## 3 Case Study
### Evaluation of SOTIF-Related Causes  
Based on the method proposed in Section 2.2.1, the hazardous factors network (HFN) of the hazardous factors is identified in the above STPA analysis. There are 165 nodes, including 3 hazard nodes, 8 UCA nodes, and 154 causal factor nodes, as well as 302 directed edges in this HFN. The HFN is shown in Figure 5.  
With the adjacency matrix and the reachability matrix, the two overall indexes are calculated. By Equation (5), the path density is evaluated as 0.6732. By Equation (4), the causal connection density is evaluated to be 0.0232. It shows that the value of its path density is much higher than that of the causal connection density. This indicates that the HFN has complex causal paths among the different types of hazardous factors. By Equations (6) and (7), the active correlations and passive correlations of hazardous factors are evaluated, as is shown in Figure 6. Some causal factors at the left side of the dotted line in the figure have large passive correlation values and small active correlation values, for example, \"the working condition of the train affects the quality of the image from cameras\" (CF26), \"water film or sand covers the lens\" (CF29), and \"some characteristics of the object make it hard for perception\" (CF51). This means that these causal factors are the terminal type of hazardous factors in their hazard causal relations. These terminal hazardous factors can be easily caused by their direct or indirect causes in short paths but have relatively long paths to cause some other hazardous factors. Thus, preventing this kind of hazardous factor from being caused is an efficient way to control the safety impact of these factors. On the contrary, some causal factors located at the right side of the dotted line have high active correlation and low passive correlation, for example, \"the driver exceeds the speed/distance restriction of the front red signal light\" (CF102), \"the TIDS does not find the front train in time\" (CF105), and \"the TIDS recognizes other things as an obstacle\" (CF118). The indexes mean that these factors are the initial type of hazardous factors in their causal relations. This type of hazardous factor can easily cause other hazardous factors directly or indirectly, so it is better to take measures to prevent them from causing other factors to eliminate their safety impact on the system. The UCAs are at the left side of the dotted line. The UCAs cannot directly cause other hazardous factors but can directly cause hazards in a particular context and worst-case environment. Hazard control actions on UCAs are necessary, but not so efficient due to their low passive correlation values. There are also some middle factors that have similar active and passive correlations, for example, \"the distance measurement of the TIDS to objects is incorrect\" (CF63) and \"the TIDS does not calibrate its location by the environment\" (CF7/7). These factors should be treated by the combination of preventing them from being caused and from causing others. The evaluation of active correlation and passive correlation helps distinguish the type of different hazardous factors in the hazard causation paths. Based on this, targeted actions can be applied to these hazardous factors for more practical and efficient hazard control. As the terminal hazardous factors need to be prevented from being caused, incoming importance should be given to them. Similarly, outgoing importance should be given to initial hazardous factors since they need to be preventing from causing others. By Equations (10) and (11), the corresponding kind of importance indexes are then evaluated  
Figure 5: The hazardous factors network of the human–IRDAS driving system. for edges of hazardous factors.