Redundancy systems and methods in communications systems

[0001] This application claims the benefit of U.S. provisional application No. 60/289,545 filed May 9, 2001.

[0002] This invention relates to redundancy in communication systems.

[0003] Redundancy is used in fault tolerant systems to deal with failures. When a primary component (either hardware or software) fails, a back-up component takes over the responsibilities of the primary component.

[0004] An important place where redundancy may be used is the control plane of a communication system. The control plane is responsible for monitoring events in and the status of the network, and may be responsible for monitoring service level agreements. Typically a network node has a primary control card implementing the node's control plane responsibilities. A primary control card of the network node receives requests, and retrieves any system information necessary for responding to the requests. The system information may be stored locally in a database of the control card, or may be retrieved from other components of the communication system through line interface cards. For example, a control card could receive a request for usage statistics of a line card in order to monitor service level agreements. The control card may need to poll the line cards frequently in order to respond to frequent requests for statistics.

[0005] Such systems usually include a redundant control card for each primary control card in order to provide redundancy in the event of failure of the primary control card. The redundant control card must be able to assume the responsibilities of a failed primary control card almost instantly. The primary control card and the redundant control card should also be synchronized, in that they should have access to the same system information. Both of these issues are particularly important in the control plane of communication systems, in which large amounts of system information are changing quickly, and in which the responsibilities of a failed primary control card must be assumed by the redundant control card quickly in order to deal with high volumes of traffic and high quality of service expectations.

[0006] There are two common types of redundancy that attempt to achieve synchronicity and rapid assumption of responsibilities. The first type of redundancy is hot redundancy (also called 1:1 redundancy or lock-step redundancy). In systems employing hot redundancy, completely redundant hardware and software components are used. The redundant components are used solely as back-up components, in that they do nothing during normal operation of the system. The primary component is active, and the redundant component remains inactive in the sense that it has no effect on system operation. However, the redundant component operates exactly like the active component, making exactly the same computations and updating system information. Only when a primary component fails does a redundant component become active in the sense that it actually effects the system. Hardware circuits are typically used to ensure extremely fast activity switches. Synchronicity is achieved by use of point to point communication channels to ensure that the system information accessible by the primary component is the same as the system information accessible by the redundant component.

[0007] In communication systems, hot redundancy is frequently used in voice communication systems due to the high reliability requirements. However, while hot redundancy ensures that the redundant component is always available in case of failure of the primary component, the inclusion of completely inactive redundant components is expensive. Components are doubled in number, without doubling capacity of the system in which the components are installed. The capacity of the redundant component is unused, other than to maintain synchronicity of system information with the primary component, until a failure occurs. This unused capacity is a potentially valuable resource in data communication systems.

[0008] The second type of redundancy is load sharing. In systems employing load sharing, the secondary component is used to some extent in normal operation. The use of an otherwise inactive component increases the efficiency of the system. When a failure occurs in the primary component, the redundant component takes on the added responsibility of the primary component, in addition to the tasks already being processed by the redundant component.

[0009] The secondary component does not stay in lock-step with the primary component and therefore when a load sharing redundancy system fails, it takes longer for the redundant component to assume all the responsibilities of the primary component. Also, such systems typically do have certain single point of failure scenarios which the redundancy scheme cannot handle. The occurrence of such a failure can be catastrophic.

[0010] In data communications, rather than having redundancies within each node, the emphasis has been on redundant nodes within the network and the ability to re-route around a failure.

[0011] Redundancy is used to ensure that routing information can be provided upon demand. Two responsibilities of a router employing the Open Shortest Path First (OSPF) protocol are to maintain a link state database describing a topology of the communication network, and to provide routes upon request using the stored topology of the communication network.

[0012] OSPF Routers exchange link state information in the form of Link State Advertisements (LSAs). A router floods the communication network with LSAs when the router first comes online, and typically periodically thereafter. An OSPF router also transmits an LSA if it detects a change in the network topology, for example if a neighbouring router goes down. Each OSPF router maintains a state machine for each neighbouring router. If the state of a neighbouring router is “Full”, then the router on which the OSPF module resides is in full communication with the neighbouring router. If the OSPF router does not receive a “Hello” packet from a neighbouring router before the expiry of a timer, then the state of the neighbouring router is set to “Down”. The state of the neighbouring router progresses through various states until a proper exchange of protocol packets is completed, at which time the state of the neighbouring router is set to “Full”. While the state of a given neighbouring router is not “Full”, the OSPF router does not attempt to calculate routes through the neighbouring router.

