On Double-Link Failure Recovery in WDM Optical
Networks
Hongsik Choi, Suresh Subramaniam, and Hyeong-Ah Choi
Abstract— Network survivability is a crucial requirement in
high-speed optical networks. Typical approaches of providing sur-
vivability have considered the failure of a single component such
as a link or a node. In this paper, we consider a failure model in
which any two links in the network may fail in an arbitrary order.
Three loopback methods of recovering from double-link failures
are presented. The first two methods require the identification
of the failed links, while the third one does not. However, pre-
computing the backup paths for the third method is more difficult
than for the first two.
A heuristic algorithm that pre-computes backup paths for links
is presented. Numerical results comparing the performance of
our algorithm with other approaches suggests that it is possible
to achieve
recovery from double-link failures with a modest
increase in backup capacity.
Index Terms—Wavelength division multiplexing (WDM), loop-
back recovery, restoration, double-link failures, 3-edge-connected
graph.
I. INTRODUCTION
T
HE explosive growth of the Internet has fueled intensive
research on high-speed optical networks based on wave-
length division multiplexing (WDM) technology. WDM tech-
nology harnesses the large bandwidth of the optical fiber, which
is of the order of several Terabits/s into a few tens of wave-
lengths, each of which can be operated at electronic rates of a
few Gb/s. Point-to-point WDM links with several tens of wave-
lengths have been deployed by carrier networks.
Recent advances in optical routing and switching are en-
abling the transition from point-to-point optical WDM links to
true optical networking by performing optical routing. In this
technique called as wavelength routing, wavelengths can be in-
dependently routed from an input port to an output port. With
the potential developmentofopticalswitches that are capable of
dynamically reconfiguring the routing pattern under electronic
control, the flexibility provided by the network is dramatically
increased. In a dynamically configurable wavelength-routing
network, lightpaths or all-optical circuit-switched paths can be
provided on a demand basis, depending on traffic requirements.
As wavelength-routing paves the way for network through-
puts of possibly hundreds of Tb/s, network survivability as-
sumes critical importance. A short network outage can lead
to data losses of the order of several gigabits. Hence, protection
or dedicating spare resources in anticipation of faults, and rapid
H. Choi and H.-A. Choi are with the Dept. of Computer Science, and S.
Subramaniam is with the Dept. of ECE, George Washington University, Wash-
ington, DC 20052. e-mail:
hongsik,choi,suresh
@seas.gwu.edu.
This work was supported in part by the DARPA under grant N66001-00-
18949 (co-funded by NSA) and by the NSF under grants ANI-9973098 and
ANI-9973111.
restoration of traffic upon detection of a fault are becoming in-
creasingly important. According to [1], the overall availability
requirements are of the order of
percent or higher. Sur-
vivability is the ability of the network to withstand equipment
and link failures. There are several kinds of failures that can
disrupt the lightpath service provided by the optical network.
Link failures occur because of fiber cuts that are mostly due to
backhoe accidents. Such cuts typically result in all fibers in the
bundleto be cut and hence a link failure could lead the failure of
hundreds of channels, and therefore need elaborate restoration
mechanisms. Node failures occur due to the failure of equip-
ment at nodes such as switches. These equipment are typically
protected within the node by redundant equipment (including
redundant switches) [2]. The other type of failure is a channel
failure in which the equipment on a single wavelength chan-
nel such as transmitter or receiver fails. These failures cause a
single lightpath to fail and typically do not affect the other light-
paths. In order to recover from channel failures, spare transmit-
ting and receiving equipment must be available at the source
and destination nodes.
In this paper, we restrict ourselves to the case of link failures.
Traditional optical networks have tended to take the form of
point-to-point WDM transmission links or rings. Well-known
protection mechanisms such as
and
protection [3]
are used for point-to-point links. There are two kinds of pro-
tection schemes for other networks: link protection and path
protection. In link protection, an alternate lightpath (called
as a backup lightpath) between the end points of each link is
pre-computed. Upon the link’s failure, all the lightpaths us-
ing the link (called as working lightpaths) are switched at the
end-nodes of the link to their corresponding backup lightpaths.
