Spec: Define failover behavior

Add notes about emergency vs normal flows, and define an expectation
for the switch to support multiple controller strings.

doc/of-spec/appendix.tex

@@ -155,6 +155,8 @@ The \verb|flags| field may include the follow flags:
 When the \verb|OFPFF_SEND_FLOW_EXP| flag is set, the switch must send a flow expiration message when the flow expires.  The default is for the switch to not send flow expirations.  
 \\\\
 When the \verb|OFPFF_CHECK_OVERLAP| flag is set, the switch must check that there are no conflicting entries with the same priority. If there is one, the flow mod fails and an error code is returned.
+\\\\
+When the \verb|OFPFF_EMERG_| flag is set, the switch must consider this flow entry as an emergency entry, and only use it for forwarding when disconnected from the controller.
 
 \paragraph{Port Modification Message}
 The controller uses the \verb|OFPT_PORT_MOD| message to modify the behavior of the physical port:

doc/of-spec/openflow-spec-v0.8.9.tex

@@ -336,7 +336,11 @@ When an OpenFlow connection is first established, each side of the connection mu
 If the negotiated version is supported by the recipient, then the connection proceeds. Otherwise, the recipient must reply with an \verb|OFPT_ERROR| message with a \verb|type| field of \verb|OFPET_HELLO_FAILED|, a \verb|code| field of \verb| OFPHFC_COMPATIBLE|, and optionally an ASCII string explaining the situation in \verb|data|, and then terminate the connection.
 
 \subsection{Connection Interruption}
-In the case that the switch loses contact with the controller, the default behavior must be to do nothing - to let flows timeout naturally.  Other behaviors can be implemented via vendor-specific command line interface or vendor extension OpenFlow messages.  
+In the case that a switch loses contact with the controller, as a result of a echo request timeout, SSL session timeout, or other disconnection, it should attempt to contact one or more backup controllers.  The ordering of the controller IP addresses is not specified by the protocol.
+\\\\
+If some number of attempts to contact a controller fail, the switch must enter ``emergency mode''.  In this mode, the matching process is dictated by the emergency flow table entries (those marked with the emergency bit when added to the switch).  All normal entries must be ignored in emergency mode.
+\\\\
+Upon connecting to a controller again, the matching process is dictated by the normal flow tables entries, and emergency entries are ignored.  The controller then has the option of resetting the flow cache, if needed.
 
 \subsection{Encryption}
 The switch and controller communicate through an SSL connection.  The SSL connection is initiated by the switch on startup to the controllerÕs server, which is located by default on TCP port \input{define/OFP_TCP_PORT}.   The switch and controller mutually authenticate by exchanging certificates signed by a site-specific private key.  Each switch must be user-configurable with one certificate for authenticating the controller (controller certificate) and the other for authenticating to the controller (switch certificate).