Você está na página 1de 10

European Journal of Operational Research 141 (2002) 679688

www.elsevier.com/locate/dsw

O.R. Applications

Using formal MS/OR modeling to support disaster


recovery planning
Kweku-Muata (Noel) Bryson a,*, Harvey Millar b, Anito Joseph c,
Ayodele Mobolurin d
a
Department of Information Systems, Virginia Commonwealth University, Richmond, VA 23284, USA
b
Department of Management Science, St. Marys University, Halifax, Nova Scotia B3H 3C3, USA
c
Department of Management Science, University of Miami, Coral Gables, FL 33124, USA
d
Department of Information Systems and Analysis, Howard University, Washington, DC 20059, USA
Received 19 April 2000; accepted 15 July 2001

Abstract

All organizations are susceptible to a non-zero risk of experiencing out-of-course events, whether natural or man-
made, that can lead to internal disasters with respect to business operations. Dierent types of events (e.g. ood,
earthquake, re, theft, computer failure) have implications for the operations of modern organizations. Hence, there is
a critical need for planning and recovery strategies for the eects of disasters. Disaster recovery plans (DRPs) aim at
ensuring that organizations can function eectively during and following the occurrence of a disaster. As such, they
possess cost, performance, reliability, and complexity characteristics that make their development and selection non-
trivial. To date, there has been little modeling of disaster recovery issues in the MS/OR literature. We believe that many
of the issues involved can benet from the application of quantitative decision-making techniques. Consequently, in this
paper our contribution is prescriptive rather than descriptive in nature and we propose the use of mathematical
modeling as a decision support tool for successful development of a DRP. In arriving at a nal DRP, decision-makers
must consider a number of options or subplans and select a subset of these subplans for inclusion in the nal plan. We
present a mathematical programming model which helps the decision maker to select among competing subplans, a
subset of subplans which maximizes the value of the recovery capability of a recovery strategy. We use hypothetical
situations to illustrate how this technique can be used to support the planning process.  2002 Elsevier Science B.V.
All rights reserved.

Keywords: Disaster recovery strategy; Disaster recovery planning; Subplan selection; Heuristics

1. Introduction

A disaster recovery plan (DRP) or disaster re-


* covery strategy (DRS) is a system for internal
Corresponding author. Tel.: +1-804-225-3632; fax: +1-804-
828-3199. control and security that focuses on quick resto-
E-mail addresses: kweku-muata@isy.vcu.edu, kweku-mu- ration of service for critical organizational pro-
ata@worldnet.att.net (K.-M. Bryson). cesses when there are operational failures due to

0377-2217/02/$ - see front matter  2002 Elsevier Science B.V. All rights reserved.
PII: S 0 3 7 7 - 2 2 1 7 ( 0 1 ) 0 0 2 7 5 - 2
680 K.-M. Bryson et al. / European Journal of Operational Research 141 (2002) 679688

