Qualitative cause-defense matrices: Engineering tools to support the analysis and prevention of common cause failures