Probable cause fields in telecommunications network alarm indication messages

<u>FIELD OF THE INVENTION</u>

The present invention relates to methods of, apparatus for and computer programs for generating and processing data included in a probable cause field of a telecommunications network alarm indication message and to signals representing probable cause fields of telecommunications network alarm indication messages.

<u>BACKGROUND TO THE INVENTION</u>

Network management systems use information indicating a probable cause of a network event in performance monitoring and in operation and maintenance of telecommunications networks. When a device in a network detects an event (such as a network element failure) it notifies the network management system by sending an alarm indication message. Information identifying the event is included in the alarm indication message in a field known as the "probable cause" field. The probable cause field is important because it enables a network operator to begin the process of diagnosis in order to fix any underlying problem. The alarm indication message also contains other useful fields such as the object instance (which describes the precise entity where the condition was detected); a timestamp, a severity indication, and so on.

Use of a standardised list of probable cause codes is known. For example, a list of probable cause codes is defined by the ITU-T in CCITT Recommendations M.3100 (1995) Generic Network Information Model; M.3100 Amendment 2 (1999): 1999; X.721 (1992) ISO/IEC 10165-2: Structure of management information: Definition of management information; and X.733 (1992) ISO/IEC 10164-4: Systems Management: Alarm reporting function. Other standards bodies, such as IETF, GSM and 3GPP have also defined standard probable cause codes.

The list of probable cause codes defined in the above standards specifications are either numeric (for example, M.3100 code '12' which indicates excessive bit error rate) or textual (for example 'ExcessiveBER'). Such codes offer a very concise representation of a probable cause and were conceived at a time when bandwidth and processing power were limited to avoid using a significant proportion of the available bandwidth and processing capacity for performance monitoring and operations and maintenance. Note that a single network event will typically result in a large number of alarms being raised by various devices which are affected by the event around the network. This is known as alarm flooding. Because of alarm flooding, a single event can trigger a large volume of alarm signalling to network management systems taking up a corresponding large proportion of bandwidth and processing capacity.

It is highly valuable to have a standardised set of probable cause codes for interoperability of equipment and software from multiple vendors. With the gradual convergence of different network technologies, for example wireline, wireless and optical networks, this becomes even more important.

However, technological advancement in telecommunications systems, equipment, protocols and software gives rise to an ever increasing and changing set of possible network events that may occur. It is desirable to be able to report these events in a meaningful way to network management systems for performance monitoring and operations and maintenance. Unfortunately, this objective is incompatible with the need to maintain a standardised set of probable cause codes because the procedures of standards bodies are simply unable to keep up with the rapid rate of technological advancement. Thus, in the past, relatively infrequent amendments to standards specifications have been made which typically include dramatic extensions to the list of probable cause codes.

One problem with the above is that, prior to the inclusion of new probable cause codes, vendors have tended to map new network events that may occur to existing probable cause codes in an imprecise or inaccurate manner. For example, the network event of the synchronisation status of a node being unstable might be mapped to "timingProblem" or "synchronizationSourceMismatch". "SynchronisationSourceMismatch" is not an accurate mapping, whereas "timingProblem" is very vague. Either way, this results in a loss of valuable information that might otherwise be reported to network management systems.

This loss of information also results in problems when it comes to clearing previously set alarms because the imprecise or inaccurate mapping results in a many-to-one, one-to-many or even a many-to-many mapping between network events that trigger the raising and setting of an alarm and network events that trigger the clearing of an alarm.

Another problem is that legacy network management applications or equipment that were developed before a new probable cause code is introduced is unable to understand and process an alarm indication message having that probable cause code and thus evolution or replacement of transport network equipment or software often requires a radical overhaul of network management systems as well.

<u>OBJECT TO THE INVENTION</u>

The present invention seeks to ameliorate the problems identified above.

