@rlumley - <Grin>
@Alderian - to cut the number of car related deaths replace all of the drivers safety systems (seat belt, airbag, collapsible steering column) with a rigid steering column topped by a 9 inch steel spike. The number of car deaths would fall dramatically.
@ZhnangFang - Reducing the chances of a catastrophic failure from 1/1000000 to 1/10000000000 would be prohibitively expensive.
It costs money to keep an aircraft airworthy. Every aircraft has an AF/BF (pronounced "Aff Baff") an After-Flight/Before flight inspection. This is also known as "count the wings and kick the tyres". It's to make sure all of the parts (antennas, pitot-heads, static wicks, wings, tyres, engines, etc.) are there and properly attached.
Every part has a lifetime-to-failure. For fixed wing aircraft, regular servicing is carried out to replace these parts before they become life-expired. For rotary wing aircraft, parts are replaced when half their expected life-time has expired (half-life to failure). This is done at a Minor Service.
Every few years the entire aircraft is stripped down to bare metal and all of the airframe is inspected for cracks and corrosion, then it is rebuilt and repainted (a Major Service).
All these steps make the aircraft as safe as economically viable. If you watch "Aircrash Investigation" you'll know that a significant number of crashes were caused by an airline reducing costs by stretching the intervals between services or even skipping them entirely. The parts failed and people died.
Real-world example: working on a helicopter squadron during a conflict long ago. We couldn't get spares, so the junior engineering officer signed half-life expired items as fit-to-fly (125 hours in this case). Every one had to be inspected and tested after every flight. But we still couldn't get spares so, after more flying hours (170), the senior engineering officer became involved. The part in question (part of the electrical power system) was well past its half-life but not yet at its full-life expectancy. It appeared functional and passed every test, so he signed it fit-to-fly. Eventually it reached its full 250 flying hours and we *still* couldn't get spares. The decision went even higher - but we needed the aircraft and, while a failure would end the mission it would not directly endanger the aircraft, which could fly back to base with its essential electrical systems run from the batteries. Why do I remember this? Because the part failed at 254 hours, just 4 hours past its expected lifetime to failure.