment practices by providing a structured pathway to transform control-theoretic hazard analyses into probabilistic risk forecasting models, thereby alleviating the structural homomorphism problem.
• Analytical Advancement in Rare-Event Data Processing: We propose a logic-guided parameterization strategy integrating text mining of ASRS reports with deterministic safety constraints. This approach advances the modeling of high-consequence, low-probability events by mitigating the data sparsity bottleneck common in aviation safety research, offering a robust alternative to pure statistical learning in small-sample regimes.
• Operational Advancement in Airport Surface Risk Management: Validated via a quantitative reconstruction of the 2023 Austin–Bergstrom incident (mapping factual operational data extracted from the final NTSB investigation docket into the BN’s evidence vector), this study advances the understanding of human–system resilience. It provides quantitative evidence that in sensory-deprived environments (e.g., Low-Visibility Procedures), purely procedural controls are insufficient, highlighting the critical need to shift towards independent engineering safeguards.

2. Related Work

2.1. Traditional and Data-Driven Safety Analysis

Traditional safety analysis paradigms, such as Fault Tree Analysis (FTA), Bow-Tie models [9], and standard probabilistic risk assessments [10], or alternative mathematical models like game-theoretic set pair analysis [11], typically rely on linear causal assumptions that attribute accidents to sequential component failures. While newer data-driven approaches like neural networks are emerging [12], modern aviation accidents are often emergent properties resulting from functional resonance or dysfunctional interactions among components that are operating within their normal performance standards [13]. Consequently, relying solely on sequential failure models is insufficient to capture the non-linear accident mechanisms inherent in modern airport surface operations.

2.2. System-Theoretic Process Analysis (STPA)

To address this systemic complexity, System-Theoretic Process Analysis (STPA) has been widely adopted in aviation safety and incident investigation [6]. By constructing a Hierarchical Control Structure (HCS), STPA effectively identifies potential Unsafe Control Actions (UCAs) and their underlying Causal Factors (CFs), offering superior coverage of human–system interactions [14] and complex control architectures [15]. However, while STPA excels in qualitative hazard identification, it lacks the capability to quantify risk priorities. In the resource-constrained environment of airport management, the absence of a probabilistic dimension hinders decision-makers from optimizing resource allocation among competing safety risks.

2.3. Hybrid STPA-BN Approaches

To overcome the limitations of purely qualitative analysis and enable rigorous risk prioritization, researchers have increasingly sought to integrate STPA with Bayesian Networks (BNs) [16]. BNs offer robust capabilities for probabilistic reasoning and uncertainty management. This hybrid STPA-BN approach has been successfully applied across various domains, including maritime autonomous surface ships [17,18,19,20], formal verification of autonomous systems [21], and automated driving [21]. In the aviation sector, recent works have utilized similar integrations to assess risks in unstabilized approaches [22], Unmanned Aerial Vehicle (UAV) traffic management [23], controller-caused accidents via association rules [24], and hydrogen-electric propulsion systems [25].

Despite these advancements, significant methodological challenges remain in the application of STPA-BN frameworks. First, constructing a BN structure often relies heavily on data correlation, potentially generating topologies that lack causal explanatory power. Second, a rigorous quantification challenge exists: aviation accidents are highly consequential but rare events, leading to severe data sparsity for statistical learning. As noted in reliability studies, accurate parameterization often requires navigating the uncertainty between limited empirical data and subjective expert elicitation [7,8]. Relying solely on small-sample data yields mathematically smoothed probabilities that may contradict the deterministic causality of safety-critical systems, while purely subjective methods may lack precision [26]. Therefore, a critical challenge remains: how to establish a parameterization mechanism that effectively reconciles the statistical patterns derived from historical data with the rigorous logical constraints of system operations.

Addressing these limitations, this study proposes a hybrid risk assessment framework that integrates STPA mechanism analysis with a logic-informed Bayesian Network. This approach utilizes the rigorous system control logic of STPA to define a causally meaningful topology for the BN. Specifically, we first identify control loop defects and causal scenarios using STPA, establishing a structured mapping mechanism from UCAs to BN nodes. Subsequently, utilizing 50 relevant accident reports from the Aviation Safety Reporting System (ASRS), we employ text mining to establish baseline risk frequencies. To mitigate the “zero frequency” problem inherent in small-sample learning, we augment this data-driven baseline with deterministic logic corrections, thereby enforcing physical and operational consistency in high-risk boundary conditions.

3. Methodology

3.1. Scope and Limitations of the Study

Before detailing the proposed STPA-BN framework, several inherent methodological boundaries and limitations of the current study must be explicitly acknowledged:

• Data Sparsity and Bias: The probabilistic parameters in this study were quantified using a dataset of 50 relevant Aviation Safety Reporting System (ASRS) reports. While sufficient for a pilot validation of the proposed mapping mechanism, the relatively small sample size inevitably introduces epistemic uncertainty. Furthermore, ASRS data is derived from voluntary and subjective reporting, which potentially introduces reporting bias. Certain types of errors (e.g., minor procedural deviations) might be underrepresented compared to more dramatic, high-consequence incidents.
• Static Modeling Constraints: The current Bayesian Network represents a static “snapshot” of causal dependencies based on STPA control flaws. It relies on static topological mappings and does not explicitly capture the continuous temporal evolution of operational risk (e.g., how the probability of collision dynamically fluctuates second-by-second as an aircraft accelerates down the runway).
• Generalizability: The Austin–Bergstrom case study validated the model specifically under a severe sensory-deprived environment (Low Visibility/Fog). The sensitivity and robustness of the model parameters under nominal weather conditions but with high-traffic complexity (e.g., runway crossing saturation) require further empirical validation in future studies.
• Logic-Guided Parameterization Trade-offs: To address data sparsity, we utilized a logic-guided override (e.g., θ ≈ 0.9999) for boundary conditions rather than traditional mathematical smoothing (e.g., Laplace smoothing). While this prevents the generation of mathematically smoothed but physically impossible safe probabilities, it inherently introduces a conservative bias into the network. Future iterations could explore alternative parameterization approaches, such as weighted Noisy-OR gates or hierarchical Bayesian updating, to further balance deterministic physical constraints with empirical data distributions.

