## 3 Fault Model and SH and GH Node Generation Mechanism
### GH Node Generation Mechanism  
To explain the generation mechanism of GH nodes, we take the program Dijkstra's Shortest Path (DSP) in the route planning phase in Table 2 as an example to conduct fault injection experiments. First, based on the DSP intermediate code generated by the Clang compilation, the program call graph is built in this paper, as shown in Figure 8. First, DSP obtains the link-state information by calling the _fscanf_ function through the _main_ function. Then, DSP uses the _Dijkstra_ function to plan the path from the satellite node to other nodes in the network and obtains the next hop node ID. Finally, the program generates a routing table in the format of the destination node ID and the next hop node ID. To simulate a SEU of the program, we use the LLFI tool to inject 10,000 faults into the DSP program in the form of a single-bit upset and carry out a statistical analysis of the results. We find that more than 80% of the results are Masked, SW Detected, or OS/HW Detected, and the number of SDC errors is 1173. Potential SDC errors that may be caused by fault injection include data loss, destination node changes, and next-hop node changes. The occurrence number and description of the errors are shown in Table 4. Because the influence of SEU on the DSP program ultimately affects the routing table, the data loss and the destination node change in the routing table can cause the satellite to fail to find the next hop, resulting in the emergence of a GH node in the satellite network. In most cases of next-hop changes, the next hop changes to other connectable neighbor nodes. Therefore, in the case of a next-hop change, we further obtain 188 cases where the next hop changes to a non-neighbor node, that is, the case where a GH node occurs in the satellite network. Figure 8: The call graph of Dijkstra’s Shortest Path (DSP). Figure 7: A typical example of a SH node caused by SEU. In this way, we find that the probability of the occurrence of GH nodes induced by SEU is about 2%. GH nodes occur in 202 cases After statistical analysis, we find that in the nine cases of data loss, except for the _load_ instruction (%10) of the basic block %8 in the _array_fill_ function, the other seven cases occur in the %188, %192 and %253 basic blocks of the _Dijkstra_ function. Meanwhile, the five cases of destination node change are caused by the _load_ instruction (%201) in the basic block %197 of the _Dijkstra_ function, as shown in Figure 9. At the same time, we find that in the 188 cases of next-hop node changes, in which GH nodes appear, the majority (161 times) occur in the _main_ function, as shown in Figure 10, and the rest (27 times) occur in the _Dijkstra_ function, as shown in Figure 11. Of these, the instructions in the _main_ function that can cause GH nodes are mainly concentrated in the basic blocks %9, %12, %17, %33, and %37, and the instructions in the _Dijkstra_ function that can cause GH nodes are mainly concentrated in the basic blocks of %28, %208, and %237. \begin{table}
\begin{tabular}{c c l} \hline \hline
**SDC Error** & **Occurrence** & **Description** \\ \hline Data loss & 9 & The route table misses one or more rows. The satellite fails to find the next hop of the corresponding destination node, which can generate a GH. \\ \hline Destination node change & 5 & The destination node in the routing table changes. The satellite fails to find the next hop of the corresponding destination node, which can generate a GH. \\ \hline Next-hop node change & 1159 & The next hop node in the routing table changes. A GH is generated when the next-hop node changes to a non-neighbor node, which occurs 188 times in total. \\ \hline \hline \end{tabular}
\end{table} 
Table 4: DSP SDC error occurrence number and description. Figure 9: The CFG and the instructions in the _Dijkstra_ function that lead to data loss and destination node changes. An extreme case of a GH node is a Blackhole node, that is, a node that discards all packets passing through it. Blackhole nodes also exist in the above cases.