The portion of the working lightpaths excluding the failed link
remains the same. In contrast, path protection entails the rerout-
ing of all working lightpaths that use the failed link along pre-
computed backup lightpaths. Here, the entire route of the work-
ing lightpaths may be changed. This flexibility in path protec-
tion could lead to lower protection capacity but requires that all
failed paths effect their recovery independently. On the other
hand, link protection may require more protection capacity be-
cause of reduced flexibility in rerouting, but requires only local
knowledge around the failed link to complete the recovery. In
both link and path protection, the protection capacity may be
dedicated to a link or path, respectively, or may be shared.
Rings (with links in both the clockwise and counterclock-
wise directions) have been especially attractive because of the
availability of exactly one backup path between any two nodes,
leading to simple automatic protection switching mechanisms.
When a link fails, in link protection, the end-nodes of the link
switch to the backup path joining the two end-nodes. In path
protection, all affected connections are notified of the link fail-
ure, and they switch to the backup paths. Both link and path
protection techniques in rings require the reservation of
of
the total capacity for protection purposes.
More recently, attention has focused on mesh networkspartly
because of the increased flexibility they provide in routing con-
nections, and partly because the natural evolution of network
topologies leads to a mesh-type topology. While protection in
mesh networks can potentiallybemoreefficient, it is morecom-
plex as well because of the multiplicity of routes which can be
used for recovery. Approaches for protecting link failures in
mesh netwokks can be found in the recent literature and are
briefly reviewed here.
One approach is to use ring-like protection mechanisms by
embedding cycles on a given mesh topology. Suppose the net-
work is represented by a directed graph (digraph). Recovery
from single-link failures requires the graph to be 2-edge con-
nected,
1
so let us assume that a 2-connected digraph is given.
In the double cycle cover method of [4], [5], the links of the
digraph are covered by two directed cycles such that each link
is covered by a cycle in each direction exactly once. A set of
cycles that has this property can be found in polynomial time
for planar graphs [5] (i.e., graphs that can be drawn on a plane
without intersecting edges), but no known polynomial-time al-
gorithm is known for non-planar graphs. On each link, exactly
half of the fibers are set aside for protection and half are used
for working traffic. Consider the undirected link AB (that in-
cludes the directed links AB and BA), and suppose that it is a
part of two cycles
and
, where
is a cycle that includes
directed link AB and
is a cycle that includes directed link
. Then, all the working fibers from A to B are backed up
by the protection fibers from A to B on cycle
, and all work-
ing fibers from B to A are backed up by the protection fibers
from B to A on cycle
. Note that this is fiber-based recovery
since whole working fibers are backed up by a set of protection
fibers. The advantage of this technique lies in the fact that the
protection switches can be pre-configured, and no signaling is
required upon failure of a link.
Apart from the drawback of not being able to guarantee
recovery when the graph is non-planar, the above technique
has the disadvantage of requiring wavelength conversion when
there is a single fiber in each direction of a link [6]. Accord-
ingly, another method of link protection was presented in [6]. In
this method, instead of forming cycles, a 2-connected directed
subgraph
that covers all nodes is obtained. Another subgraph
which is similar to
except that the directions of the edges
are reversed is also immediately obtained. On each fiber, half
of the wavelengths are working and the other half are reserved
for protection. Furthermore, the wavelengths that are reserved
for protection in the edges in
are the working wavelengths
in
and vice versa. Then, a failure of an undirected link AB
can be recovered as follows. Suppose the working wavelengths
on directed link AB belong to
and those on directed link
BA belong to
. The working wavelengths on directed link
A graph is said to be
-edge connected if the removal of any
edges does
not disconnect the graph. We will drop the term “edge” and simply refer to it
as
-connected henceforth.
AB are recovered using the protection wavelengths on directed
path AB in subgraph
. Similarly, the working wavelengths
on directed link BA are recoveredusing protection wavelengths
on directed path BA in subgraph
. This method is applicable
to non-planar graphs as well.