<u>SUMMARY OF THE INVENTION</u>

In short, the present invention consists of: <ul id="ul0001" list-style="dash"><li>a notation for the probable cause field in messages that network devices send to management systems.</li><li>a method for devices to generate messages with this notation</li><li>an application that interprets these messages.</li></ul>

According to one aspect of the present invention, there is provided a method of generating data for inclusion in a probable cause field of a telecommunications network alarm indication message, the method comprising: <ul id="ul0002" list-style="none"><li>detecting the occurrence of an event in a telecommunications network;</li><li>mapping one or more characteristics of the event to first and second predetermined probable cause codes; and</li><li>generating the data for inclusion in a probable cause field of a telecommunications network alarm indication message, the generated data comprising first and second delimited data elements respectively indicating the first and second predetermined probable cause codes.</li></ul>

In one embodiment, the first predetermined probable cause code identifies a condition effecting an entity of the network.

In one embodiment, the second predetermined probable cause code identifies an attribute of an entity of the network.

In one embodiment, the method comprising mapping the one or more characteristics of the event to a third predetermined probable cause code identifying a qualifier of the attribute, and wherein the generated comprises a third delimited data element indicating the third predetermined probable cause code.

According to another aspect of the present invention, there is provided a method of generating a telecommunications network alarm indication message, the method comprising generating data for inclusion in a probable cause field of a telecommunications network alarm indication message according to the above method; and including the generated data in a telecommunications network alarm indication message.

According to another aspect of the present invention, there is provided a method of processing a telecommunications network alarm indication message, the method comprising: <ul id="ul0003" list-style="none"><li>identifying first and second delimited data elements in a probable cause field of the alarm indication message;</li><li>recognising a first predetermined probable cause code from a first one of the first or second data elements; and</li><li>processing the alarm indication message using the first predetermined probable cause code.</li></ul>

In one embodiment, the first predetermined probable cause code identifies a condition effecting an entity of a telecommunications network.

In one embodiment, the first predetermined probable cause code identifies an attribute of an entity of a telecommunications network.

In one embodiment, the above method comprises <ul id="ul0004" list-style="none" compact="compact"><li>recognising a second predetermined probable cause code from a second one of the first or second data elements,</li></ul> wherein the second predetermined probable cause code identifies a qualifier of the attribute and wherein the step of processing the alarm indication message uses the second predetermined probable cause code.

In one embodiment, the step of processing the alarm indication message comprises displaying the first predetermined probable cause code, or information derived therefrom, on a user display.

In one embodiment, the step of processing the alarm indication message comprises selecting the alarm indication message in dependence on whether the first predetermined probable cause code matches a predetermined criterion.

Apparatus and computer programs corresponding to the above methods are also provided.

According to another aspect of the present invention, there is provided a signal representing a probable cause field of a telecommunications network alarm indication message, the probable cause field comprising first and second delimited data elements respectively indicating first and second predetermined probable cause codes, the first and second predetermined probable cause codes relating to one or more characteristics of an event occurring or having occurred in a telecommunications network.

In one embodiment, the first predetermined probable cause code identifies a condition effecting an entity of the network.

In one embodiment, the second predetermined probable cause code identifies an attribute of an entity of the network.

In one embodiment, the probable cause field comprises a third delimited data element indicating a third predetermined probable cause, the third predetermined probable cause code relating to the one or more characteristics of an event occurring or having occurred in a telecommunications network, the third predetermined probable cause code identifying a qualifier of the attribute.

According to another aspect of the present invention, there is provided a signal representing a telecommunications network alarm indication message, the message comprising a probable cause field, the probable cause field comprising first and second delimited data elements respectively indicating first and second predetermined probable cause codes, the first and second predetermined probable cause codes relating to one or more characteristics of an event occurring or having occurred in a telecommunications network.

The preferred features may be combined as appropriate, as would be apparent to a skilled person, and may be combined with any of the aspects of the invention.

