We introduce a formal model describing the interaction between the data plane and a distributed control plane (consisting of a collection of fault-prone controllers). Then we formulate the problem of consistentcomposition of concurrent network policy updates. The composition is enabled via atransactional interface with all-or-nothing semantics, which allows us to reason about possibilities and impossibilities in controller synchronization.