3.2. Framework Overview

To address the inherent complexity of airport surface operations and the persistent challenge of quantifying runway incursion risks, this study proposes a hybrid analysis framework integrating System-Theoretic Process Analysis (STPA) with Bayesian Networks (BNs). This framework utilizes STPA to construct a control loop topology grounded in system physics, establishing a structured mapping mechanism from Unsafe Control Actions (UCAs) to Bayesian nodes. Specifically, the BN topology in this framework captures three hierarchical levels of causal dependencies:

• Contextual Dependencies: modeling how environmental dynamics and sensor feedback shape operator mental models;
• Cognitive-Behavioral Dependencies: capturing how flawed process models dictate the execution of UCAs;
• Functional Dependencies: representing how systemic hazards emerge from the nonlinear combinations of multiple UCAs and barrier failures.

By bridging qualitative causal scenarios identified via STPA with the probabilistic inference capabilities of BNs—an integration strategy increasingly adopted for complex safety-critical systems [23,27]—the proposed approach facilitates both the identification of complex hazard causality and the quantitative assessment of occurrence probabilities.

3.3. System Architecture and Control Loop Specification

To systematically characterize the interactions between system components, a Hierarchical Control Structure (HCS) was constructed following the standard STPA protocol [28], as illustrated in Figure 1. This topology delineates the distinct roles of the Tower Controller, Flight Crew, and Vehicle Driver, visualizing the command channels and feedback mechanisms (e.g., visual observation, VHF radio communication, and sensor displays) that constitute the operational loop. Furthermore, the structure explicitly accounts for environmental disturbances (such as glare or signal congestion) and actuator/sensor configurations, serving as the foundational model for identifying potential UCAs.

Figure 1. Hierarchical Control Structure (HCS) of the airport surface operation system.

As depicted in Figure 1, the system is organized into a dual-branch control architecture where the Tower Controller functions as the supervisory authority. The interactions within these loops are mediated through specific sensor and actuator interfaces, which are critical for maintaining the system’s safety constraints. In the supervisory level, the Tower Controller issues control actions via VHF radio transmitters. Feedback is acquired through auditory channels, direct visual observation, and advanced surveillance technology (e.g., A-SMGCS). The operational level comprises the Flight Crew and Vehicle Driver, who translate supervisory commands into physical manipulation of the system via actuators (e.g., tillers, pedals), while monitoring system states through displays (e.g., ND, MDT) and external visual cues.

Crucially, the HCS explicitly models the vulnerability of these control loops to environmental disturbances. As illustrated on the periphery of the control structure, external variables such as low visibility, VHF congestion, or sun glare act as exogenous inputs that can degrade sensor fidelity or obstruct control actions. For the Austin–Bergstrom case study, capturing these environmental interactions is vital, as they represent the specific contextual hazards that can induce human error or mechanical latency.

3.4. Mathematical Formulation of the Hybrid Risk Model

In this study, the “Model” is defined as a probabilistic graphical mapping $M$ that transforms the qualitative control structure of STPA into a quantitative Bayesian Network (BN). Formally, the model is a tuple $M=⟨S_{STPA},G_{BN},\mathsf{\Theta }⟩$, where $S_{STPA}$ represents the set of hierarchical control constraints and causal scenarios identified in the qualitative analysis. $G_{BN}=(V,E)$ is a Directed Acyclic Graph (DAG) representing the network topology, constructed via a formalized mapping function $f:S_{STPA}\to V$. $\mathsf{\Theta }$ represents the set of parameters (Conditional Probability Tables, CPTs) quantifying the dependencies between nodes. The core algorithmic scheme governing this model consists of two phases:

• Phase 1: Topological Mapping ($f$)

The structural translation adheres to a formalized set of mapping protocols. The node set $V$ is generated through the union of distinct subset mapping functions, formally expressed as follows:

$$V=M_1\left(C_F\right)\cup M_2\left(P_M\right)\cup M_3\left(UCA\right)\cup M_4\left(H\right)$$

(1)

where $C_F$, $P_M$, $UCA$, and $H$ denote the sets of Causal Factors, Process Model defects, Unsafe Control Actions, and Hazards, respectively.

The logical transformation from the qualitative control structure to the probabilistic network adheres to a formalized set of mapping protocols. Figure 2 delineates this translation process. Consistent with established transformation logic in the recent literature [29], a formal mapping set $M = \{M_1,{ M}_2,{ M}_3,{ M}_4\}$ is defined as follows:

Figure 2. Schematic representation of the mapping mechanism. The thick black arrow indicates the application of the general STPA framework to the specific analysis domain.

