Failure-Tolerant and Low-Latency Telecommand in Mega-Constellations: The Redundant Multi-Path Routing

In recent years, in order to provide worldwide broadband Internet access services, many mega-constellation projects have been proposed. Traditional ground-based and space-based telecommand systems only rely on a single path for data transmission, which is vulnerable once the path fails. This paper utilizes inter-satellite-links (ISLs) in the constellation network to reduce the risk of data transmission failure, and proposes the failure-tolerant and low-latency redundant multi-path routing algorithm (RMPR). RMPR transmits multiple data copies on multiple shortest edge-disjoint paths according to the optimal proportions with the minimum delay. Compared with traditional single-path routing and backup multi-path routing, RMPR ensures both reliability and timeliness in telecommand system.


I. INTRODUCTION
In recent years, in order to provide worldwide broadband Internet access services, many mega-constellation projects have been proposed. For example, Starlink is composed of about 42000 satellites, Kuiper is composed of about 3236 satellites running on 98 orbital planes, and Oneweb is composed of about 650 satellites. Meanwhile, Samsung, Telesat, Facebook and other companies have also put forward plans to build mega-constellations.
In order to ensure the normal operation of the constellation, the ground control center needs to send command instructions to the satellite. Telecommand is generally used for controlling the satellite to achieve orbit adjustment, attitude adjustment, operation mode switching, fault diagnosis and other functions, which is the basic guarantee for the normal operation of the system. Moreover, in order to ensure the rapid response ability and emergency response ability of the constellation system, telecommand has strict requirements on reliability and timeliness.
The associate editor coordinating the review of this manuscript and approving it for publication was Paulo Mendes .
Traditional telecommand systems can be classified as ground-based and space-based systems according to different working mechanisms. For the ground-based telecommand system, the ground station directly sends command data to the target satellite through the satellite-to-ground-link (SGL). For the space-based telecommand system, the ground station sends command data to the target satellite through the relay of the geostationary earth orbit satellite. However, ground-based telecommand system can only transmit command data when the target satellite and the ground station are visible to each other, and thus the timeliness cannot be guaranteed. And space-based telecommand system relies on a single path to transmit command data, without any other path as a backup. Once the activated path is interfered or fails, it is prone to cause the transmission failure of command data. In order to ensure the reliability of command data transmission, networked telecommand system is a promising choice [1], where command data is transmitted through the ISLs of the mega-constellation. The constellation network provides multiple paths as backups, which reduces the impact of path failure and ensures the reliability of command data transmission. In networked telecommand system, the traditional single-path routing algorithm selects the path with the best comprehensive performance according to the link interference, link quality and other parameters, which ensures the transmission reliability to some extent. The security aware routing algorithm proposed by Salameh et al. [2] comprehensively considers the link quality, personal radio activities and channel interference degree to select the optimal path from the source node to the destination node. Sheikholeslami et al. [3] proposed a routing algorithm to resist multiple static and dynamic jammers in quasi-static multipath fading environment. According to the average power of the jammer detected by each network node for a long time, the algorithm selects the path with the lowest energy consumption under the constraint of the end-to-end outage probability. The multi parent hierarchical (MPH) protocol proposed by Del Valle Soto et al. [4] periodically updates the neighbor table of network nodes to remove the interfered links, isolate the interfered areas and perform rerouting. However, single-path routing only relies on a single path for data transmission, which is vulnerable once the path fails. So it is difficult for single-path routing to meet the reliability requirement of telecommand.
The backup multi-path routing algorithm selects a set of paths and ensures at least one path is available. Based on ant colony optimization, Rostami et al. [5] found two maximally shared risk link group disjoint paths to minimize the probability of simultaneous path failure. The sub-branch multipath routing protocol (SMRP) proposed by Challal et al. [6] relaxes the constraint of path coupling, so that the path with the same root node can be used for multipath routing. The split multi-path routing (SMR) proposed by Lee and Gerla [7] is based on the on-demand routing mechanism to establish the shortest delay path. Meanwhile, SMR establishes the path that is maximally disjoint with the shortest delay path as a backup, which improves the robustness of the routing and reduces the overhead of the routing recovery process. Pu [8] considered the link quality and traffic load performance of the path, and selected multiple maximally spatial node-disjoint paths with high link quality and light traffic load. According to the availability history of paths, Mustafa et al. [9] selected multiple fault-independent paths to maximize the end-to-end availability to resist jamming. Backup multi-path routing uses path backup to ensure the routing reliability and avoid the rerouting delay caused by path failure. However, due to the long transmission distance of ISL, the retransmission delay introduced by backup multi-path routing reduces the timeliness of telecommand.