One advantage of the present invention is that it simplifies extension of standards defining probable cause information. By using first and second delimited data elements respectively indicating first and second predetermined probable cause codes, new probable causes may be identified by either i) adding new first probable cause codes, while using existing standardised second probable cause codes; ii) adding new second probable cause codes, while using existing standardised first probable cause codes; or iii) adding both new first probable cause codes and new second probable cause codes. For example, instead of standardising x*y new probable cause codes, where x new conditions are identified for y new attributes of network entities, only x+y new probable cause codes need be standardised. Thus, the combinatory explosion of new possible conditions that may effect new network entities is avoided. Furthermore, it is likely that either i) standardised probable cause codes already exist for the conditions that may effect new attributes of network entities (in which case only y new probable cause codes representing teh new attributes need be standardised) or ii) standardised probable cause codes already exist for either the attributes of network entities that may be effected by new conditions (in which case only x new probable cause codes representing the new conditions need be standardised).

Another advantage is that it improves the accuracy and precision with which the probable causes of network events may be communicated to network management systems. New network events may be mapped to a richer set of standardised probable cause information - ie the set of all valid combinations of first and second probable cause codes.

Furthermore, when probable cause information is generated to signify a new network event using standardised probable cause codes, the degree of precision with which each of the first and second data elements indicating first and second probable cause codes may be varied independently of each other. Thus, for example, the attribute of a network entity effected may be indicated with high precision (such as "IAPDlinkProtocol") whereas the condition may be left vague (such as "fault") or vice versa. Thus, loss of information or inaccuracy is avoided, since precision may be applied where it is appropriate and not where it is not appropriate.

Additionally, new network management applications or equipment which can recognise probable cause information comprising first and second delimited data elements respectively indicating first and second predetermined probable cause codes can perform advanced processing of alarm indication messages. For example, a network management application that filters (ie selects) alarm indication messages on the basis of prior art probable cause can only simply filter based on the entire probable cause. Hence an attempt to filter alarm indication messages on "all failed items" would require either explicitly identifying all probable causes that involve failure or for the application to have these built in. The latter would require the application designer to attempt to anticipate all such possible filters and hard code the detailed prior art probable cause codes that these would implicitly reference. Any added new probable cause codes would not be included in the list, hence the application would need rebuilding to give an accurate response every time a new probable cause code was added to the list. In contrast, the present invention allows the use simple filters (eg on any fail) without the application developer having to anticipate such filters. This is achieved because the notation described above separates the condition (eg fail) from the attribute (eg circuit pack).

Furthermore, legacy network management applications or equipment developed before a new probable cause code is introduced may be able partially to recognise and process probable cause information comprising first and second delimited data elements respectively indicating first and second predetermined probable cause codes. For example, a legacy application will be able partially to process probable cause information when a network entity exploits a new and unrecognised attribute against an existing and recognised condition or vice versa.

It will be apparent that the above advantages are even more applicable with probable cause information comprising three or more delimited data elements respectively indicating three or more predetermined probable cause codes.

There now follows, by way of example only, a detailed description of preferred embodiments of the present invention.

<u>DETAILED DESCRIPTION OF INVENTION</u>

Proposed notation

Structure

The structure of the probableCauseText is as follows:<img file="EP1526680A2_D0001.tif" /><img file="EP1526680A2_D0002.tif" />

Examples of structured probable causes

<tables id="tabl0001" num="0001"><img file="EP1526680A2_D0003.tif" /></tables>

Conditions

This section contains the current list of valid condition values and their definitions.

The list of conditions includes neutral conditions (e.g. inProgress) as well as negative conditions (e.g. fail). Conclusions cannot therefore be drawn on the basis of the condition alone. The condition needs to be considered in the context provided by the accompanying attribute.