• (M₁) Causal Factors $\to$ Root Nodes: STPA-identified causal factors—specifically those pertaining to Environmental Disturbances (e.g., Visibility) and Physical/Component Constraints (e.g., Marking Legibility)—are mapped to Root Nodes. These nodes represent independent exogenous variables that provide the base probability inputs.
• (M₂) Process Model Defects $\to$ Intermediate Nodes: Discrepancies in the Process Model/Mental State of human controllers or automation (e.g., Pilot Situational Awareness, ATC Fatigue) are mapped to Intermediate Nodes. These nodes represent the internal state-sensing logic and cognitive conditions influencing decision-making.
• (M₃) Unsafe Control Actions (UCAs) $\to$ Control Action Nodes: The specific UCAs derived from the Control Structure (e.g., Unauthorized Crossing, Erroneous ATC Instruction) are directly mapped to Control Action Nodes. These nodes characterize the failure states of critical control functions.
• (M₄) System Hazards $\to$ Target Node: The system-level Loss/Hazard (e.g., Runway Incursion) corresponds to the Target Node. This terminal node aggregates the conditional probabilities from all upstream function nodes to quantify the final consequences.

It is important to acknowledge the inherent structural divergence between the cyclic feedback loops typical of STPA and the strict acyclic constraint of the BN DAG. To reconcile this, the proposed mapping mechanism employs a ‘causal unrolling’ approach, representing a static temporal snapshot of the hazard evolution. Within this defined time slice, causal ordering is assumed to be strictly unidirectional: from environmental constraints to cognition, and subsequently to action. Consequently, STPA feedback channels (e.g., surveillance displays or visual observation) are not modeled as structural loops; rather, the states of these feedback mechanisms are modeled as upstream Causal Factors (M₁) that unidirectionally influence the operator’s mental Process Model (M₂). While this static mapping effectively quantifies the impact of feedback degradation on decision-making at a specific critical juncture, it cannot capture continuous, multi-round mutual co-dependencies. This structural boundary is formally addressed in the limitations of the study (Section 3.1).

• Phase 2: Probabilistic Inference ($\mathsf{\Theta }$)

Once the topology $G_{BN}$ is established, the joint probability distribution $P\left(V\right)$ over the set of variables $V=\{X_1,X_2,\dots ,X_n\}$ is factorized according to the chain rule of Bayesian Networks:

$$P(X_1,X_2,\dots ,X_n)=\prod _{i=1}^{n}P(X_i\mid Pa(X_i))$$

(2)

where $Pa\left(X_i\right)$ denotes the set of parent nodes for $X_i$ in the graph $G_{BN}$. The quantitative diagnostic inference (discussed in Section 5) is performed by computing the posterior probability $P(H\mid E)$ given an evidence vector $E$ (e.g., verified visibility conditions from factual data), utilizing the Junction Tree algorithm to achieve exact algorithmic inference.

3.5. Parameterization and Data Source

3.5.1. Network Topology Construction

Following the formal mapping protocols defined in Section 3.4, the complete Bayesian Network topology was implemented using GeNIe academic software (Version 5.0, BayesFusion, LLC, Pittsburgh, PA, USA), as depicted in Figure 3. This Directed Acyclic Graph (DAG) serves as the structural skeleton for the subsequent parameter learning phase, faithfully translating the causal dependencies identified in the STPA into a probabilistic graphical model. As depicted in Figure 3, the network is visually structured hierarchically from top to bottom. The top-level Root Nodes (e.g., Visibility, Surveillance) represent exogenous environmental variables and systemic constraints. These inputs propagate downwards to the Intermediate Nodes, which model the cognitive and situational awareness states of the operators (e.g., ATC_SA and Pilot_SA). The causal flow concludes at the bottom Leaf Nodes, representing the unsafe control actions (UCAs) and the final target node (Incursion_Event). This topology explicitly visualizes how environmental constraints physically and cognitively dictate operational decision-making.

Figure 3. Bayesian Network topology construction in GeNIe.

3.5.2. Data Processing Pipeline

The transformation of unstructured narrative accident reports into structured probability tables necessitated a systematic, structured data processing workflow. Figure 4 illustrates the data processing pipeline implemented in this study. The workflow proceeds from the mining of raw text and keyword extraction to STPA-guided classification, concluding with expert-assisted parameter learning. For example, an ASRS excerpt stating “…dense fog obscured the taxiway markings…” is parsed to extract the keyword “fog”. Guided by the STPA control structure, this is classified as an “Environmental Disturbance,” which is then mapped to the state “Low Visibility” in the corresponding BN root node.

Figure 4. The overall workflow of the proposed data processing pipeline.

3.5.3. Probabilistic Inference and Learning

Probabilistic inference is governed by Bayes’ Theorem, allowing for the dynamic updating of risk estimates. For a given set of evidence variables E, the posterior probability of a hypothesis H (e.g., Incursion Event) is calculated as follows:

$$\mathrm{P}(\mathrm{H}\mid \mathrm{E})={\displaystyle \frac{\mathrm{P}(\mathrm{E}\mid \mathrm{H})·\mathrm{P}(\mathrm{H})}{\mathrm{P}\left(\mathrm{E}\right)}}$$

(3)

where $\mathrm{P}\left(\mathrm{H}\right)$ denotes the prior probability derived from historical data, and $\mathrm{P}(\mathrm{E}\mid \mathrm{H})$ represents the likelihood function.