The traffic allocation based multi-path routing algorithm optimizes the traffic allocation proportions of different paths, so as to minimize the traffic affected by path failure. Tague et al. [10] allocated the traffic of the source node according to the jamming statistics of the network nodes, so as to avoid jamming and improve the network throughput. The traffic allocation problem is modeled as a lossy network optimization problem based on portfolio selection theory.
Lee et al. [11] proposed a distributed secure multipath routing algorithm. By optimizing the traffic allocation of different paths, more resources are needed for attackers to destroy the network routing.
Stochastic multi-path routing algorithm stochastically transmits data on different paths, and selects the optimal strategy to avoid the failed paths. Sarkar and Datta [12] proposed a secure and energy efficient stochastic (SEES) multipath routing algorithm. SEES models the routing from the source node to the destination node as a Markov decision process. The randomness of path selection can resist congestion, interception, hijacking and other attacks. Sarkar and Datta [13] proposed a stochastic multi-path routing algorithm based on zero-sum game. In each decision-making stage, the source node decides the optimal path switching strategy based on the available path, the remaining bandwidth and the attacker's strategy, so as to avoid the attacked path.
Traffic allocation based multi-path routing and stochastic multi-path routing focus on how to minimize the amount of data affected by path failure. However, command data requires high reliability, even the loss of a small amount of data may have a serious impact on the system, which makes traffic allocation based multi-path routing and stochastic multi-path routing unsuitable for networked telecommand system.
In order to ensure the reliability and timeliness of telecommand, this paper proposes the redundant multi-path routing algorithm (RMPR). RMPR transmits multiple data copies on multiple paths, and ensures the successful transmission of data even if some paths fails. Moreover, RMPR optimizes the data allocation proportions on different paths, thereby making full use of the transmission capacity of paths and minimizing the end-to-end delay. In order to verify the reliability and timeliness of RMPR, we build the Starlink constellation and compare the performance of single-path routing, backup multi-path routing with RMPR on MATLAB. According to the simulation results, we derive the conclusion that RMPR performs comprehensively better on packet delivery ratio (PDR) and delay.
In order to ensure the reliability and timeliness of routing, multi-path routing algorithm is widely studied in traditional ad hoc networks. For the networked telecommand system, the introduction of data redundancy is the key feature of RMPR. Due to the short link distance and the low retransmission delay in traditional ad hoc networks, multi-path routing algorithms generally guarantee the reliability by retransmission on the backup paths after path failures occur, instead of transmitting redundant data simultaneously on multiple paths. In particular, for some ad hoc networks requiring low energy consumption, e.g. the wireless sensor networks, the transmission of redundant data will increase energy consumption and thus reduce the life time of devices. In the networked telecommand system, due to the long link distance, the retransmission delay introduced by backup multi-path routing is high, which seriously reduces the timeliness of routing. However, transmitting redundant data simultaneously on multiple paths can effectively reduce the possibility of data retransmission and thus improve the timeliness of routing. In addition, concerning the design of multi-path routing algorithm, RMPR for the telecommand system is also different from the traditional multi-path routing algorithm in ad hoc networks. Since the ground station can obtain the constellation network topology at any moment by orbit propagation, it is not necessary to design a complex route discovery process for RMPR.
The main contributions of this paper are as follows: 1) A redundant multi-path routing algorithm based on data redundancy, named RMPR, is proposed, which is suitable for the networked telecommand system with long link distance and ensures the reliability and timeliness of telecommand. 2) In the path selection stage, according to the predictability of constellation network topology, the L-shortest edge-disjoint paths searching method based on repeated Dijkstra algorithm is proposed. 3) In the data allocation stage, according to the convex optimization theory, the optimal data allocation proportions on different paths are derived to minimize the end-to-end delay. 4) In the parameter adjustment stage, the influences of path number and data redundancy on PDR and delay are analyzed, and the parameter adjustment method to ensure reliability and timeliness of telecommand is proposed. The paper consists of the following parts: Section II describes the basic mechanism of RMPR in networked telecommand system. Section III analyzes the end-to-end delay from the ground station to the destination satellite, and calculates the optimal data allocation proportions on different paths for RMPR to minimize the end-to-end delay. In Section IV, the bounds of RMPR's failure-tolerance capability are analyzed, and the influences of path number and data redundancy on PDR and delay are analyzed. Section V describes the simulation method of networked telecommand system, and compares the PDR, delay and overhead of RMPR with traditional single-path routing and backup multi-path routing. In Section VI, we summarize the paper and give some suggestions on potential extensions and further improvements of RMPR.