Conditions are not meant to be extended except through updates to standards <tables id="tabl0002" num="0002"><img file="EP1526680A2_D0004.tif" /></tables><tables id="tabl0003" num="0003"><img file="EP1526680A2_D0005.tif" /></tables><tables id="tabl0004" num="0004"><img file="EP1526680A2_D0006.tif" /></tables><tables id="tabl0005" num="0005"><img file="EP1526680A2_D0007.tif" /></tables><tables id="tabl0006" num="0006"><img file="EP1526680A2_D0008.tif" /></tables><tables id="tabl0007" num="0007"><img file="EP1526680A2_D0009.tif" /></tables>

Attributes

This section contains the current list of attribute values. This list is expected to be extended. <tables id="tabl0008" num="0008"><img file="EP1526680A2_D0010.tif" /></tables><tables id="tabl0009" num="0009"><img file="EP1526680A2_D0011.tif" /></tables><tables id="tabl0010" num="0010"><img file="EP1526680A2_D0012.tif" /></tables><tables id="tabl0011" num="0011"><img file="EP1526680A2_D0013.tif" /></tables><tables id="tabl0012" num="0012"><img file="EP1526680A2_D0014.tif" /></tables><tables id="tabl0013" num="0013"><img file="EP1526680A2_D0015.tif" /></tables><tables id="tabl0014" num="0014"><img file="EP1526680A2_D0016.tif" /></tables><tables id="tabl0015" num="0015"><img file="EP1526680A2_D0017.tif" /></tables><tables id="tabl0016" num="0016"><img file="EP1526680A2_D0018.tif" /></tables><tables id="tabl0017" num="0017"><img file="EP1526680A2_D0019.tif" /></tables><tables id="tabl0018" num="0018"><img file="EP1526680A2_D0020.tif" /></tables><tables id="tabl0019" num="0019"><img file="EP1526680A2_D0021.tif" /></tables><tables id="tabl0020" num="0020"><img file="EP1526680A2_D0022.tif" /></tables><tables id="tabl0021" num="0021"><img file="EP1526680A2_D0023.tif" /></tables><tables id="tabl0022" num="0022"><img file="EP1526680A2_D0024.tif" /></tables><tables id="tabl0023" num="0023"><img file="EP1526680A2_D0025.tif" /></tables>

Detailed syntax for attributes

Threshold (PM) related attributes are identified as having the following detailed structure:<img file="EP1526680A2_D0026.tif" />

The reserved words used above and the values they may take are as shown: <tables id="tabl0024" num="0024"><table frame="all"><tgroup cols="2" colsep="1" rowsep="1"><colspec colnum="1" colname="col1" colwidth="78.75mm" /><colspec colnum="2" colname="col2" colwidth="78.75mm" /><thead valign="top"><row><entry namest="col1" nameend="col1" align="left">Reserved word</entry><entry namest="col2" nameend="col2" align="left">Values</entry></row></thead><tbody valign="top"><row><entry namest="col1" nameend="col1" align="left">parameter</entry><entry namest="col2" nameend="col2" align="left">SES|ES|UAS|SEFS|CV</entry></row><row><entry namest="col1" nameend="col1" align="left">direction</entry><entry namest="col2" nameend="col2" align="left">tx|rx</entry></row><row><entry namest="col1" nameend="col1" align="left">location</entry><entry namest="col2" nameend="col2" align="left">NE|FE (NE = near end, FE = far end)</entry></row><row><entry namest="col1" nameend="col1" align="left">loopback</entry><entry namest="col2" nameend="col2" align="left">facility|terminal</entry></row><row><entry namest="col1" nameend="col1" align="left">opertype</entry><entry namest="col2" nameend="col2" align="left">force|lockout|manual|auto</entry></row><row><entry namest="col1" nameend="col1" align="left">config</entry><entry namest="col2" nameend="col2" align="left">ring|span|line|path|interRing</entry></row><row><entry namest="col1" nameend="col1" align="left">period</entry><entry namest="col2" nameend="col2" align="left">15M|24H</entry></row><row rowsep="1"><entry namest="col1" nameend="col1" align="left">threshold</entry><entry namest="col2" nameend="col2" align="left">T1|T2</entry></row></tbody></tgroup></table></tables>

Structured probable cause encoding

Currently the definitions in X.721 and M.3100 are in terms of definitions of enumerated type (integer) values in ASN.1. This proposal suggests using a structured text on interoperability interfaces. This text will be an engineering mnemonic text similar to the enumerated type names (which are already based on English). It is structured so that it is machine readable and can be used on a machine to machine interface. There are a number of reasons for replacing numbers with structured text as follows:

The management of number assignment is avoided (currently different standards have used the same number for different probable causes).

The text is human interpretable, leading to more clarity of meaning.

The text itself is structured in a flexible way meaning that the ASN.1 definition does not change as texts are added or structured. Note how the ASN.1 does not change as interpreters are designed to exploit the structure within the text string that is the probable cause.

The text can also be displayed, for human readability, where this is of value to the operator. When displayed, it can be displayed in other languages. This proposal defines the display texts for English (which are the same as the engineering mnemonics used on the interface). It does not define display texts for other languages but allows for them. The ASN.1 in X.721 and M.3100 will add an ASN.1 cstring attribute, probableCauseText, wherever probableCause exists.

Backwards compatibility

The probableCauseText field will be used by existing systems in the following manner while migration to this new field occurs: <ul id="ul0005" list-style="none"><li>1. Existing applications use the integer value probableCause.</li><li>2. This proposal adds probableCauseText as a structured string value.</li><li>3. New applications that understand these values should read the probableCauseText. If this is null or not present they should read the probableCause (as a number) and process according to the existing meanings.</li><li>4. New applications that set these values should set the probableCauseText attribute according to this proposal, and set the probableCause field according to the best value available in the existing list.</li></ul>

Mechanism for devices to Generate the probable cause

A device will store the above texts in their internal memory. When a particular alarm condition is detected, it will construct the text according to the rules and transmit the probable cause to a management application.

There is nothing new about the mechanism proposed here.

Management application to receive and interpret the probable cause

Many management applications currently maintain a list of alarms. They can display the list of alarms that can be raised and many applications allow this list to be filtered on the basis of date time, probable cause and equipment.

An application that filters on the basis of probable cause can only simply filter based on the entire probable cause. Hence an attempt to filter on "all failed items" would require either the customer to explicitly identify all probable causes that involve failure or for the application to have these built in. The latter would require the application designer to attempt to anticipate all such possible filters and hard code the detailed probable cause numbers that these would implicitly reference. In addition the addition of a new cause would not be included in the list, hence the application would need rebuilding to give an accurate response every time a new item was added to the list.

This invention allows the customer to use simple filters (eg on any fail) without the application developer having to anticipate such filters. This is achieved because the notation described above separates the condition (eg fail) from the attribute (eg circuit pack). An application developer merely develops a parser that takes into account the structure defined in section 2 and parses this structure to separate out the condition, then compares this condition with the condition that the customer entered. The application can then list all alarms that have a condition of fail. This would be much too cumbersome for either the application writer or the customer without the structure of the notation specified in section 2.

The invention also allows for the application to give a correct display when a device exploits a new attribute (against an existing condition). The application will display the correct list of alarms even if it was built before the new attribute was added to the list and implemented in the device. The application will also display the correct text for new fields introduced after the application was built. This is achieved by the application displaying the text from the device. Previously this was not possible as it would have to map a number to the text. This mapping would not be available at the time the application was built.

Advantages for management applications include: <ul id="ul0006" list-style="none"><li>1. Ability for an application to display texts that were introduced after the application was built "</li><li>2. Ability for an application to filter on conditions like fail without complex activity from the user or complex knowledge in the application.</li><li>3. Ability for application to perform 2 correctly, even for attributes that were introduced in devices after the application was built</li></ul>