Software is one of the most complex products in the world - it cannot be seen, it’s theoretically easy to change, and over time it grows brittle and breaks easily. When you couple software to an already complex system - a failure-inducing one - you have a system in great need of robust performance. And yet, we have spent little time understanding what truly robust performance really means and how to achieve it. We are satisfied with systems that fail, even essential systems, because we think there is no alternative.