All systems fail. The question isn't whether your system will break—it's whether you've designed it to break in the right ...