It is great ideal to prepare SCP-500 exam with Latest Braindumps.

SCP-500 mock test | SCP-500 cheat sheet pdf | SCP-500 exam dumps | SCP-500 exam results | SCP-500 Q&A - Killexams.com



SCP-500 - SolarWinds Certified Professional - Dump Information

Vendor : SUN
Exam Code : SCP-500
Exam Name : SolarWinds Certified Professional
Questions and Answers : 145 Q & A
Updated On : May 29, 2017
PDF Download Mirror : SCP-500 Brain Dump
Get Full Version : Pass4sure SCP-500 Full Version


No questions was asked that was not in my Q&A guide.

Tried a lot to clear my SCP-500 exam taking help from the books. But the elaborate explanations and tough example made things worse and I skipped the test twice. Finally, my best friend suggested me the question & answer by Killexams. And believe me, it worked so well! The quality contents were great to go through and understand the topics. I could easily cram it too and answered the questions in barely 180 mins time. Felt elated to pass well. Thanks, Killexams dumps. Thanks to my lovely friend too.

Dont forget to try these Actual Questions questions for SCP-500 exam.

I would take a privilege to say Many Many Thanks to all team members of Killexams for providing such a wonderful platform made available to us. With the help of the online questions and caselets, I have successfully cleared my SCP-500 certification with 81% marks. It was really helpful to understand the type and patterns of questions and explanations provided for answers made my concepts crystal clear. Thanks for all the support and keep doing it. All the best Killexams.

Great source of great real questions, accurate answers.

I got numerous inquiries normal from this aide and made an astounding 88% in my SCP-500 exam. At that point, my companion proposed me to take after the Dumps aide of Killexams as a fast reference. It carefully secured all the substance through short answers that were helpful to remember. My next advancement obliged me to select Killexams for all my future exams. I was in an issue how to blanket all the substance inside 3-week time.

It is great to have SCP-500 real questions.

I got numerous inquiries normal from this aide and made an astounding 88% in my SCP-500 exam. At that point, my companion proposed me to take after the Dumps aide of Killexams as a fast reference. It carefully secured all the substance through short answers that were helpful to remember. My next advancement obliged me to select Killexams for all my future exams. I was in an issue how to blanket all the substance inside 3-week time.

How many days required for SCP-500 preparation?

Killexams has top products for students because these are designed for those students who are interested in the preparation of SCP-500 certification. It was great decision because SCP-500 exam engine has excellent study contents that are easy to understand in short period of time. I am grateful to the great team because this helped me in my career development. It helped me to understand how to answer all important questions to get maximum scores. It was great decision that made me fan of Killexams. I have decided to come back one more time.

Observed maximum SCP-500 Questions in real exam that I prepared.

My brother saden me telling me that I wasnt going to go through the SCP-500 exam. I notice when I look outside the window, so many different people want to be seen and heard from and they just want the attention of us but I can tell you that we students can get this attention when we pass our SCP-500 test and I can tell you how I cleared my SCP-500 test it was only when I got my study questions from Killexams which gave me the hope in my eyes together forever.

SCP-500 certification exam preparation got to be this easy.

I wound up the exam with a satisfying 84% marks in stipulated time. Thanks very much Killexams. By and by, it was difficult to do top to bottom study proceeding with a full-time work. At that point, I turned to the Q&A of Killexams. Its concise answers helped me to see some intricate subjects. I chose to sit for the exam SCP-500 to attain further advancement in my profession.

It is unbelieveable, but SCP-500 real questions are availabe here.

I passed, and very delighted to report that Killexams adhere to the claims they make. They provide real exam questions and the testing engine works perfectly. The bundle contains everything they promise, and their customer service works well (I had to get in touch with them since first my online payment would not go through, but it turned out to be my fault). Anyways, this is a very good product, much better than I had expected. I passed SCP-500 exam with nearly top score, something I never thought I was capable of. Thank you.

Do you need updated braindumps for SCP-500 exam? Here it is.

It was just 12 days to try for the SCP-500 exam and I was loaded with a few points. I was seeking a simple and powerful guide urgently. Finally, I got the Q&A of Killexams. Its short answers were not difficult to finish in 15 days. In the true SCP-500 exam, I scored 88%, noting all the inquiries in due time and got 90% inquiries like the Sample papers that they provided. Much obliged to Killexams.

I feel very confident by preparing SCP-500 Latest Braindumps.

Found out this good source after a long time. Everyone here is cooperative and competent. Team provided me very good material for SCP-500 preparation.

Latest Exams added on Killexams

1Z0-453 | 210-250 | 300-210 | 500-205 | 500-210 | 70-765 | 9A0-409 | C2010-555 | C2090-136 | C9010-260 | C9010-262 | C9020-560 | C9020-568 | C9050-042 | C9050-548 | C9050-549 | C9510-819 | C9520-911 | C9520-923 | C9520-928 | C9520-929 | C9550-512 | CPIM-BSP | C_TADM70_73 | C_TB1200_92 | C_TBW60_74 | C_TPLM22_64 | C_TPLM50_95 | DNDNS-200 | DSDPS-200 | E20-562 | E20-624 | E_HANABW151 | E_HANAINS151 | JN0-1330 | JN0-346 | JN0-661 | MA0-104 | MB2-711 | NSE6 | OMG-OCRES-A300 | P5050-031 |

See more dumps on Killexams

000-619 | HP0-830 | 9L0-619 | E20-670 | 70-465 | LSAT | 920-181 | HP2-H17 | JN0-560 | 251-351 | HP2-K14 | ST0-074 | GED | HP5-H04D | E22-186 | 350-020 | 000-907 | C2180-374 | 9A0-094 | BH0-005 | HP2-027 | QQ0-300 | 9L0-066 | MA0-102 | OAT | 000-202 | 000-207 | ST0-91X | 9A0-060 | 310-540 | 350-026 | 000-017 | CRRN | HP2-H08 | BH0-010 | CSCP | 70-551-CSharp | HP2-Q06 | 70-334 | COG-320 | HP0-D02 | ISSMP | HP0-M33 | CLSSYB | C2140-130 | 000-115 | LOT-981 | PEGACBA001 | 1Z0-498 | E22-250 |

SCP-500 Questions and Answers

SCP-500


  1. firewall rules

  2. Windows services

  3. polling frequency

  4. bandwidth utilization


Answer: B


QUESTION: 137

What wouldcause an NOC user's accountto stay logged in indefinitely?


  1. using Account Manager to give administrator rights to the NOC user

  2. using Orion Web Console settings to increase timeout on the NOC user

  3. using Account Manager to disable timeout on the NOC user

  4. using theOrion NPM settings to change the default timeout


Answer: C


QUESTION: 138

The Orion NPMadministrator wants users to see a different node details page for all Extreme Network switches. How should the administrator implement this change globally for all accounts?


  1. use the Account Manager and select the new node details page for each account

  2. use the Views by Device Type to change theview to the new nodes page

  3. use the Manage Views and limit the new Nodes Details view

  4. use the Account Views to assign the view to the guest account


Answer: B


QUESTION: 139

AnOrion NPM administrator enables audible alerts through the Orion Web ConsolE. Assuming you are on a view that shows alerts, when will the audible alert be triggered?


  1. every 10 minutesif there is an active alert


  2. whenever your view includes NodesWith Problems

  3. whenever a new alert has appeared since the last refresh

  4. when you first log in to the Web Console


Answer: C


QUESTION: 140

The Orion NPM administrator needs to create an NOC view that hasonly a summary page. Which Orion component should you use to accomplish this?


  1. Account Limitation Builder

  2. Custom Property Editor

  3. Customize Menu Bars

  4. System Manager


Answer: C


QUESTION: 141

The Orion NPM administrator wants to add the company ticketing website as a menu item within the Web Console. What is the most time-efficient way toaccomplish this goal for all user accounts?


  1. add a custom html resource to the Summary view

  2. add user-defined links to the Menu bar

  3. add a custom link to the Modules bar

  4. add an external website to the Menu bar


Answer: D


QUESTION: 142

The NOC team wants to add asimplemap within Orion NPM that showsthe United States and theedge routerstatusfor each of the company sites. Which two operationsare required to set up this map? (Choose two.)


  1. modifybackgroundimage

  2. drag and drophyperlinks onto map

  3. drag anddropstatus icons onto map

  4. associate network interfaces with map lines

  5. dragand drop interfaces onto map


Answer: A, C


QUESTION: 143

Which two stepsare required tocreate a nested map using Orion NPM? (Choose two.)


  1. create asingle map that includes both site overview and site details

  2. add a hyperlink from the site details map tothe site overview

  3. select "Enable Nested Maps" onthe site details map

  4. drag and dropthe site details maponto thesite overviewmap

  5. create asiteoverviewmap and a separate site details map


Answer: D, E


QUESTION: 144

Network engineers want the ability tosee a custom propertywhen the cursor hovers over a node on the map. How do you enable this functionality in Orion NPM?


  1. addcustom property labelsto the nodes in the map

  2. enable the custom property for map display

  3. set up a drill-down text box for nodes in the map

  4. configure a custom tool tip for the nodes in the map


Answer: D


QUESTION: 145

A network engineerusing Orion NPM notices that a node on a top level map is green, even though half of the items in the associated nested map are down. What is the most likely cause of this issue?


  1. Availability thresholds for devices have been set to above 50%.

  2. Map status thresholds have been set to above 50%.

  3. Map status thresholds have been set to below 50%.

  4. Availability thresholds for deviceshave been set to below 50%.


Answer: C


SUN SCP-500 Exam (SolarWinds Certified Professional) Detailed Information

Non-Standard Game Over

"YOU embody Jeearr; you are cursed by ten thousand generations of victims; your face adorns the idols. And worst of all, you remain awake and aware, a witness to horror, never sleeping, and never, ever to escape. Your score is -99 of a possible 400, in 805 moves. This puts you in the class of Menace to Society." In most games, players see the dreaded Game Over screen when the Player Character is defeated in some way. Maybe you fell down too many Bottomless Pits and lost all your lives, lost all your Hit Points to a particularly vicious Demonic Spider. Failed a story important mission or lost a critical Non-Player Character during an Escort Mission. You might have been caught or captured during a Stealth-Based Mission. Or, maybe you just forgot to pause the game while reading the walkthrough you pulled from GameFAQs and the game's timer ran out — you get the idea. These are all standard failings, usually treated with a simple, default message: "Game Over." But, there are a few games that give unique sequences or even a full cutscene to particularly noteworthy player screw-ups. These are non-standard game overs. There are a few variations on this theme: This page is about the unusual, context-sensitive methods by which players trigger a Game Over screen. It doesn't include the times when the game tries to trick you into thinking that the game has ended. For games where every death is accompanied by a special message, see Have a Nice Death. For games where every death has a special animation, see The Many Deaths of You. For games where all bad endings contain extended narrations or demonstrations about the consequences of your actions, see It's a Wonderful Failure. For standard Game Overs that result from an instant-kill attack, see One-Hit Kill. For the game ending early due to a non-standard victory condition, see Instant-Win Condition. Examples:

    openclose all folders 

     Action Adventure 

  • Alone In The Dark 1992: The normal Game Over shows a zombie dragging your dead body to the altar of Pregzt, where it shows the text "The End". Nonstandard game-overs occur if you die in or near the final boss room, get eaten by the giant plant guarding the front door, or happen to read "De Vermis Mysteriis", in which case it just says "The End" on the screen where you died.
  • The Legend of Zelda:
  • The Legend of Zelda: Majora's Mask has two game over types; the standard death, and the ending that occurs if you let the moon fall on Termina. There's also an extension of the moon falling Game Over: If the guardians are called with the Oath to Order when even one of them isn't free, the free ones' attempt to stop the moon will turn out to be not working, at which point the player gets one minute (real time) left to play the Song of Time to escape. If the player opts to let time run out here, he or she will see a scene where the guardians fall over and the moon continues to fall. Then it continues to the normal scene of this Game Over variant. The Nintendo 3DS remake further extends this slightly: Whilst in the original game, "You've met with a terrible fate, haven't you?" appears on a black screen after the Moon falls, the remake adds some text telling you "And so the angry moon fell from the sky, annihilating this world and its many inhabitants", in between the moon hitting and the "terrible fate" line. The original game had some degree of ambiguity to its game over, but the remake straight up tells you that you were too slow and everyone died.
  • A more obscure Zelda Bad End can be found in The Legend of Zelda: The Minish Cap. As you fight through the last few enemies, Ezlo warns you that Vaati will be done draining the light force out of Zelda (fatally) by the time the bell rings three times. This can happen. The first two rings are scripted, but the bell will ring again if you take too long to beat the Darknuts.
  • In The Legend of Zelda: Twilight Princess, you accidentally set fire to Barnes' bomb storehouse and if you fail to Outrun the Fireball in time you're treated to a short cutscene of the building exploding around you and a Game Over screen. Similar situations occur if you fail to extinguish the flames on Prince Ralis' carriage quickly enough or jump off the burning Great Bridge of Hylia in time.
  • In The Legend of Zelda: Spirit Tracks, when you're travelling with a character, a Pirate tank (or ship) may invade your train. When this happens, lots of Miniblins (and later a Big Blin) will try to kidnap your passenger. If they succeed, you can still rescue the character when going to the Pirate Hideout island, so this wouldn't be a big deal. But if that place hasn't been unlocked yet (and it isn't yet by the time you're taking Carben, a plot-critical character, with you), you have no way to rescue the character, and you get an automatic Game Over.
  • In The Legend of Zelda: Skyward Sword, The Imprisoned triggers this if it manages to arrive at the Sealed Temple before Link can reseal it. The Imprisoned requires Hylia's soul (read: ZELDA'S) in order to reclaim its true form and power, and it's in the temple where he can find it.
  • Metroid:
  • Metroid Prime 3: Corruption has one: Stay in Hyper Mode for too long, and you see a cutscene of Samus turning into Dark Samus, followed by a modified death screen.note Normally, the game over screen has a red splatter appear, presumably blood. If you get this Nonstandard screen, there's this dark blue blotch (Phazon) that grows on the screen, and the words "Terminal Corruption" appear This outcome can also happen through a different means during the travel to the Very Definitely Final Dungeon: since Samus is already on a near-terminal stage of corruption, her PED Suit vents all of the Phazon out of her body, but at the cost of any further protection, so any Phazon damage will affect a yellow bar that replaces the standard energy meter (and as time passes, the atmosphere of Phazon will slowly fill it up anyway). If this yellow bar completes, Samus will reach total corruption and the Terminal Corruption scene will trigger.
  • Metroid: Fusion has exactly three Non-Standard Game Overs, all of which involve a timed mission. The first occurs when the X figure out how to hack the computer and order the engines' boiler to explode; the second when an SA-X discovers and attacks a secret Metroid breeding facility; the third occurs at the very end of the game, when Samus is forced to destroy the entire space station. If you run out of time during any of these timed segments, you will see the same cutscene you'd see if you successfully completed the mission — except that you don't survive. Of course, initiating said cutscenes are Instant-Win Condition type, so you can literally wait until the last possible second.
  • Tomb Raider: The Angel of Darkness:
  • If you take too long in Madame Carvier's apartment, the police arrest Lara and the game resets to the title screen.
  • Being too much of a jerkass to Bouchard during your first conversation with him will end with him pulling out a gun and shooting Lara dead on the spot.
  • In Tomb Raider (and loyally copied into its remake, Tomb Raider: Anniversary), if Lara makes the mistake of touching the magic hand of the Midas statue, she herself turns to solid gold, just painfully slowly enough for her to be able to realize what her mistake has cost her before she actually dies. Many players consider this to be the coolest death of the franchise.
  • In [PROTOTYPE], if you fail a normal mission, MISSION FAILED is displayed on the screen. If you fail the last mission, you see a nuclear bomb destroy Manhattan.
  • In The Matrix: Path of Neo, taking the blue pill.
  • If you fail most missions in LEGO Island, the Infomaniac will simply tell you so. If you fail to catch the Brickster, though...
  • In Mercenary II, also known as Damocles, death is normally a slap on the wrist, since you can use a safe quit option that will resurrect you and teleport to space in a cool ship that you can fly. However, you can activate non-standard Game Overs
  • failing to prevent the comet Damocles from colliding with the planet Eris (the president of Eris will then insult you)
  • destroying Eris instead of Damocles (the president will ask you if you understood the mission)
  • destroying one of two other unrelated planets (a newsflash will report the destruction of the planet and inform you that you are now wanted by the police)
  • destroying the author's computer, on which the game itself supposedly runs (all planets in the system will explode one by one, and your on-board computer will question your actions, telling you to reset the game. If you do not, your on-board computer will tell you that he is surprised you haven't left yet, informing you that "THERE'S NOTHING LEFT - IT'S ALL GONE - BLOWN UP". That phrase will remain on the screen until you reset the game.)
  • The 2003 Bionicle game has three, two of which are in Kopaka's rail-shooter level against the Bohrok.
  • First, when you fight against Gahlok, if you take too long to fight him, he will reach the Kini he is heading towards and will proceed to attack it.
  • Second, when you fight against Tahnok, if you take too long to fight him, the chase will end with him calling upon multiple Bohrok to beat the ever-loving crap out of you.
  • In the game's final level, in Tahu Nuva's racingrail-shooter level against the Rahkshi, Kurahk. If Kurahk gets to Ta-Koro before you do, it's game over.
  • Batman: Arkham Knight has a few Game Overs that are different from those of the previous games.
  • Occasionally you'll receive a comforting send-off from Alfred or Robin, guaranteeing that Gotham will remember you and they'll keep fighting the good fight.
  • If you fail during one of the Poison Ivy missions, she'll lament the destruction of her plant, saying that there's no way she can save Gotham now.
  • A rather terrifying example comes if you fail during the GCPD defense mission. You get a cutscene of Barbara and the cops in the lockup room, when suddenly the elevator opens and a minigunner starts firing, complete with audible screams.
  •      Action Game 

  • God of War Series:
  • During the final battle in God of War, Kratos is hurled back to the moment his family died by his hand, only to find them alive... whereupon Ares conjures up an army of Kratos clones. The family has their own health bar in the following battle; should it run out, a cutscene starts, showing Kratos collapsing in abject despair and sorrow, murmuring, "Not again..." The Kratos clones then gang up and chop him apart.
  • During one of the last battles in God of War II, Kratos is hurled back to the moment that he defeated Ares. The boss, Atropos, was going to destroy the giant sword you originally used in the first game to slay the god of war, which would lead to your retroactive death. If you failed to defeat Atropos before she could destroy the sword, you get a cutscene of past Kratos kneeling in defeat and getting stabbed by Ares, which causes present Kratos to wretch in pain and fall over, dead.
  • In Dante's Inferno, failing the Quick Time Event with Cleopatra when she starts fondling Dante results in him being seduced and a game over. Which is only natural, seeing as he's in Hell trying to save Beatrice.
  • In Paperboy, if you lose all your customers, the game over screen says "Paperboy Fired" instead of the usual "Paperboy Calls It Quits".
  • In Contra: Hard Corps, choosing to join Colonel Bahamut in one of the game's alternate routes will show an ending in which Bahamut conquers the world with the player character as his lackey. However, the player will be then taken to the Game Over screen and be asked to continue (if he has any credits left).
  • A mission in the later parts of Mafia II has you in a house trying to hide somewhere while hoping not to be seen by a hitman. If you decide to hide in the shower, you will be treated to an extra cutscene of the hitman shooting you through the curtains, and then you get your "You got killed"-screen. Another one will take place if you drive too recklessly while transporting a bomb, resulting in a massive fireball.
  • In North America's release of Custom Robo, the protagonist is freely given the option to not go on the final mission near the end of the game. If you decide not to go, the protagonist's partner, Harry, will beseech him — repeatedly — to reconsider. By steadfastly refusing to go, the rest of the team will go without him. The next day, the Big Bad arrives in the city, having killed off the others, and proceeds to destroy everything. And Harry chastises you for letting him die. After an ellipse, the game will return the player to the previous day where Harry insists that they all go.
  • In the Sega CD version of Spider-Man vs. the Kingpin, losing to the Kingpin (the final boss) results in a sad ending sequence in which the Kingpin triumphs over the defeated Spider-Man. He then lowers both Spider-Man and Mary Jane into the vat of deadly ooze, after which they are never seen again. In the Genesis version of the game, the bad ending consists of Mary Jane being lowered into a vat of acid, Spidey falling to his knees in despair, and "GAME OVER".
  • If you beat the final boss but fail to rescue all the animals in Rolo to the Rescue, the game tells you that it will "remain on your conscience" and "you will never truly be happy again". This is followed by the words "GAME OVER".
  • In Contra: Shattered Soldier, completing Stage 5 with too low a rank results in the archipelago being destroyed via Kill Sat, taking the heroes with it.
  • In the NES game Cowboy Kid, if the player accepts the bosses' deal to join the Mad Brothers, they will say that Sam became one of the villains who then did bad things and ended up getting hanged by the new sheriff of the town. After this, it shows the words "GAME OVER".
  • In the arcade game Magic Sword, choosing to accept the orb which drops when you defeat the final boss makes you the new final boss, with a caption asking who's going to save the world now.
  • Zone of the Enders has one that doubles as a bad ending: fail all SOS missions by getting an E rank (all building destroyed and no survivors), and Thunderheart will be abruptly and suddenly killed by an explosion shortly after he's introduced. ADA will confirm that Jehuty severing some of the colony's lifelines is what caused the explosion, and berate Leo for letting it happen. This is almost impossible to achieve unless one goes out of their way to do so, however.
  • In Bayonetta, Cereza gets captured by a Joy at one point. If you take too long to get to them, the Joy will fly away with Cereza in her arms, then the game over screen will show Cereza's discarded doll instead of the usual Bayonetta's corpse.
  •      Adventure Game 

  • The normal Game Over sequence in King's Quest VI is a very short cutscene in Hades. There are three Non-Standard Game Overs: a Deader Than Dead Game Over (Alexander's skeleton in tattered clothing collapses on a black background), a Baleful Polymorph Game Over ("Was that the beast you could do?"), and another non-deadly Game Over where Alexander gets captured and locked in the castle dungeon right before the wedding ("'Tis a noble thing to have a means of escape, and 'tis a far, far better thing to never get caught at all!")
  • King's Quest IV had a couple. Rosella could, in theory, complete all the victory conditions...except getting the magic fruit she came to get for the ailing Graham. What plays is most of the happy ending, but when she gets to Daventry, she has to admit failure and watch her father die. Another one was either failing to escape the tower cell or getting caught by Lolotte's guards, which ended with her forced to marry Edgar note  Mind you, Rosella does marry Edgar several games later, but it prevents her from killing Lolotte, rescuing Graham and Genesta, restoring Edgar to his true form, and reuniting him with his real parents.
  • Shadowgate: All the myriad deaths cut to a glowing-eyed Reaper against a sunset with the caption, "It's a sad thing that your adventures have ended here!!", except (at least) jumping into a massive chasm, which brings, "The Reaper Man stands below, waiting to catch you" instead. If that doesn't seem scary, you lack the childhood trauma.
  • In the original Leisure Suit Larry, anything that resulted in a "normal" dead body would trigger a cut-scene of Larry's corpse being lowered into a laboratory, which then creates a new Larry to be raised to the opening scene for the soon-to-be-restarted game. (Interestingly enough, getting killed in an alley would result in one of the techs saying Larry screwed up again, but this never happened anywhere else.) More obscurely, if the player took too long to reach the end game, Larry sees the sun rising, and then shoots himself in the head in despair over still being (technically) a virgin.
  • Space Quest IV: Roger Wilco and the Time Rippers has the option, at one point, to access an in-game computer and "delete" the files for Space Quest IV. Doing so automatically quits the game, with no warning. A similar thing happens if you type "cheat" in the second and third installments of Leisure Suit Larry. It's also possible to do this in Space Quest II, although it results in a different ending.
  • Freddy Pharkas: Frontier Pharmacist quits to DOS if you shoot yourself.
  • In an Older Than the NES example, many old text adventures (Interactive Fiction) games allow you to easily recover from death (sometimes by simply "walking out" of the afterlife, sometimes with an "undo" command) but have some exceptions where that doesn't work if you really screw up, such as by wiping yourself from existence through Temporal Paradox.
  • Example: The original Zork trilogy always cut to a prompt allowing you to "RESTART, RESTORE, or QUIT" upon death. The notable exception was if you died in Zork 3 while using the time machine to travel to the past — the game simply and immediately quit to the system command prompt, due to the historical paradox making your character cease to have ever existed entirely. This becomes particularly jarring for people playing the games on emulators on modern systems.
  • The notoriously cruel The Hitchhiker's Guide to the Galaxy text adventure also does this if you, as Ford Prefect, negate the events of the game by not saving Arthur Dent from the Earth's destruction in the first place. It is particularly notable for causing chaos and consternation among players by actually quitting the game in MID-SENTENCE.
  • Quitting the game became a less acceptable option over time at Infocom, but the Enchanter Trilogy, sequel to the Zork Trilogy, kept up the tradition of having special ways to die. In all three games, it is possible to take actions that not only cause you to fail your mission, but make the world substantially worse off than it was before. Thus, your score displayed at the game over prompt, which normally would be some score taken out of a total (100 out of 400, say) and give you a rank dependent on your score (from "Charlatan" to "Enchanter" to "Sorcerer" to "Archmage"), would instead become a score of -100 and your rank would be "Menace to Society". In the original game, Enchanter, one earned this rank for releasing a powerful Lovecraftian demon upon the land; in the sequel, Sorcerer, one earned this rank for successfully tracking down your demon-possessed mentor and allowing the demon to transfer itself to your far more powerful body; and in the finale, Spellbreaker, it was revealed that the entire plot of the game was a cunning trap and that actually succeeding in your goal would grant you this rank if you didn't see the ruse in time.
  • In the computer game version of Frederick Forsyth's The Fourth Protocol (in 1984), you have to uncover a Soviet plot to explode a nuclear bomb near a US Air Force base in Britain, to influence the upcoming British elections and lead to the election of an anti-NATO, anti-American, anti-nuclear, pro-Soviet government. Usually, if you take too long or don't get anywhere with the plot, you get a memo telling you you're being reassigned to The Falkland Islands, until you get far enough. When you find the bomb you have to defuse it, and if you mess it up you are told the plan succeeded: Britain fell to the Soviets, and they started working on Europe from two fronts. But sometimes a different ending appears: the bomb leads to a limited nuclear war, destroying both sides and making the northern hemisphere uninhabitable. This comes "From the annals of the Australio-Indonesian Empire..."
  • Failure during the finale of any Quest for Glory installment from Trial by Fire through Dragon Fire will lead not only to the hero's death, but a scene of the resident Sealed Evil in a Can breaking free to lay waste to the world.
  • This can happen several times in the second game, Trial by Fire. The main city is beset by four elementals over the course of the story, and three days after they individually show up, if they haven't been defeated, then you get a cutscene of them destroying the city. In addition, the final portion of the game, after the Big Bad gets the sealed evil but before it is released, any failure or waste of time will result in the above mentioned non-standard game over.
  • In the third game, the Fighter must become initiated into the Simbani tribe as part of the plot, and this means competing against your new friend and the chief's son Yesufu at the Initiation Ceremony. The competition includes a number of events, including running, which Yesufu will always automatically beat you at until a pre-scripted moment where he is injured. If you leave him there, the Simbani, who rely on complete trust and cooperation within the tribe to survive in a harsh environment, will be horrified by your selfishness and refuse to initiate you, leading to a game over.
  • In Shadow of Destiny, when you die, you are generally given a couple of hints, and automatically continue; without the option to game over. However, it is possible in at least the first chapter to meet yourself — by coming into contact with yourself, you create a time paradox which erases you from existence. It also fails back to the title screen. You also unlock one of the Multiple Endings by inducing someone else to do it.
  • The Interactive Fiction Game, Anchorhead, has a large number of grisly ways to die, but the character can go insane in true Call of Cthulhu fashion by either fully reading the black tome in the church or by attacking and killing your husband during the game's finale. The character can also suffer "Endless Torment" by being sucked into the womb at any point.
  • Return To Zork: In most deaths, a three-note song plays (the notes are from the game's opening theme), an evil guy laughs at you, and a temple screen is shown. However:
  • In the very first death of the game (getting attacked by a vulture), a longer song plays.
  • In any death relating to water, a different three-note song plays.
  • In any death relating to explosions, there is no song and no evil laugh.
  • In one death (walking over a pile of leaves and getting sprung in a trap that also turns you upside-down), the temple screen is also upside-down.
  • Two final special game overs, related to the Protection quizzes. One just exits out to DOS normally if you get the questions wrong, but in the other one, later on in the game, you are "blown" back to DOS by a double barrel hunting shotgun.
  • Typing "click heels" in the old The Wonderful Wizard of Oz text adventure would lead to a black screen and state that while it did get Dorothy home safely, it leaves her friends fending for themselves, and that Dorothy will spend the rest of her life wondering about the adventures she missed out on.
  • In Myst, if you try to enter either the red book or the blue book, the brother inside will keep you trapped inside the book by tearing out all the pages. If you enter the green book without the final page, you're trapped. In the nice ending, you put the white pages into the green book with Atrus in it. Then you get to wander the entire game world as a reward. Other entries in the series also offer multiple endings.
  • Normal game overs in Ghost Trick are caused by being unable to save your subject's life before time runs out. However, there are two instances where you can actively cause the subject's death.
  • If you recline the seat while the van-driver is driving, he will lose control of the vehicle and crash anyway.
  • If you replace the bullet with the hard-hat, rather than the soft knit hat, it will still crash into Cabanela's face and crush his skull (even more brutally than the bullet would have). His ghost isn't very pleased, but it's hilarious to watch.
  • Another instance (in the same chapter as the second example) occurs if you try manipulating objects in view of the killer.
  • In the video game version of Monty Python and the Holy Grail, you play most of the game as King Arthur, but the "Knights in Kombat" mini-game allows you to play as Arthur or the Black Knight. If you play as the Black Knight and win, the game immediately cuts to the Game Over screen.
  • the white chamber has a full eight endings. Four are standard Have a Nice Death you get by getting killed before completing the story (end up in outer space, get electrocuted, die from toxic air, or decide to stay in a quarantine bay until you expire). Completing the story nets you an ending depending on how many points you've gained by certain deeds until then: five points nets you the Redemption ending, in which you leave the station. Less, you get the Damned ending in which you have to do everything all over again since you didn't learn. Zero points nets you the Tormented ending, in which you're essentially dumped into HELL. Oh, and scoring six points (difficult unless you go out of your way to do everything right) lands the Comedy ending, which is weird.
  • In one of Homestuck's flash "walkarounds" (Past Karkat: Wake Up), Karkat specifically tells you not to fall asleep — that doing so would be fatal, given the dream worlds' annihilation. Later on, Nepeta shows you to an Easter Egg room with a bed and lots of treasure chests. Guess what you can do.
  • At the end of Beneath a Steel Sky, you can get one either by having Rob voluntarily plug himself into LINC, or waiting until LINC itself grabs him. Rob struggles for a while, then has his mind wiped and replaced with that of LINC.
  • All of the endings in the Atlantis series are non-standard, and depend entirely on what wrong choice you made to bring them about.
  • In Sword Of Shannara if you attack the Warlock Lord instead of the book controlling him, you get a text-only ending where the main character is the new Warlock Lord.
  • Trying to enable cheat codes in The Stanley Parable results in Stanley being trapped in "the serious room", leaving the player no choice but to restore or restart.
  • The PC game Hell Cab, despite having a three-strikes-and-you're-out life system, has a few instant-death consequences depending on your morals. Early examples include telling Nero you want to throw the ladies to the lions, and choosing to kill your opponent during the gladiator match.
  • In The Dead Case, shortly before the very last part of the game, the killer runs into the house of the protagonist's fiance, pursued by the ghost of his wife. The dead wife goes to set the house on fire, and the player is given the choice between stopping her and letting her go ahead. The correct option is to stop her (which will lead to the two going inside the house, stopping the killer, and saving the fiance), but letting the ghost burn the house down will result in a game over, informing the player that the fiance died and the killer escaped.
  • In the bonus chapter of Nevertales: The Beauty Within, failing the test of character results in the main character's husband being crushed to death while she waits fruitlessly forever for his return.
  • In Super Adventure Rockman, the default Game Over screen is Roll dying. However, there are some battles that can cause a Game Over for you.
  • Losing to Shadow Man will cause Shadow Man to kill Mega Man off screen, and give out a Evil Laugh.
  • Losing to Gemini Man will cause Gemini Man to comment on Mega Man's loss before finishing off Mega Man with his Gemini Laser and giving out a Evil Laugh. The screen fades to black with no option of continuing.
  • Losing to the final boss will cause a Game Over where Ra-Moon kills everyone and takes over the world. There is a option to retry the final boss, luckily.
  • Another example from Zork. If you are in the forest, in just the right spot, and throw the knife or golden egg at a tree, it bounces back, hitting you in the face and killing you instantly. The game then tells you that you seem like a good guy so it will give you another chance and automatically restarts for you. You then appear, alive, in the forest, right where you were before, but without any of your belongings. In front of you, whatever you used to kill yourself will be right in front of you. You pick it up, throw it at the tree again, it hits you in the face again, killing you again. The third or fourth time you do this - or kill yourself in any way three or four times in a row - the game gives you the message "You are obviously unstable" and gives you the game over message.
  •      Beat 'em Up 

  • Fable Heroes normally does not allow the player to lose; even if all Player Characters in the party are killed, they can complete the level as ghosts, receiving fewer resources. The normal end screen shows the party members standing on a championship platform. However, if the game is set to the highest difficulty level and all the PCs die, the game cuts to the same platform but with all of the top 3 spaces occupied by monsters, with the heading "The Creatures Win!"
  • In Undercover Cops, failing to stop Dr. Crayborn from dropping the atomic bomb on the city will result in a bad ending in which the city is destroyed by the bomb and the three city sweepers are forced to quit their jobs, followed by the Game Over screen.
  • In Anarchy Reigns, during the boss fight against the Blacker Baron, once you weaken him to about 25% of his life, you'll be warned of an impending plane crash on your position. After weakening him further, you'll then have about 20 seconds to finish the fight, or else the plane will crash, killing you both and causing a Mission Failure.
  •      Fighting Game 

  • In the arcade version of Street Fighter Alpha 3, losing the final CPU match against M. Bison does not allow you to continue. Instead, you'll get an alternate ending in which M. Bison uses your character's body as an energy source for his Psycho Drive. And if you lose to Ryu playing as M. Bison, it will play Ryu's ending instead.
  • Normally, losing a fight in the first Fatal Fury leads to a taunting quote from your opponent and a "Continue?" screen showing your fighter's battered picture. Losing to Geese, the last boss, however, gives you a cutscene where he kicks you off of Geese Tower. The "Continue?" screen likewise shows your character plummeting to his death.
  • Given that using a Continue would place you back at the same battle again, one imagines a giant trampoline placed directly under the window...
  • In Marvel vs. Capcom 3, you can watch a unique ending sequence if you lose to the final boss and opt not to continue. In Ultimate Marvel vs Capcom 3, said ending became unlockable by beating the newly added Galactus Mode.
  • In Bushido Blade, you must fight your opponents honorably in Story mode. Use dishonorable tactics and the game abruptly ends after a certain point, with a usually random message berating you, such as "None are more contemptible than those who defile the way of the Bushido."
  • In Tekken 5, if you lose to Jinpachi and let the "Continue" timer run out, you'll get an extended Game Over. Instead of just a plain "Game Over" appearing, a cutscene plays first. Jinpachi laments that no one was able to stop him, cries Tears of Blood, and goes One-Winged Angel one last time before rocketing himself into the sky. The screen fades to black, and a message comes up saying "Jinpachi's mind is consumed by the devil as he reaches his final transformation. The world will never be the same."
  • In the Arcana Heart series, should you time out during the final boss battles, the bad endings show either the Elemental World and human world merging in the first game or Japan getting destroyed by Ragnarok in the third.
  • In the original Virtual-ON and the sequel Oratorio Tangram, attempting to defeat the final boss by time over will result in a bad ending (due to a Wave Motion Gun on the moon powering up in the first game, or a Reality Warper super-computer activating in the sequel).
  • In the Virtual Boy game Teleroboxer, there is a "Title Defense" mode which can only be played if you defeat all of your robot opponents, including the "Legendary Champ". If you lose even one match in the "Title Defense" mode, it will say that you are no longer the champion and you must now retire. Depending on which save file that you played on, it will say "CHAMPION RETIRED" on it, which means you cannot play on that same save file ever again.
  •      First Person Shooter 

  • In Time Shift, if you block or otherwise interfere with certain movable objects while using your Time Reversal power, you get a non-standard Game Over due to Time Paradox.
  • System Shock's normal game over is you serving SHODAN well, as a cyborg. You get a non-standard game over when you fire the mining laser into Earth. The game ends with a frantic Cyberspace battle where the player crashes an AI who in turn hacks the player's mind. The latter is represented by a storm of pixels slowly filling the screen. If the AI wins, the pixels fill the screen to form a picture of her empty, emotionless, Gigeresque face.
  • If you die in Jedi Knight II: Jedi Outcast, you will usually just watch Kyle die in a slow motion sequence. However on one level, you are required to be stealthy. If an enemy raises the alarm, you will see a cutscene of Kyle in prison just before being tortured.
  • America's Army:
  • If you shoot an instructor, the screen goes black and then transports your character to a prison cell in Leavenworth.
  • If you shoot people on your own team too many times in online play, the game will kick you out of the server and give you the Leavenworth scene as well.
  • Half-Life has several of these, usually taking the form of a black screen with white text:
  • When using the teleporter "gun" in Opposing Force, there are places where you can translocate into nothingness, giving you an unusual Game Over screen.
  • And if you try to chase Freeman to Xen, you will lose due to creating a Temporal Paradox.
  • And similar to the America's Army example above, you can attackkill an instructor during the tutorial and get yourself court-martialed.
  • In the Opposing Force Chapter "Friendly Fire", you can damage the rocket the nuke that will eventually blow up Black Mesa came in, to the point where it explodes!
  • Similar to the Opposing Force tutorial example mentioned above, this can also occur at the start of Blue Shift before you officially report for duty. You're given a pistol at the practice-firing range, loads of comrade security guards are around, no need to guess what happens if you decide to shoot someone.
  • Refusing the G-Man's offer at the end of Half-Life might be a case of this, or a case of Multiple Endings. He expresses his regrets, and then it's not pretty.
  • There's also a much earlier Half-Life non-standard game over during the Questionable Ethics level where you need to bring one of the three hiding scientists to the eye scanner to unlock the front door of the building. If you decide to kill all three of the scientists, get them killed by the malfunctioning surgery saws, or otherwise let them die before the door is unlocked, you end up trapping yourself. The game will then fade out like the G-Man endings after the last remaining scientist dies.
  • In Half-Life 2, crashing a vehicle into a location that the player will not be able to recover will result in you getting terminated for "failure to preserve mission-critical resources".
  • Jumping off the cliffs on Highway 17 will fade to black with the note that you "demonstrated exceedingly poor judgement".
  • In Episode Two, the G-Man's endgame reports have been replaced with Vortessent messages, the most amusing of which comments that "the Magnusson's misgivings about the Freeman were completely justified" if the player fails to protect the base.
  • In Red Faction, if Griffin dies, you will get a special message saying "Your failure to protect Griffin doomed the rebellion, etc'', followed by just "Game Over" instead of "You Have Died". A similar thing happens if Capek kills Eos during his boss battle.
  • In Tron 2.0, if you kill any non-hostile andor "Civilian" Programs (like Ma3a, Byte, or any character that you can talk to), you hear a voice say "Illegal program termination." Five seconds later, you get a screen with the same message.
  • If Ma3a is killed during her Protection Missions or a stray shot takes out Alan when you're running your Escort Mission with him in the latter part of the game, the message is "You failed to protect Ma3a your father." Ma3a proves difficult to defend; Alan (being possibly the most rational character in that universe) has the good sense to duck when the discs start flying.
  • In the final mission of Target Terror, if you directly shoot the final terrorist instead of the Dead Man Switch he's holding, the plane blows up. If you run out of lives during the "no continues" part of the mission, the plane is shown crashing into the White House.
  • Call of Duty: "You are a traitor to the motherland!" if you kill a Commissar in the Russian campaign, "Friendly fire will not be tolerated", if you shoot a friendly elsewhere, or "You were killed by a grenade, exploding vehicle, lethal pocket of radiation, etc."
  • If you fail the helicopter jump in Modern Warfare, you get "Nobody makes their first Jump...". If you miss your shot in the flashback level "One Shot, One Kill", "Zakhaev escaped unharmed".
  • In Modern Warfare 2, in the early mission "Team Player", if the player chooses to run in on foot rather than go into the convoy, you are promptly taken down by sniper fire with the notice "It would probably be safer to ride in the convoy."
  • Failing to move past certain events in recent installments will replace the quotes with whatever you are supposed to do. One is reminded to "Hold on for dear life" after falling to death while ice climbing.
  • Dying to an attack dog in Modern Warfare or a Banzai charger in World at War has the game tell you when to press the melee buttonkey to save yourself.
  • In Call of Duty 2, there are two instances, one in "Red Army Training", and one (appropriately enough) in "Prisoners of War", where the game will display the message "Killing prisoners of war will not be tolerated" if the player attacks captured German soldiers.
  • Operation Wolf: Aside from "sustaining a lethal injury", the game will also end if you run out of bullets and grenades ("Since you have no ammunition left, you must join the hostages."). Strangely enough, you still have to run out of health before that happens.
  • In the Xbox 360 version of Secret Service, shooting the President results in a game over... and unlocks a zero gamerscore achievement entitled 'The Exact Opposite Of Your Job'.
  • Halo: Combat Evolved:
  • If Captain Keyes dies in the mission "Truth and Reconciliation", where you have to rescue him, the camera cuts to him falling, and Cortana says "No! Without the Captain, the Covenant have already won".
  • If you run out of time during the Escape Sequence on the final level, the game displays a cutscene of the Pillar Of Autumn exploding with you still onboard.
  • Typically one can friendly fire your fellow marines and still complete the level even if they turn on you and try to kill you. The ONE exception to this is if you kill one of the bridge crew on the first level, "The Pillar Of Autumn". Doing this causes the room exit to be locked and invincible marines to attack you. You can't complete the level and you WILL die eventually.
  • In Rise of the Triad, failing to catch all of El Oscuro's (the final boss and villain of the series) spawn will give you a seemingly standard ending... but twenty years later, one of his spawn rises to power and explodes the Earth. But nice work, anyway. You then get a voice telling you that "Youuuuuuuuuuuuuu suuuuuuuuuuuuuuuuuuuuuuck."
  • In Strife:
  • The first Soldier of Fortune has a number of these for failed mission objectives, such as running out of time to stop the missile launch in Siberia.
  • In the first Stealth-Based Mission of Soldier of Fortune II, if a guard spots you, Dr. Ivanovich is immediately captured and you get a slightly different Game Over screen. In the level where you are escorting a team of soldiers, disobeying orders or accidentally shooting one of them results in them executing you on the spot.
  • In the original Time Crisis, running out of time caused an instant game over, unlike the sequels.
  • Left 4 Dead has a non-standard game over in the finale of The Sacrifice. There has to be a minimum of 2 survivors alive to perform the sacrifice; one survivor has to jump off the bridge and restart the generator to get the bridge up and the other survivor has to be on the bridge to get away from the zombies once it is raised. If 3 survivors are killed or are incapacitated on the bridge and the survivor sacrificing themselves is off the bridge, it counts as a failure and you will have to redo the finale. This is coming from a game where the only way to lose is everyone dying.
  • Quake IV has a Nonstandard Game Over that can be activated at two distinct points, both of those points happening when an ally you're supposed to protect is killed.
  • Usually in SWAT 3 and SWAT 4, failing objectives does not end the entire mission in failure, with Mission Control instead asking if you want to continue and try to salvage what you can of the mission. A few missions, however, have objectives that, if failed, result in an immediate game over (i.e., letting the plane take off in SWAT 3's "Rapid Deployment, Airport" mission), complete with an FMV showing what happens afterwards.
  • In Return to Castle Wolfenstein, in the Rocket Base mission, there is a German operator counting down the time left before the rocket you have to destroy will take off. If you fail to destroy the rocket in time, the game will fade to black as the rocket takes off and you will have to start again.
  • In the Marathon game mod Gemini Station, if you kill Jack Melville in the penultimate level, you are charged with his murder and sent to an Oubliette, where the only way out is suicide by crushing trap.
  • Nosferatu The Wrath Of Malachi: If you get killed by the Count or Malachi, you get a special cutscene saying that you were the last sacrifice needed to restore Malachi's powers, and now you will be absorbed into him as he is released to destroy the world.
  • Far Cry 4 has one right at the start of the game. If you do what the horrifying, Affably Evil psychopath Pagan Min says and simply wait around until he comes back, he returns and starts up a pleasant conversation about Ajay's mother, revealing several key plot points in the process, then puts Ajay on a helicopter and takes him to Lakshmana so he can honour his mother's dying wish, then rounds up by asking Ajay if he wants to go do something fun before the credits roll. Probably one of the most egregious, anti-climatic, and humorous examples of We Could Have Avoided All This in modern fiction.
  •      Light Gun Game 

  • Zorton Brothers has an example of this; besides the undertaker burying you if you lose all of your lives, the fight against the Zorton Brothers is this; you only have two bullets to kill the Zorton Brothers. If you miss a single bullet, you will be shot, and you will be treated to a scene with the undertaker commenting on your loss against the Zorton Brothers. Afterwards, your remaining lives are ignored, and you do not get to continue, meaning that it's back to the beginning of the game for you.
  •      H-Game 

  • RPG eroge made by Eushully tend to have this. Even losing in battles that should be somewhat easy will result in a slightly extended ending. For example, losing against an assassin in Reiki has the main character talk with said assassin before going to the game over screen.
  • Typical H-Game fandom has a GOR (Game Over Rape) subgenre, which is all about this trope.
  • This is typically averted in Corruption Of Champions, where no matter how badly you've gotten your ass kicked by an enemy you are guaranteed to "come to your senses in 8 hours, missing some gems". Most players die their first time by abusing transformation items which if used too much can leave you as a wild horse or a mindless puddle of slime to name a couple, though it is actually possible to get a Game Over by losing to enemies during specific scenarios.
  •      MMORPG 

