Why mainframe migrations fail

And the mechanism that makes ours falsifiable

Provecta - provecta.dev

Every documented mainframe migration failure has the same shape: the new system was judged by inspection, and the first machine-checked test happened on production, in front of customers. This paper maps the named failures to the mechanisms Provecta ships, so the claim is concrete: each of these would have failed our gate before cutover, not after.

1. TSB, 2018: validated by inspection, fined by regulators

A UK bank's core migration locked 1.9 million customers out of their accounts for weeks, required over GBP 360 million of remediation, and ended in a GBP 48.65 million regulator fine. The post-mortems (IBM's findings, the Slaughter and May report, the FCA fine) agree on the root cause: the migrated system was tested for function, never proven for equivalence. Behaviour was checked by eye and by sampling.

The Provecta mechanism: acceptance is mechanical, not inspected. Every migrated job must reproduce its legacy reference output byte for byte, across the full corpus, enforced on every run. A system with TSB's defect profile fails the validator in the test environment - where a failure costs an afternoon, not a regulator.

2. KCB, 2024: wrong balances are a data-fidelity failure

Kenya Commercial Bank customers overdrew accounts by USD 7.7 million during a migration whose glitches produced incorrect balances. The failure class is numeric: somewhere between the legacy and the new system, money stopped being exact.

The Provecta mechanism: money travels as integer cents end to end - no float drift, by construction - and the output contract is byte-level: field values, totals, ordering, formatting. The validator would have flagged the wrong-balance outputs the first time they were produced, with a diff naming the account and the cents.

3. Suncorp: the multi-year write-off

Suncorp's core system replacement was finally junked after years, leaving a AUD 90 million crater. Big-bang platform replacement compounds risk: every job must work before any job ships.

The Provecta mechanism: migration is per job, not per platform. Each function carries its own byte-exact proof and its own cutover, so a failing function is found and bounded early. Nothing about the approach requires a big-bang date to be survived.

4. Westpac: when the brake is the strategy

Westpac slammed the brakes on a core system change rather than ride it into production - the rational response to a migration whose risk cannot be measured. The brake is expensive, and it is what every team does when the only verification tool is judgement.

The Provecta mechanism: risk becomes measurable. Dual-run shadowing reconciles legacy and target outputs continuously, and every function is reversible until its decommission order is signed. Teams get evidence to decide with, instead of a brake to pull.

5. The industry odds, and the disciplines that beat them

Gartner's much-cited forecast - 70% of mainframe-exit efforts failing or being abandoned (summary) - is the aggregate of the cases above. The known-good disciplines that reduce the odds are documented independently: dual-run risk control and semantic equivalence testing. Provecta productises both, and adds the part the industry does not publish: the byte-exact validator as the standing acceptance criterion, plus the correctness contract (float drift, look-ahead leakage, and non-idempotence are refused, not cautioned against).

6. The honest other side: staying is also failing

The failure case on the stay side is measured too: legacy systems cost the US at least USD 40 billion during Covid, and COBOL-era unemployment systems delayed benefits for the people who needed them most. Inaction has a price; the Provecta answer to that price is the profiling step: measure the estate, then choose the target state on evidence.

The falsifiable claim

Every failure above was discovered by customers or regulators. Ours would be discovered by a test run, because the acceptance criterion is a comparison of bytes, not a comparison of confidence. That is the entire argument: proof, not percentages - and the proof is falsifiable on your hardware, before cutover.

Sources are linked inline and cited in the Evidence Annex. Figures are the named cases' published numbers, not Provecta estimates.