II. SYSTEM MODEL AND BASIC MECHANISM OF RMPR
In the networked telecommand system, the ground station use multiple paths within the network to transmit command data. The links may fail due to malicious attack or functional breakdown. The basic mechanism of RMPR is depicted in Fig. 1. The ground station first establishes L paths to the destination satellite, then expands the original data into multiple copies, and allocates them to different paths for transmission according to certain proportions. Finally, the destination satellite combines the data segments received on each path to recover the original data. In this case, even if some paths fail, the destination satellite can still recover the original data by using the segments successfully received from the available paths. RMPR can not only resist path failure, but also make full use of the transmission capacity of multiple paths, thereby ensuring both reliability and timeliness of telecommand.
RMPR is divided into three stages: path selection, data allocation and parameter adjustment.
In the path selection stage, RMPR selects multiple shortest edge-disjoint paths from the ground station to the destination satellite, so as to reduce the path propagation delay and the risk of simultaneous path failure. Because each satellite in the constellation runs in a fixed orbit, the ground station can obtain the constellation network topology at any time through orbit propagation. Network topology can be modeled as a weighted graph G = (N , E, W ), where N is the set of satellite nodes, E is the set of links, W is the set of link distances, and the distances of nonexistent links are infinite. In order to reduce the path propagation delay and the risk of simultaneous path failure, the L-shortest edge-disjoint paths are selected. It is assumed that the ground station is the source node S and the destination satellite is the destination node D. By repeatedly executing Dijkstra algorithm [14], we can get the L-shortest edge-disjoint paths from S to D as shown in Algorithm 1.

Algorithm 1 Search the L-Shortest Edge-Disjoint Paths
Input: The weighted graph G = (N , E, W ), the source node S, the destination node D, and the path number L.
The i-th shortest edge-disjoint path P i = Dijkstra(G, S, D); 3: Set the weight of all links on path P i as infinite; 4: Update the weighted graph G; 5: end for In the data allocation stage, RMPR allocates multiple data copies on different paths according to the optimal proportions so as to minimize the end-to-end delay. For the RMPR using L paths to transmit n data copies, we name it (L, n) RMPR and define n as the data redundancy. For example, the (4, 3) RMPR shown in Fig. 2 first expands the data into 3 copies, and then transmits them on 4 paths according to the allocation VOLUME 9, 2021 FIGURE 2. Data allocation of (4, 3) RMPR.
proportions w 1 ∼ w 4 , which satisfy 4 i=1 w i = 3. In order to reduce the risk of data loss, non-overlapping data segments should be transmitted within the same path. Therefore, each path can only transmit one data copy at most, i.e. 0 ≤ w i ≤ 1. And the data redundancy satisfies 1 ≤ n ≤ L. The data allocation proportions mainly affect the end-to-end delay of RMPR. In Section III, the method of optimizing the data allocation proportions to minimize the end-to-end delay is discussed in detail.
In the parameter adjustment stage, (L, n) RPMR can dynamically adjust L and n to ensure the reliability and timeliness of telecommand. In Section IV, the influence of L and n on PDR and end-to-end delay is analyzed, and the parameter adjustment method is given in detail.

III. END-TO-END DELAY AND ITS OPTIMIZATION A. END-TO-END DELAY
Generally, link delay is composed of propagation delay, transmission delay, queuing delay and processing delay: Propagation delay refers to the delay of signal propagation in space, which is determined by the signal propagation distance. For the wireless link, the propagation delay is the ratio of the propagation distance to the speed of light: where d is the link propagation distance and c is the speed of light. Transmission delay refers to the time required for a packet to complete transmission due to link bandwidth limitation: where m is the amount of data and b is the link bandwidth. Queuing delay refers to the time that data packets are buffered in the satellite forwarding queue. In the process of multi-hop delivery, if the satellite link is occupied, the packet is buffered in the queue and forwarded according to a certain rule and order. However, for the telecommand scenario of satellite constellation, the ground station only needs to control the satellite and thus sends command data through the network in a few cases, such as fault diagnosis, orbit adjustment and attitude adjustment. Therefore, only a small amount of data is transmitted on the network, and only in a few cases can command data enter the buffer and queuing delay is introduced. According to the queuing theory, the queuing delay depends on the data arrival rate, the buffer size and the service rate. Since the data arrival rate of the networked telecommand system is very low according to the above analysis, we do not consider the queuing delay for simplification of the system model.
