Protection against loss or corruption of data upon switchover of a replicated system

In a protection-switching arrangement, each optical output of replicated switching nodes (12,13) is connected to the input of an error detector (17,18) and of an optical delay line (19,20); their outputs are in turn connected to inputs of an optical AND gate (21,22). The error detector generates an error signal when it detects error in data at the connected output. The error signal causes the connected AND gate to block signals incoming from the connected delay line. The delay line is sized to ensure that the connected AND gate, when responding to an error signal, blocks signals whose error status is represented by that responded-to error signal. AND gates whose inputs are coupled to like outputs of the switching nodes have their outputs connected to inputs of an optical OR gate (23). The OR gate combines signals received at its inputs into a single signal at its output. The switching nodes may be replaced by computers, transmission lines, or other replicated signal-handling elements.

TECHNICAL FIELD 
The invention relates to communications in general, and particularly 
relates to fault-tolerance of communication arrangements in digital 
optical systems. 
BACKGROUND OF THE INVENTION 
In diverse technical areas that rely on reliable communication of signals, 
such as telephony and data transmission and switching, data processing, 
and process control, it is common to duplicate--or even more extensively 
replicate--system components (e.g., control units, circuit packs) in order 
to achieve fault tolerance, and hence reliability. 
The replicated components typically operated either in active mode (all 
components are simultaneously operating in the same state and using the 
same inputs), or in "hot" standby mode (all components are powered up, but 
are not necessarily in the same state nor using the same inputs), or in 
"cold" standby mode (the non-active components need not be powered up). 
When using standby components, some form of testing of the active 
component, or error detection in the data stream(s) processed by the 
active component, is typically used to determine when a switch of system 
output (a "protection switch") should be made from the active component to 
a standby component. Irrespective of whether the standby component is hot 
or cold, however, the switching action conventionally results in a time 
period during which data is corrupted. 
Alternatively, having the replicated components operate in synchronized 
active mode can prevent data corruption if three or more components are 
used (e.g., by "voting" to determine the system output). However, having 
such redundancy has other problems. These problems include the cost of the 
extra component(s), increased probability of internal failure (because 
there is more equipment to fail) and the associated increased maintenance 
cost, and the extra space and wiring required to accommodate the extra 
component(s). Therefore, it would be advantageous to have an arrangement 
which would use only two replicated active components, but which would 
retain the ability to prevent data corruption. 
Additionally, arrangements such as voting, which operate on the possible 
output signals themselves in order to determine which one should become 
the system output, introduce the possibility that the arrangements 
themselves will corrupt the output data which they are intended to 
safeguard. 
Digitized voice is relatively tolerant of data corruption. And for 
low-speed data, if the time during which data is corrupted as a result of 
protection switching could be made less than a bit time, either error 
correction schemes or error detection combined with minimal retransmission 
could be used effectively to prevent corruption. However, for high-speed 
data, protection switching causes burst errors which make correction 
schemes impractical and detection schemes less reliable. Further, these 
burst errors may last long enough to corrupt the data of more than one 
user. If a burst error is not detected, myriad problems arise. Even when a 
burst error is detected, retransmission is needed, and it typically must 
be invoked either manually or by higher layers of data protocol. Thus, 
with a grade of service that allows error bursts caused by protection 
switching, upgrading of the equipment to operate with the protocol options 
that automate retransmission would normally be required. This may be very 
costly for high-speed data systems. Also, retransmission following a 
protection switch may cause temporary overload conditions. For these 
reasons, the prevention of data corruption rather than the mere curing of 
corrupted data is more desirable for high-speed data switching 
communication services. 
SUMMARY OF THE INVENTION 
This invention is directed to solving the data corruption problems of the 
prior art while offering the option of having duplicated--as opposed to 
more extensively replicated--components. According to the invention, 
functionally-replicated components that operate on a common input signal 
are monitored for the occurrence of malfunction and, at the same time, 
their output signals are delayed for the period of time spent in checking 
for a malfunction. The delayed output signals are used to generate a 
signal system output signal. But if a malfunction is detected, the delayed 
output signal which is affected by the malfunction is prevented from being 
used to generate the system output signal. 
Specifically according to the invention, an arrangement is provided for use 
with replicated signal-handling components--be they transmission links, 
switching nodes, processors, or any other equipment--which eliminates the 
previously-described corruption of output. The arrangement uses either an 
error detection mechanism connected to the outputs of the signal-handling 
components to detect errors in the output of any of the components, or a 
fault detection mechanism connected to the components themselves to detect 
faulty operation of any of the components. The preferred implementation 
employs error detection on the outputs, as this will detect not only the 
effects of faults, but also other errors such as noise-induced transient 
errors, and because the time it takes to detect an error is typically 
small. For purposes of this application, both faults in components and 
errors in component outputs will be subsumed in the term "malfunction." 