[0013] Any redundancy system within an OSPF router should ensure that an active OSPF module is synchronized with a standby OSPF module so that each OSPF module is capable of calculating routes using the same stored network topology, and will therefore calculate the same shortest path when requested. The link state database of each OSPF module would therefore have to be synchronized properly. Lack of synchronicity could arise due to delay in processing or copying LSA information from one OSPF module to another. However, general redundancy schemes involve byte-wise copying of redundancy information from an active control card to a standby control card. This could create problems in an OSPF router, since the standby OSPF module could contain meaningless (or at best, confusing) data if asked to calculate a route part way through copying of an LSA.

[0014] Additionally, the wasted capacity of hot redundancy is a particular problem in routers, since calculation of a shortest path is computationally very expensive.

[0015] One broad aspect of the invention provides a redundancy method of managing requests in a control plane of a communication node, the communication node including a first control card and a second control card. The redundancy method involves defining one of the control cards to be in an active state and the other of the control cards to be in an inactive state, the control card in the inactive state having a reduced set of privileges compared to the control card in the active state; maintaining synchronicity of information stored on the control card in the active state and the control card in the inactive state such that the control card in the inactive state can assume responsibilities of the control card in the active state in case of failure of the control card in the active state; monitoring for failure of the control card in the active state, and upon determining that a failure of the control card in the active state has occurred switching states of the control card in the inactive state and the control card in the active state such that the control card in the inactive state has the active state and the control card in the active state has the inactive state; receiving or generating a request at the control card in the active state; determining whether the request is to be passed to the control card in the inactive state; and if the request is to be passed to the control card in the inactive state, passing the request to the control card in the inactive state.

[0016] In some embodiments, switching states of the control card in the inactive state and the control card in the active state involves resetting the control card in the active state and sending a signal to the control card in the inactive state indicating that the control card in the inactive state is to assume responsibilities of the control card in the active state.

[0017] In some embodiments, monitoring for a failure of the control card in the active state comprises monitoring a reliability measure of each control card, and determining that a failure of the control card in the active state has occurred if the reliability measure of the control card in the active state relative to that of the control card in the inactive state indicates that the control card in the active state is less reliable than the control card in the inactive state.

[0018] In some embodiments, monitoring a reliability measure of each control card comprises maintaining a demerit count for each control card indicating how many of at least one monitored component of the control card are in an unreliable state; if the demerit count of the control card in the active state lies above the demerit count of the control card in the inactive state, determining that a failure of the control card in the active state has occurred.

[0019] In some embodiments, determining whether the request is to be passed to the control card in the inactive state involves determining whether the control card in the inactive state is synchronized with the control card in the active state; determining if the request has a type which is designated to be processable by the control card in the inactive state; determining the request is to be passed to the control card in the inactive state if the control card in the inactive state is synchronized with the control card in the active state and the request has a type which is designated to be processable by the control card in the inactive state.

[0020] In some embodiments, the control card in the inactive state includes at least one request provider, and passing the request to the control card in the inactive state involves selecting a selected request provider at the control card in the inactive state; and passing the request to the selected request provider.

[0021] In some embodiments, the method allows for requests to be received at the control card in the inactive state. The method further involves determining whether the request is one which is allowed to be processed on the control card in the inactive state; if the request is one which is allowed to be processed on the control card in the inactive state, passing the request to a request provider on the control card in the inactive state.

[0022] In some embodiments, the method further involves, if the request is one which is not allowed to be processed on the control card in the inactive state, determining whether the request is to be passed to the control card in the active state by determining whether the control card in the inactive state is synchronized with the control card in the active state and determining whether active handoff of the request is allowed; and if active handoff of the request is allowed and the control cards are synchronized, passing the request received at the inactive card to a request provider on the control card in the active state.

[0023] In some embodiments, the method further involves rejecting the request if the control card in the inactive state is not synchronized with the control card in the active state, the request can not be processed by the control card in the inactive state, and if active handoff of the request is not allowed.

