Managing threats rather than risks in blood transfusion: robust design for a complex system