When I was working with mission-critical (7/24/365) high volume transaction systems and we needed to do a software upgrade, we thoroughly tested it before the cutover. We would do things like set up a separate dedicated server or servers for the new software, would do "load testing", ran old data through it offline and if appropriate run the test system in parallel with the old system. We always did a backup before cutover so if there was a "glitch" in the upgrade, we could revert to the previous version and lick our wounds and figure out why it didn't work. Being self-critical of my software group, I would probably give only get a B- grade in terms of software expertise but we never lost customer data, lost a single transaction or had a system inoperative for as long as the Marriott system has been. In the 15 years since I retired, I'm sure that the state of the art in software testing has progressed ... except perhaps with the Marriott technical folks.