The malfunction detection mechanism generates a malfunction signal to 
indicate detection of a malfunction as any of the signal-handling 
components. 
A signal delay arrangement is connected to the outputs of the 
signal-handling components. The delay arrangement receives the output 
signals of the components and outputs them following a delay of time 
sufficient for the malfunction-detection mechanism to detect a malfunction 
and to generate the malfunction signal. A system ouput signal generating 
arrangement is connected to the delay arrangement to receive therefrom the 
delayed output signals. The generating arrangement outputs a system output 
signal which correspon to at least one of the received delayed signals. 
However, the generating arrangement responds to the malfunction signal to 
output a system output signal which corresponds only to received delayed 
signals which are not affected by the malfunction. That is, the 
malfunction signal serves to block a delayed output signal which is 
affected by the detected malfunction from being used in generating the 
system output signal, while the delay arrangement provides sufficient time 
for the malfunction to be detected and the requisite blocking to commence. 
The above characterization makes clear that no output information is 
corrupted or lost as a result of the output of one or more of the 
replicated components becoming faulty and system output switching, as a 
consequence, to being based on non-faulty outputs. No loss or corruption 
results because the output signal delay introduced by the delay 
arrangement equals or exceeds the time needed to detect the error 
condition and to effect the blocking of the errored signal. Furthermore, 
the signals on which the system output will be based are not directly 
operated on by the malfunction-detection mechanism, but are propagating 
through the delay mechanism while malfunction detection occurs. Hence, the 
arrangement is not likely to itself be a corruptor of the system output. 
To further limit the possibility that the arrangement itself would bring 
about failure of a system that uses it, it is desirable to make as many 
parts thereof as possible out of passive elements. The signal delay 
arrangement and the system output signal generating arrangement are 
particularly suited for implementation from passive parts, particularly 
from passive optical parts. For example, the delay arrangement may 
comprise lengths of optical fiber, and the generating arrangement may 
comprise optical AND gates (e.g., transphasors), for selectively 
passing-through or blocking component output signals. The outputs of the 
AND gates may further be combined into a single output by means of an 
optical OR gate (e.g., a coupler) or another optical AND gate. 
These and other advantages of the present invention will become apparent 
from the following description of an illustrative embodiment of the 
invention considered together with the drawing.

DETAILED DESCRIPTION 
FIG. 1 illustrates the invention within the context of a communication 
switching system 10. As is conventional, system 10 comprises a plurality 
of switching stages 11 arranged in a switching matrix. An illustrative 
system of this type is the fast packet switching system disclosed in U.S. 
Pat. No. 4,484,326. 
Switching stages 11 are all the same. Each includes a switching element 12. 
For reliability purposes switching element 12 has been duplicated in this 
illustrative example. Each stage therefore includes two switching elements 
12 and 13. Both elements 12 and 13 are normally active at the same time. 
The switching elements are conventional, each illustratively being a 
packet switching node such as is disclosed in the aforementioned patent. 
Signal link 14, which carries input signals to a stage 11, is connected to 
the inputs of each element 12 and 13. In this illustrative example, stage 
input signal link 14 is an optical link carrying optical signals, whereas 
elements 12 and 13 are electrical signal-switching elements. Hence, link 
14 is interfaced to the input of each element 12 and 13 by an 
optical-to-electrical signal converter 25. Such converters are well known 
in the art. 
Each element 12 and 13 has two outputs. The outputs are treated 
identically--they are each connected to identical apparatus--and hence the 
connection of only one output will be discussed, with the understanding 
that the connection of the other output is the same. 
First outputs of elements 12 and 13 are connected to element output links 
15 and 16, respectively. In this illustrative example, links 15 and 16 
also are optical links. Hence, they are interfaced to the outputs of the 
respective elements 12 and 13 by electrical-to-optical signal converters 
26. Such converters are well-known in the art. Each link 15 and 16 is 
connected to the input of a respective error-detection circuit 17 and 18, 
and to the input of a respective delay line 19 and and 20. Error-detection 
circuits 17 and 18 may be any desired error-detection circuits. Many error 
detection schemes and circuits for implementing them are known in the art. 
For example, a parity error checker may be used to advantage for this 
purpose. 
