Mesh network switch port failure after the whole network topology automatic reconstruction hardware processing flow

Abstract

The application discloses a hardware processing flow for automatic reconstruction of a whole network topology after failure of a Mesh network switch port. After the port failure, the hardware forms a safe old view which does not select the fault port by shielding a covering layer, and then reliably propagates a topology increment with a fault serial number between still reachable nodes. An affected set not only contains entries of old paths passing through the fault port, but also iteratively contains entries of alternative paths which share a capacity bottleneck and occur out of bounds. The system generates candidate routing and address decoding double tables for a new period, and submits them according to a dependent layer wave from an outlet to an inlet; a data packet carries a period and does not rewrite along a path. When submission fails, a reverse wave is retreated, and the new period table is reserved until a passing packet is closed, so as to avoid mixed entries.

Description

Technical Field

[0001] This invention relates to the technical fields of port failure propagation, topology recalculation, and hardware time submission in Mesh switching networks, specifically to the hardware processing flow for automatic reconstructing of the entire network topology after a Mesh network switch port fails. Background Technology

[0002] Local detours on a single link can only restore flows with pre-set backup paths. Switch port failures may simultaneously remove multiple virtual adjacencies, change address decoding reachability, and cause backup paths to share new bottlenecks, requiring a complete recalculation of routes and mappings across the entire network.

[0003] When each Switch updates its forwarding table independently, loops, black holes, or different owners of the same address window may form during the update propagation process; the centralized controller's re-update of the forwarding table is also limited by management links and scale.

[0004] Common Mesh topology convergence recalculates the path through the failed port based on the failed port, but the alternative path will occupy the capacity of other links and affect the flow that did not originally pass through the failed port; independent table switching of each switching node may also form cross-period loops and address decoding inconsistencies.

[0005] A port failure changes more than just routes that pass directly through that port. Alternative paths increase the load on shared links, further causing traffic that wouldn't normally pass through the failed port to exceed capacity. If only the next hop is changed locally, or if the routing table is changed independently on each switch, it can lead to cascading capacity out-of-bounds issues and cross-era forwarding loops.

[0006] This invention first establishes a secure legacy view using an overlay layer, then calculates the affected closure after capacity expansion through topology increments with a confirmation bitmap. New-era routing and decoding tables are generated in pairs and committed in the downstream-to-upstream dependency wave; in case of failure, necessary entries in transit are retained and a reverse rollback is performed.

[0007] When a port fails, a topology increment with a fault sequence number is generated first, and the receiving switch uses the source sequence number to suppress repeated propagation. Affected address segments continue to expand according to path capacity, and routing tables and address decoding tables are generated in pairs during the candidate period; submissions are advanced in waves according to distance labels, and if any wave is not confirmed, the downstream maintains the old table or enters partition isolation. Summary of the Invention

[0008] This invention addresses the issues of cascading impact on alternative path capacity after Mesh port failure, the order of submission of entries across the entire network, and the coexistence of old and new packets during failure rollback.

[0009] After a port fails, in order to maintain a secure old view and form a candidate new topology, the hardware processing procedure includes steps S101 (confirm port failure and isolate it), S102 (maintain a secure old view), S103 (generate and propagate topology increments), S104 (calculate the affected area), S105 (generate candidate routes and decoding tables), S106 (perform distributed wavelet submission), and S107 (verify convergence and reclaim or rollback).

[0010] This invention unfolds along the lines of port isolation, incremental propagation, capacity expansion, candidate dual tables, wave submission, and period reclamation. The affected closures and in-transit processing conditions are fully preserved as follows.

[0011] The port health unit confirms that the switch port is faulty, prevents new packets from entering the port, transfers accepted packets to the replay queue or error queue, increments the port fault number and latches the old topology period, sets a faulty port masking overlay before the old period routing and decoding table to form a secure old view, and allows the output of table entries that hit the faulty port or unclosed address range to be retried or isolated without selecting the faulty port again.

[0012] Generate a topology increment containing the source switch, failed port, original neighbor, link identifier, port failure number, and the old topology period. Use the source switch and port failure number to deduplicate, and use a propagation bitmap and acknowledgment bitmap to propagate between still reachable switches.

[0013] First, select entries on the old topology replica that pass through the failed port of the old path. Then, map the incremental bandwidth of its candidate alternative path to the physical link. Iteratively add other entries that share the capacity bottleneck with the alternative path and whose reserved capacity exceeds the limit to the affected set until all reserved links meet the capacity limit or the out-of-limit flow is converted to degradation or isolation.

[0014] For each affected address segment, a candidate next hop is generated for the new topology period using distance labels that are strictly reduced toward the target, and the address owner and isolation decoding entries are generated in the same new topology period.

[0015] The old security view is retained along with the candidate routing table and address decoding table for the new era, so that each data packet carries the topology era at the ingress and is not rewritten along the way. Each switch selects the corresponding table according to the topology era carried by the packet.

[0016] Based on the candidate paths of the new era, a commit dependency layer from the exit to the entry is generated. The downstream switch first publishes the candidate table summary and prepares for confirmation. The upstream switch only atomically switches the local new era table pointer when the prepare summary of its next hop in the new era matches.

[0017] Count the number of messages in transit for each topology period.

[0018] When the preparation or submission confirmation is not closed, the ingress first stops marking the new period. The switched switch stops accepting new periods in the rollback wave from the ingress to the egress, but continues to retain and query the new period table for in-transit messages that have been marked with new periods until the new period in-transit count is zero or each message has formed a retryable or isolated result, then rollback to the security old view, and unconfirmed address segments remain isolated.

[0019] The in-transit counts for both the old period and the reverted new period are closed, and the corresponding table is retrieved after the activity table summary converges.

[0020] Furthermore, the topology increment header is 192 bits, including a 16-bit source switch identifier, an 8-bit failed port, an 8-bit flag, a 32-bit port failure sequence number, a 32-bit old topology period, a 32-bit new topology period, a 16-bit original neighbor identifier, a 16-bit link identifier, and a 32-bit content digest, and carries a propagation bitmap and an acknowledgment bitmap corresponding to the number of switches.

[0021] Furthermore, the iterative calculation of the affected set stops when "the alternative path of the newly added entry no longer causes the reservation of any reserved link to exceed the capacity limit". Flows that cannot meet the capacity limit are removed from the candidate routes according to priority and written to the degraded or isolated set.

[0022] Furthermore, for packets carrying the old topology period, each hop queries the old period table and simultaneously applies a failed port masking overlay. If a failed port or an unclosed address segment is hit, a retry or isolation status is output. For packets carrying the new topology period, each hop only queries the new period table. When a switch that has not yet prepared a new period table receives a new period packet, it outputs a retry or isolation status and does not re-mark the packet as the old period.

