## 1 Introduction  
The efficient and safe operation of railway systems now relies on automated train control (ATC) systems based on the cooperation of onboard and ground-based signaling equipment. When ATC fails, the driver can only drive at an extremely limited speed, which brings about enormous disruption in the operation of the railway network. In recent years, the Intelligent Railway Driving Assistance System (IRDAS), achieved by sensors such as cameras, RADARs and LiDARs, and AI algorithms, is being developed and installed on trains to make the train environment situationally aware by itself [1, 2, 3]. The driver can be allowed to operate the train at a much higher speed with the assistance of IRDAS. At the same time, this also causes a potential safety problem where the driver may not be able to stop the train in time if the system does not behave as intended, which could be fatal. Therefore, it is necessary to ensure the safety of the IRDAS. For a traditional electrical/electronic (E/E) system such as ATC, the safety is of the field of functional safety, in which the safety problem is mainly due to random hardware failures and systematic failures [4]. Now, for IRDASs, the control and acting are based on the perception of objects, infrastructures, and other critical information. The systematic use of situational awareness achieved by complex sensors and processing algorithms brings up a new safety problem, i.e., the safety of the intended functionality (SOTIF) [5]. Unlike the traditional functional safety that focuses on failures, the SOTIF is caused by two categories of hazardous factors, which are functional insufficiencies and reasonably foreseeable misuses. For the IRDAS, the SOTIF provides a complement of safety issues of environmental hazardous factors which are not considered in functional safety [6]. As a vital part of ensuring the safety of the IRDAS, it is essential to analyze the SOTIF of the IRDAS. Therefore, a practical hazard analysis method for the SOTIF of the IRDAS is needed. Approaches such as fault tree analysis (FTA) [7], failure mode and effect analysis (FMEA) [8], event tree analysis (ETA) [9], and hazard and operability analysis (HAZOP) [10] are widely used in the hazard analysis of railway E/E systems [11]. The works in [12; 13] apply FTA to the hazard analyses of the railway moving authority plus system and the railway turnout system. The works in [14; 15] use FMEA to identify the potential safety problems in the structure and function of automatic train protection systems. In [16; 17], HAZOP is used to support the hazard identification and analysis of railway signaling systems. However, these approaches are based on event chains, in which the events are usually component faults, functional failures, and functional deviations [18]. For the IRDAS, the SOTIF problems arise from the performance limitations during complex interactions with the operational environment [19], i.e., the SOTIF issues are related to interactions. It is difficult for the above approaches to deal with such interaction-related issues. Other than the traditional approaches, there are systematic models and methods that are able to interpret the safety impacts of interactions in systems, such as the Functional Resonance Accident Model (FRAM) [20; 21; 22] and System Theoretic Process Analysis (STPA) [23; 24; 25]. In the systematic approaches, safety is considered an emergent problem and should be analyzed among the complex interactions within the social-technical systems. This kind of approach is suitable for SOTIF issues. For example, STPA has been applied to the SOTIF of road vehicles. The work in [26] develops a process that captures key steps from PAS 21448 [5] with STPA and analyzes lane centering and lane changing for a generic level 3 highway chauffeur system. The authors in [27] use the STPA method with agile systems engineering pipeline. Hazardous scenarios are identified before system testing to improve SOTIF in autonomous vehicles. Therefore, STPA can be utilized to analyze the SOTIF issues of IRDAS.