Network parameters were quantified using a dataset comprising 50 relevant accident reports retrieved from the Aviation Safety Reporting System (ASRS). For a child node ${\mathrm{X}}_{\mathrm{i}}$, the Conditional Probability Table (CPT) was derived by calculating the posterior probability given the configuration of its parent node states $\mathrm{Pa}({\mathrm{X}}_{\mathrm{i}})$:

$$\mathrm{P}({\mathrm{X}}_{\mathrm{i}}=\mathrm{k}\mid \mathrm{Pa}({\mathrm{X}}_{\mathrm{i}})=\mathrm{j})={\displaystyle \frac{{\mathrm{N}}_{\mathrm{ijk}}}{\sum _{{\mathrm{k}}^{\prime }}{\mathrm{N}}_{{\mathrm{ijk}}^{\prime }}}}$$

(4)

where ${\mathrm{N}}_{\mathrm{ijk}}$ denotes the frequency of samples in the dataset where the parent node state is $\mathrm{j}$ and the child node state is $\mathrm{k}$.

3.5.4. Addressing Data Sparsity via Logic-Guided Correction

A critical methodological challenge in parameterizing BNs with aviation accident data involves combinatorial explosion and consequent data sparsity. In high-dimensional CPTs, specific combinations of parent node failures may have a zero frequency in a limited dataset (i.e.,${\mathrm{N}}_{\mathrm{ijk}}=0$). Relying solely on standard mathematical smoothing (e.g., Laplace Smoothing) in these scenarios typically yields a uniform probability distribution (maximum entropy), which contradicts the deterministic causality of safety-critical systems where the simultaneous breach of independent barriers conceptually guarantees a hazard.

To resolve this conflict, we implemented a Logic-Guided Parameterization Strategy. This approach aligns with hybrid reliability analysis methods that incorporate expert knowledge [21,30]:

• Data-Driven Baseline: For node configurations with sufficient observations (${\mathrm{N}}_{\mathrm{ijk} }> 0$), the MLE derived from ASRS data is used strictly.
• Logical Override: In scenarios involving the conjunctive failure of multiple independent safety barriers (i.e., total system breakdown), the conditional probability of the hazard was manually constrained to approach certainty (θ ≈ 0.9999). This override is strictly applied when two conditions are met: (i) Two or more independent safety barriers are simultaneously violated; and (ii) The STPA control structure indicates no remaining effective feedback loop to mitigate the hazard.

It is crucial to clarify the theoretical basis of this logic-guided override regarding barrier independence and the avoidance of circular reasoning. First, the “independence” of safety barriers is not established via formal statistical hypothesis testing—which is infeasible for zero-frequency rare events—but is determined structurally and functionally through the STPA Hierarchical Control Structure. For instance, the Tower Controller and the Flight Crew represent distinct control loops equipped with separate sensors (radar vs. visual), actuators (radio vs. flight controls), and cognitive process models. While they may share common environmental precursors (modeled as shared root nodes), their functional execution of control actions remains independent. Second, setting θ ≈ 0.9999 is not arbitrary hard coding, but the enforcement of a physical boundary condition. According to the foundational axioms of Systems Theory, if all structurally independent control loops designed to prevent a hazard are simultaneously compromised (i.e., a total loss of system control), the occurrence of the hazard is physically deterministic. This logical constraint ensures that the probabilistic network respects the deterministic physics of safety-critical systems, preventing standard mathematical smoothing algorithms from generating physically impossible safe probabilities under total-failure boundary conditions.

Upon integrating historical data with expert logic, the network parameters were fully populated. Figure 5 presents the parameterized network in its initial state. Within each node, the horizontal bars and corresponding percentages indicate the prior marginal probability of each state derived from the historical training data. Quantitative analysis of this initial state reveals a baseline risk of approximately 71%. Note that this value represents the marginal probability of an incursion-related event within the context of the reported incidents (i.e., given that a safety compromise has been flagged in ASRS), rather than the absolute probability of incursion for nominal airport operations.

Figure 5. Parameterized Bayesian Network.

4. Case Study: The Austin–Bergstrom International Airport (AUS) Incursion

4.1. Scenario Description

To validate the efficacy of the proposed STPA-BN framework, this study conducts a retrospective analysis of the severe runway incursion incident that occurred at Austin–Bergstrom International Airport (AUS) on 4 February 2023. The reconstruction approach aligns with recent Bayesian modeling of NTSB accident reports [31]. The event involved a potential collision between FedEx Flight 1432 (a Boeing 767 on final approach) and Southwest Airlines Flight 708 (a Boeing 737 departing on the same runway).

The data for this study is derived from the final Aviation Investigation Report (NTSB/AIR-24–02) officially published by the National Transportation Safety Board (NTSB) [32]. Unlike preliminary reports, this final document and its associated factual investigation docket provide deterministic and comprehensive operational records, including Cockpit Voice Recorder (CVR) transcripts, detailed meteorological visibility logs, and radar/surveillance system status. These factual data points form the robust basis for parameterizing the evidence vector in our Bayesian Network reconstruction.

The incident unfolded under Low-Visibility Procedures (LVPs), characterized by dense freezing fog with a Runway Visual Range (RVR) fluctuating between 600 and 1200 feet. A critical systemic deficiency identified during the investigation was the absence of surface surveillance technology (e.g., ASDE-X or ASSC) at the AUS control tower. Consequently, Air Traffic Controllers (ATCOs) were forced to rely exclusively on pilot position reports and direct visual observation—feedback channels that were effectively severed by the prevailing weather conditions.