[0023] Furthermore, the target distance label of any next hop in the new era message is strictly less than the target distance label of the current switch, and the candidate with equal cost selects a unique next hop according to the switch stability identifier; the old era message uses the next hop of the old era table but is constrained by the failure port shielding overlay layer. When the shielding item is hit, forwarding is terminated and it enters the retry or isolation queue. Therefore, neither the new nor the old era message uses the next hop of the two eras in the same forwarding chain.

[0024] Furthermore, during network partitioning, a component identifier is generated for each still reachable connected component. A new period is submitted only for address segments where the address owner and path are both closed within the connected component, while the address segments on the other side are written into the isolation decoding entry. When the partition is reconnected, a new period longer than the topology periods seen on both sides is generated, the address owner and path are recalculated, and the old table before the partition is not directly restored.

[0025] Corresponding to the aforementioned method, this invention also discloses a topology reconstruction hardware system for areas still reachable after a Mesh network port failure. The system comprises a port health unit, a topology increment generator, a reserved credit control channel, a propagation bitmap and an acknowledgment bitmap, an affected set calculator, a distance label comparator, a capacity accumulator, an old-period routing and decoding table, a failed port masking overlay, a new-period candidate routing and decoding table, a packet period selector, a submission dependency layer controller, a period-in-transit counter, and a convergence checker. The old-period table and the failed port masking overlay constitute a secure old view. Packets hitting failed ports or unclosed address ranges only enter retry or isolation queues. The packet period selector selects the corresponding table based on the packet period. The submission dependency layer controller switches only when the downstream table digest for the new period has been confirmed, and stops marking the entry point for the new period when it is confirmed to be unclosed, keeping the new period table available for in-transit packets to query. It then reverts to the secure old view after the new period's in-transit count is closed.

[0026] Furthermore, the message period selector includes an old period matching comparator, a new period matching comparator, and a table selector. When a match fails or the corresponding table for the message period is not ready, the message is sent to a retry or isolation queue and is not sent to the routing table of another period.

[0027] Furthermore, the commit status of each switch includes SAFE_OLD_ACTIVE, NEW_PREPARED, NEW_ACTIVE, ROLLBACK_DRAIN, and PARTITION_ISOLATED. When the confirmation timeout occurs, switches in NEW_PREPARED do not switch, while switches in NEW_ACTIVE stop marking new periods. Each switch enters ROLLBACK_DRAIN in the rollback sequence from the inlet to the outlet and continues to query the new period table according to the period carried in the message. Switches only enter SAFE_OLD_ACTIVE after the local and downstream new period in transit counts are zero or all result in explicit retry or isolation. The old view and new period table are not reclaimed before the rollback summary is closed.

[0028] Furthermore, the convergence checker summarizes the connected component identifiers, active topology periods, routing table summaries, address decoding table summaries, unreachable address segments, and partition boundaries of the still reachable switches, and outputs convergence confirmation only for address segments within the same connected component where address ownership, path, and summary are all consistent.

[0029] The secure legacy view prevents faulty ports from being selected until reconstruction is complete; the affected set expands iteratively by sharing bottlenecks along alternative paths, covering indirect capacity out-of-bounds outages.

[0030] In the new era, dual tables are submitted from the export to the import. If the submission fails, the process stops accepting entries from the import to the export and continues to retain the necessary table entries for querying while they are in transit. This avoids switching the time period or prematurely reclaiming the message during transit. Attached Figure Description

[0031] Figure 1 This diagram illustrates the old topology and candidate new topology after a Mesh network switch port fails.

[0032] Figure 2 Functional structure diagram of the hardware system for automatic topology reconfiguration of the entire network.

[0033] Figure labeling: Port isolator 110, Secure old view maintainer 120, Topology increment propagator 210, Affected area calculator 220, Candidate route and decoding table generator 230, Distributed wave submitter 310, Convergence checker and period reclaimer 320. Detailed Implementation

[0034] The following section explains hardware processing in conjunction with the failed port overlay layer, topology increment, capacity mapping, and dual-table commit layer. Propagation acknowledgment and data in-transit counting are closed separately; control plane acknowledgment cannot replace data plane flushing.

[0035] The topology increment header is 192 bits long: bits 191-176 are the source switch identifier, bits 175-168 are the failed port, bits 167-160 are the flag, bits 159-128 are the port failure number, bits 127-96 are the old topology period, bits 95-64 are the new topology period, bits 63-48 are the original neighbor identifier, bits 47-32 are the link identifier, and bits 31-0 are the content digest. The propagation bitmap and acknowledgment bitmap are carried separately according to the number of switches and are transmitted using the reserved credit control virtual channel.

[0036] The receiving switch uses the source switch identifier and port failure number as the deduplication key. Duplicate increments with the same digest are only merged into the propagation bitmap; when the same deduplication key has different content digests, it enters a conflict state and does not participate in candidate table generation. After a switch sets its local propagation bit, it only forwards to reachable neighbors not yet covered by the propagation bitmap.

[0037] The affected set begins with entries in the table that hit the failed port on the old path. After reserving bandwidth for candidate alternative paths in the initial set, if any physical link exceeds its capacity limit, other entries sharing that link are added to the set and recalculated. Iteration terminates when all reserved links meet their capacity limits or all unschedulable flows have been degraded or isolated, thus providing a definite stopping condition for the affected scope.

[0038] Data packets are marked at the ingress as belonging to the old topology epoch or the new topology epoch, and said mark is not rewritten on subsequent Switches. An invalid port shielding overlay directly driven by the port health unit is disposed in front of the old epoch table, and the two form a secure old view. Even if an old epoch table entry still stores an invalid port, it cannot select said port beyond the overlay, but generates a retryable or isolated result. Each Switch retains the secure old view and the new epoch candidate or active table at the same time. When no table matches the epoch of a packet, a retryable or isolated state is returned.

[0039] The new epoch candidate route calculates a distance label L=(cost, switch_id) for each destination, and cost is compared first, followed by switch_id during comparison. For any candidate next hop m and current Switch n, it must satisfy L(m)<L(n). Since the label strictly decreases at each hop, the forwarding chain of the new epoch cannot return to a label that has already been accessed; packets of the old epoch continue to use the unmodified old epoch path.