natural or man-made disasters. A DRP aims to out the re, and there must be a clear plan for
minimize potential loss by identifying, prioritizing recovery that requires various resources including
and safeguarding those organizational assets that personnel, hardware and infrastructure.
are most valuable and that need the most protec- The dearth of models in the MS/OR literature
tion. In recent years various factors including shows quite clearly that the benet of MS/OR
government regulations in certain industries (e.g. methodology has not yet been brought to bear on
banking, credit unions), the occurrence of natural this emerging discipline. Although recently Jenkins
disasters (e.g. hurricane Andrew of 1993), and the (2000) has explored the use of integer programming
occurrence of social disasters (e.g. L.A. riots of techniques for selecting disaster scenarios, it would
1992) have led to increasing interest in the devel- appear that the largest body of relevant quantita-
opment, testing and maintenance of DRPs. This tive analysis exists primarily in the area of risk as-
has resulted in intense customer and vendor in- sessment (Levitt, 1997; Tamura et al., 2000), or has
terest in the development of tools for disaster re- been reactive in focus, being restricted only to the
covery (e.g. Sclafane, 1996; Violino, 1996; Tevis, operational post-disaster phase such as the de-
1996; Carson, 1997). For example in just the NT ployment of crews (Pidd et al., 1996; Sarker et al.,
(operating system) recovery area, it is estimated 1996). Our research, we believe, will be a welcomed
that customers spent $ 102 million in 1996, with addition to the contribution of MS/OR to disaster
the projected amount being $ 324 million for the recovery research. Recognizing that little modeling
year 2000 (Torode, 1997). of disaster recovery issues has taken place to date
Although the eld of DRP has attracted the in the MS/OR literature, our model represents a
interests of information technology practitioners forward step in providing what is a fast growing
and vendors for a number of years, very little discipline with rigorous models for supporting de-
formal management science type research (e.g. cision making. Consequently, our contribution is
Sarker et al., 1996) has been done in this area. prescriptive rather than descriptive in nature. We
Thus, while there is a large volume of publications introduce the application of MS/OR to DRP at the
on DRP in numerous and various practitioner- pre-disaster planning/development phase. MS/OR
oriented journals (e.g. Banking Technology, Net- has potential for contributing to the strategic levels
work World, Communications News), the subject of decision-making in DRP to ensure that plans
has received scant attention in the management operate as expected/desired when put into opera-
science (including information systems) research tion. There are opportunities for applying MS/OR
journals. It appears that while much attention has at all levels of DRP planning, development, im-
been paid by vendors and organization to the de- plementation and operation, however we focus on
velopment of hardware and software tools for the development phase where MS/OR has been
addressing specic aspects of a disaster (e.g. Dry- most noticeably absent and can have its greatest
den, 1997; Bucholz, 1997; Merrill, 1997), little at- impact. In this paper we presents a mixed-integer
tention has been paid to formal modeling of the mathematical decision model for selecting subplans
DRP process. In the instances where the problem for a DRP. We use randomly generated hypothet-
has appeared in the academic journals the focus ical problems to demonstrate the feasibility of MS/
has been on examining the general features of a OR for decision support in DRP development.
disaster recovery plan rather than on decision The rest of the paper is organized as follows:
support. But as noted by Jackson (1997), Creat- Section 2 provides an overview of DRP concepts;
ing a good plan is no easy task. For DRPs are Section 3 provides a sample of outstanding DRP
inherently complex, given the various types of research problems; Section 4 provides an OR-
possible interactions that could occur between based solution approach for addressing one of the
target resources, solution resources and the envi- research problems described in Section 3; and -
ronment. Also as observed by Howard (1997), nally in Section 5, the paper terminates with a brief
the danger is not over once the re has been put discussion of the contribution of the paper and
out, so that survival is not just a matter of putting possible directions for future research.
K.-M. Bryson et al. / European Journal of Operational Research 141 (2002) 679688 681

