The causal scenarios developed from STPA provided holistic insight into how accidents might happen in the CESS. For example, the analysis showed how EMS software updates which change battery process model can cause the EMS to provide unsafe control actions and possibly allow thermal runaway to develop in thebattery. It is important to recognize that nothing in this scenario has a probabilistic mechanism of failure and so generally would not be accounted for in a PRA based analysis. Understanding the complex causes of accidents promotes design changes that act systematically. In the example above this means that designers can choose the right combination of version control, database management, software testing, oversight, technician training, signage, and informational/hardware redundancy to assure that a new process model will not provide unsafe control. If scenarios are identified early enough in the design process, then even architectural changes can be made to eliminate accident scenarios altogether. These insights provide designers a complete picture of how to avoid accidents such that cost and performance optimization can be performed without compromising safety.