[0024] In some embodiments, the communication node is a router running link state routing protocols, wherein the control card in the active state and the control card in the inactive state each include a respective link state database, and wherein maintaining synchronicity involves upon activation of the router, copying the link state database of the control card in the active state to the link state database of the control card in the inactive state as a series of atomic information units; and upon receipt of a new atomic information unit by the control card in the active state, sending a copy of the new atomic information unit to the control card in the inactive state. The atomic information units might for example be Link State Advertisements.

[0025] In some embodiments, the control card in the active state and the control card in the inactive state each maintain a state machine for each of at least one neighbouring router, and the method further involves receiving protocol packets from the at least one neighbouring router; passing the protocol packets to both the control card in the active state and the control card in the inactive state; the control card in the active state running its state machine as a function of the protocol packets; the control card in the active state sending instructions to the control card in the inactive state; and the control card in the inactive state running its state machine as a function of the protocol packets and the instructions received from the control card in the active state.

[0026] In some embodiments, the control card in the active state sending instructions to the control card in the inactive state involves upon occurrence of a particular state transition of the control card in the active state's state machine the control card in the active state sending a notification of the particular state transition to the control card in the inactive state. The control card in the inactive state running its state machine involves the control card in the inactive state running its state machine as a function of the protocol packets excepting that any state transition of the control card in the inactive state's state machine corresponding to one of the particular state transitions of the control card in the active state's state machine is only implemented upon receipt of the notification of the particular state transition.

[0027] In some embodiments, the protocol packets are Open Shortest Path First (OSPF) protocol packets, and in some embodiments, the particular state transition is any transition out of “Full”.

[0028] Another broad aspect of the invention provides a redundancy system comprising two control cards adapted to implement any of the above summarized redundancy methods.

[0029] Other aspects and features of the present invention will become apparent to those ordinarily skilled in the art upon review of the following description of specific embodiments of the invention in conjunction with the accompanying figures.

[0036] Referring to FIG. 1, a redundancy system according to one embodiment of the invention is shown. The redundancy system include two identical control cards 10,12. One control card 10 is shown in an active state, hereinafter referred to as the active (or primary) control card (ACC), and the other control card 12 is shown in an inactive state, hereinafter referred to as the inactive (or redundant) control card (ICC) 12. Each of the control cards 10 and 12 communicate with a plurality of line interface cards 14 via a bus 15. The control cards 10 and 12 and the line interface cards 14 are typically located within a shelf of a communications node, such as a metro optical node, within a communication system.

[0037] The ACC 10 includes a physical interface 16, such as an Ethernet port. The ACC 10 has a number of components typically connected to each other through a bus on the card with most components being individually addressable. Typically, an operating system is included which provides a message passing mechanism. For example, messages may have a source and destination, each specifying a shelf, slot and processor number. All components in the system are connected by the system bus 15. These include a request manager 20, a plurality of request providers 22, a database 24 containing stored system information, and a redundancy manager 30. The ACC 10 receives requests 18 from a requesting application, for example a network management terminal (not shown), through the physical interface 16. Each request may be any one of thousands of types of requests received by a control plane of the communication system. The request may be in any suitable format, SNMP, telnet, or HTTP, to name a few examples. For example, the request may be a request for usage statistics of one of the line interface cards 14 or may be a request for information in the database 24.

[0038] In typical implementations, most requests originate within the node itself, many within the ACC. There is no restriction on where requesting entities may reside, only that their requests are first sent to the request manager on the ACC.

[0039] Each request 18 is passed to the request manager 20 within the ACC 10. Each of the plurality of request providers 22 is a subsystem that can process one or more types of request. The request providers 22 have access to the database 24 of stored system information, and to the line interface cards 14 via the bus 15. In normal operation (that is, until a failure occurs), when the request manager 20 receives a request 18 the request manager 20 selects a selected request provider from the plurality of request providers 22 based on which request provider can process the request 18. The request manager 20 passes the request 18 to the selected request provider. The selected request provider accesses system information necessary to respond to the request 18, either from the database 24, a line interface card 14, or both. The selected request provider determines a response to the request 18 using the retrieved system information. The selected request provider passes the response to the request manager 20, which in turn passes the response to the requesting application through the physical interface 16.

[0040] The inactive control card 12 is identical to the active control card 10 as it must be able to take over from the active control card 10. Thus, the ICC 12 includes a plurality of request providers 28, redundancy manager 32, and a database 29 of stored system information. There is also a request manager 26 and a physical interface 27, but these are inactive until the inactive control card 12 takes on the role of the active control card 10 after a failure. The components of the inactive control card 12 are also individually addressable. Components on the active control card 10 and the inactive control card 12 can communicate with each other over the bus 15 using this individual addressability.

