SDH Protection Schemes

Protection as a Defined Recovery Mechanism

A transport network must maintain a service when a fiber span, optical interface, or switching element fails. SDH/SONET protection provides a predefined alternate resource and a rule for selecting or switching to it. The physical working and protection routes, their monitoring points, and the allowed recovery commands are part of the protection design. This ability to continue service after a fault is called resiliency.

ITU-T G.841 defines SDH protection architectures and their switching behavior. It distinguishes multiplex-section protection, subnetwork-connection protection, and protection of an entire VC trail. The physical implementation can be a linear chain or a ring. SONET uses corresponding APS and ring specifications from ANSI and Telcordia. The mechanisms include dedicated 1+1 protection, linear 1:1 and 1:N arrangements, and shared protection rings. These schemes differ in the protected layer, the capacity allocation, and the APS signaling required for a switch.

Protection concepts

All protection schemes use redundancy: a protection resource is assigned so that traffic can continue when the working resource fails.

Working vs. Protection: The path or channel carrying traffic under normal conditions is the working entity. The alternate path or channel is the protection entity. For a cable-cut scenario, the two routes should be physically diverse, so one civil-works event does not remove both resources.
Automatic Protection Switching (APS): APS defines the messages and state transitions used to coordinate a switch when coordination is needed. In SDH/SONET, the K1 and K2 bytes are carried in the (MSOH in SDH, with the corresponding SONET line overhead). They carry requests, priorities, and status for linear 1:1 or 1:N protection and for shared ring switching. A 1+1 receiver normally selects between two already received copies and does not require an APS exchange. Network designs commonly target a 50-millisecond switch under specified fault and equipment conditions.
Line vs. Path Protection: Protection can be applied at different layers. Line protection (like MSP) protects the entire high-speed line signal (the whole STM-N). Path protection (like SNCP) protects a specific, individual payload (a Virtual Container) traveling within the line signal.

Linear Protection Schemes (Point-to-Point)

These schemes protect point-to-point links, such as a pair of optical spans between two sites.

1+1 (One-Plus-One) Architecture: Dedicated Protection

In 1+1 protection, one working path has one dedicated protection path. The receiver can choose between two copies without waiting for a remote bridge command.

Principle: "Bridge and Select." The sending node permanently transmits the same signal on both the working and protection fibers. This is the bridge operation.
Operation: The receiving node (tail-end) continuously monitors the signal quality on both incoming fibers. It selects the higher-quality signal to pass on to the rest of the network.
Switching: If the working fiber is cut, the receiver selects the protection copy that it was already receiving. No remote APS exchange is needed for this local selection; the measured recovery time still depends on fault detection and the equipment implementation.
Advantages: The receiver logic is simple, and the protection copy is available at the decision point.
Disadvantages: The duplicate transmission consumes the protection capacity continuously. In a two-path design, about half of the line resources are reserved for the duplicate and cannot carry unrelated traffic.

1:1 (One-to-One) Architecture

This architecture uses the protection path for lower-priority traffic during normal operation, while keeping it available for the protected service.

Principle: The working path carries high-priority traffic. The protection path is not idle; it can carry low-priority, preemptible traffic.
Operation: The head-end and tail-end exchange K1/K2 APS messages. Under normal conditions, the working path carries the protected service and the protection path may carry preemptible traffic.
Switching: When the working path fails, the affected node sends a switch request in K1/K2. The two ends coordinate the transfer of high-priority traffic to the protection path and preempt the low-priority traffic using that capacity.
Advantages: Normal operation can use protection capacity for additional traffic, so the allocation is more efficient than 1+1.
Disadvantages: The switch requires APS signaling and coordinated state changes at both ends.

1:N (One-to-N) Architecture

In a 1:N arrangement, one protection channel is shared by N working channels. The allocation saves capacity but requires a rule for selecting which failed working channel receives the shared resource.

Capacity model: One protection channel is assigned to a group of N working channels, and the protected service is selected by the APS state machine.
Operation:Switching equipment at both ends identifies the failed working channel. APS then coordinates moving that channel's traffic to the shared protection channel.
Limitation: One shared channel can protect only the failure or request selected by the group policy at a time. Simultaneous failures can therefore leave one or more working channels without that protection resource.

Ring Protection: Alternate Paths and Shared Capacity

A ring connects each node to two neighbors, so a pair of nodes has a clockwise and a counter-clockwise route. The protection architecture determines whether both routes carry duplicate paths or whether capacity is reserved for a coordinated line switch.

Multiplex Section-Shared Protection Ring (MS-SPRing)

The SDH term is Multiplex Section-Shared Protection Ring (MS-SPRing); the SONET term is Bidirectional Line-Switched Ring (BLSR). Both are shared line-protection architectures that use APS information in the multiplex-section or line overhead.

Architecture (2-Fiber Example)

In the common 2-fiber MS-SPRing/BLSR arrangement, two optical fibers connect each pair of neighboring nodes. The provisioned capacity on each fiber is divided into working and protection portions, often 50% and 50%. A channel numbering example such as 1 to 8 clockwise and 9 to 16 counter-clockwise is illustrative, not a universal timeslot assignment.

The Loopback Mechanism in Action

A ring switch, also called a "loopback" switch, handles a complete cable cut by using the reserved protection capacity on the intact side of the ring:

Failure: A cable is cut between Node B and Node C. Both fibers are severed.
Detection: Node B detects a Loss of Signal (LoS) on its link towards C. Node C detects a LoS from B.
Signaling: Nodes B and C exchange the failure and switch information in K1/K2 across the adjacent sections, allowing the ring nodes to apply the same protection state.
Loopback Switch:
- Node B, the node just before the break, performs a "loopback". The high-priority working traffic that it would have sent towards C is now looped back onto the protection capacity of the fiber going away from the break (back towards A).
- Node C, the node just after the break, performs the same action in reverse. Working traffic arriving from D meant for B is looped back onto the protection capacity going back towards D.
Result: Traffic travels around the intact side of the ring using the reserved protection capacity and bypasses the failed segment. Network designs commonly target restoration within 50 milliseconds under the specified fault, distance, and equipment conditions.

Path Protection: SNCP / UPSR

An alternative to protecting the entire line is to protect individual payloads or paths. In SDH, this is known as Sub-Network Connection Protection (SNCP), and in SONET, it is called an Unidirectional Path-Switched Ring (UPSR).

Principle:SNCP operates on the same "bridge and select" principle as 1+1 linear protection, but applied to a specific end-to-end path (a Virtual Container).
Operation in a Ring: At the source node (e.g., A), a specific VC payload is permanently bridged and sent in both directions around the ring simultaneously (clockwise and counter-clockwise). The destination node (e.g., C) receives two identical copies of the VC from both directions. It continuously monitors them and selects the better one for its output.
Switching: If a failure occurs on one side of the ring, the destination node selects the copy of the VC arriving from the other side. The decision is local, while the measured recovery time includes fault detection and selector processing.
MSP vs. SNCP:MSP (like MS-SPRing) is more efficient with bandwidth but protects the entire line (all traffic is switched together). SNCP is less efficient (like 1+1) but allows for per-service protection, meaning the failure of one path doesn't affect others, and different paths can have different levels of protection.