Processing delay refers to the time for packet processing, including analyzing packet header, extracting data, error checking, etc. Generally, the processing delay is in the order of microseconds. Compared with the propagation delay and transmission delay, the processing delay can be ignored.
Therefore, considering the minor probability of queuing and the negligible processing delay, the link delay of command data is Path delay is the sum of each hop's link delay, i.e.
Assuming that (L, n) RMPR allocates n data copies on L paths according to the proportions of w 1 , w 2 , · · · , w L , which The end-to-end delay of (L, n) RMPR depends on the time when the first recoverable data copy is successfully received. Let [a, b] denotes the data segment starting from a to b of the original data, where 0 ≤ a < b ≤ 1. For example, (4, 3) RMPR shown in Fig. 3 allocates 3 data copies on P 1 , P 2 , P 3 , P 4 according to the proportions of 0.7, 0.8, 0.7, and 0.8, respectively. Failure occurs on P 3 , while P 1 , P 2 , P 4 finish the transmission with the delays of 10ms, 8ms and 9ms respectively. The data segments of [0, 0.5] and [0.7, 1] are first received through P 2 with the delay of 8 ms; and the data segment of [0.5, 0.7] is first received through P 4 with the delay of 9 ms. Therefore in this case, the end-to-end delay of (4, 3) RMPR is 9 ms. However, if P 3 does not fail and the path delay is 8.5 ms, then the data segment of [0.5, 0.7] would be first received through P 3 . In this case, the end-to-end delay of (4,3) RMPR is 8.5 ms.
In different cases of path failure, the end-to-end delay varies even with the same data allocation proportions. Due to the unpredictability of path failure, we consider the worst case, that is, the original data is recovered when the data segment on the path with the maximum delay is received. Therefore, the end-to-end delay can be derived as

B. OPTIMIZATION OF THE END-TO-END DELAY
In this section, we will optimize the data allocation proportions of different paths to obtain the minimum end-to-end delay. Consider the following optimization problem: where P = diag(γ 1 , · · · , γ L ), q = (q 1 , · · · , q L ) T , w = (w 1 , w 2 , · · · , w L ) T . ( * ) i represents the i-th element of the vector in the bracket. Here the auxiliary variable z is introduced to derive the equivalent optimization problem: Since the objective function and constraint function are affine, the optimization problem is convex. The domain of the problem is R L+1 . Considering the point of (w rel , z rel ) = n L , · · · , n L , max where relint R L+1 represents the relative interior of R L+1 , we notice that 0 ≺ w rel ≺ 1, 1 T w rel = n, γ i w rel,i + q i · w rel,i < z rel · w rel,i ∀i, so the Slater condition is satisfied. Since the objective function and the constraint function of the convex optimization problem are differentiable and the Slater condition is satisfied, the KKT (Karush-Kuhn-Tucker) conditions are necessary and sufficient for the optimal solution. Here the Lagrange multipliers λ, u, v, η are introduced, where λ = (λ 1 , λ 2 , · · · , λ L ) T , u = (u 1 , u 2 , · · · , u L ) T , η = (η 1 , η 2 , · · · , η L ) T . And the Lagrange function is defined as The KKT conditions of the convex optimization problem consist of four parts, which are 1) Constraints of the original optimization problem: 2) Constraints of the dual problem: 3) Complementary relaxation conditions: 4) The gradient of Lagrange function is 0: Through the solving process of (11) ∼ (14) in the appendix, the unique solution of the above equations is obtained as: The solution of w i can be equivalent to the problem of water filling. Fig. 4 shows the equivalent water filling problem of data allocation on 6 paths, where the blue line q i is the floor of the container, the blue line γ i + q i is the ceiling of the container, the shaded part is the injected water, and the red line z is the water level. For each path, if the floor is higher than the water level, i.e. q i ≥ z , no water can be injected into the area and thus w i = 0, such as path 2; if the floor is lower than the water level and the ceiling is higher than the water level, i.e. q i < z , γ i + q i > z , water can be injected into the area until q i + γ i w i = z , such as path 1, 3, 5, 6; if the floor and the ceiling are lower than the water level, i.e. q i < z , γ i + q i ≤ z , water can be fulfilled between the floor and the ceiling of the area and thus w i = 1, such as path 4.

