A gray release and logical rollback system for configuration parameters of an optical module

Abstract

The present application relates to the field of optical communication technology, disclose a kind of grey release and logic rollback system of optical module configuration parameter, solve the technical problem that current optical module parameter configuration has no parameter grey verification and risk isolation, rollback action is strongly dependent on host, single dimension of fault identification, the present application is realized the physical isolation and hierarchical backup of configuration parameter by four-stage register architecture, prohibit host to directly rewrite effective register from hardware level, avoid unprotected configuration operation;By preloading-grey verification-permanent effect three stages, realize the phased risk control of parameter configuration;Through multidimensional total health score, realize the accurate identification of link fault, distinguish transient fluctuation and permanent fault;Through timeout confirmation timer, realize the bottom rollback trigger under the management channel failure scenario;Three kinds of trigger mode are executed three-level hierarchical rollback, realize the non-intervention self-recovery of fault scenario, guarantee the reliability and success rate of rollback process.

Description

Technical Field

[0001] This invention relates to the field of optical communication technology, and in particular to a grayscale release and logical rollback system for optical module configuration parameters. Background Technology

[0002] Currently, remote parameter tuning of high-speed optical modules has become a core part of routine operation and maintenance in scenarios such as data center interconnection and telecommunications bearer networks. Existing optical module parameter configuration technologies are mainly divided into three categories:

[0003] The first type is the direct overwrite configuration scheme, where the host directly writes the new configuration parameters into the working register of the optical module through management interfaces such as I2C and MDIO, and the parameters take full effect immediately.

[0004] The second type is the dual-partition firmware backup solution, which divides the optical module firmware into a primary partition and a backup partition. When the primary partition firmware fails to boot, it automatically switches to the backup partition for booting. This solution can only handle firmware corruption or boot anomalies and cannot cope with link interruptions caused by incorrect parameter configuration.

[0005] The third type is the host-dependent rollback solution, where the optical module relies on the host to issue a rollback command to restore the parameter configuration before the failure. The prerequisite for the rollback operation is that both the management channel and the service channel are in normal condition.

[0006] Therefore, existing technologies have technical problems:

[0007] 1. New configuration parameters are written and applied directly without phased risk control. If parameters are incorrect or combinations are mismatched, the link will be interrupted immediately.

[0008] 2. After the link is interrupted, the management channel often fails at the same time, and the rollback command issued by the host cannot be delivered to the optical module, resulting in an irreversible failure of one-click lock-up.

[0009] 3. Relying solely on simple indicators such as link connectivity to determine faults cannot distinguish between transient fluctuations and permanent faults, resulting in a high rate of false rollbacks. Summary of the Invention

[0010] The purpose of this invention is to address the technical problems of existing optical module parameter configurations, such as lack of parameter grayscale verification and risk isolation, strong host dependence on rollback operations, and single fault identification dimension, by providing a grayscale release and logical rollback system for optical module configuration parameters.

[0011] To achieve the above-mentioned objectives, the embodiments of the present invention provide the following technical solutions:

[0012] A system for canary deployment and logical rollback of optical module configuration parameters includes a register management module, a canary deployment control module, a link health self-check module, a timeout confirmation timer module, a logical rollback execution module, a non-volatile parameter storage module, and an event log and reporting module.

[0013] The register management module abstracts the configurable registers of the physical layer devices into a four-level register architecture in the address space of the MCU chip, and establishes the address mapping relationship between the registers at each level.

[0014] The grayscale release control module belongs to the core control layer. It constrains the execution prerequisites of host interaction instructions through a state machine and adjusts the new configuration parameters of the four-level registers for health and fault management of the business link.

[0015] The link health self-check module obtains the total health score for each sampling period based on the core monitoring indicators, distinguishes consecutive total health scores through a sliding window queue, and reports link failures to the gray release control module based on hardware anomalies and consecutive total health scores.

[0016] The timeout confirmation timer module stores the configuration rules for the timeout window, confirms the timeout window duration of the timeout confirmation timer according to the configuration rules, and starts or stops the timeout confirmation timer through the signal of the grayscale release control module.

[0017] The logic rollback execution module performs a three-level rollback through different triggering modes, overwrites the new configuration parameters of the fourth-level register, and restores the health of the business link.

[0018] The non-volatile parameter storage module uses the Flash storage chip built into the optical module to divide different storage partitions, and manages the erase and write operations of the storage partitions through static wear leveling.

[0019] The event log and reporting module records the event log for each new configuration parameter event. The host reads the event log through the management interface and reports alarm information to the host through the management interface when the state machine changes or when an abnormal event occurs.

[0020] Compared with existing technologies, the beneficial effects of this invention are as follows: It achieves physical isolation and hierarchical backup of configuration parameters through a four-level register architecture, prohibiting the host from directly rewriting the effective register at the hardware level and avoiding unprotected configuration operations from the source; it achieves phased risk management of parameter configuration through a three-stage state machine of preloading, gray-scale verification, and permanent effectiveness; it achieves accurate identification of link faults and distinguishes between transient fluctuations and permanent faults through a multi-dimensional total health score specific to optical module services; it achieves fallback rollback triggering in management channel failure scenarios through a timeout confirmation timer, solving the technical problem of rollback command failure; it achieves uninterrupted autonomous recovery in fault scenarios through three trigger modes of three-level hierarchical rollback, ensuring the reliability and success rate of the rollback process; the entire system is implemented at the firmware level, requiring no modification to the optical module hardware design and is compatible with existing high-speed optical module architectures.

[0021] Furthermore, a grayscale release and logical rollback system for optical module configuration parameters includes a four-level register group comprising a working register group, a shadow register group, a historical best register group, and a factory default register group.

[0022] The working register group serves as the effective register for the real-time operation of the optical module service link, and all operating parameters of the service link are completely determined by the values ​​of the working register group.

[0023] The shadow register group serves as the sole entry point for writing new configuration parameters to the host and as a preloaded cache, thereby achieving physical isolation between the new configuration parameters and the current service link.

[0024] The historical best register group serves as a backup area for host configuration parameters, storing historical best parameters.

[0025] The factory default register group serves as a backup area for parameters fixed at the factory when the optical module leaves the factory, storing default factory parameters.

[0026] Furthermore, a grayscale release and logical rollback system for optical module configuration parameters is provided. The storage medium of the working register group is the physical layer chip's built-in register. The address mapping rule of the working register group forms a completely direct mapping with the physical address of the configurable register of the physical layer device, which is the physical address that takes effect in real time for the physical layer device. The host read and write permissions of the working register group are completely prohibited, and the firmware read and write permissions of the working register group are the highest permissions. Only atomic full synchronous read and write is supported, and discrete writing of a single working register or a part of the working registers is not supported.

[0027] The storage medium of the shadow register group is the static random access memory built into the MCU chip. The address mapping rule of the shadow register group is a 1:1 linear mapping with the address of the working register group. The host read and write permissions of the shadow register group are open write permissions and prohibited read permissions. The firmware read and write permissions of the shadow register group are full read and write permissions. It supports performing three-level verification on new configuration parameters written to the host and supports atomically synchronizing all parameters of the shadow register group to the working register group.

[0028] The storage medium of the historical best register group is the non-volatile memory built into the MCU chip. The address mapping rule of the historical best register group is a 1:1 linear mapping with the address of the working register group. The host read and write permissions of the historical best register group are open read permissions and prohibited write permissions. The firmware read and write permissions of the historical best register group are limited to write permissions when the new configuration parameters of the working register group take effect permanently, and read permissions are limited to full read permissions when the logic rollback execution module triggers the trigger mode.

[0029] The storage medium of the factory default register group is the one-time programmable memory built into the optical module. The address mapping rule of the factory default register group is linearly mapped to the address of the working register group in a 1:1 ratio. The host read and write permissions of the factory default register group are open read permissions and prohibited write permissions. The firmware read and write permissions of the factory default register group are to be executed when the logic rollback execution module triggers a second-level rollback.

