Robust, collateral messaging and recovery system and method within a digital switch

Abstract: System and method are disclosed for collateral out-­ of-band messaging within the distributed data processing environment in a digital switch which has mainstream in-­ band data channels. The system comprises independent reset modules, which decode and recognize the out-of-­ band messages to effect emergency control functions of the distributed processors, such as resetting and jamming an insane processor.

Description: BACKGROUND OF THE INVENTION Field of the Invention The present invention relates to digital switching systems, such as voice and data switches, in general, and in particular to those systems employing plural processors for control in a distributed switching environment. It has application to a quasi-independent system and method within the digital switch for surveillance, messaging and limited control of the distributed plural system units. General Prior Art of the Invention The general prior art digital time division switching system exhibits a hierarchical, two-plane organization comprising duplicate central controllers (CC) at the top, followed by central message controllers (CMC) then by the network modules (NM) proper as well as input-output controllers (IOC). This general architecture is also that within which the system and method of the present invention will typically operate operate. Such prior art system is disclosed in United States Patent 4,213,201 granted July 15, 1980 to Gagnier et al, which is incorporated herein by reference. A useful general overview of this category of switching systems is given in an article by Robert Wood entitled "DMS-100 technology evolution", at page 6 in Telesis, Volume 10, Number 3, 1983. SUMMARY OF THE INVENTION In the above-referenced United States patent to Gagnier et al, the system units are rigidly controlled by the central controller (CC). For example, the central message controller (CMC, Figure 14) has a limited number of well defined states without independent processing capability. In the course of technological evolution, however, a digital switching system now exhibits distributed processing, and a message switch (MS) has its own processor and its own firmware and software. The same is true of the switching network modules (NM). Distributed processing in switching systems therefore means a larger number of processors which, if the high level of reliability is to be maintained, means that each single processor must be capable of being disabled and/or reset with a very high degree of reliability in the event it ceases to be operationally sane. There is proposed, in IEEE International Conference on Communications '86, Conference Record Volume 2 pages 1111 to 1114 "A Distributed Architecture Line Concentrator", a switching network in which, if a main unit detects the failure of a module, it sends a command to disconnect the module. Initially, command is sent to the module using CCITT No. 7 common channel signalling. If the module does not react to this command it is repeated on channel 0 as a specific bit pattern and is received in the module by a simple hardware unit independent of the processor. Acccording to the present invention there is provided a messaging sytem according to claim 1 and a messaging method according to claim 10. The remaining claims set out optional features. An embodiment of the present invention provides collateral control messaging that is independent on the main messaging system and which operates outside of processor control system modules of the same level in the switch hierarchy. Of course, each level remains dependent on the operational integrity of the level above it, and the whole depends on the sanity of the computing module (CM) at the head of the hierarchy. (The number of levels that may be controlled can be expanded, within a level and in the number of levels). Since every single level has two planes or duplicate modules, and the system is operational with only one plane, operational reliability is in fact very high. BRIEF DESCRIPTION OF THE DRAWINGS The preferred embodiment of the present invention will now be described in detail in conjunction with the annexed drawings, in which: Figure 1 is a block diagram of the digital switch embodying the system and method of the present invention; Figure 2 is a block schematic of the reset module of the embodiment shown in Figure 1; Figure 3 is a block schematic of the receiver portion of the block labelled R/T in Figure 1; Figure 4 is a block schematic of the transmitter portion of the block labelled R/T in Figure 1; and Figure 5 is a flow-chart for the out-of-band data filtering function performed by the processor in the reset module in Figure 2. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT With reference to figure 1 of the drawings, the digital switching system shown comprises three duplicated (planes 0 and 1) hierarchical components: computing module (CM) 10 and 11; message switches (MS) 12 and 13; and network modules (NM) 14 and 15; (as mentioned earlier, more depth and width are possible). The computing modules 10 and 11 are identical 32-bit processor based control modules, which operate synchronously and continuously, even though only one of the two CMs 10 and 11 has control of the switch at any given moment. Control of the switch shifts without interruption from one of the CMs 10 and 11 to the other, either at the instance of a human operator via one of video terminals (VDT) 16 and 17, or automatically by software, or should the CM in control lose sanity. While only one of the CMs 10 and 11 is in control at anytime, the message switches (MS) 12 and 13 are both operating simultaneously, and serve primarily as a conduit for 8-bit in-band (IB) messaging from the controlling CM 10 or 11 to the network modules (NM) 14 and 15, both of which also operate simultaneously. The MSs 12 and 13 also relay in-band control messages to peripheral in-output controller (IOC) 18, which is shown controlling back-up data storage device 19, which in turn may contain the switching system image data necessary to reboot the system should catastrophic collapse have occurred. The NMs 14 and 5 interface with the end users of the switching system, shown here as two subscriber station sets 20 and 21, through line modules, (LM) 22 and 23. The CMs 10 and 11, the MSs 12 and 13, the NMs 14 and 15, as well as the IOC 18 communicate by means of receiver/transmitter modules (R/TM) 24 to 41. For example, R/TM 24 is interconnected with R/TM 26 in MS 12 and with R/TM 27 in MS 13. In the preferred embodiment, an R/TM is an optical receiver/transmitter and the interconnection between R/TMs is via optical fiber links of up to 1 km in length, which carry serially multiplexed data at the rate of 49.152 MHz. The remaining module in figure 1, namely the reset module (RM), is the key component in the collateral messaging and recovery system of the present embodiment Each of RMS 42 to 47 is at its controlling output in direct control of the central processing unit (CPU) of the associated CM, MS or NM, each of which has a CPU pursuant to the distributed processing architecture. It is outside the scope of the present invention to consider the internal details of the computing module, the message switch or the network module, except to know that each has a CPU which can be reset and disabled by means of a hard-wired lead from the associated reset module (RM). The reset module (RM) is shown in block detail in figure 2. It comprises a microprocessor 50 (for example, INTEL'S 8031), which is reset every 24 seconds by a sanity reset clock 51 for reliability, unless the clock is inhibited under certain conditions. EPROM and RAM memories 52 store firmware and data. An out-of-band (OOB) data shift and latch interface 53 receives demultiplexed messaging data bits from the respective receiver of R/TMs of the 0 and 1 planes. These messaging data bits convey the commands in the collateral messaging and recovery system and are termed out-of-band (OOB) data because they are not part of the in-band (IB) 8-bit data words that pass between the CM and the NM through the message switches 12 and 13. The data bits travel between R/TMs in 10 bit words. Eight of these bits (In-Band) are under control of the main distributed processors. The two remaining bits may not be altered in their route to the destination RM. One of these is the OOB bit (link) and the other is a spare. The OOB data is multiplexed and demultiplexed into the data stream between system modules at the R/T modules (as shown in figures 3 and 4). This is necessary in order to maintain reliability of communication of commands within the collateral messaging system. The R/T modules are strictly hardware modules, which are duplicated and multiplex/demultiplex identical data streams throughout the switching system. A dual UART 54 (for example, INTEL'S 82530) serves as interface with the video terminal and a remote link modem if the RM is attached to a CM, such as in the case of RMs 42 and 43. Finally, a CPU interface 55 interfaces the processor 50 to the CPU of the associated CM, MS or NM, as the case may be. The interface 55 also has an ID PROM which stores a label identifying the RM. There is also information available indicating whether it is attached to a CM, MS or NM, and whether in plane 0 or 1. The processor 50 performs, besides its general control functions, a software filtering function on the OOB data to ensure its legitimacy. This will be described later in conjunction with figure 5, when describing the operation of the collateral messaging system. Turning now to figure 3, the receiver portion of the R/T module is shown. The optical fiber enters fiber hybrid 60 where the received optical signal is output to a receive fiber interface 61, the outputs of which are the in-band message bits and the OOB serial data. The latter is converted to parallel data in serial/parallel converter 62 and latched onto the processor-bus (P-BUS) in the computing module 10 or 11, but is used for maintenance only. The serial OOB data is supplied to either the 0 or 1 inputs of the RM, shown in figure 2, via selection switch 64, depending on which plane the R/T module is connected to. Thus, each RM receives two inputs (identical under normal operation) of OOB data, one from the 0-plane and one from the 1-plane. Figure 4 shows the transmitter portion of the R/T module. The OOB data is supplied by the