[0041] Although the inactive control card 12 and the active control card 10 have identical components and subsystems, they perform differently. The inactive control card 12 has a reduced set of privileges, in that the inactive control card 12 can only process a limited subset of all possible types of request. This reduced set of privileges may for example involve each request manager 20 and 26 maintaining a table of commands that can be processed by the communication node. The table identifies whether each command can be processed by the inactive control card 12. Only the control card in the active state is allowed to generate requests.

[0042] The redundancy managers 30 and 32 are responsible for synchronizing the two control cards. Synchronization of the control cards requires that the database 24 on the ACC 10 and the database 29 on the ICC 12 contain the same system information by copying all changes to the active control card's database 24 to the inactive control card's database 29. The redundancy managers 30, 32 keep the two cards very close to being in “hot redundancy”. The two databases 24, 29 are kept completely in sync. Information concerning the line interface cards 14 is kept on the line interface cards 14 and does not need to be replicated. Typically everything is replicated except for some RAM which is regenerated in the “inactive” card after a switch. More particularly, at least all information that cannot be derived from the transferred information should be replicated on the ICC 12. Information which can be derived from previously transferred information does not need to be transferred. For example, a network topology is replicated from the ACC 10 to the ICC 12, but best routes are not replicated since the ICC 12 can derive the best routes from the replicated topology information.

[0043] When the ICC 12 is switched on, the redundancy managers 30 and 32 transfer system information from the ACC 10 to the ICC 12. Once all system information to be transferred has been transferred (i.e. other than information derivable by the ICC 12), the ACC 10 declares the ICC 12 to be in sync. The ICC 12 can fall out of sync with the ACC 10 if system information on the ACC 10 is changing faster than it can be replicated to the ICC 12. The ACC 10 has a fixed size information buffer which stores information to be replicated. If the buffer fills because the ICC 12 is not draining information from the buffer quickly enough, the ACC 10 declares the ICC 12 out of sync. The redundancy managers 30 and 32 then restart synchronization of the ACC 10 and the ICC 12, as if the ICC 12 had been switched on again.

[0044] The redundancy managers on the ACC 10 and ICC 12 monitor the state of the ACC 10. If the ACC 10 fails (for example, a process resets or some other hardware fault occurs), the ACC 10 is reset and the ICC 12 immediately receives a hardware interrupt (more generally some sort of signal) indicating that the ICC 12 is to assume the responsibilities of the ACC 10. Simultaneously, the physical interface 16 begins communicating with the request manager 26 on the ICC 12 rather than the request manager 20 on the ACC 10, so that the switch from ACC 10 to ICC 12 is not carried out by or even perceived by any external management system.

[0045] In one embodiment, the redundancy managers monitor a reliability measure of each control card. If the reliability measure of the ACC 10 falls below the reliability measure of the ICC 12, the redundancy managers determine that a failure has occurred in the ACC 10. This allows proactive prevention of faults. (This assumes that the reliability measures are defined such that a higher reliability measure signifies a higher reliability of the respective control card. If a higher reliability measure signifies a lower reliability of the respective control card, then the redundancy managers act as if a failure has occurred in the ACC 10 if the reliability measure of the ACC 10 rises above that of the ICC 12.)

[0046] As one example of a reliability measure, the ACC 10 and the ICC 12 each monitor at least one monitored component (each of which may be a software component or a hardware component). Each monitored component is in either a reliable state or an unreliable state. When a monitored component changes state, each of the ACC 10 and the ICC 12 determine a demerit count. The demerit count is a count (possibly weighted) of the number of monitored components currently in the unreliable state. The hardware circuit compares the demerit count of the ACC 10 with that of the ICC 12 to determine which control card is “healthier”. If the hardware circuit determines that the ICC 12 is healthier than the ACC 10 because the ICC 12 has a lower demerit count than does the ACC 10, the hardware circuit resets the ACC 10 and the ICC 12 immediately assumes the responsibilities of the ACC 10. It can be seen that a “failure” of the ACC does not necessarily mean that it is completely non functional, only that a decision that it has decreased reliability.

