  The increase in the number of SDN-based deployments in production networks is
triggering the need to consider fault-tolerant designs of controller
architectures. Commercial SDN controller solutions incorporate fault tolerance,
but there has been little discussion in the SDN literature on the design of
such systems and the tradeoffs involved. To fill this gap, we present a
by-construction design of a fault-tolerant controller, and materialize it by
proposing and formalizing a practical architecture for small to medium-sized
scale networks. A central component of our particular design is a replicated
shared database that stores all network state. Contrary to the more common
primary-backup approaches, the proposed design guarantees a smooth transition
in case of failures and avoids the need of an additional coordination service.
Our preliminary results show that the performance of our solution fulfills the
demands of the target networks. We hope this paper to be a first step in what
we consider a necessary discussion on how to build robust SDNs.
