## 1 Introduction
Nevertheless, as a domain-independent approach, STPA focuses on the general procedures and hazardous factors. For adapting the features of the SOTIF, i.e., the hazardous factors related to functional insufficiencies and reasonably foreseeable misuses, STPA still need to be further customized. Besides, for practical hazard control, it is necessary to be aware of the importance degree of the hazardous factors [23]. Based on different values of importance degree, targeted hazard control strategies can be formed. For example, safety measures should be taken in the design phase for the vital hazardous factors, while other, less important, hazardous factors can be controlled by safety barriers or contingency plans in the system operation phase. For the STPA analysis of the SOTIF of the IRDAS, the factors derived from it should be ranked by the importance degree. As STPA alone cannot provide a factor evaluation [28], an extra importance degree evaluation method should be adopted for this part of the analysis. For the evaluation of hazardous factors, the complex network theory is a powerful tool that reveals the topological characteristic of complex systems and complex relationships [29; 30]. In the complex network analysis, the nodes represent hazardous factors of the systems, and the edges describe the interactions between nodes. By the use of some topological indexes, such as node degree and shortest path length [31], the hazardous factors can be evaluated. The complex network has been widely applied to the evaluation of railway hazardous factors. For example, the works in [32; 33] construct directed networks to evaluate the causes of Metro accidents. For the mainline railway, directed complex networks are used in [34; 35; 36] to reveal the critical safety factors and event chains, and undirected complex networks are built in [37; 38] to find the main contributing factors of various types of safety occurrences. It should be noticed that most of the railway safety analyzing networks above are homogeneous networks or heterogeneous networks consisting of two types of nodes, i.e., the nodes of such networks are of one or two types. Moreover, the topological evaluating indexes are derived from the corresponding structures of networks. However, the STPA analysis of the SOTIF of the IRDAS will obtain two types of hazardous factors, including unsafe control actions and their causal scenarios. Together with hazards, the network built upon the result of the analysis will be a heterogeneous network that contains three different types of nodes. To analyze the characteristics of this kind of network, the topological indexes designed for the existing networks cannot meet the need and should be further improved. In this context, this paper aims to purpose a hazard analysis approach for the SOTIF of the IRDAS using STPA and the complex network. Firstly, the STPA method is customized to cope with the safety problems that emerge due to the performance limitation of intelligent environment situation awareness in the IRDAS. In this part, the feedback part of the control structure in STPA is extended for better modeling the complex sensors and AI algorithms, and a new classification of causal scenarios is proposed to identify the SOTIF-related causal scenarios. Then, a modeling method for the heterogeneous complex network consisting of three types of nodes and some corresponding topological indexes are proposed to evaluate the importance degree of the hazardous factors identified in the STPA causal analysis. By applying the proposed hazard analysis approach to a real IRDAS, the usefulness of this approach is validated. The remainder of this paper is organized as follows. Section 2 describes the methodology of the analysis and evaluation of the SOTIF of the IRDAS. A case study is presented in Section 3, and the results are further discussed in Section 4. Finally, Section 5 provides the conclusion of this paper.