[0040] The commit dependency layer is established according to the destination direction of the new epoch path, and the Switch close to the address owner enters NEW_PREPARED first and publishes the combined digest of the routing table and the decoding table. An upstream Switch switches to NEW_ACTIVE only after all new epoch next-hop digests match. The ingress Switch marks new packets with the new epoch only after all of its downstream links are NEW_ACTIVE. During rollback, the reverse data injection order is adopted: the ingress stops marking the new epoch first, then propagates ROLLBACK_DRAIN from the ingress to the egress; each node still serves packets already carrying the new epoch according to the new epoch table during the draining period.

[0041] The recovery condition for the old epoch table is: the local in-flight count of the old epoch is zero, all relevant ingresses have stopped marking the old epoch, and the convergence verifier has received corresponding confirmations. A rolled-back new epoch table is recovered only after all relevant ingresses stop marking the new epoch, the local and downstream new epoch in-flight counts are zero or all generate explicit retryable or isolated results, and the rollback digest is closed. When draining times out, the corresponding table is retained, undrained flows are transferred to isolation, the epoch of in-flight packets is not forcibly rewritten, and the original old table pointer containing invalid ports is not restored.

[0042] When the control channel cannot cross a certain boundary to complete the closing of acknowledgements, said boundary is recorded as a partition boundary. Each connected component generates a component identifier using the digest of the set of reachable Switch identifiers, and a NEW_ACTIVE state is generated only for address segments where both the address owner and the complete path are located within the local component. Opposite-side address segments enter isolated decoding entries, and no default route is established based on expired ownership.

[0043] When a node failure occurs during candidate table preparation or wave submission, nodes that have not been switched over remain SAFE_OLD_ACTIVE. Switched entry points first stop marking new periods, and each switched node enters ROLLBACK_DRAIN in waves from entry to exit. The new period table continues to serve marked messages, and only returns to SAFE_OLD_ACTIVE, which consists of the old table and a fault masking overlay, after being emptied or an explicit isolation result is formed. New failure events generate another topology increment with a higher fault sequence number, without overwriting incremental records that are being rolled back.

[0044] When two partitions reconnect, each publishes its maximum seen topology period, component identifier, address ownership digest, and in-transit count digest. The reconstructed period is set to a new value greater than the maximum seen period on both sides, and address ownership and paths are renegotiated under this new period. Transactions that do not receive confirmation from the other side during the partitioning process are not automatically replayed after network recovery.

[0045] When a port physically recovers, the port fault number is incremented and a recovery increment is generated. The port is only added to the new candidate table after the stable observation window has passed, propagation confirmation has closed, and both the new capacity and loop-free conditions are met. Expired recovery messages with fault numbers lower than locally seen fault numbers are discarded.

[0046] Figure 1 The system displays the old security view, affected areas, and candidate new topologies after a port failure. Figure 2 It illustrates port isolation, topology incremental propagation, candidate table generation, ingress / egress wave submission, and backoff branches when acknowledging incomplete closures.

[0047] See Figure 1 After port isolation, the old view continues to serve marked transactions in transit, and the affected area only extends to the failed port and entries sharing the new bottleneck. Candidate new topologies are written to a separate table after passing acyclic and capacity checks, without directly overwriting the old table.

[0048] To ensure the processing results can be verified, this embodiment records and saves inputs, parameters, outputs, and evidence around the port fault topology increment and candidate table. The fault port identifier, fault number, and topology period are used to locate the same object, while the port isolation period, incremental propagation period, candidate preparation period, and old period emptying period are used to exclude cross-period data; records of verification failures are retained separately and point to the last recoverable version.

[0049] Step S101 is used to confirm and isolate port failure. Accepted packets within the port are transferred to the replay or error queue. Physical recovery signals only form a recovery increment after a higher sequence number and stable observation. Before publishing the results of this stage, it is also necessary to verify that "increments are deduplicated by source and fault sequence number"; if this cannot be proven from the current snapshot, the result remains in a pending verification state and points to the most recent stable version.

[0050] After completing the previous stage, step S102 completes the maintenance of the secure old view. New transactions are prevented from entering the faulty port, while address ownership and forwarding table entries required to complete old-era messages in transit are preserved. This stage uses "affected areas include both path and capacity relationships" as a substantive threshold; if the threshold is not met, only conflict items, the scope of impact, and evidentiary gaps are registered.

[0051] The process then proceeds to step S103, where the system generates and propagates the topology increment. Increments with the same source and fault number are processed only once and merged into a propagation bitmap. The system confirms delivery to all still reachable switches via the management channel and explicitly registers partition boundaries. The output is only available for the next step if the "next-hop distance label strictly decreases" condition is met in the current period; otherwise, the active version remains unchanged.

[0052] In step S104, the system completes the calculation of the affected area. It reuses entries that have not passed through the failed port and do not share new bottlenecks, and establishes isolation sets for the address ranges of unreachable devices. The judgment that "the routing table and the address table carry the same candidate period" is limited to frozen snapshots, and unknown operands are not padded with default values.

[0053] Step S105 involves generating candidate routes and a decoding table. A loop-free condition is established based on a strict descent of the target distance label; paths with insufficient capacity are marked as downgraded; and redirects to unknown devices are not performed when the address owner is unreachable. Before publishing the results of this stage, it is necessary to verify that "unreachable addresses are written into isolation entries"; if this cannot be proven from the current snapshot, the result remains in a pending verification state and points to the most recent stable version.

[0054] After proceeding to step S106, the system completes the distributed wave submission. The ingress side switches after the target direction switch is ready, and the egress side switches before it can receive new era messages; the message carries the topology era, and both tables are stored concurrently until the old era is emptied.

[0055] Step S107 is used to verify convergence and reclaim or rollback. After confirming the closure of the set, period count, and summary, the old table is reclaimed; if the commit is not closed, entry is stopped, new periods are marked, and in-transit entries are retained. Partition merging is performed to renegotiate ownership in full period order.

[0056] The processing chain preserves dependencies based on the input digest. If an underlying record becomes invalid, only results that directly or indirectly reference that record revert to the candidate state and are recalculated; other results remain valid. If any publication threshold is not met, the candidate routing table and address decoding table are not switched concurrently; instead, the reason for failure, affected objects, supplementary evidence entry points, and security recovery points are preserved. Records provided externally include the version period, evidence location, and boundaries still awaiting confirmation.

[0057] Furthermore, when a port health unit confirms a failure, it increments the port fault number and transfers the accepted packets within the port to the replay or error queue.

[0058] Furthermore, the topology reconstruction increment is deduplicated by source switch, port fault sequence number and propagation bitmap and confirmed to still reachable switches within the same connected component.

[0059] Furthermore, the affected areas include entries where the old path passes through the failed port and entries where the alternative path shares the new capacity bottleneck.