processor of the CM or MS onto the processor-bus and is latched in latch 70 into parallel/serial converter 71 then to transmit fiber interface 72 and onto the fiber via the hybrid 60. It should be understood that OOB data is generated by the processor of the CM (10 or 11) for transmission to the next level in the hierarchy, i.e. to the MSs 12 and 13, which are in turn responsible for transmission to the level below, i.e. the NMs 14 and 15. The MS will output OOB messages only on instructions from the CM. This makes the OOB data transmission dependent on the sanity of the controlling processor, be it in the CM or MS. There is, however, no detriment to reliability of the collateral messaging system, because if both CMs 10 and 11 were to be inoperative, the whole switching system would be inoperative anyway. The same is true if both MSs 12 and 13 were to become inoperative. The fate of received OOB data, however, is different; a reset module, for example RM 45, would still be able to disable or reset its associated MS 13 if it receives a valid OOB command from either of the CMs 10 and 11 via one of the R/T modules 37 and 39. The processor in the CM 10 or 11 on the other hand cannot be disabled or reset by OOB commands, and only an operator can do so via the VDT terminals 16 or 17. In fact, under normal operation, the RMS 42 and 43 attached to the CM are transparent to data emanating from the VDT terminals 16 and 17. These and associated details will be better understood in the context of the following description of the method of collateral messaging of the present system. As long as the switching system is operating properly, the messaging and recovery system of the present embodiment operates in a strictly transparent monitoring mode. If, for any reason, the switching system crashes, an operator must first bring up the master CM (either 10 or 11) by means of the respective VDT and associated reset module (16/42 or 17/43). Thereafter the master CM is used to reset and reboot the message switches 12 and 13, and if necessary the network modules 14 and 15 are also reset by MSs 12 and 13. As mentioned above, the recovery messaging proceeds by the collateral out-of-band links which cannot be perturbed by the crash of any of the distributed processors so that the reset commands would not pass through to the insane processor. In the preferred configuration as shown in figure 1 only the reset modules 42 and 43, attached to the computing modules 10 and 11, respectively, have VDT terminals 16 and 17. The reset module is transparent and passes characters back and forth between the VDT and the CM until a designated command character is entered (normally "\") which then causes the reset module to go into command collection mode. Characters are then collected in a 16-bit buffer; for example, in order to reset the CM, the following command is entered: \BOOT <cr>, where <cr> is the enter key. The firmware of the reset module will request YES/NO confirmation, and when confirmed YES a reset pulse will be output through the CPU interface 55 and the reset module will display BOOT INITIATED on the VDT. The following are operational codes and parameters of example commands supported by the system: Any of the commands that may be entered on the VDT may also be entered by the processor in the CM. It is possible in this way for the CM to initiate its own reset (for example, after unsuccessful attempts at reloading) and the following exchange will take place between the CM and the RM. During the last sequence of the exchange the reset pulse has been applied by the CPU interface 55 to the processor in the computing module. Thus, the CPU has caused itself to be reset. The OOB data links from the CM and the MS into the lower level reset modules are unidirectional. There are two OOB links terminating on each reset module, one from each plane of the CM or the MS. The command codes used to force control over a subsystem component are sent over the OOB links and are detected and acted upon by the reset module. In principal, any of the commands which may be entered from the VDT may be sent by the OOB links. A command consists of three bytes; a synchronization character, an operation code, and a parameter code. Each byte is proceeded by an idle code. Where YES/NO confirmation of a command is required, it must follow. Since each byte is sent for 200 ms, the worst case time for a command with confirmation is 2.4 seconds. The multiplex optical transmission links between the RT modules carry 512 in-band channels during 125 us frames. An OOB byte is transmitted 4 times within a single frame and persists for at least 200 ms. The reset module samples the OOB data supplied to it by the RT module once every 1 ms. The OOB data received by the reset module is filtered before accumulation by the firmware routine shown in figure 5 in flow-chart form. As a result, the threshold for the processor 50 to begin paying attention to the incoming OOB bytes is that the last 3 bytes received must be the same; after 16 identical bytes the software recognizes the byte as legitimate and stores it. The received sequence of a legitimate command must be as follows: Where 7F is the hexadecimal figure representing the idle code.

