Broker Unit Update Without Downtime in Embedded Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Embedded control devices face challenges in updating the broker unit without downtime, as it is a critical component providing decoupled Publish/Subscribe-based communication, and downtime can be costly and risky, especially in critical infrastructure.
Innovation Solution
The embedded control device includes an updater unit that facilitates the update of the broker unit by executing a new instance alongside the old instance, publishing an update topic, and transmitting a switch command on the message bus to hand over control atomically, ensuring minimal downtime.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the broker unit is updated by shutting down the old instance and starting the new instance, then the update is completed, but downtime occurs and system availability deteriorates
Solution Approach 1:
The new broker instance is started and prepared in advance while the old instance is still running. The new instance is configured and ready before the actual switchover, allowing the update to be applied without interrupting system availability. This preliminary preparation eliminates downtime by having the replacement instance ready beforehand.
Solution Approach 2:
A switchover mechanism acts as an intermediary between the old and new broker instances. This mechanism manages the transition by coordinating the shutdown of the old instance and the activation of the new instance, ensuring that the update process does not cause system downtime. The intermediary handles the complexity of the transition, making the update transparent to the running system.
2Ease of manufacture
If the broker unit is updated with conventional methods, then the new component is installed, but operational safety risks increase due to potential critical events being missed
Solution Approach 1:
The switchover mechanism serves as an intermediary that manages the update process safely. It coordinates the transition between broker instances, ensuring that critical events are not missed during the update. The intermediary handles the complexity of the transition, making the update both simple to execute and safe for operational continuity.
Solution Approach 2:
The system implements feedback mechanisms to monitor the broker instance transition. The switchover mechanism receives feedback about the state of both old and new instances, ensuring that the update process maintains operational safety. This feedback loop allows the system to detect and respond to any issues during the update, preventing critical events from being missed.
3Reliability
If the broker unit is updated frequently for security patches, then security is improved, but the complexity of managing updates increases
Solution Approach 1:
The new broker instance is prepared and validated in advance before being activated. This preliminary action includes downloading, configuring, and testing the new instance while the old one continues to run. By preparing beforehand, the system can apply security updates frequently without increasing management complexity, as each update follows a standardized pre-preparation process.
Solution Approach 2:
The update mechanism is designed to be self-service, automatically managing the lifecycle of broker instances. The system handles downloading, validating, and activating new instances without requiring complex manual intervention. This self-service approach enables frequent security updates while keeping update management complexity low, as the system autonomously handles the update process.
Data Source
AI summary
An embedded control device can concurrently execute a number of control apps for controlling a technical system. The embedded device has a number of units, including: a broker unit configured to provide a message bus enabling serialized publish/subscribe topic-based communication between any of the control apps, the units, and the technical system. An updater unit is configured to: in response to a new instance of the broker unit being executed on the embedded control device in addition to the old instance of the broker unit, publish an update topic on the message bus; and cause a handover of control from the old instance to the new instance by transmitting a switch command in the update topic on the message bus. There is also described a method for updating a broker unit of an embedded control device and a computer program product. The broker unit can be updated without downtime.