[0060] Furthermore, the target distance label of the candidate next hop is strictly smaller than the local label, and the unique order is determined by the Switch stability identifier when the cost is equal.

[0061] Furthermore, the routing table and address decoding table carry the same candidate period and are submitted in waves according to the exit-to-entry or explicit dependency hierarchy.

[0062] Furthermore, unreachable address segments are written into isolation decoding entries, and the recovered ports generate new topology increments with higher fault numbers instead of directly restoring the old tables.

[0063] This scheme uses the topology reconstruction increment as a record object commonly referenced in all steps, and isolates data from different batches using version and processing period. Based on this, the port health unit isolates failed ports and generates a topology increment with source sequence number and propagation bitmap. Each switch calculates regions including those affected by path failures and shared capacity on its old-period replica. During the candidate period, loop-free paths, capacity-constrained routes, and address ownership tables are jointly generated. The entire network reconstruction is completed through phased preparation for submission and convergence verification. "Confirmation" requires the existence of direct technical observations or mutually independent indirect observations with consistent input digests; "Unknown" is maintained until the evidence is closed, and "unknown" is not interpreted as negation.

[0064] The raw data processed includes port health and fault numbers, old topology periods and neighbor relationships, routing and address decoding tables, and link capacity and fault domains. Interface requests carry object stability identifiers, expected versions, calling permissions, and idempotent keys, while responses carry actual versions, collection time intervals, quality flags, and content summaries. Data from caches, mirrors, or derivations retains its direct source; unavailable fields use explicit unknown values, and unavailable facts are not filled in with zero values ​​or old records.

[0065] Parameters, decision thresholds, and weights are fixed simultaneously with the incremental version of topology reconstruction. Thresholds can be determined by the allowable range of equipment specifications, the quantile of field-calibrated samples, the upper bound of historical normal window fluctuations, and the task delay budget or risk budget; parameters are not changed within the same processing period. When the sample is insufficient or the denominator is zero, the calculation result is marked as incalculable, and fixed empirical numbers are not used for supplementary calculation in this case.

[0066] Each entry in the status catalog stores at least the object or flow identifier, current period, candidate period, input summary, processing status, starting sequence number, confirmation boundary, error flag, and the index corresponding to the topology reconstruction increment. The catalog uses a double buffer of the current table and candidate tables; the calculation of candidate periods does not modify the current table; after all commit conditions are met, the visible table is switched through a single-cycle selection bit, and the old table is recycled after the relevant in-transit transactions are cleared.

[0067] For incomplete topology incremental propagation, insufficient candidate path capacity, and partial switch commit timeouts, the abnormal unit records the initial trigger period, input period, affected entries, and final acknowledgment boundary. Transactions that can be selectively replayed retain the original transaction identifier and add a replay bit; transactions whose side effects cannot be confirmed must not be treated as ordinary unsent transactions.

[0068] Candidate results are processed according to a two-level rule: The first level deduplicates candidates incrementally by source and fault number, establishes a feasible set with hard constraints by strictly decreasing the labels for affected areas (including path and capacity relationships) and next-hop distance; the second level sorts candidates within the feasible set only based on risk, latency, resource consumption, or evidence completeness. If no candidate satisfies all hard constraints, the system outputs a conflicting item and terminates the selection process, while the necessary conditions remain unchanged.

[0069] Before committing, the preparation confirmation and current topology reconstruction incremental header versions of each switch are read again, and the input digests saved during the preparation phase are compared. If the digests match, the commit is allowed; if the digest changes but does not affect the current dependent branches, the confirmed output is reused; if the digest changes hit the dependency index, only the affected branches are recalculated, and unaffected branches are not rolled back as a whole.

[0070] The final isolation or rollback status is published through the results interface, which simultaneously returns the status, applicable period, input summary, evidence path, and unresolved boundaries. The caller can only perform subsequent irreversible actions when the status is confirmed and the applicable period is still valid; candidate, unknown, and contradictory results are only used for diagnosis, supplementary evidence, or manual review.

[0071] The topology reconstruction increment is a structured record that runs through the processing chain of this invention, including at least the source switch, failed port, original neighbor, link identifier, port fault number, old topology period, new candidate period, propagation bitmap, affected address range, pending commit table summary, and acknowledgment status. The port fault number increments with each port status change to distinguish delayed recovery messages; the pending commit table summary covers routing, address decoding, and isolation entries.

[0072] Full network topology reconstruction refers to the recalculation of switch entries that are still visible within the reach of the switch but whose path or address reachability is affected.

[0073] The submission waves are advanced in either the reverse or forward direction from the fault area, so that messages at any transition moment either follow the path reachable in the old period or the path prepared in the new period.

[0074] Each switch includes a port health unit, a topology increment generator, a reliable propagation unit, an affected area calculator, a routing and decoding calculator, a dual-table store, and a period commit unit. The control channel uses reserved credits.

[0075] In step S101, accepted packets within the port are transferred to the replay or error queue, and the physical recovery signal only forms a recovery increment after the sequence number is higher and stable observation has been performed.

[0076] In step S102, new transactions are prevented from entering the faulty port, while retaining the address ownership and forwarding table entries required to complete old-era messages in transit.

[0077] In step S103, increments with the same source and fault number are processed only once and the propagation bitmap is merged. The delivery to all still reachable switches is confirmed through the management channel, and the partition boundary is explicitly registered.

[0078] In step S104, entries that have not passed through the failed port and do not share the new bottleneck are reused to establish an isolation set for the address range of unreachable devices.

[0079] In step S105, the target distance label is strictly reduced as a loop-free condition, the path label is downgraded due to insufficient capacity, and the address owner is not redirected to an unknown device when the address owner is unreachable.

[0080] In step S106, the ingress side switches after the target direction switch is ready, and the egress side switches before it can receive new era messages; the message carries the topology era, and the two tables are stored in parallel until the old era is emptied.

[0081] In step S107, after confirming the closure of the set, period count, and summary, the old table is recycled; if the closure is not completed, the entry is stopped, the new period is marked, and the in-transit entries are retained. The partitions are merged and ownership is renegotiated according to the full period order.

[0082] Affected={v | Path_old(v)∩Failed≠∅ ∨ CapacityShare(v,Failed)=1}

[0083] In the formula, Affected is the set of affected switches or entries; in addition to the old path containing the failed link, entries that share the capacity bottleneck with the alternative path after failure are also recalculated to avoid new congestion caused by partial updates.

[0084] A loop-free label can be composed of the cost to the target and the Switch stability flag. The label of the candidate next hop must be strictly smaller than the local label. When the costs are equal, the stability flag is used to break the tie.