[0030] Furthermore, a grayscale release and logical rollback system for optical module configuration parameters is provided, wherein the host interaction commands include parameter preloading commands, grayscale activation commands, health confirmation commands, manual rollback commands, parameter backup commands, and timeout window configuration commands.

[0031] The parameter preloading instruction is used by the host to write new configuration parameters to the shadow register group. The execution of the parameter preloading instruction is premised on the optical module being in an idle state.

[0032] The grayscale activation command is used to perform grayscale verification on the new configuration parameters, and the new configuration parameters officially take effect. The prerequisite for executing the grayscale activation command is that the optical module is in a preload ready state.

[0033] The health confirmation command is used by the host to confirm the health of the service link to the optical module, triggering the new configuration parameters to take effect permanently. The prerequisite for the gray-scale activation command is that the optical module is in gray-scale verification state and the timeout confirmation timer countdown has not ended.

[0034] The manual rollback command is used by the host to trigger a manual rollback, restoring the historical optimal register set to the historical optimal parameters. The prerequisite for executing the manual rollback command is that the optical module is in the rollback execution state.

[0035] The parameter backup command is used by the host to manually trigger the backup of new configuration parameters to the historical best register group. The execution of the parameter backup command is premised on the optical module being in an idle state and the service link being continuously healthy.

[0036] The timeout window configuration instruction is used by the host to configure the timeout window duration for grayscale verification. The execution of the timeout window configuration instruction is premised on the optical module being in an idle state.

[0037] Furthermore, a grayscale release and logical rollback system for optical module configuration parameters is provided, wherein the state machine includes an idle state, a preload state, a grayscale verification state, a rollback execution state, and a permanent effective state.

[0038] The idle state means that the host has not been configured with parameters, the operating parameters of the service link are the best historical parameters, and the service link is continuously healthy;

[0039] The preload state is when the firmware performs a three-level verification of the new configuration parameters, and the operating parameters of the business link are the stored historical optimal parameters;

[0040] The preload ready state is to wait for the host to issue a grayscale activation instruction and lock the write permission of the shadow register group;

[0041] The grayscale verification state involves fully synchronizing the new configuration parameters of the shadow register group to the working register group, the firmware sending a start signal to the link health self-check module, synchronously starting the timeout confirmation timer, starting a countdown according to the timeout window duration, and locking the write permissions of all registers.

[0042] The permanent effective state means that the new configuration parameters are permanently effective. A stop signal is sent to the link health self-check module, the timeout confirmation timer is stopped synchronously, the new configuration parameters of the working register group are fully synchronized to the historical best register group, written to the Flash storage chip, the corresponding CRC32 check code is updated, the write permission of all registers is unlocked, a configuration success response is returned to the host, and the event log and reporting module is called.

[0043] Furthermore, in a grayscale release and logical rollback system for optical module configuration parameters, the entry condition for the idle state is: the optical module power-on initialization is completed, the parameter configuration is completed, and the three-level hierarchical rollback execution is completed; the jump condition for the idle state is: the firmware has received the host's parameter preloading instruction, the new configuration parameters have been written into the shadow register group, and the system jumps to the preloading state.

[0044] The transition conditions for the preload state are as follows: when the level 3 check passes, a preload success response is returned to the host, and the process jumps to the preload ready state; when the level 3 check fails, a preload failure response is returned to the host, the new configuration parameters of the shadow register group are cleared, and the process jumps to the idle state.

[0045] The transition conditions for the preload ready state are as follows: if the firmware has received the grayscale activation instruction from the host, the session ID of the grayscale activation instruction matches the session ID of the preload instruction, and the host has not timed out when issuing the grayscale activation instruction, then it will transition to the grayscale verification state; if the firmware times out when it receives the grayscale activation instruction from the host or does not receive the grayscale activation instruction from the host, then it will clear the new configuration parameters of the shadow register group and transition to the idle state.

[0046] The transition conditions for the grayscale verification state are as follows: when a link fault report is received from the link health self-check module, an immediate fault rollback is triggered, and the system transitions to the rollback execution state; when no health confirmation instruction is received before the timeout confirmation timer expires, a timeout fallback rollback is triggered, and the system transitions to the rollback execution state; when a health confirmation instruction is received before the timeout confirmation timer expires and the link remains healthy, the system transitions to the permanent effective state; when a manual rollback instruction is received from the host, the system transitions to the rollback execution state.

[0047] The transition condition for the permanent effective state is: after the firmware returns a configuration success response to the host, it transitions to the idle state.

[0048] Furthermore, a grayscale release and logical rollback system for optical module configuration parameters, wherein the link health self-check module includes a total health score acquisition submodule, a health status determination submodule, and a self-check anomaly fallback submodule;

[0049] The total health score acquisition submodule acquires core monitoring indicators and obtains the total health score for the current sampling period based on the core monitoring indicators;

[0050] The health status determination submodule stores the total health score into a sliding window queue in a first-in-first-out order. Based on the sliding window queue, it determines whether the optical module's service link is healthy. The determination criteria are as follows:

[0051] If the total health score in the sliding window queue is continuously less than 0.6, the link failure will be reported to the canary release control module.

[0052] If a total health score in the sliding window queue is greater than 0.6 but less than 0.8, a degradation warning will be reported to the host.

[0053] If the total health score in the sliding window queue is continuously greater than 0.8, the link remains healthy and will not be actively reported.

[0054] If a reading failure, sampling interruption, or data abnormality occurs when the self-checking anomaly fallback submodule performs hardware register reading in each sampling cycle, it will automatically retry 3 times. If the retry is successful, it will continue to obtain the total health score of the current sampling cycle normally. If all 3 retry attempts fail, it will be determined as a hardware abnormality and the link failure will be reported to the gray-scale release control module.

[0055] Furthermore, a grayscale release and logical rollback system for optical module configuration parameters, wherein the core monitoring indicators include physical layer signal hard fault indicators, data link layer bit error rate performance indicators, and management channel availability indicators;

[0056] The physical layer signal hard fault indicators include the receiver CDR signal lock status, the transmitting laser bias current, the transmitting optical power, and the receiving optical power.

[0057] The data link layer error rate performance indicators include the bit error rate before forward error correction, the bit error rate after forward error correction, and the number of code block synchronization losses.

[0058] The availability metrics for the management channel include the host interaction command response success rate and the communication timeout rate.

[0059] Furthermore, a grayscale release and logical rollback system for optical module configuration parameters, wherein the triggering modes include immediate fault rollback, timeout fallback rollback, and manual rollback;

[0060] The instant fault rollback is triggered by the link health self-check module reporting the link fault to the canary release control module.

[0061] The timeout fallback rollback is triggered if no confirmation health command is received when the timeout confirmation timer countdown ends;

[0062] The manual rollback is triggered by the host issuing a manual rollback command.

[0063] Furthermore, a grayscale release and logical rollback system for optical module configuration parameters, wherein the three-level hierarchical rollback includes first-level rollback, second-level rollback, and third-level rollback;

[0064] The first-level rollback is initiated during the rollback execution state. It locks the host's read and write permissions to all registers, the firmware reads the historical optimal parameters, verifies the CRC32 checksum associated with the historical optimal parameters, and if the verification passes, it atomically synchronizes the historical optimal parameters to the working register group and the shadow register group. The firmware sends a reset signal to the physical layer device to reset the service link, unlocks the host's read and write permissions to all registers, sends a stop signal to the link health self-check module, stops the timeout confirmation timer, and calls the event log and reporting module.

[0065] The secondary rollback is initiated after the primary rollback fails, and a link recovery verification window is launched to continuously monitor the overall health score through the link health self-check module.

[0066] If the total health score in the sliding window queue is continuously greater than 0.8, the first-level rollback is considered successful, and the link health self-check module is closed when the link recovery verification window ends.

[0067] If the total health score in the sliding window queue is continuously greater than 0.6 and less than 0.8, the first-level rollback is considered successful, a degradation warning is reported to the host, and the link health self-test module is closed when the link recovery verification window ends.