[0047] Load sharing is achieved by allowing the request manager 20 on the ACC 10 to pass requests to the request providers 28 on the ICC 12. Since the request providers 22, 28 on both control cards can access the line interface cards 14, the control bandwidth between the combination of the active control card 10 and the inactive control card 12 and the line interface cards is double that of a single control card. This is an important improvement since control plane messaging in communication systems is frequently bottlenecked by communication between the control cards and the line interface cards. Typically external systems monitor service level agreements (SLAs) by very aggressive querying of statistics on the line interface cards 14. Doubling the control bandwidth reduces the bottleneck between the control cards and the line interface cards in responding to these queries. Examples of statistics that might be requested at high frequency include a number of transmit packets sent, number of transmit or receive packets shipped, SLA statistics for service path through the node, node inventory requests, verification that particular hardware exists in the node, checking software loads on the cards, retrieving manufacturing information from the cards, and retrieving card and port status information.

[0048] The request manager 20 only passes a request to a request provider on the ICC 12 if the request manager 20 determines that the ICC 12 is synchronized with the ACC 10 and that the request can be processed by the ICC 12. Otherwise, the request manager 20 passes the request to a request provider on the ACC 10. Referring to FIG. 2, a method by which the resource manager 20 of FIG. 1 manages a request according to one embodiment of the invention is shown. The method is executed by the resource manager 20 of the ACC 10. At step 50 the resource manager 20 receives a request. At step 52 the resource manager 20 determines whether the ICC 12 is synchronized with the ACC 10. If the ICC 12 is not synchronized with the ACC 10, then at step 54 the resource manager 20 selects a selected resource provider on the ACC 10 and passes the request to the selected resource provider.

[0049] If at step 52 the resource manager 20 determines that the ICC 12 is synchronized with the ACC 10, then at step 56 the resource manager 20 determines whether the request is of a type that can be processed by the ICC 12 by consulting the table of commands that can be processed by the node. If this is the case, then at step 58 the resource manager passes the request to the selected request provider of the ICC 12. Otherwise, the request manager passes the request to the selected request provider of the ACC 10 at step 54.

[0050] The embodiment of FIG. 1 provides the benefits of the hot redundancy schemes since the inactive card is kept fully up to date and can take over immediately from the active card upon a failure. When this occurs, the roles of the active and inactive control cards are reversed, with the request manager 26 and physical interface 27 on the previously inactive control card 12 becoming active. It also provides the benefits of a load sharing system in that in the absence of a failure, the capacity of the control cards to handle requests is effectively doubled.

[0051] Unlike existing systems which are really only suitable for data or voice but not both, the redundancy scheme described herein is suitable for both voice and data applications.

[0052] Referring to FIG. 3, a redundancy system according to another embodiment of the invention is shown. The ACC 10 in this embodiment is similar to the ACC 10 described above with reference to FIG. 1. However, the ICC 12 includes an active physical interface 70, making the redundancy system a dual interface redundancy system. Additionally, the resource manager 26 is used even while in the inactive state, and communicates with the physical interface 70, the request providers 28 on the ICC 12, and the request providers 22 on the ACC 10. Such an ICC may be referred to as a receiving ICC, as it can receive requests independently of the ACC. The ICC 12 may receive a request 72 through the physical interface 70. The request 72 is passed to the request manager 26, which determines whether the request can be processed by the ICC 12, as described below with reference to FIG. 4. If the request can be processed by the ICC 12, the request manager 26 selects a selected request provider from the plurality of request providers 28, and passes the request to the selected request provider. Since both physical interfaces are active, this embodiment has twice the request bandwidth compared to that of the embodiment of FIG. 1.

[0053] The request manager 26 only passes requests to a resource provider on the ICC 12 if the resource manager 26 determines that the ICC 12 is synchronized with the ACC 10 and that the request can be processed on the ICC 12. Otherwise, the request manager 26 determines if active handoff of the request is allowed. If active handoff of the request is allowed, then the request manager 26 passes the request to a request provider on the ACC 10. If active handoff of the request is not allowed, then the request manager 26 rejects the request. Referring to FIG. 4, a method by which the request manager 26 of FIG. 3 manages a request according to one embodiment of the invention is shown. The request manager 26 receives a request through the physical interface 70 at step 80. At step 82 the request manager 26 determines whether the ICC 12 is synchronized with the ACC 10, which is possible since the ACC 10 will have declared the ICC 12 to be in sync or out of sync (as described above). If the request manager 26 determines that the two control cards are synchronized, then the request manager 26 determines at step 84 whether the request can be processed on the ICC 12 by consulting the table of commands (as described above). This determination is made in the same way that the request manager 20 of the ACC 10 makes this determination, as described above with reference to step 56 of FIG. 2. If the request manager 26 determines that the request can be processed on the ICC 12, then at step 86 the request manager 26 selects a selected request provider from the plurality of request providers 28 on the ICC 12 and passes the request to the selected request provider.