[0085] Unreachable address ranges are written to the isolation decoding entry and a definitive error or retry status is returned; requests cannot fall into the default route.

[0086] Example 2: Taking a mesh consisting of six switches as an example, before port P fails, it carries the main path for multiple address ranges, while its alternative links also carry other flows that do not pass through P. Therefore, the affected range cannot be determined solely by whether the original path includes P.

[0087] The port health unit increments the port fault number and stops accepting new packets on that port after a physical link failure, persistent error, or neighboring connection loss meets the acknowledgment criteria. Accepted but not yet transmitted packets are moved to the replay queue; packets that have left the port are awaiting completion or marked as ambiguous based on their hop-by-hop status.

[0088] The topology increment includes the source switch, port, original neighbor, link identifier, fault number, old topology period, and propagation bitmap. The receiving end deduplicates the same source and fault number, sets the local bit in the bitmap, and forwards it to uncovered neighbors; the digest acknowledgment is used to determine whether the still reachable set has been received.

[0089] The impact calculation first selects entries in the table that the old route passes through the faulty port, and then maps the candidate alternative paths of these entries to the physical bottleneck. If adding a reservation would cause a bottleneck to be insufficient in capacity, then entries that did not originally pass through the faulty port but share the bottleneck are also added to the affected set until the capacity is rebalanced.

[0090] Candidate paths are constructed using target distance labels. The label of any next hop must be strictly less than the local label. Equal-cost candidates are ordered in a fixed manner according to the Switch stability identifier. Labels and next hops are written to the candidate table simultaneously to avoid transient loops caused by different switches using different tie rules.

[0091] Address owner, next hop, and decoding behavior are calculated in the same candidate period. When the address owner is unreachable, an isolated decoding entry is generated for the corresponding address range instead of being sent along the old route; owner recovery requires republishing with a new increment of a higher fault number, and expired ownership is not directly reused.

[0092] Dependency submission is established from the exit to the entry point of the candidate path. The switch closest to the target completes preparation and publishes a digest first, and the upstream only switches when all candidate downstream digests match; in this way, the message can still proceed along the submitted downstream path at the wavelet boundary.

[0093] For example, if port P fails, address segment A will switch to link Q, causing Q's capacity to reach its limit. Although address segment B's original path does not contain P, it also passes through Q, so its next hop needs to be adjusted synchronously. Recalculating only A would cause B to become congested after the handover. This method writes A and B into the same affected area and submits them together.

[0094] The convergence check summary still includes the active period of the switch, routing table summary, decoding table summary, unreachable address ranges, and partition boundaries. If the summaries are inconsistent, the old table is retained or a fallback candidate is used; in the case of partitions, each connected component only submits address ranges whose ownership and paths are closed within that component.

[0095] The hardware can employ active / candidate table double buffering, distance tag comparators, capacity accumulators, and commit bitmaps. Table switching is a pointer-level atomic operation; upon reset, the current active period is latched first, and if a higher period increment is received after recovery, uncommitted candidate tables are discarded.

[0096] In terms of data organization, each topology reconstruction increment includes at least the failed port, propagation bitmap, affected address range, distance label, capacity bottleneck, and preparation summary. Business identity and database auto-incrementing primary key are stored separately; business identity is determined by the source switch, port failure sequence number, and candidate topology period, while the auto-incrementing primary key is only used for physical location. Updates use append-only versions, with the previous version recording its termination reason and remaining readable, thus enabling differentiation between object changes, repeated data collection, and reprocessing of the same object.

[0097] In terms of state control, topology reconstruction increments can be in port isolation, increment propagation, impact calculation, candidate table preparation, wave submission, convergence, and partition isolation. Each transformation is triggered by a specific event, and the transformation record contains the states before and after the transformation, the trigger field, and the rejection reason. The recovery procedure only replays confirmed transformations and does not infer intermediate states from the final field values; this allows for different handling of execution interruptions, late messages, and partial successes.

[0098] When switching between the candidate routing table and the address decoding table simultaneously, the system first generates a preparation record containing the expected write set and compensation entry, and then calls the execution interface. Commit is only confirmed when the object identities of the execution receipt, independent observation, and preparation record match. If the interface times out and the external state is unclear, it is marked as an unclear commit, and the external observation is read first; actions with side effects are not immediately repeated.

[0099] In terms of concurrent processing, the idempotent index is derived from a hash of the source switch, port failure sequence number, and normalized encoding and action number during the candidate topology period. When the same index arrives again, if the input digest is the same, the already confirmed output reference is returned; if the digests are different, an idempotent conflict is registered and overwriting is rejected. During multi-processor contention, a unique writer is determined through conditional write or comparison exchange, and the processor that does not obtain the write right becomes the result reader.

[0100] All time-related fields are registered as intervals, which cover the old topology period, incremental propagation period, wave submission interval, and convergence observation period. Two intervals are only allowed to be used in the same calculation if they still intersect after considering clock errors and the source period has not been reset. When the interval uncertainty exceeds the allowed value by the rules, the system expands the set of evidence to be supplemented instead of shortening the interval; late records are written to their original period without modifying the currently published conclusion.

[0101] Configurable parameters during implementation include fault confirmation conditions, capacity limit, distance tag bit width, propagation retry, and wave timeout. Parameter values ​​are derived from device specifications, offline calibration, or prior stable operating samples. At the start of processing, the parameter values, units, source summary, and applicable objects are written to a read-only parameter snapshot. Specific values ​​can be changed during implementation, but parameter items corresponding to security commits, version consistency, or integrity checks must not be deleted.

[0102] Abnormal recovery does not cross the following boundaries: abandoning candidate periods and maintaining the old table; writing unreachable address ranges into isolation entries; and not directly recovering expired routes. Each rollback request has an independent action number, and upon successful execution, a recovery observation and a post-recovery summary are appended. If a step fails to recover, subsequent compensation dependent on that step is discontinued, on-site evidence is preserved, and the object is placed in an isolated state to prevent null values ​​from masquerading as recovery completion.

[0103] To implement the above method, each switch can be configured with a port health unit, incremental propagation unit, candidate calculator, dual tables, and convergence checker. Control messages use structured messages with length and version numbers. The receiver checks each required field, enumeration range, and checksum item by item. Older versions of the receiver can ignore unknown optional fields, but must reject and return the supported mode version when encountering unknown required fields.

[0104] In the mesh, select ports carrying multiple primary paths to fail, and allow alternative paths to share bottlenecks with flows not directly affected by the failure. Compare the impact spread and wave commits of this invention with only recalculating old path hits, a single network-wide table split, and the entire network. Verify loops, black holes, address decoding conflicts, capacity out-of-bounds errors, and convergence time during the entire network period.

