Just a note: The RMS method assumes independence (or at least 0 correlation). Often one "worst case" happening might be more likely if another "worst case" happens, because mistakes are often positively correlated.