What does safe mean?

It is an interesting question. Nothing is safe, 100% robust under any set of circumstances. If a two hundred foot high sea monster climbs out of the Thames and starts munching on Canary Wharf a few disaster recovery plans would doubtless be found wanting.

There are at least two issues. The first is to encourage people to be skeptical about the performance of any construction, mechanical, electronic or intellectual: there are some events that will screw up any design.

But then we come to the problem of how to estimate how unlikely these testing circumstances are. Typical operational risk events involve a concatenation of errors, of individually improbable circumstances. Sadly it seems that sometimes these events are not independent so that the joint probability of a screw up is much bigger than one might think. For that matter, the equity, credit, FX and interest rate markets often have low return correlations: but they can all move together in a crisis, as LTCM found out. It isn't that a plausible worst case is bad -- we knew that -- it is that the worst case can be much more likely than it appears.