Advanced Human Reliability Analysis Approach for Ship Convoy Operations via a Model of IDAC and DBN: A Case from Ice-Covered Waters

Abstract

The melting of Arctic ice has facilitated the successful navigation of merchant ships through the Arctic route, often requiring icebreakers for assistance. To reduce the risk of accidents between merchant vessels and icebreakers stemming from human errors during operations, this paper introduces an enhanced human reliability assessment approach. This method utilizes the Dynamic Bayesian Network (DBN) model, integrated with the information, decision, and action in crew context (IDAC) framework. First, a qualitative analysis of crew maneuvering behavior in scenarios involving a collision with the preceding vessel during icebreaker assistance is conducted using the IDAC model. Second, the D–S evidence theory and cloud models are integrated to process multi-source subjective data. Finally, the human error probability of crew members is quantified using the DBN. The research results indicate that during convoy operations, the maximum probability that the officer on watch (OOW) chooses an incorrect deceleration strategy is $8.259\times {10}^{-2}$ and the collision probability is $4.129\times {10}^{-3}$. Furthermore, this study also found that the factors of Team Effectiveness and Knowledge/Abilities during convoy operations have the greatest impact on collision occurrence. This research provides important guidance and recommendations for the safe navigation of merchant ships in the Arctic waters. By reducing human errors and adopting appropriate preventive measures, the risk of collisions between merchant ships and icebreakers can be significantly decreased.

1. Introduction

Since the beginning of the 21st century, global warming and the melting of sea ice in the Arctic have led to a rapid increase in the number of vessels passing through the region. The Northern Sea Route (NSR) is gradually becoming a crucial seaway connecting Asia and Europe. Due to natural conditions such as sea ice, Arctic navigation faces significant challenges and risks. Over the past decade, to avoid damage to merchant ships caused by sea ice, low-ice-class ships have had to navigate with the assistance of icebreakers. However, this also brings new risks, such as the risk of collisions between commercial vessels and icebreakers. Statistics show that collisions occurring during icebreaker assistance account for 95% of all collisions in Finnish waters [1]. The accident investigation report shows that the Arctic accident risk is mainly caused by human error [2]. In view of this, it is necessary to take human factors into account to carry out indepth research on the collision accidents between merchant ships and icebreakers in Arctic navigation, in order to reveal the root cause of human error.

1.1. The Risk of Ship Navigation in the Arctic

When merchant ships navigate in polar regions, they either navigate independently or require the assistance of icebreakers for navigation [3].

Vessels operating independently in ice-covered waters must be capable of conducting operations safely in icy conditions, necessitating a high level of ice class. These vessels typically operate in regions with relatively low sea ice concentration and thickness. However, due to the lack of infrastructure and the harsh marine environment in the Arctic waters, single-vessel operations may still face risks, such as contact with ice and besetting by ice, resulting from inadequate capabilities in ice conditions [4,5]. Scholars have begun to analyze or assess the risks of single-vessel ice navigation based on environmental data and accidents in the Arctic. For instance, an extensible data-driven prediction model was developed to evaluate the risks of Arctic navigation under uncertain weather and sea ice conditions [6]. Data-driven algorithms are employed to construct a model for predicting ship navigation accidents in Arctic waters [7]. The Dynamic Bayesian Network (DBN) model is utilized to investigate the risk of ship-ice collisions [8,9]. Additionally, some studies have identified own-ship risk factors by analyzing accidents to evaluate the risks associated with single-vessel operations [10].

During icebreaker assistance operations, a typical setup involves one icebreaker assisting several commercial vessels, forming a fleet. Compared to single-ship navigation, the risk of sea ice collisions damaging ships is reduced during icebreaker assistance. However, maintaining safe distances and speeds between ships is crucial to prevent collisions and ice entrapment. For instance, a multi-ship-following model is established, and an artificial potential energy field method is utilized to evaluate the risk [11]. An optimization method for ship-following navigation is developed with safety as a primary consideration [12]. Given the significant role of human error in ship collision accidents [13,14], it is essential to consider Human and Organizational Factors (HOFs) during icebreaker assistance. This includes using the Human Factors Analysis and Classification System (HFACS) model to identify HOFs in accidents [1] and integrating human response into the icebreaker assistance process [15]. To better understand the impact of human errors on navigational safety during icebreaker assistance in ice-covered waters, this paper systematically analyzes human reliability in this scenario. The analysis is based on the identification and quantification of human errors and their probabilities.

1.2. Human Reliability Analysis in Maritime Operations

In maritime operations, human reliability analysis (HRA) aims to predict the probability of operator errors in various scenarios. For instance, the Success Likelihood Index Method (SLIM) is used to calculate the probability of human error in ship bunkering operations [16]. Combining the SLIM with interval type-2 fuzzy set (IT2FS) is also used to analyze operator reliability in container ship loading operations [17]. Integrating the SLIM and the Evidential Reasoning (ER) method is used to conduct human factor reliability analysis for chemical ship cargo compartment cleaning operations [18]. A combination of the D–S evidence theory and the Human Error Assessment and Reduction Technique (HEART) is used to quantify human error rates in ship-to-ship LNG bunkering operations [19].

However, first-generation HRA methods like these have limitations, such as insufficient consideration of cognitive factors, difficulty in identifying the causes of errors, and unclear descriptions of the error occurrence process. Consequently, second-generation HRA methods have been applied in the maritime field, such as the Cognitive Reliability and Error Analysis Method (CREAM) [20]. For example, Bayesian Belief Networks (BBNs) and the ER-CREAM methodology are utilized to conduct an HRA on Maritime Autonomous Surface Ship (MASS) operators [21]. An optimized CREAM method and a Group Decision Making (GDM) approach are used together to analyze human-caused and non-human-caused accidents [22]. The CREAM is also employed to assess risk levels during MASS operations [23]. Furthermore, combining the CREAM with Bayesian Networks (BNs) is used to perform quantitative risk assessment (QRA) on LNG bunkering operations [24]. The CREAM and ER are integrated to quantify the probability of ship capsizing and navigation [25,26]. However, CREAM’s control mode struggles to describe dynamic problems and accurately depict the dynamic cognitive process of operators in complex environments.