[0068] If the total health score in the sliding window queue is continuously less than 0.6, the first-level rollback is deemed to have failed. When the link recovery verification window ends, the link health self-test module is closed, the second-level rollback is initiated, the host's read and write permissions to all registers are locked, the default factory parameters of the factory default register group are read, and the CRC32 checksum associated with the default factory parameters is verified. If the verification passes, the default factory parameters are fully and atomically synchronized to the working register group, shadow register group, and historical best register group. The firmware sends a reset signal to the physical layer device to reset the service link, unlocks the host's read and write permissions to all registers, and calls the event log and reporting module.

[0069] The third-level rollback is initiated after the second-level rollback fails, and a link recovery verification window is launched to continuously monitor the overall health score through the link health self-check module.

[0070] If the total health score in the sliding window queue is continuously greater than 0.8, the second-level rollback is considered successful, and the link health self-check module is closed when the link recovery verification window ends.

[0071] If the total health score in the sliding window queue is continuously greater than 0.6 and less than 0.8, the second-level rollback is considered successful, a degradation warning is reported to the host, and the link health self-test module is closed when the link recovery verification window ends.

[0072] If the total health score in the sliding window queue is continuously less than 0.6, the second-level rollback is deemed to have failed. When the link recovery verification window ends, the link health self-test module is closed, the third-level rollback is initiated, the event log and reporting module is called, the firmware sends a soft reset signal to the MCU chip and DSP chip, and performs a full hardware reset of the optical module. After the optical module restarts, it reads the default factory parameters of the factory default register group and verifies the CRC32 checksum associated with the default factory parameters. If the verification passes, the default factory parameters are fully and atomically synchronized to the working register group, the shadow register group, and the historical best register group. Attached Figure Description

[0073] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0074] Figure 1 A structural diagram of the grayscale release and logical rollback system for configuring parameters for optical modules. Detailed Implementation

[0075] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0076] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this invention, the terms "first," "second," etc., are used only for distinguishing descriptions and should not be construed as indicating or implying relative importance, or suggesting any such actual relationship or order between these entities or operations. Additionally, the terms "connected," "linked," etc., can refer to a direct connection between elements or an indirect connection via other elements.

[0077] This invention is achieved through the following technical solutions, such as... Figure 1 As shown, a grayscale release and logical rollback system for optical module configuration parameters includes a register management module, a grayscale release control module, a link health self-check module, a timeout confirmation timer module, a logical rollback execution module, a non-volatile parameter storage module, and an event log and reporting module.

[0078] The register management module belongs to the hardware abstraction layer. In the address space of the MCU chip, it abstracts the configurable registers of the physical layer devices into a four-level register architecture and establishes the address mapping relationship between the registers at each level.

[0079] It should be noted that the firmware running in the MCU chip of the optical module and the firmware running in the DSP chip of the system adopt a layered and decoupled architecture, which is divided into a hardware abstraction layer, a core control layer, a service verification layer, an execution layer, and a storage layer.

[0080] It is important to note that each register in the register management module is equipped with a 32-bit CRC32 checksum. The CRC32 checksum is stored in a bound manner with the register parameters. Before each read, write, or synchronization operation, the CRC32 checksum is checked first. Only parameters that pass the checksum can be read, written, or synchronized, in order to avoid secondary failures caused by parameter corruption.

[0081] The four-level registers include the Working Register Group (ARB), the Shadow Register Group (SRB), the History Best Register Group (HOB), and the Factory Default Register Group (FDB).

[0082] The working register group serves as the effective register for the real-time operation of the optical module service link, and all operating parameters of the service link are completely determined by the values ​​of the working register group.

[0083] The storage medium of the working register group is the built-in register of the physical layer chip. The address mapping rule of the working register group forms a completely direct mapping with the physical address of the configurable register of the physical layer device. It is the physical address that takes effect in real time for the physical layer device. The host read and write permissions of the working register group are completely prohibited. The firmware read and write permissions of the working register group are the highest permissions. Only atomic full synchronous read and write are supported. Discrete writing of a single working register or a part of the working registers is not supported.

[0084] The physical layer chip built-in registers are specifically real-time control registers located inside physical layer devices such as DSP chips, laser driver chips, CDR clock data recovery chips, and TEC temperature control chips.

[0085] It is important to note that completely prohibiting host read and write permissions means that the host cannot directly read or write the working register group through any management interface (including I2C, MDIO, and other management interfaces). The operating parameters can be understood as the parameters that the optical module is currently using in real time, which directly control the physical layer devices.

[0086] The shadow register group serves as the sole entry point for writing new configuration parameters to the host and as a preloaded cache, thereby achieving physical isolation between the new configuration parameters and the current service link.

[0087] The storage medium of the shadow register group is the static random access memory (SRAM) built into the MCU chip. The address mapping rule of the shadow register group is a 1:1 linear mapping with the address of the working register group. The host read and write permissions of the shadow register group are open write permissions and prohibited read permissions. The firmware read and write permissions of the shadow register group are full read and write permissions. It supports performing three-level verification on new configuration parameters written to the host and supports atomically synchronizing all parameters of the shadow register group to the working register group.

[0088] It is important to note that the address mapping rule of the shadow register group and the 1:1 linear mapping of the working register group address can be understood as each working register address corresponding to a unique shadow register address. Disabling read permissions can be understood as the host being unable to indirectly obtain the operating parameters of the working register group by reading the shadow register group. The new configuration parameters do not interfere with the real-time operation of the optical module service link at all.

[0089] The historical best register group serves as a backup area for host configuration parameters, storing historical best parameters.

[0090] The storage medium of the historical best register group is the non-volatile memory (Flash) built into the MCU chip. The address mapping rule of the historical best register group is a 1:1 linear mapping with the address of the working register group. The host read and write permissions of the historical best register group are open read permissions and prohibited write permissions. The firmware read and write permissions of the historical best register group are limited to write permissions when the new configuration parameters of the working register group take effect permanently, and read permissions are limited to full read permissions when the logic rollback execution module triggers the trigger mode.

[0091] It is important to note that the historical best register set is also the preferred recovery benchmark for the logic rollback execution module, and its non-volatile nature ensures that configuration parameters are not lost after power failure or restart.

[0092] The factory default register group serves as a backup area for parameters fixed at the factory when the optical module leaves the factory, storing default factory parameters.

[0093] The storage medium of the factory default register group is the optical module's built-in one-time programmable memory (OTP). The address mapping rule of the factory default register group is a 1:1 linear mapping with the address of the working register group. The host read and write permissions of the factory default register group are open read permissions and prohibited write permissions. The firmware read and write permissions of the factory default register group are to be executed when the logic rollback execution module triggers a second-level rollback.

[0094] It is important to note that the default factory parameters of the factory default register group are permanently stored and cannot be rewritten. This serves as the recovery baseline for the logic rollback execution module to perform a secondary rollback, ensuring that the optical module can be restored to its factory state at any time. After execution, the default factory parameters of the factory default register group are synchronized to the working register group.

[0095] With the above solution, when the host accesses the registers through any management interface, the firmware does not grant read or write permissions to the working register group at all, and cannot directly rewrite all the operating parameters of the service link. Instead, the firmware only grants write permissions to the shadow register group and the historical best register group, and read permissions to the historical best register group and the factory default register group. Furthermore, write permissions to the historical best register group are restricted and prohibited in any other state, ensuring the stability and reliability of the rollback baseline. All technical solutions are implemented in firmware, requiring no modification to the optical module hardware design and ensuring compatibility with the existing optical module architecture.

[0096] The grayscale release control module belongs to the core control layer. It constrains the execution prerequisites of host interaction instructions through a state machine and manages the new configuration parameters of the four-level registers based on the health and fault management of the business link.

[0097] The host interaction commands include parameter preloading commands, gray-scale activation commands, health confirmation commands, manual rollback commands, parameter backup commands, and timeout window configuration commands.

[0098] The parameter preloading instruction is used by the host to write new configuration parameters to the shadow register group. The execution of the parameter preloading instruction is premised on the optical module being in an idle state.

[0099] The grayscale activation command is used to perform grayscale verification on the new configuration parameters, and the new configuration parameters officially take effect. The prerequisite for executing the grayscale activation command is that the optical module is in a preload ready state.

