A method implemented by a network topology design system, the network topology design system including a processing device, the method to determine placement of a controller within a network with a split architecture where control plane components of the split architecture network are executed by a controller and the control plane components are separate from data plane components of the split architecture network, wherein the placement of the controller is selected to minimize disruption of the split architecture network caused by a link failure, a switch failure or a connectivity loss between the controller and the data plane components, the method comprising the steps of: a) graphing a topology of the split architecture network, with links in the split architecture network represented as a set of edges in a graph and network elements in the split architecture network represented as a set of nodes (S1-S10) wherein control traffic is sent to and from the controller over a controller routing tree rooted at the controller; b) for each node (S1-S10) in the graph generating a controller routing tree with said each node serving as the root of the tree and traversing the set of nodes (S1-S10) within the graph to calculate a protection metric for each node, wherein the protection metric measures resilience of the split architecture network as a degree of node failure protection within the split architecture network for a potential controller placement, the degree of node failure protection determining a subset of protected nodes in the set of nodes, or wherein said protection metric is the number of protected neighbour nodes, where a protected node can encapsulate control traffic inside a data message and redirect said encapsulated control traffic over a tunnel to an intermediate node in the graph that is not downstream of the protected node and in which said encapsulated control traffic is decapsulated, and where the tunnel traverses at least one downstream node of the protected node; and c) selecting the network element (317, 315) corresponding to the node serving as a root of the tree with a best protection metric to be the controller for the split architecture network. a) graphing a topology of the split architecture network, with links in the split architecture network represented as a set of edges in a graph and network elements in the split architecture network represented as a set of nodes (S1-S10) wherein control traffic is sent to and from the controller over a controller routing tree rooted at the controller; b) for each node (S1-S10) in the graph generating a controller routing tree with said each node serving as the root of the tree and traversing the set of nodes (S1-S10) within the graph to calculate a protection metric for each node, wherein the protection metric measures resilience of the split architecture network as a degree of node failure protection within the split architecture network for a potential controller placement, the degree of node failure protection determining a subset of protected nodes in the set of nodes, or wherein said protection metric is the number of protected neighbour nodes, where a protected node can encapsulate control traffic inside a data message and redirect said encapsulated control traffic over a tunnel to an intermediate node in the graph that is not downstream of the protected node and in which said encapsulated control traffic is decapsulated, and where the tunnel traverses at least one downstream node of the protected node; and c) selecting the network element (317, 315) corresponding to the node serving as a root of the tree with a best protection metric to be the controller for the split architecture network.