  • In World of Warcraft, a Total Party Kill during the Madness of Deathwing encounter will result in him activating the titular ability "Cataclysm". Doing so causes the entire screen to temporarily go black as he just destroyed the planet.
  • The same thing used to happen if the countdown ran out for Algalon the Raid Destroyer, for the same reason.
  • In EVE Online, getting your ship destroyed or running out of scan probes in wormhole space after the wormhole you use to get there collapses results in you becoming stranded in an unknown solar system. It's not technically a 'game over' since you can hire other pilots to come find and rescue you, but if nobody does, it is.
  • The fight against Bismarck in Final Fantasy XIV occurs on a floating island being pull along by an airship. Periodically Bismarck will ram the island and weaken its integrity, which is represented by a special bar. Should this bar reach 0% you are treated to a lovely cut-scene in which Bismarck rises up a swallows whats left of the island whole. With your character still on it.
  •      Party Game 

  • In Getter Love!!, the game normally ends when you or one of your opponents declares your love to one of the girls. If someone other than you wins the game, you're treated to a word from everyone involved, and that's it. If two game-weeks pass by and no one wins, you'll be treated to a scene where Reika, fucking, MARRIES YOU, as her equally butt-ugly family attends her wedding ceremony.
  •      Pinball 

         Platforming Game 

  • Kirby 64: The Crystal Shards has a Boss Rush mini-game. When you lose all your lives, you fall down one last time as if there's a hole. And instead of "Try Again" and "Quit", you get "Accept Defeat".
  • Conker's Bad Fur Day involves a fabled Panther King seeking a red squirrel with which to replace his broken table leg, so as to prevent him from spilling his milk on said table. The standard game over has Conker, the protagonist, tied and gagged to the king's table leg. Depending on the circumstances of the player's death, the game's nonstandard endings include the Panther King's minions turning Conker in as either a bag of soggy squirrel (drowning or otherwise dying underwater), bloodied chunks (gibbed), or black char (burned or electrocuted), or just a shot of Conker's Face on a Milk Carton (falling down a bottomless pit). In the final stage of the game (after the Panther King dies), they do away with the cutscene entirely, only showing you "GAME OVER" on a black screen.
  • In the first two Banjo-Kazooie games, as well as Donkey Kong 64, just quitting the game triggers a Game Over banner, as if the developers of the games (Rare) wanted the player to beat the whole campaigns in one session. In both DK64 and the first BK, the Game Over includes a scene showing the potential outcome that would result if the protagonists failed to twart the plans of the villains; like in Conker's Bad Fur Day, however, once the player gets past the foil of the evil plans, and all that remains is the final battle, no scene is shown, as the game just puts the Game Over banner before returning to the title screen (this is also true for the entirety of Banjo-Tooie, which doesn't have any Game Over cutscenes whatsoever).
  • Castlevania:
  • In Castlevania: Rondo of Blood, normally Richter dies in a Rain of Blood (being the first Castlevania protagonist to suffer this), but getting ambushed by a living portrait ends up with Richter being trapped in a picture within the picture — which the figure in the portrait proceeds to tear up. It's the only unique death animation in the game. That said, this isn't really a Game Over (unless you were on your last life).
  • Losing to the True Final Boss in Castlevania: Aria of Sorrow results in Soma being taken over by Dracula completely, and you get a short scene where Julius Belmont is implied to make good on the I Cannot Self-Terminate promise he made with Soma earlier. The DS sequel one-ups this even more: getting the Non-Standard Game Over unlocks a new game mode where the other characters team up to take down the now Face Heel Turned protagonist.
  • In Kya: Dark Lineage, standard Game Overs show a screen saying "Game Over". However, near the game's end, if you're hit by traitor Aton's Wolfen Gun, you can see a sequence where Kya slowly transforms into a scary, female Wolfen. And that's The End.
  • Rayman 2 has exactly one of these. There's a quest in which you have to locate a healing elixir in the Cave of Bad Dreams. After completing the cave's obstacle course, you are offered massive sums of cash. If you accept this, you will find yourself sitting on a luxury yacht with a pile of cash the size of a small building. The implication is that Rayman lets his greed get the best of him and decides to simply let the pirates enslave everybody while he lies around enjoying his money. The game snaps you back immediately instead of ending the game though, and will cycle through until you pick the right option. In some ports of the game, Rayman just takes the potion automatically, though.
  • Cave Story:
  • After the standard Critical Existence Failure, the gameover screen reads "You have died. Would you like to try again?" If your Oxygen Meter runs out underwater, the screen changes to "You have drowned." If you fall into either of the two Bottomless Pits in the game, it reads "You were never seen again..."
  • The worst of the game's Multiple Endings borders on a non-standard game over. Notably, the music that plays ("Hero's End") is different from that in the better endings ("The Way Back Home"), and this is the only ending that lacks the ending credits.
  • In Sonic the Hedgehog CD, waiting idle for 3 minutes will cause Sonic to lose his patience with you, and with an "I'm outta here!", leave the game, giving you a Game Over.
  • In SegaSonic the Hedgehog, failing to escape from Eggman's Tower in time will cause a Game Over with no option to continue.
  • Sonic the Fighters. Not beating Robotnik in 15 seconds or less also results in this.
  • Plenty of 'em in I Wanna Be the Guy.
  • Inverted in The New Zealand Story. If, after clearing World 1, you lose your last life by getting hit by an arrow (or similar) attack, instead of the standard game over screen, you instead go to "heaven", and have a chance to escape in order to continue the game. If you make it to the end of this "hidden" stage, however, the game ends for real. You have to find a hidden exit in order to get out of this "nonstandard" game over. Escape and you have one last chance. Lose that, and you're taken to Hell for another Nonstandard Game Over.
  • In Drawn to Life, you can choose not to help the Raposas. Mari, the only one hearing from "you" at that point, loses hope, and the game ends.
  • In Mega Man Legends 2, if you mess up during the time you're defending Nino island from the Birdbots and they blow through the gate, the scene switches to the Guildmaster going nuts and hitting the self-destruct button, blowing up the island and everything in it.
  • In Mario's Time Machine, if you either lose all of your lives or run out of time rescuing all of the artifacts from Bowser, then the game will show a cutscene where Bowser successfully activates his time machine and escapes to a tropical island. If you rescue all of the artifacts but get them back in the wrong time period, then Bowser's time machine will overload, and as a result he is sent back to the Cretaceous period all dazed and confused-looking. If you get everything right, then Bowser's time machine will still overload, and as a result he is sent back to the Cretaceous again, only to be crushed to death by a giant dinosaur foot.
  • In the second episode (game) of Commander Keen, there are Tantalus Ray Cannons you must destroy in order to save Earth. There are eight of them, but if you press a switch on the side of any of them, a Tantalus Ray shot will destroy the planet and your game is over instantly.
  • The classic Sonic the Hedgehog fan game Sonic Robo-Blast had a stage set in a volcano that would erupt in five minutes, real time. The eruption was an instant Game Over, ignoring lives.
  • Running out of time on the Dam level in Teenage Mutant Ninja Turtles causes the bombs to detonate. This causes a game over, no matter how many turtles you had remaining.
  • In the arcade game Elevator Action II (Elevator Action Returns in Japan), if you run out of time near the end of the final stage (the nuclear missile silo), the missile will be launched and a picture of an erupting mushroom cloud is shown, followed by a message on the computer screen that says "YOUR MISSION IS OVER".
  • In The Simpsons: Bart vs. the Space Mutants, losing your last life in the final level rewards you with a look at the aliens' ultimate weapon: an army of Homer Simpson clones.
  • In the Oddworld series, there are horrible consequences if you fail to complete the in-game tasks to a high enough standard. In Abe's Oddysee, if you fail to save over 50 Mudokons, Abe will be sliced and diced through a meat saw in Rupture Farms. In Abe's Exoddus, again, failing to save enough Mudokons, will leave Abe in the hands of the Brewmaster, who will strap him down and pass electricity through his body to extract his tears. Eventually, the electricity gets turned up too high and he will be electrocuted. In Munch's Oddysee, failing to obtain a certain level of Quarma will leave both Munch and Abe to be mauled by Fuzzles, who also alert the Vykkers as to their whereabouts. Abe will be killed and his head hung on a wall. Munch has an even worse fate. He is strapped down, while his lungs are forcibly removed while he is still fully conscious so that they can be given to the ailing Glukkon queen.
  • The Famicom Star Wars game had a cutscene of the Death Star destroying Yavin IV if you ran out of lives on the last level.
  • The Sega game adaptation of Tom & Jerry: The Movie has one where, if Tom is idle for too long, Jerry simply runs off the screen, taking you to the Game OverContinue screen.
  • The indie PC game Iji includes a specific death sequence for being slain through overkill. Ordinary deaths in the game, through small arms fire, electric shock, or even a nuclear explosion, result in the protagonist shrieking, flying backwards, and exploding, cracking the camera as the game over screen plays. However, getting killed by the ultimate attack of the final boss, who wields a Phantom Hammer, normally mounted on space ships to exterminate all life on a planet, instead results in Iji being obliterated before she can scream, wiping her stats to zero, with nothing but silence left where she once stood.
  • In Mystery Quest, losing all of your Hit Points gave you a normal Game Over screen with Hao standing in place and crying. However, if he should die by jumping into deep water without an SOS raft, the Game Over screen will show Hao crying against a watery background while displaying the words "Hao Can Not Swim; Game Over".
  • Wario Land 3 has a strange variation, where the Game Over is non-standard because there is only one way to die. Normally enemies can only inflict Amusing Injuries on Wario (like getting Squashed Flat or set on fire, and some of these even allow him to reach new areas, but during the Final Boss fight Rudy the clown will occasionally try to grab Wario. Let this attack connect and you receive the ONLY Game Over in the whole game.
  •      Puzzle Game 

  • One question in The Impossible Quiz 2 asks "Click Yes to exit." Clicking "Yes" will take you back to the title screen, without the Game Over screen.
  • In the computer version of Who Wants to Be a Millionaire??:
  • If, on the Fastest Finger portion of the game, no one gets it right after several attempts, Regis Philbin comes on, mocks you for being stupid, and says "That's it, I'm out of here." Then the game quits.
  • This also happens as early as the select mode screen. note  It gives you the option of either going straight to the game or playing Fastest Finger first. If you do nothing, Regis will make a comment once every few seconds, growing increasingly impatient each time, before he finally throws in the towel and quits the game for you, kicking you back to your desktop.
  • In almost all You Don't Know Jack games, the following will happen when the contestants respond with "fuck you" on Gibberish Questions three times in a single game: the first time, you lose a very large sum of money, and depending on the mood, the host will take even more and possibly even rename you into something insulting. The second time, nothing happens to the score because he doesn't find it funny or creative enough to warrant the punishment a second time. The third time, he just gives up and closes the game, and he'll make it known you can't pause or press a key to get out of this if you tried.
  • Antichamber: Killing yourself in-game (namely by crushing yourself with blocks) will crash the game engine.
  • LIT gives you a unique punishment if you use too much electricity at one time; the generator breaks and the screen undergoes a Fade to White, leaving Jake and Rachael at the mercy of the creatures in the darkness.
  •      Racing Game 

         Real Time Strategy 

  • Rise of Nations:
  • The game has two kinds of Game Over: the normal defeat, when your opponent simply wins, and the Armageddon defeat, which happens if you drop too many nukes, and basically means everybody loses. Similarly, the Cold War campaign has two Game Overs: the normal defeat, where the opposing side wins, and the Nuclear Holocaust ending, where everybody fires Mnogo Nukes.
  • Theatre Europe. Notably, you can't win as Warsaw Pact under the hardest difficulty, as NATO will, as a desperate measure, launch a major nuclear attack against you, leading to an End of the World as We Know It.note Oddly, this tracks actual historical NATO and Soviet doctrine: the US and NATO merely had a no-offensive-use policy—that is, we'll use nukes first, but only if they attacked conventionally first—but not a no-first-use policy. The US and NATO several times considered and rejected proposals to move to no-first-use (most recently in 1999 on a motion by Germany). In contrast, the USSR actually did have a no-first-use policy from time to time (although they never announced it). This shows in their respective targeting: US missiles were targeted counterforce (aimed at known Soviet missile sites) while Soviet missiles were targeted countervalue (aimed at US and other NATO cities and sites of economic value). (Conversely, when playing as NATO, your goal is to defend yourself for a requisite number of turns; if you ever enter the Warsaw Pact territory, the enemy will start a global nuclear war. You can also trigger it deliberately, or by provoking the enemy by launching one too many nuclear missiles against them.)
  • The old MS-DOS Real-Time Strategy game Command HQ features a nonstandard game over by nuclear winter. Normally, allowing your capital to be overrun results in the status bar stating "We captured the enemy's capital!" or "The enemy captured our capital!", along with a catchy tune and a bit of flashing. However, if you use too many nuclear strikes in a scenario, it exits straight to DOS with the message "SIC TRANSIT GLORIA MUNDI" (Latin for "Thus passes the glory of the world.")
  • Failing the storyline stage battles in Brütal Legend leads to a Type A cutscene where they gloat over you.
  • Battle Zone 1998 includes several missions that avert Take Your Time despite the absence of a mission timer. On Mars, General Collins orders you to scan Cthonian ruins for a flight data log; continue to ignore his orders, and he will transfer Grizzly One's command to Lieutenant Corbin before ordering Grizzly One to be court-martialed.
  • Yu-Gi-Oh! The Falsebound Kingdom has several special game overs depending on the campaign objectives and storyline.
  • After brainwashing Tea, Scott Irvine makes her attempt a forbidden spell that will destroy the world, with herself as the tribute for it. If you wait until the mission timer runs out, she succeeds.
  • If you win the second brainwashed Joey fight with anyone but Mai, he fails to break free of the mind control. Scott sets him up to sacrifice himself via a hypnotic suggestion, and Yugi and friends can't even take revenge on Scott since he appears as a hologram.
  • Your second encounter with Yami Bakura has him threatening to burn Jakhud to the ground. If you fail to stop him from reaching the city, he does burn it down, and you get a special cutscene of Fizdis crying out for her parents.
  •      Rhythm Game 

  • In the Groove:
  • The first game has a slightly different Game Over screen for its hardest song, "Pandemonium." After the usual "LIFE DEPLETEDROUND FAILED" screens, a skull appears afterwards.
  • In the Groove 2 features something similar if you fail "Vertex^2," you get the usual "LIFE DEPLETEDROUND FAILED" screens, and then a power of two pops up next to "FAILED," turning it into "ROUND FAILED^2."
  • Rhythm Heaven (GBAAC) and Rhythm Heaven Fever offer two ways to fail "Night Walk": Either fail to hit enough notes, which is the "standard" way, or fall into a Bottomless Pit.

    You fell in a hole.

  • Reflec Beat typically lets the current song run to the end, unless you are playing the iOS port, in which you can pause the game and quit or restart the current song. However, in Reflec Beat colette -All Seasons-, the Pastel Wonder Traveler event puts you on a Life Meter, which decreases whenever you get a Good or a Miss. If your HP hits zero, the song ends immediately in failure.
  • Normally, a Game Over in beatmania IIDX results from finishing a song with less than 80% Groove Gauge. However, if you miss 50 notes in a row, or have one of several different "survival" gauges and that gauge hits 0%, the "STAGE FAILED" shutters—which never pop up on a "finish with <80%" fail—will pop up and the song will immediately end.
  •      Roguelike 

  • Rogue: "R.I.P.: Software Pirate. Killed by Copy Protection Mafia.", if you die while playing an illegal copy.
  • In Pokémon Mystery Dungeon: Gates to Infinity, you can actually refuse to come back to the Pokémon world after your partner makes it possible with a wish. This results in being sent back to the main menu after a brief narration that you never returned and were missed terribly by your friends, and upon loading your save, the game will treat it as though you had been defeated in the dungeon prior to the event.
  • FTL: Faster Than Light:
  • Video Game{{868-Hack}} will give you a special death cause if you manage to make yourself stuck with no possible move.
  • While dying in weird ways is pretty standard in ADOM, there's also the non-dying way to end the game by having your character just walk off the game map by the same path they took to get in, never to return. It's definitely the easiest way to avoid actually dying, aside from the fact that the backstory implies the forces of Chaos will then probably consume the world.
  • In The Awakened Fate Ultimatum, if you choose to have Shin not try to save Eri after she is kidnapped by devils, he receives a package containing her severed head. This causes him to go full monster, killing everyone around him, destroying Celestia and then the devils that come to investigate the carnage. You are then dumped to the game's title screen.
  •      Role Playing Game 

         Shoot 'em Up 

  • Sega's 1981 Astro Blaster can have you lose the entire game if you crash into the mothership during the docking sequence at the end of every level.
  • Space Invaders: Perhaps one of the earliest video game examples; allowing even one of the eponymous alien ships to reach the bottom of the playfield results in an instant game over, no matter how many lives you have left. This is retained in Return of the Invaders but averted in Super Space Invaders '91 because of the difficulty of the differing formations in each wave: you simply die and the playfield is reset, minus any Invaders you destroyed previously.
  • In the Strike series of Helicopter games:
  • Simply getting yourself blown up would earn a normal game over. Failing a mission or otherwise rendering the level Unwinnable, however, would result in your being recalled to base for a dressing-down from your commanding officer which changed according to what you did wrong. (From Jungle Strike's first level, if you tried some Monumental Damage of your own: "You redecorated the White House, Beruit style!")
  • In Nuclear Strike, it is possible to have a nonstandard game over piled on top of a nonstandard game over. If you tried to refuel thrice after being told to return to base because of a SNAFU, General Earle orders your (literal) termination for going rogue.
  • In Hellsinker, if you time out Rex Cavalier and only have one life left, you get a very strange sequence referred to as the "spirit overload" ending. The boss, with its last remaining bits of energy, downloads its memories into the character's mind and drives them insane. Over time, the game over text implies, your (human) character is reshaped into an utterly inhuman Prayer.

    SPIRIT OVERLOAD.YOU GOT INSANITY.YOU MUST RESHAPE ONESELF FOR ONCOMING ASPIRANTS.

  • In Devastators, not only does this happen if you run out of time, but it actually tells you straight out before each mission:

    "IF YOU FAIL TO COMPLETE,YOU WILL PERISH!"

  • In Star Control II: The Ur-Quan Masters:
  • The Ur-Quan, being the reasonable people they are, will allow you to surrender to them and offer to spare the lives of your crew in exchange. They're not going to let you live, of course, and even if they did, you wouldn't have your plot-necessary Cool Spaceship anymore, so if you accept, the conversation cuts directly to a Game Over screen. Still, quite a magnanimous offer considering that everyone on your ship is currently engaged in fully voluntary rebellion.
  • The game has a time limit, in that eventually the Ur-Quan Kohr-Ah who have an agenda of total genocide will triumph over the green Ur-Quan and begin moving to exterminate all sentient life in the galaxy. You can monitor their progress on the galactic map as they move from species to species. Eventually, they will head for Earth, and if they arrive before you eliminate their flagship and halt their advance, the population of Earth is eradicated and it's game over.
  • Star Control III can end abruptly if you allow the Eternal Ones to feed on the galaxy without improving their process to be survivable to the natives. You also get a game over if you're too trusting of the Orz, Arilou, or Ploxis, or commit enough war crimes (or bad enough war crimes) to be fired from your leadership position.
  • Running out of lives on the last mission of Star Wars: Rebel Assault results in a cutscene of the Death Star destroying Yavin IV, with the narrator announcing "The alliance was defeated".
  • In NAM-1975, should you lose to the final boss, Dr. R. Muckly, he will be heard boasting that the world is now his, and the world is then shown exploding. He is then heard laughing evilly and it cuts to the Game Over screen.
  • Einhänder, Stage 6: Fail to destroy the space shuttle's thrusters in time and your craft plummets to earth, where it is immediately set upon by German forces. The game ends here even if you have extra lives remaining.
  • Galaga: You can get your ship captured by an enemy, then shoot down said enemy to obtain the double ship. However, if the captured ship is your last ship, the game will end instead, as if you had been shot down.
  • Confidential Mission: If you and your CPU partner—or the other player in a two-player game—don't both lock the Kill Sat onto the submarine and then fire, the Big Bad gets away and the island that you're on blows up. Part Downer Ending, part Game Over since the "MISSION INCOMPLETE" screen shows up.
  • Fantasy Zone: The second game's PS2 remake has three endings, and in the worst of them, Opa-Opa turns evil and spreads chaos throughout the Fantasy Zone. It doubles as a non-standard game over, as it is the only ending that doesn't lead to a New Game+, and downright says Game Over.
  • Star Wars Rogue Squadron:
  • If you shoot too many friendly ships or escorts in the first game, Rieekan will contact Luke to return to base so he can "discuss [Skywalker's]... tactics... in private."
  • In the first mission of Rogue Leader, you have a limited amount of torpedoes, and must save at least one of them to complete an objective later. Waste them all and the mission abruptly ends in failure, with a cutscene of Yavin IV going kaboom.
  • The unreleased Star Fox 2 has an alternate Game Over screen. Let Corneria take too much damage, and you'll get a cutscene that shows it being destroyed by Andross's forces. The Game Over screen will show Andross grinning like normal, but will read "Corneria fell".
  •      Simulation Game 

  • In the late-80s jet combat simulator Jet Fighter II: Advanced Tactical Fighter, a successful ejection would result in the message: "Successful bailout! Rescue copter is on its way! Isn't simulating stimulating?"
  • Harvest Moon
  • There are three non-standard Game Overs in Harvest Moon DS and two or three in Harvest Moon DS Cute.
  • The first is during the opening sequence, when Mayor Thomas from Mineral Town annoys your character into attacking him. The dog will then become angry. You'll have the option to call your dog back. Refuse, and Thomas will scream and the screen fades to white as the dog attacks him. The credits roll, and you're taken back to the title screen.
  • This next one takes a very long time to get...you have to grow a Level 100 Toadstool, then submit it at the Harvest Festival. The entire town (including you) will grow sick. The credits roll, and you're taken back to the title screen.
  • If you turn on HMDS with Harvest Moon Friends Of Mineral Town in the GBA slot (or HMDSC with Harvest Moon: More Friends of Mineral Town), villagers from Mineral Town will start to visit Forget-Me-Not Valley. You only have to do this once to make them keep coming back forever. The Mineral Town girls in DS are marriage candidates... but marrying any of them will take you back to the title screen and revert back to your last save file. This is changed in DS Cute, though, allowing you to continue the game with a Mineral Town husband.
  • In the English version of Harvest Moon: Magical Melody, marrying your rival, Jamie, will cause the game to end as they weren't marriageable in the Japanese version, and thus nothing was written for them post-marriage.
  • In the Harvest Moon: A Wonderful Life subseries, your game ends if you are not married by the end of the first year.note Though this is more a Earn Your Bad Ending scenario, as the game will have the bachelor(ette) with the highest affection level propose to you, and you have to turn them down to get the game over In later chapters, allowing your farm and shipment levels to fall by the wayside can cause your wife to leave you. In the PS2 special edition, you can end the game in the first cutscene by simply telling Takakura you don't want the farm.
  • In Harvest Moon SNES, if your farm is in bad enough condition by the time your parents visit the first time (about six months in) you'll be booted from the farm and, most likely, have to re-start the game. Though since it takes so little to make your farm acceptable, this becomes an Earn Your Bad Ending scenario.
  • Wing Commander:
  • In the first game, if the Tiger's Claw is destroyed, you get a message saying "With your carrier destroyed, you drift endlessly through the void..."
  • In Wing Commander IV, if you repeatedly screw up your early missions, say, by immediately ejecting on launch for every mission you get, Tolwyn hands you your pink slip in a hysterically dark cut scene.
  • In Wing Commander III, screwing up critical missions results in the fleet jumping back to Proxima and then making a Last Stand at Sol. This mission is unwinnable even with godmode, and drops you into another cutscene where you can decide how you die. This is quite possibly the Nonstandard Game Over that's drawn out the longest. If it is possible to save before the mission, pray you didn't save it over your previous save game.
  • Ace Combat:
  • In the final mission of Ace Combat 5: The Unsung War, if you fail to destroy the SOLG (loaded with a nuke) in time, you're treated to a short cutscene of it detonating over Oured.
  • If you don't destroy the last missile in the Megalith mission in Ace Combat 04: Shattered Skies, you get to see that very missile launch from its silo and win the war for Erusea.
  • Trauma Center:
  • Under the Knife and Second Opinion, Episode 4: Fail the bomb "operation" and instead of a depressing Game Over in which Derek quits his job, you hear an explosion as the screen simply goes white.
  • New Blood, Episode 5: Run out of time on the lock-picking mission, and instead of "Your skills were not up to the task — Operation Failed", you hear the sound of water filling up as the screen fades to white.
  • Trauma Team also gets one. If you fail on Naomi's final case, instead of the normal messagesuicide note, you get a recording of Rosalia talking about Albert and the Rosalia Virus.
  • In the Star Wars: Rogue Squadron series, failing a critical mission objective will cause the mission to end (even if you are still intact), followed by a "MISSION FAILED" screen (instead of "GAME OVER") with a description of what triggered mission failure. Also, if you shoot down alliesconvoysthings you're supposed to be protecting you get a warning or two - "Skywalker, what are you doing?!" — and then Rieekan calls you back with "Commander Skywalker, return to base. We'll discuss your... tactics... in private." In Rogue Leader, it's possible to get a unique game over by running out of torpedoes in the attack on the Death Star. Cue Yavin IV getting blown the hell up.
  • In the 1985 game Balance of Power, pushing too hard in international negotiations would result in an immediate end to the game, with a black screen displaying the message: "You have ignited a nuclear war. And no, there is no animated display of a mushroom cloud with parts of bodies flying through the air. We do not reward failure."
  • In FA-18 Hornet, if you land or eject in enemy territory, you get captured and are listed as "Missing in Action". If you cause any collateral damage, you are "Court Martialed".
  • In X Wing Vs Tie Fighter, if you fail at a mission (rather than just dying, ejecting, or hyperspacing out of there before the mission's done), you'll be treated to some tragic music. Depending on how well you did, you might be the sole survivor, or your enemy might curb stomp you.
  • The Oregon Trail II: "You're Fired!" (kicked out of the wagon train), if you're a trail guide and morale gets too low.
  •      Sports Game 

  • Super Bases Loaded for the SNES. In this particular sports game, you end up getting the Non-Standard Game Over screen, should the CPU completely blow you out by getting 9 runs straight. It will not even wait for you to make it to 9 innings. Instead, it will briefly freeze, then show someone from your team kneeling in defeat, with the word "Blowout" over their head, with some sad music. From there, it will go to the scoreboard, and the words "Blowout Game" will appear. From there, it will promptly go back to the title screen.
  • Baseball Stars uses a similar "mercy rule", ending the game if either team is ahead by ten or more runs at any point. So did Sega's Sports Talk Baseball for the Genesis. It was explicitly called a "10-run Rule", and the talking commentator would say the team won "by domination".
  • Mario Superstar Baseball and Mario Super Sluggers have a rule (which can be disabled in normal game modes, but is always active in story mode) where being 10 runs ahead at the end of an inning ends the game; however, if the visiting team is 10 runs ahead in the top of the inning, the home team still gets the bottom of the inning to even the score before it kicks in.
  • In Blitz: The League 2, getting Franchise injured in Prison Ball will end the game, as you have ruined your career. Unlike in other modes of the game, Prison Ball will not let you perform triage if an injury occurs.
  •      Stealth-Based Game 

  • In Splinter Cell: Double Agent, if you fail the final minigame-for-a-boss, you are treated to a very disturbingly realistic portrayal of emergency services and news helicopters flying over Manhattan as a smoking ruin after a nuclear blast.
  • In the first Splinter Cell game, you are on a training facility, and at a certain point you get a gun. If you turn back and kill an officer, you get fired. You also get fired if you attack Grimsdottir in the beginning of the level. Same for any level with friendlies or other NPC's you are required to keep alive.
  • Metal Gear:
  • The original Metal Gear Solid used the Nonstandard Game Over as a plot device on one occasion, being told before a possibly-fatal Minigame that "there are no continues, my friend...". And, of course, dying results in a non-standard game over screen — with no CONTINUE option. A player would have to quit the game and reload before they could try again. The game can go even further to psych out the player here. If you haven't saved in a while, the game will detect this and call you out on it. "Do you really want to lose all of your progress?"
  • In Metal Gear Solid 2: Sons of Liberty, during the Tanker chapter, if Snake gets caught sneaking around in the holds during the Commandant's speech, the player is shown the soldiers in whatever room he's in taking Snake into custody before "Game Over" is displayed.
  • MGS2 uses a completely different "Game Over" screen for the solo Raiden missions that's unlike the "Game Over" screen when playing as Snake or even as SnakeRaiden later in the game. Around the time both characters join forces, the player learns why this is.
  • In Metal Gear Solid 3: Snake Eater, which is a prequel, you meet a young version of Ocelot from the previous games. He's supposed to survive the events of the game, but in one occasion you can kill him after he's been knocked out in a cutscene. If you do so, you'll have Colonel Campbell, from the 'future', shout "Snake, what have you done? You changed the future! You've created a time paradox!", and the words "OCELOT IS DEAD" will appear, instead of the usual game over text. This also applies to other characters whose actions affect the rest of the series, but Ocelot is the most notable. You even get a achievement for this in the HD Version.
  • There's a few cases in Metal Gear Solid and its sequel, in particular, where you get a wildly different Informal Eulogy depending on the circumstances. Crash into the tripwires surrounding Baker, and Ocelot will call you an idiotfool depending on if you're playing the remake or not. Fail the torture, and not only will your CONTINUE option be missing, but you'll get to hear Liquid yell at Ocelot for getting carried away and botching another interrogation. Die during the final battle in Metal Gear Solid 2 after your "support" team has dropped their façade, and they'll laugh at your failure.
  • In Metal Gear Solid 4: Guns of the Patriots, die during the final battle & you will be given the choice to "Continue" or "Exist". Choose the latter, and you will hear Ocelot tell you "It's not over yet, Snake!" and you will have to choose again, only "Exist" will have returned to the traditional "Exit".
  • If, in the VR missions centered around Gurlugon, you get hit by one of its Eye Beams while wearing the BDU, you get possibly the most bizarre game over sequence in the entire series .
  • Rather than Snake dying, there are other ways you can get a Game Over. If, for example, you kill Johnny in MGS4, Otacon will shout "Snake, what did you just do? Have you lost your mind?!", and as soon as the Game Over screen appears, Otacon says "Oh no! What are we going to do now, Snake?"
  • There's a few ways to get one of these in Metal Gear Solid V: The Phantom Pain.
  • If Ishmael dies in the tutorial level, you'll get a "Time Paradox" message Foreshadowing the fact that he's the real Big Boss.
  • You'll also get one of these if you kill one of your own men while on Mother Base by throwing them into the ocean, where Miller screams "Have you lost your mind?!".
  • In Mission 1, where you have to rescue Miller, Ocelot tells you he only has about 3 days to live. If you wait 3 days, either by using the Phantom Cigar or simply by taking too long, he will be unresponsive when you trigger his cutscene, and when Snake lets go of his face, it will stiffly lull to a downward position, causing Snake to scream in agony and Ocelot to solemnly inform you that Miller has died from extensive blood loss due to his severed limbs. This also results in a "Time Paradox" message.
  • Killing any child soldiers in Africa causes the screen to flash red and the camera to focus on the corpse before going to the normal game over screen.
  • Killing Eli in Mission 23 will also result in a Time Paradox message. This is because he is Liquid Snake.
  • Games based on Batman:
  • In Dishonored:
  • Two of them as death cutscenes in Hitman: Blood Money. The first is in You Better Watch Out... where an unknown Franchise assassin disguised as one of the strippers stabs 47 in the neck with a nail file. The second is in A Dance with the Devil; the singer is actually a Franchise assassin named Eve, who will try to seduce you. Should you follow her and wait for too long, she will stab 47 repeatedly.
  •      Survival Horror 

  • In Silent Hill 3, if you die a certain way or in a certain place, Valtiel is shown carrying away Heather's body. And if Heather shoots Claudia, Heather "births" the god and dies in a rather gruesome cutscene, where Claudia says "Oh God, bring us salvation".
  • In Fatal Frame II, if you decide to use the secret passage to escape from the haunted village without your twin sister Mayu, you'll get a scene and then one of these. It could actually qualify as a bad ending, since it's a viable conclusion to the story and even suckier than the already depressing regular (and canonical!) ending.
  • Five Nights at Freddy's:
  • Freddy has two killscreens and is the only animatronic to have as such. One when the power runs out and another when he enters the office during normal play.
  • Golden Freddy. When you look at the poster at the end of the West Hall while it displays his face, he appears in your office. You will then hear robotic murmurs and hallucinations just before he instantly kills you and crashes the game, but only if you don't pull up your monitor and switch to another camera.
  • In Five Nights at Freddy's 2 both Shadow Freddy and Shadow Bonnie crash the game instead of killing you.
  • In Five Nights at Freddy's 4 Nightmare is slightly more benevolent: he merely resets the game. Nightmarionne takes that role in the Halloween Edition.
  • Resident Evil 4:
  • If Ashley gets captured, a cutscene is shown of the Ganado carrying her off and the game over screen says "Mission Failed" instead of "You are Dead". This also occurs if she is killed, either by an enemy or your bad aim.
  • Also, in an early scene, where you defend a cabin with Luis, if you shoot him too many times, you're treated to a cutscene where he gets sick of it and guns you down.
  • Resident Evil 5 also has one. If Chris kills a brainwashed Jill in the middle of the fight, you're treated to a death cutscene and a screen that says "Your Partner Died" like you would get for any of Sheva's deaths.
  • In Slender: The Arrival, if you somehow manage to find your way out of the map's boundaries (either by mistake or by purposefully trying to glitch out of bounds), you will eventually end up falling through the map and get the standard Game Over screen, except there will be an additional message overlayed on the screen in messy-looking text, presumably said by Slenderman: "Even a glitch in this game can't save you from me."
  • In Dead Rising 2: Off The Record, Frank needs to take a dose of Zombrex once every 24 hours. If Frank doesn't get his shot by 8AM, he will drop dead on the spot.
  • In SCP - Containment Breach, refusing to cooperate with the guards will have you terminated before the containment breach even occurs.
  • Haunting Ground has several special cutscene deaths that the unsuspecting player can incur, mainly for failing at certain puzzles, but some are very obvious (did you really think hiding in an iron maiden was a good idea?).
  • Idle for too long in Spooky's House of Jump Scares and Specimen 9 comes out of nowhere and kills you, resulting in an instant Game Over.
  • Night Trap has a Game Over that can occur if you don't push start during the opening scene, effectively ending the game before it even starts. Commander Simms: "You're wasting time, get over there now!" (Beat) "Looks like you're not up for this mission...breaking contact."SCAT System Disconnect
  •      Third Person Shooter 

  • Army Men: Sarge's Heroes has one in the ice level where you free prisoners. If you manage to get yourself locked in a cell, Plastro himself comes out of nowhere to mock you followed by a game over.
  • Sarge's Heroes 2 has a hilarious one. The tutorial has you follow orders from Colonel Grimm, a.k.a. Vikki's father. You can choose to kill him and simply finish the tutorial yourself, but at the end, instead of Vikki's usual "Congratulations" when you open the last door, she will immediately shoot you with a bazooka as soon as the door opens. Even if you somehow dodge, you still fail.
  • The second game and Toys In Space also have various failure cutscenes for missions, ranging from being melted by a magnifying glass to being torn apart by zombies in a hospital.
  • F.A.K.K.2 would give you game overs if you managed to kill yourself.
  • Kid Icarus: Uprising has several, with what causes them ranging from "failing a critical goal" to "missing a quick-time event".
  • During the flying segment of Chapter 12, you have to make a detour to destroy a falling Reset Bomb that Viridi deployed as you approached the Reset Bomb Depot. It's a Time-Limit Boss, as with most other aerial boss fights; however, unlike all those other fights, there's not a special event that wins the fight for you if you take too long. If you don't destroy the Reset Bomb in time, then you get a game over because Pit isn't lucky enough to be outside the blast range this time.
  • Most of Chapter 17 takes place on a platform being held up by Centurions high above the ground. You're being attacked constantly, and the Centurions aren't invincible; they will die if you don't kill the attacking enemies quickly enough. Palutena has an extra set if you let the first two die, but that's it; if you let that set die, then you get some unique dialogue before you get a game over and restart at the last checkpoint.
  • Chapter 20 ends with a fight against a possessed Palutena. However, the goal is not to attack the boss, but rather to attack the Chaos Kin, which is controlling her. However, it's pretty easy to hit Palutena, and if you do so too many times... game over.
  • The more minor non-standard game overs include; failing to line up with a target while falling at certain points in Chapters 17, 21, and 25, failing to shoot the Chaos Kin near the end of Chapter 21's flight segment, getting hit by the Great Sacred Treasure's arena-wrecking laser blast in Chapter 24, and failing to keep your reticle on Hades so that Medusa can interrupt his attempt to finish you off in Chapter 25.
  • Spec Ops: The Line:
  • If Walker dies before making it to the destroyed helicopter in "Adams", a special loading screen will play where Konrad's silhouette will shake his head at you with the faint voice of "Stop, just fucking stop!" being yelled in the background.
  • Dying to the hallucinatory Lugo in the next chapter will give the player another one of the White Phosphorous scene, with "Twinkle, Twinkle Little Star" being hummed in the background. The game then rewinds to the beginning of the fight — except with a Heavy Trooper in Lugo's place.
  •      Turn Based Strategy 

  • The Disgaea series tends to give you often humorous endings for being beaten by the games' Goldfish Poop Gang, or one of the main team members before they've joined the group. Most of them are treated like endings (particularly in 3 and 4, which add lengthy narratives to them), causing the credits to roll, and in some cases, allowing you to start a New Game+ earlier then normal.
  • In Disgaea 2, a multitude of characters propose bills to be the main character in the Dark Assembly. Should they be passed (and there's a very high chance they will without any intervention on your part), you immediately get a game over. Also, winning the Hopeless Boss Fight against Laharl, or the one against Etna, nets a Non-Standard Game Over as well.
  • Revisiting the final level of the first chapter in Disgaea 3 and winning the battle there before a certain point in the story also results in a humorous ending where Mao and Almaz openly acknowledge that they've screwed up the plot and the only option is to reset the game.
  • In Makai Kingdom postgame, you can trigger an encounter with Zetta himself, who turns out to be Overlord Baal possessing Zetta's lost body. Winning the fight nets you the body as a playable character. However, if you've previously shanghaied Laharl and use him as the active character when initiating the encounter, and then winning the fight, results in Laharl claiming the victory instead of Zetta, followed by him destroying the body and ending Zetta's reign.
  • Waerjak in Heroes of Might and Magic IV can trigger one of these when he meets the Boar's Hoof tribe. Waerjak is given the option of attacking them and claiming their garrison; if he does so, his followers will turn on him, proclaiming his philosophy of community to be a lie.
  • This is a recurring element throughout the campaigns, made easier by the fact that all events are narrated instead of animated, resulting in various different scenarios that you wouldn't normally see in a game. If Lysander, for example, were to attack Glen Garrison to rescue the Big Bad's mother (instead of finding a way around it), the commander would notify him that he sent his men to execute her. If Elwyn takes the red ship instead of the blue one, Shaera would commit suicide, believing that he died (granted, this is an unnecessary complication of the gameplay, since Harke will bribe the crew to switch the sails, and Elwyn arrives just in time to save the girl anyway, making the outcome pretty much the same).
  • Might and Magic VI has a special ending video if you complete the end-game dungeon without getting the Ritual of the Void. You are warned that if you destroy the Kreegan Hive's reactor without powerful magic to keep it contained, it will destroy the world. Ignore the advice, and you get to see exactly that happen.
  • Another way to get this in Might and Magic is in VII, but you'd have to be pretty stupid for it to happen. For one quest in the main storyline, you end up working for two nobles simultaneously, and your actions during the quest require you to betray them both. Treason is a crime punishable by death, and that might make you worried. However, in each case, there are no witnesses and no evidence pointing to you, so neither of them would even suspect you unless you actually confessed. Believe it or not, there's an option that lets you do that when you finish the quest and report back to them. Long story short, if you confess to one of them, you won't live long enough to tell the other.
  • Blaze Union: Although the game over conditions are normal, losing the battlefield where your female characters are cornered by a gang while shopping leads to a unique scene, where it's explained said party members, one of them in her teens, were so deeply traumatized by the rape the revolution had to be put on hold indefinitely.
  •      Visual Novel 

  • Many of the Ace Attorney games have those, usually in the final cases:
  • In Phoenix Wright: Ace Attorney, in the fifth case, there is a piece of evidence that appears to point to one person, but the place where it was found points to the real murderer. If you present it too early, i.e. before the real murderer admits that he was hiding it, you're told that the trial was unwinnable from that point onward, and the word "Guilty" appears on a black background.
  • Similarly, in Justice for All, right near the end of the 4th case, you're given a chance to show a particular piece of evidence to a particular person. Pick the wrong thing or person, and the villain goes free, an innocent person is convicted, and Phoenix quits being a lawyer. "The miracle never happen..."
  • Also, in Apollo Justice: Ace Attorney, you actually get to pick the verdict at the end, thanks to the jury. If you pick guilty, it results in a hung jury, and the defendant dies in the hospital.
  • In Ace Attorney Investigations 2, you can refuse to help a mentally unstable and profoundly broken Sebastian Debeste and instead tell him that he's "a failure as a human being". Doing so finally puts him over the edge and ends the case immediately, as he's the only one who can find the evidence his father got rid of.
  • The final case of Dual Destinies provides unique game over sequences during its sole trial day, which double as bad endings:
  • Fail to prove Simon Blackquill's innocence after he's admitted his guilt, and watch as things spiral go From Bad to Worse: Blackquill is executed the next day as scheduled for a crime he didn't commit, his sister Aura leaves with the hostages she took, including Trucy, and they are never heard from again, Athena leaves the office, Apollo is so broken he stops smiling, and Phoenix gives up on being a lawyer.
  • Lose during one of the forced questions in the chapter "Remembering the Killer", and Aura Blackquill kidnaps Athena, with Phoenix never seeing her again.
  • Lose during the final testimony given by the Big Bad and while Athena and Simon Blackquill are let off the hook, the phantom walks away scot-free, and the dark age of the law keeps growing ever darker.
  • In Spirit of Justice, the final case has multiple outcomes depending on when you lose the case. Lose during the first trial day of the final case and the villainous sleazy politician walks away scott-free with the Founder's Orb, and Apollo and Phoenix's relationship goes down the crapper. In the final trial, losing the case after getting Dhruke acquitted has the real killer's identity remains unknown forever while the revolution completely falls apart due to Dhruke's death. Failure to provide proof that the Queen is the real killer ends with her siccing her guards on Apollo, forcing him to go into hiding with him deciding to join the revolution to overthrow the Queen.
  • In Nine Hours, Nine Persons, Nine Doors, nonstandard game overs are actually plot-critical. If you try to get the True Ending on your first playthrough, instead you get the Coffin Ending. You need to find the Safe Ending first... Eventually you find that you are actually playing from the perspective of the protagonist's friend in the past. The fact that you know it would be impossible for Junpei to know at the time is because she (you) actually ran through these scenarios where Junpei made this or that decision, gleaning more information about the best way to proceed each time.
  • This persists in the sequel Virtue's Last Reward. You will be running into a lot of different endings, several of which are 'To Be Continued' path locks that require secret knowledge from other paths to get past.
  • Virtue's Last Reward normally has fairly standard Game Over conditions: Sigma loses the Nonary Game and either dies or becomes trapped in the facility. But some other Game Overs, which do not even appear on the game's provided flowchart, arise in circumstances where a plot thread is impossibly damaged; for example, if the player managed to annoy Alice enough to alienate her by repeatedly failing to decode a message, the game ends instantly, even though nothing has happened to Sigma.
  • Zero Time Dilemma has an inversion if you win the coin flip at the beginning of the game. True to his word, Zero releases all of you. Game over. Credits roll. You win. Ten minutes flat.
  • As a combination Visual NovelRPG, FateEXTRA has one of these for pretty much every defeat by another Master, as well as a number of ways to lose by making a wrong dialog choice. (DEAD END, indeed.)
  • Fatestay night has Multiple Endings which are tagged with a descriptive note, with all game-overs being tagged "Dead End" if Shirou dies and "Bad End" in all other cases. The odd ending out is the "Superhero" ending, where Shirou decides to kill Sakura and likely Rin and Ilya as well in order to prevent a disaster. Despite being a very harsh bad ending, it is referred to only as an "End", the only ending with this note.
  • Kara no Shoujo has a few, but some are difficult to distinguish from the good endings, such as they are. In one in particular, Reiji will end the game locked in a mental ward if he disembowels his best friend Shugo for the key to escape a trap.
  • Should you fail the bomb diffusing sequence at the end of Act 2 of Policenauts, the bomb will explode on Beyond Coast in the Game Over screen.
  • Lux-Pain:
  • Using Sigma carries a gauge with it, which depletes as you probe their mind more and more. If it falls to zero, Ray Platiere will tell you that you basically destroyed their mind and you get a Game Over. "You're no telepath."
  • Every time you let a Silent infectee get away, intentionally or otherwise, the Hazard percentage at the corner of the map increases. If it reaches 100%, you get another call from Ray that says that it's too late, and there's nothing left to do for the city but send in The Tigers and destroy them all mentally to stop Silent spreading any further.
  • Failing to find Yayoi before too long when she goes missing will get you told that it's too late, and that she killed herself due to Silent's infection before you could save her.
  •      Wide Open Sandbox 

  • Fallout:
  • Fallout has several, narrated like the HaveANiceDeaths by Ron Perlman. If you choose to reveal Vault 13's location to the Lieutenant, a cinematic plays where your character is dipped in the vats, becoming a Super Mutant, Vault 13's citizens are captured to befall a similar fate, and the Overseer is violently killed by mutant invaders.
  • Fallout and Fallout 2 both have a built-in time limit — if this is ever reached, a small cinematic with the words "THE END" plays and the game quits back to the title screen. It takes about thirteen years of game time though, so it's really no bother unless you're actively seeking it out.
  • Fallout 3 allows you to tell Colonel Autumn the activation code for the water purifier. He thanks you, then shoots you. Also, if you fail to activate the purifier in time, it explodes, terminating your game regardless of whether Broken Steel is installed, since without the purifier, the events of the epilogue can't take place, and the main characters are probably killed in the explosion anyways.
  • In the Fallout: New Vegas DLC Dead Money, if you agree to work with Elijah at the end, as opposed to killing him, the game ends and a cutscene explains how the Courier and Elijah spread the toxic cloud across the entirety of the Mojave, turning it into an uninhabitable wasteland. There's another one where examining a computer message specifically meant for Dean Domino in the Sierra Madre Vault will lock the Courier in there. After she eventually dies, a hologram of himher is created.
  • The Fallout: New Vegas DLC Old World Blues had one, but it was cut from the final game. The Courier would have the option to surrender their brain to the Think Tanks and be helpless to stop them from performing their crazy experiments on the Mojave. Goodsprings is destroyed by falling blocks, the Jacobstown Super Mutants are driven mad by a satellite, Black Mountain is overrun by giant, man-eating mutant cows, and the Legion and NCR are brainwashed into thinking they're respectively living in ancient Rome (on the moon) and Pre-War America.
  • Fallout 4 will come to an abrupt end if, during the pre-war segment of the game at the very beginning, you take too long to get to the Vault and escape the nuclear explosion.
  • Choosing to suicide or shoot Forrest Kaysen over shooting Emily to end her suffering in Deadly Premonition results in York telling Zach he made the wrong choice, while showing a shriveled up Emily in the Red Room, and allowing the choice to try again.
  • While playing Vangers, at one point you may discover a special artifact Mechanical Messiah. It has a number of dangerous functions and is considered to be cursed. One of its functions is named Lucky: try to activate it and the fourth wall will be destroyed, with the game stating that you, the Vanger, have failed the test and will be utilized. This becomes understandable if you played the game before and know the ending(s).
  • In X: Beyond the Frontier, if you shoot at the Terran mothership during the Justified Tutorial, you'll get the usual "cut it out" remarks from the flight controller. If you keep doing it past the part where he threatens you with Reassigned to Antarctica, he'll actually do it.
  • In Saints Row IV, at one point you're are offered a choice to either keep fighting or take a deal with the aliens to save the world by dying. If you take the deal, you get a game over screen telling you that you shouldn't have trusted them.
  • In Grand Theft Auto: San Andreas, during the mission "Stowaway", you can jump out the plane without a parachute, which leads into a cutscene showing CJ crashing into a parked car at a drive-in.
  • In Shenmue, or just the first game at least, it's impossible for Ryo to actually get himself killed - failing a Quick Time Event or losing a fight results in Ryo taking a dirtnap. The only exception is allowing April 15th to roll around, in which case Lan Di comes back to the dojo asking for the Phoenix Mirror; Ryo challenges him to a fight and is subsequently wiped out in one move, the same move that Lan Di used to kill Ryo's father in fact.
  • In Sleeping Dogs, one mission requires you to succeed in a karaoke minigame. Failure grants the following game-over message:
  • Early sandbox ZX Spectrum game Skool Daze normally ends the game when you have accrued 10,000 lines or more; however, there is a random event where you must avoid contact with another character who has contracted the mumps. Get touched and you contract the illness too, whereupon you are immediately sent home.
  • Examples in non-video game applications:

        Card Games 

  • Under some partners rules variants of Spades, getting a "Boston" run on your team (losing all thirteen tricks) is an automatic game loss.
  • In Magic: The Gathering, the standard loss condition occurs when your opponent brings your life total to zero. However, there are other ways to lose the game:
  • If you are forced to draw a card when there are no cards remaining in your library, you are "decked" and lose the game.
  • Creatures with the Infect ability, rather than dealing life damage to a player, inflicts that player with poison counters. A player with ten poison counters loses the game.
  • Certain cards cause you to win or lose in unusual circumstances; for instance, the Near-Death Experience card, which allows you to win if you have exactly 1 life remaining in your upkeep step.
  • In Munchkin players win when they reach the 10th level, but they must do it by defeating a monster - other ways to normally level up (such as selling items or using "go up a level" cards) aren't allowed. Except for the card "Divine Intervention" which makes every cleric go up a level, and explicitly states you can win the game this way.
  • The Star Trek Customizable Card Game (First Edition) by Decipher was normally won either by scoring 100 points before the opponent, or (more rarely) by having the higher score when both players' draw decks were depleted. A common "nonstandard" game ending involved a card called Writ of Accountability. If you exceeded any of the limits outlined by the card, and your opponent activated the card on you, you instantly lost the game, with a score of 0 (and if only one player remained—which nearly always was the case—that player scored the full 100 points needed to win). There were a few other cases where you could lose the game instantly (such as calling "Devidian Door", then being caught without a Devidian Door in hand when it came time to show it), but that was perhaps the best known.
  •     Gamebooks 

  • Several Choose Your Own Adventure books feature conclusions punctuated by something other than The End:
  • The third book in the series, By Balloon to the Sahara, has a few: A Chilling End for when your character is trapped under an avalanche, The (BLAT!) End for when aliens disintegrate you with a laser gun, and even The Beginning, among several others.
  • The Mystery of Chimney Rock probably plays this trope the straightest:
  • One ending has you leaving the haunted house after encountering a ghostly creature who threatens you with his fate if you ever look back at the house.note Another equally bad ending implies he was a former inhabitant of the house who died after falling off the roof. If you don't like that ending, you can choose to look back one last time anyway, the resulting page of which simply has a bloodcurdling scream down the page in giant letters followed by a THUNK.
  • Another ending has your character accidentally breaking the resident witch's china cat and being cursed to pick up the pieces for all eternity, complete with There Is No End.
  • Pipe Down! in the Nintendo Adventure Books sees Mario and Luigi coming across a Clawgrip, to whom they must give an item to pass. If they do not have the required item or refuse to give it to him, they try to run. The Clawgrip gives chase, and they decide to distract him with a few coins. If you don't have enough, the resulting page is nothing but the word PINCH! in a huge explosion graphic that fills the entire page, along with the "GAME OVER".
  • From The Time Raider of the "Twistaplot" series: "Oh, no! You're stuck in a time warp! (turn to page -number-, quick!)" *flip* "Nothing warps the human brain faster than a time warp. (turn to page -number-)" *flip back* "Oh, no! You're stuck in a time warp! ..."
  •     Game Shows 

    In game show parlance, the Non-Standard Game Over is, in its broadest sense, a form of Epic Fail, where a contestant performs so poorly that he is either disqualified or causes a situation where the winner's score makes it mathematically impossible for himher to catch up. In several game shows, the game is ended early, the losing contestant is given his Consolation Prizes, and the winner plays the bonus game early.