C. CALCULATION OF THE OPTIMAL DATA ALLOCATION PROPORTIONS BASED ON WATER FILLING ALGORITHM
We calculate the optimal data allocation proportions for (L, n) RMPR with the minimum delay based on the water filling problem. For path i, we assume that the floor is q i , the rising rate of the water level is γ i , and the ceiling is γ i + q i . Firstly, all floors and ceilings q 1 , · · · , q L , γ 1 + q 1 , · · · , γ L + q L are sorted in ascending order as s 1 , · · · , s 2L . With the increase of the volume of injected water, we assume that the water level rises in the sequence of s 1 , · · · , s l , s , where s is the water level with all water injected and s l < s ≤ s l+1 . We check in order whether s 1 , · · · , s 2L is s l by judging whether the water filling volume of s i exceeds n. When the water level increases from s l to s , the water level rises only in the areas satisfying q i ≤ s l < γ i + q i , and the rising rate of the water level is 1 i∈{i|q i ≤s l <γ i +q i } 1 γ i . Specifically, the water filling algorithm for calculating the optimal data allocation proportions is shown in Algorithm 2.

IV. PARAMETER ADJUSTMENT
(L, n) RMPR transmits n data copies on L paths, which can resist path failure. However, in different cases of path failure, the numbers of failed paths that (L, n) RMPR can resist are different. The worst case and the best case of (L, n) RMPR against path failure are discussed in Proposition 1 and Proposition 2.
Proof: Suppose that the data allocation proportions of n-1 failed paths are w 1 ∼ w n−1 , which satisfy w i ≤ 1. In the worst case, one data copy is transmitted on each failed path, i.e. w i = 1 for 1 ≤ i ≤ n − 1. And the amount of data successfully received is n − n−1 i=1 w i = 1, which indicates that the original data can be recovered. Therefore for failures of any n-1 paths, (L, n) RMPR can successfully recover the original data. All L-1 paths except path 1 fail. Thus one data copy is successfully received, which indicates that the original data can be recovered. Therefore (L, n) RMPR can resist failure of L-1 paths in this case. However for failure of L paths,

Algorithm 2 Calculation of the Optimal Data Allocation Proportions With Minimum Delay Based on Water Filling
Input: Path propagation delays q 1 , · · · , q L , path bandwidth factors γ 1 , · · · , γ L , and data redundancy n. Output: The optimal data allocation proportions w 1 , · · · , w L . 1: Step 1 (Initialization): 2: All floors and ceilings q 1 , · · · , q L , γ 1 + q 1 , · · · , γ L + q L are sorted in ascending order as s 1 , · · · , s 2L ; 3: Step 2 (Determine the water level with all water injected): 4: for i = 1 to 2L do 5: for j = 1 to L do 6: if q j < s i < γ j + q j then 7: else if s i ≤ q j then 9: w j = 0; 10: else if s i ≥ γ j + q j then 11: w j = 1; 12: end if 13: end for 14: if j w j > n then 15: The current water level is s = s i−1 ; Obviously, the number of failed paths resisted by (L, n) RMPR varies under different cases of path failures. In order to simplify the analysis, we discuss the influence of path number L and data redundancy n on PDR in the worst case.
Proposition 3: In the worst case, with the increase of data redundancy n, the PDR of (L, n) RMPR increases or remains unchanged.
Proof: In the worst case, (L, n) RMPR can only resist failure of at most n-1 paths. Suppose that the set of failed paths is F, we have PDR = p (|F| ≤ n − 1). Considering (L, n+1) RMPR, we have PDR = p (|F| ≤ n) ≥ p (|F| ≤ n − 1) = PDR. Therefore, in the worst case, with the increase of data redundancy n, the PDR of (L, n) RMPR increases or remains unchanged.
Proposition 4: In the worst case, with the increase of path number L, the PDR of (L, n) RMPR decreases or remains unchanged.
Proof: In the worst case, (L, n) RMPR can only resist failure of at most n-1 paths. Suppose that the set of failed paths is F, we have PDR = p (|F| ≤ n − 1). For (L+1, n) RMPR, supposing that the failure probability of the (L+1)- Therefore, in the worst case, with the increase of path number L, the PDR of (L, n) RMPR decreases or remains unchanged.
Based on the equivalent water filling problem of optimal data allocation in Section III, the influence of path number L and data redundancy n on end-to-end delay is discussed in Proposition 5 and Proposition 6.
Proposition 5: With the increase of data redundancy n, the delay of (L, n) RMPR increases or remains unchanged.