[0100] The health confirmation command is used by the host to confirm the health of the service link to the optical module, triggering the new configuration parameters to take effect permanently. The prerequisite for the gray-scale activation command is that the optical module is in gray-scale verification state and the timeout confirmation timer countdown has not ended.

[0101] The manual rollback command is used by the host to trigger a manual rollback, restoring the historical optimal register set to the historical optimal parameters. The prerequisite for executing the manual rollback command is that the optical module is in the rollback execution state.

[0102] The parameter backup command is used by the host to manually trigger the backup of new configuration parameters to the historical best register group. The execution of the parameter backup command is premised on the optical module being in an idle state and the service link being continuously healthy.

[0103] The timeout window configuration instruction is used by the host to configure the timeout window duration for grayscale verification. The execution of the timeout window configuration instruction is premised on the optical module being in an idle state.

[0104] The state machine includes an idle state, a preload state, a grayscale verification state, a rollback execution state, and a permanent effective state.

[0105] The idle state means that the host has not been configured with parameters, the operating parameters of the service link are the best historical parameters, and the service link is continuously healthy;

[0106] The conditions for entering the idle state are: the optical module power-on initialization is completed, the parameter configuration is completed (success / failure), and the three-level rollback execution is completed; the conditions for jumping to the idle state are: the firmware has received the host's parameter preloading instruction, the new configuration parameters have been written into the shadow register group, and the jump is to the preloading state.

[0107] The preload state is when the firmware performs a three-level verification of the new configuration parameters, and the operating parameters of the business link are the stored historical optimal parameters;

[0108] It should be noted that the parameter preloading command, parameter backup command, and timeout window configuration command are only received in the idle state. In other states, configuration permissions are locked to avoid concurrent operations.

[0109] The transition conditions for the preload state are as follows: when the level 3 check passes, a preload success response is returned to the host, and the process jumps to the preload ready state; when the level 3 check fails, a preload failure response is returned to the host, the new configuration parameters of the shadow register group are cleared, and the process jumps to the idle state.

[0110] It should be noted that because the operating parameters of the business link are the best historical parameters stored during the preload state, the new configuration parameters have not yet taken effect, so there will be no impact on the business.

[0111] The three-level verification includes CRC32 check code verification, parameter value range verification, and parameter combination compliance verification.

[0112] The CRC32 checksum verifies that the value of the new configuration parameter matches and there are no transmission bit errors.

[0113] The parameter value range verification shows that all newly configured parameters are within the minimum and maximum ranges set in the physical layer device datasheet, with no parameters exceeding the range.

[0114] The parameter combination compliance verification shows that the combination of new configuration parameters (which includes multiple parameter items) conforms to the optical module hardware specifications and that the combination has no mutually exclusive parameters or logical conflicts (such as conflicts between transmit shutdown and transmit power tuning parameters, or conflicts between forward error correction (FEC) shutdown and high bit error rate adaptation parameters).

[0115] The preload ready state is to wait for the host to issue a grayscale activation instruction and lock the write permission of the shadow register group;

[0116] The transition conditions for the preload ready state are as follows: if the firmware has received the grayscale activation instruction from the host, the session ID of the grayscale activation instruction matches the session ID of the preload instruction, and the host has not timed out when issuing the grayscale activation instruction, then it will transition to the grayscale verification state; if the firmware times out when receiving the grayscale activation instruction from the host (e.g., 30s) or does not receive the grayscale activation instruction from the host, then it will clear the new configuration parameters of the shadow register group and transition to the idle state.

[0117] It is important to note that once locked, the host cannot write new configuration parameters to modify the shadow register group again, thus preventing the new configuration parameters that have undergone three levels of verification from being tampered with. Timeout checks prevent configuration permissions from being locked for an extended period.

[0118] The grayscale verification state involves fully synchronizing the new configuration parameters of the shadow register group to the working register group, the firmware sending a start signal to the link health self-check module, synchronously starting the timeout confirmation timer, starting a countdown according to the timeout window duration, and locking the write permissions of all registers.

[0119] It is important to note that locking write permissions for all registers ensures that the firmware only accepts health confirmation commands and manual rollback commands, thus preventing chaos caused by concurrent operations.

[0120] The transition conditions for the grayscale verification state are as follows: when a link fault report is received from the link health self-check module, an immediate fault rollback is triggered, and the system transitions to the rollback execution state; when no health confirmation instruction is received before the timeout confirmation timer expires, a timeout fallback rollback is triggered, and the system transitions to the rollback execution state; when a health confirmation instruction is received before the timeout confirmation timer expires and the link remains healthy, the system transitions to the permanent effective state; when a manual rollback instruction is received from the host, the system transitions to the rollback execution state.

[0121] The permanent effective state means that the new configuration parameters are permanently effective. A stop signal is sent to the link health self-check module, the timeout confirmation timer is stopped synchronously, the new configuration parameters of the working register group are fully synchronized to the historical best register group, written to the Flash storage chip, the corresponding CRC32 check code is updated, the write permission of all registers is unlocked, a configuration success response is returned to the host, and the event log and reporting module is called.

[0122] The transition condition for the permanent effective state is: after the firmware returns a configuration success response to the host, it transitions to the idle state.

[0123] In the above scheme, the canary release control module is responsible for the state management, instruction parsing, process scheduling and exception handling of the new configuration parameters throughout the entire process. It has created a unique three-stage closed-loop state machine of preloading-canary verification-permanent effect, replacing the unprotected two-state mode of direct writing-immediate effect in the existing technology, realizing full-process risk management of new configuration parameters. The host interaction instructions are all based on the optical module standard I2C / MDIO protocol extension, which is compatible with existing host hardware and systems and does not require modification of host hardware design. The state machine transitions have clear trigger conditions and exception fallback logic, with no state transition dead zones, ensuring full process controllability.

[0124] The link health self-check module belongs to the business verification layer. It obtains the total health score for each sampling period based on the core monitoring indicators, distinguishes continuous total health scores through a sliding window queue, and reports link failures to the canary release control module based on hardware anomalies and continuous total health scores.

[0125] The link health self-check module includes a total health score acquisition submodule, a health status determination submodule, and a self-check anomaly fallback submodule.

[0126] The total health score acquisition submodule acquires core monitoring indicators and obtains the total health score for the current sampling period based on these indicators, using the following formula:

[0127] ;

[0128] in, The overall health score for the current sampling period. The CDR signal is locked in the current sampling period. This is the bias current of the emitted laser during the current sampling period. The transmitted optical power during the current sampling period, The received optical power for the current sampling period. The bit error rate before error correction in the forward error correction code of the current sampling period. The bit error rate after forward error correction by the error correction code in the current sampling period. This represents the number of code block synchronization losses in the current sampling period. This represents the host interaction command response success rate for the current sampling period. Communication timeout rate for the current sampling period

[0129] In this example, the sampling period is 1ms.

[0130] The core monitoring metrics include physical layer signal hard fault metrics, data link layer bit error rate performance metrics, and management channel availability metrics.

[0131] The physical layer signal hard fault indicators include the receiver CDR signal lock status, the transmitting laser bias current, the transmitting optical power, and the receiving optical power.

[0132] The CDR signal lock status is read from the CDR chip's lock status register according to the current sampling period, with 1 when locked and 0 when unlocked;

[0133] The laser emission bias current is read from the ADC register of the laser driver chip at the sampling period to determine whether it is within the normal threshold of the physical layer device datasheet. If it exceeds the normal threshold range, it is 0; if it does not exceed the normal threshold range, it is 1.

[0134] The transmitted optical power is read from the optical power monitoring ADC register built into the optical module at the sampling period to determine whether it is within the normal operating threshold. If it exceeds the normal operating threshold, the value is 0; if it does not exceed the normal threshold, the value is 1.

[0135] The received optical power is read from the optical power monitoring ADC register at the receiving end according to the sampling period, and it is determined whether it is within the sensitivity and overload threshold. If it exceeds the sensitivity and overload threshold, it is 0; if it does not exceed the sensitivity and overload threshold, it is 1.