  • A number of quiz shows from the late 1960s and early 1970s — including the Who, What or Where Game and the original Sale Of The Century — had rules where falling below zero at any time immediately eliminated that player from further play. These games spotted the players a small bankroll ($20 for $otC, $125 for the betting-type 3 Ws) and, like Jeopardy!, money was deducted for incorrect answers. But enough incorrect answers meant falling to or below $0 and, per the rules, meant they were eliminated immediately. The "$0 means goodbye" rule was eliminated for the more familiar 1983 $otC and the 3 Ws 1990 remake The Challengers. (With the earlier incarnations, the standard "game over" is at the end of the front game of $otC (we've just played the last question, here's the scores, here's our champion) or, on the 3 Ws, after the day's final category is played with all three contestants participating.
  • Blockbusters: The Bonus Round, called "Gold Rush" (or "Gold Run"), required players to make a side-to-side chain on a game board by answering questions within a 60-second time limit; an incorrect answer blocked the progress and required the contestant to work hisher way around. The trope kicked into effect for just the first few weeks of the series' run –- if, because of enough wrong answers, there was no longer a way to make a side-to-side connection before the 60-second time limit expired, the game ended early. The trope no longer was in effect after the bonus round was tweaked; the contestant could still win consolation cash by continuing to answer questions until the time limit expired.
  • The Bonus Round on Body Language, a charades game show, was broken down into two parts. The first had a contestant guessing up to ten words at $100 per word in 60 seconds, followed by another 20-second round with three words played for 10 times the amount the contestant won previously. Giving an illegal clue (talking or using a prop) in the second part immediately ended the round in failure even if any words were left over; the bonus round was also not played if, by rare happenstance, the contestant failed to guess even one word in the first part.
  • On Card Sharks, the Money Cards Bonus Round automatically ended prior to the Big Bet card if, while on the second row, the contestant busted -– i.e., bet everything on an incorrect hunch. (On the NBC version, this was marked by a harsh buzzer followed by a truncated version of The Price is Right losing horns). Quite a few times, there were players who "two-card busted" (meaning they blew everything on the first card, then -– with the card moved immediately to the second row and the player given a new bankroll -– immediately lost everything on their next call of the cards). This was also originally possible if the next card was of the same value as the previous one; it was originally ruled as a loss, but on later episodes, the next card being of the same value resulted in neither a gain nor a loss (referred to in-show as a "push").
  • Jeopardy!:
  • In its broadest sense, any player who has $0 or a negative cash score at the end of the "Double Jeopardy!" round ends his participation in the show early (i.e., he's not around for "Final Jeopardy!"). However, at least once on the original NBC series -– the late 1960s, by most accounts -– the trope truly kicked into full effect when all three players had negative cash scores and thus were ineligible for "Final Jeopardy!" No "Final Jeopardy!" was played that day, and Art Fleming spent the rest of the time talking with the contestants and the audience. The standard "game over" is with all three players participating in "Final Jeopardy!"
  • A twist on the "nonstandard game over" trope is the "lock game" scenario, where the leading contestant's score at the end of "Double Jeopardy!" is more than double that of the second-place contestant ... assuming, of course, heshe does not bet more than what he'd be left with if he were incorrect and the second-place player was correct and bet enough. In this case, a standard "game over" is a competitive game, where the second-place contestant can still win if certain things go right (e.g., a correct answer and a wise bet, vs. the champion being wrong and forced to bet enough to cover the second-place player's wager).
  • Match Game: The 1970s version's two-part Super Match — the Audience Match followed by the Head-to-Head Match — required the contestant to match at least one of the top three answers in the Audience Match portion of the game to play the Head-to-Head portion; failure to do so ended this bonus round early. While not uncommon during the and daily syndicated run, only one time did it happen on Match Game PM (where two Audience Matches were played back-to-back prior to the Head-to-Head round), forcing a modified front-game question to be played in place of that show's Head-to-Head match; the contestant won. Averted with later versions: The 2016 ABC primetime version instead gives a Consolation Prize of $1,000 for the Head-to-Head round, which can be multiplied to $5,000; and when the show was married to The Hollywood Squares in 1983-1984, the contestant was given $100 and could turn it into up to $3,000.
  • Name That Tune: Most game shows' bonus rounds that were quiz-based allowed for incorrect answers; the game would still proceed and allow the contestant a chance to achieve the stated goal (guess 10 correct answers in 60 seconds to win). This game was one of the exceptions: With only seven songs to be guessed (in a 30-second time period), the contestant had to guess all seven songs correctly to win the day's top prize and be invited back to a grand prize tournament. This meant that even one wrong answer stops the game immediately and the player is left to take home consolation prizes. The standard game overs, then, come if the player guesses all seven songs or the time limit expires before all seven songs are guessed.
  • The Price Is Right: Several pricing games – those involving the pricing of groceries or small items – have this clause if the contestant is wrong with all questions or fails to meet any conditions on hisher given choices (usually three), and the contestant had to earn all picks. A few examples:
  • Bullseye: In this game involving pricing of groceries, the objective was to pick an item and tell how many was needed to – when multiplied by the price of the item – reach a target score of $10-12, which was an Instant-Win Condition. If the actual total wasn't within $10-12 but at least $2 and not more than $12, the contestant earned a mark on the board resembling an archery target, meaning they could still win if that item concealed a hidden bullseye; up to three turns were given. The trope kicks in, then, if the contestant fails to at least get one mark on the board – that is, he was below $2 or above $12 on every one of his three picks, meaning the hidden bullseye is out of play and cannot help; despite the instant early loss condition, the host often will still show the audience which grocery item had the hidden bullseye.
  • 5 Price If the contestant is wrong on all four true-false pricing questions. At least one correct answer was needed to be able to pick from one of the price tags they thought was the correct price.
  • Master Key: If the contestant is wrong on both either-or pricing questions, meaning no pick of which one of the five keys. The contestant needed one or both correct answers to try to pick the right key and (attempt to) win at least something.
  • Rat Race: If the contestant is wrong on all three pricing questions, meaning no selection of the rats (although the rodents may run anyway just for fun). At least one was needed for the contestant to have a stake in the race.
  • Shell Game: If the contestant is wrong on all four higher-lower pricing questions, meaning no chips on the table; they had to have at least one correct to place a chip beside the shell they thought concealed the ball.
  • Bonus Game: Like Shell Game, if the contestant is wrong on all four higher-lower pricing questions, meaning they won't have control over any windows, including the Bonus window; they had to have at least one correct to have a chance of controlling the Bonus window.
  • Punch-A-Bunch (also known as the Punchboard): If the contestant is wrong on all four higher-lower pricing questions, meaning no punches to use on the board; at least one was needed to punch a hole and win something.
  • Secret X: If the contestant is wrong on both small item prices, meaning no extra Xs to go with the first one they receive, at least 2 Xs are needed to be able to make a tic-tac-toe with the Secret X in the middle column.
  • One Away: If the contestant is wrong on all five (previously four) numbers the first time; note  This rule exists because if the contestant gets all five numbers wrong, then it would become clear that the 5 numbers the contestant didn't flip to were the correct ones, meaning changing to the other numbers would reveal the correct price. This scenario only happened once, in 1989, with the audience and Bob jeering the contestant for it one correct number was necessary to attempt a second try. A nonstandard win occurs if the contestant gets all five numbers right on the first try.
  • Originally the case with Pass The Buck on its first three or four playings, where three pairs of grocery items were used and no free pick was given, meaning a Non-Standard Game Over for the contestant if they were wrong on all three pairs, since it would result in no picks on the board. This was changed afterward to give the contestant a free pick, as well as reduce the pairs from three to two and the board spaces from eight to six (losing $2,000 and leaving two Lose Everythings instead of three.)
  • Retired Games:
  • Hit Me: A la Blackjack, if the contestant picked grocery items with cards that brought their score to 22 or higher, meaning THEY bust and forfeit the game regardless of the house's score.
  • Joker: If the contestant was wrong on all four small prizes, meaning they can't discard any cards, including the target Joker; at least one was needed for the contestant to have a chance of discarding the Joker, which was the goal of the game.
  • Phone Home Game: If the home viewer on the phone accidentally read the product names instead of the prices on all three grocery items that they were allowed to play for, because the goal of the game was for the stage contestant to guess what product held the price that the home viewer selected. This would mean they forfeited the game, and it happened at least once.
  • Super Ball! If the contestant was wrong on all four balls (the last of which was the Super Ball), meaning they had no balls to play the skee ball game with; at least one was needed to play and win.
  • Telephone Gamenote  A rare game that was only played a few times, and had the misfortune of mostly appearing on episodes with fur coat prizes; these episodes were excluded from being rerun when then-host Bob Barker became a vegetarian and began his pet population campaign : A one time form of the trope; if the contestant spent more that 90 cents of the dollar they were provided in the pricing round of this game, meaning they didn't have enough money to make a call in the second round; at least 10 cents (a dime) was required to make a phone call in the second round for the contestant to win.
  • Pyramid:
  • In the front game, after the first four categories are played, the fifth category is selected by the team that is trailing. If, after that fifth category, the team's score is still behind that of their opponents, the game is automatically ended (unless the remaining box is the 711 or Mystery 7, thus allowing for at least a chance at it). More than once, because the trailing team was behind by more than eight points (categories only have seven words, meaning a maximum of seven points possible per round), the game was ended after the fourth category. The standard game over, then, comes with the sixth category (either the winning team scores enough points to win, or if the trailing team is still behind when time expires). Theoretically, the earliest a Pyramid front game could end is during the playing of the first word of the fourth category; that is, the losing team is trailing 14-0 and they immediately get disqualified on the first word. Not enough words would be available to help the trailing team at least tie.
  • This could also happen in the Winner's Circle. If all six subjects are guessed in 60 seconds or less, the contestant wins the large bonus. Giving an illegal clue on a category puts it out of play and the contestant forfeits the chance at the jackpot. However, if any categories are left, play continues until the rest are guessed or time runs out. If the former happens, the Winner's Circle just ends with no music and no flashing board indicating a bonus round win. You just see the lights come back on and the host explaining what went wrong. In this case, the standard game over is either getting all six in 60 seconds or time running out.
  • Password:
  • Password Plus and Super Password have an end game example similar to the above. The bonus round consists of ten passwords which must be communicated in order to win a large bonus. The standard game over is guessing all ten in 60 seconds or time running out. An illegal clue or accidentally reading a password or part of a password would put the password out of play and end the chance for the contestant to win the large bonus. If any passwords are left, the end game continues until the remaining are guessed or time runs out. In the case of the former, the round ends early with no celebration.
  • For Super Password's Cashword, giving an illegal clue ended the segment in a loss right away, regardless of how many chances the contestants have left (up to 3). This happened at least twice.
  • Trashed featured a Pyramid-esque bonus round in which each of the two contestants had to guess the artists in three separate music videos via clues given by his or her teammate. Giving an illegal clue (such as a part of the artist or band's name, the title of the song, etc.) eliminated that video from play and forfeited the chance to win the grand prize.
  • Good News Week: Several episodes of the Australian current-affairs comedy have ended with both teams losing to the studio audience. On one particularly memorable occasion during the show's original 90's run, the show was won by hostscorerumpire Paul McDermott.
  • The Weakest Link has been known to do this a few times; while there is no unusual way to lose the game other than being voted off or losing the final round, contestants occasionally show such a lack of intelligence that Anne sends them off without even saying "You are the Weakest Link, goodbye!"
  • Lingo:
  • The series had this happen twice in the Bonus Round during Season 1. At the time, the round consisted of guessing a string of five-letter words in two minutes with the first letter and another random letter revealed, with a ball awarded for each correct word. After time expired, the team was given a Bingo board with 13 of the 25 spots already covered in such a way that a 5-in-a-row could be achieved in as few as two draws, and the grand prize was won for completing said 5-in-a-row "Lingo" at any time; a standard game over was either winning the prize package, or running out of balls and receiving a consolation prize. However, one team in Season 1 won only one ball (which was drawn anyway even though it was useless) and another somehow failed to guess any words in the two minutes, note  It doesn't help that their last word was "Kazoo" with the K & A showing, and they first misspelled "Khaki" as "Kahki", and followed that with Chuck's favorite, "Kazaa". Since these spellings resulted in fake words, no help regarding the letters was provided, and they ran out of time on the third chance. thus winning zero balls and zero dollars; they left with the same consolation prizes that the losing team in the main game won, and the Bonus Lingo board didn't even appear.
  • Another example came after the tweaking began in Season 2. From that point onward, the teams were now given a few "bonus letters" that they could add to the words at any time if they got stuck; also, the board had only 12 spots covered, but a Lingo could now be made in only one draw, with a larger prize (either a trip or a Progressive Jackpot) for completing the Lingo in only one draw, and a smaller prize for doing it in two or more draws. A standard game over was still the consolation prize for failing to complete a Lingo before all the earned balls were used up. The non-standard came when a team who won 7 balls failed to make a Lingo in all 7 draws; host Chuck Woolery, incredulous over what just happened, reached into the hopper himself to draw another ball and, against 99.9% odds, drew the only number that still didn't make a Lingo.
  • In both scenarios, there's a non-standard win condition, which is in play if a team is able to win 10 balls; this is the max amount of pulls allowed and the spelling game ends immediately if it happens. While this allegedly guarantees $1,000, it actually guaranteed the $5,000 standard bonus prize because the team will have enough picks to eventually get a Lingo regardless of what order the balls are drawn.
  •     Sports 

  • The penalty shootout occurs in many sports games, where the players or teams are tied after a certain amount of regulation play, getting alternate turns shooting or trying to score from a set situation and the team who scores the most wins.
  • The most widely known example is in Association Football, where teams get a number of shots from the penalty spot with the team who score the most winning. 5 kicks is the standard practice. If tied they keep going until one team misses while the other scores. Field Hockey shares the same style of shootout.
  • Ice Hockey has a form where one player takes the puck from the halfway line, skates towards the goal and has to try and score in a one-one one with the goalkeeper. The North American Soccer League introduced a variation of penalty kicks that took inspiration from Ice Hockey, where the player would start 25 yards away from the goal and have to dribble towards the penalty box and shoot past the keeper. The majority of these attempts failed due to the strict time 5 second shot clock which stopped players from getting anywhere past the start of the penalty box and thus a long way from goal.
  • At the high school level and below –- and in some cases, the collegiate level and some non-major league level sports leagues –- there is a "mercy rule," which serves to either end a game after a prescribed point in the game or kick into effect a rule that hastens the end of the game once the winning team's margin reaches a defined point. This is as opposed to playing out a one-sided game to its natural conclusion under normal rules. Common applications:
  • Baseball and softball:
  • Virtually all state high school associations have rules which end games after a prescribed lead after a certain number of innings have been played. In both sports, the rule is usually 10 runs after five innings; it differs by sport if the winning team builds a larger lead even earlier; for instance, in baseball, the common rule is 15 runs after four innings, while in softball teams need only to have a 12-run lead after three innings. College contests have variations of this rule, but since baseball games at this level sometimes go the full nine innings, the 10-run rule doesn't usually kick in until the seventh inning. Softball rules are typically similar to high school's "10 after five" rule.
  • Child-based and junior high level baseball and softball, and some semi-professional leagues often have variations of the "mercy rule." For instance, a townball league for children may even have a rule where a team that builds a huge lead — say, 30-0 — after just one inning is no longer is allowed to bat, and the trailing team is given more than the standard three outs (usually six, or if they are the home team and haven't batted yet, nine) to give everyone at least one at-bat, with the game continuing only if in the game manager's judgement the losing team has sufficiently caught up.
  • Football:
  • Most states have a "continuous clock" rule, which means that if a team has a certain lead after halftime (it varies from 35-50 points), the clock runs continuously, not stopping on plays where the clock normally would be stopped, such as an incomplete pass or a play going out of bounds (although the clock does stop for quarter breaks, time outs, and any scoring). The clock continues to run in these games until the scoring difference falls below the prescribed margin (normal timing rules once again take effect), but then kick back in if the winning team once again exceeds the margin.
  • Prior to the advent of "continuous clock" rules, some states had rules whereby the game would end at halftime or any time after if the winning team has a certain lead (usually, 50 points or more). In Kansas, an eight-man football game (or six-man game in Texas) stops once a team gets a lead of at least 45 points by halftime or at any point after that (The entire first half must be played out). This rule came into effect during the 1980s, when some games featured mismatches so great, the winning team was easily scoring 90 or, on some rare occasions, 100 points.
  • In the NFL, most overtime games end with a field goal or touchdown, but on three occasions, they have ended in a safety (a defensive play where the defense stops the offense inside their own end zone).
  • Basketball: Much like football, state high school athletic associations have implemented "continuous clock" timing rules if the winning team is ahead by a certain margin (usually 30 points) after halftime. There are currently no known states that end a game before the end of the fourth quarter if an even higher point difference is reached.
  • Soccer:
  • The NCAA (particularly in football and basketball) and professional leagues such as the NBA, NFL and Major League Baseball do not have mercy rules, meaning they could score an unlimited number of points, runs, etc., without having special rules kick into effect to hasten the end of the game. Meaning unfortunate teams on the losing end would have no choice but to continue playing and trying to reduce the margin. (Which is not very fun for the loser.) That said, a continuous clock was used on at least three occasions in NCAA Division I football games, where the winning team ran up a large lead by halftime and agreed to a continuous clock for the entire second half; the winning team in all cases at least maintained the lead, with two of them increasing the lead. Aside from that, teams that have a very large lead over their opponents, especially a decidedly weaker one, will typically play reserves, run plays designed to take time off the clock (such as in football, run the ball up the middle and rarely if ever pass), use pinch hitters (in baseball, said roles going to non-starters andor reserves) with low batting averages, or shoot the ball conservatively (in basketball).
  • Boxing: At all levels, a boxer can be knocked down only so many times before he will be declared the loser by TKO — that is, a "technical knockout." It is also an automatic "game over" — that is, match over — if one boxer fails to answer a 10 count (that is, sufficiently get up in the referee's judgement) to continue the match. At some levels (though rarely at high-level bouts, since it rarely happens), the match automatically ends if a boxer is knocked down three times in a round.
  • In the "8-Ball" variant of pocket billards, you win if you legally sink the 8-ball (no other balls of your pattern remaining, calling the pocket you're going to sink the 8-ball in and then legally sinking the 8-ball there) before your opponent does. However, it is possible to lose on your turn instead, in the following ways:
  • Sinking the 8-ball when you haven't sunk every ball of your pattern yet.
  • When you are allowed to sink the 8-ball:
  • Sinking the 8-ball in a pocket you did not call.
  • Sinking the 8-ball in the correct pocket, but making a foul in the process (e.g. a scratch, hitting an opponent's ball first).note Note that if you foul up, but don't sink the 8, the usual foul rules apply instead of an instant loss.
  • Knocking the 8-ball off the table, although this is generally rare.
  • In Association Football, apart from the usual results of a win or draw over 90 minutes, or the 120 minutes of extra time, there are a handful of other ways to win or lose a game.
  • In a two match tie (used in knock-out competitions), the away goals rule, if the aggregate score is tied, then whoever scored the most goals in their match away from home wins.
  • Most leagues have a statue in the laws that says when a team cannot field a certain number of players, (most often a team being down to 6 from a team of 11), the game is abandoned, although depending on the score or the laws of the league the game can still be awarded to the team with enough players.
  • Numerous sports have what is termed "Sudden Death", "Golden Goal" or "Golden Point" where after a draw, the game continues to be played in extra time, with the first team to score a point of any kind is immediately the winner. It was introduced for Association Football in 1993 but removed by 2004.
  • A bizarre variation of the Golden Goal rule as part of the 1994 Caribbean Cup Qualification football tournament was that any goal scored in Golden Goal extra time counted as double for the league ladder in addition to winning the match itself. The final match for Barbados required them to defeat Grenada by 2 goals to qualify in first place and go through to the tournament itself. Barbados were winning the match 2-1, but were unable to score a goal to make the game 3-1. They decided to score an own goal which would tie the match and send it to extra time, hopefully allowing them to score a golden goal, worth double, to finish first. With only a handful of minutes left, the Grenada players cottoned onto the plan, and realised that they would finish first if they could score a goal at either end of the field. This resulted in Barbados defending both ends of the field and they succeeded in bringing the game to extra time and then scored a winning golden goal, winning the match 4-2 (despite only scoring 3 goals), and then qualifying in first place.
  • Another development across word sports was the "Silver Goal" (although other sports use different terminology). It is a variation of Golden Goal where the instant win condition of scoring any point in extra time is removed to allow the opposition team a certain amount of time or plays to equal or better the opposition. In Association Football this Silver Goal period was one half of extra time. When used in American Football, the team who have been scored on get one drive to match or better their opposition result, which can lead to a team scoring a field goal, then losing because their opposition scored a touchdown.
  • In Sumo Wrestling, if a wrestler's loin cloth falls off, they lose instantly. For obvious reasons, this infraction is extremely rare.
  • Cricket test matches has 3 standard endings after the 5 days of play, with 2 innings per team, comes to a close: A team may either win, lose, or drawnote aka. No result was reached at the end of the match the match. The non-standard ending is the tie, where the scores are exactly level once the team batting fourth and last has lost all of their batsmen. This has only happened twice in more than 2100 test matches. Should not be confused with the scores being level as the allotted time runs out, in which case it's a "We flippin' murdered 'em"-draw.
  •     Tabletop Games 

  • Chess: Resigning before you're put into checkmate. Often symbolized by deliberately knocking over your own king's piece, though this is not required. Both players may also choose to agree to a draw if they realize that neither of them can reasonably checkmate the other.
  • Any tabletop RPG set in more modern times can have a non-standard game over in probably the most mundane way possible: Your character gets arrested. This is more likely in settings where the Player Characters are just normal humans, and can be especially prominent when they are fighting any Eldritch Abomination that looks (or turns back into a) human after its dead. You may have been fighting to save the world, but to the police a corpse is a corpse after all, and while your character might get out on bail, or have their case thrown out due to lack of evidence, for all practical purposes you are out of the game for at least a little while until your bail hearing, the case has been to court etc. Hunter: The Vigil specifically mentions this as a danger hunters of any level face, and games like Call of Cthulhu which feature the players fighting wholly mortal servants of some monster often at least imply this.
  • Seeing as it is based on comic books, Sentinels of the Multiverse features a few ways to cause the players to get a Non-Standard Game Over (the standard way of winning is to reduce the Villain to 0 HP)
  • If Baron Blade has 15 or more cards in his trash (i.e. discard pile) at the start of his turn, his Tractor Beam plunges the moon into the Earth, and everyone dies.
  • Evil Alien Overlord Grand Warlord Voss takes over the Earth if he has 10 or more Minions in play at the start of his turn.
  • The Dreamer turns the Standard win condition listed above into the lose condition in battles against her: If she dies, the heroes lose. Justified, for two reasons: 1) The Dreamer is the child version of the hero Visionary, who time traveled to the present to save her younger self from a government project, so if Dreamer dies, Visionary dies. 2) the Dreamer's psychic powers overloaded during a nightmare and the nightmares themselves but be destroyed to wake her up. In short, the battle is one big Hostage Situation.
  • This is Inverted with Gloomweaver. If the heroes manage to get all three of his Relicsnote The Pouch of Bones, the Drum of Despair, and the Grimore of Curses into his trash before he can flip, the heroes succeed in preventing his summoning to Earth, and Gloomweaver automatically loses.
  • The environments also have Non-Standard Game Overs occasionally. The most prominent is the Self Destruct Sequence in the Wager Mars Base. If the Sequence completes itself, the base blows up and everyone dies.
  • Silver Gulch, 1993, has Lost In the Past. If there are no cards in the Environment's trash by the end of it's turn, the time portal the heroes used to get to Silver Gulch closes and thus, the heroes lose.
  • The Mobile Defense Platform has the Propulsion Systems. If it loses all of it's 10 HP, the Platform blows up and everyone dies. Note that it can be removed or destroyed in other ways without invoking the everyone dying part.
  • As of the last couple of editions of Warhammer 40,000, if a game turn ends with one player having no models at all on the board, they are "tabled" and immediately lose. Doesn't matter if they have enough Victory Points in the bag to wipe the floor with their opponent, or if they have their entire army in reserve ready to drop in at the start of the next turn - if you get tabled, you lose everything.
  • Fluxx has Goal cards — if someone meets the conditions on an active Goal card, they win. It also has Ungoals — if the conditions on an active Ungoal card are met, everyone loses.
  • The Game of Life - in the classic (1960-1990) version, if you didn't think you had enough money to win the game outright by having the most money at retirement, you could attempt to become a "Millionaire Tycoon" by calling one number on the wheel and spinning. Landing on that number resulted in an Instant-Win Condition (and thus a NSGO for your opponents); any other number resulted in the loss of everything you owned and your banishment to the Bankrupt space (thus a NSGO for yourself).
  • In the dice game Pass the Pigs (which uses special pig-shaped dice), if you somehow manage to roll the dice so that one pig is standing upright on the ground, and the other is standing upright on the first pig's back (a virtually impossible feat), you instantly lose the game.
  • The standard Chrononauts has this occur if there are thirteen temporal paradoxes on the field at one time. An expansion included a character who actually had a temporal paradox as his own win condition.
  • Real time fault tolerant transaction processing system

    This application is a continuation of application Ser. No. 07125,463, filed Nov. 25, 1987, now abandoned.

    BACKGROUND OF THE DISCLOSURE

    1. Field of the Invention

    The invention relates to a real time fault tolerant transaction processing system and particularly one suited for use in a service control point.

    2. Description of the Prior Art

    Currently, many computer controlled systems, particularly those used in transaction processing, must operate at extremely high levels of reliability. Unfortunately, a computer which controls such a system, due to the complexity of the computer hardware and attendant software, is oftentimes the least reliable component in the system and is frequently a main cause of system failure. Therefore, in an effort to provide increased reliability, the art has turned to so-called fault tolerant computers for use in transaction processing systems. However, computers of this type possess serious drawbacks which, as discussed in detail below, severely limit their utility. As a result, such computers can not be used to impart increased reliability to a variety of computer based transaction processing systems.

    One specific transaction processing system that must operate at an extremely high level of reliability is a service control point ("SCP") that controls routing of telephone calls, within the telephone network, that require special handling, such as 800 and calling ("credit") card calls. In particular, whenever a telephone subscriber dials such a call, this call is first routed to an equal access switch, located either at a local office or elsewhere, which has service switching point capability (such a switch will hereinafter be referred to as an "SSP"). Primarily, the SSP processes calls that require remote data base translation. Now, whenever the SSP recognizes an incoming a call as one that requires special handling, the SSP suspends normal call processing, launches a message over a common channel signalling ("CCS") network to an SCP to determine how the call is to be routed, and finally upon receipt of a return message from the SCP, routes the call in a manner specified by the return message.

    Specifically, whenever a subscriber places a call to an 800 number, the local switch routes the call to an SSP. The SSP fabricates an query in the form of a packet. This packet contains the 800 called number and a request for a destination routing number associated with the 800 number and, additionally, identification of a particular long distance (inter-exchange) carrier over which the call is to be routed. This packet is then routed over a common channel signalling line in a CCS network to a particular one of several geographically separated signalling transfer points (STPs). Specifically, the CCS network typically consists of a multi-level hierarchy of STPs, wherein each STP is a primarily a packet switch. The first STP to receive the packet, i.e. the "originating" STP, then routes the packet, over an available link to an SCP for processing or, via a specified link, to another STP for eventual routing to an SCP. To perform this routing correctly, each STP that routes this packet examines a routing field located in the packet and, in response, determines where the packet should be routed. In particular, for an 800 call, the first six digits of the dialed 800 number specify the appropriate SCP that is to receive a corresponding packet from an SSP.

    The SCP itself is a fault tolerant transaction processing system that contains various databases that collectively provide desired call routing information. These databases contain a "customer record" which specifies how each 800 call is to be routed. This record frequently contains one or more destination routing numbers associated with a particular 800 number and specifies the manner in which one of these destination routing numbers is to be selected, e.g. in accordance with the time of day, day of month, originating numbering plan area of the caller or other pre-defined method. The SCP is a transaction processor in which a transaction involves the receipt of a packet and the generation of a corresponding response. In particular, whenever a query is received, via an incoming packet, the SCP performs associated database access operations to obtain a necessary destination routing number and an inter-exchange carrier identification for the corresponding 800 call. The resulting information is then transmitted, as a packet, over the CCS network by the SCP, via one or more STPs, back to an "originating" SSP which generated the corresponding query. Once a packet containing the destination routing number and inter-exchange carrier selection is received, the originating SSP appropriately routes the 800 call to the destination routing number. If the destination routing number is within the local access and transport area (LATA) served by the local telephone company, then the 800 call is routed by the SSP, via switching and transport facilities provided by that telephone company, directly to the destination routing number. Alternatively, if the destination routing number is outside the LATA served by the local telephone company, then the SSP routes the 800 call to the identified inter-exchange carrier with specific instructions (e.g. the destination routing number) for routing the call to its final destination.

    To ensure that 800 service is reliably provided all the time, an SCP must operate with minimal down time, preferably less than three minutes per year. Two techniques are often used in the art to impart a high degree of fault tolerance to the SCP: use of redundant link connections from the CCS network to an SCP and use of fault tolerant processors within the SCP.

    First, each SSP is connected, by separate links, to two different STPs, each of which, in turn, is connected by separate links to two different SCPs. In the event one of these links fails, then traffic destined to a particular SCP is re-routed thereto via another link or a different STP.

    Second, the art teaches that each processor used within the SCP must be fault tolerant. Generally, SCPs known in the art contain two front end processors, two back end processors and a fault tolerant mass memory device, such as a dual ported disk drive. Each front end processor is connected to both incoming links that terminate at the SCP. Each back end processor is connected to both front end processors. Also, each back end processor is connected to the disk drive through one of its dual ports. In operation, one of the front end processors formulates a database query in response to each packet appearing on either link. One of the back end processors receives a query from the front end processor and, in response, performs various database look-up operations, through one of the ports of the disk drive, to obtain the desired information. The front and back end processors are both fault tolerant. Specifically, the fault tolerant processors, as is typically taught in the art, operate in a hotstandby configuration in which one processor (the "hot" processor) is actively processing packets or queries while the other (the "standby" processor) remains in a standby condition ready to take over processing in the event the hot processor fails. A typical example of such a processor is shown in U.S. Pat. No. 4,484,275 (issued Nov. 20, 1984 to J. Katzman et al and hereinafter referred to as the '275 patent).

    Fault tolerant processors known in the art possess serious drawbacks which substantially limit their utility in an SCP.

    First, fault tolerant processors are very expensive. While a non-fault tolerant minicomputer having sufficient throughput for use in an SCP may cost upwards of $20,000, a fault tolerant processor of the same capacity may cost in the range of $100,000 or more. The additional cost is incurred as the direct result of highly specialized hardware and very sophisticated software, particularly for fault detection and recovery, needed in these processors to provide an acceptable degree of fault tolerance. Specifically, the software used in fault tolerant processors is often of such complexity that it accounts for upwards of 65% of the total cost of the processor. Thusfar, the art has failed to provide any "off the shelf" software that can be purchased and installed in two relatively low cost commercially available stand alone processors to provide an acceptable degree of fault tolerant operation therebetween.

    Second, in a traditional fault tolerant processor, such as that shown in the '275 patent, the hot processor handles the entire processing load while the standby processor remains idle. Consequently, in an application, such as the SCP, where queries may occur at a rate in excess of 200second, the hot processor itself must be capable of handling all these queries. This mandates that the each processor must have a sufficiently large throughput which further increases the cost of these processors. Now, in an attempt to reduce cost, the art teaches, as shown by the architecture described in U.S. Pat. No. 4,356,546 (issued Oct. 26, 1982 to A. Whiteside et al), that a set of different tasks can be assigned to and executed by a different processor. In this manner, each processor is not required to handle the entire processing load but rather a proportionate share thereof. Consequently, processors having a reduced capacity can be used to implement a fault tolerant architecture. Unfortunately, complex hardware and sophisticated and costly software is needed to monitor the execution of all tasks and, in the event a processor fails, re-schedule tasks among all active remaining processors. As a result, the cost savings that may accrue through the use of smaller processors are more than offset by the added expense of task monitoring and re-scheduling hardware and its attendant software.

    Third, traditional fault tolerant processors, such as that described in the above-noted '275 patent, utilize separate processors that are tightly coupled together through multiple busses. Unfortunately, inter-connecting processors in this fashion forces each processor to be somewhat dependent upon the other processors. Specifically, should one such processor fail, then depending upon the severity of the failure, e.g. whether a processor inter-connection bus is taken down as a result, the failed processor may well disrupt the operation of one or more of the remaining processors and potentially halt all further processing occurring throughout the fault tolerant system. Other illustrative fault tolerant architectures that rely on relatively tight inter-processor coupling are shown, for example, in U.S. Pat. Nos.: 4,484,273 (issued Nov. 20, 1984 to J. Stiffler et al); 4,421,955 (issued Dec. 20, 1983 to H. Mori et al); and 4,412,281 (issued Oct. 25, 1983 to G. Works). A similar dependency problem arises in those fault tolerant processors known in the art which rely on distributing tasks through a common switch to any one of several inter-connected processors. Such an arrangement is illustratively shown in U.S. Pat. No. 4,392,199 (issued July 5, 1983 to E. Schmitter et al). Here, the overall reliability of the fault tolerant processor is limited by the reliability of the common switch. Should the switch fail, all processing will stop.

    Fourth, other fault tolerant processors known in the art rely on simultaneously processing tasks through paired redundant hardware and comparing the results to isolate faults. For example, in the architecture described in U.S. Pat. No. 4,453,215 (issued June 5, 1984 to R. Reid), identical tasks are simultaneously processed, on a synchronous basis, through two identical dual processors. The results obtained from both processors within a dual processor are compared against each other to detect any errors (i.e. any differences) occurring within that dual processor and, should an error be detected, to immediately take that one of the two dual processors out of service. As a result, the faulty dual processor is taken out of service before it has a chance to transfer any possibly erroneous information onward to a bus. Although this arrangement may, in certain instances, provide an acceptable level of fault tolerance, substantial expense is incurred for quadruplicating processing elements.

    Thus, a need exists in the art for a transaction processing system, particularly one suitable for use in a service control point, that provides a very high degree of fault tolerance without complex hardware, sophisticated software and the attendant high cost associated with traditional fault tolerant processing systems.

    SUMMARY OF THE INVENTION

    The above-described drawbacks inherent in the art for providing a fault tolerant transaction processor, particularly one suitable for use within a service control point, are advantageously eliminated in accordance with the teachings of the present invention by a network based communication system which employs a communication protocol that adaptively distributes packets on an equal basis over multiple physical links that connect two points within the network, such as an SCP and a signalling transfer point (STP), and non-fault tolerant front end and back end processors that are connected to each physical link for handling the processing of packets appearing on that link. All the front and back end processors are loosely coupled together for purposes of processor synchronization and re-assignment. Through this communication system, all the physical links simultaneously carry an approximately equal number of packets which are, in turn, processed by all the processors connected thereto. In the event any physical link or either a front or back end processor connected thereto fails, then that link is declared to be out of service. Consequently, the protocol merely re-assigns all subsequently occurring packets to the other links until such time as the fault is cleared. As the result of link re-assignment, there is advantageously no need to connect a fault tolerant processor to each physical link. This, in turn, substantially and advantageously reduces the complexity and cost of the fault tolerant transaction processing system.

    In accordance with a specific embodiment of the present invention, the inventive system employs "j" sparing in which j processors (where j is an integer) are used in situations that would normally require j processors. Specifically, if only three physical links are sufficient to carry expected traffic, then four physical links with accompanying front and back end processors would be used in lieu of three physical links with the protocol providing approximately equal traffic (packet) distribution among the four links. Since use of an extra link and an extra set of processors is far less expensive than completely duplicating the entire system hardware as has been done in the past to provide fault tolerance, use of "j" sparing results in a substantially less expensive fault tolerant processing system than has been taught in the art.

    Furthermore, since no processors (either front or back end) are normally in an idle state but instead all such processors are productively processing packets, then advantageously little processing capacity is wasted, at least far less than that associated with traditional fault tolerant processors that rely on using separate hotstandby processors. Moreover, since the processors used in the inventive system are non-fault tolerant and have a smaller processing capacity than those typically associated with fault tolerant architectures, use of these non-fault tolerant processors results in a fault tolerant architecture that is substantially less expensive than that previously possible. In addition, since the all the front and back end processors are loosely coupled and a single back end processor can selectively bring up or take down subsystem (application) processing in each corresponding frontback end processor pair located within an entire SCP, the software that co-ordinates all the front and back end processors in the inventive system is far less sophisticated than that associated with traditional fault tolerant architectures. This, in turn, further reduces the cost of providing a fault tolerant real-time transaction processing system according to the teachings of the present invention.

    Moreover, in accordance with a feature of the invention, the inventive architecture advantageously bifurcates the software that provides an application, such as 800 service, from the software used to implement a fault tolerant communication network. In the past, application and communications software were frequently intertwined which slowed and significantly increased the expense of developing new applications for use in fault tolerant network environments. By separating the software, many new transaction based applications destined for use in a fault tolerant network environment can be advantageously developed without having to modify the associated communication software. This advantageously shortens the development cycle substantially and also provides significant attendant cost savings.

    BRIEF DESCRIPTION OF THE DRAWING

    The teachings of the present invention can be readily understood by considering the following detailed description in conjunction with the accompanying drawing, in which:

    FIG. 1 is a simplified diagram of a prior art architecture of a telephone signalling network that utilizes signalling system 6;

    FIG. 2 is a block diagram of prior art service control point (SCP) 200 shown in FIG. 1;

    FIG. 3 graphically depicts the hierarchy of the various levels of signalling system 7 (SS7) associated with a node on the common channel signalling (CCS) network and the message and control flow that occur among these levels;

    FIG. 4 is a simplified diagram of the architecture of the telephone signalling network shown in FIG. 1 that has been modified to utilize SS7;

    FIG. 5 shows the correct alignment of the drawing sheets for FIGS. 5A and 5B;

    FIGS. 5A and 5B collectively depict a block diagram of a preferred embodiment of SCP 500 shown in FIG. 4 that incorporates the teachings of the present invention;

    FIG. 6 depicts a block diagram of front end processor 5101 situated within SCP 500 shown in FIGS. 5A and 5B;

    FIG. 7 depicts a high level block diagram of several of the software processes executing within each front endback end processor pair in SCP 500 shown in FIGS. 4 and 5 and the principal inter-process communication occurring therein;

    FIG. 8 diagrammatically shows the communication occurring between SCP 500 and STPs 56 and 58 during the handling of a SS7 link failure;

    FIG. 9 shows the correct alignment of the drawing sheets for FIGS. 9A and 9B;

    FIGS. 9A and 9B diagrammatically show a sequence of inter-process communications that occur within SCP front end processors 5101 and 5102 shown in FIG. 8 during the handling of a link failure;

    FIG. 10 diagrammatically shows a sequence of inter-process communications that occur within SCP front end processor 5101 and back end processor 1 for bringing a subsystem executing on back end processor 1 into service;

    FIG. 11 diagrammatically shows a sequence of communications that occur between primary and mate SCPs and an adjacent STP to effectuate a mate switch operation;

    FIG. 12 diagrammatically shows a sequence of inter-process communications that occur within SCP front end processor 5101 and back end processor 1 situated within SCP 500 for generating a SS7 subsystem out of service request (SOR) message in order to invoke a mate switch operation; and

    FIG. 13 diagrammatically shows a sequence of inter-process communications that occur within SCP front end processor 910 and back end processor 920 situated within mate SCP 590 in response to an incoming SS7 SOR message initially issued by SCP 500 as part of a mate switch operation.

    To facilitate understanding, identical reference numerals have been used to designate identical elements that are common to the figures.

    DETAILED DESCRIPTION

    The teachings of the present invention are applicable to implementing a wide variety of real-time fault tolerant transaction processing systems. For the sake of brevity, the present invention will be discussed in the context of a real-time fault tolerant transaction processing system for use in a service control point (SCP) that processes packets supplied over any link existing within a link set that connects a signalling transfer point (STP) to the SCP. Clearly, after reading the following description, those skilled in the art will readily appreciate how the teachings of the present invention can be incorporated into other transaction processing systems to provide fault tolerance.

    I. Background

    To fully appreciate the teachings of the present invention, the following discussion will first examine how packets occurring within a telephone signalling network were traditionally processed and then address the inventive system.