Proof: Considering the equivalent water filling problem of data allocation, we assume that the water volumes of L paths of (L, n) RMPR are w 1 , · · · , w L , and the water level is z. For (L, n+1) RMPR, the water volume of L paths are w 1 , · · · , w L , which satisfy w i ≥ w i . Therefore we have z = max 1≤i≤L,w i =0 {q i + γ i w i } = z, which indicates that the water level rises or remains unchanged. Therefore, with the increase of data redundancy n, the delay of (L, n) RMPR increases or remains unchanged.
Proposition 6: With the increase of path number L, the delay of (L, n) RMPR decreases or remains unchanged.
Proof: Considering the equivalent water filling problem of data allocation, we assume that the water volumes of L paths of (L, n) RMPR are w 1 , · · · , w L , and the water level is z. For (L+1, n) RMPR, we suppose that the water volume of the L+1 paths are w 1 , · · · , w L+1 , and that the floor of the (L+1)-th path is q L+1 . If q L+1 ≥ z, we have w L+1 = 0, w 1 = w 1 , · · · , w L = w L . Therefore z = max 1≤i≤L+1,w i =0 {q i + γ i w i } = z, which indicates that the water level remains unchanged.
{q i + γ i w i } = z, which indicates that the water level decreases or remains unchanged. In summary, with the increase of path number L, the delay of (L, n) RMPR decreases or remains unchanged.
The basic principles of parameter adjustment can be obtained through the above analysis. According to Proposition 3 and 4, the data redundancy can be increased or the path number can be decreased to improve the PDR for enhancing the reliability of telecommand. According to Proposition 5 and 6, the data redundancy can be decreased or the path number can be increased to reduce the delay for enhancing the timeliness of telecommand.
Generally, the transmission of command data needs to ensure that the PDR is higher than a given threshold. On the basis of the guarantee of reliability, the delay should be reduced to the greatest extent for enhancing the timeliness. Specifically, if the current PDR is lower than the given threshold, the data redundancy can be increased or the path number can be decreased. If the current PDR is higher than the given threshold, the data redundancy can be decreased or the path number can be increased.

V. COMPUTATIONAL SIMULATION A. SIMULATION METHODOLOGY
The constellation of Starlink is selected for computational simulation. By October 30, 2020, about 725 satellites have been successfully launched into the scheduled orbits. Satellites are distributed on 32 orbital planes with the inclination of 53 • , the altitudes of 200 km ∼ 600 km, and the orbital period of about 5531 seconds [15], [16]. According to the orbital elements of Starlink by October 30, 2020, we build the constellation at 12:00 on October 30, 2020. Fig. 5 shows the 3D topology of the constellation, and Fig. 6 shows the satellite trajectories on the earth surface.
Based on the network topology of the constellation, we further define the simulation conditions of ISLs and SGLs. ISLs can be established only when satellites are visible to each other and the propagation distance is less than 2000 km. SGLs can be established only when the satellite is visible to the ground station and the elevation angle of the ground station is more than 5 • . The bandwidths of ISLs and SGLs are randomly set as 100 kHz, 200 kHz, · · · , 1 MHz [16,17], and failure probability of each ISL and SGL is set as the same within the range of 10 −4 ∼ 10 −1 . New York is selected as the location of the ground station and Starlink-1625 is selected as the destination satellite. The packet size of command data is set as 1 kb. And the simulation period starts from 12:00 to 13:33 on October 30, 2020, which covers an orbital period.

B. SIMULATION AND PERFORMANCE COMPARISON
In this section, the performances of (L, n) RMPR, single-path routing and backup multi-path routing are simulated and VOLUME 9, 2021  compared. Single-path routing selects the shortest path from the ground station to the destination satellite. Backup multi-path routing selects multiple shortest edge-disjoint paths as backups. Assuming that the L shortest edge-disjoint paths from the ground station to the destination satellite are P 1 , · · · , P L , where P i is the i-th shortest path. The single-path routing uses P 1 for transmission, without any path backup. Backup multi-path routing initially uses P 1 for transmission. If failures occur, the activated path will be switched sequentially to P 2 , · · · , P L until the transmission succeeds.
We simulate the delivery process of command data from the ground station to the destination satellite, and analyze the influence of the path number, the data redundancy and the link failure probability on the delay and PDR of different routing algorithms.
