A good design is approximately optimal. When a reasonable probabilistic model is available, the design can be optimized in expectation: flight delays should be rare, e-mails should arrive within seconds, and buildings should protect from elements and provide comfort on most days of the year. But a single disaster can cause big trouble.