    In particular, FIG. 1 shows a simplified diagram of a prior art architecture of a telephone signalling network that employs transaction processing. In general, this network provides special telephone routing information to support a variety of special calls, such as 800 number calls and calling card services. This information is obtained through remote database translations, using caller supplied information such as a called number or a credit card number, to appropriately access one or more databases that are embedded within the telephone signalling network. For illustrative purposes, this network and the invention will be discussed in the context of processing calls to 800 numbers.

    Assume for the moment that a caller dials a call to an 800 number. The caller (not shown) is generally connected to a local switch, such as local switch 12 or 14. An 800 telephone number is actually a logical telephone number. To route such a call to its proper destination, the 800 number must be translated to an appropriate destination routing number to which the call can be subsequently routed. The specific destination routing number is specified in a customer record stored within one or more databases residing within a service control point (SCP). This record typically contains one and often more destination routing numbers and associated inter-exchange carrier selections that are associated with a dialed 800 number and the manner in which one of these destination routing number and its associated inter-exchange carrier are to be selected, e.g. time of day, day of month, originating numbering plan of the caller and the like. An SCP is an on-line real time fault tolerant transaction processing system that provides call processing information (responses) in response to inquiries received via STPs connected within the signalling network. This call processing information can include call routing instructions, such as for 800 calls, or other instructions depending upon the information requested by an SSP. In particular, several different database applications can be concurrently available on an SCP. The following discussion addresses one such application, 800 service.

    Now, to process an 800 number call, whenever a local switch, typified by either local switch 12 or 14, receives an 800 call, this switch routes the call onward, either through trunk 22 or through trunk 24, respectively, to an equal access switch, located either at a local office or elsewhere, that has service switching point capability (such a switch will be collectively referred to as an "SSP"), such as SSP 30. The function of the SSP is to first recognize an incoming call as one requiring special handling --such as 800 number calls, then suspend normal call processing for this call, thereafter obtain appropriate routing instructions through the telephone signalling network and finally route the call according to the resulting instructions. Specifically, in response to a call to an 800 number, SSP 30 fabricates a query in the form of a packet. This query contains the called 800 number and a request for a destination routing number associated with the dialed 800 number and a designation of a specific inter-exchange carrier, such as inter-exchange carrier 1 or 2, that is to carry this call. This packet also contains a network address of the SSP, i.e. SSP 30, that originated the query. Once this packet is generated, it is transmitted through a regional common channel signalling (CCS) network 50 to an appropriate SCP, such as SCP 200 or SCP 210, which processes the packet and provides an appropriate response. Every packet received by an SCP is part of a separate transaction. Every transaction includes both a packet sent to an SCP from an SSP and a corresponding response generated thereto by the SCP and sent to the SSP.

    The CCS network consists of a multi-level hierarchy of signalling transfer points (STPs) which primarily act as packet switches to carry a message, in this case a packet, from an "originating" SSP to a particular "destination" SCP and to carry a packet containing a response message (call routing instructions) from that SCP back to the originating SSP which, in turn, routes the 800 call using the call routing instructions. As shown, CCS network 50 contains STPs 52, 54, 56 and 58 which are situated at different geographic locations within a given service region. STPs 52 and 54 receive incoming packets from SSP 30 for subsequent routing through the CCS network. As a result, these STPs function as "originating" STPs. To ensure continued operation in the event of a link failure, each originating STP is connected through two separate bi-directional links, such as links 64 and 72 for STP 52, and links 66 and 74 for STP 54, to destination STPs 56 and 58. If one of the links, such as link 64, connecting an originating STP, such as STP 52, fails, then that STP routes packets, via the other link--here link 72, to the other destination STP. Destination STPs 56 and 58 are inter-connected by bi-directional link 68 to route packets therebetween, if necessary. Hence, if STP 58 receives a packet destined for STP 56, the former STP routes the message over link 68 to the latter STP. Likewise, originating STPs 52 and 54 are inter-connected by bi-directional link 62 to route packets therebetween in the event of a link failure. Generally, CCS network 50 contains more than two originating and two destination STPs, and more than two STP levels wherein one or more levels of STPs are situated between the originating and destination STPs to provide packet routing therebetween. Each individual SSP, STP and SCP that exists within a signalling network is often referred to as a node.

    Now, once SSP 30 formulates an query, this SSP routes the associated packet that contains this query and appropriate header information through an available link, such as link 36 or 38, to an originating STP, i.e. either STP 52 or 54, respectively, located within CCS network 50. The originating STP determines, using internal global title translation tables, an address of a particular SCP, such as SCP 200, which contains the appropriate databases necessary to provide the requested call routing instructions, i.e. the specific SCP which contains a copy of the customer record for the dialed 800 number. This address is then inserted as a routing field that forms part of the header of the packet. Thereafter, the packet is routed from the originating STP to a destination STP within CCS network 50. Each STP that receives this packet examines its routing field and routes the packet accordingly. Once the destination STP receives the packet, it routes the packet to the particular SCP specified within the header. The SCP performs associated database look-up operations to formulate the desired call routing instructions. After this has occurred, the SCP fabricates a packet that contains the call routing instructions as a response message and a header that specifies the address of the SSP that originated the original query. Once the SSP receives this packet, it routes the dialed 800 call according to the routing instructions, i.e. the SSP routes the dialed call to the specified destination routing number via a specified inter-exchange carrier, such as inter-exchange carrier 1 or 2, via respective trunks 32 or 34.

    This signalling network that has just been described and which is well known in the art utilizes CCITT signalling system 6 (SS6). This signalling system employs only one physical path for each link that connects any two components (SSPs, STPs, and SCPs) that reside within or are connected to the signalling network.

    With this in mind, FIG. 2 shows a block diagram of an SCP, illustratively SCP 200, that forms part of the prior art signalling network shown in FIG. 1.

    As shown, the SCP contains two separate front end processors 220 and 225 each of which is connected to both links 82 and 86 which emanate from STPs 56 and 58, respectively. Each front end processor receives incoming packets and executes various software routines that implement a well-known communication protocol that forms part of SS6. This protocol provides framing, synchronization, error checking and correction, destination checking, message transport and other well-known communication functions. After the protocol has executed in a front end processor for an incoming packet, this processor sends the query contained in the incoming packet to a back end processor, such as processor 260 or 265, to process the query accordingly and provide a desired response. Query processing typically includes database look-up operations performed through path 270 or path 275 into a customer record stored on dual ported fault tolerant disk drive 280. The resulting response provided by the back end processor is then communicated back to the front end processor that provided the query. This front end processor executes the SS6 protocol to fabricate a packet containing the response and appropriate header information and then subsequently transmits the packet back to an STP.

    Hardware redundancy and link redundancy are used to impart a necessary degree of reliability to the signalling network. Specifically, in the event one path fails, another is available; in the event, one processor fails, another is available. As shown, each SCP is connected, via two separate links--here links 82 and 86, to two different STPs. In this manner, CCS network 50 can still communicate with SCP 200 and process calls even if one of the STPs or links fails. If STP 56 or link 82 fails, then the packets that would otherwise be carried by these components are routed, via STP 58 and link 86, to the SCP. Also, within the SCP, both links are connected to both front end processors. Hence, if one of these processors fails, then the other front end processor can immediately take over the processing load of the failed processor. Additionally, each front end processor is connected through separate data links to both back end processors. In the manner, should either one of the data paths connecting a front end processor to a back end processor fail or should a back end processor itself fail, then queries can be routed through the other data link to a different back end processor for processing. Specifically, front end processor 220 is connected through bi-directional data paths 242 and 244 to back end processors 260 and 265. Likewise, front end processor 225 is connected through bi-directional data paths 246 and 248 to back end processors 260 and 265.

    The art teaches that to provide added reliability, each of the front end and back end processors must be fault tolerant. Unfortunately, traditional fault tolerant processors known in the art possess serious drawbacks that significantly limit their use in an SCP. Specifically, traditional fault tolerant processors disadvantageously: utilize, typically in a hotstandby configuration, separate high throughput processing elements that are quite expensive; utilize complex, sophisticated and relatively expensive software; andor might, depending upon the specific fault tolerant processor chosen, employ tight inter-processor coupling which decreases overall system reliability.

    II. Inventive Fault Tolerant Transaction Processing System

    Now, in accordance with the teachings of the present invention, a real-time fault tolerant transaction processing system, particularly suited for use in an SCP, can be fabricated which substantially eliminates the drawbacks associated with traditional fault tolerant systems.

    The inventive system relies on using a communication protocol, illustratively signalling system 7, that adaptively distributes traffic on an approximately equal basis over multiple physical links that connect two points, coupled with use of non-fault tolerant front end and back end processors that are connected to each physical link for handling the processing of packets appearing on that link, wherein all the front and back end processors are loosely coupled together for purposes of processor synchronization and re-assignment. Through this system, all the physical links simultaneously carry an approximately equal number of packets which are, in turn, processed by all the processors connected thereto. In the event any physical link or either a front or back end processor connected thereto fails, then that link is declared to be out of service. As a result, the protocol merely re-assigns all subsequent traffic to the other links until such time as the fault is cleared. As the result of link re-assignment, there is advantageously no need to connect a fault tolerant processor to each physical link.

    Moreover, to provide increased fault tolerance, the inventive system employs "j" sparing in which j processors (where j is an integer) are used in situations that would normally require j processors. Specifically, if only three physical links are sufficient to carry expected traffic, then four physical links with accompanying front and back end processors would be used in lieu of three physical links with the protocol providing approximately equal traffic (packet) distribution among the four links. Since use of an extra link and an extra set of processors is far less expensive than completely duplicating the entire system hardware as has been done in the past to provide fault tolerance, use of "j" sparing results in a substantially less expensive fault tolerant processing system than has been taught in the art.

    Furthermore, since no processors (either front or back end) are normally in an idle state but instead all such processors are productively processing packets, then advantageously little processing capacity is wasted, at least far less than that associated with traditional fault tolerant processors that rely on using separate hotstandby processors. Moreover, since the processors used in the inventive system non-fault tolerant and have a smaller processing capacity than those typically associated with fault tolerant architectures, use of these non-fault tolerant processors results in a fault tolerant architecture that is substantially less expensive than that previously possible. In addition, since the all the front and back end processors are loosely coupled together and a single back end processor can selectively bring up or take down subsystem (application) processing in each corresponding frontback end processor pair located within an entire SCP, the software that co-ordinates all the front and back end processors in the inventive system is far less sophisticated than that associated with traditional fault tolerant architectures. This, in turn, further reduces the cost of providing a fault tolerant real-time transaction processing system according to the teachings of the present invention.

    Inasmuch as the inventive communication system utilizes a communication protocol along with particular hardware and software, the discussion will now address the salient properties of the protocol before proceeding to a detailed examination of the hardware and software used in the inventive system.

    A. Communication Protocol

    The protocol used in the inventive communication system provides point-to-point communication between different nodes--such as between an SSP and an STP, between separate STPs, and between and STP and an SCP--existing within CCS network that forms a telecommunications signalling system. This protocol, hereinafter referred to as signalling system 7 (SS7), is the ANSI (American National Standards Institute) implementation, as recommended by the ANSI T1X1.1 Working Group, of the signalling system 7 standard initially promulgated by CCITT. This protocol includes mechanisms, such as error detection and correction, to insure reliable transfer of signalling information, between two points in a CCS network, in the presence of transmission disturbances or a network (link or node, e.g. STP or SCP) failure. This protocol, as described in detail below, connects each pair of nodes with a number of separate signalling links, specifically up to sixteen separate links, that collectively form a link set. In the case of a link failure, the protocol diverts and distributes traffic from a failed link in the set to and among all the remaining links in the set. The software that implements SS7 executes in every node within the network in order to reliably transfer messages therebetween.

    One type of transmitted message that appears on the network is a packet consisting of a message signal unit (MSU) that contains desired signalling information (application information) followed by various header and trailing fields. Two other types of messages, i.e. a link status signal unit (LSSU) and a fill-in signal unit (FISU) can also, under certain circumstances, be transmitted onto the network by a node and are discussed below. The structure of an MSU is depicted in Table 1 below. The number in parenthesis in each of the following tables specifies the associated number of bits in each corresponding field.

    TABLE 1______________________________________MESSAGE SIGNAL UNIT (MSU) STRUCTURE______________________________________ ##STR1##______________________________________

    where:

    F is a message delimiter flag;

    CK are check bits;

    SIF is a signalling information field;

    SIO is a service information octet;

    LI is a length indicator field;

    FIB is a forward indicator bit;

    FSN is a forward sequence number;

    BIB is a backward indicator bit; and

    BSN is a backward sequence number.

    Specifically, each MSU begins and ends with a unique 8-bit pattern, illustratively "01111110", called a message delimiter flag (F). Appropriate routines executing at level 2 of the protocol prevent data from being interpreted as a delimiter flag by stuffing a "0" bit into a data pattern at the end of any consecutive string of five "1" bits in that pattern. Sixteen check (CK) bits are provided at the end of every MSU. For each MSU, the values of these check bits (a cyclic redundancy code) are generated by a transmitting node by computing a well-known frame check polynomial on portions of the MSU (flag and check bits excluded) prior to transmitting that MSU. Upon receipt of that MSU at a receiving node, the receiving node locally generates the check bits by computing the same polynomial and then compares the values of the locally generated check bits against those embedded within the received MSU. If any discrepancy is found between the values of the received and locally generated bits, then transmission errors are assumed to exist. As a result, the receiving node discards the received MSU and provide either a negative or no acknowledgement of receipt. This causes the transmitting node to re-transmit this MSU, as discussed below.

    The signalling information field (SIF), as described in detail below in conjunction with Table 2, contains an application message, in this case for 800 service a query from an SSP to an SCP or a response therefrom to an SSP, and a routing label. The routing label, as discussed in detail below in conjunction with Table 2, specifies the network origination and destination addresses of the MSU along with a code specifying the specific link within a link set that is to carry the MSU. The signalling information field contains an integral number of octets (8-bit groups) greater than or equal to 2 and less than 2722. The specific format and content of the application message is defined by the specific application software, i.e. the 800 service software.

    The service information octet (SIO) is an 8-bit code used by level 3 of SS7 to distinguish between different message types and different label types and thereby assist in routing a message to an appropriate application.

    The length indicator (LI) is a binary number within the range 0-63 which specifies the number of octets that follow the length indicator bits and precede the check bits.

    The forward (FIB) and backward (BIB) indicator bits along with the forward and backward sequence numbers (FSN and BSN, respectively) are used to perform sequence control and acknowledgement of transmitted MSUs. Specifically, each MSU is sequentially numbered in a cyclical sequence running between 0 and 127. The forward sequence number is the sequence number of a message contained within the present MSU that is being transmitted. The backward sequence number is a sequence number associated with an MSU that has been previously received, by the node that is now transmitting, from the node that is now receiving and is now being acknowledged to that receiving node.

    As discussed above, the signalling information field (SIF) not only contains an application message required by the 800 service application executing within a destination SCP but also contains a routing label. This label is utilized by the message distribution, discrimination and routing functions within level 3, as discussed below, to route, an MSU to a proper application, such as 800 service, that executes within a specified SCP. The routing label, for use within the United States CCS network, takes the form shown in Table 2 below:

    TABLE 2______________________________________ROUTING LABEL STRUCTURE______________________________________ ##STR2##______________________________________

    where:

    SLS is a signalling link selection code;

    OPC is an originating point code; and

    DPC is a destination point code.

    The signalling link selection code is a five bit code used in sharing traffic among two different link sets emanating from a node and within different links that form each of these link sets. The purpose of load sharing is to ensure that individual links and STPs do not become overloaded. All signalling points in a network use the same procedure for load sharing. Specifically, the least significant bit in the SLS specifies which of two link sets emanating from a node is to carry the MSU with the remaining four bits designating the particular link within the specified set. Prior to transmitting the MSU, the node rotates the SLS and places the value of the most significant bit into the least significant bit position. The receiving node then uses the value of the bit now occupying the most significant bit position to select one of two link sets with the remaining four bits used to select a specific link within that set and so on for all subsequent nodes that will receive the MSU. As a result, information that determines load sharing at any node in the network is independent of information used at any previous node. In the event a link in a link set fails, then the protocol load-shares the traffic (MSUs) that would otherwise be carried by the failed link over the remaining links in the link set. This is accomplished by re-assigning the signaling link selection codes that were previously assigned to the failed link to the remaining links in the link set. Messages are routed on the network through pre-defined (static) routing paths that are adaptively changed in the presence of node or link failures or link congestion, as explained below.

    The originating and destination point codes are CCS network addresses of the origination and destination sites of the associated MSU. Both CCS network addresses, OPC and DPC, take the form shown in Table 3 below:

    TABLE 3______________________________________ORIGINATIONDESTINATION POINT CODE(OPCDPC) STRUCTURE______________________________________ ##STR3##______________________________________

    The network identifier field contains a code that identifies a specific CCS network to which a DPCOPC belongs. The network cluster field, when used, defines a cluster of nodes within the specified network. Lastly, the network cluster member field contains a code that specifies a specific node within a specific cluster. The network cluster member code "00000000" is used to address STPs that form any specific cluster.

    A graphical depiction of hierarchy 300 of the various levels of SS7 existing at each node on the CCS signalling network and the message and control flow that occurs among these levels is shown in FIG. 3. Dot-dashed line A represents that a mirror image of hierarchy 300 exists in a companion node on the CCS network. As shown, SS7 utilizes a number of distinct levels: signalling data link functions 310 (level 1), signalling link functions 320 (level 2), signalling network functions 340 (level 3) and user levels 390 (level 4 and higher). The first three levels form message transfer part 380 which collectively provides a transport system to reliably transfer MSUs between different nodes andor different applications, of which 800 service is one such application, residing at one or more nodes. Here, specifically, a portion of the 800 service which generates queries and processes responses to route calls to a specific destination routing number, resides within an SSP and the remainder which performs database access operations resides within an SCP. An SSP and SCP may, though often do not, reside at the same geographic site. Since each node in the communications network can transmit and receive SS7 messages, every node executes identical software that implements levels 1, 2 and 3 of the SS7 protocol in order to reliably transfer messages among these nodes.

    In essence, level 1, signalling data link 310, defines physical, electrical and functional characteristics of an actual signalling link, i.e. transmission channel 303, and a specific transmission method, i.e. switching functions 307, through which the link is accessed. Level 1 exists between dot-dashed lines A and B. Generally, such a link is a 56 or preferably 64 kbitsecond synchronous digital path. As such, level 1 is implemented in hardware. Each higher level is implemented in software with each task executing within that level being implemented through one or more subroutines. The content and organization of each of these subroutines are readily apparent to those skilled in the art.

    Level 2, signalling link functions 320, define various tasks (that invoke pre-defined functions and procedures) relating to the transfer of individual MSUs over an individual signalling data link (transmission channel) that has been defined in level 1. These functions include: MSU delimitation and MSU alignment, error detection, error correction, initial alignment, error monitoring and flow control of MSUs being transmitted through the link. Level 2 exists between dot-dashed lines B and C. Specifically, based upon the detection of delimiter flags (F), level 2 tasks determine the beginning and end points of an MSU. Level 2 tasks also stuff "0" bits into a data stream after the occurrence of five "1" bits to prevent any data from imitating a delimiter flag. As set forth above, upon receipt of an MSU, level 2 tasks also locally generate, 16 check bits, through computing the frame check polynomial, and compares the locally generated bits to the check bits embedded within the received MSU. If a discrepancy is detected between these two groups of check bits, then level 2 tasks discard the received MSU through use of a negative or no acknowledgement messages which, in turn, cause the transmitting node to re-transmit the discarded MSU.

    Level 2 of SS7 provides non-compelled, positivenegative acknowledgement with re-transmission error correction. Specifically, once an MSU has been transmitted over a link, a copy of that MSU is retained within a re-transmission buffer associated with that link and situated at a transmitting node until that node receives a positive acknowledgment (in the form of a backward sequence number) that the transmitted MSU has been received by a far end node connected to that link. If however a negative acknowledgement or no acknowledgement message is received within a prescribed time period, then the transmitting node ceases to transmit any new MSUs and re-transmits all MSUs, for which it has not yet received a positive acknowledgement, in the order these MSUs were first transmitted.

    Initial alignment tasks, as described in detail below, are used in initializing a link, i.e. after a "switch-on" condition, or in aligning (synchronizing) a link after it has recovered from a link failure. These tasks utilize a compelled exchange of status information over the link between two nodes on the network during a pre-defined "proving" period.

    Level 2 tasks also detect link failures by monitoring errors, specifically rates of signalling errors and losses of alignment on a link and the length of time during which each loss of alignment occurs.

    Flow control of MSUs transmitted down a link is another function provided by tasks executing within level 2. Specifically, whenever link congestion (periods of heavy traffic) is detected at a receiving node connected to a link, the receiving node notifies the transmitting node connected to that link by an appropriate status code existing within a link status signal unit (LSSU), as discussed in detail below, and then withholds acknowledging all MSUs that have been received but not yet acknowledged. In particular, the LSSU is transmitted by the receiving node down that link to the transmitting node. In response to the receipt of this LSSU the transmitting end does not send any further MSUs to the receiving end over this link. Thereafter, the receiving node periodically notifies the transmitting node of the condition of the link. If this congestion continues too long, then the transmitting node designates this link as having failed and routes traffic to other links accordingly. Alternatively, if the congestion abates, then the receiving node resumes acknowledging received MSUs. Lastly, level 2 tasks also control link recovery.

    Signalling network functions 340, which collectively form SS7 level 3, define tasks (here transport functions and corresponding procedures) that are common to and independent of the operation of individual signalling links. Level 3 exists between dot-dashed lines C and D. Level 3 tasks typically fall into two broad categories: signalling message handling task 350 and signalling network management task 360.

    Specifically, while an MSU is being transferred over the network from an application executing at an originating node, signal message handling task 350, in response to the routing label within that MSU, directs that MSU to an application within SS7 level 4 or higher at a destination node. The delivery of the MSU is made either through a link that directly connects the originating and destination nodes or via one or more intermediate STPs. Signalling message handling task 350 consists of three sub-tasks: message routing task 352, message discrimination task 354 and message distribution task 356. Message routing concerns MSUs that are to be transmitted to other nodes; while message discrimination and distribution concerns MSUs that have been received. If an MSU containing an application message is to be sent from an application executing at level 4 or higher to another node on the network, then message routing task 352 at the originating node utilizes the SLS field within the routing label situated in the MSU to determine an outgoing link on which this MSU should be transmitted onward towards its destination. Message discrimination task 354 is used at a node to determine whether or not a received MSU, based upon its routing label, is destined for this node. If the received message is destined for another node, then task 354 applies that MSU to message routing task 352 for re-transmission to its eventual destination node. Alternatively, if the MSU is destined for the present node at which it has been received, then message discrimination task 354 applies that MSU to message distribution task 356. This latter task separates the application message from the received MSU and directs it to the proper application, here 800 call service, executing at this node such as an SCP.

    Signalling network management task 360, based upon pre-defined data and information regarding the status of the individual links and nodes that form the network, controls current routing of MSUs appearing on the network and also the configuration of the network links and nodes. Should any change occur in the status of the network, such as the failure of a link or node or congestion of a link, then signalling network management task 360 re-configures the network to by-pass the failed or congested link or failed node and thereby preserve communication over the network by sending messages to all nodes, particularly STPs, in the network to change routing tables used by message routing task 352 within each such node. In certain circumstances, this may entail activating and aligning new links that connect two nodes to provide signalling capability between these nodes. When normal operating conditions resume on this link or node, task 360 restores normal MSU transfer capability thereto.

    Specifically, signalling network management task 360 contains three sub-tasks: signalling traffic management 362, signalling route management 364 and signalling link management 366. Signalling traffic management task 362 diverts traffic from a link or route and routes it to one or more different links or routes, respectively, in the event of a link or node failure or slows traffic entering a given link if congestion occurs. This sub-task provides the functions of changeover (diversion of traffic without loss of messages to alternate links), changeback (acceptance of traffic into a recovered link), forced re-routing (used when a signalling route becomes unavailable), controlled re-routing (used to route traffic to a signalling route that has just become available), management inhibiting (manual instruction, by e.g. a craftsperson or technician, to the network to inhibit a link) and signalling traffic flow control. Signalling route management task 364 distributes status information throughout the network in order to block or unblock specific signalling routes. This information includes those routes that are transfer-restricted, transfer-prohibited, transfer-allowed, and transfer-controlled. Signalling link management task 366 restores failed links andor link sets, activates idle though not yet aligned links andor link sets, and deactivates aligned links andor link sets.

    As shown in FIG. 3, the different tasks provided at level 3 interact with each other and with various tasks existing at levels 2 and 4. Various standard testing and maintenance tasks 370 also exist which can be invoked through appropriate level 3 messages to test various aspects of the network.

    Levels 4, user (application) level 390, and above define specific user applications, such as the 800 service, that utilize information provided within the SIF field situated in an MSU. The application levels exist to the left of dot-dashed line D. Hence, levels 1, 2 and 3 collectively define a communication network that here reliably exchanges information, here transactions specifically queries and responses, between the same user application, 800 service, typically situated at different geographic sites. Specifically, levels 1, 2 and 3 define the network which carries queries from originating SSPs at various sites to destination SCPs and each resulting response from the destination SCP back to its corresponding originating SSP. Clearly, by merely changing the routing label, specifically the value of the service information octet within the MSU, this network can be used to exchange information between different user applications executing at one or more sites.

    Two additional types of messages, link status signal units (LSSUs) and fill-in signal units (FISUs), can also be transmitted over a link. LSSUs indicate status of the link and play a role in aligning a link to the network and passing failure messages regarding that link to the network. The organization of an LSSU is shown in Table 4 below.

    TABLE 4______________________________________LINK STATUS SIGNAL UNIT (LSSU) STRUCTURE______________________________________ ##STR4##______________________________________

    where:

    is an 8 or 16 bit status field that contains a code specifying the status of the link.

    Specifically, whenever a node, such as an STP or SCP, is fully operational and therefore ready to be brought into service on the network, a link connecting this node to the remainder of the network must undergo alignment. At this point, each node connected to the link repetitively transmits LSSU messages through the link to the other node connected thereto. In particular, whenever either node is ready to undergo alignment, then this node toggles, once a second, the code in the status field in the LSSU it is repetitively transmitting between a value indicative of "out of alignment" and a value indicative of "out of service". Once both nodes have detected a toggling status code transmitted by the other node, then both nodes begin an alignment procedure. This procedure, which typically lasts approximately 11.8 seconds, involves sending a pre-defined serial alignment bit stream four times over this link from each node to the other node. If this stream is received without any errors by each node, then each node connected to that link undertakes a level 3 application test, i.e. a so-called signal link test. This test is typically issued from an STP to an SCP and at the same time from an SCP to an STP. Specifically, a special pre-defined MSU is sent by, for example, the STP and contains a pre-set message and a routing label for a specific destination, such as the specific SCP. Whenever this SCP receives this message, it must acknowledge receipt. If the routing label is wrong, typically indicative of improper network addresses caused by faulty initialization of an STP or SCP, then no acknowledgement will be sent. In this case, the receiving node will wait for approximately one second for the acknowledgment. If such an acknowledgement is not received during this one second interval, then the receiving node (SCP or STP) will repeat the test. If the second attempt also fails, then this node categorizes this link as being out of service. As a result, the receiving node then repetitively transmits LSSUs onto this link with the status field set to the code for "out of service". As soon as either node connected to this link is ready to attempt alignment, it then transmits LSSUs with toggling status codes and the above process repeats. Alternatively, in the event a proper acknowledgement is received by a node, then this node changes the status of that link to available and then repetitively sends FISU messages, as described below, until MSUs are ready to be transmitted. Now, if the link fails for any reason or a node is not able to attempt alignment, such as for example through an STP failure, a back end processor failure in the SCP or a physical failure of the link itself or congestion on the link, then each node connected to that link transmits LSSU messages with the status field set accordingly to, for example, a code specifying "out of service", "out of alignment", "processor failure" or "signalling link out of service" depending upon the specific failure.

    If no other messages, such as MSUs, are awaiting transmission between two nodes connected by an aligned and available link on the network, then each of these nodes repetitively transmits FISUs over the link to the other node in order to maintain an available aligned connection between these two nodes. Table 5 shows the structure of a FISU. A FISU contains no SS7 level 3 messages. The length indicator LI, is used to differentiate between three different types of messages that can appear on the network: MSUs (the value of the LI bits>"2"), link status signal units (the value of LI bits="1" or "2") and fill-in signal units (the value of LI bits ="0"). Unlike MSUs, both LSSUs and FISUs are not re-transmitted in case of a detected transmission error.

    TABLE 5______________________________________FILL-IN SIGNAL UNIT (FISU) STRUCTURE______________________________________ ##STR5##______________________________________

    Oftentimes signalling traffic becomes quite heavy on a given link with more messages being destined for transmission over that link than the link is able to carry in a given time. When this occurs, the link basically becomes congested with a concomitant increase in transmission times. In these cases, SS7 is notified of a congested condition by a receiving node connected to that link. As long as congestion continues, signalling traffic is diverted from the congested link. Specifically, each MSU is assigned a priority value within the application portion of that MSU. Priority values can take on any integer value between "0" and "3", with "3" being the highest priority and reserved for signalling network management messages--a network message that is carried in lieu of an application message within an MSU. The amount of congestion occurring on that link, i.e. determined by the number of non-acknowledged MSUs contained in a re-transmission buffer for a link at a transmitting node, specifies the level of congestion occurring on that link. In the event, an MSU having a priority lower than the current congestion level occurs, then the transmitting node will send that message over an available link having a lower congestion level than the congested link. If, alternatively, the message has a priority greater than or equal to the congestion level of the congested link, then that message will be transmitted over the congested link.

    Changeover procedures are embedded within SS7 to ensure that signalling traffic that would otherwise be carried over an unavailable link or link set is diverted to other available links within the same or a different link set as quickly as possible while avoiding message loss, message duplication or message mis-sequencing. Once a link has failed, either node connected to that link and which first detects the failure, e.g. an originating STP, a destination SCP or an intermediate STP connected to that link, can invoke a changeover procedure at its associated originating STP to divert traffic away from the failed link. To do so, each node that detects the failure transmits a changeover message. This message is a specific network management message. In general, network management messages (which, as discussed above, are embedded as application messages within an MSU) take the form of:

    TABLE 6______________________________________NETWORK MANAGEMENT MESSAGE STRUCTURE______________________________________ ##STR6##______________________________________

    where:

    Header is a pre-defined 56 bit routing code for a particular STP;

    Functional code specifies a particular network management function that is to be executed within signalling network management task 340; such as among others: changeover (COO) and changeback, emergency changeover, changeover acknowledge (COA), transfer-controlled (TFC), transfer-prohibited (TFP), transfer-allowed (TRA), transfer-restricted (TFR), and management inhibiting;

    Link ID is a four bit code that specifies the particular link which has failed within the link set running from the destination SCP (or intermediate STP) to the STP; and

    the FSN is that associated with the last MSU that has been received by the destination SCP (or intermediate STP) prior to link failure.

    Now, once the changeover message is received and acknowledged to a detecting node through transmission of a changeover acknowledge (COA) message, changeover commences. The changeover procedure involves updating and retrieving messages from transmission and re-transmission buffers on either side of a failed link, then diverting these messages, via other links or STPs, to nodes connected through available links for communication between the originating and destination nodes, and finally preventing any subsequent traffic from being generated for transport over the failed link.

    Specifically, this updating includes identifying, using forward sequence numbers, all messages that have not been acknowledged and are located in the re-transmission buffer associated with the failed link. This is done through well-known handshaking procedures between both nodes connected to the unavailable link. Retrieval consists of transferring these non-acknowledged messages to the re-transmission buffers for the available link and located within a pair of nodes connected thereto. Alternate routes are selected based upon network configuration information and current link status information located within tables associated with signalling route management task 364 within level 3 of SS7. If no alternate routes exist to replace a failed link between two nodes, then signalling network management task 360 executing within the originating node declares the destination node to be inaccessible. In this case, network management messages (e.g. transfer prohibit messages) are sent back through the network to all nodes that can generate messages in order to specify the failed link as being blocked. These messages also instruct the nodes connected on either side of the failed link to discard any messages for the destination node and stored within transmission and re-transmission buffers associated with the failed link. Furthermore, these messages cause a command to be sent to each application (subsystem) executing within every node to prohibit that application from generating any messages for the destination node. In addition, appropriate well-known procedures are executed within signalling link management task 366 to update the current configuration of the network given the location of the failed link andor inaccessible node.

    For a more detailed explanation of SS7, the reader is referred to the following material, which is incorporated by reference herein: Bell Communications Research Specification of Signalling System 7, Technical Reference TR-NPL-000246, Issue 1, Volume 1, 1985 (1985, Bell Communications Research); and M. G. Walker, "Get inside CCITT signalling system No. 7", Telephony, Mar. 10, 1986, pages 72-77. Since this concludes the discussion of the salient features of the SS7 communication protocol as it pertains to the inventive system, the description will now turn to a detailed explanation of the hardware used in the inventive system followed by such a description of the software.

    B. System Hardware

    The hardware that forms the inventive real-time fault tolerant transaction processing system utilizes a CCS network, similar to that existing in the art but which has been modified to implement SS7, and a new architecture for each SCP appearing in this network. With this in mind, the discussion will now describe the signalling network followed by the SCP.

    1. Signalling Network

    The signalling network that is used in the inventive system is based upon and contains the same hierarchy of inter-connected nodes as a signalling network existing in the art, such as for example the network shown in FIG. 1, but with a modification required by SS7. Such a modified signalling network is depicted in simplified form in FIG. 4. As evident from this figure, the modified signalling network utilizes the same hierarchy of an SSP, connected to a CCS network that contains various levels of inter-connected STPs which are, in turn, connected to various SCPs. As discussed above, the existing signalling network shown in FIG. 1 utilizes SS6 in which only one physical link inter-connects any two different nodes. However, to accommodate SS7 and specifically to provide requisite link redundancy required by the SS7 protocol as discussed above, each pair of nodes that can pass signalling traffic therebetween (STPs within the CCS network, and SSPs and SCPs connected thereto) must be connected through a link set that contains more than one and up to sixteen separate physical bi-directional links. Therefore, as shown in FIG. 4, the SSP is Inter-Connected by link sets 37 and 39 to respective originating STPs 52 and 54 within CCS network 50. Within CCS network 50, originating STPs 52 and 54 are themselves inter-connected by link set 63 and are redundantly inter-connected to destination STPs 56 and 58 by link sets 65, 67, 73 and 75. STPs 56 and 58 are themselves inter-connected by link set 69 and are redundantly inter-connected to respective SCPs 500 and 590 by link sets 83, 85, 87 and 89. Each link set carries the same address. As noted above, selection of an appropriate link within a link set to carry an MSU is made by a node that is to transmit that MSU using the signalling link selection code, in the manner set forth above. Each node in the network is identified by one address although several link sets each containing a number of separate physical links are connected to that node.

    The modified signalling network can and usually does, in actuality, contain multiple SSPs, inter-connected by a CCS network having more than four STPs organized in a multi-level hierarchy with originating, intermediate and destination STPs, and where each destination STP is connected to an associated SCP.

    2. SCP Hardware Architecture

    A block diagram of the inventive architecture of an SCP, illustratively SCP 500, is depicted in FIGS. 5A and 5B, for which the correct alignment of the drawing sheets for these figures is shown in FIG. 5.

    The SCP contains a cluster of processors (inter-connected front and back end processors) that appear to the CCS network as a single node. Essentially, SCP 500 consists of from one to eight back end processors that execute queries using commonly available databases and provide responses. Each back end processor is connected to and communicates, via a corresponding front end processor, with the CCS network to receive individual queries and transmit responses. Each query is separately processed by a corresponding back end processor. One of the back end processors, in a manner to be described below in connection with the system software, co-ordinates the operation of all the front and back end processors so that individual front andor back end processors as well as software, including application (subsystem) software, executing thereon can be gracefully brought into and out of service. As a result of this co-ordination, SCP 500 appears as a single node to the CCS network, specifically STPs 56 and 58, even though different messages (e.g. containing different queries) arriving on different links connected to the SCP may, in fact, be processed essentially simultaneously.

    As shown and discussed above, SCP 500 is connected to STPs 56 and 58 by respective link sets 83 and 87. Link set 83 contains multiple links 831, 832, 833, . . . , 83n. Link set 87 contains multiple links 871, 872, 873, . . . , 87n (where "n" ≦8). Within SCP 500, every pair of corresponding links in both link sets is connected to a separate processor within front end processors 510. In this manner, each front end processor services incoming messages on two links. Specifically, front end processors 510 consist of front end processors 5101, 5102, 5103, . . . , 510n, which, are in turn, respectively connected to links 831 and 871, 832 and 872, 833 and 873, . . . , 83n and 87n. The front end processors are all identical. Each front end processor, which will be discussed in greater detail below in conjunction with FIG. 6, contains a MicroVAX-II computer manufactured by Digital Equipment Corporation (which also owns the trademark "MicroVAX-II"). The front end processors execute layers 3 and below of the SS7 protocol including the message transfer part, and a signalling connection control part, which will be described in detail below.

    Each front end processor is, in turn, connected through a well-known ETHERNET link (hereinafter referred to as a "dedicated" ETHERNET link) to a corresponding one of back end processors (ETHERNET is a registered trademark of Xerox Corporation). Each dedicated ETHERNET link is shown using a dot-dashed line in order to distinguish this ETHERNET connection from administrative ETHERNET network 512 and its inter-processor connections, which will be discussed below. Specifically, front end processors 5101, 5102, 5103, . . . , 510n, are connected through ETHERNET links 5161, 5162, 5163, . . . , 516n, on a one-for-one basis to back end processors 1, 2, 3, . . . , n, respectively. All the back end processors are identical with each consisting of a VAX 8600 processor which is also manufactured by Digital Equipment Corporation (which also owns the trademark "VAX"). Each of the dedicated ETHERNET links is controlled by appropriate communications software executing in both the front and back end processors connected to either side of the link. This communications software forms part of the DECnet family of communications products available from Digital Equipment Corporation (which also owns the registered trademark "DECnet"). All the application layers of SS7 are executed within the back end processors.

    To process incoming queries for 800 calls, all back end processors are able to commonly access disk resident databases containing customer records. Specifically, back end processors 1, 2, 3, . . . , n are connected through individual paired busses, specifically high speed dual path computer inter-connect busses 5251, 5252, 5253, . . . , 525n, through star coupler 530, to dual path computer inter-connect busses 5351 and 5352. The computer inter-connect busses are controlled by appropriate communications software executing within the back end processors and disk controllers and available within the DECnet family of communications products. These inter-connect busses, in turn, are connected to disk controllers 540 formed of disk controllers 5401 and 5402 Star coupler 530 is a well-known passive device that can be used to physically inter-connect up to sixteen high speed digital devices consisting of processors and disk controllers. Disk controllers 5401 and 5402 are each preferably model HSC50 available from Digital Equipment Corporation. Each of the controllers, specifically controllers 5401 and 5402, is connected through an appropriate bus, specifically bus 5521 or 5522, to one port of each disk drive 5621, 5622, . . . . , 562m, that forms paralleled disk drivers 562 (where "m" is an integer greater than zero). These disk drives contain data files consisting of databases containing the necessary customer records sufficient to support 800 service as well as the necessary databases to support all other enhanced services, such as calling card, that might rely on remote processing provided by SCP 500. Each of the data files stored on the disks are arranged with multiple copies using a well-known "shadowing" technique to allow simultaneous access to multiple copies of the data and provide real time recovery in case of a failure of a disk drive, a disk itself or a disk controller. Multiple copies of the data files are also stored within each disk to improve access speed and provide increased system reliability.

    All the front and back end processors are connected via separate ETHERNET local area network 512, which is referred to as an "administrative" ETHERNET local area network (LAN). This local area network permits communication to occur between the processors in order to provide synchronization and co-ordination therebetween. Specifically, administrative ETHERNET network 512 is connected to front and back end paired processors 5101 and 1, 5102 and 2, 5103 and 3, . . . , 510n and n, via respective leads 5121, 5122, 5123, . . . , 512n. This network uses the BX.25 protocol and is also controlled by appropriate communications software that forms part of the DECnet family of communications products. This network utilizes token passing. Specifically, a message is placed onto this network by a sending site, for example front end processor 5101. This message is then picked up by an adjacent site on the network, e.g. front end processor 5102. If the message is not for the latter front end processor but instead is destined for a downstream site, then the adjacent site that received the message, here front end processor 5102, will place the message back onto the network for reception at the next adjacent site, i.e. front end processor 5103 and so on. The message repeatedly appears on the network as the message travels from site to site. Whenever the message finally reaches its destination site, the message will not be re-transmitted and hence effectively "pulled" off the network. As will be discussed below, the processors that form the SCP are synchronized and co-ordinated through certain so-called one-and-only one (O-O-O) processes, as described below, that execute on one of the back end processors at any given time. These processes executing on one back end processor, e.g. back end processor 1 , communicate with all the other processes via administrative ETHERNET network 512. The communication generally involves application level commands to other back end processors to gracefully bring up or remove a certain application, such as 800 call processing, at other back end processors or invoke a mate switch operation, as described below, to another SCP. In addition, all the front end processors can also communicate to each other via administrative ETHERNET network 512. These communications, as described below, illustratively involve inquiries (changeover requests) regarding available links in the event of a link failure and accompanying acknowledgements (changeover acknowledgements) and other network management messages.

    In addition, to provide a primary port through which craftspersons andor technicians can locally manage the SCP, administrative ETHERNET network 512 is connected to maintenance and operations sub-system 570. This sub-system, typically a VAXstation IIGPX workstation produced by Digital Equipment Corporation (which also owns the trademark VAXstation II), is a multi-tasking workstation that is used to provide a system operator with simultaneous access to multiple processes executing within the SCP, such as status, configuration and re-configuration processes, performance data and alarm information. The information provided by sub-system 570 is displayed to a system operator. Similarly, the system operator can enter commands into SCP 500 through a well-known keyboard (not shown) that forms part of sub-system 570. Additionally, server 582 is connected to administrative ETHERNET network 512 to provide a simple interface for terminal 584 for communicating with any single task then executing within the SCP, e.g. run a single diagnostic within any processor or update a file and the like. Support system processor 572 is also connected to network 512 and is used to collect and disseminate, upon command, various SCP system statistics from each processor, such as utilization of each front and back end processor, number of failures of each such processor andor each application and the like. Processor 572 is also a MicroVAX-II processor provided by Digital Equipment Corporation.

    FIG. 6 depicts a block diagram of any front end processor, such as processor 5101, situated within SCP 500 shown in FIGS. 5A and 5B. As shown in FIG. 6, the front end processor consists of MicroVAX-II processor 630 that is interfaced to each of two 64 kbit synchronous SS7 links 831 and 871 through a separate communications processor 610 and 620, respectively. Both communications processors are identical. Specifically, each processor is a model LSI-JFEP II general purpose front end processor currently available from MDB Systems, . of Orange, Calif. The communications processors relieve host MicroVAX-II processor 630 of the task of directly interfacing to the synchronous links by providing on transmission of any message well-known framing functions including, for example: flag generation for frame delineation (message delimiting), zero bit insertion (bit stuffing) for data transparency, and computing the frame check polynomial to generate the check bits for each message and insertion of the check bits into each message. Upon reception of any message, each communications processor searches for and strips message delimiting flags; searches for and deletes stuffed zero bits; and checks for framing errors by locally computing the cyclic redundancy code (check bits) for each received message, then comparing the received check bits against locally computed values therefor and finally generating appropriate error messages should a framing error occur. These processors also provide well-known clocking functions. Each of these processors also detects signal loss (SS7 level 1 errors) on its associated link. Furthermore, these processors generate and transmit FISU (fill-in signal units, as discussed above) messages on each link whenever the link is not being used to carry any other messages, such as LSSUs and MSUs.

    Host MicroVAX-II processor 630 is also connected through disk controller 640 to disk drive 650. The disk controller and disk drive are preferably models RDQX2 disk controller and RD52 2 31Mbyte Winchester disk drive, both of which are available from Digital Equipment Corporation. The disk drive is presently used to store diagnostic software. Inasmuch as diagnostic procedures could be downloaded to host processor 630 over administrative ETHERNET network 512 in lieu of being stored locally at each front end processor, this disk drive and its associated controller could be eliminated from the front end processor with attendant cost savings if the diagnostics were to be remotely stored.

    To permit front end processor 5101 to communicate with its associated back end processor 1 and with the other processors within SCP 500 (see FIGS. 5A and 5B), host MicroVAX processor 630 is connected, as shown in FIG. 6, via ETHERNET controllers 660 and 670 and respective ETHERNET transceivers 680 and 690 to dedicated ETHERNET link 5161 and, via lead 5121, to administrative ETHERNET local area network 512. Each ETHERNET controller is a model DEQNA controller available from Digital Equipment Corporation. Each of these controllers implements the data link and physical link protocols specified by the ETHERNET standard (standard 803.2 promulgated by the Institute of Electrical and Electronics Engineers). The ETHERNET transceivers are well-known bi-directional hardware receivertransmitters that provide signal shaping and appropriate amplification.

    C. System Software

    The software used in the inventive system resides in both the front and back end processors. This software co-ordinates the operation of all processors within the SCP and thereby enables the entire SCP to communicate as one entity, even though multi-processing is occurring therein, to an STP. The STP remains totally ignorant of the replicated processing paths residing within the SCP and is only required to send messages and receive responses (transactions) over physical links connected to an SCP.

    FIG. 7 depicts a high level block diagram of several of the software processes (modules) executing within each front endback end processor pair in SCP 500 (see FIGS. 4 and 5) and the principal inter-process communication occurring therein. These processes are event driven. As shown in FIG. 7, processes 700 execute within each front end processor; while processes 760 execute within each back end processor, with the exception of certain processes specifically one-and-only one (O-O-O) processes 798, which as described below execute within execution manager 795 situated within only one of the back end processors. To facilitate understanding, processes 700 and 760 will be described as executing within illustratively a front endback end processor pair consisting of front end processor 5101 and back end processor 1, respectively.

    Specifically, as shown in FIG. 7, processes 700 are organized as a hierarchy. As discussed, an incoming SS7 message, such as a packet containing a query, from the CCS network is first processed through one of SS7 communications handlers 705, specifically SS7 communications handler 7051 or 7052, depending upon which one of two links connected to the front end processor carried the message. Similarly, if a SS7 message, such as a packet containing a query response, is to be transmitted from the front end processor onto the CCS network, then this response will be directed to one of these communications handlers depending upon which one of the two physical SS7 links is to carry this response. Since both communications handlers are identical, then, for the sake of brevity, only communications handler 7051 will be discussed. Moreover, operation of communication handler 7051 will be discussed in the context of message reception. This handler simply operates in a reverse manner for transmission, with exceptions and additional operations being noted.