With advancements in computer technology, simulation-based HRA methods have emerged, offering a more precise description of dynamic interaction between humans and machines in different scenarios. The information, decision, and action in crew context (IDAC) model is a notable example, establishing a detailed human cognitive model and providing a method to describe dynamic interaction between human behavior and situational environments [27,28,29,30,31]. The IDAC model includes more detailed Performance Influencing Factors (PIFs), enabling thorough descriptions of human behavior, accurate identification of human error types, causes of accidents, and detailed descriptions of incident processes. In conclusion, this study analyzes the complex dynamic interactions within the human-machine system during the icebreaker assisted navigation of merchant ships in polar environments using the IDAC model. It conducts a human reliability analysis of navigation personnel.

By identifying human errors that can potentially lead to collisions during icebreaker assistance operations in polar environments, this study establishes a DBN model to quantify these errors and analyze the main factors affecting collisions. The contents of this study are organized as follows: the second section establishes a new method applicable to the research scenario using IDAC and the DBN, the third section applies the advanced method to the research scenario, and the fourth section presents the experimental results. The fifth part discusses the research methods and experimental results. Finally, the sixth part concludes the paper.

2. Research Methodology

To dynamically assess human reliability during the assistance of merchant ships by icebreakers in the Arctic, an advanced method that combines the IDAC and DBN models is adopted. First, the IDAC model is used to identify potential human errors during the icebreaker assistance process. Based on these identified human errors, a DBN model of ship-to-ship collision is then established. Finally, human reliability in this scenario is evaluated. The steps of the method are illustrated in Figure 1.

The method comprises the following six steps:

Step 1: Conduct task analysis for seafarers in various positions and time periods, clarifying the cognitive function transformations of seafarers during operations and their impact on accident occurrence.

Step 2: Identify possible human errors at various time periods based on seafarers’ tasks. Establish the connection between crew cognitive behavior and PIFs provided by the IDAC model.

Step 3: Analyze how human errors can change the system state, potentially leading to accidents. Identify critical events in the accident evolution path through dynamic system analysis and determine the influence of human error on system state changes.

Step 4: Map the accident evolution process to a BN network. The network consists of three layers: the PIF layer, the Human Error (HE) layer, and the Critical Event Sequence (CES) layer.

Step 5: Use fuzzy set theory, Dempster-Shafer evidence theory (D–S evidence theory), and the Leaky Noisy–OR Gate model to process multi-source data and obtain the probabilities of nodes in the BN model. This provides the necessary data support for accurately evaluating human errors and system state changes.

Step 6: Identify dynamic nodes in the DBN model and design cloud model simulation experiments to obtain state transition probabilities. Construct the DBN to describe the evolution process from the cause to the result of the accident and obtain the probability of crew operational error.

2.1. System Task Analysis

The IDAC [27] model is used to analyze human-machine interaction in complex systems and consists of three parts: cognitive behavior, behavioral impact, and cognitive response. It divides the human cognitive process into three stages: information perception and preprocessing (I), decision making (D), and action (A). Additionally, individuals in complex systems are categorized into Decision Makers (ODMs), Consultants (OCTs), and Action Takers (OATs) based on their responsibilities. When analyzing system tasks, the system status may vary at different time points, with changes in system status potentially accompanied by changes in personnel roles and tasks. A change in roles implies a change in responsibilities. Therefore, it is necessary to identify and analyze human errors for different tasks at different times (Figure 2).

2.2. Human Error Identification and Analysis

The cognitive model constructed based on the IDAC framework analyzes crew tasks from three aspects—information perception and preprocessing, decision making, and action—to identify possible human errors in each task [28,32]. The occurrence of human errors is closely related to the contextual environment, and each human error is analyzed in correlation with its contextual environment to further clarify its causes.

In addition to providing a framework for describing human-environment interactions, the IDA model constructs a detailed and structured set of PIFs. The PIFs are designed as a pyramid structure, with layers representing the impact of the contextual environment on human cognition. Utilizing the PIF set developed by [31], the PIFs are divided into three levels. The top-level PIFs, which directly affect human cognition and have the highest priority and influence, are represented by P1-P9. The impact of PIFs is classified as positive (P) or negative (N), and the evaluation is conducted using a hierarchical classification and status evaluation table of PIFs (

Table 1. PIF classification and status evaluation.

Lowest	Middle	Highest	PIF Status Evaluation
	HIS Input	his (P1) 1	P/N
	HIS Output
	Procedure Quality	Procedures (P2) 2	P/N
	Procedure Availability
Tool Availability	Tools	Resources (P3) 3	P/N
Tool Quality
	Workplace Adequacy
Communication Availability and Communication Quality	Communication	Team Effectiveness (P4) 4	P/N
Leadership
Team Cohesion	Team Coordination
Role Awareness
Team Composition
Team Training
Task Training
	Knowledge/Experience/Skill (Content)	Knowledge/Abilities (P5) 5	P/N
Attention	Physical Abilities and Readiness
	Knowledge/Experience/Skill (Access)
Perceived Situation Urgency	Physical Abilities and Readiness	Bias (P6) 6	P/N
	Morale/Motivation/Attitude Safety Culture
	Confidence in Information
	Familiarity with or Recency of Situation
	Competing or Conflicting Goals
Perceived Situation Severity	Stress due to Situation Perception	Stress (P7) 7	P/N
Inherent Cognitive Complexity	Stress due to Decision
Cognitive Complexity due to External Factors	Cognitive Complexity	Task Load (P8) 8	P/N
Inherent Execution Complexity
Execution Complexity due to External Factors	Execution Complexity
	Extra Work Load
	Passive Information Load
		Time Constraint (P9) 9	P/N

¹ Human System Interface (HSI): interaction between the crew and the system; ² Procedures: availability and quality of clear progressive instructions required for the crew to perform the task; ³ Resources: availability and adequacy of required resources; ⁴ Team Effectiveness: the degree of coordination and synchronization of the crew’s contributions to the overall objectives and tasks of the team; ⁵ Knowledge/Abilities: the adequacy of the knowledge and ability of the crew; ⁶ Bias: the crew tends to make decisions or draw conclusions based on the selected information while excluding information that is inconsistent with the decision or conclusion; ⁷ Stress: tension/pressure resulting from the crew’s perception of the situation or their awareness of the consequences and responsibilities; ⁸ Task Load: the workload imposed on the crew within a given time frame, arising from the complexity, quantity, significance, and accuracy requirements of the tasks they are confronted with; ⁹ Time Constraint: whether the crew has enough time available to complete the task at hand.

).

Based on the task analysis in Section 2.1, human errors are identified from three aspects: I, D, and A. Subsequently, the PIFs that are likely to impact the identified human errors are selected, and a PIF-HE influence diagram (Figure 3) is constructed.

