Embodiments of the present invention provide a service path protection method, a controller, a device and a system. The method includes: receiving, by an end node of a protection path, a path selection instruction sent by an SDN controller, wherein the path selection instruction comprises a service path and protection path activation type, forwarding relationships respectively of a service path and the protection path in the end node; activating at least one forwarding relationship according to the service path and protection path activation type; and when a fault occurs in the service path, updating the at least one forwarding relationship according to the service path and protection path activation type. The embodiments of the present invention relate to the field of communications technologies and resolve a problem that in an SDN technology, when a fault occurs in a service path, a protection path cannot be used.