    SS7 communications handler 7051 consists of communication processor software 710, device driver module (DDM) 715 and data link control (DLC) module 720. Communications processor software 710 represents the software executing within a communications processor, such as communications processor 610 (see FIG. 6). As discussed above, this software searches for and strips message delimiting flags from an incoming SS7 message; searches for and deletes stuffed zero bits from this message; and checks for framing errors by locally computing the cyclic redundancy code (check bits) for each received message, then comparing the received check bits against locally computed values therefor and finally generating appropriate error messages should a framing error occur. Also, appropriate transmission and re-transmission software buffers are provided within communications processor software 710. Each SS7 message that is to be transmitted is first loaded into transmission buffer 713. Then, once the communications processor is able to service this message, this message is transmitted onto the associated link. At the same time, the SS7 message is retained in re-transmission buffer 711 for subsequent re-transmission over that link in the event no or a negative acknowledgement message is received, as discussed above.

    Furthermore, software 710 also detects signal loss (SS7 level 1 errors) on its associated physical SS7 link. In addition, software 710 instructs its communication processor to generate and transmit FISU (fill-in signal units, as discussed above) messages on the link connected to that processor whenever the link is not being used to carry any other messages, such as LSSUs and MSUs to or from that processor.

    The remainder of SS7 communications handler 7051 executes within a host MicroVAX-II processor, such as processor 630 shown in FIG. 6, situated within a front end processor. DDM module 715 merely provides a well-known software driver allowing the host MicroVAX-II processor to communicate with and control the communications processor in the front end. DLC module 720 provides certain SS7 level 2 functions such as sequencing of SS7 messages for transmission and reception, flow control of messages (in response to congestion, as discussed above) and signalling link recovery.

    Once an incoming message has been processed by SS7 communications handler 705, SS7 level 3 front end processing of that message begins. This processing is provided by common transfer function (CTF) module 725, signalling connection control part (SCCP) module 730 and message distribution protocol (MDP) module 740.

    CTF module 725 directs incoming messages (queries) to the proper SS7 high level function via message discrimination, as described above in conjunction with signalling message handling task 350 shown in FIG. 3. This module also directs outgoing messages (query responses) to the proper SS7 communications handler, i.e. either 7051 or 7052, for transmission over the proper physical SS7 link using message distribution and routing, as described above. In addition, CTF module 725 implements signalling network management task 360 (see FIG. 3). This task, as described above, utilizes pre-defined data and current information regarding the status of the individual physical links and nodes that form the network, to control both current routing of MSUs appearing on the network and also the configuration of the network links and nodes. In the event of changes in status of any physical link or node, this module controls re-configuration of the network (links and nodes) in order to preserve, to the extent possible, or restore normal SS7 message transfer capability on the CCS network.

    SCCP module 730, shown in FIG. 7, provides data transport functions between a SS7 communications handler and MDP module 740. Specifically, SSCP module 730 routes incoming messages to the proper application executing at the SCP. The SCCP module maintains a table that provides current status information for each application installed at a corresponding back end processor that executes software 760. Hence, whenever a message is passed to SCCP module 730 by CTF module 725, the SCCP module examines the destination point code stored within a routing label and an accompanying subsystem number (service information octet) both contained within the message to identify the desired application at the current SCP and then, in response, determines whether this message can be processed at this SCP, i.e. SCP 500. If the message can be processed, it is passed onward to MDP module 740 for subsequent transmission to back end processor 1. Alternatively, if the message can not be processed due to current unavailability of the desired application, then the message is si discarded. For 800 call applications, SCCP module 730 supports class 0 connectionless service. The SCCP module also provides subsystems status management functions in order to maintain network performance by throttling outgoing traffic in the event of a failure or congestion in the network.

    MDP module 740 distributes messages through a DECnet connection between front end processor 5101 and back processor 1. This connection is substantially transparent to the applications executing within back end processor 1. Specifically, the MDP module accepts multiple DECnet connections and allocates a different queue for each logical link to be established thereby. The processes provided by MDP 740 and DECnet communications software include establishing a logical link, sending and receiving data over that link, sending interrupt messages, checking status information of a logical link and terminating activity on a link. In addition, to achieve high throughput, MDP module 740 organizes messages into separate groups (blocks) each of which is, in turn, transmitted to the back end processor. In this manner, the back end processor can sequentially process a block of queries and generate a stream of responses without wasting time in processing overhead (framing and the like) associated with a transfer of each individual message. Thus, queries and associated responses follow a path through a SS7 communications handler; then along a path given by arrow 755 through CTF module 725, SCCP module 730 and MDP module 740, and into the transaction capability application part (SS7 application layers) existing in the back end processor.

    Two other modules exist within software 700 that executes within the front end processor: operations management protocol (OMP) module 735 and front-end state manager (FESM) module 745. The OMP module performs administration of the front end processor. Specifically, the module maintains various parameter (site specific) values, such as SCP network address, STP address, mate SCP address, link identification numbers, values for each timer, threshold values and the like, in a table for use in properly configuring the SCP front end processor during its initialization. In addition, OMP module 735 allows a system operator (e.g. craftsperson andor technician) or back end processor 1 to modify parameter values in this table as either desires. Also, the front end processor collects various system measurement statistics and provides these measurements to back end processor 1 for logging via an appropriate protocol, i.e. a state management protocol. These statistics include the number of messages processed by each layer of SS7, the number of errors detected, processor utilization and the like. Inasmuch as OMP module 735 collects data on all message handling tasks executing within the host MicroVAX-II processor (see FIG. 6) located within front-end processor 5101, this data collection, as shown in FIG. 7, is symbolized by dashed lines 738 connecting both SS7 communications handlers 7051 and 7052, CTF module 725, SCCP module 730 and MDP module 740.

    FESM module 745 co-ordinates state changes relevant to physical links or signalling points that affect the entire SCP. This co-ordination is achieved through communications with an execution manager (EM) module executing in back end processor 1 and through communications with all the other front end processors located within the SCP. Front end processor co-ordination, as will be discussed below, deals with message routing among peer front ends and is transparent to all the back end processors within the SCP. Inasmuch as FESM module 745 also controls the state of CTF module 725, SCCP module 730 and MDP module 740, this control is represented by dashed lines 748.

    Through co-ordination among peer front end processors, the SCP is able to talk with "one voice" to an STP even though transaction processing is separately occurring for each link in any given link set connected to the SCP. Co-ordination between all the front ends in an SCP is achieved through a protocol, illustratively named the front end co-ordination protocol (FCP). This protocol permits FESM module 745 to know the status of all the other front end processors in the SCP. Specifically, whenever a state change occurs in a front end that affects its ability to handle traffic, e.g. new front end arrival, front end processor crash and STP state changes, this state change is communicated through a simple message in the FCP protocol by the FESM module in an affected front end processor, such as FESM module 745, to FESM modules in all other front end processors (e.g. FESM modules in front end processors 5102, 5103, . . . , 510n in FIG. 5) and must be acknowledged by all the other front end processors to the initial FESM module, here FESM module 745. In addition, if back end processor 1 that is executing one-and-only one processes 798, as discussed below, issues an instruction to take a subsystem down on the SCP, a corresponding FCP message, as described below, is communicated by FESM module 745 to FESM modules in all the other front end processors within the SCP in order to cause their corresponding back end processors to bring down the subsystem executing therein. FESM module 745 will provide an appropriate message in order to inform the STP of a state change, as discussed below, only after all suitable FCP acknowledgement messages have been received from the other active front end processors within the SCP.

    Front endback end processor co-ordination occurs through a protocol illustratively named the state manager protocol (SMP). This protocol permits commands affecting subsystem status (such as subsystem inout of service requests and responses) and other information, such as notifications and acknowledgements, to be communicated: between front endback end processor pairs, to other back end processors in the SCP, via the FESM module in other front end processors and the administrative ETHERNET local area network, and also between back end processors in primarymate SCPs, as discussed below.

    Front endback end processor co-ordination occurs whenever back end processor 1 issues a SMP command to gracefully bring a subsystem on an SCP into or out of service. Such commands can only originate from the one back end processor within the SCP that is executing one-and-only one processes 798, as described below. To gracefully bring a subsystem up or down on back-end processor 1, the back end processors issue an SMP subsystem allowed or SMP subsystem out of service request to the front end processor through FESM module 745. FESM module 745 passes the allowed or request message, through adjacent STPs (not shown), to a mate SCP which, in response, gracefully switches traffic to or from SCP 500 from or to a mate SCP. This process is repeated for each different subsystem (application executing at each different back end processor) that is executing on SCP up or 500 in order to gracefully bring the entire SCP down.

    The messages passed between front end processor 5101 and accompanying back end processor 1 and among all the front end processors within SCP 500 occur through the dedicated ETHERNET link and the administrative ETHERNET local area network, both of which are controlled by appropriate DECnet software executing in both the front and back end processors. In an effort to simplify the figure, this software has been omitted from FIG. 7 but interfaces to OMP module 735, MDP module 740, and FESM module 745 executing in front end processor 5101, and operations management message handler 770, transaction capability application part module 780 and state manager message handler 790 executing in back end processor 1 as shown.

    Each process that forms front end processes 700 executes as a separate application surrounding a kernel (not shown) consisting of a Portable Communications Executive (CEX) operating system available from Technology Concepts, . This operating system executes within front end processor 5101 and provides: well-known mailboxes for inter-process communication; memory management; creation, deletion and scheduling of processes; alarms and timers; buffer management and other well-known software support routines. Additionally, each process that forms processes 760 executes as a separate application surrounding a kernel (also not shown) consisting of a VAXVMS multi-user, virtual memory operating system, currently available from Digital Equipment Corporation (which also owns the trademark "VMS"), that supports multiple processor operation using shared disk data. The VAXVMS operating system executes within back end processor 1.

    As noted, processes 760, with the exception of only-and-only one processes 798, execute within each back end processor, illustratively back end processor 1. These processes include: operations management message handler (OMMH) module 770, transaction capability applications part (TCAP) module 780, state manager message handler (SMMH) 790, execution manger (EM) 795, event logger module 775, system integrity module 785, and component failure handler 788.

    OMMH module 770 communicates with OMP module 735 located within the front end processor via a DECnet logical link. OMMH module 770 is responsible for downloading of front end software. This module also distributes all back end process requests to the front end and distributes front end notification and alarm responses to appropriate back end processes. Furthermore, module 770 logs all front end measurement data provided by OMP module 735 into appropriate disk files for use by administration software (not shown) executing on the back end processor.

    TCAP module 780 is the interface (SS7 levels 4 and higher) between the SS7 front end processor and the specific transaction oriented application processes for processing queries, such as destination routing number queries for 800 number calls, executing within the back-end processor. TCAP module 780 accepts blocks of messages, delivered via MDP module 740, from the front end processor, de-blocks these messages, validates the messages, and then delivers each message to the application process. Upon completion of application processing, TCAP accepts response messages from the application, blocks the response messages and delivers them to the front end processor via MDP module 740. A message from an originating SSP that does not conform to the SS7 protocol is discarded by TCAP module 780 which sends an appropriate error message to the front end processor for delivery back to that SSP. Similarly, TCAP module 780 will receive reject messages from an originating SSP in response to invalid messages sent by an application through TCAP. TCAP module 780 will also send an error response message to the SSP that indicates the error condition when an application informs TCAP of an error in the received message.

    SMMH module 790 is a message distributor that passes SCP state control information, i.e. when to change the state of a service provided by an SCP, between FESM module 745 executing within a front end processor and EM module 795. This process communicates with FESM module 745 via a DECnet logical link.

    Event logger 775 receives changes in status information, e.g. fault conditions, regarding any module in both the front and back end processes from OMMH module 770 and SMMH module 790, logs the faults and maintains a running count of the faults. The event logger module passes fault information to system integrity module (SIMO) 785. This latter module compares a running total of the fault conditions against a numerical threshold to determine whether corrective recovery action should be taken at any given level of detected faults and what specific action is necessary, such as a process re-start or, for severe faults, local SCP node software re-start. Once SIMO determines that corrective action is necessary and the specific action that should be taken, SIMO 785 instructs component failure handler (CFH) module 788 to initiate this action. Once instructed, CFH module 788 will undertake the necessary corrective action. This action is most frequently a process re-start. For example, a process will be re-created by EM 795 if the process abnormally exits, a data area--if it becomes corrupted--can be subsequently reloaded from a disk file, and a SS7 front end processor software can be down-loaded through its corresponding back end, as noted above, after a crash.

    EM module 795 is primarily responsible for creating and terminating processes on the back end processor. With respect to processes executing within back end processor 1, the functions of the EM module include: startupbootstrap, process coordination, process surveillance, graceful shutdown and individual process creation and deletion. In addition, certain processes, so-called one-and-only one (O-O-O) processes 798 execute within the execution manager of only one of the back end processors. The O-O-O processes maintain a disk based table 793 of resources existing within SCP 500 to monitor current call processing capability of the SCP. These resources include the number of active front end processors, the number of active back end processors, the status (e.g. active or failed) of each process associated with each front or back end processor and the status (e.g. active, inactive, out of service) of each specific application assigned to each back end processor. In the event of a process or processor failure within the SCP, and in response to requests to create or delete processes, execution manager 795 (as well as any other EM that creates or deletes a process) instructs O-O-O processes 798 to update resource table 793 so that the table accurately reflects the new status of the SCP. Once this occurs, the O-O-O processes, performs a resource check by comparing entries in the resource table against pre-defined threshold values, which specify minimum acceptable processing configurations, to determine if sufficient processing capacity exists to support each separate subsystem that should be executing within the SCP. If sufficient resources exist for any subsystem (e.g. accompanying SS7 application software is executing on a sufficient number of back end processors and a requisite number of active front and back end processors exist), then the O-O-O process issues a command, as discussed below, through its associated front end processor, e.g. here processor 5101, to an adjacent STP connected thereto in order to appropriately re-route traffic to a different link to the SCP and thereby avoid the failed processor or process running thereon. Alternatively, if sufficient resources do not currently exist to support a subsystem, then O-O-O processes 798 issue commands through FESM module 745 and its associated front end processor 5101 through an adjacent STP to a mate SCP (SCP 590 in FIG. 4) to institute a changeover procedure. This procedure, if successful and as discussed below, causes the adjacent STP (STP 56 in FIG. 4) to route traffic otherwise destined to SCP 500 for this subsystem, specifically processing of destination routing number queries for 800 number calls, to the mate SCP for processing.

    Now, in the event a back end processor fails, then all the other back end processors are informed of this failure, through a well-known VAXVMS facility (not shown) called "lock manager". Specifically, a lock can only be held by one back end processor at a time. All active back end processors are aware of the location of the locks for all the other back end processors. If a back end processor fails, then the VAXVMS operating system executing on the back end processor that has the O-O-O processes releases the lock for the failed back end processor thereby allowing that lock to travel to another back end processor. At this point with one less back end processor available, the O-O-O processes commence a resource check as described above and initiate a mate switch procedure, if necessary. If the back end processor executing the O-O-O processes fails, then another back end processor obtains control over these processes.

    Upon system power up of SCP 500, each execution manager within each back end processor in the SCP first brings up all processes and SS7 applications executing therein and all processes executing within its corresponding front end processor. Also, an execution manager within a default back end processor, illustratively back end processor 1, is chosen to execute O-O-O processes 798 shown in FIG. 7. This latter execution manager, through the O-O-O processes, then searches the resource table to determine what subsystems should be running within the SCP as a whole and performs a resource check to determine the status of each front end processor and each back end processor and the applications presently executing on each back end processor. If sufficient resources are currently available to support a subsystem within the SCP, then this execution manager, through O-O-O processes 798 executing in back end processor 1, sends an appropriate subsystem allowed message for that subsystem through front end processor 5101 to the adjacent STP to obtain traffic for processing on that subsystem. This is repeated for each subsystem executing on the SCP.

    The hardware that constitutes each SCP front end processor, e.g. processor 5101, (see FIG. 7) and the software executing therein, specifically software 700, have been implemented into fully operational components by Technology Concepts, . of Sudbury, Mass. for use within a CCS network that provides fault tolerant transaction processing of queries for 800 calls and other enhanced calling services. The hardware that constitutes each SCP back end processor and the inter-connected storage and peripheral devices as well as back end software processes 760 have been fully implemented into operational components by Bell Communications Research, ., which is the present assignee.

    D. Inter-Process and Inter-Processor Co-ordination Involving an SCP

    A number of conditions involving an SCP can occur which require various levels of co-ordination between the separate front end processors within the SCP, between the front and back end processors within the SCP andor between different front endback end processor pairs within the SCP and its mate SCP and adjacent STPs to properly and gracefully re-route message traffic flowing therebetween. These conditions illustratively include: detection of a failed link in a SS7 link set, bringing a subsystem executing within an SCP into service (i.e. allowing a subsystem) and invoking a mate (SCP) switch operation to take a subsystem out of service. These conditions will now be discussed in conjunction with FIGS. 8-13. To facilitate understanding, circled numbers are used in these figures to easily designate different co-ordination messages occurring between separate network components (SCPs and STPs), (front end alone, andor front and back end) processors andor processes executing within these processors. Even though the same circled number is used in two or more of these figures, these circled numbers do not refer to identical elements occurring within FIGS. 8-13.

    FIG. 8 diagrammatically shows the communication occurring between SCP 500 and STPs 56 and 58 during the handling of a SS7 link failure. Since no back end processors within an SCP take part in handling a link failure, all of the back end processors as well as other non-involved components of an SCP have been omitted from FIG. 8. Also, since link failures are handled in an identical manner for all links, this discussion will concern a failure of illustrative SS7 link 831.

    Specifically, assume for the moment that SCP front end processor 5101 has detected that physical SS7 link 831 situated within SS7 link set 83 has just failed (circled number one). Also assume that the other link, i.e. link 871 in link set 87, connected to SCP 500 is active. In this case, SCP front end processor 5101 sends a changeover (COO) signal, via administrative ETHERNET local area network 512, to the next front end processor, i.e. front end processor 5102, in SCP 500 (circled number two). This signal requests that the latter front end processor take over the messages otherwise destined for the failed link. Once front end processor 5102 receives the changeover signal, this processor determines whether it is able to handle this traffic. If this processor determines that is has an active link in the same link set as the failed link, then this processor transmits a changeover signal (COO) to STP 56 over link 832 to inform the STP that link 831 has failed (circled number three) and requesting the STP to re-route traffic to link 832 within link set 83. The STP then sends a changeover acknowledgment (COA) signal over link 832 back to front end processor 5102 (circled number four). Once front end processor 5102 receives the changeover acknowledgement signal, it will place a changeover acknowledgement (COA) signal onto administrative ETHERNET local area network 512 (circled number five). This COA signal will be routed, using token passing, as described above, to SCP front end processor 5101. At essentially the same time as items represented by circled numbers 1-5 are sequentially occurring, STP 56 sends a changeover (COO) signal through any active link, e.g. link 83n, in link set 83 (circled number six). The purpose of this is to provide a redundant signal to front end processor 5101 to instruct this processor to sequentially transmit all messages stored within its re-transmission buffer for the failed link onto the other link, i.e. link 871 in link set 87. Once the changeover signal is received by SCP front end processor 510n, this front end processor places the changeover signal onto administrative ETHERNET local area network 512. Now, as soon as front end processor 5101 receives either the changeover (COO) or changeover acknowledgement (COA) signal from administrative ETHERNET local area network 512, front end processor 5101 sequentially transmits all messages it has retained in its re-transmission buffer associated with failed link 831 by moving these messages to the transmission buffer associated with active link 871 and subsequently transmitting these messages (e.g. MSUs) in sequence over this latter link (circled number eight).

    A sequence of inter-process communications, that occurs within SCP front end processors 5101 and 5102 shown in FIG. 8, during the handling of a link failure is diagrammatically shown in FIGS. 9A and 9B, for which the correct alignment of the drawing sheets for these figures is depicted in FIG. 9. Now, once link 831 fails, this failure (circled number one) is detected by SS7 communications handler 7051 which processes SS7 levels 1 and 2 for messages appearing on this link. Within communications handler 7051, a communications processor executing communications processor software 710 sends an asynchronous event signal which reports the link failure to DDM module 715 (circled number two). Thereafter, DDM module 715 sends an asynchronous event message to DLC module 720 to report the link failure and failure type (e.g. link power lost, alignment error or the like) (circled number three). Once this has occurred, DLC module 720 sends an asynchronous event message to CTF module 725 to report the link failure and specify the link identification number and the failure type (circled number four). In response to this message, CTF module 725 creates a changeover (COO) message and sends this messages to FESM module 745 (circled number five). Once the FESM module receives this changeover message, it transmits the message, via DECnet communications software and token passing over administrative ETHERNET local area network 512 here represented by a dashed line, to the FESM module in a next SCP front end processor, here front end processor 5102. Upon receipt of this message, FESM module 845 in front end processor 5102 determines whether this processor has an active link in the same link set as the failed link, i.e. link set 83. In the event, FESM module 845 determines that link 832 in link set 83 is not available, then FESM module 845 instructs the communications software to place the changeover (COO) message back onto administrative ETHERNET network for transmission to the next front end processor. If, however, front end processor 5102 has such an active link, such as link 832, then, as shown, FESM module 845 will not re-transmit the changeover message onto network 512 but instead will send this message to CTF module 825 (circled number seven). Upon receipt of this message, CTF module 825 adds routing information to the message and passes the resulting changeover message on to DLC module 820 (circled number eight). DLC module 820 adds framing information to the message and passes the resulting changeover message to DDM module 815 (circled number nine). DDM module 815 then instructs communications processor software 810 to add appropriate message delimiter flags to this changeover (COO) message (circled number 10) to provide a SS7 message, place the SS7 message in a transmission buffer and finally transmit the resulting SS7 message over link 832 to an adjacent STP (circled number 11).

    FIG. 10 diagrammatically shows a sequence of inter-process communications that occur within SCP front end processor 5101 and back end processor 1 for bringing a subsystem into service on back end processor 1. In order for a subsystem to be brought into service on a back end processor, the execution manger (EM) that executes the one-and-only one processes (here EM module 795) must confirm through a resource check that all hardware components, such as disk drives and front end processors) that are to be used by that subsystem within the SCP are up and running. This execution manager must then determine, also through a resource check, whether each individual software process that is to be used by the subsystem within the SCP is also up and running. If all the hardware and software processes are running, then this execution manager can bring up a subsystem. Now, in the event EM module 795 executing in back end processor 1 decides to bring a subsystem into service to support an application executing within SCP 500, the EM module sends an appropriate subsystem allowed message which identifies a particular subsystem to SMMH module 790 (circled number one). Upon receipt of this message, SMMH module 790 passes the message, via a logical ETHERNET link and appropriate DECnet communications software, to FESM module 745 in front end processor 5101 (circled number two). The FESM module sends this subsystem allowed message to SCCP module 730 (circled number three) and at essentially the same time places the subsystem allowed message onto the administrative ETHERNET network (circled number 3a) for communication to all other front end processors within SCP 500 to invoke the subsystem in all other active back end processors situated within SCP 500. After SCCP module 730 receives the subsystem allowed message, it updates its local subsystem state tables. Thereafter, the SCCP module sends the subsystem allowed message to CTF module 725 (circled number four). Upon receipt of this message, CTF module 725 adds routing information to the message and passes the resulting message to DLC module 720 (circled number five). This latter module adds message sequencing information to the subsystem allowed message and passes the resulting message to DDM module 715 (circled number six). Thereafter, DDM module 715 passes the resulting subsystem allowed message to communications processor software 710 which adds appropriate check bits and message delimiter flags to the message to form a SS7 message (circled number seven) and then transmits this message over physical link 831 to an adjacent STP (circled number eight). Once these operations have been completed, FESM module issues an acknowledgement message to SMMH module 790 within back end processor .sub. 1 (circled number nine). In response to this acknowledgement message, SMMH module 790 passes the acknowledgement message to EM module 795 which invokes the subsystem within back end processor 1 (circled number ten).

    FIG. 11 diagrammatically shows a sequence of communications that occur between primary and mate SCPs and adjacent STPs to effectuate a mate switch operation. A mate switch, when successfully completed, transfers message traffic and accompanying processing of a subsystem (an entire application, such as 800 call processing) from an SCP, referred to as a primary SCP, to another SCP, referred to as a mate SCP. A subsystem executing on an SCP can be brought down in one of two ways: through manual intervention, by e.g. a craftsperson andor technician, using maintenance and operations subsystem 570 (see FIGS. 5A and 5B), or automatically by the SCP itself in the event of a failure occurring therein. Specifically, as discussed above, if a process or processor fails and a subsequent resource check, conducted by the one-and-only one processes executing within an execution manager in a back end processor within the SCP, reveals that insufficient resources are currently available to support a subsystem in the SCP, then that execution manager, through the one-and-only one processes, invokes a mate switch operation for that subsystem. As will be seen below, a mate switch operation can not occur unilaterally at the request of a primary SCP but rather is the result of negotiations conducted between primary SCP 500 and mate SCP 590.

    Since the only back end processor in the primary SCP that communicates with a mate SCP is the back end processor executing the one-and-only one processes, all other back end processors and their associated front end processors in both the primary and mate SCPs have been omitted from FIGS. 11-13 to simplify these figures.

    Specifically, as shown in FIG. 11, if the one-and-only processes executing within an execution manager in back end processor 1 in primary SCP 500 determine that a subsystem executing within the primary SCP is to be brought down, then back end processor 1 first issues a subsystem out of service request (SOR) message to its associated front end processor 5101. This message is passed through front end processor 5101 because back end processor 1 is unable to create SS7 messages (circled number one). This operation is explained in detail below in conjunction with FIG. 12. Communication between front and back end processors is through the state management protocol (SMP). In response to the reception of a SMP SOR message at front end processor 5101, this processor converts the message into a level four SS7 message with a routing code specifying mate SCP 590. Each SCP maintains the address of its mate SCP. Once this SOR message is generated in SS7 format, front end processor 5101 transmits this message over an available link in link set 83 and through STP 56 to mate SCP 590 (circled number two). Upon receipt of this message, mate SCP front end processor 910 converts the SS7 SOR message into an SOR message in the state management protocol and transmits a resulting (SMP) SOR message to mate back end processor 920 (circled number three).

    In response to an SMP SOR message, back end processor 920 undertakes a resource check to determine if mate SCP 590 can provide the necessary subsystem (application) processing requested by primary SCP 500. The mate SCP will grant a service request from the primary SCP only if all the front and back end processors are active in the mate. If insufficient resources exist, then back end processor 920 in mate SCP 590 will simply ignore the received SMP SOR message. If this request is ignored, then after a short finite time has elapsed without a response, back end processor 1 in primary SCP 500 will issue another SOR message to the mate. If this request is ignored again, then back end processor 1 in primary SCP maintains the application in an active state provided at least one front and back end processor pair remains active. As long as one front endback end processor pair is active, then primary SCP 500 continues to process messages though at a degraded rate.

    Alternatively, if the resource check performed in the mate SCP discloses that all processors are active, then back end processor 920 issues a SMP subsystem out of service grant (SOG) message to mate front end processor 910 (circled number four). Upon receipt of this message, the mate front end processor converts the SMP SOG message into a SS7 subsystem out of service grant message and then transmits that SS7 SOG message through an available link in link set 89 through STP 56 to primary SCP 500 (circled number five). Also, the mate front end processor issues a SS7 subsystem allowed (SSA) message to adjacent STP 56 over an available link within link set 83 to instruct this STP to route message traffic otherwise destined for the subsystem being terminated on the primary SCP to the same subsystem running on mate SCP 590 (circled number six). After this has occurred, the mate front end processor furnishes an SMP SOG message to mate back end processor 920 to confirm that a SOG message has been sent to the primary SCP (circled number seven). The SS7 SOG grant message received at the primary SCP is used to terminate the subsystem running at this SCP. In particular, whenever primary front end processor 5101 receives a SS7 SOG message from STP 56, it converts this message into an SMP SOG message and passes the resulting message to primary back end processor 1 (circled number eight). In response to this SMP SOG message, back end processor 1 takes the subsystem out of service. Once this occurs, primary back end processor 1 provides an SMP off message to front end processor 5101. The front end processor distributes this off message to all the other front end processors within primary SCP 500 to cause all the front end processors to refuse traffic for this subsystem and cause all the corresponding back end processors to bring the subsystem down on those latter processors (circled number nine). In response to the off message, front end processor 5101 issues a SS7 subsystem prohibited (SP) message to adjacent STP 56 to instruct this STP not to send any message traffic for the terminated subsystem to primary STP 500 (circled number ten). After this SS7 SP message has been transmitted to STP 56, primary front end processor 5101 issues an appropriate message to primary back end processor 1 (circled number eleven) to notify it that all front end processors in primary SCP 500 are prohibited from accepting traffic for this subsystem from any corresponding back end processor in the primary SCP. Also, in response to receiving a subsystem prohibit message, STP 56 issues an SS7 message to mate front end processor 910 which, in turn, causes the mate front end processor to send a notification (circled number twelve) to mate back end processor 920 that the subsystem is now off in the primary SCP. After these operations have been concluded, STP 56 sends all traffic for the subsystem now terminated on primary SCP 500 over link set 89 to the same subsystem that is now running on mate SCP 590.

    FIG. 12 diagrammatically shows a sequence of inter-process communications that occurs within SCP front end processor 5101 and back end processor 1 situated within primary SCP 500 for generating the SS7 subsystem out of service request (SOR) message in order to invoke a mate switch operation. As noted above, only the one-and-only one processes executing within the execution manager in the primary SCP are able to bring a subsystem down. Therefore, if these processes determine after a resource check that a subsystem executing in primary SCP 500 is to be taken down, then these processes instruct execution manager 795 in back end processor 1 to issue a SMP subsystem out of service request (SOR) message for subsequent communication to mate back end processor 920 (see FIG. 11). Once this SMP SOR message is generated, execution manager 795 routes this message to SMMH module 790 (circled number one). Upon receipt of this message, SMMH module 790 sends this message, via a logical dedicated ETHERNET link to FESM module 745 within primary front end processor 5101 (circled number two). Upon receipt of this SOR message, front end state manager module 745 routes this message to SCCP module 730 (circled number three). This latter module begins the creation of a SS7 SOR message from the SMP SOR message received from the back end processor. In particular, SCCP module 730 accesses the network address of the mate SCP. The SCCP module sends this address embedded within a basic SS7 out of service request message to CTF module 725 (circled number four). This latter module adds an appropriate SS7 routing label into the SS7 message and then sends the resulting message to DLC module 720 (circled number five). This latter module adds SS7 message sequencing information to the message it receives and sends the resulting message to DDM module 715 (circled number six). DDM module 715 adds check bits and delimiter flags to the message and passes the now completed SS7 message to communications processor software (circled number seven) which instructs its associated communications processor to transmit the SS7 SOR message onto illustratively onto link 831 within link set 83 for transport through an adjacent STP to mate SCP 590 (see FIG. 11).

    FIG. 13 diagrammatically shows a sequence of inter-process communications that occurs within SCP front end processor 910 and back end processor 920 situated within mate SCP 590 in response to an incoming SS7 SOR message initially issued by SCP 500 and subsequently routed by STP 56 to mate SCP 590 as part of a mate switch operation. In particular, whenever a SS7 SOR message (circled number one) appears on a link, illustratively link 891, situated within link set 89, connected to mate SCP, this message is first processed by SS7 communications handler 10051 existing within mate SCP 590. Specifically, communications processor software 1010 passes the received SS7 message to DDM module 1015 (circled number two). This module strips the delimiter flags and check bits from the SS7 message and passes the resulting message to DLC module 1020 (circled number three). This module extracts and checks the message sequencing information contained within the incoming message and passes the resulting message to CTF module 1025 (circled number four). Once this occurs, CTF module 1025 removes the routing label contained within the message it receives and, if the routing label points to the mate SCP, then the CTF module passes the message onward to SCCP module 1030 (circled number five). If this message is destined for another SCP, CTF module discards this message. Once SCCP module 1030 receives the message, it determines based upon the routing label whether this SOR message is for a subsystem resident within mate SCP 590. If it is not for such a subsystem, then the message is discarded by SCCP module 1030. Alternatively, if the SOR message is for a subsystem resident on the mate SCP, then SCCP module 1030 passes the SOR message to FESM 1045 (circled number six). FESM module 1045 creates an SMP SOR message and passes the SMP message, via a logical ETHERNET link, to SMMH 1090 in mate back end processor 920 (circled number seven). In response to the arrival of this message, SMMH 1090 passes the message to execution manager 1095 for processing by the one-and-only one processes executing therein (circled number eight).

    As described above, execution manager 1090 upon receipt of a SOR message undertakes a resource check using the one-and-only one processes executing therein to determine if sufficient processing resources are available within the mate SCP to provide the necessary subsystem processing requested by the primary SCP. In the event insufficient resources (i.e. less than all front and corresponding back end processes are active within the mate SCP) exist within mate SCP 590, then execution manager 1095 simply ignores this SOR message. Alternatively, if all the front and corresponding back end processors are active in the mate SCP, then the one-and-only one processes instruct execution manager 1095 to issue an SMP SOG message to SMMH module 1090 (circled number nine). The SMMH module forwards this SMP SOG message over a logical dedicated ETHERNET link to FESM module 1045 within mate front end processor 910 (circled number ten). FESM module 1045, upon receipt of the grant message, passes the message to SCCP module 1030 which begins the creation of a SS7 SOG message from the SMP SOG message received from the back end processor. In particular, SCCP module 1030 accesses the network address of the primary SCP (which is the mate SCP to SCP 590). The SCCP module sends this address embedded within a basic SS7 subsystem out of service grant message to CTF module 1025 (circled number twelve). This latter module adds an appropriate SS7 routing label into the SS7 message and then sends the resulting message to DLC module 1020 located within SS7 communications handler 10051 (circled number thirteen). This latter module adds SS7 message sequencing information to the message it receives and sends the resulting message to DDM module 1015 (circled number fourteen). DDM module 1015 adds check bits and delimiter flags to the message and passes the now completed SS7 message to communications processor software 1010 (circled number fifteen) which instructs its associated communications processor to transmit the SS7 SOG message onto link 891 within link set 89 for transport through an STP 56 to primary SCP 500 (see FIG. 11). Once this has occurred, primary SCP 500 can terminate the subsystem on its back end processors, as described above.

    The inventive system is not limited to being employed in networks using the SS7 communication protocol. In fact, any communication protocol which utilizes multiple individual links within a link set to carry communication between two points in a network and in event of a node or link failure, adaptively re-distributes traffic among the remaining individual links in the set can be used instead of SS7. For example, X.25 is one such protocol that can be configured to support multiple links in a link set. To use another communication protocol, such as X.25, the software described above, would need to be modified in a relatively inexpensive manner readily apparent to those skilled in the art to provide appropriate interfaces and control procedures for each level residing in the desired protocol. Therefore, by connecting a non-fault tolerant front end processor and a non-fault tolerant back end processor to each link appearing in a link set at a processing node, such as an SCP, within a network executing such a protocol and loosely coupling the processors in the manner set forth above, a relatively inexpensive real-time fault tolerant transaction processing system for use on this network can be easily fabricated.

    Furthermore, although the inventive system is shown and described as having one back end processor connected to each front end processor, more than one back end processor could be used with each front end processor. The specific number of back end processors that can be connected to any front end processor is determined by the processing capacity of that front end processor. In essence, the front end processor, which is connected to several back end processors, must be able to receive incoming messages from the network, process each incoming message to obtain the query contained therein and pass these queries to each of these back end processors, and also accept resulting responses from each of these back end processors, generate outgoing network messages containing these responses, and finally transmit these outgoing messages onto the network all at a rate that insures a sufficiently rapid response time for every incoming message. The additional processing load placed on the front end processor significantly increases with each additional inter-connected back end processor. Therefore, to provide a cost effective design using currently available technology, only one back end processor is preferably connected to each front end processor.

    Although a single embodiment which incorporates the teachings of the present invention has been shown and described herein, those skilled in the art can readily devise many other varied embodiments that incorporate these teachings.

    Multi-protocol interface apparatus at a service control point

    MUL I - PROTOCOL INTERFACE APRATUS AT A SERVICE CONTROL POINT

    The present invention pertains generally to electrical communication systems and more particularly to message processing systems and methods in a coinmunications network.

    Below is a list of terms and their definitions as used herein: Automatic Number Identification (AND - The number of the calling station, as used in "Caller ID". Application Data Field (ADF) - A proprietary transactional messaging protocol having a message structure transported over an X.25 network. Each transaction between a switch and an SCP in a call involves a single requestresponse pair.

    Automatic Failover - A process of automatically shifting operations from an online system to an alternate or redundant system after a failure of the first online system.

    Data Access Point (DAP) - A version of a Service Control Point developed by MCI WORLDCOM, . Fiber Distributed Data Interface (FDDI) - A high-speed networking standard. The underlying medium is fiber optics, and the topology is a dual - attached, counter- rotating Token Ring. The FDDI protocol has also been adapted to run over traditional copper wires.

    Intelligent Network Application Protocol (INAP) A conversational protocol that specifies the information to be exchanged between the different entities of an

    Intelligent Network functional model in terms of PDUs . The PDUs themselves represent remote operations in the scope of the TCAP . Versions of INAP include ANSI INAP (North America) , ETSI INAP (Europe) , and various proprietary versions, generically labeled "INAP+". Intelligent Network (IN) - Λ category of telecommunications network that supports collect calls, 1-800 numbers, Virtual Private Networks, digital cellphone systems, and other services, and is based on Signaling System 7 to transfer information.

    International Consultative Committee for Telegraphy and Telephony (CCITT) - A unit of the

    International Telecommunications Union (ITU) of the United Nations having representatives from the telecommunications companies of the world. The CCITT produces technical standards, known as "Recommendations", for all internationally controlled aspects of analog and digital communications.

    Message Transfer Part (MTP) - Levels 1-3 of the SS7 protocol containing the necessary mechanisms for enduring reliable functional signal message transmission and corresponding to the first three layers of the OSI reference model.

    NOP Service - A service providing special area codes, such as toll-free 1-800 services.

    Open Systems Interconnection (OSI) - The seven - layer, modular protocol stack defined by the

    International Standards Organization (ISO) for data communications between computers. Its layers are: Physical, Data Link, Network, Transport, Session Presentation, and Application. Protocol Data Unit (PDU) - A message of a given protocol comprising payload and protocol - specif ic control information, typically contained in a message header. PDUs pass over the protocol interfaces that exist between the layers of protocols (per the OSI model) .

    Signaling Connection Control Part (SCCP) - An SS7 protocol layer that connects sophisticated management and OSI network service compatibility.

    Signaling System 7 (SS7) - A family of signaling protocols originating from narrowband telephony and used to set-up, manage, share, and terminate connections as well as to exchange non-connection- associated information on a telecommunications network. The SS7 technology is a common channel signaling system based on CCITT. Q.700.

    Sub -System Number (SSN) - A value identifying an application executing on a specific Communications Server.

    Supp Codes - Supplemental digits provided to the system, typically by the user or the user's local network system (e.g., billing numbers or user ID numbers) . Transaction Capability Application Part (TCAP)

    A connectionless SS7 protocol for the exchange of information outside the context of a call or connection.

    Virtual Private Network (VPN) Service - A private intercorporation or intraorganization telephone network service, such as implemented by MCI Corporation's VNET™ .

    X.25 - A packet switched data service having channels up to 64kbs and being based on the three lower levels of the OSI model. Telecommunications network carrier use computing platforms, known generally as Service Control Points (SCPs), for real-time call processing of many services (such as a 1-800 service). An SCP is generally a computer and database platform coupled to a communications network switch for performing real-time processing of various telecommunications services by executing service logic programs to provide customer services. The SCP platforms are distinct from, and typically remote from, telecommunications network switches. A version of an SCP is referred to as a Data Access Point (DAP) . Figure 1A illustrates a telecommunications network. When a call requiring a service, such as a 1 - 800 service, is initiated by a user at an originating telephone 150, a request message is received by the central office 154 via local telephone network 152. Systems at central office 154 determine, by searching a database, which long distance carrier, such as MCI WORLDCOM, ., must service the 1-800 number. The systems at central office 154 then route the request message via public switched network 158 to switch 156, which belongs to the long distance carrier. The request message is then forwarded on the service network 160 to SCP 164 from switch 156 to perform the requested service. In this example, a Service Application running on SCP 164 determines the destination for the 1-800 call, and then responds to switch 156, indicating that the call may be connected with receiving telephone 170.

    Switch 156 then sends a request message via SS7 network 172 to switch 162 to initiate the call with receiving telephone 170. The switch sends the request to central office 166 via public switched network 158. Central office 166 then routes the call to receiving telephone 170 via local telephone network 168. Additional request and responses messages may be communicated during the call, between the two telephones, between the two switches, and between one of the switches and the service control point, depending on the type of service required by the call and by the communications protocols supported by the system. Figure 1 illustrates an overview of a portion of . a telecommunications system and is generally not limited to a specific configuration or protocol . Figure IB illustrates an exemplary SCP architecture. Each of a plurality of switches 100 in telecommunications network 101 have a dual data link 112 to each of three SCPs 102, 104, and 106 coupled by, for example, an FDDI ring. Each data link from a switch (e.g., 118) connects to two redundant Communications Servers 108 and 110 within SCP 102. On the back end, each Communications Server (e.g., 110) interfaces with a number of Transaction Servers 114 coupled by, for example, an FDDI ring 116. Transaction servers are grouped by services including, for example, Virtual Private Networks (VPN), N00, and Calling Card (CC) services. A single service such as N00 may actually be performed by multiple individual Service Applications. Communications Server 110 receives the request message, processes the communications protocol of the request message, and forwards it to a selected Transaction Server, such as 120. A Service Application executing on the Transaction Server processes the request and returns a response, which the Communications Server sends back to the switch. In a transactional messaging protocol, like ADF, the requested service completes with a single requestresponse pair. In a conversational messaging protocol, like INAP, a service typically requires a dialog of requestresponse messages to fully complete the requested service.

    Service Applications are software programs that execute on a Transaction Server to process calls and messages for a particular service. Typically, a Transaction Server supports more than one service, and therefore, typically executes multiple specific Service Applications. For example, in a preferred embodiment, there are multiple redundant Transaction Servers for each service at a single SCP. In addition, there are multiple SCPs redundantly supporting every service at each SCP site. Accordingly, there are commonly nine Transaction Servers for each service at each SCP site. Furthermore, in an embodiment of the present invention, there are three SCP sites in a communications network. The Transaction Servers at each SCP are evenly load balanced: a switch evenly distributes its service request messages among the three redundant SCPs, and at each SCP, a Communications Server evenly distributes service request messages for a certain service among the three redundant Transaction Servers for that service.

    For communications between switches and SCPs, a transactional messaging protocol referred to as Application Data Field (ADF) messaging may be used.

    Application Data Field messaging includes a transactional message structure that is transported over an X.25 network employing a single requestresponse message exchange process for a single service call in which a switch sends a request message to the SCP, and the SCP returns a response message to the switch. This single exchange of messages typically completes the processing for a single- service call, although some types of ADF calls might require multiple services and, therefore, multiple requestresponse exchanges.

    When originating switch 118 receives an ADF call that requires SCP processing, it sends a service request message to SCP 102. Communications Server 110 at SCP 102 receives the service request message, determines which service is needed, and forwards the message to an appropriate Transaction Server 120. Communications Server 110 determines the appropriate Transaction Server based on services supported by each Transaction Server and the relative loading of each Transaction Server. A Service Application on selected Transaction Server 120 processes the service requested message, and generates a service response message. The service response message is returned to the same Communications Server 110, which then forwards the service response message to the same switch 118. This procedure is an exemplary process for standard calls. Thereafter, although multiple redundant Transaction Servers may be available for a particular service, a single Transaction Server is typically used to completely process the individual call .

    Accordingly, the context data of an individual call is maintained by the switch or by the single Transaction Server, as shown by Figure 2, throughout call processing, where the entire call is processed by Transaction Server A. For ADF transactions, call context is typically managed by a switch or originating station and passed to all system components in single requestresponse transactions. In Figure 2, the switch sends a service request message to the Communications Server which performs some protocol processing and passes the service request to the appropriate Transaction Server (in this example, Transaction Server A) . After completing the requested service, Transaction Server A returns a service response message to the Communications Server, which repackages the service response for communication to the switch. All necessary context data flows along with the service requestresponse message. This cycle typically completes a call, although, for example, multi - service calls may require multiple transactions to access multiple services.

    Another messaging protocol is an SS7 messaging protocol known as Intelligent Network Application Part (INAP) . The INAP protocol occupies a top layer of an SS7 protocol stack, riding on what is referred to as the Transaction Capability Application Part (TCAP) message. Unlike ADF, INAP is a conversational protocol in which several messages are exchanged between the switch and the SCP in processing a singe call. Each message may be considered a stage in the processing of a multiple stage call dialog.

    In the current communications business environment, many alliances are formed in which the network of one carrier must be integrated with the network of another carrier. Often this need requires one carrier's SCP to interface with more than one network, typically involving support for more than one protocol for switch interfacing. For example, an SCP interface to switches using ADF may also be required to interface with switches using various versions of INAP. Furthermore, this need may also extend to additional protocols not discussed herein. Conversational messaging protocols such as INAP involve several messages exchanged between the switch and SCP in processing an individual call. In one approach, just as an individual call is processed by a single Transaction Server A in an ADF message exchange, a

    Communications Server supporting an INAP message exchange preferably ensures the same Transaction Server is used to complete the entire message exchange. This approach compromises the load balancing and automatic failover features provided by a multiple Transaction Server architecture. For example, if a Transaction Server, fails during the processing of a call, another Transaction Server cannot take over processing because the current context of that call is lost when the first Transaction Server fails. As a result, need exists for a system and method of processing conversational message exchanges using multiple Transaction Servers. Likewise, a need exists for a system and method for supporting multiple protocols, both single requestresponse and conversational protocols, at a single SCP and among multiple load balanced Transaction Servers, potentially located at different SCPs.

    Systems in accordance with the present invention process calls according to a conversational protocol in a service control point. Individual stages of a call defined by a conversational protocol may be processed by different service applications within the originating service control point or at a remote service control point coupled thereto by a communications network. When a call requires processing of multiple services, a first stage of the call processing a first service may be transferred to a second stage of the call processing a second service without requiring communication with a switch between the processing of each service. Such transfer may be accomplished within a single service control point or among multiple service control points coupled by a communications network.

