MODELLING A FAULT-TOLERANT CONFIGURATION OF A BANK INFORMATION ENVIRONMENT

Abstract

Regulatory requirements for the operational resilience of the financial sector define quantitative availability targets for critical banking services; however, the traditional pass/fail verification of disaster-recovery plans provides no statistically grounded answer to the question of whether a deployed configuration actually meets these targets. The failure coverage factor, that is, the probability that a failure is detected and handled automatically without interrupting the service, is postulated rather than measured in availability calculations. The paper proposes a method for experimental verification of a fault-tolerant configuration of a bank information environment, based on controlled fault injection into the production-grade environment combined with interval estimation of the results. It is shown that the test programme should be derived as a projection of the risk-analysis models, namely the ranking of failure modes by their risk priority numbers and the list of protective barriers of fault and event trees, so that every experiment series tests a separate quantitative hypothesis about a specific protection mechanism and its outcome refines the corresponding parameter of the availability model. A controlled-experiment scheme suitable for an industrial banking environment is formalized: a steady-state metric, operational definitions of the detection, localization and switchover completion instants, blast-radius confinement to a pilot circuit, and an automatic abort criterion. The statistical processing rests on Wilson confidence intervals and on pooled estimates for identical mechanisms tested on different components; the required sample sizes are quantified, showing that at least 381 defect-free runs are needed to confirm coverage of 0.99, which justifies the automation of fault injection. The method was validated on a pilot geo-distributed environment of an operating bank: eight series totalling 261 runs produced interval estimates of coverage for all key barriers, revealed two latent configuration defects that cannot be derived from analytical models, and demonstrated that manual switchover to the backup site, with a median of 42 minutes, violates the recovery-time objective of the most critical service class.