2.3. PIF-HE Influence Diagram

An accident scenario is a collection of a series of events. Therefore, it is necessary to clarify the critical event sequence (CES) during the occurrence of the accident and establish a logical relationship between human error and critical events. Based on system task analysis and the identification of human error, the critical event sequence leading to the accident can be determined. A dynamic event tree (DET) can then be constructed. Utilizing the IDAC model, the development process of critical events is divided into three stages, with the breach of the safety barrier (BSB) identified as a critical event (

Table 2. Description of accident occurrence paths.

Each Phase before the Accident	The First Phase			The Second Phase			The Third Phase
Main tasks of the crew	ODM needs to find anomalies in time and make correct decisions			OCT did not remind or give wrong advice, or ODM still made a mistake in the second decision			OAT executes instructions correctly
Start-End	Time0–Time3			Time3–Time6			Time6–Time9
Critical event	BSB1			BSB2			BSB3
	I of ODM	D of ODM	A of ODM	I of OCT	D of OCT	A of OCT	I of OAT	D of OAT	A of OAT
Judgment time	Time1	Time2	Time3	Tim4	Time5	Time6	Time7	Time8	Time9

).

In Table 2, the information perception and preprocessing (I), decision-making (D), and action execution (A) stages of the Decision Maker (ODM), Consultant (OCT), and Action Taker (OAT) serve as the three components of the cognitive model for key crew members. These stages are also considered as critical events. Time1 to Time9 define the boundaries of the analysis periods, which solely serve to support the dynamic analysis of the cognitive processes of the team members. They do not represent specific time points of anomaly occurrences; hence, no time unit is associated with them. Each type of human error can lead to a breach of safety barriers, which are identified as critical events. To establish the relationship between human errors and critical events, a combination of Fault Tree Analysis (FTA) and dynamic event tree (DET) is adopted, visually demonstrating the association between human errors and critical events (Figure 4).

2.4. Accident Evolution Mapping Based on BN

The Bayesian Network (BN) is well suited for describing the uncertainties and probabilistic issues in accident evolution. Therefore, a multi-level BN model including PIF, HE andCES is established to describe the accident evolution process. The mapping algorithm between adjacent parts comprises two components: structural mapping and probability mapping (

Table 3. Model mapping.

Model Node	Evolution Analysis	Structure Mapping	Probability Mapping
PIF–HE			$Pr\left(P_n\right)$ $Pr\left(\right(I_n/P_n)$ $Pr\left(\right(D_n/P_n)$ $Pr\left(\right(A_n/P_n)$
HE–CES			$Pr({BSB}_1/I_{OOW})$ $Pr({BSB}_1/D_{OOW})$ $Pr({BSB}_1/A_{OOW})$ $Pr(I_{OOW}/IHE)$ $Pr(D_{OOW}/DHE)$ $Pr(D_{OOW}/I_{OOW})$ $Pr(A_{OOW}/I_{OOW})$
CES			$Pr(A_{OOW}/D_{OOW})$ $Pr(A_{OOW}/AHE)$ $Pr(T/{BSB}_1)$ $Pr(T/{BSB}_2)$ $Pr(T/{BSB}_3)$

) [33].

2.5. The Acquisition of Node Probabilities

2.5.1. Data Preprocessing

Given the insufficiency of prior knowledge, expert scoring is used as the core data source in this study. To address the inherent ambiguity and uncertainty of natural language, fuzzy set theory is introduced as the analytical framework. Fuzzy set theory extends classical binary logic by quantifying the degree of an element belonging to a set as a continuous value within the interval [0,1] [34]. Multi-source data cannot be effectively synthesized by using fuzzy set theory. In order to solve the problem of uncertainty caused by the differences and limitations of different expert knowledge, D–S evidence theory is introduced [19,35]. Merging the BPA of different experts’ knowledge aims to reduce the uncertainty of subjective data. The core elements of D–S evidence theory include the Basic Probability Assignment (BPA) function, which must satisfy specific constraints, along with two important concepts derived from it: Belief (Bel) and Plausibility (Pl). These constraints are expressed as

$$m\left(A\right)\to [0,1];m(\varnothing )=0;{\sum }_{A\subseteq \Omega }m(A_i)=1,$$

(1)

where Ω represents a comprehensive frame of discernment, encompassing a complete and mutually exclusive set of events. Assuming A is one of these events, its Basic Probability Assignment (BPA) is denoted as m(A), satisfying the condition that the sum of the BPAs of all events in Ω equals 1, and the BPA of the empty set ∅ is 0. $A_i$ represents event i within Ω.

The specific steps for data preprocessing are as follows:

(1) Establish the association rules between semantics and triangular fuzzy numbers $\tilde{U}\left(x\right)=(a, m, b)$, where different semantics represent different levels of membership.

(2) $\tilde{U}\left(x\right)=(a, m, b)$ consists of three parameters: a, m, and b. Among them, a and b represent the lower and upper bounds of the fuzzy number, while m represents the most probable value of the fuzzy number. To obtain the true semantic value (F), defuzzification is performed according to Equation (2), followed by normalization:

$$F={\displaystyle \frac{a+2m+b}{4}}.$$

(2)

(3) Based on the definitions of D–S evidence theory, calculate the Bel and Pl values for each piece of evidence using the following equations:

$$\mathit{Bel}\left(A\right)={\sum }_{B\in A}{m}_B,$$

(3)

$$\mathit{Pl}\left(A\right)={\sum }_{B\cap A\ne \varnothing }{m}_B,$$

(4)

where Bel(A) is the sum of the BPAs of all subsets B of A, and Pl(A) is the sum of the BPAs of all sets B that intersect with A nontrivially.

(4) Combine data from different input sources using the combination rules of the D–S evidence theory [35] to obtain the overall credibility under the combined effect of various data:

$$m(A)=\left\{\begin{array}{c}\begin{array}{cc}{\displaystyle \frac{{\sum }_{\cap A_i=A}{\prod }_{1\le i\le n}{m}_i\left(A_i\right)}{1-K}}& A\ne \varnothing \end{array}\\ \begin{array}{cc}0& A=\varnothing \end{array}\end{array}\right.$$

(5)

where K represents the level of conflict between pieces of evidence, $K={\sum }_{\cap A_i=\varnothing }{\prod }_{1\le i\le n}\left(A_i\right), \mathrm{and}0\le K\le 1$.