[0136] The data link layer error rate performance metrics include the bit error rate before forward error correction, the bit error rate after forward error correction, and the number of code block synchronization losses.

[0137] The bit error rate before error correction of the forward error correction code is read from the bit error statistics register of the DSP chip during the current sampling period. If it exceeds... =0, if not exceeding =1;

[0138] The bit error rate (BER) after forward error correction (FEC) is read from the DSP chip's bit error rate statistics register for the current sampling period. If it exceeds... =0, if not exceeding =1;

[0139] The number of code block synchronization loss is calculated from the DSP chip within the most recent sliding window (10ms) based on the sampling period. If the number of accumulated code block synchronization loss is greater than or equal to 5, it is 0; if the number of accumulated code block synchronization loss is less than 5, it is 1.

[0140] The availability metrics of the management channel include host interaction command response success rate and communication timeout rate;

[0141] The host interaction command response success rate is calculated by counting the number of successful host interaction command responses within a sliding statistical window (the most recent 100) during the sampling period, and the formula for the host interaction command response success rate during the current sampling period is as follows:

[0142] ;

[0143] in, To obtain the maximum value, To round down, The number of successful responses to host interaction commands within the sliding statistics window (0-100).

[0144] It is important to note that For every 10% reduction That is, reduce by 0.2, with a minimum of 0.

[0145] The communication timeout rate is calculated by counting the number of communication timeouts within a sliding statistical window (the most recent 100 records) during the sampling period, and the formula for the current sampling period is as follows:

[0146] ;

[0147] in, This represents the number of communication timeouts (0-100) within the sliding statistics window.

[0148] The health status determination submodule stores the total health score into a sliding window queue in a first-in-first-out order. Based on the sliding window queue, it determines whether the optical module's service link is healthy. The determination criteria are as follows:

[0149] If the total health score in the sliding window queue is continuously less than 0.6, the link failure will be reported to the canary release control module.

[0150] If a total health score in the sliding window queue is greater than 0.6 but less than 0.8, a degradation warning will be reported to the host.

[0151] If the total health score in the sliding window queue is continuously greater than 0.8, the link remains healthy and will not be actively reported.

[0152] In this embodiment, the sliding window queue consists of the most recent 10 sampling periods. To avoid accidental rollbacks caused by occasional events such as fiber jitter, instantaneous interference, and bit error spikes, the state machine jumps to the rollback execution state when the value of the 10 sampling periods is continuously less than 0.6. Instantaneous fluctuations, however, will be reported to the host as a degradation warning, and the rollback execution state will not be jumped.

[0153] If a reading failure, sampling interruption, or data abnormality occurs when the self-checking anomaly fallback submodule performs hardware register reading in each sampling cycle, it will automatically retry 3 times. If the retry is successful, it will continue to obtain the total health score of the current sampling cycle normally. If all 3 retry attempts fail, it will be determined as a hardware abnormality and the link failure will be reported to the gray-scale release control module.

[0154] It is important to note that the self-test anomaly fallback submodule is included to prevent link faults from being missed due to self-test failure.

[0155] In the above scheme, the link health self-check module is responsible for the real-time collection, judgment and fault reporting of the health status of the optical module service link in all dimensions. It has created a unique multi-dimensional weighted total health score and sliding window anti-shake mechanism (sliding window queue) for the characteristics of optical module services. All indicators are collected directly from the hardware registers by the optical module firmware in real time, without relying on host reporting, and are completely autonomous and controllable, providing accurate triggering basis for the logic rollback execution module.

[0156] The timeout confirmation timer module belongs to the core control layer. It stores the configuration rules of the timeout window, determines the timeout window duration of the timeout confirmation timer according to the configuration rules of the timeout window, and starts or stops the timeout confirmation timer through the signal of the gray-scale release control module.

[0157] The timeout confirmation timer is implemented using a hardware timer built into the optical module MCU chip, and the clock source is a high-precision crystal oscillator external to the MCU chip.

[0158] It is important to note that the timeout confirmation timer has a timing accuracy of up to 1ms and is not affected by software interrupts or program execution of the MCU chip, ensuring timing accuracy and avoiding false triggering caused by timing deviations of the software timer.

[0159] The rules for the timeout window include the configuration range, the timeout window duration, and the configuration activation rules;

[0160] The configuration range is 100ms-30s, with a step size of 100ms; the default timeout window duration is 5s; the configuration activation rule is that the timeout window duration issued by the host is verified by the firmware and then written to the Flash storage chip.

[0161] In the embodiments, the long-distance transmission optical module (with a long link lock time) can be configured with a timeout window of 10s to 30s, and the data center multimode short-distance optical module can be configured with a timeout window of 100ms to 5s.

[0162] It should be noted that the timeout window duration is not lost after the optical module loses power or restarts after being written to the Flash storage chip, and will be automatically used during the next grayscale verification.

[0163] When the grayscale release control module enters the grayscale verification state, the timeout confirmation timer starts counting down according to the timeout window duration, decreasing in 1ms increments. If the host sends a confirmation health command, the grayscale release control module receives and verifies the confirmation health command, sends a stop signal to the timeout confirmation timer module, and the timeout confirmation timer stops counting down and the timeout window duration is cleared.

[0164] It is important to note that the timeout confirmation timer will only stop counting down if the health command meets the following conditions:

[0165] 1. Confirm that the session ID of the health command and the session ID of the preload command are consistent;

[0166] 2. Confirm that the CRC32 checksum of the health command has been verified.

[0167] 3. Confirm that the health command's permission verification has passed;

[0168] 4. Confirm that the health command is sent to the grayscale release control module before the timeout confirmation timer countdown.

[0169] It should be noted that the timeout confirmation timer is in a stopped and cleared state in other states to avoid accidental triggering.

[0170] In the above solution, if the host cannot issue a health confirmation command, it means that the management channel has failed. The optical module does not need to wait for the host command and can automatically perform the rollback, which fundamentally solves the technical problem that the rollback of the existing technology is heavily dependent on the host channel.

[0171] The logic rollback execution module belongs to the execution layer. Through different triggering modes, it performs a three-level rollback to restore the health of the business chain.

[0172] The triggering modes include immediate fault rollback, timeout fallback rollback, and manual rollback.

[0173] The instant fault rollback is triggered by the link health self-check module reporting the link fault to the canary release control module.

[0174] The timeout fallback rollback is triggered if no confirmation health command is received when the timeout confirmation timer countdown ends;

[0175] The manual rollback is triggered by the host issuing a manual rollback command.

[0176] It is important to note that immediate fault rollback enables rapid response to business link failures caused by new configuration parameters, timeout fallback rollback provides fallback protection for timeliness in management channel scenarios, and manual rollback enables manual intervention by operations and maintenance personnel.

[0177] The three-level rollback includes level one rollback, level two rollback, and level three rollback.

[0178] The first-level rollback is initiated during the rollback execution state. It locks the host's read and write permissions to all registers, the firmware reads the historical optimal parameters, verifies the CRC32 checksum associated with the historical optimal parameters, and if the verification passes, it atomically synchronizes the historical optimal parameters to the working register group and the shadow register group. The firmware sends a reset signal to the physical layer device to reset the service link, unlocks the host's read and write permissions to all registers, sends a stop signal to the link health self-check module, stops the timeout confirmation timer, and calls the event log and reporting module.

[0179] It is important to note that locking the host's read and write permissions to all registers prohibits any external operations, ensuring that the first-level rollback is not interrupted. The historical optimal parameters are atomically synchronized to the working register group and shadow register group to overwrite the erroneous new configuration parameters and restore the healthy operation before the configuration.

[0180] The secondary rollback is initiated after the primary rollback fails, and a link recovery verification window (50ms) is started, continuously monitoring the total health score through the link health self-check module.

[0181] If the total health score in the sliding window queue is continuously greater than 0.8, the first-level rollback is considered successful, and the link health self-check module is closed when the link recovery verification window ends.

[0182] If the total health score in the sliding window queue is continuously greater than 0.6 and less than 0.8, the first-level rollback is considered successful, a degradation warning is reported to the host, and the link health self-test module is closed when the link recovery verification window ends.