Figure 6 provides a spatial reconstruction of the conflict geometry on Runway 18L. As indicated by the “Closest Proximity” marker (06:40:37), the vertical separation between the two aircraft diminished to approximately 150–190 feet, signaling a severe violation of critical safety constraints. The diagram illustrates how the Category III (CAT III) visibility conditions created a “blind” operational environment, preventing the control tower from detecting the developing conflict until the flight crews initiated evasive maneuvers.

Figure 6. Reconstruction of the spatial conflict at Austin–Bergstrom International Airport.

4.2. Evidence Setting (BN Input Vector)

To ensure the predictive validity of the proposed model and prevent retrospective fitting (confirmation bias) to the specific Austin occurrence, strict methodological boundaries were maintained between model development and case application. First, structural independence was preserved: the BN topology was derived from a generalized STPA of nominal standard operating procedures, rather than being reverse-engineered from the Austin accident sequence. Second, parametric independence was enforced (i.e., train-test separation): the Conditional Probability Tables (CPTs) were parameterized exclusively using the independent historical ASRS dataset (serving as the training set). The Austin incident was utilized strictly as an out-of-sample test case, meaning no internal parameters were tuned to fit the incident’s outcome. Finally, during evidence instantiation, only objective, deterministic boundary conditions (e.g., meteorological states, hardware availability) were clamped as input evidence (E). Intermediate cognitive nodes (e.g., Controller Situational Awareness) were deliberately left unmanipulated, allowing the network to organically infer the hazard probability based purely on the pre-trained logical dependencies. Following these rigors, the evidence vector E was instantiated as follows:

Drawing upon the factual data detailed in the NTSB investigation report and referencing established probability distributions for aviation human factors [33], the evidence vector E for the Bayesian Network was instantiated to reconstruct the specific boundary conditions of the incident. The configuration of the evidence variables is summarized as follows:

• Environmental Factors (Root Nodes): Consistent with the taxonomy of airport surface risk factors [34], the Visibility node was fixed to the state [Poor/IMC] to reflect the dense freezing fog. The Surveillance node was set to [Degraded], accounting for the absence of a Surface Movement Radar (SMR) system (e.g., ASDE-X), which eliminated a critical feedback loop for the controllers.
• Runway Condition: The node was set to [Wet/Slippery]. Crucially, this physical environmental state necessitated a procedural deviation: the Southwest Airlines crew was required to perform a static engine run-up prior to takeoff to prevent ice accumulation. This maneuver significantly extended their runway occupancy time, contributing directly to the temporal convergence of the two aircraft.
• Operational Boundary Constraints: Since the incident was strictly an aircraft-to-aircraft conflict, the Ground Vehicle branch of the network was neutralized by clamping the Driver/Vehicle Familiarity (and associated vehicle nodes) to the [Safe/No Presence] state, thereby isolating the risk factors relevant to the aerial conflict.

4.3. Analysis of Causal Propagation

The STPA-BN framework allows for a quantitative diagnosis of the accident’s causal chain by observing the variation in nodal probabilities before and after evidence injection.

• Layers 1 to 2: The Collapse of Mental Models

The injection of evidence states E = {Visibility: Low, Surveillance: Degraded} triggers a significant belief update throughout the network. The model indicates that the lack of visual confirmation, combined with the absence of surface radar data, profoundly impacts the controller’s cognitive state—a dependency phenomenon previously quantified in man–machine phased-mission systems [29]. Specifically, the posterior probability of the node ATC Situational Awareness = Poor escalates drastically from a baseline prior of 37% to 86%. This quantitative shift (+49%) mathematically demonstrates how environmental deprivation severed the controller’s feedback loop, rendering them cognitively “blind” to the dynamic runway state. Furthermore, the evidence of [Wet/Slippery Runway] propagates through the logical chain, increasing the likelihood of “Procedural Deviation” (static engine run-up), creating a critical discrepancy between the controller’s mental expectation (immediate takeoff) and the actual aircraft state (delayed departure).

2.

Layer 3: Unsafe Control Actions (UCAs)

Driven by these compromised mental states, the probability of Unsafe Control Actions rises sharply:

UCA-1 (ATC Issues Unsafe Instruction): The aggregate probability of the controller generating an unsafe output (summing the [Error_Permit] and [Uncorrected] states) surges to 77%. Notably, the specific probability of [Error_Permit]—corresponding to clearing an arrival while the runway is occupied—reaches 65%. This dominant failure mode aligns precisely with the NTSB’s finding that the controller issued a landing clearance to FedEx 1432 under the false assumption that SWA 708 had departed [4,5].

UCA-2 (Pilot Hazardous Action): Simultaneously, the probability of the Southwest aircraft entering a hazardous state ([Cross_In/Incursion]) increases to 61%. In this context, this elevated probability reflects the high risk of the aircraft remaining on the active runway (Extended Occupancy) beyond the safe time window without effective position reporting.

3.

Layer 4: Risk Outcome

The probabilistic convergence of these failures (UCA-1∩UCA-2) propagates to the target node. The model predicts that under these specific boundary conditions, the Posterior Probability of a Runway Incursion reaches 86%. This quantitative result aligns with the factual outcome, confirming that without independent barriers (like Runway Status Lights), the residual risk in this scenario exceeded acceptable safety margins by orders of magnitude compared to the baseline risk profile.

