Most accidents in well-designed systems involve two or more events of low probability occurring in the worst possible combination.