2. Overview of DRP concepts time objective (RTO), and its own reliability
prole. In developing the DRP, an organization
2.1. Some general axiomatic statements about must select among competing alternatives. Typi-
DRPs cally budget limitations, resource limitations, and
complexity issues are major driving forces behind
We begin this subsection by listing some general the need to rst generate alternative plans, and
axiomatic statements about DRPs: secondly to design the DRP by selecting from
the set of alternatives. A mathematical modelling
Several possible disasters can occur. approach provides the capability to select these
Each disaster has a set of possible debilitating subplans in a rational manner and simultaneously
eects. address concerns about consistency, feasibility,
Each eect has the ability to aect a number of completeness, and reliability.
business functions.
To protect against each eect, a set of (solution) 2.2. Properties of good DRPs
resources are necessary.
Two strategies are possible: prevention (risk A DRP should have the properties of feasibility,
mitigation) and recovery. completeness, consistency, and reliability. The fea-
Some recovery resources may be substitutable. sibility property relates to whether the DRP is fea-
Substitutable resources do not necessarily pos- sible in terms of resources (e.g. skilled and unskilled
sess the same level of eciency (e.g., a back manpower, hardware and software resources, time)
hoe and a set of hand-held shovels do not have availability. Now complete mock-up testing of a
the same eciency level). DRP is rarely feasible, and so testing is usually re-
Some resources can be used to handle more stricted to a narrow focus area of DRP which is
than one eect. covered by a subplan. However, even this partial
Some resources will require the existence of testing of the DRP has major disadvantages in-
other resources. cluding disrupting operations and manpower costs,
A disaster recovery plan is made up of a set of while not guaranteeing the feasibility of the full
subplans, resources, rules, and procedures and DRP. The completeness property relates to whether
must aim at recovering from at least one eect. the DRP covers all important target organizational
resources and functions from the debilitating ef-
A DRP is made up of procedures and rules that fects of disasters. Are there some resources that we
utilize solution resources (e.g. hot sites) that are believe are covered by our DRP that are not in fact
aimed at protecting and/or reviving target orga- covered by the DRP? The consistency property is
nizational resources, functions, or processes (e.g. concerned with whether the dierent components of
information systems). Because there are dierent the DRP are consistent. Because the focus is often
types of disasters that could occur, each of which on local feasibility, it is possible that though two
could have dierent eects on dierent organiza- subplans of the DRP are individually feasible, that
tional target resources, a DRP or DRS is made up taken together they are infeasible. This could be
of a set of component subplans, each of which is caused by the fact that both subplans require the
aimed at protecting/reviving a set of target re- use of the same set of solution resources at the same
sources from the debilitating eects of a specic time. Finally, the reliability of a DRP is a measure
disaster. It is not uncommon for alternate recovery of the likelihood of the plan achieving its pre-
subplans to exist for the same disaster eect (for established continuity, recovery, and restoration
example internal versus external hot sites, or hot objectives. Because, the implementation of a DRP
sites versus cold sites for the recovery of a data is essentially the activation of a project, it is very
processing function). Each subplan, however, will likely that parts of the project network could fail.
have its own resource requirements, its own acti- Hence the critical path to recovery can be severely
vation and escalation procedures, its own recovery aected by unforeseen events.
682 K.-M. Bryson et al. / European Journal of Operational Research 141 (2002) 679688

2.3. Developing DRPs that could be used to eectively (i.e. exceeds target
eectiveness) protect against that eect. The full
Development of a disaster recovery plan or DRP thus consist of a set of DRSPs. Each such
strategy involves the following phases: (1) vulner- DRSP has an associated procedure that utilizes a
ability assessment, (2) organizational impact as- subset of the solution resources in a specied way.
sessment (or business impact analysis (BIA)), (3) The level of utilization of a given resource varies
denition of detailed requirements and continuity, from subplan to subplan. Again some of these
recovery, and restoration objectives, (4) develop- solution resources may require other solution re-
ment of alternative subplans; (5) the evaluation sources for their eective use in the given subplan.
and selection of the subplans which will constitute We require that all these solution resources (both
the DRP, (6) testing of the DRP, and (7) mainte- primary and secondary) be explicitly linked with
nance of the DRP. Testing is usually done at the the given subplan. We also assume that some
local subplan level, and so while it addresses subplans are mutually exclusive. The reasons for
the property of feasibility, it does not address this could vary. One possibility is that both plans
the other properties. Because we are focusing on could require the full utilization of a particular
business continuity, these considerations should be resource.
included in the design/development phase of the
process. Although phases 5 and 6 are often per- 3.2. DRP implementation and testing costs
formed separately and sequentially in practice,
they are not independent. The objective of testing For this problem we are required to develop a
the DRP is to determine whether the plan will DRP that protects a set of business functions from
execute according to the specied performance a specic set of disasters. Now each of the com-
levels if and when it becomes necessary. The test- ponent DRSP has associated cost of implementa-
ing of DRP is supposed to result in some degree tion, cost of testing, and time to test the DRSP.
of condence that the plan will execute success- Given that testing of a DRSP tends to disrupt
fully. There is no mechanism at stage 5 to integrate regular operations there is an interest in having the
some of the concerns at stage 6 in determining the total test time to be as small as possible. As usual
outcomes of stage 5. The mathematical model pro- there would be an interest in minimizing the total
vides a mechanism for eectively integrating con- cost (i.e. implementation cost plus test cost) of the
cerns at stages 5 and 6 so that at the end of stage 6, DRP. This problem thus involves the attempt to
the outcome will be at a higher degree of condence. ideally simultaneously minimize three objectives
(i.e. total implementation cost, total test cost, total
test time) in a manner that results in the DRP
3. A sample of outstanding DRP research problems having the feasibility, consistency, completeness
and reliability properties.
In this section we present an overview of three
DRP problems that could be suitably addressed by 3.3. Risk of lock out
mathematical modeling techniques. In the follow-
ing section we present a mathematical model for An o-site disaster recovery vendor has several
addressing the subplan selection problem. primary customers. There will be a number of
subsets of customer locations based on geograph-
3.1. Subplan selection ical proximity that will have simultaneous disaster
declarations from a storm, tornado, hurricane, etc.
Our aim here is to determine the resources that For other locations, disasters would occur at the
should be acquired in order to maximize the total customers sites independent of each other. Given
expected value of the recovery capability. In this that the demand for the resource is triggered by the
model it is assumed that for each disaster eect, occurrence of one of several causes (re, ood,
there is a set of disaster recovery subplans (DRSP) accidents, human error, plane crash, earthquake,
K.-M. Bryson et al. / European Journal of Operational Research 141 (2002) 679688 683

