ple, node S3 is an upstream node of nodes S6 and S7, and these two nodes are downstream nodes of node S3. In the controller routing tree, a node's parent is its immediate upstream node and a node's children are its immediate downstream nodes. Because of the assumed tree structure, each node has only one immediate upstream node in T. 4.4.4.2 Node Versus Link Failure With a given controller location and controller routing tree T, consider node a and its immediate upstream node b. We say node a is pro- tected against the failure of its outgoing link (a, b) if there exists node C E V\{a,b} with the following properties: 1) (a,c) is in G (i.e., there is a link between nodes a and C in the net- work). 2) Node C is not a downstream node of node a in T. The second condition guarantees that a loop will not be created as a result of connecting node a to node C. If the above conditions are met, then link (a, c) could be assigned as the backup link for link (a,b), and this backup link could be preconfig- ured in node a. As soon as node a detects a failure in link (a, b), it will immediately change its route to the controller by changing the primary link (a, b) to the secondary link (a, c). We say that node a is also protected against the failure of its imme- diate upstream node if node C satisfies another condition in addition to the above ones. 3) Node C is not a downstream node of node b in T. This condition guarantees that the control traffic of node C toward the controller will not pass through node b (which is assumed to have failed). Again, as soon as node a detects a failure in node b, it switches its outgoing link over from (a, b) to (a, c). In the network shown in Figure 4.14, for example, Switches S, S2, and S7, are not locally protected, that is, if their out- going links (or upstream nodes) fail, no backup links can be chosen and preconfigured to be used. 4.4 SDN Management Switch S4 is protected against its output link failure, that is, if link (S4, S2) fails, link (S4, S5) could be used instead. However, S4 is 