[0105] After a power outage or process restart, the recovery process first reads the most recent complete checkpoint, then scans subsequent preparation and confirmation records. Only topology reconstruction increments that are fully verified and confirmed are entered into the active index; objects with only preparation records are determined to be continued, compensated, or isolated based on external observations. The scan results are written to a new recovery period without altering the sequence numbers before the interruption, thus preserving the causal boundaries required for incident analysis.

[0106] When failed ports, propagation bitmaps, affected address ranges, distance labels, capacity bottlenecks, and prepared summaries are provided by different interfaces, the adaptation layer simultaneously registers and saves the original and normalized values, units, source versions, and transformation rules. Fields that fail to normalize remain unknown with a reason code and are not converted to zero. If multiple sources provide conflicting results for the same field, a topology reconstruction incremental candidate set is formed according to the pre-configured evidence level, and the step using the field determines whether to supplement sampling or stop submission.

[0107] When incremental candidate results for topology reconstruction have the same priority, the processor sequentially checks the satisfaction of hard constraints, the completeness of evidence, the recovery cost, and the stability flag. The last item is only used to determine the order and does not change the technical feasibility. Each component used for sorting retains its original value, so that the same selection is obtained when replaying under the same input, and it can explain which constraint among fault confirmation conditions, capacity limits, distance tag bit width, propagation retry, and wave timeout is excluded from the candidate.

[0108] When persisting a processing result, first arrange the failed ports, propagation bitmap, affected address ranges, distance tags, capacity bottlenecks, and prepared digests by field number, specifying units for all values ​​and writing the enumerated values ​​into the mode version, then calculate the content digest. Strings only undergo protocol-defined whitespace and encoding normalization; resource names are not fuzzed. This ensures that the same topology reconstruction increment yields the same digest on different processing nodes, and two objects with only the same display name will not be mistaken for the same object.

[0109] This example also generates a version identifier for each version of the content. Let the normalized business key be K, the processing period be E, the input digest be D, and the parameter snapshot digest be P. Then the version identifier can be H(K∥E∥D∥P), where H is the collision-resistant hash function selected by the system, and the connector includes the field length. K corresponds to the source switch, port failure sequence number, and candidate topology period. In addition to comparing the version identifier, the reading end also compares E and the mode version item by item to prevent accidental digest reuse under different encoding rules.

[0110] Evidence quality is registered separately, but includes at least four components: source authenticity, temporal integrity, field integrity, and cross-consistency. Steps using a particular field declare the required components and minimum quality levels; low-quality flags for unused fields do not block irrelevant branches. When performing local updates on topology reconstruction increments, only outputs dependent on the changed components are recalculated; other confirmed outputs retain the original evidence references without copying the original content.

[0111] If a gap exists in the current data collection, the system first determines whether the gap is relevant based on the read sets of subsequent actions. If the missing field is not in the read set, processing can continue, but the gap flag is retained in the output. If the field is involved in the release judgment of the simultaneous switching of the candidate routing table and the address decoding table, the branch is stopped and a supplementary data collection request is generated. The supplementary data collection result must include the original source switch, port fault sequence number, candidate topology period, and new source summary. After confirmation, only the branch waiting for that field is awakened to avoid unconditionally rerunning the entire process.

[0112] A transaction catalog is established around the topology reconstruction increment, and preparation, external call, observation confirmation, and compensation records are numbered separately. A preparation entry must at least store the calling interface, target object, expected write set, pre-execution summary, request idempotent key, and timeout time; a confirmation entry stores the receipt summary and independent observation. When the receipt is lost but the observation shows that the target state has changed, the catalog confirms it as executed and continues the confirmation phase, instead of calling the interface again; if the observation is also uncertain, the commit remains unclear and is handled by the recovery procedure, without directly retransmitting the simultaneous switching of the candidate routing table and address decoding table.

[0113] Queues are divided according to business objects. Messages from the same source do not automatically enter the same shard. Only one writer is allowed at any given time for the same source switch, port failure sequence number, and candidate topology period. Different objects can be written concurrently. When the queue reaches its capacity limit, the entry point prioritizes acknowledgment messages, rollback messages, and evidence re-sampling results. Ordinary duplicate samples can be merged into a single record with a count. Merging only applies to samples that have not yet been consumed and have the same pattern version, and cannot cross the period boundaries of the old topology period, incremental propagation period, wave submission interval, and convergence observation period.

[0114] Abnormal path verification should at least include message duplication, message out-of-order delivery, processor restart after preparation, interface execution timeout, mode version switching, and one source distortion. Before each injection, save an input snapshot; after injection, check for erroneous submissions, unfounded state transitions, or unassociated orphan records. For periods of abandoning candidate routes, maintain the old table; write unreachable address ranges into isolation entries; do not directly restore expired routes, but interrupt again during compensation to verify that the recovery process can continue from the confirmation point of the compensation action itself, without re-executing the already completed reverse action.

[0115] The verification of rule boundaries uses three sets of objects: a baseline object with all evidence complete, an object located exactly at the rule boundary, and an object missing only one key field. Boundary values ​​are taken as the lower bound, upper bound, and adjacent representable values ​​of the allowed values; for count or fixed-point fields, overflow, wraparound, and reset are also tested. The results cannot only compare the final success or failure, but also compare the state of the topology reconstruction increment, the reasons for rejection, and whether the evidence references are consistent with the expectations item by item.

[0116] For interfaces requiring authorization, the least privilege credential is used. The credential itself is not written into the topology reconstruction increment; only an irreversible credential reference summary, permission scope, and audit number are recorded. When the executing entity is not authorized to complete the simultaneous switching of the candidate routing table and the address decoding table, the process terminates during the preparation phase, and permission errors are not misjudged as target object failures. Audit records and business records are associated with the same object key and processing period, but access is controlled separately. When exporting implementation data, a stable anonymous identifier is used to replace the real asset identifier.

[0117] Once the number of incremental topology refactoring versions reaches the retention limit, consecutive versions that have been closed and exceeded the audit period can be compressed into checkpoints. Checkpoints retain the beginning and end states, the summary chain for each state transition, parameter versions, and the location of external evidence; the original large fields are transferred to content-addressable storage. Records still in a state of unclear commit, pending verification, or isolation must not be compressed; versions with source switch, port failure sequence number, and candidate topology period references must not be deleted until the last reference expires.