    Additional objects, advantages, and novel features of the invention will be set forth in part in the description which follows and in part will become apparent to those skilled in the art upon examination of the following or may be learned by practice of the invention. The objects and advantages of the invention may be realized and attained by means of the instrumentalities and combinations particularly pointed out in the appended claims. To achieve the foregoing and other objects, in accordance with the purpose of the present invention, as embodied and broadly described herein, the system for processing a call received from a switch, wherein the call has a first service request message that includes a dialog identifier and defines a first stage of the call, includes a switch interface coupled to receive the first service request message from the switch; a storage device coupled to the switch interface; a call context data record being storable in the storage device with reference to the dialog identifier; and a first service application coupled to receive the first service request message and the call context data record from the switch interface and to process the first stage of the call based on the first service request message and the call context data record.

    The present invention may also comprise, in accordance with its objects and purposes, a method for processing in a service control point a request message having a dialog identifier and a service key, including the acts of storing at least one call context data record in the service control point; receiving the request message in the service control point; selecting one of the at least one call context data records based on the dialog identifier of the request message; selecting a service application based on the service key, the service application having a processing sequence including multiple stages; sending the request message and the selected call context data record to the selected service application; processing the request message beginning at a proper processing point in the selected service application determined based on the request message and the selected call context data record; modifying the selected call context data record responsive to the processing of the request message; and storing the selected call context data record at the service control point, responsive to the modifying step. The systems and methods in accordance with the present invention overcome the disadvantages and limitations identified in related art. A single SCP can support a conversational protocol while using different Transaction Servers and Service Applications to process different stages of the call dialog, thereby preserving the capabilities of load balancing and automatic failover. In part, this capability is accomplished by storing the context of each call on a Communications Server relative to each stage of a conversational protocol dialog. In this manner, at each stage in a call dialog, the Communications Server can forward a request message and the call context to any available Transaction Server that supports the requested service, regardless of whether that Transaction Server was involved in a previous stage in the dialog or whether the Transaction Server is even located on the same SCP. Moreover, these capabilities are achieved substantially independent of the switch (i.e., no enhanced intelligence is required in the switch) .

    In addition, SCPs are coupled by a communications network, such as a WAN, to allow other SCPs to process a request message initiated at an original SCP, thereby enhancing load balancing and , automatic failover capabilities, and providing capabilities to support a specialized SCP configuration. In accordance with the present invention, SCPs can also redirect a multiple- service call from a switch between appropriate service applications without requiring communication with the switch between services.

    Figure 1A depicts an overview of a telecommunications network including a Service Control Point.

    Figure IB depicts an overview of an SCP including Communications Servers and Transaction Servers.

    Figure 2 depicts message flow employing a transactional protocol, such as ADF. Figure 3 depicts a general purpose computer in accordance with the present invention.

    Figure 4 depicts message flow employing a conversational protocol.

    Figure 5A depicts an SCP employing call context data and generic requestresponse messages.

    Figure 5B depicts an SCP supporting both a conversational protocol and a transactional protocol employing call context data and generic requestresponse messages .

    Figure 5C depicts an example of a Call Context Record (CCR) data structure. Figure 6A depicts multiple SCPs coupled by a

    WAN.

    Figure 6B depicts message flow for a multiservice call performed by multiple SCPs.

    Figures 7A, 7B and 7C depict a flow chart for processing a call employing a conversational protocol.

    Figures 8A, 8B and 8C depict a flow chart , for processing a multiple- service call in a single SCP.

    Figures 9A, 9B, 9C and 9D depict a flow chart for processing a multiple- service call employing a conversational protocol and multiple SCPs.

    One operating element useful in accordance with the present invention is the general purpose computer. In such a system, data and program files may be input to the computer, which reads the files and executes the programs therein. Some of the elements of a general purpose computer are shown in Figure 3 , wherein a processor 301 is shown having an inputoutput (IO) section 302, a Central Processing Unit (CPU) 303, and a memory section 304. The IO section 302 is connected to keyboard

    305, display unit 306, disk storage 309, and disk drive unit 307. Generally, in contemporary systems, the disk drive unit 307 is a CD-ROM driver unit capable of reading a CD-ROM medium 308, which typically contains programs 310 and data. Computer program products containing mechanisms to effectuate the system and methods in accordance with the present invention may reside in the memory section 304, on a disk storage unit 309, or on the CD-ROM medium 308 of such a system. Alternately, disk drive unit 307 may be replaced by a floppy drive unit, a tape drive unit, or other storage medium drive unit. Examples of such systems include Digital Equipment

    Corporation (DEC) ALPHA™ systems running OpenVMS, SRC systems offered by Sun Microsystems, ., personal computers offered by IBM Corporation and by other manufacturers of IBM- compatible personal computers, and other systems running the UNIX-based operating system. In accordance with the present invention, procedural components of a program product may be executed by CPU 303, and the program product and associated data may be stored on disk storage unit 309, disk drive unit 307 or other storage medium drive unit coupled to such system.

    A Communications Server is generally a general purpose computer executing specialized software to provide functions such as protocol conversion, allocation of service requests to selected Transaction Servers, and receipt of service responses. Special purpose computers may also be designed to perform the functions of a Communications Server. A Communications Server provides a switch interface between a service application and a communications switch. Generally a switch interface manages communications, directly or indirectly, between a switch and a service application, in part, by providing protocol processing for an SCP. A Transaction Server is generally a general purpose computer that executes specialized service applications for providing call services to a communications network. In an embodiment of the present invention, these servers are Digital Equipment Corporation systems having ALPHA processors running OpenVMS , although other general purpose systems are also available in accordance with the present invention. A Transaction Server may also be combined with a Communications Server in a switch interface. Furthermore, in an embodiment in accordance with the present invention, Transaction Servers are clustered for reliability and automatic failover using DECNet routing from DEC over an FDDI ring that couples the Communications Servers and Transaction Servers at a particular SCP.

    Call processing involving a single service requestservice response message exchange inherently occurs on a single Transaction Server, as illustrated in Figure 2. In contrast, call processing involving a conversation protocol comprises a dialog of requestsresponses, and it is preferable to distribute individual requestsresponse pairs among multiple Transaction Servers to support load balancing and automatic failover features. Figure 4 shows an INAP dialog between a switch and an SCP, comprising Communications Server A and multiple Transaction Servers. As shown, Communications Server A receives service request 1 (e.g., "PROVIDE INSTRUCTIONS") and sends the request to Transaction Server A. Formats and codes for the INAP protocol are defined in Ericsson's Protocol for Intelligent Networks, Version 2 (Formats & Codes), 2155 17-CRT 249 01 Rev. B. Portions of a service requestresponse may be stripped away or supplemented as the message is passed among Communications Servers, Transaction Servers, Service

    Applications, and switches. Furthermore, Communications Server A selects the appropriate Transaction Server to receive the request message based on Transaction Server availability and a Service Key included in the service request. Accordingly, the Communications Server distributes the service request only to an available Transaction Server that supports the service indicated by the Service Key. Transaction Server A returns service response 1 (e.g, "MONITOR") and call context to Communications Server A. Service response 1 is then communicated to the switch. In the next stage of the dialog, the switch sends service request 2 (e.g., "EVENT") to Communications Server A which, in this example, transfers the request and call context to Transaction Server B. The optional redirection to Transaction Server B might result for several reasons, including a server failure or excessive loading at Transaction Server A. Transaction Server B performs the requested function and returns service response 2 (e.g., "ACTIVE RESOURCE") response and call context to Communications Server A which then transmits service response 2 to the switch. By distributing the individual messages of the conversational dialog among multiple Transaction Servers, a system in accordance with the present invention can distribute individual INAP messages to the least loaded Transaction Server coupled to the Communications Server to perform load balancing. Alternately, the Communications Server can resend a request to a second Transaction Server if a first Transaction Server fails while processing the request (automatic failover) . Figure 5A illustrates an SCP architecture supporting INAP messaging in accordance with the present invention. The SCP 500 comprises Communications Server 502 and Transaction Server 504. As previously described, telecommunications switch 506 is connected to telecommunications network 507 and is typically coupled to multiple Communications Servers, each of which is preferably coupled to multiple Transaction Servers. Communications Server 502 is equipped with an SS7 Interface 508, which receives TCAPSS7 message 509 from switch 506 and processes the SCCP and MTP parts of message 509. The SS7 Interface 508 also passes the TCAP portion 511 of the message to TCAP Server 510 (an example of a protocol server) , which extracts the INAP portion 513 of the TCAP message and passes it to Transaction Server (TS) Interface 512. A typical TCAP definition includes a Dialog Identifier (Dialog ID) , which maintains a multi -message exchange dialog between two components (switch and Communications Server); a sub-system number (SSN) , which identifies a specific Communications Server application in a network; and a Service Key. The SSN, in conjunction with the Dialog ID, insures that a switch sends each TCAP message for a single call dialog to the same Communications Server at the same SCP. The Service Key identifies the requested service to be invoked.

    To initiate a call dialog, switch 506 sends an initial service request message to Communications Server 502, which in INAP is a "PROVIDE INSTRUCTIONS" message. The INAP protocol supports multiple requests, which are fully described in INAP specification documents available from the International Telecommunication Union (ITU), Place des Nations, CH-1211 Geneva 20, Switzerland (Web site: (.itu.int.) . An operation represents an INAP message type (e.g., PROVIDE INSTRUCTIONS, EVENT, etc.), in which the receiving process performs a specific operation in a stage of the call dialog, in accordance with the message type.

    When TCAP Server 510 extracts INAP message 513, it parses a Service Key 515, which is used by TS Interface 512 (TS Interface) to locate an available

    Transaction Server (in Transaction Server List 514 (TS List)) to process the service request message. The TCAP Server 510 passes the extracted INAP message to the Transaction Server Interface 512, which accesses TS List 514 with Service Key 515. The TS List 514 stores a list of Transaction Servers associated with a list of Service Keys 517. The TS Interface 512 references TS List 514 with the Service Key 515 from the current service request to select a specific Transaction Server to receive the current service request message. The TS Interface 512 used a round- robin algorithm to balance and distribute all inbound messages among the multiple Transaction Servers coupled to Communications Server 502 that support the requested service. Communications Server 502 maintains call context data for certain calls that are being processed. A "call" is generally an association between two or more users or between a user and a network entity that is established by the use of network capabilities. This association may have zero or more connections and one or more stages (i.e., a call may comprise multiple stages) . Generally, the "context" of a call is data identifying the relevant connections and the current phase or stage of such connections andor other state information for the call.

    Generally, a "call context data record" refers to a data structure containing call context data. In one form, a call context data record is stored and communicated as a generic call context data structure processed on a Transaction Server (see an example in Table 1) . Fields other than those shown in Table 1 may also be added to a generic call context data structure to assist in processing service. A generic call context data structure is preferably a C- language data structure that uses pointers to minimize the aggregate amount of data passed between modules in a Transaction Server. If a field is unused, a convention indicates that the field is unused (e.g., a null pointer indicates "unused field") . The generic call context data structure includes a pointer to a corresponding generic request message structure, a pointer to a corresponding generic response message structure, pointers to service- specific data including a VPN context data, a N00 context data, and a common service context area, other service- specific data, such as the current processing state of the corresponding service application, and a transfer record pointer, which, if non-null, points to a transfer record data structure (see an example in Table 2) having information required to transfer processing to a second Service Application before sending a response message to the switch. Fields other than those shown in Table 2 may also be added to a transfer record to assist in processing the service transfer.

    Table 1 - Examples of fields stored in a Generic Call Context Data Structure

    Table 2 - Examples of fields stored in a Transfer

    Record data structure

    In a second form, a call context data record is stored and communicated as a Call Context Record (CCR) that is periodically stored in memory buffer 516 on Communications Server 502 after the CCR is initiated by a Transaction Server (see the example in Figure 5C) . The TS Interface 512 selects an appropriate CCR from memory buffer 516 based on Dialog ID 523 when a request is received from a switch. The TS Interface 512 also writes a CCR to memory buffer 516 based on Dialog ID 523 when a response is received from a Transaction Server. The CCRs are stored in memory buffer 516 in accordance with a list of Dialog IDs 519, also stored in memory buffer 516.

    A CCR is preferably a C- language data structure which, in contrast to a C- language data structure having multiple fields of different data types and data elements, typically defines a contiguous block of memory having a specified length, although other data storage structures (such as a linked-list) are also possible. Although C- language is used in an embodiment of the present invention, other programming languages may be used within the scope of this invention, including assembly language and C++. The CCR is initiated by a Transaction Server in response to generic call context data generated by a Service Application. The Formatter module 522 maps the generic call context data structure, and all data structures directly or indirectly referenced by the generic call context data structure, into the CCR. Once created, the CCR is communicated between the Transaction Server and the Communications Server, as needed, for the duration of the call. During the call, the Service Application may supplement, replace, or eliminate data in the generic call context data structure, which is periodically loaded into the CCR for transmission to a Communications Server, to maintain an accurate context snapshot.

    The CCR comprises a block of memory containing one or more variable- length records in a taglengthdata format. Each tag represents a specific data record. While many possible records may be defined to encompass all possible context data for all possible message and dialog types, only data records that are populated with data are included in the CCR, thereby minimizing the size of the CCR and minimizing the network bandwidth used when communicating the CCR between a Communications Server and a Transaction Server. For example, in Figure 5C, TAG1 field 585 refers to a generic call context data structure having a length specified by LENGTHl field 587. The TAG1 -specified data structure 589 follows and is the memory image of the generic call context data structure. The TAG2 field 591 refers to a protocol - formatted request message that is references by a pointer in the generic call context data structure (see, for example, Table 1) having a length specified by LENGTH2 field 593. The TAG2 -specified data structure 595 follows and is the memory image of the protocol - formatted request message referenced in the context data. Notice that, in this example, there is no record for an unformatted response message, which would be the case when a CCR is being initially transferred to a Transaction Server because no response message has been generated by the Transaction at this point in the request loop, thereby minimizing the bandwidth required to transmit this CCR to a Transaction Server.

    Each memory image includes component data fields supported in the corresponding data structures. Examples of typical call context data fields include ANIs, Country Codes, Carrier Identification Codes (CICs) , various types of Supp Codes, destination addresses, various types of service or feature indicators, event type indicators, and so on.

    The TS Interface 512 sends an INAP message and the CCR to the selected Transaction Server 504 on communication link 521. At Transaction Server 504, a

    Parser Module 518 converts the INAP message to a generic request message and converts the CCR data into a generic call context data structure. A generic request message is a defined data structure that supports all messaging protocols supported by the SCP. In an embodiment of the current invention, the data structure is defined in C language. While C is the programming language used in an embodiment of the Transaction Server, other languages could also be used in accordance with the present invention. Parser 518 maps the field of the INAP message into the data structure of the generic request message. Parser 518 also maps the data in the CCR 516 to a generic call context data structure representing call context data. Accordingly, a generic call context data structure can store a call context data record mapped from a CCR. The generic call context data structure holds a pointer to the corresponding generic request and response messages. The generic call context data structure (including a pointer to the generic request message) is then sent via communications link 525 to the Service Application for processing.

    A distinct Parser type is used for each switch protocol (e.g., INAP, INAP+, and ADF). Each Parser type converts messages to the same generic request message structure allowing a single Service Application, which receives and processes the generic request messages, to be used for every switch protocol supported. Preferably, a Parser is statically or dynamically linked to each

    Service Application from a reusable library that includes a Parser type for each switch protocol. A Parser also maps CCR data into a generic call context data structure. A generic message is preferably a C- language data structure including a message type field indicating the type of message (e.g., INAP "PROVIDE INSTRUCTIONS", INAP "EVENT"), ADF-specific fields, TCAP- specific fields, INAP- specific fields, a calling number field, a called number field, an authorization code field, a billing number field, a destination address field (indicating a translated internal designation of the called number) , and an original switching trunk field. A generic response message is preferably a C- language data structure including a message type field, ADF-specific fields, TCAP- specific fields, INAP- specific fields, INAP+ fields, an action code (indicating routing and error information) , a dialing plan information field (populated by data extracted from a database coupled to a Service Application) , a partition number and other routing fields, and a destination address field. Although C- language is used in an embodiment of the present invention, other programming languages may be used within the scope of this invention, including assembly language and C++.

    Service Application uses the INAP message type (which has been mapped to an attribute of the generic message) and the generic call context data structure to determine the proper processing of the call. For example, if the INAP message type is "PROVIDE INSTRUCTIONS", Service Application will begin processing at the starting point of the application. Other message types (e.g., EVENT) cause Service

    Application to begin processing at some mid-point in the application. Furthermore, refinement of a processing point can be determined and verified using call context data. For example, an EVENT message from a switch may provide digits for a Supp Code collected from a caller.

    Since there may be several types of Supp Codes needed for a call, the call context data is used to determine which Supp Code has been collected and at which point in the Service Application processing is to continue. Service Application has an Event module, which is preferably a CASE statement module in a C- language program, to process an EVENT message. The EVENT messages are typically received after a message dialog is initiated with an SCP. Other control flow constructs may be used to effect equivalent functionality using C- language or other programming languages. There are, however, different types of EVENT messages, including those associated with the return of Supp Codes and the response to a busy signal when the call can be redirected to an alternate destination (such as a secretary's phone) . The Event module determines which type of EVENT message has been received and, consequently, where in the Service Application to continue processing. For example, a particular Event may result from the collection of a calling card number (an example of a Supp Code) . The EVENT module determines the nature or type (i.e., calling card collection event) of the event and forwards the calling card number to the calling card portion of the Service Application indicating that processing should continue from the processing point at which the calling card number is to be received as input. Once the EVENT type has been determined, the program code associated with that EVENT evaluates the call context to determine whether the detected event corresponds with the current call context. If the EVENT type and the current call context correspond, processing continues from that processing point in the Service Application using data provided by the EVENT message and data in the generic call context data structure. If there is no such correspondence, the Service Application performs appropriate error recovery.

    Service Application processes the generic request message and returns a generic response message. During execution of Service Application , call context data in the generic call context data structure may be updated by the Service Application with a generic response message and new call context data. The generic call context data structure (now including a generic response message) is provided then sent via communications link 527 to Formatter 522. If the generic call context data structure includes call context data provided by Service Application , Formatter 522 creates or obtains memory for a CCR if a CCR for this call has not already been obtained. A distinct Formatter type is used for each switch protocol (e.g., INAP, INAP+, ADF) . Each Formatter type converts the generic response message to a protocol message of the appropriate type, in a manner similar (only reversed) to the field mapping performed by Parser 518. Preferably, a Formatter is statistically or dynamically linked to each Service Application from a reasonable library that includes a

    Formatter type for each switch protocol. Formatter 522 also loads the generic call context data structure into the CCR. Formatter 522 then sends the INAP response message and the CCR via communications link 529 to TS Interface 512 on Communications Server 502. The CCR is stored in memory buffer 516 on Communications Server 502 for the next message exchange, until the entire call dialog is completed. When the call is complete, the CCR structure is made available for use in another call dialog.

    To complete the process, TS Interface 512 sends the INAP message 513 (the service response message) to TCAP Server 510, which encapsulates the INAP message into a TCAP message 511. The TCAP message 511 is sent to switch 506 via SS7 Interface 508, which also controls the MTP and SCCP portions of the SS7 messaging.

    Also shown in Figure 5A is network interface 524 on Communications Server 502. A Communications Server may be connected to other Communications Server 531 via a communications network 526, including a LAN,

    WAN or other data communications network. Protocols such as IP or DECNet can be used to independently interface the Communication Servers in a communications network over this network. In an exemplary embodiment of the present invention, network interface 524 is coupled to TS Interface 512 via communications link 533 to receive INAP messages and CCRs and transmit messages (in a form including an INAP message, a CCR, and an original Communications Server ID) among other SCPs coupled to network 526.

    Figure 5B illustrates an SCP architecture supporting multiple messaging protocols in a single SCP 511. Communications Server 550, in addition to the components of Communications Server 502 of Figure 5A, also includes X.25 interface 552 to support ADF messaging from switch 560 over an X.25 network 563. The X.25 network interface 552 on Communications Server 550 receives ADFX.25 messages 561 and passes the ADF portion 565 of the message to TS Interface 554. The TS Interface 554 differs slightly from TS Interface 512 of Figure 5A (also shown as TS Interface 556 of Figure 5B) , due to the differences between ADF and INAP. The TS Interface 554 extracts a Service Key 567 from ADF message 565, and references TS list 560 to identify the appropriate Transaction Server to process the request message. Since ADF is a single message exchange protocol, no special call context is needed for communication with the Transaction Server 558. All necessary information is communicated in the ADF request message itself on communications link 569. The TS Interface 554 selects a Transaction Server from TS List 560 and sends the ADF request message to the selected Transaction Server 558. A round- robin algorithm is used to balance inbound messages among multiple Transaction Servers according to service type.

    Parser 562 on Transaction Server 558 receives the ADF message and converts it to a generic request message. Parser 562 is very similar to Parser 518 of

    Figure 5A, except that the field mapping relates to ADF messages, which differ from INAP messages. Nevertheless, all message types (protocols) are converted to the same type of generic request message structure, so that the same Server Application 564 can be used (although different structure fields may be populated) . The generic request message is sent to Service Application 564 via communications link 571. After processing the request, Service Application 564 returns via communications link 573 a generic response message to Formatter 566, which converts the generic response message to an ADF message before sending the ADF message to TS Interface 554 on Communications Server 550 via communication link 575. The TS Interface 554 returns an ADF message 565 to switch 560 via X.25 interface 552. As shown in Figure 5B, the same Communications Server computer may be used to support multiple message protocol architectures (e.g., INAP, ADF, and so on) . However, if performance requires, different Communications Server computers may be allocated to a single message protocol architecture.

    As discussed regarding Figure 5A, Communications Servers may be coupled together, such as by a communications network 577. In an SCP configuration that supports both ADF and INAP messaging, Communications Server 550 may send both ADF and INAP requests to other Communications Servers 579. To process an INAP request at a remote Communications Server (at 579) ,

    Communications Server 550 sends the INAP message and corresponding CCR to network interface 581 on communications link 583. In contrast, to process an ADF request at a remote Communications Server, Communications Server 550 sends the ADF message to network interface 581 on communications link 583, but there is no need to send a CCR because no conversational dialog has been initiated to require it. Figure 6A illustrates the architecture for connecting multiple SCPs on communications network 600, preferably a WAN. Originating switch 612 (connected to telecommunications network 613) is coupled to each SCP via dual data links 615. In an exemplary embodiment in accordance with the present invention, Communications Servers (e.g., 602, 604, and 606) at each SCP are linked to a high-speed WAN. In this manner, Communications Server 602, for example, can send a service request message to a Transaction Server at another SCP (e.g., Transaction Server 608) . The service request message (specifically, in this example, the INAP portion of the service request message) , the CCR corresponding to the call dialog (Dialog ID) , and an ID of the original Communications Server 602 are transmitted to remote SCP 607 for processing. Remote SCP 607 receives this data via its own network interface, which is coupled to its own TS Interface (see, for example, Figures 5A and 5B) . Because originating switch 612, the respective TCAP interfaces, and the respective TCAP Servers are bypassed, a full TCAP message is not required. For the same reason, the response message must be relayed back through the original Communications Server 602 before being communicated to originating switch 612. For conversational protocols like INAP, a service can first be invoked at SCP 603 and, subsequently, that same service for that same call can be processed at SCP 605 or SCP 607. For example, a VPN service request message (INAP "PROVIDE INSTRUCTIONS") is sent by a switch to Communications Server 602 on SCP 603. This message is then forwarded to VPN Transaction Server 610 at SCP 603, which processes the request and returns a response message to be sent back to switch 612. The switch then sends a second message (e.g., EVENT) in the VPN call dialog to Communications Server 602 at SCP 603. If, for example, all VPN Transaction Servers at SCP 603 are loaded or otherwise unavailable, Communications Server 602 at SCP 603 can forward this second message (including the CCR and an ID for the original Communication Server at SCP 603) to a VPN Transaction Server (e.g., 608) at SCP 607. Although Communications Server 602 at SCP 603 maintains the dialog with originating switch 612 throughout the call, any VPN

    Transaction Server at any SCP (such as SCP 607) coupled to the communications network 600 can process messages for this call dialog. This redirection requires Communications Server 602 to send the request message, the CCR, and the ID for the original Communications

    Server 602 to remote Communications Server 606, which forwards the request to the appropriate Transaction Server 608.

    Multiple services can also be provided for a single call, with service distribution specialized among the multiple SCPs coupled to a communications network. In other words, an SCP can be specialized, rather than redundant. Instead of redundantly supporting the same services in all SCPs, each SCP can support a limited number of services (or even a single service) so long as the system is capable of routing service request messages to a specialized SCP supporting the requested service. It may, for example, be desirable to deploy a VPN service only on a certain subset of SCPs, rather than on every SCP in a communications network.

    In a system in accordance with the present invention, call context is maintained at the original Communications Server. Therefore, the original Communications Server can distribute service request messages to other specialized SCPs. For example, suppose SCPl only provides NOO service, and SCP2 only provides VPN service (examples of specialized SCPs) . A switch receiving a remote VPN access call (i.e., a multiple service call including both NOO and VPN services) may issue an NOO service request message to a Communications Server in SCPl. A Service Application in SCPl processes the NOO service request and returns a service response message to the original Communications Server indicating, in part with a transfer record in the CCR, that a VPN service is subsequently required. Rather than returning the response message to the switch, which could then issue a second service request message for VPN to SCP2, Communications Server of SCPl in accordance with the present invention can receive the service response message from the NOO Transaction Server at SCPl and issue its own VPN service request message to SCP2 , thereby foregoing the detour to the switch. Figure 6B shows a message dialog between a switch and multiple SCPs. As shown, Communications Server A receives service request 1 and sends the request to Transaction Server A. Transaction Server A processes the service request and returns service response 1 to Communications Server A. In accordance with the present invention, service response 1 is accompanied by call context data, which is stored at Communications Server 1 in a CCR. In an exemplary embodiment of the present invention, the first Service Application at Transaction Server A determines that the call is a multiple service call and populates a transfer record in the call context data structure, modifies the Service Key in the generic response data structure to reflect the second service, and provides a flag indicating that the request should be transferred to a second service. In a first exemplary embodiment in accordance with the present invention, when Communications Server A searches its TS List for an available Transaction Server that supports the requested service, the list includes Transaction Servers from other SCPs. A field in the TS List associated with each Transaction Server indicates the Communications Server at which the corresponding Transaction Server is located. Therefore, if Communication Server A finds an available Transaction Server supporting the requested service at a different SCP, it issues the new service request to the other SCP. In another exemplary embodiment in accordance with the present invention, this selection process can be prioritized such that available Transaction Servers supporting the requested service and residing at the current SCP are favored over remote transaction servers . Such priority can be denoted by a priority field associated with each Transaction Server or through other statistical or heuristic means. In an alternate embodiment in accordance with the present invention, the TS List may contain only Transaction Servers residing in the same SCP. In this case, when no Transaction Server that supports the requested service is available at the present SCP, the original Communications Server will forward the request to a designated Communications Server coupled to the WAN. This designation may be accomplished by a round- robin algorithm, or some other priority mechanism. From such response data, Communications Server

    A in Figure 6B determines that a second service is required to complete the call. Using the new Service Key, Communications Server A searches its TS List for an available Transaction Server that supports the requested service. Determining that an appropriate Transaction Server is on another SCP, Communications Server A transmits service request 2 (which includes the service request for the service, the CCR for the call dialog, and an ID for original Communications Server A) across a WAN to Communications Server B, which then forwards service request 2 to Transaction Server B to process the second service. Thereafter, Transaction Server B returns service response 2 to Communications Server B, which returns service response 2 to original Communication Server A (where the call context is maintained) . Communication Server A then returns service response 2 to the switch. Subsequent message stages of the second service continue to flow through Communications Server A, which may forward them to any appropriate Transaction Server at any SCP that supports the requested service.

    Figures 7A, 7B, and 7C depict a flow chart illustrating the process of providing a single service for a call, in accordance with the present invention. A single service refers to a call that executes a single Service Application (for example, a call that is strictly a 1-800 call or a call that is strictly a VPN call) .

    In step 701, a network switch receives a call. While the switch is processing the call, it encounters a software-based trigger point that causes it to issue a service request message to an SCP. In step 702, the switch creates a service request message, such as an INAP "PROVIDE INSTRUCTIONS" message. In step 703, the switch selects an SCP using a load balancing algorithm. In an exemplary embodiment of the present invention, the switch selects a specific Communications Server (identified by the SSN) at an SCP, and the load balancing algorithm is a round- robin selection process. In step 704, the switch sends the service request message to the selected Communications Server at the selected SCP in the form of a TCAP message over an SS7 network. The TCAP message includes a new Dialog ID that uniquely identifies an SS7 dialog for this particular call, and a sub- system number (SSN) that identifies the specific Communications Server at the SCP.

    In step 705, the selected Communications Server has a TCAP Server that extracts the INAP portion of the service request message. In step 706, the Communications Server obtains a memory buffer including a CCR, if it exists, to communicate the call context data to a Transaction Server. In step 707, the Communications Server selects an available Transaction Server based on the Service Key extracted from the INAP message. The Service Key, identifies the type of service associated with the service request message. In Step 708, if no Transaction Server that supports the requested service is available to process the call, then the process proceeds to Step 710. In each SCP, there are multiple redundant Transaction Servers for each service type, clustered in a VAX cluster, for example. One or more Transaction Servers in such a cluster may be unavailable due to failure, overload, or other service-oriented circumstances. In Step 709, the Communications Server determines if the selected Transaction Server, and therefore, the selected Service Application are located at the present SCP site. Step 709 may be unnecessary in a redundant SCP configuration because all SCPs support the same types of Transaction Servers. If the selected Transaction Server is not located at the present site, the process proceeds to Step 710. In step 710, if no Transaction Server is available at the present SCP site, or no Transaction Server for the appropriate service type is located at the present SCP site, then the Communications Server sends the extracted INAP message, CCR, and an ID for the original Communication Server to a Communications Server at another SCP site. In step 711, the Communications Server at the other SCP site receives the INAP message and CCR, and begins processing as in step 707. In an exemplary embodiment in accordance with the present invention, the other SCP may be designated by a field in the TS List. Alternately, the other SCP site may be selected based on a round- robin algorithm, or other priority algorithm. This process continues until an available Transaction Server for the appropriate service type is found at any SCP, at which point the process proceeds to step 712.

    In step 712, the Communications Server sends the INAP message and the CCR to the selected Transaction Server. In step 713, the Transaction Serve receives the INAP message and CCR. In step 714, the INAP Parser on the selected Transaction Server maps the INAP message into a generic request message, which is then passed with the generic call context data structure (mapped from the CCR) to the Service Application. In step 715, the

    Service Application determines where to begin processing, based on the type of INAP message and received and, possibly, the call context data. The Service Application processes the request and returns a generic response message with the generic call context data structure, which is sent to the INAP Formatter on the Transaction Server. In step 716, the Formatter maps data from the generic call context data structure to an INAP message and a CCR. In step 717, the Transaction Server sends the INAP message and CCR to the Communications Server.

    In step 717, the Communications Server receives the INAP message and CCR from the Transaction Server. Step 719 determines whether the Communications Server in the original SCP is maintaining the call dialog with the switch, based on the Communications Server ID communicated via the WAN Interface. For example, when a switch initiates a call with an original Communications Server, that original Communications Server continues to maintain a call dialog with the switch throughout the duration of the call. If that original Communications Server directs a service request message to a Communications Server at an alternate SCP, the original Communications Server continues to maintain the call dialog and, therefore, also maintains the call context. As such, when the alternate Communications Server returns a response, the response is directed through the original Communications Server before proceeding to the switch. Accordingly, all messages exchanged with the switch within a single call dialog are passed through the original Communications Server, which also maintains the CCR.

    In step 721, the original Communications Server updates the CCR buffer with the CCR data received from the Transaction Server. In step 722, the Communications Server encapsulates the INAP message in a TCAP message and sends the TCAP message to the switch over the SS7 network. In step 723, the switch determines whether call processing is complete, based on the INAP response message type. If not, then in step 724, the switch sends the next TCAP message to the same Communications Server with which it initiated the call (i.e., the original Communications Server) . In step 725, the Communications Server receives the TCAP message, extracts the INAP message, and updates the call context data using the same CCR buffer throughout call processing for this dialog. The process continues as before with step 707. When call processing is completed for this call dialog, then in step 726, the original Communications Server deletes the data in the CCR buffer, and the process ends.

    In an embodiment of the invention, as illustrated in Figure 7A, the Communications Server obtains a buffer for a CCR (Step 706) in response to an initial service request message (e.g., INAP "PROVIDE INSTRUCTIONS") . Alternately, an exemplary embodiment in accordance with the present invention may wait to obtain a buffer for a CCR until context data is returned by a Service Application. In such an embodiment, the CCR is created and obtained by the Formatter upon receipt of call context data from a Service Application.

    Figure 8 is a flow chart illustrating the process of an additional feature provided in accordance with the present invention . Multiple services can be provided for a single call, with a first service invoking a second service at the same SCP, without the switch having to invoke the second service. This feature enables intelligence, which would otherwise be placed on the switch, to be migrated to the SCP. It is generally preferable that a single SCP process an entire call. Figure 7, however, illustrates a single service call being processed on multiple SCPs if the appropriate Transaction Servers at the first SCP are unavailable. In contrast, Figure 8 illustrates a process where a multiple service call (i.e., where a single call requires execution of more than one Service Application to process completely) is processed by the same SCP, without communicating with the switch between services. For example, in an exemplary embodiment in accordance with the present invention, a remote VPN access service requires both a VPN service and an NOO service to complete the call. MCI Communications Corporation's VPN service, VNET™, provides a remote access feature in which a 1-800 number is dialed to access a VPN platform. A first service, supporting 1-800 processes as part of the NOO Transaction Server is invoked, which results in the determination that a second service (for VPN) must be invoked. As such, the service returns a response message with a transfer record in the call context data to the Formatter, and then to the Communications Server. In accordance with this invention, the Communications

    Server, rather than the switch, evaluates the response message and transfer record and issues a service request to a VPN Transaction Server within the same SCP, if the response message and transfer record indicate that the VPN Service Application must be invoked. In an exemplary embodiment in accordance with the present invention, the transfer record includes data specifying whether the access is remote or registered, global switch data, point of entry data, point of origin data, and other formatting data. Generally, the transfer record includes context information that is passed between an NOO service and a VPN service.

    In Figure 8, steps 810-810 are described before, corresponding to equivalent steps illustrated in Figure 7, with specific application to an NOO call. In step 811, the NOO Service Application processes the service request message and determines that this particular NOO call is for a VPN remote access service. The NOO Service Application returns a response message that includes a Service Key and a transfer record for VPN service invocation. Steps 812-815 are as described before, relating to Figure 7. In step 816, the Communications Server detects the Service Key for VPN service invocation, and as a result, in Step 817, the Communications Server generates a new INAP service request message, such as an INAP "PROVIDE INSTRUCTIONS", message for VPN service. In step 818, the Communications Server selects a VPN Transaction Server, and in step 819, the Communications Server sends the new INAP message and CCR to the selected VPN Transaction Server.

    In steps 820-824, the VPN Transaction Server processes the service request message and returns a service response message. In step 825-829, the

    Communications Server processes and forwards the service response message to the switch, and engages in additional message exchanges until call processing completes for the current call dialog. In step 830, the Communications Server deletes the data in the CCR buffer, and the process ends.

    Figure 9 is a flow chart illustrating the process shown in Figure 8, but in which a second service (e.g., VPN) is invoked on a second SCP. The second service is invoked by the original Communications Server on the first SCP, so that the switch need not be involved to process the second service. As a result, multiple services may be implemented using a specialized service distribution architecture, in which SCPs are specialized rather than redundant. Alternately, this same process can also be applied to redundant service distribution architectures, in a situation where a needed Transaction Server at the first SCP is unavailable (as illustrated in Figure 7) . The process illustrated in Figure 9 comprises a multi- service call (a 1-800 remote VPN access service) .

    While the method disclosed herein has been described and shown with reference to particular steps in a particular order, it will be understood that these steps may be combined, sub-divided, or re-ordered to form an equivalent method without departing from the teachings of the present invention. Accordingly, unless specifically indicated herein, the order and grouping of the steps is not a limitation of the present invention.

    Moreover, while there have been described herein the principles of the present invention in conjunction with specific hardware and software, it is to be clearly understood that the foregoing description is made only by way of example and not as a limitation to the scope of the invention. Particularly, it is recognized that the teachings of the foregoing disclosure will suggest other modifications to those persons skilled in the relevant art. Such modifications may involve other features which are already known per se and which may be used instead of or in addition to features already described herein. Although claims have been formulated in this application to particular combinations of features, it should be understood that the scope of the disclosure herein also includes any novel feature or any novel combination of features disclosed either explicitly or implicitly or any generalization or modification thereof which would be apparent to persons skilled in the relevant art, whether or not such relates to the same invention as presently claimed in any claim and whether or not it mitigates any or all of the same technical problems as confronted by the present invention. The applicants hereby reserve the right to formulate new claims to such features andor combinations of such features during the prosecution of the present application or of any further application derived therefrom.

    Real time fault tolerant transaction processing system

    This application is a continuation of application Ser. No. 07125,463, filed Nov. 25, 1987, now abandoned.

    BACKGROUND OF THE DISCLOSURE

    1. Field of the Invention

    The invention relates to a real time fault tolerant transaction processing system and particularly one suited for use in a service control point.

    2. Description of the Prior Art

    Currently, many computer controlled systems, particularly those used in transaction processing, must operate at extremely high levels of reliability. Unfortunately, a computer which controls such a system, due to the complexity of the computer hardware and attendant software, is oftentimes the least reliable component in the system and is frequently a main cause of system failure. Therefore, in an effort to provide increased reliability, the art has turned to so-called fault tolerant computers for use in transaction processing systems. However, computers of this type possess serious drawbacks which, as discussed in detail below, severely limit their utility. As a result, such computers can not be used to impart increased reliability to a variety of computer based transaction processing systems.

    One specific transaction processing system that must operate at an extremely high level of reliability is a service control point ("SCP") that controls routing of telephone calls, within the telephone network, that require special handling, such as 800 and calling ("credit") card calls. In particular, whenever a telephone subscriber dials such a call, this call is first routed to an equal access switch, located either at a local office or elsewhere, which has service switching point capability (such a switch will hereinafter be referred to as an "SSP"). Primarily, the SSP processes calls that require remote data base translation. Now, whenever the SSP recognizes an incoming a call as one that requires special handling, the SSP suspends normal call processing, launches a message over a common channel signalling ("CCS") network to an SCP to determine how the call is to be routed, and finally upon receipt of a return message from the SCP, routes the call in a manner specified by the return message.

    Specifically, whenever a subscriber places a call to an 800 number, the local switch routes the call to an SSP. The SSP fabricates an query in the form of a packet. This packet contains the 800 called number and a request for a destination routing number associated with the 800 number and, additionally, identification of a particular long distance (inter-exchange) carrier over which the call is to be routed. This packet is then routed over a common channel signalling line in a CCS network to a particular one of several geographically separated signalling transfer points (STPs). Specifically, the CCS network typically consists of a multi-level hierarchy of STPs, wherein each STP is a primarily a packet switch. The first STP to receive the packet, i.e. the "originating" STP, then routes the packet, over an available link to an SCP for processing or, via a specified link, to another STP for eventual routing to an SCP. To perform this routing correctly, each STP that routes this packet examines a routing field located in the packet and, in response, determines where the packet should be routed. In particular, for an 800 call, the first six digits of the dialed 800 number specify the appropriate SCP that is to receive a corresponding packet from an SSP.

    The SCP itself is a fault tolerant transaction processing system that contains various databases that collectively provide desired call routing information. These databases contain a "customer record" which specifies how each 800 call is to be routed. This record frequently contains one or more destination routing numbers associated with a particular 800 number and specifies the manner in which one of these destination routing numbers is to be selected, e.g. in accordance with the time of day, day of month, originating numbering plan area of the caller or other pre-defined method. The SCP is a transaction processor in which a transaction involves the receipt of a packet and the generation of a corresponding response. In particular, whenever a query is received, via an incoming packet, the SCP performs associated database access operations to obtain a necessary destination routing number and an inter-exchange carrier identification for the corresponding 800 call. The resulting information is then transmitted, as a packet, over the CCS network by the SCP, via one or more STPs, back to an "originating" SSP which generated the corresponding query. Once a packet containing the destination routing number and inter-exchange carrier selection is received, the originating SSP appropriately routes the 800 call to the destination routing number. If the destination routing number is within the local access and transport area (LATA) served by the local telephone company, then the 800 call is routed by the SSP, via switching and transport facilities provided by that telephone company, directly to the destination routing number. Alternatively, if the destination routing number is outside the LATA served by the local telephone company, then the SSP routes the 800 call to the identified inter-exchange carrier with specific instructions (e.g. the destination routing number) for routing the call to its final destination.

    To ensure that 800 service is reliably provided all the time, an SCP must operate with minimal down time, preferably less than three minutes per year. Two techniques are often used in the art to impart a high degree of fault tolerance to the SCP: use of redundant link connections from the CCS network to an SCP and use of fault tolerant processors within the SCP.

    First, each SSP is connected, by separate links, to two different STPs, each of which, in turn, is connected by separate links to two different SCPs. In the event one of these links fails, then traffic destined to a particular SCP is re-routed thereto via another link or a different STP.

    Second, the art teaches that each processor used within the SCP must be fault tolerant. Generally, SCPs known in the art contain two front end processors, two back end processors and a fault tolerant mass memory device, such as a dual ported disk drive. Each front end processor is connected to both incoming links that terminate at the SCP. Each back end processor is connected to both front end processors. Also, each back end processor is connected to the disk drive through one of its dual ports. In operation, one of the front end processors formulates a database query in response to each packet appearing on either link. One of the back end processors receives a query from the front end processor and, in response, performs various database look-up operations, through one of the ports of the disk drive, to obtain the desired information. The front and back end processors are both fault tolerant. Specifically, the fault tolerant processors, as is typically taught in the art, operate in a hotstandby configuration in which one processor (the "hot" processor) is actively processing packets or queries while the other (the "standby" processor) remains in a standby condition ready to take over processing in the event the hot processor fails. A typical example of such a processor is shown in U.S. Pat. No. 4,484,275 (issued Nov. 20, 1984 to J. Katzman et al and hereinafter referred to as the '275 patent).

    Fault tolerant processors known in the art possess serious drawbacks which substantially limit their utility in an SCP.

    First, fault tolerant processors are very expensive. While a non-fault tolerant minicomputer having sufficient throughput for use in an SCP may cost upwards of $20,000, a fault tolerant processor of the same capacity may cost in the range of $100,000 or more. The additional cost is incurred as the direct result of highly specialized hardware and very sophisticated software, particularly for fault detection and recovery, needed in these processors to provide an acceptable degree of fault tolerance. Specifically, the software used in fault tolerant processors is often of such complexity that it accounts for upwards of 65% of the total cost of the processor. Thusfar, the art has failed to provide any "off the shelf" software that can be purchased and installed in two relatively low cost commercially available stand alone processors to provide an acceptable degree of fault tolerant operation therebetween.

    Second, in a traditional fault tolerant processor, such as that shown in the '275 patent, the hot processor handles the entire processing load while the standby processor remains idle. Consequently, in an application, such as the SCP, where queries may occur at a rate in excess of 200second, the hot processor itself must be capable of handling all these queries. This mandates that the each processor must have a sufficiently large throughput which further increases the cost of these processors. Now, in an attempt to reduce cost, the art teaches, as shown by the architecture described in U.S. Pat. No. 4,356,546 (issued Oct. 26, 1982 to A. Whiteside et al), that a set of different tasks can be assigned to and executed by a different processor. In this manner, each processor is not required to handle the entire processing load but rather a proportionate share thereof. Consequently, processors having a reduced capacity can be used to implement a fault tolerant architecture. Unfortunately, complex hardware and sophisticated and costly software is needed to monitor the execution of all tasks and, in the event a processor fails, re-schedule tasks among all active remaining processors. As a result, the cost savings that may accrue through the use of smaller processors are more than offset by the added expense of task monitoring and re-scheduling hardware and its attendant software.

    Third, traditional fault tolerant processors, such as that described in the above-noted '275 patent, utilize separate processors that are tightly coupled together through multiple busses. Unfortunately, inter-connecting processors in this fashion forces each processor to be somewhat dependent upon the other processors. Specifically, should one such processor fail, then depending upon the severity of the failure, e.g. whether a processor inter-connection bus is taken down as a result, the failed processor may well disrupt the operation of one or more of the remaining processors and potentially halt all further processing occurring throughout the fault tolerant system. Other illustrative fault tolerant architectures that rely on relatively tight inter-processor coupling are shown, for example, in U.S. Pat. Nos.: 4,484,273 (issued Nov. 20, 1984 to J. Stiffler et al); 4,421,955 (issued Dec. 20, 1983 to H. Mori et al); and 4,412,281 (issued Oct. 25, 1983 to G. Works). A similar dependency problem arises in those fault tolerant processors known in the art which rely on distributing tasks through a common switch to any one of several inter-connected processors. Such an arrangement is illustratively shown in U.S. Pat. No. 4,392,199 (issued July 5, 1983 to E. Schmitter et al). Here, the overall reliability of the fault tolerant processor is limited by the reliability of the common switch. Should the switch fail, all processing will stop.

    Fourth, other fault tolerant processors known in the art rely on simultaneously processing tasks through paired redundant hardware and comparing the results to isolate faults. For example, in the architecture described in U.S. Pat. No. 4,453,215 (issued June 5, 1984 to R. Reid), identical tasks are simultaneously processed, on a synchronous basis, through two identical dual processors. The results obtained from both processors within a dual processor are compared against each other to detect any errors (i.e. any differences) occurring within that dual processor and, should an error be detected, to immediately take that one of the two dual processors out of service. As a result, the faulty dual processor is taken out of service before it has a chance to transfer any possibly erroneous information onward to a bus. Although this arrangement may, in certain instances, provide an acceptable level of fault tolerance, substantial expense is incurred for quadruplicating processing elements.

    Thus, a need exists in the art for a transaction processing system, particularly one suitable for use in a service control point, that provides a very high degree of fault tolerance without complex hardware, sophisticated software and the attendant high cost associated with traditional fault tolerant processing systems.