2.5.2. Acquisition of Conditional Probability Table

In complex BN, acquiring conditional probability tables (CPTs) can be challenging due to the numerous intermediate nodes. To address this issue, the Leaky Noisy–OR Gate model is introduced, which extends the Noisy–OR model by incorporating latent nodes $x_l$ to represent unaccounted for random and secondary factors’ CPTs [36,37].

It is assumed that in the Leaky Noisy–OR Gate model, node Y has only two parent nodes, namely $x_i$ and $x_{\mathit{all}}$, where $x_{\mathit{all}}$ represents all other nodes except $x_i$, with corresponding conditional probabilities $P_i$ and $P_{\mathit{all}}$, which can be derived as follows:

$$P(Y/x_i)=P_i+P_{\mathit{all}}-P_{\mathit{all}}{P}_i,$$

(6)

$$P(Y/\overline{x_i})=P_{\mathit{all}}$$

(7)

By combining Equations (6) and (7), the connection probability $P_i$ between node Y and all its parent nodes can be obtained:

$$P_i={\displaystyle \frac{P\left(Y|x_i\right)-P(Y/\overline{x_i})}{1-P(Y/\overline{x_i})}}.$$

(8)

All unaccounted for factors are consolidated into an unknown factor $x_l$, with a connection probability of $P_l$. The CPT of node Y can be derived based on

$$P\left(Y\right)=1-(1-P_l){\prod }_{i; x_i\in x_p}\left(1-P_i\right).$$

(9)

2.6. Description of Accident Evolution Based on DBN

In accident evolution, ignoring the impact of the time dimension on system state changes results in an incomplete description of the process. Therefore, introducing a DBN is necessary, enabling each time slice to be a static BN, and updating network parameters of subsequent time slices based on previous time-slice data [38,39]. This section consists of two parts: the determination of dynamic nodes in the DBN and the acquisition of state transition probabilities.

2.6.1. Determination of Dynamic Nodes in DBN

The BN model consists of three layers: the PIF layer (green), the HE layer (blue), and the CES layer (red), each containing several nodes. Based on interaction patterns among team members provided by the IDAC model, human errors are identified. Considering that the state of human errors is influenced only by factors related to the current or previous moment, aligning with the first-order Markov assumption, state transition probabilities quantify the self-correction ability of team members. Thus, human errors in the HE layer are treated as dynamic nodes, resulting in a multi-level, including PIF, HE and CES, DBN model.

2.6.2. Acquisition of Node State Transition Probabilities

The direct acquisition of state transition probabilities within a DBN model through D–S evidence theory often encounters significant uncertainty. To address this issue, incorporating the establishment of simulation experiments based on cloud models can effectively transform subjective data into objective data, which in turn enables the derivation of state transition probabilities from these more reliable, objective data. The core parameters of the cloud model include the expected value (Ex), entropy (En), and hyperentropy (He). Ex indicates the center position of the cloud droplets, En represents uncertainty, and He characterizes the degree of entropy dispersion and the thickness of cloud droplets [40]. The experimental design follows the steps below:

(1) Defuzzify the data from different experts to obtain the true semantic values.

(2) Based on the true semantic value, calculate the average (Ave), belief (Bel), and plausibility (Pl) of the expert opinions for the node states.

(3) Use Ave, Bel, and Pl as the three necessary parameters Ex, En, and He for the cloud model. Establish cloud models for different states of the required nodes, determine the number of cloud droplets (j), and generate them using the normal cloud model generator:

$$N(n_1,n_2,\cdots n_k)=\mathit{Gnc}(\mathit{Ex}, \mathit{En}, \mathit{He}, j).$$

(10)

(4) Determine the simulation time t. At each time instant, randomly extract a cloud droplet from the cloud models of different states of the same node. Calculate the membership degree (μ) of the cloud droplet using the normal cloud model membership function.

$$\mu =\mathit{exp}\{-{\displaystyle \frac{{(x-\mathit{Ex})}^2}{(2\mathit{En}{)}^2}}\}.$$

(11)

The state of the cloud droplet with the larger membership degree is taken as the node state. Perform repeated calculations to obtain the state transition set within the time t.

(5) Derive the state transition probability through statistical analysis of the state transition set.

3. Quantification of Human Error Probability in Arctic Ship Formations

According to Section 1.1, merchant ships navigating in polar regions have two options: independent navigation, which is suitable for areas with lighter ice conditions and relies on the ship’s own ice-resistant capabilities, or navigation with the assistance of icebreakers for more challenging ice conditions. In the latter case, precise control of ship spacing and speed is essential to avoid collisions and ice entrapment. This involves five specific operations (Figure 5) [3]:

(1) Escort: The icebreaker breaks the ice, and the commercial vessel follows at a certain distance.

(2) Convoy: Similar to Escort, but with one icebreaker guiding multiple commercial vessels.

(3) Towing: When the commercial vessel cannot follow the icebreaker due to excessive ice pressure or a large amount of snow and muddy ice, it needs to be towed.

(4) Double convoy: One icebreaker proceeds ahead of another to assist in guiding a wider range of vessels.

(5) Cutting loose: When the commercial vessel becomes trapped in ice, the icebreaker breaks the ice to relieve the pressure.

The primary difference between Escort and Convoy operations lies in the number of merchant ships assisted, both of which have a high risk of collision [41]. Therefore, this study focuses on Convoy operations where icebreakers and merchant ships must collaborate closely to ensure safety. As environmental conditions deteriorate, transitioning from independent navigation to Convoy operations involves an increase in crew numbers and changes in crew tasks. Thus, analyzing the human reliability of ship-to-ship collisions in Convoy operations is crucial.

3.1. Task Analysis of Convoy Operations

During Convoy operations, maintaining an appropriate distance from the preceding ship is crucial for safety. To achieve this, convoy navigation tasks undertaken by different crew members must be decomposed (

Table 4. Decomposition diagram of formation navigation.

Main Objective	Main Members	Specific Task	Task Time Range
Convoy operations	Officer on Watch (OOW)	Execute icebreaker vessel instructions	Time1~20
		Radar monitoring	Time1~20
		Regular lookout	Time1~20
		Issuing instructions to the duty seaman	Time1~20
		Maintain attention on VHF	Time1~20
		Positioning and navigating the vessel	Time1~20
		Display appropriate signal light code	Time1~20
	Quarter Master (QM)	Carrying out tasks assigned by the IP	Time2~20
		Maintaining the set course and acknowledging orders	Time4~20
		Assisting the OOW with lookout and communicating information	Time4~20
	Ice Pilot (IP)	Execute normal vessel icebreaking navigation tasks	Time1~20
		Issue formation navigation instructions to the assisted vessel	Time2~20

).

In Table 4, the main objective of main members involved in Convoy operations is to safely execute the Convoy operations. This encompasses a diverse range of key crew members, including the OOW, QM, and IP, each of whom holds distinct responsibilities throughout the operational process. The duration of these individual tasks varies, contingent upon a range of triggering conditions that render the time frames inherently uncertain. The notation of Time1–Time20 is solely employed for analytical purposes and does not signify any specific unit of time.

3.2. Identification of Human Error Based on IDAC

Using the IDAC model, the crew’s tasks are analyzed in terms of information perception (I), decision making (D), and action (A), identifying 20 human errors (I1–I9, D1–D7, A1–A4) related to ship-to-ship collisions. The occurrence of human errors is influenced by PIFs. To construct a BN, the associations between PIFs and human errors (

Table 5. Relationship between PIFs and human errors.

Human Error		P1	P2	P3	P4	P5	P6	P7	P8	P9
IHE	Inadequate radar surveillance frequency (I1)	Yes		Yes	Yes		Yes			Yes
	Incomplete radar information acquisition (I2)	Yes				Yes			Yes	Yes
	Inadequate frequency of VHF monitoring (I3)	Yes		Yes	Yes		Yes			Yes
	Incomplete VHF information acquisition (I4)	Yes				Yes			Yes
	Inadequate frequency of lookout (I5)				Yes		Yes	Yes	Yes
	Intentional failure to acquire relevant information (I6)						Yes	Yes	Yes	Yes
	Successful information acquisition but no response (I7)		Yes				Yes	Yes	Yes	Yes
	QM fails to assist in lookout at appropriate frequency (I8)		Yes				Yes		Yes	Yes
	IP fails to timely monitor the situation of fleet vessels (I9)		Yes					Yes	Yes	Yes
DHE	OOW error in judging system status (D1)					Yes	Yes	Yes	Yes
	OOW decides to delay deceleration operation (D2)				Yes	Yes	Yes	Yes
	OOW chooses incorrect deceleration strategy (D3)					Yes		Yes		Yes
	QM error in judging system status (D4)					Yes		Yes	Yes
	QM decides to delay reminder operation (D5)				Yes		Yes	Yes	Yes
	IP error in judging system status (D6)				Yes	Yes		Yes	Yes
	IP decides to delay reminder operation (D7)				Yes	Yes	Yes	Yes	Yes
AHE	Misinterpretation of IP or OOW instructions (A1)				Yes	Yes				Yes
	QM error in setting course (A2)				Yes	Yes			Yes	Yes
	Error in conveying IP instructions (A3)				Yes	Yes		Yes	Yes
	Instruction operated incorrectly (A4)				Yes	Yes		Yes

) were established, where “Yes” indicates that the corresponding PIF may affect the corresponding error.

3.3. Analysis of Accident Occurrence Paths

To analyze convoy navigation tasks, a DET (Figure 6) was therefore constructed to visually demonstrate the influence of different crew members on the occurrence of collisions prior to impact.

In the DET analysis, the critical starting point is when the distance between the icebreaker and the assisted ship decreases to a point where necessary actions must be taken. Based on this analysis, three critical time points are identified: Time1 (when the OOW determines whether to enter the deceleration process), Time4 (when the IP or QM reminds the OOW to enter the deceleration process), and Time7 (when the actual deceleration operation is executed). These three time points divide the entire process into three stages, with specific team members responsible for preventing collisions at each stage. Consequently, three safety barriers are formed: Safety Barrier 1, Safety Barrier 2, and Safety Barrier 3.

Stage 1: The decision-making period for the OOW, with possible errors including I1 to I7 and D1 to D3.

Stage 2: The period when the IP or QM reminds the OOW to act, with possible errors including I8 and I9, D4 to D7, and A1 to A3.

Stage 3: The period when the crew receives instructions and takes deceleration actions, with possible errors including A4.

Based on this analysis, Time1, Time4, and Time7 are identified as the critical time points for assessing the breach of safety barriers (BSB₁–BSB₃). Given the direct connections among BSB₁–BSB₃ nodes, the introduction of intermediate nodes M1, M2, and M3 separately indicates that errors occur in OOW in the first stage, QM and IP in the second stage, and QM in the third stage. FTA is employed to elaborate on the relationship between BSB₁, BSB₂, and human errors, as well as the logical connection between accidents (T) and the occurrence of BSB (see Figure 7). Stage 3 solely involves error A4, whose occurrence signifies the occurrence of BSB₃.

3.4. Mapping of Accident Evolution Based on BN

The BN model architecture is structured into three layers: the PIF layer, the HE layer, and the CES layer. The PIF layer serves as the set of root nodes (P1 to P9), each of which can exist in two states: N and P. The HE layer encompasses human errors, while the CES layer designates all factors except for ship-to-ship collision T as intermediate nodes, with T serving as the leaf node indicating the ultimate ship-to-ship collision event. Both intermediate and leaf nodes are assigned YES/NO states to represent whether the event occurs or not. The BN model structure is constructed based on the mapping rules.

3.5. Acquisition of Node Probabilities

The data were sourced from four experts with long-term experience in polar navigation. They provided ratings based on the association rules between semantics and triangular fuzzy numbers, as shown in

Table 6. Language variables and corresponding triangular fuzzy numbers.

Root Nodes (P1–P6)	Intermediate Nodes	TFN (l, m, i)	Root Nodes (P7–P9)	TFN (l, m, i) 1
Very High (VH)	Very High (VH)	(0.8, 0.9, 1)	Very High (VH)	(0.7, 0.8, 1)
High (H)	High (H)	(0.6, 0.7, 0.9)	High (H)	(0.3, 0.5, 0.8)
Medium (M)	Medium (M)	(0.4, 0.5, 0.7)	Medium (M)	(0, 0.2, 0.5)
Low (L)	Low (L)	(0.2, 0.3, 0.5)	Low (L)	(0.3, 0.5, 0.8)
Very Low (VL)	Very Low (VL)	(0, 0.1, 0.3)	Very Low (VL)	(0.7, 0.8, 1)

¹ Triangular Fuzzy Number (TFN).

.

According to the method described in Section 2.5.2, the fuzzy set theory is used to defuzzify and obtain true semantic values, and the D–S evidence theory is applied to combine the opinions of four experts (H1–H4), allowing for the direct calculation of the prior probability values of the root nodes, as shown in

Table 7. Root node prior probability values.

Root Note	H1	H2	H3	H4	Pro(P)
P1	M	VH	VH	H	0.9958
P2	M	H	VH	H	0.9857
P3	M	H	VH	M	0.9667
P4	H	VH	VH	H	0.9982
P5	H	H	VH	H	0.9940
Root Note	H1	H2	H3	H4	Pro(N)
P6	VL	VL	VH	M	0.1688
P7	VH	H	VH	H	0.9645
P8	VH	VH	VH	H	0.9914
P9	VH	H	VH	H	0.9645

.

In Table 7, H1–H4 represent the data provided by four experts, respectively. The impact of PIFs on HE is divided into two states, P and N. Pro(N)/Pro(P) represents the prior probability value of the root node being in a negative/positive state. The last column (Pro(Y)/Pro(N)) represents the prior probability of the root node being in the P/N state calculated by the D–S evidence theory.

Due to the large number of intermediate nodes, it is not possible to perfect the CPT of all intermediate nodes solely through mapping algorithms. Therefore, for some intermediate nodes (all nodes in the HE layer), the CPT needs to be perfected according to the method described in Section 2.5.2. The intermediate nodes in the CES layer can be perfected through the mapping algorithm described in Section 2.4. Taking the intermediate node I6 as an example, this section utilizes the D–S evidence theory to obtain the state probabilities of node I6 under different states of the root node (

Table 8. Comprehensive fuzzy relationship.

$({\mathsf{\mu }}_{{\mathbf{x}}_{\mathbf{N}}}^{{\mathbf{y}}_{\mathbf{Y}}}/{\mathsf{\mu }}_{{\mathbf{x}}_{\mathbf{P}}}^{{\mathbf{y}}_{\mathbf{Y}}})$ 1	$({\mathsf{\mu }}_{{\mathbf{P}6}_{\mathbf{N}}}^{\mathbf{I}{6}_{\mathbf{Y}}}/{\mathsf{\mu }}_{{\mathbf{P}6}_{\mathbf{P}}}^{\mathbf{I}{6}_{\mathbf{Y}}})$	$({\mathsf{\mu }}_{{\mathbf{P}7}_{\mathbf{N}}}^{\mathbf{I}{6}_{\mathbf{Y}}}/{\mathsf{\mu }}_{{\mathbf{P}7}_{\mathbf{P}}}^{\mathbf{I}{6}_{\mathbf{Y}}})$	$({\mathsf{\mu }}_{{\mathbf{P}8}_{\mathbf{N}}}^{\mathbf{I}{6}_{\mathbf{Y}}}/{\mathsf{\mu }}_{{\mathbf{P}8}_{\mathbf{P}}}^{\mathbf{I}{6}_{\mathbf{Y}}})$	$({\mathsf{\mu }}_{{\mathbf{P}9}_{\mathbf{N}}}^{\mathbf{I}{6}_{\mathbf{Y}}}/{\mathsf{\mu }}_{{\mathbf{P}9}_{\mathbf{P}}}^{\mathbf{I}{6}_{\mathbf{Y}}})$
H1	(VL/VL)	(VL/VL)	(VL/VL)	(VL/VL)
H2	(L/VL)	(L/VL)	(M/L)	(L/VL)
H3	(M/L)	(M/L)	(M/L)	(M/L)
H4	(M/L)	(L/VL)	(M/L)	(L/VL)
D–S	(0.0775/0.0047)	(0.0353/0.0014)	(0.0167/0.0157)	(0.0353/0.0014)

¹ ${\mathbf{\mu }}_{{\mathbf{x}}_{\mathbf{N}}}^{{\mathbf{y}}_{\mathbf{Y}}}$ represents the expert’s evaluation of the probability that the intermediate node y is in the state of Yes when the root node x is in the state of N, and ${\mathbf{\mu }}_{{\mathbf{x}}_{\mathbf{P}}}^{{\mathbf{y}}_{\mathbf{Y}}}$ represents the expert’s evaluation of the probability that the intermediate node y is in the state of Yes when the root node x is in the state of P.

).

The connection probability between the root node and I6 is calculated as shown in

Table 9. Node connection probability of I6.

I6	P6 (N)	P7 (N)	P8 (N)	P9 (N)
YES	0.0731	0.0340	0.1483	0.0340
NO	0.9269	0.966	0.8517	0.966

.

The omitted factor ${\mathrm{x}}_{\mathrm{l}}$ is considered. Assuming the parameter for the omitted factor ${\mathrm{P}}_{\mathrm{l}}$ = 0.00231 [42], the conditional probability of I6 is corrected based on the Leaky Noisy–OR Gate model, as shown in

Table 10. Conditional probability table of Node I6.

P6	P7	P8	P9	I6 (YES)
N	N	N	N	0.2650
N	N	N	P	0.2392
N	N	P	N	0.1371
N	N	P	P	0.1067
N	P	N	N	0.2392
N	P	N	P	0.2124
N	P	P	N	0.1067
N	P	P	P	0.0752
P	N	N	N	0.2071
P	N	N	P	0.1792
P	N	P	N	0.0690
P	N	P	P	0.0362
P	P	N	N	0.1792
P	P	N	P	0.1503
P	P	P	N	0.0362
P	P	P	P	0.0023

. Similarly, the CPTs of intermediate nodes I1–I9, D1–D7, and A1–A4 can be perfected using this method.

3.6. Description of Collision Evolution

3.6.1. Identification of Dynamic Nodes in DBN

To construct the accident evolution model based on the DBN, it is necessary to define the dynamic nodes and obtain their state transition probabilities. According to Section 2.6, the PIF nodes (P1–P9) are designated as static. In contrast, based on Section 3.2, HEs (I1–I9, D1–D7, A1–A4) are considered dynamic. Furthermore, it is essential to quantify the state transition probabilities of each dynamic node to evaluate the self-correction capabilities of crew members in response to errors.

3.6.2. HEs State Transition Probabilities Acquisition

Based on the analytical framework presented in Section 3.1, crew errors are categorized into two major groups according to their responsibilities. The merchant ship OOW, serving as the ODM, is grouped into one category, while the remaining personnel, including the IP and QM, are classified into another group due to the phased nature of their responsibilities. The state of errors is categorized using a binary classification method, defining them as Y1 (occurred) and Y2 (not occurred). Introducing (Y1, Y2) represents uncertainty, reflecting the ambiguity in crew members’ perceptions of error states. Subsequently, expert data undergo defuzzification and normalization processes to ensure the accuracy and consistency of evaluation data (

Table 11. Evaluation data and normalization.