5. Quantitative Risk Assessment Results

5.1. Quantitative Diagnostic Inference

Upon instantiating the Bayesian Network with the specific evidence vector derived from the Austin–Bergstrom incident, the model performed a diagnostic belief update. Figure 7 illustrates this diagnostic inference. Visually, the root nodes where factual evidence has been injected (e.g., ‘Visibility’ set to ‘Poor_I…’, ‘Surveillance’ set to ‘Degrad…’, ‘Runway_Cond’ set to ‘Wet_Sli…’) are locked at 100% probability. Comparing Figure 7 with the baseline in Figure 5, the visual shift in probability distributions highlights the cascading impact of these specific failures. The posterior probabilities (the updated blue, yellow, and green bars) explicitly quantify how the degraded environment impairs situational awareness (e.g., ATC_SA dropping to 14%: ‘Good’), thereby visually tracing the risk propagation path from the root causes down to the terminal hazard.

Figure 7. Diagnostic inference of the Bayesian Network.

The inference results quantify a critical system state. The cumulative posterior probability of the target node, Incursion_Event (a BN node label comprising two distinct operational severity states: a general ‘Incursion’ meaning loss of separation, and a catastrophic ‘Collision’ meaning physical impact), surged to 86%. Compared to the historical baseline of 71%, this represents a 15% absolute escalation in conditional severity. More critically, the probability distribution within the risk states indicates a high potential for severity: the likelihood of a catastrophic Collision is estimated at 67%, while a general Incursion (without collision) stands at 19%. This specific distribution (a > 3:1 ratio of Collision to Incursion) quantitatively implies that once the safety margin is breached under these sensory-deprived conditions, the lack of visual evasive cues makes a catastrophic collision the overwhelmingly probable outcome.

It is imperative to contextualize these specific posterior probabilities (e.g., 86% and 67%). Given the epistemic uncertainty inherent in utilizing a limited sample size (N = 50 ASRS reports) for baseline parameterization, these figures should not be interpreted as absolute, real-world statistical frequencies. Rather, they represent conditional diagnostic metrics calculated within the model’s specific logic-constrained space. The primary analytical value of this framework lies in evaluating the relative magnitude of systemic risk degradation and comparing the efficacy of different interventions (e.g., the relative difference in risk reduction between restoring surveillance versus enforcing communication), which is robustly anchored by the deterministic constraints of the STPA control structure.

This quantification aligns closely with the empirical “near-miss” reality of the incident, where vertical separation was compromised to less than 150 feet. The diagnostic reasoning identifies the ATC_SA node as the primary failure pathway, exhibiting a posterior failure probability of 86%. This finding corroborates the qualitative hypothesis generated by STPA, confirming that the collapse of the controller’s process model was the dominant precursor to the hazard.

5.2. Counterfactual and Sensitivity Analysis

To evaluate the efficacy of potential risk mitigation strategies (Risk Control Options), a counterfactual sensitivity analysis was performed. This process involved systematically modifying specific root nodes—representing distinct safety barriers—while holding the adverse environmental boundary conditions (e.g., Low Visibility) constant. The results, summarized in Table 1, reveal the non-linear response of the system to different intervention types.

Table 1. Sensitivity Analysis of Safety Interventions.

Scenario ID	Intervention/Variable Control	Posterior Risk (Total)	Breakdown (Incursion/Collision)	Risk Reduction (Δ)
Baseline	Original Incident Conditions (No Radar, Fog and Comm Issues)	86.0%	19%/67%	-
Intervention A	Hardware Upgrade: ASDE-X Radar Installed (Surveillance = Available)	77.0%	23%/54%	−9.0%
Intervention B	Procedural Compliance: Accurate Reporting (Comm_Accuracy = Accurate)	86.0%	17%/69%	~0.0%
Intervention C	Combined Synergy: Surveillance = Available + Comm_Accuracy = Accurate	73.0%	25%/48%	−13.0%

To visually compare the impact of these safety barriers, the posterior risk probabilities were plotted across the defined scenarios (Figure 8). The chart abstracts the complex network dependencies to visualize the marginal utility of each safety barrier regarding the terminal hazard state.

Figure 8. Sensitivity analysis comparing the effectiveness of hardware interventions versus procedural compliance.

As illustrated in Figure 8, the introduction of surveillance technology (Intervention A) produces a measurable reduction in aggregate risk (dropping from 86% to 77%). Specifically, the probability of a catastrophic collision decreases significantly (from 67% to 54%), reflecting the capability of hardware sensors to bypass human cognitive limitations and provide objective feedback loops. However, the residual risk remains high because the downstream Pilot Situational Awareness node remains severely bottlenecked by the persistent ‘Poor Visibility’ root node; the flight crew remains functionally blind despite the controller’s improved awareness.

Notably, a counterintuitive finding emerged regarding procedural interventions: strictly enforcing procedural compliance regarding communication (Intervention B) not only failed to reduce the aggregate risk but resulted in a marginal increase in the probability of a catastrophic collision (rising from 67% to 69%). This phenomenon implies that under conditions of sensory deprivation, high-fidelity communication channels may inadvertently accelerate the propagation of erroneous control actions. Specifically, when the controller operates under a flawed mental model (e.g., falsely believing the runway is clear), clear and confident instructions reduce the pilot’s hesitation (or “cautionary latency”). Quantitatively, the model’s CPT dictates that the conditional probability of the pilot executing the unsafe crossing (P (UCA_Pilot = Cross∣UCA_ATC = Error ∩ Comm_Accuracy = Accurate)) is mathematically higher than when communication is degraded, thus explicitly driving the collision probability up to 69%. This facilitates the efficient execution of an unsafe command rather than triggering a fail-safe verification delay.