For the simulation shown in Fig. 7, Fig. 8, the data redundancy is fixed as 3 and the link failure probability is fixed as 10 −2 . With the increase of the path number, the delay and PDR of (L, n) RMPR decrease, which is consistent with the theoretical analysis in Section IV. Compared with single-path  routing, (L, 3) RMPR has higher PDR and lower delay, and thus has better reliability and timeliness. Meanwhile, the PDR of (L, 3) RMPR is only slightly lower than that of backup multi-path routing, but the delay of (L, 3) RMPR is greatly reduced compared with backup multi-path routing.
For the simulation shown in Fig. 9, Fig. 10, the path number is fixed as 5, and the link failure probability is fixed as 10 −2 . With the increase of data redundancy, the delay and the PDR of (L, n) RMPR increases, which is consistent with the theoretical analysis in Section IV. Compared with single-path routing, (5, n) RMPR has higher PDR and lower delay, and thus has better reliability and timeliness. Meanwhile, the PDR of (5, n) RMPR is only slightly lower than that of backup multi-path routing, but the delay of (5, n) RMPR is greatly reduced compared with backup multi-path routing.
For the simulation shown in Fig. 11, Fig. 12, we compare the performance of different routing algorithms under different link failure probabilities. Generally, the link failure probability of the constellation network would not change dramatically. The path number L and the data redundancy n  can be adjusted by the ground station according to the link failure probability for better performance on PDR and delay.
Then we compare the performance of (L, n) RMPR with that of backup 5-path routing. For the link failure probability as 10 −4 , the PDRs of (5,1), (4,2), (4,3), (5,5) RMPR are lower than that of backup 5-path routing by no more than 0.4%, while the delay of (5,1) RMPR is 30.17% lower than  that of backup 5-path routing. For the link failure probability as 10 −3 , the PDRs of (4,2), (4,3), (5,5) RMPR are lower than that of backup 5-path routing by no more than 0.04%, while the delay of (4,2) RMPR is 20.92% lower than that of backup 5-path routing. For the link failure probability as 10 −2 , the PDRs of (4,3), (5,5) RMPR are lower than that of backup 5-path routing by no more than 0.34%, while the delay of (4,3) RMPR is 24.25% lower than that of backup 5-path routing. For the link failure probability as 10 −1 , only the PDR of (5,5) RMPR is close enough to that of backup 5-path routing, and the delay of (5,5) RMPR is 65.68% lower than that of backup 5-path routing. Therefore, (L, n) RMPR dramatically improves the timeliness while slightly reduces the reliability compared with backup 5-path routing.

C. DISCUSSION
Single-path routing only uses the shortest path, which is under high risk of path failure. Therefore the low PDR is hard to meet the reliability requirement of telecommand. Although backup multi-path routing has the highest PDR, the high delay due to the introduction of retransmission reduces the VOLUME 9, 2021 timeliness of telecommand. (L, n) RMPR utilizes data redundancy to resist path failures, so the high PDR meets the reliability requirement of telecommand. Moreover, due to the following reasons, the delay of (L, n) RMPR is lower than that of single-path routing and backup multi-path routing: Firstly, backup multi-path routing introduces retransmission delay when path failure occurs, while (L, n) RMPR resists path failures with data redundancy rather than retransmission. Secondly, (L, n) RMPR allocates data to multiple paths according to the optimal proportions, which makes full use of the transmission capacity of multiple paths and minimizes the delay. Therefore, the high reliability and timeliness makes (L, n) RMPR more suitable for telecommand in satellite constellation.
Furthermore, the routing overhead is discussed from the perspective of data redundancy. For failure probabilities of 10 −4 ∼ 10 −1 , single-path routing transmits 1 data copy, backup 5-path routing transmits 1.007, 1.0074, 1.0782, 1.8598 data copies on average respectively, and (L, n) RMPR transmits n data copies. Specifically, (5, 1), (4, 2), (4, 3), (5, 5) RMPR mentioned in Section V transmit 1, 2, 3, 5 data copies respectively. Although the data redundancy of (L, n) RMPR is larger than those of backup multi-path routing and single-path routing, the amount of command data is usually small, which means the amount of data copies will be small as well. Therefore the data redundancy introduced by RMPR is generally acceptable for the network.