Crew	Error State	H1	H2	H3	H4	T1	T2	T3	T4
OOW	Y1	L	VL	M	L	0.2766	0.1064	0.3333	0.2364
	Y2	L	L	M	M	0.2766	0.2766	0.3333	0.3818
	(Y1, Y2)	M	H	M	M	0.4468	0.6170	0.3333	0.3818
Others	Y1	L	VL	M	L	0.2766	0.1064	0.3333	0.2063
	Y2	L	L	M	M	0.2766	0.2766	0.3333	0.3333
	(Y1, Y2)	M	H	M	H	0.4468	0.6170	0.3333	0.4603

). In Table 11, T1–T4 represent the true values of each expert’s evaluation data after being calculated from H1–H4.

Using the method described in Section 2.6.2, the state cloud parameters (Ex, Bel, Pl) for different personnel errors are calculated, resulting in the cloud model parameter table (

Table 12. Cloud model parameters.

Crew	Status Cloud	$\mathit{E}\mathit{x}$	$\mathit{B}\mathit{e}\mathit{l}$	$\mathit{P}\mathit{l}$
OOW	Y1	0.2382	0.1956	0.2336
	Y2	0.3171	0.3159	0.3539
Others	Y1	0.2307	0.2037	0.2489
	Y2	0.3050	0.3208	0.3661

). The state transition probabilities of errors for the two types of crew members are then calculated separately.

Taking the OOW of a merchant ship as an example, state cloud diagrams for errors (Figure 8a) and non-errors (Figure 8b) are generated, each containing 1000 cloud droplets. The degree of membership is then randomly sampled and compared 1000 times. This process generates a set of node state transitions for 1000-time segments. A line chart illustrating the state transitions for the first 60-time segments is plotted (Figure 8c).

The node state transition set is statistically processed to obtain the error state transition matrix $P_{\mathrm{OOW}}$ for merchant ship navigators:

$$P_{\mathrm{OOW}}=\left[\begin{array}{cc}{P}_{11}& P_{12}\\ P_{21}& P_{22}\end{array}\right]=\left[\begin{array}{cc}0.3838& 0.6162\\ 0.3847& 0.6153\end{array}\right].$$

(12)

Similarly, the error state transition matrix for other personnel ($P_O$) can be obtained:

$$P_O=\left[\begin{array}{cc}{P}_{11}& P_{12}\\ P_{21}& P_{22}\end{array}\right]=\left[\begin{array}{cc}0.4059& 0.5941\\ 0.4119& 0.5881\end{array}\right].$$

(13)

The required parameters for the DBN model are obtained based on the above methods. The experimental time slice is set to 20, taking Time1 as the initial analysis point. Considering that Convoy operations have just started at Time1 and no errors have occurred in OOW, and according to the description of human cognitive processes in the IDAC model, IHE, DHE, and AHE occur sequentially. Therefore, the “I of OOW” status at Time1 is “N”; similarly, the “D of OOW” status at Time1 and Time2 is “N”, and the “A of OOW” status at Time1–Time3 is “N”. Subsequently, indepth analysis is conducted in the second and third stages, and the parameters are input into the DBN model. The DBN structure diagrams of Event M1 (Figure 9a) and Event M2 (Figure 9b) are drawn, respectively. Finally, by integrating the results of each stage, a complete DBN model is constructed.

4. Model Validation and Experimental Results

4.1. Model Validation and Experimental Results

To ensure the rationality and consistency of the established DBN, a sensitivity analysis was conducted from a theoretical perspective. The DBN model must satisfy the following axioms [43,44,45]:

Axiom 1: An increase or decrease in the prior probability of a parent node should result in a corresponding increase or decrease in the posterior probability of a child node.

Axiom 2: Different growth rates in the prior probability of a parent node should have a consistent effect on the child node.

Axiom 3: The combined effect of multiple parent nodes is greater than the effect of a single parent node.

Node I6 was selected for verification; it has four parent nodes: P6, P7, P8, and P9.

To test Axiom 1, the prior probability of P8 being in state N was set to 0% and 100%, respectively, and the resulting changes in the probability of I6 were observed (Figure 10a).

For Axiom 2, the prior probability of P7 being in state P was incrementally increased by 20% each time until it reached 100%. The changes in the probability of I6 were observed at each increment (Figure 10b).

To verify Axiom 3, parent nodes P8 and P9 were selected. First, the probability of P8 being in state N was changed to 100%. The probabilities of both P8 and P9 being in state N were then simultaneously changed to 100%, and the changes in the probability of I6 were observed (Figure 10c).

Figure 10 demonstrates the probability of I6 being in state Y over time. Figure 10a shows that the initial probability of I6 is 21.37%, stabilizing at 32.31%. When the probability of P8 being in state N is adjusted to 0 or 100%, the initial value of I6 changes to 7.82% or 21.49%, stabilizing at 14.43% or 32.47%, respectively, confirming Axiom 1. Figure 10b shows that as the probability of P7 being in state P gradually increases to 0.3355, 0.6355, and 0.9355, the initial values of I6 being in state “yes” are 20.54%, 19.71%, and 18.88%, respectively, while the respective stable values are 32.28%, 30.25%, and 29.22%. This consistency with Axiom 2 demonstrates that the increase in the prior probability of P7 consistently affects I6. Figure 10c illustrates that when the probability of P8 being in state N rises to 100%, the initial value of I6 decreases to 8.34%, and the stable value reaches 7.82%. When both P8 and P9 are in state N, the initial value drops to 4.69%, and the stable value reaches 9.90%. This confirms that the combined effect of P8 and P9 is greater than the individual effect of P8, in accordance with Axiom 3.

4.2. Risk Probability Assessment

Using the established DBN model, the inference process of GeNle software (genie-academic-setup-4.1.4109), which is freely available for academic research from BayesFusion, LLC (Pittsburgh, PA, USA), https://www.bayesfusion.com/ (accessed on 25 January 2024), was employed to obtain probability data of various intermediate and leaf nodes varying over time (Figure 11).

Figure 11a depicts the variation of collision probability over time. The collision probability is 0 at the initial time points 1 to 7 due to the transmission time from human errors to collision. From time point 8 onward, the collision probability gradually increases with increasing sailing time and stabilizes at approximately $4.129\times {10}^{-3}$.

