Hi,
RFC 4090 explains this operation. By using the session attribute "label recording requested" flag, the headend router requests that all downstream inbound labels are recorded in the RRO. So the PLR can examine this RRO and determine the correct label:
6.4.1. Discovering Downstream Labels
To support facility backup, the PLR must determine a label that will
indicate to the MP that packets received with that label should be
switched along the protected LSP. This can be done without
explicitly signaling the backup path if the MP uses a label space
global to that LSR.
As described in Section 6, the head-end LSR MUST set the "label
recording requested" flag in the SESSION_ATTRIBUTE object for LSPs
requesting local protection. This will cause (as specified in
[RSVP-TE]) all LSRs to record their INBOUND labels and to note via a
flag whether the label is global to the LSR. Thus, when a protected
LSP is first signaled through a PLR, the PLR can examine the RRO in
the Resv message and learn about the incoming labels that are used by
all downstream nodes for this LSP