[0054] If the request manager 26 determines at step 82 that the two control cards are not synchronized or if the request manager 26 determines at step 84 that the request can not be processed on the ICC 12, then the request manager 26 determines whether passing of the request to the ACC 10 is allowed. At step 88 the request manager 26 determines whether active handoff of the request to the ACC 10 is allowed. If active handoff of the request to the ACC 10 is allowed, then at step 90 the request manager 26 selects a selected request provider from the plurality of request providers 22 on the ACC 10 and passes the request to the selected request provider. If active handoff of the request to the ACC 10 is not allowed then the request can be processed by neither the ICC 12 nor the ACC 10, and the request manager 26 rejects the request at step 92.

[0055] The invention will now be described with reference to a particular example, calculation and exchange of routing information in a control plane of a communication network employing the Open Shortest Path First protocol (J. Moy, “OSPF Version 2”, IETF RFC 2178, July 1997, incorporated by reference herein). The OSPF protocol is a link-state routing protocol used for routing Internet Protocol traffic. The redundancy system shown in FIG. 1 (or FIG. 3) is installed at a router in the communication network. Each router includes at least two OSPF modules. One OSPF module is a primary (or active) OSPF module, and the remaining OSPF modules are redundant (or inactive) OSPF modules. In the description that follows, it is assumed that the router includes only one inactive OSPF module. The OSPF modules are request providers.

[0056] The primary (or active) OSPF module receives protocol packets such as routing updates in the form of Link State Advertisements (LSAs) and “Hello” packets, receives provisioning information indicating local characteristics, and receives requests for routing information (RRI) identifying a destination to which the router must determine a route. The active OSPF module stores a network topology of the communication network as a link state database in the database 24. When an LSA arrives at the router, the active OSPF module updates the link state database to reflect new status information about nodes and links identified in the LSA. When OSPF protocol packets arrive, appropriate changes are made to neighbour state machines (described below). When an RRI arrives from a requesting application, the active OSPF module extracts the destination contained in the RRI. The active OSPF module then calculates a shortest path to the destination using the link state database. The active OSPF module provides the shortest path to the requesting application.

[0057] Load sharing and redundancy with respect to RRIs is effected in the active OSPF module and the inactive OSPF module using the methods and apparatus described above with reference to FIGS. 1 to 4. In other words, routing requests can be handled by both the active and inactive OSPF modules. However, since each OSPF module consults the copy of the link state database in its respective database 24 or 29 in order to determine a shortest path, it is important that the link state databases in each database 24 and 29 be synchronized so that each OSPF will determine the same shortest path for a given RRI. Referring to FIG. 5, a method by which the active OSPF module initializes and maintains synchronicity of its link state database with that of the inactive OSPF module is shown. At step 120 the active OSPF module initializes synchronicity with the inactive OSPF module by copying its link state database to the inactive OSPF module. The link state base is copied as a series of LSAs, rather than byte-wise. LSAs are copied one at a time, including the checksum of the LSA, to the inactive OSPF module. This allows the inactive OSPF module to verify the accuracy of each LSA, and to build its copy of the link state database as it receives copies of individual LSAs. There will never be a “partial LSA” stored which could lead to junk computations.

[0058] More generally, the link state database may be copied as a series of any atomic information units, rather than byte-wise. These atomic information units are preferably LSAs in the case of an OSPF router but may be some other form of information, particularly for routers running link state routing protocols other than OSPF.

[0059] At step 122 the active OSPF module enters a Wait state. At some later time, the active OSPF module receives a new LSA at step 124. The active OSPF module passes a copy of the new LSA to the inactive OSPF module at step 126. At step 128 the active OSPF module updates its link state database using information within the new LSA. The active OSPF module then returns to a Wait state to await receipt of another new LSA.

[0060] Meanwhile, when the inactive OSPF module receives the copy of the new LSA sent by the active OSPF module at step 126, the inactive OSPF module updates its own link state database using information within the new LSA. Since both OSPF modules begin with the same link state database (as a result of step 120), receive the same new LSA (as a result of step 126), and implement the same updating algorithm, the link state database of each OSPF module will, aside possibly for a very brief time, be identical.

[0061] The very brief time during which the link state databases of the active OSPF module and the inactive OSPF module are not identical may arise due to message propagation delays between the active OSPF module and the inactive OSPF module. During this time, the shortest path calculated for a given RRI may differ depending on whether the RRI is sent to the active OSPF module or to the inactive OSPF module.

[0062] After the two link state databases are synchronized initially, from then on all protocol packets (including those bearing LSAs) are fed directly to both OSPF modules. If both OSPF modules are fed the same information, they should both keep the same pictures of the network.

[0063] For each of at least one neighbouring router, each OSPF module maintains a state of the neighbouring router using a state machine corresponding to the neighbouring router. When OSPF protocol packets are received from neighbouring routers, appropriate updates to the state machines are made. For example, when a “Hello” packet from a neighbouring router arrives at an OSPF module, the OSPF module resets a timer. If the timer expires before the arrival of another “Hello” packet, the OSPF module notes that a “Hello” packet is missing and restarts the timer. If a provisioned number of consecutive “Hello” packets are notes as missing, the OSPF module updates the state of the neighbouring router to indicate that the neighbouring router is unreachable, and begins attempting to re-establish contact with the neighbouring router. However, since the active OSPF module and the inactive OSPF module may receive a “Hello” packet at different times, the state of the neighbouring router in the respective state machines may be different. If an RRI arrives while the state machines are different, different shortest paths may be calculated by each OSPF module since an OSPF module does not calculate a path through a neighbouring router suspected of being unreachable.

[0064] In order to avoid this, according to a preferred embodiment the inactive OSPF module ignores the timer. While the active OSPF module runs its state machine as a function of the protocol packets, the inactive OSPF module runs its state machine as a function of the protocol packets and instructions received from the active OSPF module. If the active OSPF module implements a particular state transition of its state machine signifying that communication through the neighbouring router is not possible, such as out of “Full” in OSPF systems, the active OSPF sends a notification of the particular state transition to the inactive OSPF module. In running its state machine, the inactive OSPF module only implements a state transition corresponding to one of the particular state transitions upon receipt of the notification of the particular state transition.

[0065] Calculation of a route by the OSPF module may be very processing intensive, particularly if the communication network is large or if the calculation has additional constraints such as link and node diversity among different parallel paths. After a failure in a network occurs it may be necessary to recompute thousands of routes in as short a time as possible. The ability to use this inactive OSPF module greatly speeds up the process.

[0066] As stated above, the router may have more than one inactive OSPF module. Although this increases hardware costs, additional inactive OSPF modules improves redundancy and load sharing. This is particularly advantageous in the case of routers employing the OSFP protocol, as additional OSPF modules provide additional processing power for calculating shortest paths. Each inactive OSPF module maintains its own link state database and set of state machines (one for each neighbouring router). When the active OSPF module receives an RRI, the active OSPF module selects a selected inactive OSPF module to which it will attempt to send the RRI, as described above with respect to the more general case of a redundancy system having more than one ICC. The active OSPF module establishes and maintains synchronicity of the link state database with each inactive OSPF module. When a state transition occurs in a neighbouring router corresponding to one of the particular state transitions signifying that communication through the neighbouring router is not possible, the active OSPF module sends a notification of the particular state transition to each inactive OSPF module. Each inactive OSPF module only implements a state transition corresponding to one of the particular state transitions upon receipt of a notification of the particular state transition.

[0067] The request managers and redundancy managers of the ACC and the ICC may be processors including instructions for carrying out the redundancy methods described above. These instructions may be in the form of any combination of circuitry (including integrated circuitry) or external logical instructions (including software). Each request manager and each redundancy manager may be on a discrete processor, on multiple processors, or on a processor containing other functionality.

[0068] What has been described is merely illustrative of the application of the principles of the invention. Other arrangements and methods can be implemented by those skilled in the art without departing from the spirit and scope of the present invention.