Why Use CAST?

Uncovering Latent Risks in Industrial Processes: Shell Moerdijk

A CAST analysis of the Shell Moerdijk explosion found systemic flaws the official report left out, including lessons from two similar earlier incidents that were never built into the plant’s design and procedures.

Chemical and process plants often analyze risk with “bow-tie” or “Swiss cheese” models, which treat an accident as a chain of events that barriers should stop. A CAST analysis of the Shell Moerdijk reactor explosion found systemic flaws that the official investigation report had left out. CAST identified that similar incidents had occurred at Moerdijk in 1999 and at Shell’s Nanhai plant in China, yet the corporate safety management system had not incorporated these lessons into the design and procedures of the Moerdijk plant.

The analysis highlighted “risk assessment blinders” and a flawed Management of Change (MOC) process where production modifications, such as switching to a different catalyst, were made without retesting underlying safety assumptions. Traditional reports tend to stop at the immediate trigger, such as a leak. The CAST analysis also looked at the operating company, the parent company, and the external audits, and found a flawed mental model of the risk at the corporate level.

Source: CAST Analysis of the Shell Moerdijk Accident (opens in a new tab)

Addressing Complexity in Autonomy: The Uber-Volvo Case

A CAST analysis of the Uber self-driving car crash went beyond the NTSB’s focus on the safety operator, finding flaws in the car’s software and in the company’s decisions.

The Uber-Volvo collision with a pedestrian in Tempe, Arizona, shows how an official accident report and a CAST analysis can differ. The National Transportation Safety Board (NTSB) report focused heavily on the safety operator, who was not monitoring the system. A CAST-based socio-technical analysis, however, shifted the focus to how decisions taken in the broader system created the circumstances necessary for the accident. CAST identified flaws in the Automated Driving System (ADS) classification logic, which could not identify the pedestrian for more than four seconds. It also identified the corporate decision to remove the “co-pilot” from the vehicle, which decreased safety and ignored warning signs of vehicle damage. The CAST analysis modeled the safety control structure, and showed automation complacency as a predictable human response to the situation the organization created, rather than a simple individual lapse.

Source: Testing the Reliability of Accident Analysis Methods: a comparison of AcciMap, STAMP-CAST, and AcciNet (opens in a new tab)

Systems Thinking in Aviation Investigations

In a study of the Tenerife runway collision, CAST found every cause that FTA and FMEA found, plus organizational and social factors that both methods missed.

A study of the Tenerife runway collision compared two traditional reliability methods, FTA and FMEA, with CAST. FTA and FMEA mostly found causes such as pilot errors, air traffic controller mistakes, technical problems, and adverse weather.

Applied to the same accident, CAST found every cause that FTA and FMEA found, plus organizational and social factors that both methods missed. The CAST analysis showed a safety control structure that did not manage the pressure of duty-hour regulations or the limits of the airport’s infrastructure.

Source: Tenerife Accident Analysis: A Comparison of FTA, FMEA, and CAST (opens in a new tab)

Looking Past Blame in a Hospital Investigation

When a hospital safety team used CAST on a sentinel event, it found causes, such as shortcomings in the electronic medical record, that a standard RCA would have attributed to a “lack of communication.”

In healthcare, where 6% of patients suffer preventable harm, incident reporting systems are often ineffective because they focus on frontline human error and are “blame-laden”. CAST treats safety as a feedback control problem rather than a failure problem. Instead of asking “Who did it?”, CAST asks “Why did the system allow this to happen?” and “Why did the action make sense to the person at the time?”.

In a trial implementation at a hospital, a safety team trained in CAST analyzed a sentinel event and identified not only the unsafe actions by frontline staff but also the departmental management’s unsafe decisions and the underlying reasons for those decisions. The CAST analysis identified diverse causal factors, such as shortcomings in the electronic medical record and technology limitations in biopsy pathway guidance, which a standard RCA would have attributed to a “lack of communication”. Causes like these point to stronger fixes, such as process redesign and change management, in place of the “weak” interventions typical of RCAs, such as personal reflection or retraining.

Source: The Use of STAMP/CAST in Healthcare LRS (opens in a new tab)

Nuclear Industry: Learning from Operating Experience

In NRC workshops on digital instrumentation and controls, most CAST findings, including incorrect operational assumptions, were absent from licensee event reports and other traditional analyses.

The U.S. Nuclear Regulatory Commission (NRC) recognized the potential of CAST to improve regulatory oversight in safety-related digital instrumentation and controls (DI&C). During CAST workshops, participants noted that most findings, such as incorrect operational assumptions and systemic factors, were entirely absent from traditional analyses like Licensee Event Reports (LERs).

CAST led participants to identify the reasons behind people’s actions, and questions that investigations should ask but usually overlook. CAST also showed why safety-related controls had not been effective, one of the “modern challenges” in accident analysis that chain-of-events models do not handle.

Source: NRC Regulatory Oversight (opens in a new tab)

Looking Past the Dispatcher: Sunwing Airlines

At Sunwing Airlines, a CAST of a flight that had to divert found causes up to senior management that the original investigation, which focused on the dispatcher, had not covered.

The flight was due to arrive 30 minutes before a scheduled runway closure at its destination, and then left the gate late. An email appeared to extend the airport’s operating hours, so the flight departed. During descent, air traffic control told the crew they were not cleared to land. The planned alternate airport had closed just before departure. With help from air traffic control, the crew diverted to another airport and landed safely.

The original investigation found that the email was ambiguous and hadn’t come from the right authority, and that the dispatcher had stopped checking for notices about the alternate airport after releasing the flight plan. It identified 4 possible solutions.

CAST asked why each decision made sense at the time. The dispatcher had never seen an airport close after a flight plan was issued, and didn’t know the planning software could flag new notices. That question led to the chief dispatcher, who had no feedback on how dispatchers’ skills held up after training. Higher still, the duty manager believed the email was approval from the airport, and the airline’s goal of minimizing delays came with no feedback to management when requirements were worked around to meet it. The CAST analysis identified 15 possible solutions.

The analysts found that CAST showed them where to probe in interviews, and that the control structure made missing feedback easy to see. They also reported a steep learning curve, and found CAST labor-intensive for simpler events.

Source: Beyond Root Cause: Using CAST in Airline Operations (workshop slides) (opens in a new tab)

Efficiency Gains in Medical Devices

After a year of FMEA missed the cause of a blood gas analyzer recall, one analyst using CAST and STPA found it in two weeks.

A manufacturer spent a year performing FMEA on a blood gas analyzer that had been recalled, identifying 75 scenarios but failing to find the cause of the recall. In only two weeks, a single analyst using CAST and STPA modeled the control loops and found 175 scenarios, including the cause of the recall. The CAST and STPA took less than 4% of the time the FMEA took.

Source: Blood Gas Analyzer Recall (opens in a new tab)

Speed and Reusability in Large Organizations

Investigators report that CAST analyses take less time with experience, because much of the control structure from early analyses can be reused for later investigations of the same system.

Experienced investigators report that CAST helps them work faster, because the questions CAST raises early in an investigation reduce the need to go back and collect more data later. The first few CAST analyses of a system take time, mostly to model its safety control structure, but much of that model can be reused in later investigations of the same system. After that, investigations take less effort, and fixing the causes that CAST finds reduces the number of accidents.

Source: CAST Handbook: How to Learn More from Incidents and Accidents (opens in a new tab)