Skip to content

Redundant Network Link

Infrastructure artifact — instantiates Spanning Connectivity Formation

A standing parallel link that carries no unique load until a primary path is cut, congested, or misconfigured — then it keeps the two sides connected without interruption.

The simplest insurance against a connection being severed is a second connection that was there all along. Redundant Network Link is that spare: a standing parallel link between two sides whose entire purpose is to sit ready — often idle — so that when the primary path is cut, congested, misconfigured, or taken down for maintenance, traffic fails over to it and the two sides stay connected. Its defining property is that it is pre-provisioned and pairwise: it converts a single point of failure between two specific nodes into a survivable one by raising their connectivity from one path to two. Unlike an analysis that decides where fragility lives, this is the concrete artifact that removes it — the "keep a spare" tactic made physical.

Example

A neighbourhood water zone is fed by a single trunk main running from one reservoir — a dead-end feed. One burst pipe and four thousand homes lose water until it is repaired. The utility closes the loop by laying a second main from a different reservoir zone, turning the dead-end into a ring. Now any single main failure leaves an alternate feed — a rollback path — and the invariant no single main break cuts supply to the zone holds continuously.[1] The redundant main carries little unique load day to day; its value is entirely in the failure it silently absorbs.

How it works

The distinguishing feature is that the link is a standing spare provisioned before the failure, not discovered during it. It runs parallel to a primary path and fails over — automatically or by a defined switch — the moment the primary degrades, so the connection survives the loss without a redesign. Everything about its worth lives in the failure case: on a normal day it may look like wasted capacity, which is exactly the temptation the mechanism must resist. Its effectiveness depends wholly on being genuinely independent of the path it backs up.

Tuning parameters

  • Fate diversity — how independent the spare is in route, power, vendor, and conduit. A "backup" that shares fate with the primary is no backup at all; this is the dial that decides whether the redundancy is real.
  • Failover mode — hot and automatic (instant cutover) versus cold and manual (cheaper, slower). The gap between them is measured in downtime.
  • Backup capacity — whether the spare carries full load or only degraded service when it takes over.
  • Redundancy depth — N+1 (one spare) versus N+2 or more for paths that must never drop.
  • Exercise cadence — how often failover is actually tested, since an untested spare may be dead when it is finally needed.

When it helps, and when it misleads

Its strength is dependable, low-complexity continuity for a critical pair: it converts a single point of failure into a survivable event with a spare that needs no cleverness to work.

Its classic failure is false redundancy — a backup that shares fate with the primary, so the same trench cut, power outage, or provider incident takes down both at once and the "redundant" link protects nothing. The idle-looking cost tempts teams to under-provision or route the spare through the cheapest, least-diverse path, quietly hollowing out the protection. And a failover that is never exercised can be silently broken until the day it is needed. The discipline is to enforce genuine route and fate diversity and to test failover on a schedule, treating an untested spare as no spare.

How it implements the components

Redundant Network Link realizes the standing-failover side of the archetype — the components that keep a pair connected through a loss:

  • rollback_path — the alternate path that traffic fails over to when the primary is cut or degraded; the artifact is that path.
  • protected_connectivity_invariant — for its pair, it makes true the guarantee that no single path failure disconnects the two sides.

It does not decide where in the network a spare is worth adding — the network-wide cut-set analysis that targets fragility is Cut-Set Hardening, which deploys this artifact — nor does it monitor failover live (that is Giant-Component Dashboard).

  • Instantiates: Spanning Connectivity Formation — this artifact makes a formed connection survive the loss of any single path.
  • Consumes: none — it is a standing artifact deployed by other mechanisms rather than a consumer of them.
  • Sibling mechanisms: Cut-Set Hardening · Reachability Test · Mesh-Link Deployment · Link-Maintenance Sweep · Giant-Component Dashboard

References

[1] A network is k-edge-connected when at least k links must be removed to disconnect it; adding a diverse parallel link raises a pair from 1- to 2-edge-connectivity — the graph-theoretic meaning of "survives any single cut," and the guarantee a redundant link provides. ↩