[0183] If the total health score in the sliding window queue is continuously less than 0.6, the first-level rollback is deemed to have failed. When the link recovery verification window ends, the link health self-test module is closed, the second-level rollback is initiated, the host's read and write permissions to all registers are locked, the default factory parameters of the factory default register group are read, and the CRC32 checksum associated with the default factory parameters is verified. If the verification passes, the default factory parameters are fully and atomically synchronized to the working register group, shadow register group, and historical best register group. The firmware sends a reset signal to the physical layer device to reset the service link, unlocks the host's read and write permissions to all registers, and calls the event log and reporting module.

[0184] The third-level rollback is initiated after the second-level rollback fails, and a link recovery verification window (100ms) is started. The link health self-check module continuously monitors the total health score.

[0185] If the total health score in the sliding window queue is continuously greater than 0.8, the second-level rollback is considered successful, and the link health self-check module is closed when the link recovery verification window ends.

[0186] If the total health score in the sliding window queue is continuously greater than 0.6 and less than 0.8, the second-level rollback is considered successful, a degradation warning is reported to the host, and the link health self-test module is closed when the link recovery verification window ends.

[0187] If the total health score in the sliding window queue is continuously less than 0.6, the second-level rollback is deemed to have failed. When the link recovery verification window ends, the link health self-test module is closed, the third-level rollback is initiated, the event log and reporting module is called, the firmware sends a soft reset signal to the MCU chip and DSP chip, and performs a full hardware reset of the optical module. After the optical module restarts, it reads the default factory parameters of the factory default register group and verifies the CRC32 checksum associated with the default factory parameters. If the verification passes, the default factory parameters are fully and atomically synchronized to the working register group, the shadow register group, and the historical best register group.

[0188] The above solution features a unique three-trigger mode and three-level rollback mechanism to ensure rapid and reliable recovery to an available state in the event of a service link failure. Level 1 rollback is the preferred recovery solution, Level 2 rollback is the fallback solution if Level 1 rollback fails, and Level 3 rollback is the final fallback solution if Level 2 rollback fails. All register synchronization operations are performed, and the rollback process is completely shielded from external interruptions and host read / write operations to ensure that the rollback execution is not interrupted. All register synchronization operations are completed in a single clock cycle, with no intermediate state of partial parameter writing, avoiding service link anomalies caused by partial parameter writing. Before each parameter synchronization, a checksum verification is performed, and only parameters that pass the verification can be synchronized to avoid secondary failures caused by writing corrupted parameters.

[0189] The non-volatile parameter storage module belongs to the storage layer. It uses the Flash storage chip built into the optical module to divide different storage partitions and manages the erase and write operations of the storage partitions through static wear leveling.

[0190] The storage partitions include historical optimal parameter partitions, event log partitions, and configuration parameter partitions.

[0191] The historical optimal parameter partition stores the historical optimal parameters, the CRC32 checksum associated with the historical optimal parameters, and the effective time of the historical optimal parameters; the read and write rules for the historical optimal parameter partition are: write when the historical optimal parameters are permanently effective, and read when a three-level rollback is performed; the historical optimal parameter partition adopts dual-backup redundant storage, with the primary partition and backup partition addresses isolated;

[0192] The event log partition stores new configuration parameter events, rollback events, fault details, and business link status; the read / write rule for the event log partition is append-only, prohibiting modification of already written event logs, and supporting cyclic overwriting; the event log partition uses cyclic storage;

[0193] The configuration parameter partition stores the timeout window configuration value, permission configuration, and non-volatile parameter storage module operating parameters; the read and write rules of the configuration parameter partition are that the optical module can be modified when it is idle and automatically loaded when the optical module is powered on; the configuration parameter partition adopts dual backup redundant storage.

[0194] In this embodiment, the size of the historical best parameter partition is 4KB, the event log partition is 32KB and can store at least 1000 event logs, and the size of the configuration parameter partition is 1KB.

[0195] It is important to note that the historical optimal parameters are stored using an AES128 symmetric key, which is permanently stored in the MCU chip's OTP memory and cannot be read, thus preventing malicious tampering of the historical optimal parameters. The event log uses cyclic redundancy check, with each event log entry accompanied by a checksum, ensuring that the event log data is immutable and can be used for fault tracing.

[0196] The static wear leveling method includes: when updating the configuration parameter partition and the event log partition, distributing the erase and write operations evenly to each physical block of the Flash memory chip; automatically detecting bad physical blocks of the Flash memory chip, masking the addresses of bad physical blocks, and transferring the original erase and write operations to healthy physical blocks; and when updating the historical best parameter partition, using an incremental write mechanism, and only performing erase and write operations when the historical best parameters change.

[0197] In the above scheme, static wear leveling avoids frequent erasure and writing of individual physical blocks, ensuring storage reliability and reducing the number of erasure and writing cycles, thus extending the lifespan of the Flash storage chip; as a last resort, the Flash storage chip is responsible for the non-volatile storage of configuration parameters, event logs, and operating data after power failure, ensuring that the rollback baseline and fault logs are not lost after the optical module loses power and restarts.

[0198] The event log and reporting module belongs to the core control layer and records the event log for each new configuration parameter event. The host reads the event log through the management interface and reports alarm information to the host through the management interface when the state machine changes or when abnormal events occur (such as rollback events, link failures, parameter verification failures).

[0199] The event log includes parameter preloading, verification, gray-scale activation, overall health score, business link health determination, rollback event time, triggering reason, parameter changes, link status data, and execution results.

[0200] The abnormal event includes the fault type, fault details, and processing result.

[0201] It is important to note that each event in the new configuration parameter event includes a timestamp, event ID, event details, and checksum to ensure traceability. The event log and reporting module actively report the events, eliminating the need for host polling. The host can perform fault analysis and maintenance auditing by reading alarm information.

[0202] Example 2: The entire process of normal system gray-scale release and new configuration parameters

[0203] S1: After the optical module is powered on, the firmware of the MCU chip performs full system initialization, loads the four-level register architecture, initializes all modules, reads the historical best parameters from the historical best parameter partition of the Flash storage chip, verifies the CRC32 check code, and loads it into the working register group after the verification is successful. The optical module starts up, the service link runs, the initialization state machine enters the idle state, opens the instruction receiving permission of the host management interface, and waits for the host to issue configuration instructions.

[0204] S2: The host sends a parameter preloading instruction to the optical module through the I2C / MDIO management interface, along with the session ID, new configuration parameters, parameter length, and CRC32 checksum. After receiving the parameter preloading instruction, the firmware writes the new configuration parameters into the shadow register group without modifying the working register group. The current service link continues to operate normally with the historical optimal parameters, and the new configuration parameters are completely isolated from the service link.

[0205] S3: The firmware enters the preload state and performs three-level verification on the new configuration parameters in the shadow register group. If any level of verification fails, the firmware immediately clears the new configuration parameters in the shadow register group, returns a preload failure response to the host with the reason for the failure, and the state machine jumps back to the idle state, ending the process. If all three levels of verification pass, the firmware locks the write permission of the shadow register group, prohibits the host from modifying the new configuration parameters, returns a preload success response to the host, and the state machine jumps to the preload ready state.

[0206] S4: After the host receives the preload success response, it sends a grayscale activation command to the optical module. The command includes a session ID that is consistent with the parameter preload command. After the firmware receives the grayscale activation command, it verifies the session ID matching and checks the new configuration parameters. It immediately performs atomic parameter synchronization, fully synchronizing the new configuration parameters in the shadow register group to the working register group. The new configuration parameters officially take effect, and the state machine jumps to the grayscale verification state.

[0207] S5: After entering the grayscale verification state, the firmware starts the link health self-check module, starts the total health score calculation and judgment of the business link health according to the sampling period, and starts the timeout confirmation timer simultaneously. The countdown starts according to the duration of the timeout window. If no confirmation health instruction is received before the countdown ends, the timeout fallback is triggered.

