Distributed Control Software Updates Without Plant-Wide Downtime
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Distributed control systems (DCS) face challenges in maintaining resilience during frontend software updates, as failures can render multiple devices and the system inoperative, especially when updating backend and frontend software versions require simultaneous updates across many client devices.
Innovation Solution
A distributed control system with multiple instances of backend and frontend software running different versions, managed by a software manager that allows gradual updates, starting with non-critical devices, and includes a policy server for version assignment and rollback mechanisms to ensure seamless operation and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If backend software is updated to a new version, then system functionality is improved, but frontend software on many client devices must be simultaneously updated, increasing the risk of system failure
Solution Approach 1:
The system segments the software update process by introducing a software manager that coordinates updates individually for each client device rather than requiring simultaneous updates across all devices. This allows the backend software to be updated while frontend software updates are staged and managed per device, reducing the risk of system-wide failure.
Solution Approach 2:
The software manager performs preliminary actions by notifying client devices of upcoming backend software updates before they occur. This allows frontend software to be prepared and updated in advance on individual devices, ensuring compatibility without requiring all devices to update simultaneously, thus maintaining system reliability during transitions.
2Reliability
If frontend software is updated on all client devices simultaneously, then version compatibility is ensured, but system resilience against update failures is reduced
Solution Approach 1:
The update process is segmented and distributed across individual client devices through the software manager. Each device receives update notifications and performs updates independently at different times, allowing the system to maintain operational compatibility while providing resilience if any single device fails to update successfully.
Solution Approach 2:
The system changes the temporal parameter of software updates from simultaneous to staggered/distributed timing. The software manager controls the update schedule for each client device independently, allowing version compatibility to be maintained through coordinated communication while improving resilience by preventing single-point update failures from affecting the entire system.
3Reliability
If outdated backend software is kept running, then service availability is maintained, but system security and resource efficiency are compromised
Solution Approach 1:
The software manager performs preliminary notification to client devices before backend software is updated or shut down. This allows clients to prepare and update their frontend software in advance, ensuring service availability is maintained during the transition while enabling the outdated backend software to be securely shut down after clients have migrated to compatible versions.
Solution Approach 2:
The system implements feedback through the software manager that monitors which client devices are still using outdated backend software versions. This feedback mechanism allows the system to maintain service availability by keeping outdated versions running only as long as needed, while identifying when they can be securely shut down to eliminate security vulnerabilities and free resources.
Data Source
Figure 1
Figure 2
AI summary
A distributed control system, DCS (1), for controlling the execution of at least one industrial process in an industrial plant, comprising: • low-level controllers (2) that are configured to interact with field devices that are in a direct physical relationship with the industrial process; • at least one high-level controller (3) that is configured to provide instructions (3a) for executing the industrial process, and/or set-point values (3b) at which at least one quantity of interest of the process and/or of the plant is to be kept, to the low-level controllers (2); • at least one human-machine interface, HMI, device (4) that is configured to: ∘ receive, from a user (12), user input (4a) and transmit the user input (4a), and/or a work product derived from it, to the at least one high-level controller (3); and ∘ receive, from the at least one high-level controller (3), state information (4b) of the process, and display this state information (4b) to the user (12); • at least a first instance (5a) and a second instance (5b) of backend software that are both communicatively coupled to the high-level controller (3), • at least a first instance (6a) and a second instance (6b) of frontend software running on respective client devices of the plant, and • a software manager (7) that is at least configured to indicate, to each client device, which version of frontend software (6a, 6b) is available for this client device, wherein • the first instance (6a) of frontend software is of a version that is configured to interface with the version of the first instance (5a) of backend software, and • the second instance (6b) of frontend software is of a different version that is configured to interface with the version of the second instance (5b) of backend software.