Most accidents in well-designed systems involve two or more events of low probability occurring in the worst possible combination.

Cited in: Richard K. Betts (1982) Surprise attack: lessons for defense planning. p. 158 - Principles of Operations Research (1975)