Claims: A messaging system operating within a distributed data processing system having a plurality of component modules, each said component module communicating with other component modules by passing communication messages through data links, the plurality of component modules comprising a plurality of controllable modules, each said controllable module including a controlling data processor and the system being characterised by comprising: (a) means in a plurality of said controllable modules for transmitting through one of said data links an encoded control message independent of said communication messages; (b) means (26-39) in each said controllable module for extracting from said one of said data links said encoded control message independent of said communication messages; and (c) message decoding means (44-47) in each controllable module, having a hard-wired link to the controlling data processor of the controllable module, for recognising and decoding said encoded control message and determining whether to reset or disable the controlling data processor over the hard-wired link in accordance with said encoded control message. A system according to claim 1 in which the means in a controllable module for transmitting an encoded control message comprises the controlling data processor of the controllable module, the system being structured so that the controlling data processor of a superordinate controllable module can cause resetting or disabling of the controlling data processor of a subordinate controllable module. A system according to claim 1 or claim 2 in which the means (26-39) for extracting said encoded control message comprises means (64) for receiving, storing and forwarding component bits of said encoded control message transmitted in at least two predetermined and independent bit-positions one each on two independent ones of said data links. A system according to any one of claims 1 to 3 in which the message decoding means (44-47) stores a label for identifying the location of the message decoding means within said distributed data processing system. A system according to claim 4, in which the message decoding means (44-47) further comprises a programmable local data processor (50) for applying a software filtering operation to the component bits of said encoded message. A system according to claim 5, in which said programmable local data processor controls the resetting or disabling of the controlling data processor over the hardwired link in accordance with the encoded control message after said software filtering operation. A system according to claim 5 or claim 6 in which the message decoding means (44-47) further comprises sanity reset means (51) for continuously periodically resetting said programmable local data processor (50) unless inhibited. A system according to any one of the preceding claims comprising a message decoding means (42, 43) in a said component module (10, 11) which message decoding means further comprises an asynchronous receiver-transmitter (54) for relaying said encoded message to an input/output terminal of said distributed data processing system. A system according to any one of the preceding claims in which said distributed data processing system comprises a master computing module (10, 11) controlling a plurality of telephone switching network modules (14, 15) via an intermediary message switching module (12, 13) A method of messaging within a distributed data processing system having data transmission links between its component modules, the method being characterised by the steps of: (a) transmitting an encoded control message through one of said data links independently of communication messages passing between the component modules; (b) extracting said encoded control message with extraction means (26-39) in a component module, independently of the communication messages; (c) subjecting said encoded control message to a predetermined software filtering routine in decoding means (44-47) in the communication module, to recognise or reject it; and (d) resetting or disabling a controlling data processor in the communication module over a hard-wired link from the decoding means (44-47) in accordance with a recognised encoded control message. The method of messaging according to claim 10 wherein step (a) further comprises independently transmitting said encoded control message through another of said data links. A method of messaging according to claim 11, wherein step (b) further comprises comparing said encoded control message extracted from said one of said data links with that extracted from said another of said data links. A method of messaging according to any one of claims 10 to 12 in which said predetermined software filtering routine comprises comparing a predetermined number of extracted consecutive encoded control messages, then, if identical, continuing comparison up to a larger predetermined number thereof, and storing the last compared encoded control message as legitimate if identical to the previously extracted larger predetermined number of encoded messages.

Inventors: LEUTY STEPHEN C, LEUTY, STEPHEN C.
Applicants: NORTHERN TELECOM LTD, NORTHERN TELECOM LIMITED
Application year: 1988
Main classification: H04Q11
IPC codes: H04Q3, H04Q11