Figure 11b presents a bar chart of the stable values of human error probabilities, all below 10%. The top five errors, in descending order of probability, are “OOW chooses incorrect deceleration strategy” (D3) with a probability of $8.259\times {10}^{-2}$, “OOW error in judging system status” (D1) at $6.166\times {10}^{-2}$, “OOW decides to delay deceleration operation” (D2) at $6.123\times {10}^{-2}$, “Misinterpretation of IP or OOW instructions” (A1) at $5.424\times {10}^{-2}$, and “QM error in setting course” (A2) at $4.680\times {10}^{-2}$. The complete order from highest to lowest is D3 < D1 < D2 < A1 < A2 < I8 < I9 < A4 < I7 < D7 < D5 < I6 < A3 < I1 < D6 < D4 < I3 < I5 < I2 < I4.

4.3. Identification of Key Nodes

To identify the key root nodes of collision, the collision probability is set at 100%, and reverse reasoning is used. To this end, the absolute value of the Ratio of Variation (ROV) is calculated based on the prior ($\mathsf{\pi }\left(x_i\right))$ and posterior ($\theta \left(x_i\right)$) probabilities [46,47], where a higher ROV value indicates a more critical root node:

$$V_{ROV}(x_i)={\displaystyle \frac{/\theta \left(x_i\right)-\mathsf{\pi }\left(x_i\right)/}{\mathsf{\pi }(x_i)}}.$$

(14)

After calculating the ROV values for each root node, an ROV curve is plotted in Figure 12.

Among the root nodes, the ROV value of P4 (Team Effectiveness) is the highest, followed by P5 (Knowledge/Abilities). The ROV values of P8 (Task Load) and P9 (Time Constraint) are also significant, as shown in Figure 12. Despite their lower ranking compared to P4 and P5, their posterior probabilities are mostly over 0.8, underscoring their importance and indicating that they cannot be ignored.

5. Discussion

5.1. The Innovation and Limitation of the Method

In Arctic voyages, crews are sometimes required to use a composite navigation mode that includes one or more of the five precise operations in a voyage [48]. During a long and complex task, with the changes in the cognitive behavior of the crew, the commonly used FRAM and HFACS methods cannot describe the cognitive behavior of the crew [1,49]. Therefore, more appropriate methods are needed to solve the problem. Compared with other studies, more attention is paid to the impact of changes in the polar environment on the occurrence of accidents [50,51]. However, this study focuses on the analysis of the cognitive behavior of people during the icebreaker assistance period, details the entire analysis process, identifies and quantifies the human error of different crew members, and quantifies the collision probability between the icebreaker and the assisted ship from the perspective of human error. In addition, unlike other studies that use small sample accident data or comprehensive analysis of polar navigation literature to identify important factors affecting polar navigation [4,52], this study obtains subjective data through fuzzy set theory and D–S evidence theory and transforms subjective data into objective data through a cloud model design simulation experiment to increase the available data.

However, this study refined the entire analysis process from the perspective of human cognitive behavior, so the whole method is relatively suitable for other navigation operations during Arctic navigation, but it needs to be analyzed according to the actual situation. In addition, in the process of obtaining expert data, a high degree of expertise is required to obtain appropriate data.

5.2. Discussion of Experimental Results

This study identifies and quantifies the probability of human error that leads to the collision between an icebreaker and an assisted ship during convoy operations and identifies 20 human errors, among which this study found that the highest probability of human error occurs in the OOW decision-making process, which highlights the important impact of OOW decision making on the system. Similarly, other studies have shown that failure to stay alert for a long time during navigation is an important cause of accidents [53]. This study analyzes human cognitive behavior and divides the entire analysis process into three stages. According to the experimental results, the collision probability starts to change when each crew member starts to fully carry out convoy operations and gradually stabilizes after each crew member normally performs their duties. The results of this study are similar to those of Zhu et al. [54]. This conclusion is of great significance to the process formulation in convoy operations and the allocation of ship safety resources in the icebreaker assistance process.

Through further analysis of HOFs, it is found that Team Effectiveness and Knowledge/Abilities have a great impact on the collision during convoy operations. From the perspective of individuals, it is necessary to improve the professional quality of polar voyage crew members. From the perspective of teams, the probability of misinterpretation of IP or OOW instructions (A1) is slightly less than the probability of OOW making mistakes in the decision stage (D1/D2/D3). Therefore, clear communication is crucial. Augmented reality (AR) could be used in this scenario to facilitate team communication and information exchange to improve the safety of the fleet [55]. This conclusion points out the direction for future polar crew learning and team training.

6. Conclusions

This study divided the occurrence process of ship-to-ship collisions during convoy operations into three stages, analyzed the crew tasks within each stage based on the IDAC model, and identified the critical events and human errors of different crew members within each stage. Based on this, a human reliability analysis framework centered on PIFs, HEs, and CES was established. On the basis of the above analysis, a Dynamic Bayesian Network (DBN) model was constructed based on the logical relationships between PIFs, HEs, and CES, with the occurrence of a collision (T) as the leaf node, quantifying the probabilities of the 20 identified human errors and deriving the significant Human and Organizational Factors (HOFs) that influence the leaf node.

The research results show that during convoy operations, the most significant human error is the OOW choosing an incorrect deceleration strategy (D3), with an occurrence probability of $8.259\times {10}^{-2}$. This highlights the crucial role of decision making in complex navigation environments. Additionally, the study reveals that the levels of Team Effectiveness and Knowledge/Abilities in convoy operations have a decisive impact on reducing the risk of collisions between vessels, with an estimated collision risk as high as $4.129 \times {10}^{-3}$. This emphasizes the importance of teamwork and professional training. From a theoretical perspective, this study enriches the theoretical framework of HRA, particularly in the application of navigation safety analysis in polar waters. It provides theoretical support for polar maritime safety research from a human factor perspective. From a practical perspective, it offers scientific risk assessment tools to maritime administrative agencies and shipping companies, facilitating the identification of critical risk points, and guiding the development of more efficient and precise safety precautions for convoy operations as well as crew training.

The future work could mainly focus on two aspects: on the one hand, the uncertainty probability information of subjective data is considered, and the real physiological and psychological data of navigation is obtained through experiments to improve the prediction accuracy of the DBN model. On the other hand, a more complete set of PIFs is introduced to analyze the impact of HoFs on system performance more deeply.