etc.), there is the risk of two or more customers eavg the minimum desired average of the reli-
requiring the site at the same time. That risk is ability measures for the selected set of
high if the disaster is a natural disaster (hurricane, subplans
tornado, etc.). The company needs to assess the wsj a binary parameter (0,1) whether subplan
risk of contracting with a given vendor. s provides recovery capability for eect j
vs a value measure ofPthe recovery potential
of subplan s, vs j2J wsj gj pj
4. A mathematical model of the subplan selection ys a binary variable that indicates whether
problem subplan s is acquired is selected
zr a binary variable that indicates whether
In this section, we present a mixed-integer solution resource r is acquired
model for the subplan selection problem (i.e. se-
lecting a group of subplans from a number of 4.1. The mathematical formulation
alternatives in order to establish the disaster re-
covery capability for the organization). X
Max ms ys 1
s2S
Notation
subject to:
K set of business functions X
cr zr 6 B; 2
R1 set of solution resources that occur in real r2R
quantities (e.g., time)
R2 set of solution resources that occur in in- X
ys 6 1; j 2 J; 3
teger quantities (e.g., equipment) s2Sj
R set of solution resources: R R1 [ R2
J set of disaster eects X
urs ys  zr 6 0; r 2 R; 4
I set of disaster types s2Sr
S set of recovery subplans
Sj set of subplans that can protect against X
es  eavg ys P 0; 5
disaster eect j s2S
Sr set of subplans that use resource r
Mq the qth set of mutually exclusive plans ys 2 0; 1; s 2 S; 6
Q a set of indices, 1; 2; . . . ; jQj
fij the likelihood of disaster type i having Zr > 0 and real; r 2 R1 ; 7
disaster eect j
ak the relative importance (or criticality) of Zr P 0 and integer; r 2 R2 : 8
business function k
hjk the likelihood that eect j would aect The objective of the model is to maximize the
business function k total value of the recovery capability of the set of
pj given a disaster has occurred, thePlikeli- subplans chosen. Constraint (2) is a budget con-
hood of experiencing eect j, pj i2I fij straint that stipulates that the cost of solution re-
gj the relative importance of a disaster eect source requirements for the selected subplans must
j based on P its potential business impact not exceed a specied budget limit. Constraint (3)
where gj k2K ak hjk states that at most one subplan from the set of
B budget limit primary plans for a given eect can be selected.
urs the quantity of solution resource r re- Constraint (4) is a logical constraint which allows
quired by subplan s the required solution resources for a selected sub-
cr the unit cost for solution resource r plan to be acquired. Constraint (5) ensures that the
es the reliability measure of subplan s average of the reliability measure for a selected set
684 K.-M. Bryson et al. / European Journal of Operational Research 141 (2002) 679688

of subplans exceed the minimum specied value indicates the likelihood of a given subplan
eavg . achieving its RTO. This measure can be estab-
lished by a careful analysis of the potential failure
4.2. Comments on the model points of a subplan.