[0208] S6: During the timeout window countdown, the link health self-check module continuously collects core monitoring indicators and calculates the total health score. The health status of the business link is judged by the continuous total health score. If the health score is less than 0.6 for 10 consecutive sampling periods, the link failure is reported to the canary release control module, triggering an immediate failure rollback and jumping to the rollback execution state. If the business link remains healthy, it waits for the host to confirm the health command.

[0209] S7: The host sends a health confirmation command to the optical module. The health confirmation command includes the session ID and CRC32 check code. After the firmware receives the health confirmation command, it verifies the session ID matching and check code verification. The health confirmation command is delivered before the countdown of the confirmation timer ends. The firmware immediately stops the timeout timer and the link health self-test module and clears the timing and sampling data.

[0210] S8: After receiving the health confirmation command, the new configuration parameters in the current working register group are fully synchronized to the historical best register group. At the same time, the historical best parameter partition of the Flash storage chip is written, the corresponding CRC32 check code and encrypted storage are updated, the persistent backup of the new configuration parameters is completed, the event log records the full-link event log of this configuration process, and writes it to the Flash storage chip.

[0211] S9: The firmware returns a configuration success response to the host, unlocks write permissions for all registers, and the state machine transitions back to the idle state, waiting for the next instruction from the host.

[0212] It is important to note that the host only needs to issue commands, while the entire process is autonomously controlled by the firmware.

[0213] The beneficial effects of this invention are as follows:

[0214] 1. This invention achieves intervention-free fault recovery in the event of management channel failure through an autonomous timeout rollback mechanism. The autonomous recovery rate of parameter configuration failures reaches 100%, eliminating irreversible lock-up failures caused by parameter configuration and filling a technological gap in the industry.

[0215] 2. The first-level rollback execution time of this invention is ≤1ms, which is far lower than the 50ms telecom-grade protection switching threshold of the ITU-T standard, and also far lower than the fault recovery time of several seconds to several hours in the prior art. The service is unaware of the rollback process and does not affect the normal operation of the service.

[0216] 3. The multi-dimensional weighted health score of this invention covers the core indicators of the entire optical module link. Combined with the 10ms sliding window anti-jitter mechanism, it can accurately identify 99.99% of link failures caused by parameter configuration, with a false rollback rate of less than 0.01%, thus balancing security and business stability.

[0217] 4. The three-level hierarchical rollback of this invention, combined with the four-level parameter backup architecture, realizes multiple backups and hierarchical recovery of parameters. Even if the historical optimal parameters are damaged, a fallback recovery can be completed through factory default parameters and hardware reset, with a rollback success rate of 99.999%, ensuring that the optical module is always in an available state.

[0218] 5. All technical solutions of this invention are implemented in firmware, without requiring any modification to the hardware design of the optical module. It is compatible with the MCU and DSP chips of all existing 100G / 400G / 800G / 1.6T optical modules and can be implemented directly through firmware upgrades without additional hardware costs.

[0219] 6. The event log of this invention fully records the entire process of parameter configuration and rollback, can save at least 1,000 historical logs, supports remote reading by the host, realizes full-link traceability of faults, and greatly reduces the difficulty of fault diagnosis for operation and maintenance personnel.

[0220] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A system for grayscale release and logical rollback of optical module configuration parameters, characterized in that, It includes a register management module, a canary release control module, a link health self-check module, a timeout acknowledgment timer module, a logic rollback execution module, a non-volatile parameter storage module, and an event log and reporting module. The register management module abstracts the configurable registers of the physical layer devices into a four-level register architecture in the address space of the MCU chip, and establishes the address mapping relationship between the registers at each level. The grayscale release control module belongs to the core control layer. It constrains the execution prerequisites of host interaction instructions through a state machine and adjusts the new configuration parameters of the four-level registers for health and fault management of the business link. The link health self-check module obtains the total health score for each sampling period based on the core monitoring indicators, distinguishes consecutive total health scores through a sliding window queue, and reports link failures to the gray release control module based on hardware anomalies and consecutive total health scores. The timeout confirmation timer module stores the configuration rules for the timeout window, confirms the timeout window duration of the timeout confirmation timer according to the configuration rules, and starts or stops the timeout confirmation timer through the signal of the grayscale release control module. The logic rollback execution module performs a three-level rollback through different triggering modes, overwrites the new configuration parameters of the fourth-level register, and restores the health of the business link. The non-volatile parameter storage module uses the Flash storage chip built into the optical module to divide different storage partitions, and manages the erase and write operations of the storage partitions through static wear leveling. The event log and reporting module records the event log for each new configuration parameter event. The host reads the event log through the management interface and reports alarm information to the host through the management interface when the state machine changes or when an abnormal event occurs.

2. The grayscale release and logical rollback system for optical module configuration parameters according to claim 1, characterized in that, The four-level registers include the working register group, the shadow register group, the historical best register group, and the factory default register group: The working register group serves as the effective register for the real-time operation of the optical module service link, and all operating parameters of the service link are completely determined by the values ​​of the working register group. The shadow register group serves as the sole entry point for writing new configuration parameters to the host and as a preloaded cache, thereby achieving physical isolation between the new configuration parameters and the current service link. The historical best register group serves as a backup area for host configuration parameters, storing historical best parameters. The factory default register group serves as a backup area for parameters fixed at the factory when the optical module leaves the factory, storing default factory parameters.

3. The grayscale release and logical rollback system for optical module configuration parameters according to claim 2, characterized in that, The storage medium of the working register group is the built-in register of the physical layer chip. The address mapping rule of the working register group forms a completely direct mapping with the physical address of the configurable register of the physical layer device. It is the physical address that takes effect in real time for the physical layer device. The host read and write permissions of the working register group are completely prohibited. The firmware read and write permissions of the working register group are the highest permissions. Only atomic full synchronous read and write are supported. Discrete writing of a single working register or a part of the working registers is not supported. The storage medium of the shadow register group is the static random access memory built into the MCU chip. The address mapping rule of the shadow register group is a 1:1 linear mapping with the address of the working register group. The host read and write permissions of the shadow register group are open write permissions and prohibited read permissions. The firmware read and write permissions of the shadow register group are full read and write permissions. It supports performing three-level verification on new configuration parameters written to the host and supports atomically synchronizing all parameters of the shadow register group to the working register group. The storage medium of the historical best register group is the non-volatile memory built into the MCU chip. The address mapping rule of the historical best register group is a 1:1 linear mapping with the address of the working register group. The host read and write permissions of the historical best register group are open read permissions and prohibited write permissions. The firmware read and write permissions of the historical best register group are limited to write permissions when the new configuration parameters of the working register group take effect permanently, and read permissions are limited to full read permissions when the logic rollback execution module triggers the trigger mode. The storage medium of the factory default register group is the one-time programmable memory built into the optical module. The address mapping rule of the factory default register group is linearly mapped to the address of the working register group in a 1:1 ratio. The host read and write permissions of the factory default register group are open read permissions and prohibited write permissions. The firmware read and write permissions of the factory default register group are to be executed when the logic rollback execution module triggers a second-level rollback.

4. The grayscale release and logical rollback system for optical module configuration parameters according to claim 1, characterized in that, The host interaction commands include parameter preloading commands, gray-scale activation commands, health confirmation commands, manual rollback commands, parameter backup commands, and timeout window configuration commands. The parameter preloading instruction is used by the host to write new configuration parameters to the shadow register group. The execution of the parameter preloading instruction is premised on the optical module being in an idle state. The grayscale activation command is used to perform grayscale verification on the new configuration parameters, and the new configuration parameters officially take effect. The prerequisite for executing the grayscale activation command is that the optical module is in a preload ready state. The health confirmation command is used by the host to confirm the health of the service link to the optical module, triggering the new configuration parameters to take effect permanently. The prerequisite for the gray-scale activation command is that the optical module is in gray-scale verification state and the timeout confirmation timer countdown has not ended. The manual rollback command is used by the host to trigger a manual rollback, restoring the historical optimal register set to the historical optimal parameters. The prerequisite for executing the manual rollback command is that the optical module is in the rollback execution state. The parameter backup command is used by the host to manually trigger the backup of new configuration parameters to the historical best register group. The execution of the parameter backup command is premised on the optical module being in an idle state and the service link being continuously healthy. The timeout window configuration instruction is used by the host to configure the timeout window duration for grayscale verification. The execution of the timeout window configuration instruction is premised on the optical module being in an idle state.

5. The grayscale release and logical rollback system for optical module configuration parameters according to claim 1, characterized in that, The state machine includes an idle state, a preload state, a grayscale verification state, a rollback execution state, and a permanent effective state. The idle state means that the host has not been configured with parameters, the operating parameters of the service link are the best historical parameters, and the service link is continuously healthy; The preload state is when the firmware performs a three-level verification of the new configuration parameters, and the operating parameters of the business link are the stored historical optimal parameters; The preload ready state is to wait for the host to issue a grayscale activation instruction and lock the write permission of the shadow register group; The grayscale verification state involves fully synchronizing the new configuration parameters of the shadow register group to the working register group, the firmware sending a start signal to the link health self-check module, synchronously starting the timeout confirmation timer, starting a countdown according to the timeout window duration, and locking the write permissions of all registers. The permanent effective state means that the new configuration parameters are permanently effective. A stop signal is sent to the link health self-check module, the timeout confirmation timer is stopped synchronously, the new configuration parameters of the working register group are fully synchronized to the historical best register group, written to the Flash storage chip, the corresponding CRC32 check code is updated, the write permission of all registers is unlocked, a configuration success response is returned to the host, and the event log and reporting module is called.

6. The grayscale release and logical rollback system for optical module configuration parameters according to claim 5, characterized in that, The conditions for entering the idle state are: the optical module power-on initialization is completed, the parameter configuration is completed, and the three-level rollback execution is completed; the conditions for jumping to the idle state are: the firmware has received the host's parameter preloading instruction, the new configuration parameters have been written into the shadow register group, and the jump is to the preloading state. The transition condition for the preloading state is as follows: when the three-level verification passes, a preloading success response is returned to the host, and the process transitions to the preloading ready state. When the Level 3 check fails, a preload failure response is returned to the host, the new configuration parameters of the shadow register group are cleared, and the process jumps to the idle state. The transition condition for the preload ready state is as follows: the firmware has received the grayscale activation instruction from the host, the session ID of the grayscale activation instruction matches the session ID of the preload instruction, and the host has not timed out when issuing the grayscale activation instruction, then it will transition to the grayscale verification state. If the firmware times out of receiving the grayscale activation command from the host or does not receive the grayscale activation command from the host, it will clear the new configuration parameters of the shadow register group and jump to the idle state. The transition conditions for the grayscale verification state are as follows: when a link fault report is received from the link health self-check module, an immediate fault rollback is triggered, and the system transitions to the rollback execution state; when no health confirmation instruction is received before the timeout confirmation timer expires, a timeout fallback rollback is triggered, and the system transitions to the rollback execution state; when a health confirmation instruction is received before the timeout confirmation timer expires and the link remains healthy, the system transitions to the permanent effective state; when a manual rollback instruction is received from the host, the system transitions to the rollback execution state. The transition condition for the permanent effective state is: after the firmware returns a configuration success response to the host, it transitions to the idle state.

7. The grayscale release and logical rollback system for optical module configuration parameters according to claim 1, characterized in that, The link health self-check module includes a total health score acquisition submodule, a health status determination submodule, and a self-check anomaly fallback module; The total health score acquisition submodule acquires core monitoring indicators and obtains the total health score for the current sampling period based on the core monitoring indicators; The health status determination submodule stores the total health score into a sliding window queue in a first-in-first-out order. Based on the sliding window queue, it determines whether the optical module's service link is healthy. The determination criteria are as follows: If the total health score in the sliding window queue is continuously less than 0.6, the link failure will be reported to the canary release control module. If a total health score in the sliding window queue is greater than 0.6 but less than 0.8, a degradation warning will be reported to the host. If the total health score in the sliding window queue is continuously greater than 0.8, the link remains healthy and will not be actively reported. If a reading failure, sampling interruption, or data abnormality occurs when the self-checking anomaly fallback submodule performs hardware register reading in each sampling cycle, it will automatically retry 3 times. If the retry is successful, it will continue to obtain the total health score of the current sampling cycle normally. If all 3 retry attempts fail, it will be determined as a hardware abnormality and the link failure will be reported to the gray-scale release control module.

8. The grayscale release and logical rollback system for optical module configuration parameters according to claim 7, characterized in that, The core monitoring indicators include physical layer signal hard fault indicators, data link layer bit error rate performance indicators, and management channel availability indicators. The physical layer signal hard fault indicators include the receiver CDR signal lock status, the transmitting laser bias current, the transmitting optical power, and the receiving optical power. The data link layer error rate performance indicators include the bit error rate before forward error correction, the bit error rate after forward error correction, and the number of code block synchronization losses. The availability metrics for the management channel include the host interaction command response success rate and the communication timeout rate.

9. The grayscale release and logical rollback system for optical module configuration parameters according to claim 1, characterized in that, The triggering modes include immediate fault rollback, timeout fallback rollback, and manual rollback. The instant fault rollback is triggered by the link health self-check module reporting the link fault to the canary release control module. The timeout fallback rollback is triggered if no confirmation health command is received when the timeout confirmation timer countdown ends; The manual rollback is triggered by the host issuing a manual rollback command.

10. The grayscale release and logical rollback system for optical module configuration parameters according to claim 1, characterized in that, The three-level rollback includes first-level rollback, second-level rollback, and third-level rollback. The first-level rollback is initiated during the rollback execution state. It locks the host's read and write permissions to all registers, the firmware reads the historical optimal parameters, verifies the CRC32 checksum associated with the historical optimal parameters, and if the verification passes, it atomically synchronizes the historical optimal parameters to the working register group and the shadow register group. The firmware sends a reset signal to the physical layer device to reset the service link, unlocks the host's read and write permissions to all registers, sends a stop signal to the link health self-check module, stops the timeout confirmation timer, and calls the event log and reporting module. The secondary rollback is initiated after the primary rollback fails, and a link recovery verification window is launched to continuously monitor the overall health score through the link health self-check module. If the total health score in the sliding window queue is continuously greater than 0.8, the first-level rollback is considered successful, and the link health self-check module is closed when the link recovery verification window ends. If the total health score in the sliding window queue is continuously greater than 0.6 and less than 0.8, the first-level rollback is considered successful, a degradation warning is reported to the host, and the link health self-test module is closed when the link recovery verification window ends. If the total health score in the sliding window queue is continuously less than 0.6, the first-level rollback is deemed to have failed. When the link recovery verification window ends, the link health self-test module is closed, the second-level rollback is initiated, the host's read and write permissions to all registers are locked, the default factory parameters of the factory default register group are read, and the CRC32 checksum associated with the default factory parameters is verified. If the verification passes, the default factory parameters are fully and atomically synchronized to the working register group, shadow register group, and historical best register group. The firmware sends a reset signal to the physical layer device to reset the service link, unlocks the host's read and write permissions to all registers, and calls the event log and reporting module. The third-level rollback is initiated after the second-level rollback fails, and a link recovery verification window is launched to continuously monitor the overall health score through the link health self-check module. If the total health score in the sliding window queue is continuously greater than 0.8, the second-level rollback is considered successful, and the link health self-check module is closed when the link recovery verification window ends. If the total health score in the sliding window queue is continuously greater than 0.6 and less than 0.8, the second-level rollback is considered successful, a degradation warning is reported to the host, and the link health self-test module is closed when the link recovery verification window ends. If the total health score in the sliding window queue is continuously less than 0.6, the second-level rollback is deemed to have failed. When the link recovery verification window ends, the link health self-test module is closed, the third-level rollback is initiated, the event log and reporting module is called, the firmware sends a soft reset signal to the MCU chip and DSP chip, and performs a full hardware reset of the optical module. After the optical module restarts, it reads the default factory parameters of the factory default register group and verifies the CRC32 checksum associated with the default factory parameters. If the verification passes, the default factory parameters are fully and atomically synchronized to the working register group, the shadow register group, and the historical best register group.

Images