To ensure the robustness of these generalizations regarding engineering versus administrative controls, an interaction analysis was conducted to evaluate potential synergistic effects. As demonstrated by Intervention C (Combined Synergy), when procedural compliance (communication) is paired with restored engineering infrastructure (surveillance), the model produces a further reduction in the aggregate risk (dropping to 73.0%). This interaction analysis refines the operational conclusion: administrative controls are not inherently ineffective; rather, their efficacy is highly conditionally dependent. In sensory-deprived environments, administrative controls cannot function as standalone primary barriers. However, when built upon the physical foundation of engineering controls (which restore objective feedback loops), they function synergistically to provide robust defense-in-depth.

5.3. Interpretation of Results

The sensitivity analysis yields two critical insights regarding the resilience and fault tolerance of the airport surface operation system:

The Limitations of Single-Point Technical Interventions: The implementation of a Ground Surveillance System (Intervention A) resulted in an absolute reduction in the catastrophic collision risk by 13% (driving a total risk reduction of 9%). While statistically significant, the residual risk remains substantially high at 77%. This suggests that, even with the augmentation of electronic surveillance, the severe environmental boundary conditions exert such a dominant influence that hardware solutions alone cannot fully compensate for the total loss of direct visual feedback.

The “Efficiency-Risk” Trade-off in Verbal Protocols: The analysis reveals a critical vulnerability in purely procedural barriers. Accurate communication eliminates ambiguity; however, in a system state dominated by Expectation Bias, this “efficiency” accelerates error propagation. This mirrors the ‘efficiency–thoroughness trade-off’ often observed in time-critical tasks [4]. The flight crew receives a clear, confident, but incorrect clearance, leading to a high-speed conflict rather than a tentative encroachment. This validates the STPA perspective that human-verification loops are brittle without independent physical interlocks to override cognitive failures.

6. Discussion

6.1. The Persistence of Cognitive Bias and the Communications Paradox

The quantitative results reveal a counterintuitive finding regarding the efficacy of communication protocols: the optimization of information flow (Intervention B) resulted in negligible risk mitigation (maintaining a total risk level of ~86%). This observation should not be construed as dismissing the criticality of standard phraseology; rather, it underscores the overwhelming dominance of Confirmation Bias within high-stress, low-visibility environments.

From an STPA perspective, when a controller formulates a rigid, albeit erroneous, internal Process Model (e.g., the conviction that the runway is clear), contradictory auditory cues are frequently filtered or reinterpreted to align with the pre-existing belief—a psychological mechanism characterized as “cognitive tunneling,” which is quantitatively reflected in our model by the ATC_SA node reaching an 86% posterior failure state. This finding is consistent with recent studies on man–machine phased missions [29], which highlight how cognitive errors tend to persist across operational phases. It also corroborates Reason’s Swiss Cheese Model, demonstrating that procedural barriers act as permeable defenses that are rendered ineffective when foundational physical or systemic constraints (e.g., direct visual acquisition) are compromised. Crucially, our model suggests that under these specific boundary conditions, accurate communication may paradoxically accelerate the execution of an unsafe plan. This should not be interpreted as a universal claim that accurate communication is harmful. Rather, it quantitatively demonstrates a structural vulnerability: when the UCA_ATC node generates a lethal instruction, high-fidelity communication merely ensures the unmitigated transmission of that error to the UCA_Pilot node. Consequently, under Instrument Meteorological Conditions (IMCs), the locus of safety assurance must shift from reliance on human procedural compliance to the enforcement of robust physical system constraints [35].

6.2. Technical Interventions: Necessity and Sufficiency

The sensitivity analysis elucidates the critical role of surveillance infrastructure. The simulated implementation of the ASDE-X system (Intervention A) reduced the posterior aggregate risk from 86% to 77%. This confirms that restoring the Air Traffic Controller’s situational awareness—effectively re-establishing the synthetic surveillance feedback loop—is a fundamental prerequisite for risk mitigation in low-visibility operations.

However, the residual risk (77%) remains notably higher than the baseline’s prior probability (71%) observed in the training dataset. This discrepancy suggests that while surveillance is a necessary condition, it is not a sufficient condition for total system safety. This highlights the need for a comprehensive selection of Risk Control Options (RCOs) that balances technological upgrades with cost–benefit considerations [17,18]. The persistence of residual risk is attributable to an information asymmetry within the network: while the radar intervention successfully mitigates failures in the ATC_SA node, the downstream Pilot_SA node remains severely degraded by the persistent Visibility root node. To address this deficiency and achieve multi-barrier redundancy, we advocate for the deployment of Runway Status Lights (RWSLs). Unlike surface radar, which relies on a centralized, human-mediated control loop (Sensor→Controller→Voice Command→Pilot), RWSL functions as a direct, decentralized interlock. By providing immediate, autonomous visual alerts (“STOP”) to pilots, RWSL effectively circumvents the processing latency and potential transmission errors inherent in the traditional ATC command channel.

