## 3 Fault Model and SH and GH Node Generation Mechanism
### SH Node Generation Mechanism  
The program call graph can describe the functional relationships in programs, which helps to understand program structure. Control-Flow Graphs (CFGs) are an abstract representation of all possible execution paths of the program flow, formed by linking basic blocks using directed edges (branches). Also, CFGs can depict the control flow execution of the corresponding function and the possible execution order of basic blocks and instructions. To explain the generation mechanism of the SH node, we take the program Build_RIB in the route discovery phase in Table 2 as an example to conduct fault injection experiments. First, based on the Build_RIB intermediate code generated by the Clang compilation, the program call graph is built in this paper, as shown in Figure 3. Build_RIB reads the LSA by calling the _readFile_ function through the _main_ function and writes the output results into the RIB by calling the _writeFile_ function. To simulate a SEU of the program, we use the LLFI tool [32] to inject 10,000 faults into the program in the form of a single-bit upset and carry out statistical analysis on the results. Potential SDC errors that may be caused by fault injection include format errors, link missing, weight changes, and false links. The error occurrence number and description are shown in Table 3. Among them, format error, link loss, and weight change cannot cause a SH node to form in subsequent routing planning. Also, if the false link delay is too long, the path planning algorithm will not use the link in the process of path planning, which thus cannot lead to a SH node forming. Therefore, we focus on the false link problem caused by SDC errors. By comparing the routing tables generated by the DSP with error RIBs and the golden run routing tables generated in the routing planning phase, we obtain 101 cases in which false links are used in the path planning. That is, SH nodes exist in the \begin{table}
\begin{tabular}{l l l} \hline \hline  & **Route Discovery Phase** & **Route Planning Phase** \\ \hline Name & Build\_RIB & Dijkstra’s Shortest Path (DSP) \\ \hline Input & LSA (Link-state advertisement) & RIB (Routing information base) \\ \hline Output & RIB & RT (Routing table) \\ \hline Main & Receive LSA information from other & Read the link-state information in the \\ function & satellite nodes, obtain the overall link & local RIB, use the Dijkstra algorithm to \\ function & state of the satellite network, and & plan the shortest path to other nodes, \\  & generate an RIB. & and generate an RT. \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The main programs executed by satellites during the routing phases. satellite network and affect the network. In this way, we find that the probability of the occurrence of SH nodes that can affect the satellite network is about 1%. In the 101 cases where a SH node occurs, the instructions in the _readFile_ function are affected 61 times, the instructions in the _writeFile_ function 24 times, and the instructions in the main function 16 times. The reason why the instructions in the _readFile_ function are affected 61 times is that during the Build_RIB program execution, the main function calls it 6 times. The _readFile_ function has 20 basic blocks, among which the CFG and the instructions that lead to SH nodes forming are shown in Figure 4. The instructions that cause the most SH nodes are _load_, _icmp_, _sext_, _getelemptr_, and _add_. The _writeFile_ function has 14 basic blocks, of which the basic blocks and the instructions that lead to SH nodes forming are shown in Figure 5. The instructions that cause SH nodes are mainly concentrated in the basic block %34, and the instructions that cause the most SH nodes are _load_ and _getelemptr_. The main function has 55 basic blocks. Since there are six loop bodies with the same structure (Including seven basic blocks) in the _main_ function, we map the instructions that lead to SH nodes forming in the last five loop bodies to the original loop body during the analysis.