[nobody31415926]

Actually I think Nasa's approach is to design as best they can - then have layers of management each add a a factor of 10 to the assumed level of safety until it's sufficiently safe.

In the Challenger accident the engineers estimated the chance of a fatal accident at 1:100 , the next level of management 1:1000 senior management at 1:10,000 and the official Nasa press release 1:300,000

Presumably by adding more levels of management they could have made it even safer!