6.3. Synergistic Value of the STPA-BN Framework

The outcomes of this study empirically validate the methodological synergy derived from integrating qualitative mechanism analysis with quantitative probabilistic assessment. The complementary value of this hybrid approach is demonstrated through two key dimensions:

Qualitative Structural Guidance: STPA demonstrated superior efficacy in identifying complex, non-linear Causal Factors—such as Expectation Bias and dysfunctional control interactions—that are frequently obscured in traditional linear models like Fault Trees. Furthermore, the Hierarchical Control Structure generated by STPA provided a physically grounded topology for the Bayesian Network, ensuring that the resulting graph reflected actual system physics rather than spurious correlations [19,36].

Quantitative Verification and Ranking: The BN component augmented this structural framework with the inferential capability necessary to prioritize risk factors [27]. Specifically, the probabilistic sensitivity analysis enabled the precise quantification of intervention efficacy, distinguishing the substantial impact of surveillance availability (9% risk reduction) from the negligible effect of communication fidelity (<1% reduction).

Furthermore, this study extends the scope of current hybrid safety methodologies. While previous STPA-BN integrations have successfully modeled autonomous maritime surface ships or automotive driver take-over scenarios, this study advances the framework into a highly coupled, multi-agent context. Unlike autonomous systems where risk often stems from single-agent sensing failures, or vehicle take-over models involving a localized human–machine handoff, the airport surface environment involves distributed control loops (ATC and Flight Crews) operating under information asymmetry. Our framework distinctly quantifies how a failure in one agent’s cognitive node propagates through shared procedural channels to another agent, demonstrating the necessity of decentralized interlocks over centralized procedural fixes.

To prevent the misinterpretation of these high probabilistic values (e.g., the 71% baseline or the 86% posterior) as absolute daily operational risk levels, it is crucial to emphasize the conditional domain of this framework. These metrics represent the conditional probability of incident escalation (i.e., severity) given that a safety-compromising precursor has already manifested and been flagged within the ASRS database. For operational decision-making, the utility of the 86% posterior does not lie in its absolute magnitude for setting daily safety-comfort thresholds, but rather in its comparative value (ΔP). Decision-makers should utilize this framework as a ‘conditional severity assessment tool’ to prioritize resource allocation based on relative risk reduction (e.g., the distinct 9% mitigation gap between technological and administrative interventions). Furthermore, recalibrating these conditional determinations to absolute nominal traffic risk—which is required for macroscopic safety management—would necessitate integrating the model’s outputs with overall airport base-rate exposure data (e.g., total annual traffic movements), presenting a vital avenue for future research expansion.

Consequently, this hybrid framework functions as a robust decision-support tool. The findings indicate that, within the context of current high-complexity operations, capital investment in hardware infrastructure (e.g., ASDE-X, RWSL) yields a significantly higher safety efficacy on investment (ROI) than reliance on administrative controls.

7. Conclusions

This study established a hybrid quantitative risk assessment framework integrating System-Theoretic Process Analysis (STPA) with Bayesian Networks (BNs) to address the complexity of airport surface operations. By constructing a formalized mapping mechanism (M1–M4) that translates STPA-identified Unsafe Control Actions (UCAs) into probabilistic network nodes, the proposed STPA-BN framework addresses the inherent limitations of employing purely qualitative hazard analysis methods in isolation. This methodological advantage is directly evidenced by the sensitivity analysis results (Section 4.2). While a traditional qualitative STPA identifies both administrative procedures (e.g., verbal communication compliance) and physical engineering safeguards (e.g., surveillance systems) as necessary safety constraints, it cannot evaluate their relative effectiveness under specific degraded conditions. By transforming these qualitative scenarios into a quantitative probabilistic model, our framework provided the critical distinction: restoring surveillance infrastructure reduced the simulated collision risk by approximately 13%, whereas improvements in communication compliance yielded a negligible risk reduction (Δ ≈ 0%) in sensory-deprived environments. By translating qualitative control flaws into measurable probabilistic impacts, the framework provides actionable, data-driven evidence for prioritizing safety interventions.

The application of this framework to the reconstruction of the 2023 Austin–Bergstrom International Airport incident offered critical insights into system resilience:

Quantification of Vulnerability: Diagnostic inference revealed that the confluence of low visibility and degraded surveillance creates a critical system vulnerability, escalating the posterior probability of a runway incursion to 86%. In this sensory-deprived state, the cognitive degradation of the Air Traffic Controller acts as the dominant failure propagation pathway.

Disparity in Safety Control Efficacy: Sensitivity analysis highlighted the structural limitations of traditional safety barriers. While the simulated restoration of surveillance radar reduced the aggregate risk to 77%, purely procedural interventions—such as enhanced communication compliance—yielded negligible risk reduction.

Implications for Safety Management: These findings suggest a necessary paradigm shift in managing high-density airport operations: under Instrument Meteorological Conditions (IMCs), the locus of safety assurance must shift from reliance on human procedural compliance (administrative controls) to the implementation of independent, sensor-based interlocks (engineering safeguards), such as Runway Status Lights (RWSLs).

Limitations and Future Work

While the proposed framework demonstrates robust diagnostic capabilities, certain limitations are acknowledged. First, the network parameters were quantified using a restricted dataset of 50 ASRS reports. This limited sample size introduces epistemic uncertainty, particularly regarding the estimation of rare event probabilities. Second, the current model relies on a static Bayesian Network. Future research will address these gaps by: (1) incorporating large-scale Natural Language Processing (NLP) techniques to mine global aviation safety databases, thereby refining the precision of prior probability distributions, and (2) evolving the framework into a Dynamic Bayesian Network (DBN) to enable real-time risk monitoring and time-slice analysis of evolving hazard scenarios.