## 3 Case Study
### Identification of SOTIF-Related Causes  
In the STPA approach, the system-level hazards are identified from accidents. The accidents of this system are the same as the accidents of common train operations. The accidents identified are shown as follows. * A1. A train collides with an obstacle. * A2. A train collides with a human. * A3. A train rear-end collides with another train. * A4. A train collides with a train on the sideline. * A5. Train derailment. * A6. An unnecessary emergency brake causes passenger injury. Then, the hazards and corresponding safety constraints of the system are identified from the accidents and listed as follows. * H1. The system cannot protect the safe speed/distance restriction of the train. (A1-A5). * SC1. The system must give the brake order before the train breaks the speed/distance restriction. * H2. The system cannot prevent the train from exceeding the speed limit of the section. (A1-A5). * SC2. The system should keep the speed of the train under the limit of the current section and the section being entered. * H3. The system provides an emergency brake in a nonurgent situation (A6). * SC3. The system should only provide an emergency brake when the situation is urgent. Based on the framework proposed in Section 2.1.2, the control structure of the human-machine driving system is built, as is shown in Figure 4. In the perception part of the IRDAS, the image recognition and data fusion of image and point cloud provide the type and distance information of infrastructures and objects. The detected sign information is then used with the speed from RADAR and electronic map to achieve localization. The information above is used in situational comprehension, and a situational model is built. Based on the comprehension of the situation, some projections about the situation are made. The driver can obtain the rough obstacles, localization, and speed information by \begin{table}
\begin{tabular}{c c} \hline \hline
**Category** & **Environmental Variable** \\ \hline \multirow{4}{*}{Operational area} & Station \\  & Track switch \\  & Straight line/curve line \\  & Uphill/downhill/horizontal \\  & Underground/overound/on bridge \\  & Illumination situation \\ \hline \multirow{2}{*}{Operational time} & Peak/normal \\  & Maintenance and test time \\ \hline \multirow{4}{*}{Sign} & Landmark \\  & Position sign \\  & Signal light \\  & Stop sign in station \\ \hline \multirow{4}{*}{Natural environment} & Rain/snow/sand/fog/wind \\  & Sunlight/moonlight \\  & Flood/fire/earthquake \\ \hline \multirow{4}{*}{Object} & Train (in front, on sidetrack) \\  & Human \\ \cline{1-1}  & Buffer stop \\ \cline{1-1}  & Obstacle on track \\ \cline{1-1}  & Obstacle in the air \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Environmental variables in the operational environment of the TIDS. watching. More precise and time-efficient information can be obtained from the interface of the TIDS, including the panel and the voice prompt. The driver can decide to use or power off the TIDS by judging if the current situation is within the operational design domain. For example, if the visibility is too poor due to heavy fog, the driver should stop trusting the TIDS, because the TIDS is not designed to work in this extreme weather. As shown in the control structure, the driver, as the controller in this system, has two types of control actions, which are traction/brake of the train and use/not use of the TIDS. The unsafe control actions (UCAs) related to the controller are identified by the four UCA types of STPA and the actual operational scenarios in Section 3.1, and are listed in Table 2. Since the unsafe controls are regarding the improper situation awareness and do not have a duration problem in our study, the UCAs are derived from the first three UCA types, i.e., \"not providing causes hazard\", \"providing causes hazard\", and \"too early, too late, out of order\". Figure 4: The control structure of the overall driving system.