A variation of the above method has recently been pre-
sented [7]. There, the authors propose a new algorithm to find
the backup digraph (i.e.,
). A goal of [7] is to find the
minimal backup digraph, i.e., a digraph that contains the small-
est number of edges while still covering all the nodes. Then,
those edges that are not in the backup digraph need not be al-
located protection capacity and the capacity thus freed up may
be used for traffic that does not require protection. In spite of
that, protection for all working traffic can be guaranteed [7].
Note that the problem of finding the minimal backup digraph
contains the problem of finding whether a Hamiltonian cycle
2
exists in a digraph, which is a well-known NP-complete prob-
lem [8].
The existing methods for link protection are designed for sin-
gle link failures. As we explain in the next section, double
link failures must also be considered in the context of network
survivability. In [7], some work that compares the recovery
performance of existing protection methods under double-link
failures was presented. However, this begs the question of how
protection paths should be designed in order to tolerate double-
link failures. This topic is our focus in the current paper.
The rest of the paper is organized as follows. Some moti-
vation for considering double-link failures and approaches for
handling such failures are given in Section II-B. Algorithms for
designing protection paths are given in Section III. Numerical
results comparing the algorithms with previous algorithms for
single-link failures are presented in Section IV, and the paper is
concluded in Section V.
II. DOUBLE-LINK FAILURE RECOVERY
A. Motivation
We first motivate the need for considering double-link fail-
ures. Single-link failures are common failure scenarios. Nor-
mally, recovery from the failure of a link is completed within
a few milliseconds to a few seconds depending on the mecha-
nism used for recovery. However, the time it takes to repair the
physical link may be a few hours to a few days. It is certainly
conceivable that a second link fails in this duration, thus caus-
ing two links to be down at one time. There is yet another rea-
son to consider double-link failures. The graph that represents
the physical network topology captures only the connectivity
between the nodes, but not the physical routing of the links.
The physical routing of links is dictated by right of way which
is often obtained from railroad, thruways, and pipeline com-
panies [9]. As an example, a link from New York to Boston
and from New York to Washington may be physically routed
together for some distance, e.g., along the Lincoln Tunnel. Fig-
ure 1 shows a possible physical routing topology and the cor-
responding graph that represents node connectivities. In this
example, a single backhoe accident may lead to the failures of
A Hamiltonian cycle in a graph is a cycle that covers all the graph nodes.
both links AD and BD in the graph topology, which is what
protection planning algorithms use to find backup paths.
A B
C D
A B
C D
Fig. 1. (a) A physical routing topology, and (b) the graph.
We now discuss some approaches for recoveringfrom double
link failures. Let us assume that the second link fails after the
recovery from the first failure is complete. The approaches also
work when two links fail simultaneously.
B. Double-Link Failure Recovery Approaches
We do not consider path rerouting approaches here, nor dy-
namic restoration approaches that do not reserve capacity. We
focus only on schemes that reroute around the failed links using
pre-assigned capacity. However, these schemes require signal-
ing to configure the switches when links fail. We also assume
that all working wavelengths on a failed link are rerouted along
the same backup path.
Note that for the graph to remain connected when any two
edges fail, the graph must be 3-connected. For simplicity of
explanation, let us assume this to be the case. When this is not
the case, the failure of some edge pairs cannot be tolerated. By
Menger’s theorem [10], a graph is
-connected if and only if
there exist
edge-disjoint paths between every pair of nodes
in the graph. It is also possible to find these edge-disjoint paths
easily (e.g., by a simple application of the Ford-Fulkersonmax-
flow algorithm [10]).
The following approaches are possible. The first two require
identification of failed links while the third one does not.
1) Method I: Backup paths with link identification - I: Here,
two edge-disjoint backup paths, a primary
3
backup path
and a secondary backup path
are computed for each edge
. The existence of these paths is guaranteed by Menger’s the-
orem, and as mentioned above, the paths can also be easily de-
termined.
When
fails, the primary backup path
is used for
rerouting. At the same time, all nodes in the network are in-
formed of the failure through signaling. Note that the backup
path rerouting is done in parallel with the signaling, and recov-
ery from
’s failure may be accomplished before
’s failure is
broadcast to all nodes. Now, suppose a second edge
fails.
This failure is notified to all nodes as before. If the primary
backup path
does not use
, then
is used to reroute
the traffic on
, else
is used. This is possible because the
end-nodes of
know which link has failed previously.
There are two cases possible when
fails:
does not lie on
, or
lies on
. In the former case,
will continue
to be used for
. Note that if
and
share links, then
the protection capacity that must be reserved on the common
This is not to be confused with a primary path which is sometimes used to
refer to a working path.
links is twice the link working capacity because it has to carry
the working traffic of both
and
. When
lies on
and
the information about
’s failure reaches the end-nodes of
,
these nodes switch the traffic originally on
from
to
(which is disjoint with
). Observe that the knowledgeof which
links lie on a backup path is necessary to carry out this process.
The amount of signaling that this scheme requires is roughly
equal to what is necessary in path rerouting, but possibly,
fewer switches may need to be configured in the link rerout-
ing scheme. Moreover, backup capacity must be pre-allocated
on both
and
since each of them may be active at dif-
ferent times, and the capacity cannot be shared between them
because they are link-disjoint.
2) Method II: Backup paths with link identification - II:
This is similar to the previous scheme except for the following.
Suppose, without loss of generality, that
does not use
. When
fails, and if
lies on
,
is used to back
up both the working traffic on
as well as the backup traffic
rerouted on
. Thus, the working traffic originally routed
on
is now routed on
. This scenario is
shown in Figure 2.
e
p
1
(e)
f
p
1
(f)
Route after e and f fail
...
...
Fig. 2. Rerouting with link identification - II.
Note that this scheme still requires that the end-nodes of
know that
has failed, though the failure of
need not be
known by nodes other than its end-nodes for recovery to be
completed. The cost for this is the increased path length for the
backup of the traffic originally routed on
. Here, the backup
capacity that is required on
is twice the working capacity.
This capacity is required even if the links on
are not used
as backup for any other link (unlike in the previous case). This
is because these links carry
’s as well as
’s working traffic.
3) Method III: Backup paths without link identification: In
this approach, a single backup path
is pre-computed for
each link
. Suppose for the moment that the backup path
for every link
does not contain
. Suppose
fails first.
Then, the traffic on
is rerouted along
. Now, if
fails, the
working traffic on
and any rerouted traffic on
(in this case,
the rerouted traffic from
) are both switched to
from
.
Since
does not use
, this rerouting would be successful.
Observe that no signaling is necessary to inform the network
nodes of a link’s failure; the failure of a link need only be de-
tected at the end-nodes of that link. In this scheme, the protec-
tion capacity that must be allocated on a link, say
, is com-
puted using the following rules:
If
is not part of any backup path, then no protection ca-
pacity is needed.
If
is part of the backup path of exactly one link, say
,
and if
is not on any link’s backup path, then the protec-
tion capacity needed on
is equal to the working capacity
on any link. On the other hand, if
lies on the backup
path(s) of one or more links, then twice the link working
capacity must be reserved on
. This is because, if
is car-
rying rerouted traffic from some other link failure when it
fails, then that rerouted traffic and the working traffic on
must both be rerouted along
which contains
.
If
is on the backup paths of two or more links, then twice
the link working capacity must be reserved for protection
on
.
It is possible to obtain such rules for the previous two
schemes as well, since all paths are pre-computed, and the al-
gorithm for re-routing is also pre-decided.
The advantage of this approach is that no failed link identifi-
cation is necessary (except by the end-nodes of the failed link).
As in the previous scheme, the rerouted traffic when two links
fail may have to traverse many links.
An important consideration in this scheme is how the backup
paths must be computed. Recall that in the previous two
schemes, one only needed to compute two link-disjoint backup
paths for each link, and this is easily done.
4
In the third ap-
proach, however, we need only a single backup path for each
link, but the backup paths of the various links must satisfy the
special property that was assumed earlier; namely, if
con-
tains
, then
must not use
.
It is not clear if such a set of backup paths can be computed
even if a graph is 3-connected. Our goal in the next section is
to address the problem of computing such backup paths.
III. AN ALGORITHM FOR BACKUP PATHS
In this section, we formulate the problem of computing
backup paths as required by Method III described in Section II-
B.3, and present an algorithm to compute the backup paths. We
assume that a graph
representing the network is given, and
assume that any two arbitrary links in
may fail.
A. Problem Formulation
As mentioned earlier, there exist double-link failures that
cannot be tolerated by any algorithm if the graph is not 3-
connected. However, it is not known if backup paths can be
pre-computed for every link as required by Method III, even if
the graph is 3-connected. In any case, many practical network
topologies are not 3-connected (including the ones we consider
in the next section). Therefore, we consider the more practi-
cal problem of computing backup paths such that the maximum
possible number of double-link failures can be tolerated.
Formally, we seek an answer to the following problem:
Maximum Arbitrary Double-Link Protection Problem
(MADPP): Given
, find a backup path
for each
link
such that the set
and
,
has minimum cardinality, where
and
are arbitrary links in
.
3-connectivity is assumed here. If not, then no scheme can tolerate the fail-
ure of all double-link failures, but it is possible to find two edge-disjoint paths
for those links that do have two edge-disjoint paths in polynomial time by using
the max-flow algorithm.
Note that
is exactly the set of link pairs whose failures can-
not be tolerated by Method III. We conjecture that this problem
is NP-hard. In the following, we present a heuristic algorithm
called as the Maximum Arbitrary Double-Link Protection Algo-
rithm (MADPA). This algorithm will be shown to give excellent
results in Section IV.
B. The Maximum Arbitrary Double-Link Protection Algorithm
(MADPA)
Ours is a recursive algorithmwhoseoperationcan be summa-
rized as follows. It works by contracting the graph
according
to a set of rules, computing backup paths for the links in the
contracted graph, and then mapping these backup paths back to
the original graph.
Since almost all existing network topologies are 2-connected,
we will assume that
is 2-connected throughout this section.
The algorithm is organized in three phases.
1) Phase 1: Pre-processing: In this phase,
is pre-
processed in the following way. If a node
has only two ad-
jacent nodes
and
, then delete node
and merge the edges
to form a single edge
. If
has such a
node, note that the failure of both edges
and
can-
not be tolerated by any algorithm. Let the graph after this pre-
processing be
and observe that 2-connectivity is still main-
tained after this phase.
2) Phase 2: Contraction: In this phase, we contract the
graph
in a succession of steps using a set of prioritized rules.
The rules are the result of an extensive investigation of various
cases that arise in the computation of backup paths. At each
step of this phase, we have a graph
, and a new contracted
graph
is obtained by using one of the 4 rules given be-
low. The rules are prioritized such that Rule 1 is applied first if
possible, else Rule 2 is applied if possible, and so on. The con-
tracting phase stops when, for some
,
has only two nodes.
The specific sequence of rules that was used in contracting
to
is also kept track of in this phase.
Rule 1: If there is a pair of nodes
and
connected by two
or more edges in
, we form
by merging
and
into a
single node and removing the edge
. This is illustrated in
Figure 3.
u v
uv
Fig. 3. Contraction by Rule 1.
Rule 2: If there are three nodes
and
such that the degree
of each node is exactly three and
and
are neighbors of
each other, then
is obtained as follows.
and
are
merged into a single node called
with three edges incident
to it as shown in Figure 4.
Rule 3: If there are three nodes
, and
such that they are
adjacent to each other, and the degree of (at least) one of the
three nodes is greater than 3, the contraction is done through a
two-step process. Suppose, without loss of generality, that
uvw
e
v
e
u
u v
w
e
u
e
v
e
1
e
2
e
3
uvw
e
w
e
w
Fig. 4. Contraction by Rule 2.
has degree greater than 3. In the first step,
is contracted by
merging
and
into a single node
, resulting in a new graph
which we call
. In the second step, Rule 1 is applied to
the pair of edges between the nodes
and
in
to form
. This rule is illustrated in Figure 5 where the degree of
is assumed to be
.
u
w
v
uvw
w
uv
Fig. 5. Contraction by Rule 3.
Rule 4: Find an arbitrary edge
and obtain
by merg-
ing
and
into a single node
, and deleting the edge
.
Other edges that are incident to either
or
in
are incident
to node
in
.
As noted earlier, the contracting phase stops when there are
exactly two nodes in
for some
.
5
Before describing the
third phase, which is the expansion phase, we make a couple of
observations about
.
Lemma 1:
is 2-connected.
Proof: We show this by induction on
. Suppose
is
2-connected for some
, i.e., the deletion of any
edge does not disconnect the graph. Then, it is easy to see
that the application of any of the 4 contracting rules preserves
2-connectivity, and therefore
is 2-connected. In observ-
ing this, keep in mind that if two nodes remain, the contracting
phase stops.
Lemma 2:
has two nodes with two or more edges be-
tween them.
Proof: This follows from the facts that the contracting
phase stops when
has two nodes and that
is 2-connected
(as shown in Lemma 1).
In the expansion phase of the algorithm, described next, we
present how assigned backup paths are mapped from
to
.
3) Phase 3: Expansion: In this phase, backup paths are first
assigned to
, and
is expandedin a sequence of steps to
by reversing the sequence of rules used in the contraction phase
to obtain
. In the following,we assume that a backup pathas-
signment for some
is given, and we show
It is easy to see that we will end up with two nodes eventually if the con-
tracting rules are applied to any 2-connected graph
.
how
is expanded to
and backup paths are mapped from
to
. We also show how backup paths for the edges that
appear in
but did not exist in
are assigned. Recall that
our goal is to assign backup paths as required by Method III,
i.e., if the backup path of link
uses
, then we would like the
backup path of
not to use
. The backup path assignment
during the expansion phase is done with this goal in mind.
If
was obtained from
by using contracting rule
(
, then the expansion is done by using the expan-
sion rule
described below.
In the following, we let
denote the backup path for edge
in
. In all of the rules below, if
does not pass
through any nodes that are merged in getting
from
,
then
is kept the same as
.
Rule 1: In this case,
is expanded to
by making two
nodes
and inserting the edges between
and
that were
deleted in the contraction phase. Let the number of edges be-
tween
and
be
(see contraction Rule 1).
This expansion rule is illustrated in Figure 6. We distinguish
between the cases
and
.
Case 1:
.
If
passes through node
, then
is set to
(if
is necessary; note that some backup paths may not need
to use
as shown in Figure 6), otherwise set
to
.
Then, we set
. For
, any path between
nodes
and
(other than
) is used as a backup path. Such a
path must exist because
is 2-connected.
Case 2:
.
Let
be the
edges between nodes
and
. If
passes through node
, then
is set to
(if
is necessary), otherwise set
to
. For
the edges
, the backup paths are assigned as
follows:
!
#"
.
u v
uv
Fig. 6. Expansion by Rule 1. Case 1 is shown.
Our backup path assignment according to Rule 1 has this
property: if backup paths are assigned successfully to toler-
ate the maximum number of double-link failures in
, then
the backup paths in
also tolerate the maximum number of
double-link failures. This can be easily observed from the way
the backup path assignment was done using Rule 1 – if there
are two edges
and
between
and
in
, and if
uses
, then we made sure that
does not use
.
Rule 2: In
, let us denote edge
by
, edge
by
and edge
by
. Let the other three edges incident at
nodes
and
be denoted by
%$
&
and
!'
, respectively.
Note that these edges were the only ones incident to node
in
.
We observe that the backup path for edge
$
in
uses
exactly one of the two edges
&
and
'
. A similar observation