[0118] The complete processing procedure in this embodiment is as follows: The entry components in the port health unit, incremental propagation unit, candidate calculator, dual table, and convergence checker of each switch receive the object and establish an input snapshot with the source switch, port fault sequence number, and candidate topology period index; the rule executor loads the read-only parameter snapshot and generates candidate results; the status controller selects confirmation, re-sampling, or isolation based on the current status and submission threshold; the confirmation result, along with evidence citations, is published to the next step. If a version change occurs midway, the current candidate is retained as the replaced record, and the new version continues from the first affected step without overwriting the old conclusion.

[0119] Implementation does not require specific branding of the message bus, relational database, or processor. As long as the alternative implementation maintains stable associations between the source switch, port fault sequence number, and candidate topology periods; period boundaries for the old topology period, incremental propagation period, wave submission interval, and convergence observation period; atomic visibility of state transitions; and the ability to discard candidate periods while preserving the old table; write unreachable address segments to isolation entries; and avoid directly restoring the recovery order of expired routes, it can be implemented using shared memory, persistent queues, on-chip directories, or distributed logs. If the alternative implementation eliminates any of the above boundaries, equivalent consistency checks and evidence preservation mechanisms must be added; equivalence cannot be considered solely based on identical interface names.

[0120] Example 3 illustrates the input, state changes, and exception handling by taking the example of a Switch uplink port failure where some flows that did not pass through the old path are still affected by the bottleneck of the alternative path sharing, and need to be included in the recalculation while ensuring no loops during the update.

[0121] Take a dual-ring mesh consisting of six switches as an example, where the bidirectional port of one switch fails.

[0122] Step 1: The port health unit confirms the fault and latches sequence number 17, stopping new packets from entering.

[0123] Step 2: The topology increment carries the old period e and the propagation bitmap to all still reachable Switches.

[0124] Step 3: After comparing reachability, it is determined that four switches and two address ranges need to be recalculated, while other entries are reused.

[0125] Step 4: During candidate period e+1, an alternative path with a strictly descent label is generated, and an unreachable memory device is written to the isolation set.

[0126] Step 5: Submit the routing and decoding tables according to the outbound-to-inbound dependency wave, and continue to use the old tables for old period messages.

[0127] Step 6: After the activity table summary converges, the old table is recycled; port recovery is treated as a new increment of sequence number 18.

[0128] When a port fault propagates, a wave confirmation occurs, or a count in transit is not closed, the hardware handles reconstruction and rollback according to the following rules.

[0129] (1) When controlling the channel partition, record the unconfirmed boundary. Within the partition, no speculative ownership shall be established for the address segment on the other side.

[0130] (2) When the candidate path capacity is insufficient, retain the degraded bandwidth flag and restrict new flow entry.

[0131] (3) If the timeout is confirmed, the node that has been switched will be rolled back to the old table.

[0132] (4) Port jitter is suppressed by fault sequence number and stability observation window, and old recovery messages are not reused.

[0133] (1) Incremental propagation can be achieved using flood bitmap, spanning tree broadcast or multicast confirmation.

[0134] (2) Route calculation can use distance labels, distributed shortest paths, or pre-computed alternative sets.

[0135] (3) The submitted wave can be generated by the target reverse hierarchy or by explicit dependency DAG.

[0136] A hardware system for automatic topology reconstruction of a Mesh network after a switch port fails, corresponding to the above method, can be implemented in a modular manner.

[0137] 110 is a port isolator used to identify faults and migrate accepted packets within the port.

[0138] 120 is a secure old view retainer, used to preserve table entries needed for transactions in transit from older periods.

[0139] 210 is a topology increment propagator used for reliable propagation of the increment of the source and fault number.

[0140] 220 is the affected area calculator, used to identify reusable entries, bottlenecks, and isolated address ranges.

[0141] 230 is a candidate route and decoding table generator, used to generate a loop-free candidate table and degradation flags.

[0142] 310 is a distributed wave committer used to switch to new epochs based on ingress / exgress dependencies.

[0143] 320 is a convergence checker and period reclaimer used to verify summaries, counts, and perform reclamation or rollback.

[0144] The port unit provides facts with sequence numbers, the propagation module makes the whole network see the same increment, and the affected calculations reduce the scope of recalculation; the routing and decoding modules generate dual tables for the same period, and wave submission and convergence verification avoid loops and erroneous ownership during the update.

[0145] The deployment and interface implementation of this embodiment are as follows.

[0146] Topology increments and acknowledgment messages use independent control virtual channels and reserved buffers to ensure that reconstruction can still proceed even when data congestion occurs.

[0147] Each Switch retains at least two full table versions: the current activity and the previous activity, as well as one incremental version to be submitted.

[0148] Injecting port disconnections, recovering jitter, control message loss, partitioning, and insufficient alternative path capacity in mesh, dual-ring, and irregular mesh systems.

[0149] (1) Route loop-free: Whether the next-hop label does not decrease during the transition period;

[0150] (2) Black hole time: The number of cycles in which there are no valid entries in the reachable address range;

[0151] (3) Percentage of items affected by recalculation: the percentage of items to be recalculated out of all items in the table;

[0152] (4) Period convergence: whether the Switch activity summary is consistent;

[0153] (5) Isolation correctness: whether the unreachable address returns a clear status rather than a misrouting.

[0154] This embodiment utilizes the collaborative implementation of port health units, incremental propagation units, candidate calculators, dual tables, and convergence checkers in each switch. The control logic reconstructs the incremental topology according to the source switch, port fault number, and candidate topology period index, and writes the old topology period, incremental propagation period, wave submission interval, convergence observation period, parameter version, and processing results into the same record chain. Software instructions are stored in a non-transitory computer-readable storage medium; processing requiring programmable logic can be executed by an FPGA, programmable switching device, or embedded controller. Data is transferred between hardware and software through an interface with version and integrity verification.

[0155] Figure 2 In the process, port isolator 110 and security stub view holder 120 first form a fault boundary, and topology increment propagator 210 delivers increments to the still reachable switch. Affected area calculator 220 and candidate route and decoding table generator 230 form a candidate table, and distributed wave submitter 310 determines whether to reclaim or roll back based on convergence check and period reclaimer 320.

[0156] The Port Isolation and Security Old View Module 110 is used by the Port Health Unit to confirm that a Switch port has failed, stop new packets from entering the port, and latch the port fault number and old topology period.

[0157] The topology incremental propagation module 210 is used to generate topology reconstruction increments based on the failed port, original neighbor and link identifier, and reliably propagate them to the entire network using source sequence number and propagation bitmap.

[0158] The affected area calculation module 220 is used by each switch to apply topology increments to the old topology copy, compare address, path and fault domain reachability, and calculate the switches, address segments and flow sets that need to be recalculated.