4.2.1. Properties of DRPs 4.2.2. Description of a pre-processing procedure


The major desirable DRP properties of com- Determination of the relevant sets and param-
pleteness, feasibility and reliability would be ad- eter values can be done using a set of interaction
dressed both in the mathematical model itself and matrices (e.g. matrices A; B; C; D below). Below we
through pre-processing procedures such as de- describe a process for accomplishing this.
scribed in Section 4.2.2. In this model the feasi-
bility property is addressed in this model by Step 1:
constraints (2) and (4), the consistency property is Identify the relevant set of disaster types I.
addressed by constraint (4), and the reliability Identify the relevant possible disaster eects J.
property is addressed by constraint (5). For this This is done by identifying the target infrastruc-
particular DRP problem the completeness property tural and system resources that support each
is addressed in the rst four phases of the DRP business function (see Matrix A1). For each
development cycle that would precede the appli- such supporting target resource (e.g. computers,
cation of the mathematical model (i.e. vulnerabil- electric power lines, roads, personnel), identify
ity assessment, business impact analysis, denition the eects that each disaster could have on the
of detailed requirements, and development of al- target resource. Each X in the matrix corre-
ternate subplans), and also in the mathematical sponds to a disaster eect, but multiple X en-
model. A pre-processing procedure that would tries could correspond to the same disaster eect.
partly address the completeness property and also Cross reference the disaster types and the disas-
lead to the determination of relevant parameters is ter eects in Matrix B, providing for each cell
described in Section 4.2. an estimate fij of the likelihood of disaster i
In ascertaining the cost associated with the having disaster eect j.
subplans selected, we chose to compute total cost Cross reference the disaster eects and the Busi-
by costing out the individual resources. While it is ness Functions in Matrix C, providing for each
possible to cost individual subplans and thereby cell an estimate hjk of the likelihood of disaster
reduce the number of variables in the model, it eect j aecting business function k.
is highly likely that a number of resources are
sharable and may be double-counted if subplans Step 2:
instead of resources were costed out. For example, For each disaster eect j, generate a set of di-
two subplans calling for the use of a hard disk saster recovery subplans Sj that provide recov-
where it is unlikely that both subplans would be ery capability for disaster eect j.
activated at the same time, would account for the Cross reference the disaster eects and the disas-
purchase of two hard disks instead of one if cost ter recovery subplans in Matrix D, providing
is determined by subplans. The utilization of re- for each cell a binary value wsj that indicates
sources within subplans is measured in accordance whether disaster recovery subplan s provides
with the fraction of the time between escalation recovery capability for disaster eect j.
and restoration that the resource will be in use. For each disaster recovery subplan r, identify
This resource would incur a lease or purchase cost the set of solution resources required to execute
depending on the nature of the subplan (e.g., ex- the subplan.
ternal vs. internal hot site). Resources occur in the Cross reference the disaster recovery subplans
form of equipment, facilities, or manpower, and and the solution resources required to execute
can be purchased or leased. The reliability measure the subplan in Matrix E, providing for each cell
K.-M. Bryson et al. / European Journal of Operational Research 141 (2002) 679688 685

a value urs that indicates the amount of resource 4.3. Solution of the subplan selection model (PSM)
r required by disaster recovery subplan s.
A close examination of the PSM will show that
the model as a whole possesses no unique under-
Matrix A1: Business function (BF)/target resource lying constraint structure. There are multiple
(TR) association choice constraints (3) and (4), and knapsack con-
TR1 TR2 ... TRj straints (2) and (6), coupled by a logical constraint
BF1 X X (5). However, to exploit either of these groups of
BF2 X constraints, a signicant relaxation of the con-
BFk X straint set is required thereby causing a signicant
loss in model integrity. A further complicating
Matrix A2: Disaster type (DT)/target resource matter is that the model contains binary vari-
(TR) association ables and real and/or general integer variables.
TR1 TR2 ... TRj We, therefore, explored two heuristic approaches
DT1 X X X to the problem that make use of o-the-shelf
DT2 X solvers such as CPLEX.
DTI X Heuristic 1. The rst approach is to solve the
Matrix B: Disaster type (DT)/disaster eect (DE) original model using a standard branch-and-
association bound approach and terminate the procedure after
DE1 DE2 ... DEj DEjJ j a xed number of branches have been examined.
DT1 f11 f12 f1j The best feasible solution found is used as the
DT2 f21 f22 f2j solution to the problem. We will refer to this
DTI fj1 fj2 fij method as brute-force with termination (BFT).
DTjIj Heuristic 2. The second approach to the
problem involves a three-phase procedure. The
Matrix C: Disaster eect (DE)/business function idea is to attempt to reduce the size of the solu-
(BF) interaction tion space over which the original problem is
BF1 BF2 ... BFk BFjKj solved. Intuitively, this method would be use-
DE1 h11 h12 h1k ful if there are many alternative subplans for
DE2 h21 h22 h2k each eect, and when the number of variables is
DEj hj1 hj2 hjk large.
DEjJ j Each of the three phases represents a relaxation
Matrix D: Disaster recovery subplan (DRSP)/ of the original problem. Phase I determines a set of
disaster eect (DE) interaction subplans that minimizes the total cost of the se-
DE1 DE2 ... DEk DEjJ j lected subplans while ensuring that all eects re-
DRSP1 w11 w1k ceive coverage, and the reliability criterion is met.
DRSP2 w21 w2k We call this the minimum cost total coverage
DRSPs ws1 wsk model. Phase II selects a set of subplans which
DRSPjSj maximizes the total value of their recovery capa-
bility. Cost is ignored in this phase. We call this a
Matrix E: Solution resource (SR)/disaster recovery maximal value total coverage model. The optimal
subplan (DRSP) interaction set of subplans from phases I and II are combined
DRSP1 DRSP2 . . . DRSPs DRSPjSj into a single set. Let Y 1 and Y 2 be the optimal set
SR1 u11 u1s of subplans to Phase I and Phase II, respectively.
SR2 u21 u2s Dene U Y 1 [ Y 2 . The original problem is sub-
SRr ur1 urs sequently solved over the set U. The corresponding
SRjRj models are shown below.
686 K.-M. Bryson et al. / European Journal of Operational Research 141 (2002) 679688

Phase I: Minimum cost total coverage fects can be recovered by 15 alternative subplans.
X
MC : Min c r zr 10 Resource unit costs vary between $ 50 and $ 250.
r2R Utilization levels for a given resource in a given
subject to : subplan varies between .25 and 2.0. The value
X measures for recovery capability vary between 10
ys 1; j 2 J; 11 and 50. We consider scenarios, with 5, 10, and 15
s2Sj
eects. Resources for subplans are selected from a
49: set of 25 types in one case, and from a set of 50 types
Phase II: Maximal value total coverage in another. The number of resources per subplan
X are randomly sampled. Two cases are considered.
MV : Max ms y s 12
s2S
In one case, subplans possess between 1 and 5 re-
sources. In the second case, subplans possess be-
subject to : 4; 6; 7; 11:
tween 1 and 10 resources. A budget limit for the
Phase III: The restricted problem model is obtained as follows. For each eect, de-
X termine the cheapest subplan that can cover the
RP : Max ms ys 13
s2U eect. Determine the total cost value of these
subject to : 2; 8; 9; subplans and set the budget to a percentage of the
X total cost. A value is randomly sampled between
ys 6 1; j 2 J ; 14 55% and 75%.
s2Sj \U
X In generating the problem set, three key pa-
urs ys  zr 6 0; r 2 R; 15 rameters were varied: the number of eects (three
s2Sr \U levels), the number of resources types (two levels),
X
es  eavg ys P 0; 16 and the number of resources per subplan (two
s2U levels). A single problem in each category was
ys 2 0; 1; s 2 U: 17 generated resulting in 12 test problems shown in
Table 2.
Table 3 shows solutions for the LP relaxation of
4.4. Computational results the model, the three-phase heuristic, the BFT
heuristic, and the brute-force MIP solution of the
As mentioned earlier, there is a dearth of models model. CPLEX was used as the o-the-shelf sol-
addressing selection of disaster recovery subplans, ver, and no special tuning of the solver was done.
and so there is no standard set of test problems for The BFT heuristic terminates the solver after ve
this model. To test our model, we generate 12 hy- feasible solutions have been produced or when a
pothetical problems using a variety of parameter 20,000 iteration limit has been reached. From the
settings (see Table 1). Most of the parameters are results we see that the three-phase heuristic per-
generated using uniform distributions. Disaster ef- formed extremely well. In 11 cases the solution
obtained by the three-phase approach is veriably
Table 1 optimal. In problem 11, however, the methodology
Problem parameters provided the better of the two feasible solutions
Parameter Distribution with a duality gap of less than 2%.
Subplans per eect Uniform (1, 5)
Resource unit costs (cr ) Uniform (50, 250) 4.5. Computational and implementation issues:
Resource utilization (urs ) Uniform (0.25, 2)
Problem size and solution diculty
Subplan values (vs ) Uniform (10, 50)
Number of eects 5, 10, and 15
Number of resource types 25 or 50 The proposed mathematical formulation for the
Number of resources per Uniform (1, 5) and Uniform DRP requires data for various parameters in the
subplan (1, 10) following table and as indicated in the notation at
Budget limit (B) Uniform (0.55, 0.75)
the beginning of Section 4:
K.-M. Bryson et al. / European Journal of Operational Research 141 (2002) 679688 687

for the decision variables and do not aect the size


Set parameter Where used of the formulated problem. Therefore they do not
Set of business Incorporated into tech- pose any diculty in terms of solution methodol-
functions, K nological coecient ogy. The key parameters in terms of problem size
Set of solution Part of constraint set are as follows:
resources, R
Set of disaster Part of constraint set Set parameter Probable range Size of entity
eects, J of cardinality
Set of disaster Incorporated into tech- Set of disaster jJ j 525 Small business
types, I nological coecient eects, J to a large city
Set of recovery Part of constraint set Set of solution jRj 51000 Small business
subplans, S resources, R to a large city
Set of recovery jSj 3100 Small business
Most of these data will be estimated and are re- subplans, S to a large city
quired to compute the technological coecients
The parameters that translate directly into
constraint types are the sets J, R, and S. The
Table 2 ranges of probable cardinality values for these sets
Problem characteristics
are dependent on the granularity of the denition
Problem No. of No. of No. of
of the disaster eects for these disaster types and
number eects resources resources
per subplan the size of the organization or entity to be covered
by the plan. This granularity will determine the
1 5 25 15
2 5 25 110 solution resources and the scope of the subplans
3 5 50 15 for risk mitigation and/or disaster recovery. If a
4 5 50 110 subset of disaster eects calls for identical set of
5 10 25 15 resources then those eects can be aggregated into
6 10 25 110
a single eect. Also a large number of subplans,
7 10 50 15
8 10 50 110 depending on the size of the organization, will
9 15 25 15 likely include plans that are redundant since other
10 15 25 110 plans will cover the same set of eects. The lower
11 15 50 15 limits of these ranges indicate a subjective deter-
12 15 50 110
mination of the size of the problem for small