Links 15 and 16 are typically electrical links coupled directly to inputs 
of electrical circuits 17 and 18, and indirectly--via 
electrical-to-optical conversion circuits 26--to inputs of delay lines 19 
and 20. However, for purposes of speed and reliability, it would be 
preferable to have circuits 17 and 18 be optical circuits. In such an 
arrangement, links 15 and 16 would be optical links, connected directly to 
the inputs of circuits 17 and 18. Should electrical circuits 17 and 18 be 
used in conjunction with optical links 15 and 16, the links would be 
coupled to the inputs thereof by means of optical-to-electrical conversion 
circuits such as circuits 25. 
For reliability purposes, delay lines 19 and 20 are passive optical delay 
lines, such as lengths of optical fiber. The delay of lines 19 and 20 is 
determined by the time needed to detect an error at circuits 17 and 18 and 
effect blocking of the errored signal at gates 21 and 22. For example, for 
links 15 and 16 operating at a data speed of 155 Mbps, using parity for 
error detection on 32 bit words, with a gate speed of approximately 0.01 
usec, the delay is about 0.3 usec, or about 150 feet of optical fiber. 
The outputs of delay lines 19 and 20 are connected to first inputs of 
optical AND gates 21 and 22, respectively. Second inputs of gates 21 and 
22 are optically connected to outputs of error-detection circuits 17 and 
18, respectively. The outputs of gates 21 and 22 are connected to inputs 
of an optical OR gate 23. The output of gate 23 is connected to a stage 
output signal link 24. link 24 is an optical link like stage input signal 
link 14, and gates 21-23 are optical elements known in the art. 
The operation of a switching stage 11, illustrated by the timing diagram of 
FIG. 2, is as follows. Signals--e.g., speech or data--in digital form are 
conducted by stage input signal link 14 to both switching nodes 12 and 13. 
Both nodes switch the incoming signals to one of their 
outputs--illustratively their first outputs--from whence the signals are 
conducted by element output links 15 and 16 to error-detection circuits 17 
and 18 and delay lines 19 and 20, respectively. The outputs of nodes 12 
and 13 are designated in FIG. 2 as input signal 1 and input signal 2, 
respectively. While the signals are passing through delay lines 19 and 20, 
error-detection circuits 17 and 18 process the received information to 
determine if an error therein has occurred, illustratively as a result of 
a malfunction in the switching elements 12 and 13, and generate signals 
indicative of the determination. The error signals generated by circuits 
17 and 18 are designated in FIG. 2 as error signal 1 and error signal 2, 
respectively. 
During the time that no error is found, both error-detection circuits 17 
and 18 generate error signals enabling the associated gates 21 and 22 to 
pass-through signals received from the associated delay lines 19 and 20. 
The delayed signals output by delay lines 19 and 20 are designated in FIG. 
2 as delayed signal 1 and delayed signal 2, respectively. When an error 
occurs, illustratively at point 200 in FIG. 2, it takes some time before 
its occurrence is detected. This time is designated at T 201 in FIG. 2. 
When the error is found, illustratively by error-detection circuit 17, it 
generates an output signal disabling the associated gate 21 from 
passing-through the received information, thereby causing the associated 
gate 21 to block the received information. The signals output by gates 21 
and 22 are designated in FIG. 2 as output signal 1 and output signal 2, 
respectively. Delay lines 19 and 20 are sized to delay information input 
thereto for the operating time of circuits 17 and 18, so that the output 
signals of circuits 17 and 18 arrive at gates 21 and 22 either at the same 
time as or ahead of the information whose error status they represent. 
This delay time is designated in FIG. 2 as T 202. 
The signal streams output by gates 21 and 22 are combined into a single 
signal stream by gate 23. If no error is detected by circuits 17 and 18, 
the signal streams output by gates 21 and 22 are identical, so the 
combined signal stream output by gate 23 is a duplicate of each of its 
component signal streams. If an error is detected by circuit 17 or 18, the 
corresponding signal stream is blocked by the associated gate 21 or 22, 
and the signal stream output by gate 23 is a duplicate of the remaining, 
error-free, signal stream input to gate 23. The signal output by gate 23 
is designated in FIG. 2 as a combined output signal. When an error in the 
output of one of the switching elements 12 and 13 is detected and the 
corresponding signal stream is blocked, at no time is the signal stream 
output by switching stage 11 interrupted, lost, or otherwise corrupted 
thereby. 
Of course, it should be understood that various changes and modifications 
to the illustrative embodiment described above will be apparent to those 
skilled in the art. The changes and modifications can be made without 
departing from the spirit and the scope of the invention and without 
diminishing its attendant advantages. It is therefore intended that all 
such changes and modifications be covered by the following claims.