The protection path that works, and breaks the service

Every hop passes its own review. The failure lives in the total, which belongs to nobody — and it appears at the exact moment protection succeeds.

The failure that survives good design

Every hop in a transport service gets designed against its own limit by the right tool. The microwave link has its fade margin. The fibre span has its loss budget. The amplified line has its OSNR. The protected service has its second path, on a genuinely diverse route, properly surveyed.

All of them pass. The design review moves on. And the service can still break in a way no hop review would have caught, because nothing in that process owns the total.

Latency accumulates and belongs to nobody

Light in standard single-mode fibre travels at about two thirds of its vacuum speed, which works out at 4.90 microseconds per kilometre — roughly one millisecond for every 204 km, or two milliseconds round trip. That is a property of glass, not a design choice.

Microwave through air is 3.34 µs/km, very nearly the vacuum speed. That is the whole reason low-latency routes are built out of towers rather than trenches, despite everything about microwave being harder: shorter hops, weather, line of sight, planning permission. Over the same ground, radio wins by about a third.

Equipment delay adds on top. On a long haul it is a rounding error against the distance. On a short metro path with many hops it can be most of the total, and the answer there is fewer boxes rather than a shorter route.

Protection is a different path, and different means longer

Diversity means the protection route avoids what the working route uses, and avoiding things means going further round. A protection path 50% longer than the working path is entirely normal, and it is usually evidence that the diversity is real rather than drawn.

The consequence is that latency changes when protection operates. Consider a working path of 400 km and a protection path of 700 km, both fibre, both properly diverse:

• Working: 3.9 ms round trip.
• Protection: 6.9 ms round trip.
• Against a 5 ms budget, one passes and one does not.

Availability is fine. The paths are genuinely diverse. Every element meets its target. And the service breaks the first time protection succeeds — which is the one moment nobody is looking for a latency fault, because every link is up and every alarm is green.

Which services actually care

For most traffic, three milliseconds is nothing. The services that notice are the ones with an acknowledgement in the loop, where the round trip is a hard multiplier on throughput rather than a delay you can absorb.

Synchronous storage replication is the clearest case: every write waits for the far end to confirm, so latency directly sets write throughput, and vendors publish hard distance limits for exactly this reason.

Market data and trading care about the absolute number and about consistency; a route change is itself an event.

Anything with a small window and no pipelining — some SAN protocols, some database replication, some legacy application traffic — degrades in proportion to round trip rather than gracefully.

The fix is rarely technical. It is knowing the number before the switch happens, writing it into the service description, and deciding deliberately whether the protection path is fit for the traffic it will carry. Sometimes the answer is that it is not, and the service should fail rather than switch — but that is a decision to take on purpose rather than to discover.

A chain is worse than its worst link

Everything in series must work, so availabilities multiply. Five elements at 99.99% give 99.95%. Adding anything to a path, however reliable, can only make it worse — a patch panel at 99.9999% still costs about thirty seconds a year.

The useful consequence is that one element usually dominates. If the access fibre is 99.95% and everything else is 99.999%, the access fibre is essentially the whole answer, and money spent elsewhere buys nothing measurable.

Which limit binds first

A design has several limits in different units — milliseconds, decibels, nines — and comparing them means expressing each as the fraction of its own budget that is used. Above 1 is already broken; the highest figure below 1 is what will break first.

Availability has to be handled the other way round. It is a floor rather than a ceiling, so the meaningful fraction is the share of the downtime allowance used, not the availability divided by the target. Getting that backwards makes every healthy design look like it is failing by a hair.

The value of the comparison is that it stops effort going to the wrong place. A design with everything at 40% has room everywhere. A design with one limit at 98% has no room at all, whatever the other figures say, and that single limit is the only one worth improving.

Fade margin, and the part that is a guess

Microwave availability comes from fade margin, and the relationship has two halves that deserve very different levels of trust.

The exponential is dependable: every 10 dB of fade margin divides the outage by ten. Thirty decibels to forty is a factor of ten in downtime, and that shape holds.

The occurrence factor in front of it is not dependable at all. It depends on path length, terrain roughness, climate and frequency, and getting it right is the actual work — ITU-R P.530 exists for this. A calculation that hides the factor behind a default is quoting a number to four decimal places on top of a guess.

And all of that is multipath. Rain fade is a separate mechanism that dominates above about 10 GHz and is not in this arithmetic at all.

What a composed view does not give you

It does not design hops. Per-hop budgets belong to the tools that do them properly, and a composed view is only as good as the figures put into it.

It does not model queueing, congestion, jitter, restoration behaviour or the time a protection switch itself takes. Propagation and equipment delay are the floor, not the whole story — a congested link adds delay that no amount of geography explains.

Nothing leaves your browser

Route lengths, site names, risk tags and availability figures describe your network in some detail. All of it stays on your device; none of it is uploaded, stored or logged.

Frequently asked questions

How can a service meet its availability target and still fail?

Because they are different limits. The protection path is chosen for diversity, so it is nearly always longer, and latency changes when protection operates. A 400 km working path is 3.9 ms round trip and a 700 km protection path is 6.9 ms; against a 5 ms budget the first passes and the second does not. Every link is up, every alarm is green, and the application is broken.

How much latency does a kilometre cost?

In standard single-mode fibre, 4.90 microseconds — about a millisecond per 204 km, two milliseconds round trip. Microwave through air is 3.34 µs/km, which is why low-latency routes are built from towers despite everything else about microwave being harder.

Is a longer protection path a mistake?

Usually the opposite. A protection route 50% longer than the working one is normal and often evidence the diversity is real. The mistake is not knowing the number, so nobody decided whether the traffic can tolerate it.

Which services actually notice a few milliseconds?

Those with an acknowledgement in the loop, where round trip multiplies directly into throughput: synchronous storage replication, market data and trading, and protocols with a small window and no pipelining. For most other traffic three milliseconds is nothing.

Why is a path worse than every element in it?

Because everything in series must work, so availabilities multiply. Five elements at 99.99% give 99.95%, and adding anything to a path can only make it worse.

How do you compare limits in different units?

As the fraction of each budget used, so milliseconds and decibels and nines become comparable. Availability needs inverting first — it is a floor, so the meaningful figure is the share of the downtime allowance used. Getting that backwards makes healthy designs look like failures.

What is the occurrence factor in a fade calculation?

The term in front of the exponential, and the part that needs real work: it depends on path length, terrain, climate and frequency, and should come from ITU-R P.530. The exponential itself is dependable — 10 dB of margin is a factor of ten in outage. All of it is multipath; rain fade is separate and dominates above about 10 GHz.

Does this include queueing or switching time?

No. Propagation and equipment delay are the floor. Congestion, queueing, jitter and protection-switch time are all real and none are modelled here.