[0159] The candidate route decoding table module 230 is used to calculate loop-free paths, capacity constraints, and address owners for affected address segments during the new candidate period, and write them into the routing table to be submitted and the decoding table.

[0160] The distributed wave commit module 310 is used to exchange the summary of the table to be committed and the preparation confirmation according to the commit dependency hierarchy, and to switch the local active table and propagate the commit confirmation when all adjacent dependencies are satisfied.

[0161] The convergence verification and period reclamation module 320 is used to summarize the active table summaries, unreachable address ranges and partition boundaries that are still reachable from the Switch, and reclaim the old tables after verification and convergence.

[0162] The electronic device includes a processor, memory, a communication interface, and a bus. The memory stores the program implementing the above steps, as well as topology reconstruction increments. When the processor executes the program, it first reads the valid version according to the source switch, port fault number, and candidate topology period, and then completes calculations, verification, and status submission based on fault confirmation conditions, capacity limits, distance tag bit width, propagation retries, and wave timeouts. The communication interface is used to connect to the execution unit described in the embodiment; late or duplicate messages received by the interface are still processed according to the object period and idempotent key.

[0163] Mesh dimensions, routing algorithms, or traffic degradation strategies can be changed, but the relationships between secure legacy views, capacity expansion closures, two-table wave commits, and periodic in-transit reclaim must be maintained.

Claims

1. A method for automatic topology reconstruction of the entire Mesh network after a switch port fails, characterized in that, include: Step S101: Confirm that the port is invalid, transfer the accepted packets to the replay or error queue and isolate the port; Step S102: Maintain the secure old view required to complete the in-transit messages of the old period; Step S103: Generate a topology increment with source, fault number and propagation bitmap, and confirm that it can still reach all switches after deduplication; Step S104: Reuse entries that have not passed through failed ports and do not share new bottlenecks, calculate the affected area and isolate unreachable address ranges; Step S105: Generate candidate routes and decoding tables with strict descent of target distance labels as a loop-free condition, and mark downgraded paths with insufficient capacity; Step S106: Perform distributed wave submission according to ingress and egress dependencies, with messages carrying topology periods and both tables retained until the old period is emptied; Step S107: Reclaim the old table after confirming the closure of the set, period count and digest, and stop marking the new period for ingress and retain in-transit entries if the closure is not complete.

2. The topology reconstruction method as described in claim 1, characterized in that, The topology increment header is 192 bits, including a 16-bit source switch identifier, an 8-bit failed port, an 8-bit flag, a 32-bit port failure sequence number, a 32-bit old topology period, a 32-bit new topology period, a 16-bit original neighbor identifier, a 16-bit link identifier, and a 32-bit content digest, and carries a propagation bitmap and an acknowledgment bitmap corresponding to the number of switches.

3. The topology reconstruction method as described in claim 1, characterized in that, The iterative calculation of the affected set stops when "the alternative path of the newly added entry no longer causes the reservation of any reserved link to exceed the capacity limit". Flows that cannot meet the capacity limit are removed from the candidate routes according to priority and written to the degraded or isolated set.

4. The topology reconstruction method as described in claim 1, characterized in that, For messages carrying the old topology era, each hop queries the old era table and simultaneously applies a failed port masking overlay. When a failed port or an unclosed address segment is hit, the message outputs a retry or isolation status. For messages carrying a new topology period, each hop only queries the new period table; when a switch that has not yet prepared a new period table receives a new period message, it outputs a retry or isolation status and does not re-mark the message as the old period.

5. The topology reconstruction method as described in claim 1, characterized in that, For new-era packets, the target distance label of any next hop is strictly less than the target distance label of the current switch. The equal-cost candidate selects a unique next hop based on the switch stability identifier. Old-era packets use the next hop of the old-era table but are constrained by the failure port shielding overlay. When a shielding item is hit, forwarding is terminated and the packet enters the retry or isolation queue. Therefore, neither new nor old-era packets use the next hop of the two eras in the same forwarding chain.

6. The topology reconstruction method as described in claim 1, characterized in that, When partitioning a network, a component identifier is generated for each still reachable connected component. A new period is submitted only for address segments where the address owner and path are both closed within the connected component, and the address segments on the other side are written into the isolation decoding entry. When reconnecting a partition, a new period longer than the topology periods seen on both sides is generated, the address owner and path are recalculated, and the old table before the partition is not directly restored.

7. A topology reconstruction hardware system for a region that remains reachable after a Mesh network port fails, characterized in that, This includes port health units, topology increment generators, reserved credit control channels, propagation bitmaps and acknowledgment bitmaps, affected set calculators, distance tag comparators, capacity accumulators, old-era routing and decoding tables, failed port masking overlays, new-era candidate routing and decoding tables, packet era selectors, submission dependency layer controllers, in-transit counters for each era, and convergence checkers, all located on each switch. The old-era table and the failed port masking overlay constitute a secure old view. Packets hitting failed ports or unclosed address ranges only enter retry or isolation queues. The packet era selector selects the corresponding table based on the packet era. The submission dependency layer controller switches only when the downstream table summary for the new era has been confirmed, and stops marking the entry for the new era when it is confirmed to be unclosed, keeping the new era table available for in-transit packets to query. It then falls back to the secure old view after the in-transit counter for the new era is closed.

8. The topology reconfiguration hardware system as described in claim 7, characterized in that, The message period selection table includes an old period matching comparator, a new period matching comparator, and a table selector. When a match fails or the table corresponding to the message period is not ready, the message is sent to a retry or isolation queue and is not sent to the routing table of another period.

9. The topology reconfiguration hardware system as described in claim 7, characterized in that, Each switch's commit status includes SAFE_OLD_ACTIVE, NEW_PREPARED, NEW_ACTIVE, ROLLBACK_DRAIN, and PARTITION_ISOLATED. When the confirmation timeout occurs, switches in NEW_PREPARED do not switch, while switches in NEW_ACTIVE stop marking new periods. Each switch enters ROLLBACK_DRAIN in the rollback sequence from the inlet to the outlet and continues to query the new period table according to the period carried in the message. Switches only enter SAFE_OLD_ACTIVE after the local and downstream new period in transit counts are zero or all result in explicit retry or isolation. The old security view and new period table are not reclaimed before the rollback summary is closed.

10. The topology reconfiguration hardware system as described in claim 7, characterized in that, The convergence checker summarizes the connected component identifiers, active topology periods, routing table digests, address decoding table digests, unreachable address segments, and partition boundaries of the still reachable switches, and outputs convergence confirmation only for address segments within the same connected component where address ownership, path, and digest are all consistent.

Images