A Multi-Layer Validation Architecture for Hybrid Deductive–Probabilistic Safety Models

Hybrid Fault Tree Analysis-Bayesian Network (Hybrid FTA–BN) model is well-known for its deductive causal tracing and probabilistic reasoning capabilities, which has been more widely applied in the rare event safety assessment field. But it has a long-standing fragmentation issue with its verification work. In scenarios with little data, where accident observations are few and far between, heterogeneous and often subject to underreporting, conventional independent verification approaches that emphasize prediction accuracy are at best impractical and at worst engender a false sense of security. In this paper, we present a multi-layer verification architecture for static hybrid FTA-BN models which reformulates verification as an argument regarding the credibility of a hypothesis with respect to the goals of an application along with supporting complementary evidence (rather than establishing single-cast accuracy) while synthesizing independent verification logics across five core dimensions. The architecture is operationalised as an iterative validation protocol with transparent reporting requirements and demonstrated using an inland-waterway collision model with Top Event = Collision. The final validation results show that all 20 events in the numerical validation set satisfy the selected coherence criterion, with the maximum relative deviation remaining below the tolerance threshold (0.0905 < 0.10). Behavioural validation also confirms directionally consistent responses across the tested evidence scenarios, including the communication-failure pathway. External plausibility is used only as order-of-magnitude context because of underreporting and exposure-alignment uncertainty. The study concludes that, in rare-event and data-scarce settings, hybrid FTA–BN validation should culminate in a transparent statement of credibility for a stated use—such as screening, comparative ranking, or bounded scenario exploration—under explicit assumptions and boundary conditions, rather than a binary declaration of validity or predictive calibration.