VI. CONCLUSION
In networked telecommand system of the constellation, failure-tolerant and low-latency RMPR transmits data redundancy on multiple paths of the constellation network. Specifically, data copies are allocated according to the optimal proportions with the minimum delay on multiple shortest edge-disjoint paths, ensuring both high reliability and timeliness. In contrast, traditional single-path routing is vulnerable to path failure, which cannot meet the reliability requirement of telecommand. Moreover, although traditional backup multi-path routing guarantees high reliability, the retransmission delay reduces the timeliness of telecommand. We select the topology of Starlink constellation from 12:00 to 13:33 on October 30, 2020 to verify the reliability and timeliness of RMPR. For the link failure probabilities varying in the range of 10 −4 ∼ 10 −1 , compared with the single-path routing, the PDR of RMPR is improved by about 12% ∼ 40%, and the delay is reduced by about 10% ∼ 30%; compared with the backup multi-path routing, the PDR of RMPR is slightly reduced by less than 0.4%, but the delay is dramatically reduced by about 30% ∼ 70%.
RMPR mainly focuses on transmitting multiple data copies on multiple paths according to the optimal proportions to ensure the reliability and timeliness of telecommand. In the path selection stage, RMPR selects multiple shortest paths from the ground station to the destination satellite. For future research, with link quality detection methods specialized for different scenarios, the paths can be selected according to the signal-to-noise ratio, link availability history and other parameters, which may bring potential improvement on reliability and timeliness of RMPR.

APPENDIX
A. SOLUTION OF EQUATIONS (11 ∼ 14) (a) The case of q i ≥ z : Assuming w i = 0, since 0 ≤ w i ≤ 1 (11-a), we have w i > 0. As q i ≥ z , γ i w i > 0, we obtain γ i w i + q i > z and γ i w i + q i w i > z · w i , which contradicts with γ i w i + q i w i ≤ z · w i (11-c). Therefore, the hypothesis does not hold, i.e. w i = 0. (b) The case of q i < z : Combining the conditions of λ i w i = 0 (13-a) with −λ i + u i + v + η i 2γ i w i + q i − z = 0 (14b), we derive µ i + v + η i 2γ i w i + q i − z ·w i = 0. And according to η i w i γ i w i + q i − z = 0 (13-c), we have Here v = 0 is proved by contradiction: Assuming v = 0 and combining the conditions of u i w i − 1 = 0 (13-b) with µ i + v + η i γ i w i · w i = 0 (16), we derive v + η i γ i w i · w i = −µ i . As µ i ≥ 0, we have v + η i γ i w i ·w i ≤ 0. Since v = 0, we have η i γ i w 2 i ≤ 0. From η i ≥ 0, w i ≥ 0, γ i > 0, we derive η i γ i w 2 i ≥ 0. Furthermore, η i w i = 0 holds for any i, and thus we obtain as v = 0, we obtain µ i = 0. Since u i w i − 1 = 0 (13-b), we derive w i = 1. Therefore, the 3 possible solutions satisfying µ i + v + η i γ i w i · w i = 0 (16) are as follows: Here v < 0 is proved by contradiction: Assuming v > 0, for the case of η i = 0, < 0 and contradicts with w i ≥ 0.
Therefore, η i = 0, w i = −µ i −v η i ·γ i cannot be the solution of µ i + v + η i γ i w i · w i = 0 (16). Furthermore, for any i, either w i = 0 or η i = 0, w i = 1 must be satisfied. So that i w i η i = 0, which contradicts with i w i η i = 1 (14-a).
As w i = 0, there are only 2 possible solutions of µ i + v + η i γ i w i · w i = 0 (16): Here we prove the proposition by contradiction: If γ i +q i ≤ z , then w i = 1. Assuming w i < 1, we have γ i w i + q i − z < γ i + q i − z ≤ 0. According to η i w i γ i w i + q i − z = 0 (13-c), we obtain η i w i = 0. Since w i = 0, we derive η i = 0. Therefore the solution of µ i + v + η i γ i w i · w i = 0 (16) is η i = 0, w i = 1, which contradicts with w i < 1. Thus, the hypothesis does not hold, i.e. w i ≥ 1. Finally, according to w i ≤ 1 (11-a), we derive w i = 1.
Here we prove the proposition by contradiction: If γ i + q i > z , then w i = −µ i −v η i ·γ i . Assuming η i = 0, then we obtain w i = 1, so that γ i w i + q i = γ i + q i > z , which contradicts with γ i w i + q i w i ≤ z · w i (11-c). Therefore, the hypothesis does not hold, i.e. η i = 0, so that Here w i = −µ i −v η i ·γ i is further simplified: As w i = 0 and λ i w i = 0 (13-a), we obtain λ i = 0. According to −λ i + u i + v + η i 2γ i w i + q i − z = 0 (14-b), we have −u i − v = η i (z − q i ), so that w i = z −q i γ i . In conclusion, the solutions of equations (11 ∼ 14) are derived as follows: