## 2 Methodology
### Identification of SOTIF-Related Hazardous Factors with the Extended STPA
#### 2.1.1 Model the Control Structure with the Extended Feedback Module  
To build a control structure for STPA analysis, it is necessary to recognize the role of the different parts in the assistant railway driving. The control structure of STPA consists of four basic elements, including sensor, controller, actuator, and controlled process [23]. The controller contains the process model and control algorithm. For the driving process  
Figure 1: The framework of the approach proposed in this paper.  
with the IRDAS, the traction and brake system should be the actuator of the train operation process, which is not different from the analysis in the functional safety domain. When the train is operating in IRDAS mode, the driver should be aware of the operation process, and controls the traction and brake forces. This places the driver in the role of controller. At the speed under the IRDAS driving mode, the driver is visually incapable of obtaining all the time-efficient information that is critical to operational safety. The IRDAS provides infrastructure and object information and provides driving suggestions, reminders, and warnings to the driver, while it does not provide a direct control order. This makes the IRDAS an intelligent feedback process in this research. It can be seen that the feedback process becomes too complex to depict with a simple sensor. It is necessary to further design a framework for depicting the complex feedback process that is implemented by the IRDAS.  
[PERSON] proposes the three-level model, which is now a dominant situational awareness model in the human factor domain [39]. In this model, level one is the perception of the elements in the environment, level 2 is the comprehension of the elements and their meanings, and level 3 is the projection of future status. The work in [40] provides four basic elements for robotics and autonomous systems, including sensing, understanding, deciding, and acting (SUDA). Our paper proposes to build the STPA feedback structure with the four elements of sensing, understanding, deciding, and acting, and the three-level model is used to describing the understanding process. The proposed framework for building a SOTIF-related control structure for the IRDAS is shown in Figure 2. In the control structure, the feedback part of the IRDAS describes the interaction of the sensing, understanding, deciding, and acting. The three situational awareness levels provide a guide to describe and analyze how the understanding works. The deciding element evaluates matters including uncertainty, safety, etc., and then makes decisions of what information should be noticed by the driver. The information flows from sensing to deciding, and reversely, deciding and understanding can also provide information to sensing. The downward arrows in the feedback part of the control structure represent the settings and dynamic adjustments, to obtain better environmental information. In addition, the driver obtains information directly from the controlled process and operational environment. Although not sufficient to operate the train at that speed, this information could support the driver in correctly using the IRDAS.