    SUMMARY OF THE INVENTION

    The above-described drawbacks inherent in the art for providing a fault tolerant transaction processor, particularly one suitable for use within a service control point, are advantageously eliminated in accordance with the teachings of the present invention by a network based communication system which employs a communication protocol that adaptively distributes packets on an equal basis over multiple physical links that connect two points within the network, such as an SCP and a signalling transfer point (STP), and non-fault tolerant front end and back end processors that are connected to each physical link for handling the processing of packets appearing on that link. All the front and back end processors are loosely coupled together for purposes of processor synchronization and re-assignment. Through this communication system, all the physical links simultaneously carry an approximately equal number of packets which are, in turn, processed by all the processors connected thereto. In the event any physical link or either a front or back end processor connected thereto fails, then that link is declared to be out of service. Consequently, the protocol merely re-assigns all subsequently occurring packets to the other links until such time as the fault is cleared. As the result of link re-assignment, there is advantageously no need to connect a fault tolerant processor to each physical link. This, in turn, substantially and advantageously reduces the complexity and cost of the fault tolerant transaction processing system.

    In accordance with a specific embodiment of the present invention, the inventive system employs "j" sparing in which j processors (where j is an integer) are used in situations that would normally require j processors. Specifically, if only three physical links are sufficient to carry expected traffic, then four physical links with accompanying front and back end processors would be used in lieu of three physical links with the protocol providing approximately equal traffic (packet) distribution among the four links. Since use of an extra link and an extra set of processors is far less expensive than completely duplicating the entire system hardware as has been done in the past to provide fault tolerance, use of "j" sparing results in a substantially less expensive fault tolerant processing system than has been taught in the art.

    Furthermore, since no processors (either front or back end) are normally in an idle state but instead all such processors are productively processing packets, then advantageously little processing capacity is wasted, at least far less than that associated with traditional fault tolerant processors that rely on using separate hotstandby processors. Moreover, since the processors used in the inventive system are non-fault tolerant and have a smaller processing capacity than those typically associated with fault tolerant architectures, use of these non-fault tolerant processors results in a fault tolerant architecture that is substantially less expensive than that previously possible. In addition, since the all the front and back end processors are loosely coupled and a single back end processor can selectively bring up or take down subsystem (application) processing in each corresponding frontback end processor pair located within an entire SCP, the software that co-ordinates all the front and back end processors in the inventive system is far less sophisticated than that associated with traditional fault tolerant architectures. This, in turn, further reduces the cost of providing a fault tolerant real-time transaction processing system according to the teachings of the present invention.

    Moreover, in accordance with a feature of the invention, the inventive architecture advantageously bifurcates the software that provides an application, such as 800 service, from the software used to implement a fault tolerant communication network. In the past, application and communications software were frequently intertwined which slowed and significantly increased the expense of developing new applications for use in fault tolerant network environments. By separating the software, many new transaction based applications destined for use in a fault tolerant network environment can be advantageously developed without having to modify the associated communication software. This advantageously shortens the development cycle substantially and also provides significant attendant cost savings.

    BRIEF DESCRIPTION OF THE DRAWING

    The teachings of the present invention can be readily understood by considering the following detailed description in conjunction with the accompanying drawing, in which:

    FIG. 1 is a simplified diagram of a prior art architecture of a telephone signalling network that utilizes signalling system 6;

    FIG. 2 is a block diagram of prior art service control point (SCP) 200 shown in FIG. 1;

    FIG. 3 graphically depicts the hierarchy of the various levels of signalling system 7 (SS7) associated with a node on the common channel signalling (CCS) network and the message and control flow that occur among these levels;

    FIG. 4 is a simplified diagram of the architecture of the telephone signalling network shown in FIG. 1 that has been modified to utilize SS7;

    FIG. 5 shows the correct alignment of the drawing sheets for FIGS. 5A and 5B;

    FIGS. 5A and 5B collectively depict a block diagram of a preferred embodiment of SCP 500 shown in FIG. 4 that incorporates the teachings of the present invention;

    FIG. 6 depicts a block diagram of front end processor 5101 situated within SCP 500 shown in FIGS. 5A and 5B;

    FIG. 7 depicts a high level block diagram of several of the software processes executing within each front endback end processor pair in SCP 500 shown in FIGS. 4 and 5 and the principal inter-process communication occurring therein;

    FIG. 8 diagrammatically shows the communication occurring between SCP 500 and STPs 56 and 58 during the handling of a SS7 link failure;

    FIG. 9 shows the correct alignment of the drawing sheets for FIGS. 9A and 9B;

    FIGS. 9A and 9B diagrammatically show a sequence of inter-process communications that occur within SCP front end processors 5101 and 5102 shown in FIG. 8 during the handling of a link failure;

    FIG. 10 diagrammatically shows a sequence of inter-process communications that occur within SCP front end processor 5101 and back end processor 1 for bringing a subsystem executing on back end processor 1 into service;

    FIG. 11 diagrammatically shows a sequence of communications that occur between primary and mate SCPs and an adjacent STP to effectuate a mate switch operation;

    FIG. 12 diagrammatically shows a sequence of inter-process communications that occur within SCP front end processor 5101 and back end processor 1 situated within SCP 500 for generating a SS7 subsystem out of service request (SOR) message in order to invoke a mate switch operation; and

    FIG. 13 diagrammatically shows a sequence of inter-process communications that occur within SCP front end processor 910 and back end processor 920 situated within mate SCP 590 in response to an incoming SS7 SOR message initially issued by SCP 500 as part of a mate switch operation.

    To facilitate understanding, identical reference numerals have been used to designate identical elements that are common to the figures.

    DETAILED DESCRIPTION

    The teachings of the present invention are applicable to implementing a wide variety of real-time fault tolerant transaction processing systems. For the sake of brevity, the present invention will be discussed in the context of a real-time fault tolerant transaction processing system for use in a service control point (SCP) that processes packets supplied over any link existing within a link set that connects a signalling transfer point (STP) to the SCP. Clearly, after reading the following description, those skilled in the art will readily appreciate how the teachings of the present invention can be incorporated into other transaction processing systems to provide fault tolerance.

    I. Background

    To fully appreciate the teachings of the present invention, the following discussion will first examine how packets occurring within a telephone signalling network were traditionally processed and then address the inventive system.

    In particular, FIG. 1 shows a simplified diagram of a prior art architecture of a telephone signalling network that employs transaction processing. In general, this network provides special telephone routing information to support a variety of special calls, such as 800 number calls and calling card services. This information is obtained through remote database translations, using caller supplied information such as a called number or a credit card number, to appropriately access one or more databases that are embedded within the telephone signalling network. For illustrative purposes, this network and the invention will be discussed in the context of processing calls to 800 numbers.

    Assume for the moment that a caller dials a call to an 800 number. The caller (not shown) is generally connected to a local switch, such as local switch 12 or 14. An 800 telephone number is actually a logical telephone number. To route such a call to its proper destination, the 800 number must be translated to an appropriate destination routing number to which the call can be subsequently routed. The specific destination routing number is specified in a customer record stored within one or more databases residing within a service control point (SCP). This record typically contains one and often more destination routing numbers and associated inter-exchange carrier selections that are associated with a dialed 800 number and the manner in which one of these destination routing number and its associated inter-exchange carrier are to be selected, e.g. time of day, day of month, originating numbering plan of the caller and the like. An SCP is an on-line real time fault tolerant transaction processing system that provides call processing information (responses) in response to inquiries received via STPs connected within the signalling network. This call processing information can include call routing instructions, such as for 800 calls, or other instructions depending upon the information requested by an SSP. In particular, several different database applications can be concurrently available on an SCP. The following discussion addresses one such application, 800 service.

    Now, to process an 800 number call, whenever a local switch, typified by either local switch 12 or 14, receives an 800 call, this switch routes the call onward, either through trunk 22 or through trunk 24, respectively, to an equal access switch, located either at a local office or elsewhere, that has service switching point capability (such a switch will be collectively referred to as an "SSP"), such as SSP 30. The function of the SSP is to first recognize an incoming call as one requiring special handling --such as 800 number calls, then suspend normal call processing for this call, thereafter obtain appropriate routing instructions through the telephone signalling network and finally route the call according to the resulting instructions. Specifically, in response to a call to an 800 number, SSP 30 fabricates a query in the form of a packet. This query contains the called 800 number and a request for a destination routing number associated with the dialed 800 number and a designation of a specific inter-exchange carrier, such as inter-exchange carrier 1 or 2, that is to carry this call. This packet also contains a network address of the SSP, i.e. SSP 30, that originated the query. Once this packet is generated, it is transmitted through a regional common channel signalling (CCS) network 50 to an appropriate SCP, such as SCP 200 or SCP 210, which processes the packet and provides an appropriate response. Every packet received by an SCP is part of a separate transaction. Every transaction includes both a packet sent to an SCP from an SSP and a corresponding response generated thereto by the SCP and sent to the SSP.

    The CCS network consists of a multi-level hierarchy of signalling transfer points (STPs) which primarily act as packet switches to carry a message, in this case a packet, from an "originating" SSP to a particular "destination" SCP and to carry a packet containing a response message (call routing instructions) from that SCP back to the originating SSP which, in turn, routes the 800 call using the call routing instructions. As shown, CCS network 50 contains STPs 52, 54, 56 and 58 which are situated at different geographic locations within a given service region. STPs 52 and 54 receive incoming packets from SSP 30 for subsequent routing through the CCS network. As a result, these STPs function as "originating" STPs. To ensure continued operation in the event of a link failure, each originating STP is connected through two separate bi-directional links, such as links 64 and 72 for STP 52, and links 66 and 74 for STP 54, to destination STPs 56 and 58. If one of the links, such as link 64, connecting an originating STP, such as STP 52, fails, then that STP routes packets, via the other link--here link 72, to the other destination STP. Destination STPs 56 and 58 are inter-connected by bi-directional link 68 to route packets therebetween, if necessary. Hence, if STP 58 receives a packet destined for STP 56, the former STP routes the message over link 68 to the latter STP. Likewise, originating STPs 52 and 54 are inter-connected by bi-directional link 62 to route packets therebetween in the event of a link failure. Generally, CCS network 50 contains more than two originating and two destination STPs, and more than two STP levels wherein one or more levels of STPs are situated between the originating and destination STPs to provide packet routing therebetween. Each individual SSP, STP and SCP that exists within a signalling network is often referred to as a node.

    Now, once SSP 30 formulates an query, this SSP routes the associated packet that contains this query and appropriate header information through an available link, such as link 36 or 38, to an originating STP, i.e. either STP 52 or 54, respectively, located within CCS network 50. The originating STP determines, using internal global title translation tables, an address of a particular SCP, such as SCP 200, which contains the appropriate databases necessary to provide the requested call routing instructions, i.e. the specific SCP which contains a copy of the customer record for the dialed 800 number. This address is then inserted as a routing field that forms part of the header of the packet. Thereafter, the packet is routed from the originating STP to a destination STP within CCS network 50. Each STP that receives this packet examines its routing field and routes the packet accordingly. Once the destination STP receives the packet, it routes the packet to the particular SCP specified within the header. The SCP performs associated database look-up operations to formulate the desired call routing instructions. After this has occurred, the SCP fabricates a packet that contains the call routing instructions as a response message and a header that specifies the address of the SSP that originated the original query. Once the SSP receives this packet, it routes the dialed 800 call according to the routing instructions, i.e. the SSP routes the dialed call to the specified destination routing number via a specified inter-exchange carrier, such as inter-exchange carrier 1 or 2, via respective trunks 32 or 34.

    This signalling network that has just been described and which is well known in the art utilizes CCITT signalling system 6 (SS6). This signalling system employs only one physical path for each link that connects any two components (SSPs, STPs, and SCPs) that reside within or are connected to the signalling network.

    With this in mind, FIG. 2 shows a block diagram of an SCP, illustratively SCP 200, that forms part of the prior art signalling network shown in FIG. 1.

    As shown, the SCP contains two separate front end processors 220 and 225 each of which is connected to both links 82 and 86 which emanate from STPs 56 and 58, respectively. Each front end processor receives incoming packets and executes various software routines that implement a well-known communication protocol that forms part of SS6. This protocol provides framing, synchronization, error checking and correction, destination checking, message transport and other well-known communication functions. After the protocol has executed in a front end processor for an incoming packet, this processor sends the query contained in the incoming packet to a back end processor, such as processor 260 or 265, to process the query accordingly and provide a desired response. Query processing typically includes database look-up operations performed through path 270 or path 275 into a customer record stored on dual ported fault tolerant disk drive 280. The resulting response provided by the back end processor is then communicated back to the front end processor that provided the query. This front end processor executes the SS6 protocol to fabricate a packet containing the response and appropriate header information and then subsequently transmits the packet back to an STP.

    Hardware redundancy and link redundancy are used to impart a necessary degree of reliability to the signalling network. Specifically, in the event one path fails, another is available; in the event, one processor fails, another is available. As shown, each SCP is connected, via two separate links--here links 82 and 86, to two different STPs. In this manner, CCS network 50 can still communicate with SCP 200 and process calls even if one of the STPs or links fails. If STP 56 or link 82 fails, then the packets that would otherwise be carried by these components are routed, via STP 58 and link 86, to the SCP. Also, within the SCP, both links are connected to both front end processors. Hence, if one of these processors fails, then the other front end processor can immediately take over the processing load of the failed processor. Additionally, each front end processor is connected through separate data links to both back end processors. In the manner, should either one of the data paths connecting a front end processor to a back end processor fail or should a back end processor itself fail, then queries can be routed through the other data link to a different back end processor for processing. Specifically, front end processor 220 is connected through bi-directional data paths 242 and 244 to back end processors 260 and 265. Likewise, front end processor 225 is connected through bi-directional data paths 246 and 248 to back end processors 260 and 265.

    The art teaches that to provide added reliability, each of the front end and back end processors must be fault tolerant. Unfortunately, traditional fault tolerant processors known in the art possess serious drawbacks that significantly limit their use in an SCP. Specifically, traditional fault tolerant processors disadvantageously: utilize, typically in a hotstandby configuration, separate high throughput processing elements that are quite expensive; utilize complex, sophisticated and relatively expensive software; andor might, depending upon the specific fault tolerant processor chosen, employ tight inter-processor coupling which decreases overall system reliability.

    II. Inventive Fault Tolerant Transaction Processing System

    Now, in accordance with the teachings of the present invention, a real-time fault tolerant transaction processing system, particularly suited for use in an SCP, can be fabricated which substantially eliminates the drawbacks associated with traditional fault tolerant systems.

    The inventive system relies on using a communication protocol, illustratively signalling system 7, that adaptively distributes traffic on an approximately equal basis over multiple physical links that connect two points, coupled with use of non-fault tolerant front end and back end processors that are connected to each physical link for handling the processing of packets appearing on that link, wherein all the front and back end processors are loosely coupled together for purposes of processor synchronization and re-assignment. Through this system, all the physical links simultaneously carry an approximately equal number of packets which are, in turn, processed by all the processors connected thereto. In the event any physical link or either a front or back end processor connected thereto fails, then that link is declared to be out of service. As a result, the protocol merely re-assigns all subsequent traffic to the other links until such time as the fault is cleared. As the result of link re-assignment, there is advantageously no need to connect a fault tolerant processor to each physical link.

    Moreover, to provide increased fault tolerance, the inventive system employs "j" sparing in which j processors (where j is an integer) are used in situations that would normally require j processors. Specifically, if only three physical links are sufficient to carry expected traffic, then four physical links with accompanying front and back end processors would be used in lieu of three physical links with the protocol providing approximately equal traffic (packet) distribution among the four links. Since use of an extra link and an extra set of processors is far less expensive than completely duplicating the entire system hardware as has been done in the past to provide fault tolerance, use of "j" sparing results in a substantially less expensive fault tolerant processing system than has been taught in the art.

    Furthermore, since no processors (either front or back end) are normally in an idle state but instead all such processors are productively processing packets, then advantageously little processing capacity is wasted, at least far less than that associated with traditional fault tolerant processors that rely on using separate hotstandby processors. Moreover, since the processors used in the inventive system non-fault tolerant and have a smaller processing capacity than those typically associated with fault tolerant architectures, use of these non-fault tolerant processors results in a fault tolerant architecture that is substantially less expensive than that previously possible. In addition, since the all the front and back end processors are loosely coupled together and a single back end processor can selectively bring up or take down subsystem (application) processing in each corresponding frontback end processor pair located within an entire SCP, the software that co-ordinates all the front and back end processors in the inventive system is far less sophisticated than that associated with traditional fault tolerant architectures. This, in turn, further reduces the cost of providing a fault tolerant real-time transaction processing system according to the teachings of the present invention.

    Inasmuch as the inventive communication system utilizes a communication protocol along with particular hardware and software, the discussion will now address the salient properties of the protocol before proceeding to a detailed examination of the hardware and software used in the inventive system.

    A. Communication Protocol

    The protocol used in the inventive communication system provides point-to-point communication between different nodes--such as between an SSP and an STP, between separate STPs, and between and STP and an SCP--existing within CCS network that forms a telecommunications signalling system. This protocol, hereinafter referred to as signalling system 7 (SS7), is the ANSI (American National Standards Institute) implementation, as recommended by the ANSI T1X1.1 Working Group, of the signalling system 7 standard initially promulgated by CCITT. This protocol includes mechanisms, such as error detection and correction, to insure reliable transfer of signalling information, between two points in a CCS network, in the presence of transmission disturbances or a network (link or node, e.g. STP or SCP) failure. This protocol, as described in detail below, connects each pair of nodes with a number of separate signalling links, specifically up to sixteen separate links, that collectively form a link set. In the case of a link failure, the protocol diverts and distributes traffic from a failed link in the set to and among all the remaining links in the set. The software that implements SS7 executes in every node within the network in order to reliably transfer messages therebetween.

    One type of transmitted message that appears on the network is a packet consisting of a message signal unit (MSU) that contains desired signalling information (application information) followed by various header and trailing fields. Two other types of messages, i.e. a link status signal unit (LSSU) and a fill-in signal unit (FISU) can also, under certain circumstances, be transmitted onto the network by a node and are discussed below. The structure of an MSU is depicted in Table 1 below. The number in parenthesis in each of the following tables specifies the associated number of bits in each corresponding field.

    TABLE 1______________________________________MESSAGE SIGNAL UNIT (MSU) STRUCTURE______________________________________ ##STR1##______________________________________

    where:

    F is a message delimiter flag;

    CK are check bits;

    SIF is a signalling information field;

    SIO is a service information octet;

    LI is a length indicator field;

    FIB is a forward indicator bit;

    FSN is a forward sequence number;

    BIB is a backward indicator bit; and

    BSN is a backward sequence number.

    Specifically, each MSU begins and ends with a unique 8-bit pattern, illustratively "01111110", called a message delimiter flag (F). Appropriate routines executing at level 2 of the protocol prevent data from being interpreted as a delimiter flag by stuffing a "0" bit into a data pattern at the end of any consecutive string of five "1" bits in that pattern. Sixteen check (CK) bits are provided at the end of every MSU. For each MSU, the values of these check bits (a cyclic redundancy code) are generated by a transmitting node by computing a well-known frame check polynomial on portions of the MSU (flag and check bits excluded) prior to transmitting that MSU. Upon receipt of that MSU at a receiving node, the receiving node locally generates the check bits by computing the same polynomial and then compares the values of the locally generated check bits against those embedded within the received MSU. If any discrepancy is found between the values of the received and locally generated bits, then transmission errors are assumed to exist. As a result, the receiving node discards the received MSU and provide either a negative or no acknowledgement of receipt. This causes the transmitting node to re-transmit this MSU, as discussed below.

    The signalling information field (SIF), as described in detail below in conjunction with Table 2, contains an application message, in this case for 800 service a query from an SSP to an SCP or a response therefrom to an SSP, and a routing label. The routing label, as discussed in detail below in conjunction with Table 2, specifies the network origination and destination addresses of the MSU along with a code specifying the specific link within a link set that is to carry the MSU. The signalling information field contains an integral number of octets (8-bit groups) greater than or equal to 2 and less than 2722. The specific format and content of the application message is defined by the specific application software, i.e. the 800 service software.

    The service information octet (SIO) is an 8-bit code used by level 3 of SS7 to distinguish between different message types and different label types and thereby assist in routing a message to an appropriate application.

    The length indicator (LI) is a binary number within the range 0-63 which specifies the number of octets that follow the length indicator bits and precede the check bits.

    The forward (FIB) and backward (BIB) indicator bits along with the forward and backward sequence numbers (FSN and BSN, respectively) are used to perform sequence control and acknowledgement of transmitted MSUs. Specifically, each MSU is sequentially numbered in a cyclical sequence running between 0 and 127. The forward sequence number is the sequence number of a message contained within the present MSU that is being transmitted. The backward sequence number is a sequence number associated with an MSU that has been previously received, by the node that is now transmitting, from the node that is now receiving and is now being acknowledged to that receiving node.

    As discussed above, the signalling information field (SIF) not only contains an application message required by the 800 service application executing within a destination SCP but also contains a routing label. This label is utilized by the message distribution, discrimination and routing functions within level 3, as discussed below, to route, an MSU to a proper application, such as 800 service, that executes within a specified SCP. The routing label, for use within the United States CCS network, takes the form shown in Table 2 below:

    TABLE 2______________________________________ROUTING LABEL STRUCTURE______________________________________ ##STR2##______________________________________

    where:

    SLS is a signalling link selection code;

    OPC is an originating point code; and

    DPC is a destination point code.

    The signalling link selection code is a five bit code used in sharing traffic among two different link sets emanating from a node and within different links that form each of these link sets. The purpose of load sharing is to ensure that individual links and STPs do not become overloaded. All signalling points in a network use the same procedure for load sharing. Specifically, the least significant bit in the SLS specifies which of two link sets emanating from a node is to carry the MSU with the remaining four bits designating the particular link within the specified set. Prior to transmitting the MSU, the node rotates the SLS and places the value of the most significant bit into the least significant bit position. The receiving node then uses the value of the bit now occupying the most significant bit position to select one of two link sets with the remaining four bits used to select a specific link within that set and so on for all subsequent nodes that will receive the MSU. As a result, information that determines load sharing at any node in the network is independent of information used at any previous node. In the event a link in a link set fails, then the protocol load-shares the traffic (MSUs) that would otherwise be carried by the failed link over the remaining links in the link set. This is accomplished by re-assigning the signaling link selection codes that were previously assigned to the failed link to the remaining links in the link set. Messages are routed on the network through pre-defined (static) routing paths that are adaptively changed in the presence of node or link failures or link congestion, as explained below.

    The originating and destination point codes are CCS network addresses of the origination and destination sites of the associated MSU. Both CCS network addresses, OPC and DPC, take the form shown in Table 3 below:

    TABLE 3______________________________________ORIGINATIONDESTINATION POINT CODE(OPCDPC) STRUCTURE______________________________________ ##STR3##______________________________________

    The network identifier field contains a code that identifies a specific CCS network to which a DPCOPC belongs. The network cluster field, when used, defines a cluster of nodes within the specified network. Lastly, the network cluster member field contains a code that specifies a specific node within a specific cluster. The network cluster member code "00000000" is used to address STPs that form any specific cluster.

    A graphical depiction of hierarchy 300 of the various levels of SS7 existing at each node on the CCS signalling network and the message and control flow that occurs among these levels is shown in FIG. 3. Dot-dashed line A represents that a mirror image of hierarchy 300 exists in a companion node on the CCS network. As shown, SS7 utilizes a number of distinct levels: signalling data link functions 310 (level 1), signalling link functions 320 (level 2), signalling network functions 340 (level 3) and user levels 390 (level 4 and higher). The first three levels form message transfer part 380 which collectively provides a transport system to reliably transfer MSUs between different nodes andor different applications, of which 800 service is one such application, residing at one or more nodes. Here, specifically, a portion of the 800 service which generates queries and processes responses to route calls to a specific destination routing number, resides within an SSP and the remainder which performs database access operations resides within an SCP. An SSP and SCP may, though often do not, reside at the same geographic site. Since each node in the communications network can transmit and receive SS7 messages, every node executes identical software that implements levels 1, 2 and 3 of the SS7 protocol in order to reliably transfer messages among these nodes.

    In essence, level 1, signalling data link 310, defines physical, electrical and functional characteristics of an actual signalling link, i.e. transmission channel 303, and a specific transmission method, i.e. switching functions 307, through which the link is accessed. Level 1 exists between dot-dashed lines A and B. Generally, such a link is a 56 or preferably 64 kbitsecond synchronous digital path. As such, level 1 is implemented in hardware. Each higher level is implemented in software with each task executing within that level being implemented through one or more subroutines. The content and organization of each of these subroutines are readily apparent to those skilled in the art.

    Level 2, signalling link functions 320, define various tasks (that invoke pre-defined functions and procedures) relating to the transfer of individual MSUs over an individual signalling data link (transmission channel) that has been defined in level 1. These functions include: MSU delimitation and MSU alignment, error detection, error correction, initial alignment, error monitoring and flow control of MSUs being transmitted through the link. Level 2 exists between dot-dashed lines B and C. Specifically, based upon the detection of delimiter flags (F), level 2 tasks determine the beginning and end points of an MSU. Level 2 tasks also stuff "0" bits into a data stream after the occurrence of five "1" bits to prevent any data from imitating a delimiter flag. As set forth above, upon receipt of an MSU, level 2 tasks also locally generate, 16 check bits, through computing the frame check polynomial, and compares the locally generated bits to the check bits embedded within the received MSU. If a discrepancy is detected between these two groups of check bits, then level 2 tasks discard the received MSU through use of a negative or no acknowledgement messages which, in turn, cause the transmitting node to re-transmit the discarded MSU.

    Level 2 of SS7 provides non-compelled, positivenegative acknowledgement with re-transmission error correction. Specifically, once an MSU has been transmitted over a link, a copy of that MSU is retained within a re-transmission buffer associated with that link and situated at a transmitting node until that node receives a positive acknowledgment (in the form of a backward sequence number) that the transmitted MSU has been received by a far end node connected to that link. If however a negative acknowledgement or no acknowledgement message is received within a prescribed time period, then the transmitting node ceases to transmit any new MSUs and re-transmits all MSUs, for which it has not yet received a positive acknowledgement, in the order these MSUs were first transmitted.

    Initial alignment tasks, as described in detail below, are used in initializing a link, i.e. after a "switch-on" condition, or in aligning (synchronizing) a link after it has recovered from a link failure. These tasks utilize a compelled exchange of status information over the link between two nodes on the network during a pre-defined "proving" period.

    Level 2 tasks also detect link failures by monitoring errors, specifically rates of signalling errors and losses of alignment on a link and the length of time during which each loss of alignment occurs.

    Flow control of MSUs transmitted down a link is another function provided by tasks executing within level 2. Specifically, whenever link congestion (periods of heavy traffic) is detected at a receiving node connected to a link, the receiving node notifies the transmitting node connected to that link by an appropriate status code existing within a link status signal unit (LSSU), as discussed in detail below, and then withholds acknowledging all MSUs that have been received but not yet acknowledged. In particular, the LSSU is transmitted by the receiving node down that link to the transmitting node. In response to the receipt of this LSSU the transmitting end does not send any further MSUs to the receiving end over this link. Thereafter, the receiving node periodically notifies the transmitting node of the condition of the link. If this congestion continues too long, then the transmitting node designates this link as having failed and routes traffic to other links accordingly. Alternatively, if the congestion abates, then the receiving node resumes acknowledging received MSUs. Lastly, level 2 tasks also control link recovery.

    Signalling network functions 340, which collectively form SS7 level 3, define tasks (here transport functions and corresponding procedures) that are common to and independent of the operation of individual signalling links. Level 3 exists between dot-dashed lines C and D. Level 3 tasks typically fall into two broad categories: signalling message handling task 350 and signalling network management task 360.

    Specifically, while an MSU is being transferred over the network from an application executing at an originating node, signal message handling task 350, in response to the routing label within that MSU, directs that MSU to an application within SS7 level 4 or higher at a destination node. The delivery of the MSU is made either through a link that directly connects the originating and destination nodes or via one or more intermediate STPs. Signalling message handling task 350 consists of three sub-tasks: message routing task 352, message discrimination task 354 and message distribution task 356. Message routing concerns MSUs that are to be transmitted to other nodes; while message discrimination and distribution concerns MSUs that have been received. If an MSU containing an application message is to be sent from an application executing at level 4 or higher to another node on the network, then message routing task 352 at the originating node utilizes the SLS field within the routing label situated in the MSU to determine an outgoing link on which this MSU should be transmitted onward towards its destination. Message discrimination task 354 is used at a node to determine whether or not a received MSU, based upon its routing label, is destined for this node. If the received message is destined for another node, then task 354 applies that MSU to message routing task 352 for re-transmission to its eventual destination node. Alternatively, if the MSU is destined for the present node at which it has been received, then message discrimination task 354 applies that MSU to message distribution task 356. This latter task separates the application message from the received MSU and directs it to the proper application, here 800 call service, executing at this node such as an SCP.

    Signalling network management task 360, based upon pre-defined data and information regarding the status of the individual links and nodes that form the network, controls current routing of MSUs appearing on the network and also the configuration of the network links and nodes. Should any change occur in the status of the network, such as the failure of a link or node or congestion of a link, then signalling network management task 360 re-configures the network to by-pass the failed or congested link or failed node and thereby preserve communication over the network by sending messages to all nodes, particularly STPs, in the network to change routing tables used by message routing task 352 within each such node. In certain circumstances, this may entail activating and aligning new links that connect two nodes to provide signalling capability between these nodes. When normal operating conditions resume on this link or node, task 360 restores normal MSU transfer capability thereto.

    Specifically, signalling network management task 360 contains three sub-tasks: signalling traffic management 362, signalling route management 364 and signalling link management 366. Signalling traffic management task 362 diverts traffic from a link or route and routes it to one or more different links or routes, respectively, in the event of a link or node failure or slows traffic entering a given link if congestion occurs. This sub-task provides the functions of changeover (diversion of traffic without loss of messages to alternate links), changeback (acceptance of traffic into a recovered link), forced re-routing (used when a signalling route becomes unavailable), controlled re-routing (used to route traffic to a signalling route that has just become available), management inhibiting (manual instruction, by e.g. a craftsperson or technician, to the network to inhibit a link) and signalling traffic flow control. Signalling route management task 364 distributes status information throughout the network in order to block or unblock specific signalling routes. This information includes those routes that are transfer-restricted, transfer-prohibited, transfer-allowed, and transfer-controlled. Signalling link management task 366 restores failed links andor link sets, activates idle though not yet aligned links andor link sets, and deactivates aligned links andor link sets.

    As shown in FIG. 3, the different tasks provided at level 3 interact with each other and with various tasks existing at levels 2 and 4. Various standard testing and maintenance tasks 370 also exist which can be invoked through appropriate level 3 messages to test various aspects of the network.

    Levels 4, user (application) level 390, and above define specific user applications, such as the 800 service, that utilize information provided within the SIF field situated in an MSU. The application levels exist to the left of dot-dashed line D. Hence, levels 1, 2 and 3 collectively define a communication network that here reliably exchanges information, here transactions specifically queries and responses, between the same user application, 800 service, typically situated at different geographic sites. Specifically, levels 1, 2 and 3 define the network which carries queries from originating SSPs at various sites to destination SCPs and each resulting response from the destination SCP back to its corresponding originating SSP. Clearly, by merely changing the routing label, specifically the value of the service information octet within the MSU, this network can be used to exchange information between different user applications executing at one or more sites.

    Two additional types of messages, link status signal units (LSSUs) and fill-in signal units (FISUs), can also be transmitted over a link. LSSUs indicate status of the link and play a role in aligning a link to the network and passing failure messages regarding that link to the network. The organization of an LSSU is shown in Table 4 below.

    TABLE 4______________________________________LINK STATUS SIGNAL UNIT (LSSU) STRUCTURE______________________________________ ##STR4##______________________________________

    where:

    is an 8 or 16 bit status field that contains a code specifying the status of the link.

    Specifically, whenever a node, such as an STP or SCP, is fully operational and therefore ready to be brought into service on the network, a link connecting this node to the remainder of the network must undergo alignment. At this point, each node connected to the link repetitively transmits LSSU messages through the link to the other node connected thereto. In particular, whenever either node is ready to undergo alignment, then this node toggles, once a second, the code in the status field in the LSSU it is repetitively transmitting between a value indicative of "out of alignment" and a value indicative of "out of service". Once both nodes have detected a toggling status code transmitted by the other node, then both nodes begin an alignment procedure. This procedure, which typically lasts approximately 11.8 seconds, involves sending a pre-defined serial alignment bit stream four times over this link from each node to the other node. If this stream is received without any errors by each node, then each node connected to that link undertakes a level 3 application test, i.e. a so-called signal link test. This test is typically issued from an STP to an SCP and at the same time from an SCP to an STP. Specifically, a special pre-defined MSU is sent by, for example, the STP and contains a pre-set message and a routing label for a specific destination, such as the specific SCP. Whenever this SCP receives this message, it must acknowledge receipt. If the routing label is wrong, typically indicative of improper network addresses caused by faulty initialization of an STP or SCP, then no acknowledgement will be sent. In this case, the receiving node will wait for approximately one second for the acknowledgment. If such an acknowledgement is not received during this one second interval, then the receiving node (SCP or STP) will repeat the test. If the second attempt also fails, then this node categorizes this link as being out of service. As a result, the receiving node then repetitively transmits LSSUs onto this link with the status field set to the code for "out of service". As soon as either node connected to this link is ready to attempt alignment, it then transmits LSSUs with toggling status codes and the above process repeats. Alternatively, in the event a proper acknowledgement is received by a node, then this node changes the status of that link to available and then repetitively sends FISU messages, as described below, until MSUs are ready to be transmitted. Now, if the link fails for any reason or a node is not able to attempt alignment, such as for example through an STP failure, a back end processor failure in the SCP or a physical failure of the link itself or congestion on the link, then each node connected to that link transmits LSSU messages with the status field set accordingly to, for example, a code specifying "out of service", "out of alignment", "processor failure" or "signalling link out of service" depending upon the specific failure.

    If no other messages, such as MSUs, are awaiting transmission between two nodes connected by an aligned and available link on the network, then each of these nodes repetitively transmits FISUs over the link to the other node in order to maintain an available aligned connection between these two nodes. Table 5 shows the structure of a FISU. A FISU contains no SS7 level 3 messages. The length indicator LI, is used to differentiate between three different types of messages that can appear on the network: MSUs (the value of the LI bits>"2"), link status signal units (the value of LI bits="1" or "2") and fill-in signal units (the value of LI bits ="0"). Unlike MSUs, both LSSUs and FISUs are not re-transmitted in case of a detected transmission error.

    TABLE 5______________________________________FILL-IN SIGNAL UNIT (FISU) STRUCTURE______________________________________ ##STR5##______________________________________

    Oftentimes signalling traffic becomes quite heavy on a given link with more messages being destined for transmission over that link than the link is able to carry in a given time. When this occurs, the link basically becomes congested with a concomitant increase in transmission times. In these cases, SS7 is notified of a congested condition by a receiving node connected to that link. As long as congestion continues, signalling traffic is diverted from the congested link. Specifically, each MSU is assigned a priority value within the application portion of that MSU. Priority values can take on any integer value between "0" and "3", with "3" being the highest priority and reserved for signalling network management messages--a network message that is carried in lieu of an application message within an MSU. The amount of congestion occurring on that link, i.e. determined by the number of non-acknowledged MSUs contained in a re-transmission buffer for a link at a transmitting node, specifies the level of congestion occurring on that link. In the event, an MSU having a priority lower than the current congestion level occurs, then the transmitting node will send that message over an available link having a lower congestion level than the congested link. If, alternatively, the message has a priority greater than or equal to the congestion level of the congested link, then that message will be transmitted over the congested link.

    Changeover procedures are embedded within SS7 to ensure that signalling traffic that would otherwise be carried over an unavailable link or link set is diverted to other available links within the same or a different link set as quickly as possible while avoiding message loss, message duplication or message mis-sequencing. Once a link has failed, either node connected to that link and which first detects the failure, e.g. an originating STP, a destination SCP or an intermediate STP connected to that link, can invoke a changeover procedure at its associated originating STP to divert traffic away from the failed link. To do so, each node that detects the failure transmits a changeover message. This message is a specific network management message. In general, network management messages (which, as discussed above, are embedded as application messages within an MSU) take the form of:

    TABLE 6______________________________________NETWORK MANAGEMENT MESSAGE STRUCTURE______________________________________ ##STR6##______________________________________

    where:

    Header is a pre-defined 56 bit routing code for a particular STP;

    Functional code specifies a particular network management function that is to be executed within signalling network management task 340; such as among others: changeover (COO) and changeback, emergency changeover, changeover acknowledge (COA), transfer-controlled (TFC), transfer-prohibited (TFP), transfer-allowed (TRA), transfer-restricted (TFR), and management inhibiting;

    Link ID is a four bit code that specifies the particular link which has failed within the link set running from the destination SCP (or intermediate STP) to the STP; and

    the FSN is that associated with the last MSU that has been received by the destination SCP (or intermediate STP) prior to link failure.

    Now, once the changeover message is received and acknowledged to a detecting node through transmission of a changeover acknowledge (COA) message, changeover commences. The changeover procedure involves updating and retrieving messages from transmission and re-transmission buffers on either side of a failed link, then diverting these messages, via other links or STPs, to nodes connected through available links for communication between the originating and destination nodes, and finally preventing any subsequent traffic from being generated for transport over the failed link.

    Specifically, this updating includes identifying, using forward sequence numbers, all messages that have not been acknowledged and are located in the re-transmission buffer associated with the failed link. This is done through well-known handshaking procedures between both nodes connected to the unavailable link. Retrieval consists of transferring these non-acknowledged messages to the re-transmission buffers for the available link and located within a pair of nodes connected thereto. Alternate routes are selected based upon network configuration information and current link status information located within tables associated with signalling route management task 364 within level 3 of SS7. If no alternate routes exist to replace a failed link between two nodes, then signalling network management task 360 executing within the originating node declares the destination node to be inaccessible. In this case, network management messages (e.g. transfer prohibit messages) are sent back through the network to all nodes that can generate messages in order to specify the failed link as being blocked. These messages also instruct the nodes connected on either side of the failed link to discard any messages for the destination node and stored within transmission and re-transmission buffers associated with the failed link. Furthermore, these messages cause a command to be sent to each application (subsystem) executing within every node to prohibit that application from generating any messages for the destination node. In addition, appropriate well-known procedures are executed within signalling link management task 366 to update the current configuration of the network given the location of the failed link andor inaccessible node.

    For a more detailed explanation of SS7, the reader is referred to the following material, which is incorporated by reference herein: Bell Communications Research Specification of Signalling System 7, Technical Reference TR-NPL-000246, Issue 1, Volume 1, 1985 (1985, Bell Communications Research); and M. G. Walker, "Get inside CCITT signalling system No. 7", Telephony, Mar. 10, 1986, pages 72-77. Since this concludes the discussion of the salient features of the SS7 communication protocol as it pertains to the inventive system, the description will now turn to a detailed explanation of the hardware used in the inventive system followed by such a description of the software.

    B. System Hardware

    The hardware that forms the inventive real-time fault tolerant transaction processing system utilizes a CCS network, similar to that existing in the art but which has been modified to implement SS7, and a new architecture for each SCP appearing in this network. With this in mind, the discussion will now describe the signalling network followed by the SCP.

    1. Signalling Network

    The signalling network that is used in the inventive system is based upon and contains the same hierarchy of inter-connected nodes as a signalling network existing in the art, such as for example the network shown in FIG. 1, but with a modification required by SS7. Such a modified signalling network is depicted in simplified form in FIG. 4. As evident from this figure, the modified signalling network utilizes the same hierarchy of an SSP, connected to a CCS network that contains various levels of inter-connected STPs which are, in turn, connected to various SCPs. As discussed above, the existing signalling network shown in FIG. 1 utilizes SS6 in which only one physical link inter-connects any two different nodes. However, to accommodate SS7 and specifically to provide requisite link redundancy required by the SS7 protocol as discussed above, each pair of nodes that can pass signalling traffic therebetween (STPs within the CCS network, and SSPs and SCPs connected thereto) must be connected through a link set that contains more than one and up to sixteen separate physical bi-directional links. Therefore, as shown in FIG. 4, the SSP is Inter-Connected by link sets 37 and 39 to respective originating STPs 52 and 54 within CCS network 50. Within CCS network 50, originating STPs 52 and 54 are themselves inter-connected by link set 63 and are redundantly inter-connected to destination STPs 56 and 58 by link sets 65, 67, 73 and 75. STPs 56 and 58 are themselves inter-connected by link set 69 and are redundantly inter-connected to respective SCPs 500 and 590 by link sets 83, 85, 87 and 89. Each link set carries the same address. As noted above, selection of an appropriate link within a link set to carry an MSU is made by a node that is to transmit that MSU using the signalling link selection code, in the manner set forth above. Each node in the network is identified by one address although several link sets each containing a number of separate physical links are connected to that node.

    The modified signalling network can and usually does, in actuality, contain multiple SSPs, inter-connected by a CCS network having more than four STPs organized in a multi-level hierarchy with originating, intermediate and destination STPs, and where each destination STP is connected to an associated SCP.

    2. SCP Hardware Architecture

    A block diagram of the inventive architecture of an SCP, illustratively SCP 500, is depicted in FIGS. 5A and 5B, for which the correct alignment of the drawing sheets for these figures is shown in FIG. 5.

    The SCP contains a cluster of processors (inter-connected front and back end processors) that appear to the CCS network as a single node. Essentially, SCP 500 consists of from one to eight back end processors that execute queries using commonly available databases and provide responses. Each back end processor is connected to and communicates, via a corresponding front end processor, with the CCS network to receive individual queries and transmit responses. Each query is separately processed by a corresponding back end processor. One of the back end processors, in a manner to be described below in connection with the system software, co-ordinates the operation of all the front and back end processors so that individual front andor back end processors as well as software, including application (subsystem) software, executing thereon can be gracefully brought into and out of service. As a result of this co-ordination, SCP 500 appears as a single node to the CCS network, specifically STPs 56 and 58, even though different messages (e.g. containing different queries) arriving on different links connected to the SCP may, in fact, be processed essentially simultaneously.

    As shown and discussed above, SCP 500 is connected to STPs 56 and 58 by respective link sets 83 and 87. Link set 83 contains multiple links 831, 832, 833, . . . , 83n. Link set 87 contains multiple links 871, 872, 873, . . . , 87n (where "n" ≦8). Within SCP 500, every pair of corresponding links in both link sets is connected to a separate processor within front end processors 510. In this manner, each front end processor services incoming messages on two links. Specifically, front end processors 510 consist of front end processors 5101, 5102, 5103, . . . , 510n, which, are in turn, respectively connected to links 831 and 871, 832 and 872, 833 and 873, . . . , 83n and 87n. The front end processors are all identical. Each front end processor, which will be discussed in greater detail below in conjunction with FIG. 6, contains a MicroVAX-II computer manufactured by Digital Equipment Corporation (which also owns the trademark "MicroVAX-II"). The front end processors execute layers 3 and below of the SS7 protocol including the message transfer part, and a signalling connection control part, which will be described in detail below.

    Each front end processor is, in turn, connected through a well-known ETHERNET link (hereinafter referred to as a "dedicated" ETHERNET link) to a corresponding one of back end processors (ETHERNET is a registered trademark of Xerox Corporation). Each dedicated ETHERNET link is shown using a dot-dashed line in order to distinguish this ETHERNET connection from administrative ETHERNET network 512 and its inter-processor connections, which will be discussed below. Specifically, front end processors 5101, 5102, 5103, . . . , 510n, are connected through ETHERNET links 5161, 5162, 5163, . . . , 516n, on a one-for-one basis to back end processors 1, 2, 3, . . . , n, respectively. All the back end processors are identical with each consisting of a VAX 8600 processor which is also manufactured by Digital Equipment Corporation (which also owns the trademark "VAX"). Each of the dedicated ETHERNET links is controlled by appropriate communications software executing in both the front and back end processors connected to either side of the link. This communications software forms part of the DECnet family of communications products available from Digital Equipment Corporation (which also owns the registered trademark "DECnet"). All the application layers of SS7 are executed within the back end processors.

    To process incoming queries for 800 calls, all back end processors are able to commonly access disk resident databases containing customer records. Specifically, back end processors 1, 2, 3, . . . , n are connected through individual paired busses, specifically high speed dual path computer inter-connect busses 5251, 5252, 5253, . . . , 525n, through star coupler 530, to dual path computer inter-connect busses 5351 and 5352. The computer inter-connect busses are controlled by appropriate communications software executing within the back end processors and disk controllers and available within the DECnet family of communications products. These inter-connect busses, in turn, are connected to disk controllers 540 formed of disk controllers 5401 and 5402 Star coupler 530 is a well-known passive device that can be used to physically inter-connect up to sixteen high speed digital devices consisting of processors and disk controllers. Disk controllers 5401 and 5402 are each preferably model HSC50 available from Digital Equipment Corporation. Each of the controllers, specifically controllers 5401 and 5402, is connected through an appropriate bus, specifically bus 5521 or 5522, to one port of each disk drive 5621, 5622, . . . . , 562m, that forms paralleled disk drivers 562 (where "m" is an integer greater than zero). These disk drives contain data files consisting of databases containing the necessary customer records sufficient to support 800 service as well as the necessary databases to support all other enhanced services, such as calling card, that might rely on remote processing provided by SCP 500. Each of the data files stored on the disks are arranged with multiple copies using a well-known "shadowing" technique to allow simultaneous access to multiple copies of the data and provide real time recovery in case of a failure of a disk drive, a disk itself or a disk controller. Multiple copies of the data files are also stored within each disk to improve access speed and provide increased system reliability.