Table 3
Results of the three-phase heuristic
Problem no. LP relaxation Three-phase heuristic BFT heuristic MIP optimal
1 2047 1767 1767 1767
2 2047 1767 1767 1767
3 2047 1956 1956 1956
4 2047 2047 2047 2047
5 4437 4437 4437 4437
6 4437 4437 4437 4437
7 4437 4437 4437 4437
8 4437 4437 4437 4437
9 6043 6043 5763 6043
10 6043 6043 6043 6043
11 6043 5977 5697 n/a
12 6043 6043 6043 n/a
688 K.-M. Bryson et al. / European Journal of Operational Research 141 (2002) 679688

business organizations, which could be solved by plans and considering various types of cost func-
inspection or without expensive computational tions (linear, convex, concave, etc.) for subplans,
tools. The largest realistic problem anticipated by economic issues can be given more realistic con-
our formulation will have about a thousand con- sideration in designing a cost-eective recovery
straints, but the size of most problems will likely strategy.
be in the range of a hundred. There are tools that
can handle a million constraints, and a thousand
References
constraints will not present a computational chal-
lenge for most tools, and the heuristic three-phase Bucholz, C., 1997. Safeguarding data from disaster. Telephony
procedure proposed in this research, further di- 232 (7), 38.
saggregates the problem and provides a realistic Carson, B., 1997. Ten vital steps to save your C/S system from
approach to deriving an optimal solution. disaster. Datamation 43 (2), 123126.
CPLEX Callable Library, CPLEX Optimization Inc., Incline
Village, NV, USA.
Dryden, P., 1997. Cheyenne rides to windows NTs rescue.
5. Conclusion Computerworld 31 (8), 10.
Howard, L., 1997. Time is of the essence, disaster pro says.
In this paper, we have shown how MS/OR National Underwriter, 1314.
modeling can be used to provide strategic decision Jackson, J., 1997. Give your lan a hand. Security Management
41 (8), 4452.
support for DRP selection. We have presented a Jenkins, L., 2000. Selecting scenarios for environmental disaster
new model for selecting subplans in building a planning. European Journal of Operational Research 121
DRP/DRS that addresses the concerns of feasi- (2), 275286.
bility, consistency and completeness. The objective Levitt, A.M., 1997. In: Disaster Planning and Recovery: A
of the model is to maximize the total value of the Guide For Facility Professionals. Wiley, New York, p.
1997.
coverage provided by the set of selected subplans Merrill, K., 1997. Ontrack expands service to VARs. Computer
subject to several constraints. The model, which Reseller News 721, 5359.
contains, real, binary, and general integer vari- Pidd, M., deSilva, F., Eglese, R., 1996. A simulation study for
ables can be solved using a variety of methods. In emergency evacuation. European Journal of Operational
Research 90 (3), 413419.
this paper we used the o-the-shelf solver called
Sarker, B., Mahankali, S., Mann, L., Triantaphyllou, E., 1996.
CPLEX to solve a number of hypothetical prob- Power restoration in emergency situations. Computers and
lems using both optimal and heuristic approaches. Industrial Engineering 31 (1/2), 367370.
The results demonstrate that reasonable solutions Sclafane, S., 1996. Internet growth spurns disaster recovery
can be found in reasonable time. Recognizing that service. National Underwriter, 3233.
little modeling of disaster recovery issues has taken Tamura, H., Yamamoto, K., Tomiyama, S., Hatono, I., 2000.
Modeling and analysis of decision making problem for
place to date in MS/OR literature, our model mitigating natural disaster risks. European Journal of
represents a forward step in providing what is a Operational Research 90 (3), 461468.
fast growing discipline with rigorous models for Tevis, T., 1996. Reducing the cost of distributed data recovery
supporting decision making. Consequently, our using ADSM. Computer Technology Review 278-9647, 48
51.
contribution is prescriptive rather than descriptive
Torode, C., 1997. A recovery bonanza. Computer Reseller
in nature. The model can also be expanded to in- News 748, 6566.
clude operational costs by allowing a temporal Violino, B., 1996. Serious security. Information Week 607, 107
dimension. By using 35 year life cycles for sub- 108.