    All the front and back end processors are connected via separate ETHERNET local area network 512, which is referred to as an "administrative" ETHERNET local area network (LAN). This local area network permits communication to occur between the processors in order to provide synchronization and co-ordination therebetween. Specifically, administrative ETHERNET network 512 is connected to front and back end paired processors 5101 and 1, 5102 and 2, 5103 and 3, . . . , 510n and n, via respective leads 5121, 5122, 5123, . . . , 512n. This network uses the BX.25 protocol and is also controlled by appropriate communications software that forms part of the DECnet family of communications products. This network utilizes token passing. Specifically, a message is placed onto this network by a sending site, for example front end processor 5101. This message is then picked up by an adjacent site on the network, e.g. front end processor 5102. If the message is not for the latter front end processor but instead is destined for a downstream site, then the adjacent site that received the message, here front end processor 5102, will place the message back onto the network for reception at the next adjacent site, i.e. front end processor 5103 and so on. The message repeatedly appears on the network as the message travels from site to site. Whenever the message finally reaches its destination site, the message will not be re-transmitted and hence effectively "pulled" off the network. As will be discussed below, the processors that form the SCP are synchronized and co-ordinated through certain so-called one-and-only one (O-O-O) processes, as described below, that execute on one of the back end processors at any given time. These processes executing on one back end processor, e.g. back end processor 1 , communicate with all the other processes via administrative ETHERNET network 512. The communication generally involves application level commands to other back end processors to gracefully bring up or remove a certain application, such as 800 call processing, at other back end processors or invoke a mate switch operation, as described below, to another SCP. In addition, all the front end processors can also communicate to each other via administrative ETHERNET network 512. These communications, as described below, illustratively involve inquiries (changeover requests) regarding available links in the event of a link failure and accompanying acknowledgements (changeover acknowledgements) and other network management messages.

    In addition, to provide a primary port through which craftspersons andor technicians can locally manage the SCP, administrative ETHERNET network 512 is connected to maintenance and operations sub-system 570. This sub-system, typically a VAXstation IIGPX workstation produced by Digital Equipment Corporation (which also owns the trademark VAXstation II), is a multi-tasking workstation that is used to provide a system operator with simultaneous access to multiple processes executing within the SCP, such as status, configuration and re-configuration processes, performance data and alarm information. The information provided by sub-system 570 is displayed to a system operator. Similarly, the system operator can enter commands into SCP 500 through a well-known keyboard (not shown) that forms part of sub-system 570. Additionally, server 582 is connected to administrative ETHERNET network 512 to provide a simple interface for terminal 584 for communicating with any single task then executing within the SCP, e.g. run a single diagnostic within any processor or update a file and the like. Support system processor 572 is also connected to network 512 and is used to collect and disseminate, upon command, various SCP system statistics from each processor, such as utilization of each front and back end processor, number of failures of each such processor andor each application and the like. Processor 572 is also a MicroVAX-II processor provided by Digital Equipment Corporation.

    FIG. 6 depicts a block diagram of any front end processor, such as processor 5101, situated within SCP 500 shown in FIGS. 5A and 5B. As shown in FIG. 6, the front end processor consists of MicroVAX-II processor 630 that is interfaced to each of two 64 kbit synchronous SS7 links 831 and 871 through a separate communications processor 610 and 620, respectively. Both communications processors are identical. Specifically, each processor is a model LSI-JFEP II general purpose front end processor currently available from MDB Systems, . of Orange, Calif. The communications processors relieve host MicroVAX-II processor 630 of the task of directly interfacing to the synchronous links by providing on transmission of any message well-known framing functions including, for example: flag generation for frame delineation (message delimiting), zero bit insertion (bit stuffing) for data transparency, and computing the frame check polynomial to generate the check bits for each message and insertion of the check bits into each message. Upon reception of any message, each communications processor searches for and strips message delimiting flags; searches for and deletes stuffed zero bits; and checks for framing errors by locally computing the cyclic redundancy code (check bits) for each received message, then comparing the received check bits against locally computed values therefor and finally generating appropriate error messages should a framing error occur. These processors also provide well-known clocking functions. Each of these processors also detects signal loss (SS7 level 1 errors) on its associated link. Furthermore, these processors generate and transmit FISU (fill-in signal units, as discussed above) messages on each link whenever the link is not being used to carry any other messages, such as LSSUs and MSUs.

    Host MicroVAX-II processor 630 is also connected through disk controller 640 to disk drive 650. The disk controller and disk drive are preferably models RDQX2 disk controller and RD52 2 31Mbyte Winchester disk drive, both of which are available from Digital Equipment Corporation. The disk drive is presently used to store diagnostic software. Inasmuch as diagnostic procedures could be downloaded to host processor 630 over administrative ETHERNET network 512 in lieu of being stored locally at each front end processor, this disk drive and its associated controller could be eliminated from the front end processor with attendant cost savings if the diagnostics were to be remotely stored.

    To permit front end processor 5101 to communicate with its associated back end processor 1 and with the other processors within SCP 500 (see FIGS. 5A and 5B), host MicroVAX processor 630 is connected, as shown in FIG. 6, via ETHERNET controllers 660 and 670 and respective ETHERNET transceivers 680 and 690 to dedicated ETHERNET link 5161 and, via lead 5121, to administrative ETHERNET local area network 512. Each ETHERNET controller is a model DEQNA controller available from Digital Equipment Corporation. Each of these controllers implements the data link and physical link protocols specified by the ETHERNET standard (standard 803.2 promulgated by the Institute of Electrical and Electronics Engineers). The ETHERNET transceivers are well-known bi-directional hardware receivertransmitters that provide signal shaping and appropriate amplification.

    C. System Software

    The software used in the inventive system resides in both the front and back end processors. This software co-ordinates the operation of all processors within the SCP and thereby enables the entire SCP to communicate as one entity, even though multi-processing is occurring therein, to an STP. The STP remains totally ignorant of the replicated processing paths residing within the SCP and is only required to send messages and receive responses (transactions) over physical links connected to an SCP.

    FIG. 7 depicts a high level block diagram of several of the software processes (modules) executing within each front endback end processor pair in SCP 500 (see FIGS. 4 and 5) and the principal inter-process communication occurring therein. These processes are event driven. As shown in FIG. 7, processes 700 execute within each front end processor; while processes 760 execute within each back end processor, with the exception of certain processes specifically one-and-only one (O-O-O) processes 798, which as described below execute within execution manager 795 situated within only one of the back end processors. To facilitate understanding, processes 700 and 760 will be described as executing within illustratively a front endback end processor pair consisting of front end processor 5101 and back end processor 1, respectively.

    Specifically, as shown in FIG. 7, processes 700 are organized as a hierarchy. As discussed, an incoming SS7 message, such as a packet containing a query, from the CCS network is first processed through one of SS7 communications handlers 705, specifically SS7 communications handler 7051 or 7052, depending upon which one of two links connected to the front end processor carried the message. Similarly, if a SS7 message, such as a packet containing a query response, is to be transmitted from the front end processor onto the CCS network, then this response will be directed to one of these communications handlers depending upon which one of the two physical SS7 links is to carry this response. Since both communications handlers are identical, then, for the sake of brevity, only communications handler 7051 will be discussed. Moreover, operation of communication handler 7051 will be discussed in the context of message reception. This handler simply operates in a reverse manner for transmission, with exceptions and additional operations being noted.

    SS7 communications handler 7051 consists of communication processor software 710, device driver module (DDM) 715 and data link control (DLC) module 720. Communications processor software 710 represents the software executing within a communications processor, such as communications processor 610 (see FIG. 6). As discussed above, this software searches for and strips message delimiting flags from an incoming SS7 message; searches for and deletes stuffed zero bits from this message; and checks for framing errors by locally computing the cyclic redundancy code (check bits) for each received message, then comparing the received check bits against locally computed values therefor and finally generating appropriate error messages should a framing error occur. Also, appropriate transmission and re-transmission software buffers are provided within communications processor software 710. Each SS7 message that is to be transmitted is first loaded into transmission buffer 713. Then, once the communications processor is able to service this message, this message is transmitted onto the associated link. At the same time, the SS7 message is retained in re-transmission buffer 711 for subsequent re-transmission over that link in the event no or a negative acknowledgement message is received, as discussed above.

    Furthermore, software 710 also detects signal loss (SS7 level 1 errors) on its associated physical SS7 link. In addition, software 710 instructs its communication processor to generate and transmit FISU (fill-in signal units, as discussed above) messages on the link connected to that processor whenever the link is not being used to carry any other messages, such as LSSUs and MSUs to or from that processor.

    The remainder of SS7 communications handler 7051 executes within a host MicroVAX-II processor, such as processor 630 shown in FIG. 6, situated within a front end processor. DDM module 715 merely provides a well-known software driver allowing the host MicroVAX-II processor to communicate with and control the communications processor in the front end. DLC module 720 provides certain SS7 level 2 functions such as sequencing of SS7 messages for transmission and reception, flow control of messages (in response to congestion, as discussed above) and signalling link recovery.

    Once an incoming message has been processed by SS7 communications handler 705, SS7 level 3 front end processing of that message begins. This processing is provided by common transfer function (CTF) module 725, signalling connection control part (SCCP) module 730 and message distribution protocol (MDP) module 740.

    CTF module 725 directs incoming messages (queries) to the proper SS7 high level function via message discrimination, as described above in conjunction with signalling message handling task 350 shown in FIG. 3. This module also directs outgoing messages (query responses) to the proper SS7 communications handler, i.e. either 7051 or 7052, for transmission over the proper physical SS7 link using message distribution and routing, as described above. In addition, CTF module 725 implements signalling network management task 360 (see FIG. 3). This task, as described above, utilizes pre-defined data and current information regarding the status of the individual physical links and nodes that form the network, to control both current routing of MSUs appearing on the network and also the configuration of the network links and nodes. In the event of changes in status of any physical link or node, this module controls re-configuration of the network (links and nodes) in order to preserve, to the extent possible, or restore normal SS7 message transfer capability on the CCS network.

    SCCP module 730, shown in FIG. 7, provides data transport functions between a SS7 communications handler and MDP module 740. Specifically, SSCP module 730 routes incoming messages to the proper application executing at the SCP. The SCCP module maintains a table that provides current status information for each application installed at a corresponding back end processor that executes software 760. Hence, whenever a message is passed to SCCP module 730 by CTF module 725, the SCCP module examines the destination point code stored within a routing label and an accompanying subsystem number (service information octet) both contained within the message to identify the desired application at the current SCP and then, in response, determines whether this message can be processed at this SCP, i.e. SCP 500. If the message can be processed, it is passed onward to MDP module 740 for subsequent transmission to back end processor 1. Alternatively, if the message can not be processed due to current unavailability of the desired application, then the message is si discarded. For 800 call applications, SCCP module 730 supports class 0 connectionless service. The SCCP module also provides subsystems status management functions in order to maintain network performance by throttling outgoing traffic in the event of a failure or congestion in the network.

    MDP module 740 distributes messages through a DECnet connection between front end processor 5101 and back processor 1. This connection is substantially transparent to the applications executing within back end processor 1. Specifically, the MDP module accepts multiple DECnet connections and allocates a different queue for each logical link to be established thereby. The processes provided by MDP 740 and DECnet communications software include establishing a logical link, sending and receiving data over that link, sending interrupt messages, checking status information of a logical link and terminating activity on a link. In addition, to achieve high throughput, MDP module 740 organizes messages into separate groups (blocks) each of which is, in turn, transmitted to the back end processor. In this manner, the back end processor can sequentially process a block of queries and generate a stream of responses without wasting time in processing overhead (framing and the like) associated with a transfer of each individual message. Thus, queries and associated responses follow a path through a SS7 communications handler; then along a path given by arrow 755 through CTF module 725, SCCP module 730 and MDP module 740, and into the transaction capability application part (SS7 application layers) existing in the back end processor.

    Two other modules exist within software 700 that executes within the front end processor: operations management protocol (OMP) module 735 and front-end state manager (FESM) module 745. The OMP module performs administration of the front end processor. Specifically, the module maintains various parameter (site specific) values, such as SCP network address, STP address, mate SCP address, link identification numbers, values for each timer, threshold values and the like, in a table for use in properly configuring the SCP front end processor during its initialization. In addition, OMP module 735 allows a system operator (e.g. craftsperson andor technician) or back end processor 1 to modify parameter values in this table as either desires. Also, the front end processor collects various system measurement statistics and provides these measurements to back end processor 1 for logging via an appropriate protocol, i.e. a state management protocol. These statistics include the number of messages processed by each layer of SS7, the number of errors detected, processor utilization and the like. Inasmuch as OMP module 735 collects data on all message handling tasks executing within the host MicroVAX-II processor (see FIG. 6) located within front-end processor 5101, this data collection, as shown in FIG. 7, is symbolized by dashed lines 738 connecting both SS7 communications handlers 7051 and 7052, CTF module 725, SCCP module 730 and MDP module 740.

    FESM module 745 co-ordinates state changes relevant to physical links or signalling points that affect the entire SCP. This co-ordination is achieved through communications with an execution manager (EM) module executing in back end processor 1 and through communications with all the other front end processors located within the SCP. Front end processor co-ordination, as will be discussed below, deals with message routing among peer front ends and is transparent to all the back end processors within the SCP. Inasmuch as FESM module 745 also controls the state of CTF module 725, SCCP module 730 and MDP module 740, this control is represented by dashed lines 748.

    Through co-ordination among peer front end processors, the SCP is able to talk with "one voice" to an STP even though transaction processing is separately occurring for each link in any given link set connected to the SCP. Co-ordination between all the front ends in an SCP is achieved through a protocol, illustratively named the front end co-ordination protocol (FCP). This protocol permits FESM module 745 to know the status of all the other front end processors in the SCP. Specifically, whenever a state change occurs in a front end that affects its ability to handle traffic, e.g. new front end arrival, front end processor crash and STP state changes, this state change is communicated through a simple message in the FCP protocol by the FESM module in an affected front end processor, such as FESM module 745, to FESM modules in all other front end processors (e.g. FESM modules in front end processors 5102, 5103, . . . , 510n in FIG. 5) and must be acknowledged by all the other front end processors to the initial FESM module, here FESM module 745. In addition, if back end processor 1 that is executing one-and-only one processes 798, as discussed below, issues an instruction to take a subsystem down on the SCP, a corresponding FCP message, as described below, is communicated by FESM module 745 to FESM modules in all the other front end processors within the SCP in order to cause their corresponding back end processors to bring down the subsystem executing therein. FESM module 745 will provide an appropriate message in order to inform the STP of a state change, as discussed below, only after all suitable FCP acknowledgement messages have been received from the other active front end processors within the SCP.

    Front endback end processor co-ordination occurs through a protocol illustratively named the state manager protocol (SMP). This protocol permits commands affecting subsystem status (such as subsystem inout of service requests and responses) and other information, such as notifications and acknowledgements, to be communicated: between front endback end processor pairs, to other back end processors in the SCP, via the FESM module in other front end processors and the administrative ETHERNET local area network, and also between back end processors in primarymate SCPs, as discussed below.

    Front endback end processor co-ordination occurs whenever back end processor 1 issues a SMP command to gracefully bring a subsystem on an SCP into or out of service. Such commands can only originate from the one back end processor within the SCP that is executing one-and-only one processes 798, as described below. To gracefully bring a subsystem up or down on back-end processor 1, the back end processors issue an SMP subsystem allowed or SMP subsystem out of service request to the front end processor through FESM module 745. FESM module 745 passes the allowed or request message, through adjacent STPs (not shown), to a mate SCP which, in response, gracefully switches traffic to or from SCP 500 from or to a mate SCP. This process is repeated for each different subsystem (application executing at each different back end processor) that is executing on SCP up or 500 in order to gracefully bring the entire SCP down.

    The messages passed between front end processor 5101 and accompanying back end processor 1 and among all the front end processors within SCP 500 occur through the dedicated ETHERNET link and the administrative ETHERNET local area network, both of which are controlled by appropriate DECnet software executing in both the front and back end processors. In an effort to simplify the figure, this software has been omitted from FIG. 7 but interfaces to OMP module 735, MDP module 740, and FESM module 745 executing in front end processor 5101, and operations management message handler 770, transaction capability application part module 780 and state manager message handler 790 executing in back end processor 1 as shown.

    Each process that forms front end processes 700 executes as a separate application surrounding a kernel (not shown) consisting of a Portable Communications Executive (CEX) operating system available from Technology Concepts, . This operating system executes within front end processor 5101 and provides: well-known mailboxes for inter-process communication; memory management; creation, deletion and scheduling of processes; alarms and timers; buffer management and other well-known software support routines. Additionally, each process that forms processes 760 executes as a separate application surrounding a kernel (also not shown) consisting of a VAXVMS multi-user, virtual memory operating system, currently available from Digital Equipment Corporation (which also owns the trademark "VMS"), that supports multiple processor operation using shared disk data. The VAXVMS operating system executes within back end processor 1.

    As noted, processes 760, with the exception of only-and-only one processes 798, execute within each back end processor, illustratively back end processor 1. These processes include: operations management message handler (OMMH) module 770, transaction capability applications part (TCAP) module 780, state manager message handler (SMMH) 790, execution manger (EM) 795, event logger module 775, system integrity module 785, and component failure handler 788.

    OMMH module 770 communicates with OMP module 735 located within the front end processor via a DECnet logical link. OMMH module 770 is responsible for downloading of front end software. This module also distributes all back end process requests to the front end and distributes front end notification and alarm responses to appropriate back end processes. Furthermore, module 770 logs all front end measurement data provided by OMP module 735 into appropriate disk files for use by administration software (not shown) executing on the back end processor.

    TCAP module 780 is the interface (SS7 levels 4 and higher) between the SS7 front end processor and the specific transaction oriented application processes for processing queries, such as destination routing number queries for 800 number calls, executing within the back-end processor. TCAP module 780 accepts blocks of messages, delivered via MDP module 740, from the front end processor, de-blocks these messages, validates the messages, and then delivers each message to the application process. Upon completion of application processing, TCAP accepts response messages from the application, blocks the response messages and delivers them to the front end processor via MDP module 740. A message from an originating SSP that does not conform to the SS7 protocol is discarded by TCAP module 780 which sends an appropriate error message to the front end processor for delivery back to that SSP. Similarly, TCAP module 780 will receive reject messages from an originating SSP in response to invalid messages sent by an application through TCAP. TCAP module 780 will also send an error response message to the SSP that indicates the error condition when an application informs TCAP of an error in the received message.

    SMMH module 790 is a message distributor that passes SCP state control information, i.e. when to change the state of a service provided by an SCP, between FESM module 745 executing within a front end processor and EM module 795. This process communicates with FESM module 745 via a DECnet logical link.

    Event logger 775 receives changes in status information, e.g. fault conditions, regarding any module in both the front and back end processes from OMMH module 770 and SMMH module 790, logs the faults and maintains a running count of the faults. The event logger module passes fault information to system integrity module (SIMO) 785. This latter module compares a running total of the fault conditions against a numerical threshold to determine whether corrective recovery action should be taken at any given level of detected faults and what specific action is necessary, such as a process re-start or, for severe faults, local SCP node software re-start. Once SIMO determines that corrective action is necessary and the specific action that should be taken, SIMO 785 instructs component failure handler (CFH) module 788 to initiate this action. Once instructed, CFH module 788 will undertake the necessary corrective action. This action is most frequently a process re-start. For example, a process will be re-created by EM 795 if the process abnormally exits, a data area--if it becomes corrupted--can be subsequently reloaded from a disk file, and a SS7 front end processor software can be down-loaded through its corresponding back end, as noted above, after a crash.

    EM module 795 is primarily responsible for creating and terminating processes on the back end processor. With respect to processes executing within back end processor 1, the functions of the EM module include: startupbootstrap, process coordination, process surveillance, graceful shutdown and individual process creation and deletion. In addition, certain processes, so-called one-and-only one (O-O-O) processes 798 execute within the execution manager of only one of the back end processors. The O-O-O processes maintain a disk based table 793 of resources existing within SCP 500 to monitor current call processing capability of the SCP. These resources include the number of active front end processors, the number of active back end processors, the status (e.g. active or failed) of each process associated with each front or back end processor and the status (e.g. active, inactive, out of service) of each specific application assigned to each back end processor. In the event of a process or processor failure within the SCP, and in response to requests to create or delete processes, execution manager 795 (as well as any other EM that creates or deletes a process) instructs O-O-O processes 798 to update resource table 793 so that the table accurately reflects the new status of the SCP. Once this occurs, the O-O-O processes, performs a resource check by comparing entries in the resource table against pre-defined threshold values, which specify minimum acceptable processing configurations, to determine if sufficient processing capacity exists to support each separate subsystem that should be executing within the SCP. If sufficient resources exist for any subsystem (e.g. accompanying SS7 application software is executing on a sufficient number of back end processors and a requisite number of active front and back end processors exist), then the O-O-O process issues a command, as discussed below, through its associated front end processor, e.g. here processor 5101, to an adjacent STP connected thereto in order to appropriately re-route traffic to a different link to the SCP and thereby avoid the failed processor or process running thereon. Alternatively, if sufficient resources do not currently exist to support a subsystem, then O-O-O processes 798 issue commands through FESM module 745 and its associated front end processor 5101 through an adjacent STP to a mate SCP (SCP 590 in FIG. 4) to institute a changeover procedure. This procedure, if successful and as discussed below, causes the adjacent STP (STP 56 in FIG. 4) to route traffic otherwise destined to SCP 500 for this subsystem, specifically processing of destination routing number queries for 800 number calls, to the mate SCP for processing.

    Now, in the event a back end processor fails, then all the other back end processors are informed of this failure, through a well-known VAXVMS facility (not shown) called "lock manager". Specifically, a lock can only be held by one back end processor at a time. All active back end processors are aware of the location of the locks for all the other back end processors. If a back end processor fails, then the VAXVMS operating system executing on the back end processor that has the O-O-O processes releases the lock for the failed back end processor thereby allowing that lock to travel to another back end processor. At this point with one less back end processor available, the O-O-O processes commence a resource check as described above and initiate a mate switch procedure, if necessary. If the back end processor executing the O-O-O processes fails, then another back end processor obtains control over these processes.

    Upon system power up of SCP 500, each execution manager within each back end processor in the SCP first brings up all processes and SS7 applications executing therein and all processes executing within its corresponding front end processor. Also, an execution manager within a default back end processor, illustratively back end processor 1, is chosen to execute O-O-O processes 798 shown in FIG. 7. This latter execution manager, through the O-O-O processes, then searches the resource table to determine what subsystems should be running within the SCP as a whole and performs a resource check to determine the status of each front end processor and each back end processor and the applications presently executing on each back end processor. If sufficient resources are currently available to support a subsystem within the SCP, then this execution manager, through O-O-O processes 798 executing in back end processor 1, sends an appropriate subsystem allowed message for that subsystem through front end processor 5101 to the adjacent STP to obtain traffic for processing on that subsystem. This is repeated for each subsystem executing on the SCP.

    The hardware that constitutes each SCP front end processor, e.g. processor 5101, (see FIG. 7) and the software executing therein, specifically software 700, have been implemented into fully operational components by Technology Concepts, . of Sudbury, Mass. for use within a CCS network that provides fault tolerant transaction processing of queries for 800 calls and other enhanced calling services. The hardware that constitutes each SCP back end processor and the inter-connected storage and peripheral devices as well as back end software processes 760 have been fully implemented into operational components by Bell Communications Research, ., which is the present assignee.

    D. Inter-Process and Inter-Processor Co-ordination Involving an SCP

    A number of conditions involving an SCP can occur which require various levels of co-ordination between the separate front end processors within the SCP, between the front and back end processors within the SCP andor between different front endback end processor pairs within the SCP and its mate SCP and adjacent STPs to properly and gracefully re-route message traffic flowing therebetween. These conditions illustratively include: detection of a failed link in a SS7 link set, bringing a subsystem executing within an SCP into service (i.e. allowing a subsystem) and invoking a mate (SCP) switch operation to take a subsystem out of service. These conditions will now be discussed in conjunction with FIGS. 8-13. To facilitate understanding, circled numbers are used in these figures to easily designate different co-ordination messages occurring between separate network components (SCPs and STPs), (front end alone, andor front and back end) processors andor processes executing within these processors. Even though the same circled number is used in two or more of these figures, these circled numbers do not refer to identical elements occurring within FIGS. 8-13.

    FIG. 8 diagrammatically shows the communication occurring between SCP 500 and STPs 56 and 58 during the handling of a SS7 link failure. Since no back end processors within an SCP take part in handling a link failure, all of the back end processors as well as other non-involved components of an SCP have been omitted from FIG. 8. Also, since link failures are handled in an identical manner for all links, this discussion will concern a failure of illustrative SS7 link 831.

    Specifically, assume for the moment that SCP front end processor 5101 has detected that physical SS7 link 831 situated within SS7 link set 83 has just failed (circled number one). Also assume that the other link, i.e. link 871 in link set 87, connected to SCP 500 is active. In this case, SCP front end processor 5101 sends a changeover (COO) signal, via administrative ETHERNET local area network 512, to the next front end processor, i.e. front end processor 5102, in SCP 500 (circled number two). This signal requests that the latter front end processor take over the messages otherwise destined for the failed link. Once front end processor 5102 receives the changeover signal, this processor determines whether it is able to handle this traffic. If this processor determines that is has an active link in the same link set as the failed link, then this processor transmits a changeover signal (COO) to STP 56 over link 832 to inform the STP that link 831 has failed (circled number three) and requesting the STP to re-route traffic to link 832 within link set 83. The STP then sends a changeover acknowledgment (COA) signal over link 832 back to front end processor 5102 (circled number four). Once front end processor 5102 receives the changeover acknowledgement signal, it will place a changeover acknowledgement (COA) signal onto administrative ETHERNET local area network 512 (circled number five). This COA signal will be routed, using token passing, as described above, to SCP front end processor 5101. At essentially the same time as items represented by circled numbers 1-5 are sequentially occurring, STP 56 sends a changeover (COO) signal through any active link, e.g. link 83n, in link set 83 (circled number six). The purpose of this is to provide a redundant signal to front end processor 5101 to instruct this processor to sequentially transmit all messages stored within its re-transmission buffer for the failed link onto the other link, i.e. link 871 in link set 87. Once the changeover signal is received by SCP front end processor 510n, this front end processor places the changeover signal onto administrative ETHERNET local area network 512. Now, as soon as front end processor 5101 receives either the changeover (COO) or changeover acknowledgement (COA) signal from administrative ETHERNET local area network 512, front end processor 5101 sequentially transmits all messages it has retained in its re-transmission buffer associated with failed link 831 by moving these messages to the transmission buffer associated with active link 871 and subsequently transmitting these messages (e.g. MSUs) in sequence over this latter link (circled number eight).

    A sequence of inter-process communications, that occurs within SCP front end processors 5101 and 5102 shown in FIG. 8, during the handling of a link failure is diagrammatically shown in FIGS. 9A and 9B, for which the correct alignment of the drawing sheets for these figures is depicted in FIG. 9. Now, once link 831 fails, this failure (circled number one) is detected by SS7 communications handler 7051 which processes SS7 levels 1 and 2 for messages appearing on this link. Within communications handler 7051, a communications processor executing communications processor software 710 sends an asynchronous event signal which reports the link failure to DDM module 715 (circled number two). Thereafter, DDM module 715 sends an asynchronous event message to DLC module 720 to report the link failure and failure type (e.g. link power lost, alignment error or the like) (circled number three). Once this has occurred, DLC module 720 sends an asynchronous event message to CTF module 725 to report the link failure and specify the link identification number and the failure type (circled number four). In response to this message, CTF module 725 creates a changeover (COO) message and sends this messages to FESM module 745 (circled number five). Once the FESM module receives this changeover message, it transmits the message, via DECnet communications software and token passing over administrative ETHERNET local area network 512 here represented by a dashed line, to the FESM module in a next SCP front end processor, here front end processor 5102. Upon receipt of this message, FESM module 845 in front end processor 5102 determines whether this processor has an active link in the same link set as the failed link, i.e. link set 83. In the event, FESM module 845 determines that link 832 in link set 83 is not available, then FESM module 845 instructs the communications software to place the changeover (COO) message back onto administrative ETHERNET network for transmission to the next front end processor. If, however, front end processor 5102 has such an active link, such as link 832, then, as shown, FESM module 845 will not re-transmit the changeover message onto network 512 but instead will send this message to CTF module 825 (circled number seven). Upon receipt of this message, CTF module 825 adds routing information to the message and passes the resulting changeover message on to DLC module 820 (circled number eight). DLC module 820 adds framing information to the message and passes the resulting changeover message to DDM module 815 (circled number nine). DDM module 815 then instructs communications processor software 810 to add appropriate message delimiter flags to this changeover (COO) message (circled number 10) to provide a SS7 message, place the SS7 message in a transmission buffer and finally transmit the resulting SS7 message over link 832 to an adjacent STP (circled number 11).

    FIG. 10 diagrammatically shows a sequence of inter-process communications that occur within SCP front end processor 5101 and back end processor 1 for bringing a subsystem into service on back end processor 1. In order for a subsystem to be brought into service on a back end processor, the execution manger (EM) that executes the one-and-only one processes (here EM module 795) must confirm through a resource check that all hardware components, such as disk drives and front end processors) that are to be used by that subsystem within the SCP are up and running. This execution manager must then determine, also through a resource check, whether each individual software process that is to be used by the subsystem within the SCP is also up and running. If all the hardware and software processes are running, then this execution manager can bring up a subsystem. Now, in the event EM module 795 executing in back end processor 1 decides to bring a subsystem into service to support an application executing within SCP 500, the EM module sends an appropriate subsystem allowed message which identifies a particular subsystem to SMMH module 790 (circled number one). Upon receipt of this message, SMMH module 790 passes the message, via a logical ETHERNET link and appropriate DECnet communications software, to FESM module 745 in front end processor 5101 (circled number two). The FESM module sends this subsystem allowed message to SCCP module 730 (circled number three) and at essentially the same time places the subsystem allowed message onto the administrative ETHERNET network (circled number 3a) for communication to all other front end processors within SCP 500 to invoke the subsystem in all other active back end processors situated within SCP 500. After SCCP module 730 receives the subsystem allowed message, it updates its local subsystem state tables. Thereafter, the SCCP module sends the subsystem allowed message to CTF module 725 (circled number four). Upon receipt of this message, CTF module 725 adds routing information to the message and passes the resulting message to DLC module 720 (circled number five). This latter module adds message sequencing information to the subsystem allowed message and passes the resulting message to DDM module 715 (circled number six). Thereafter, DDM module 715 passes the resulting subsystem allowed message to communications processor software 710 which adds appropriate check bits and message delimiter flags to the message to form a SS7 message (circled number seven) and then transmits this message over physical link 831 to an adjacent STP (circled number eight). Once these operations have been completed, FESM module issues an acknowledgement message to SMMH module 790 within back end processor .sub. 1 (circled number nine). In response to this acknowledgement message, SMMH module 790 passes the acknowledgement message to EM module 795 which invokes the subsystem within back end processor 1 (circled number ten).

    FIG. 11 diagrammatically shows a sequence of communications that occur between primary and mate SCPs and adjacent STPs to effectuate a mate switch operation. A mate switch, when successfully completed, transfers message traffic and accompanying processing of a subsystem (an entire application, such as 800 call processing) from an SCP, referred to as a primary SCP, to another SCP, referred to as a mate SCP. A subsystem executing on an SCP can be brought down in one of two ways: through manual intervention, by e.g. a craftsperson andor technician, using maintenance and operations subsystem 570 (see FIGS. 5A and 5B), or automatically by the SCP itself in the event of a failure occurring therein. Specifically, as discussed above, if a process or processor fails and a subsequent resource check, conducted by the one-and-only one processes executing within an execution manager in a back end processor within the SCP, reveals that insufficient resources are currently available to support a subsystem in the SCP, then that execution manager, through the one-and-only one processes, invokes a mate switch operation for that subsystem. As will be seen below, a mate switch operation can not occur unilaterally at the request of a primary SCP but rather is the result of negotiations conducted between primary SCP 500 and mate SCP 590.

    Since the only back end processor in the primary SCP that communicates with a mate SCP is the back end processor executing the one-and-only one processes, all other back end processors and their associated front end processors in both the primary and mate SCPs have been omitted from FIGS. 11-13 to simplify these figures.

    Specifically, as shown in FIG. 11, if the one-and-only processes executing within an execution manager in back end processor 1 in primary SCP 500 determine that a subsystem executing within the primary SCP is to be brought down, then back end processor 1 first issues a subsystem out of service request (SOR) message to its associated front end processor 5101. This message is passed through front end processor 5101 because back end processor 1 is unable to create SS7 messages (circled number one). This operation is explained in detail below in conjunction with FIG. 12. Communication between front and back end processors is through the state management protocol (SMP). In response to the reception of a SMP SOR message at front end processor 5101, this processor converts the message into a level four SS7 message with a routing code specifying mate SCP 590. Each SCP maintains the address of its mate SCP. Once this SOR message is generated in SS7 format, front end processor 5101 transmits this message over an available link in link set 83 and through STP 56 to mate SCP 590 (circled number two). Upon receipt of this message, mate SCP front end processor 910 converts the SS7 SOR message into an SOR message in the state management protocol and transmits a resulting (SMP) SOR message to mate back end processor 920 (circled number three).

    In response to an SMP SOR message, back end processor 920 undertakes a resource check to determine if mate SCP 590 can provide the necessary subsystem (application) processing requested by primary SCP 500. The mate SCP will grant a service request from the primary SCP only if all the front and back end processors are active in the mate. If insufficient resources exist, then back end processor 920 in mate SCP 590 will simply ignore the received SMP SOR message. If this request is ignored, then after a short finite time has elapsed without a response, back end processor 1 in primary SCP 500 will issue another SOR message to the mate. If this request is ignored again, then back end processor 1 in primary SCP maintains the application in an active state provided at least one front and back end processor pair remains active. As long as one front endback end processor pair is active, then primary SCP 500 continues to process messages though at a degraded rate.

    Alternatively, if the resource check performed in the mate SCP discloses that all processors are active, then back end processor 920 issues a SMP subsystem out of service grant (SOG) message to mate front end processor 910 (circled number four). Upon receipt of this message, the mate front end processor converts the SMP SOG message into a SS7 subsystem out of service grant message and then transmits that SS7 SOG message through an available link in link set 89 through STP 56 to primary SCP 500 (circled number five). Also, the mate front end processor issues a SS7 subsystem allowed (SSA) message to adjacent STP 56 over an available link within link set 83 to instruct this STP to route message traffic otherwise destined for the subsystem being terminated on the primary SCP to the same subsystem running on mate SCP 590 (circled number six). After this has occurred, the mate front end processor furnishes an SMP SOG message to mate back end processor 920 to confirm that a SOG message has been sent to the primary SCP (circled number seven). The SS7 SOG grant message received at the primary SCP is used to terminate the subsystem running at this SCP. In particular, whenever primary front end processor 5101 receives a SS7 SOG message from STP 56, it converts this message into an SMP SOG message and passes the resulting message to primary back end processor 1 (circled number eight). In response to this SMP SOG message, back end processor 1 takes the subsystem out of service. Once this occurs, primary back end processor 1 provides an SMP off message to front end processor 5101. The front end processor distributes this off message to all the other front end processors within primary SCP 500 to cause all the front end processors to refuse traffic for this subsystem and cause all the corresponding back end processors to bring the subsystem down on those latter processors (circled number nine). In response to the off message, front end processor 5101 issues a SS7 subsystem prohibited (SP) message to adjacent STP 56 to instruct this STP not to send any message traffic for the terminated subsystem to primary STP 500 (circled number ten). After this SS7 SP message has been transmitted to STP 56, primary front end processor 5101 issues an appropriate message to primary back end processor 1 (circled number eleven) to notify it that all front end processors in primary SCP 500 are prohibited from accepting traffic for this subsystem from any corresponding back end processor in the primary SCP. Also, in response to receiving a subsystem prohibit message, STP 56 issues an SS7 message to mate front end processor 910 which, in turn, causes the mate front end processor to send a notification (circled number twelve) to mate back end processor 920 that the subsystem is now off in the primary SCP. After these operations have been concluded, STP 56 sends all traffic for the subsystem now terminated on primary SCP 500 over link set 89 to the same subsystem that is now running on mate SCP 590.

    FIG. 12 diagrammatically shows a sequence of inter-process communications that occurs within SCP front end processor 5101 and back end processor 1 situated within primary SCP 500 for generating the SS7 subsystem out of service request (SOR) message in order to invoke a mate switch operation. As noted above, only the one-and-only one processes executing within the execution manager in the primary SCP are able to bring a subsystem down. Therefore, if these processes determine after a resource check that a subsystem executing in primary SCP 500 is to be taken down, then these processes instruct execution manager 795 in back end processor 1 to issue a SMP subsystem out of service request (SOR) message for subsequent communication to mate back end processor 920 (see FIG. 11). Once this SMP SOR message is generated, execution manager 795 routes this message to SMMH module 790 (circled number one). Upon receipt of this message, SMMH module 790 sends this message, via a logical dedicated ETHERNET link to FESM module 745 within primary front end processor 5101 (circled number two). Upon receipt of this SOR message, front end state manager module 745 routes this message to SCCP module 730 (circled number three). This latter module begins the creation of a SS7 SOR message from the SMP SOR message received from the back end processor. In particular, SCCP module 730 accesses the network address of the mate SCP. The SCCP module sends this address embedded within a basic SS7 out of service request message to CTF module 725 (circled number four). This latter module adds an appropriate SS7 routing label into the SS7 message and then sends the resulting message to DLC module 720 (circled number five). This latter module adds SS7 message sequencing information to the message it receives and sends the resulting message to DDM module 715 (circled number six). DDM module 715 adds check bits and delimiter flags to the message and passes the now completed SS7 message to communications processor software (circled number seven) which instructs its associated communications processor to transmit the SS7 SOR message onto illustratively onto link 831 within link set 83 for transport through an adjacent STP to mate SCP 590 (see FIG. 11).

    FIG. 13 diagrammatically shows a sequence of inter-process communications that occurs within SCP front end processor 910 and back end processor 920 situated within mate SCP 590 in response to an incoming SS7 SOR message initially issued by SCP 500 and subsequently routed by STP 56 to mate SCP 590 as part of a mate switch operation. In particular, whenever a SS7 SOR message (circled number one) appears on a link, illustratively link 891, situated within link set 89, connected to mate SCP, this message is first processed by SS7 communications handler 10051 existing within mate SCP 590. Specifically, communications processor software 1010 passes the received SS7 message to DDM module 1015 (circled number two). This module strips the delimiter flags and check bits from the SS7 message and passes the resulting message to DLC module 1020 (circled number three). This module extracts and checks the message sequencing information contained within the incoming message and passes the resulting message to CTF module 1025 (circled number four). Once this occurs, CTF module 1025 removes the routing label contained within the message it receives and, if the routing label points to the mate SCP, then the CTF module passes the message onward to SCCP module 1030 (circled number five). If this message is destined for another SCP, CTF module discards this message. Once SCCP module 1030 receives the message, it determines based upon the routing label whether this SOR message is for a subsystem resident within mate SCP 590. If it is not for such a subsystem, then the message is discarded by SCCP module 1030. Alternatively, if the SOR message is for a subsystem resident on the mate SCP, then SCCP module 1030 passes the SOR message to FESM 1045 (circled number six). FESM module 1045 creates an SMP SOR message and passes the SMP message, via a logical ETHERNET link, to SMMH 1090 in mate back end processor 920 (circled number seven). In response to the arrival of this message, SMMH 1090 passes the message to execution manager 1095 for processing by the one-and-only one processes executing therein (circled number eight).

    As described above, execution manager 1090 upon receipt of a SOR message undertakes a resource check using the one-and-only one processes executing therein to determine if sufficient processing resources are available within the mate SCP to provide the necessary subsystem processing requested by the primary SCP. In the event insufficient resources (i.e. less than all front and corresponding back end processes are active within the mate SCP) exist within mate SCP 590, then execution manager 1095 simply ignores this SOR message. Alternatively, if all the front and corresponding back end processors are active in the mate SCP, then the one-and-only one processes instruct execution manager 1095 to issue an SMP SOG message to SMMH module 1090 (circled number nine). The SMMH module forwards this SMP SOG message over a logical dedicated ETHERNET link to FESM module 1045 within mate front end processor 910 (circled number ten). FESM module 1045, upon receipt of the grant message, passes the message to SCCP module 1030 which begins the creation of a SS7 SOG message from the SMP SOG message received from the back end processor. In particular, SCCP module 1030 accesses the network address of the primary SCP (which is the mate SCP to SCP 590). The SCCP module sends this address embedded within a basic SS7 subsystem out of service grant message to CTF module 1025 (circled number twelve). This latter module adds an appropriate SS7 routing label into the SS7 message and then sends the resulting message to DLC module 1020 located within SS7 communications handler 10051 (circled number thirteen). This latter module adds SS7 message sequencing information to the message it receives and sends the resulting message to DDM module 1015 (circled number fourteen). DDM module 1015 adds check bits and delimiter flags to the message and passes the now completed SS7 message to communications processor software 1010 (circled number fifteen) which instructs its associated communications processor to transmit the SS7 SOG message onto link 891 within link set 89 for transport through an STP 56 to primary SCP 500 (see FIG. 11). Once this has occurred, primary SCP 500 can terminate the subsystem on its back end processors, as described above.

    The inventive system is not limited to being employed in networks using the SS7 communication protocol. In fact, any communication protocol which utilizes multiple individual links within a link set to carry communication between two points in a network and in event of a node or link failure, adaptively re-distributes traffic among the remaining individual links in the set can be used instead of SS7. For example, X.25 is one such protocol that can be configured to support multiple links in a link set. To use another communication protocol, such as X.25, the software described above, would need to be modified in a relatively inexpensive manner readily apparent to those skilled in the art to provide appropriate interfaces and control procedures for each level residing in the desired protocol. Therefore, by connecting a non-fault tolerant front end processor and a non-fault tolerant back end processor to each link appearing in a link set at a processing node, such as an SCP, within a network executing such a protocol and loosely coupling the processors in the manner set forth above, a relatively inexpensive real-time fault tolerant transaction processing system for use on this network can be easily fabricated.

    Furthermore, although the inventive system is shown and described as having one back end processor connected to each front end processor, more than one back end processor could be used with each front end processor. The specific number of back end processors that can be connected to any front end processor is determined by the processing capacity of that front end processor. In essence, the front end processor, which is connected to several back end processors, must be able to receive incoming messages from the network, process each incoming message to obtain the query contained therein and pass these queries to each of these back end processors, and also accept resulting responses from each of these back end processors, generate outgoing network messages containing these responses, and finally transmit these outgoing messages onto the network all at a rate that insures a sufficiently rapid response time for every incoming message. The additional processing load placed on the front end processor significantly increases with each additional inter-connected back end processor. Therefore, to provide a cost effective design using currently available technology, only one back end processor is preferably connected to each front end processor.

    Although a single embodiment which incorporates the teachings of the present invention has been shown and described herein, those skilled in the art can readily devise many other varied embodiments that incorporate these teachings.



    References:


    Pass4sure Exam Study Notes
    Pass4sure Certification Exam Study Notes
    Pass4sure Certification Exam Study Notes
    Pass4sure Certification Exam Study Notes
    Pass4sure Certification Exam Study Notes
    Pass4sure Study Guides and Exam Simulator - shadowNET
    Killexams Study Guides and Exam Simulator - simepe.com.br
    Download Hottest Pass4sure Certification Exams - CSCPK
    Complete Pass4Sure Collection of Exams - BDlisting
    Latest Exam Questions and Answers - Ewerton.me
    Here you will find Real Exam Questions and Answers of every exam - dinhvihaiphong.net
    Practice questions and Cheat Sheets for Certification Exams at linuselfberg
    Study Guides, Practice questions and Cheat Sheets for Certification Exams at brondby
    Study Guides, Study Tools and Cheat Sheets for Certification Exams at assilksel.com
    Study Guides, Study Tools and Cheat Sheets for Certification Exams at brainsandgames
    Study notes to cover complete exam syllabus - crazycatladies
    Study notes, boot camp and real exam Q&A to cover complete exam syllabus - brothelowner.com
    Study notes to cover complete exam syllabus - Killexams.com
    Study Guides, Practice Exams, Questions and Answers - cederfeldt
    Study Guides, Practice Exams, Questions and Answers - chewtoysforpets
    Study Guides, Practice Exams, Questions and Answers - Cogo
    Study Guides, Practice Exams, Questions and Answers - cozashop
    Study Guides, Study Notes, Practice Test, Questions and Answers - cscentral
    Study Notes, Practice Test, Questions and Answers - diamondlabeling
    Syllabus, Study Notes, Practice Test, Questions and Answers - diamondfp
    Updated Syllabus, Study Notes, Practice Test, Questions and Answers - freshfilter.cl
    New Syllabus, Study Notes, Practice Test, Questions and Answers - ganeshdelvescovo.eu
    Syllabus, Study Notes, Practice Test, Questions and Answers - ganowebdesign.com
    Study Guides, Practice Exams, Questions and Answers - Gimlab
    Latest Study Guides, Practice Exams, Real Questions and Answers - GisPakistan
    Latest Study Guides, Practice Exams, Real Questions and Answers - Health.medicbob
    Killexams Certification Training, Q&A, Dumps - kamerainstallation.se
    Killexams Syllabus, Killexams Study Notes, Killexams Practice Test, Questions and Answers - komsilanbeagle.info
    Pass4sure Brain Dump, Study Notes, Pass4sure Practice Test, Killexams Questions and Answers - levantoupoeira
    Pass4sure Braindumps, Study Notes, Pass4sure Practice Test, Killexams Questions and Answers - mad-exploits.net
    Pass4sure Braindumps, Study Notes, Pass4sure Practice Test, Killexams Questions and Answers - manderije.nl
    Pass4sure study guides, Braindumps, Study Notes, Pass4sure Practice Test, Killexams Questions and Answers - manderije.nl
    Pass4sure Exams List - mida12.com.br
    Braindumps and Pass4sure Exams Download Links - milehighmattress
    Exams Study Guides Download Links - morganstudioonline
    Study Guides Download Links - n1estudios.com
    Pass4sure Study Guides Download Links - netclique.pt
    Killexams Exams Download Links - nrnireland.org
    Study Guides Download Links - partillerocken.com
    Certification Exams Download Links - pixelcoding
    Certificaiton Exam Braindumps Download Links - porumbeinunta
    Brain Dumps and Study Guides Links - prematurisinasce.it
    Pass4sure Brain Dumps - nicksmagic.com
    Quesitons and Answers - recuperacion-disco-duro.com
    Exam Questions and Answers with Simulator - redwest.se
    Study Guides and Exam Simulator - sarkic.com
    Pass4sure Study Guides and Exam Simulator - shadowNET
    Killexams Study Guides and Exam Simulator - simepe.com.br
    Killexams Study Guides and Exam Simulator - skinlove.nl
    Pass4Sure Study Guides and Exam Simulator - marinedubai.com/
    Pass4Sure QA and Exam Simulator - brandtsleeper/
    Pass4Sure Q&A and Exam Simulator - risingeagleproductions/
    VCE examcollection and Exam Simulator - starvinmarv/
    Collection of Certification Exam Study Guides - studyguidecourses


    Speed Marketing India (c) 2017