Online Firmware Upgrade for Process Control Nodes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current process control systems require redundant hardware and risk unforeseen impacts during online firmware upgrades, leading to production losses and increased costs.
Innovation Solution
A method for online firmware upgrade of nodes in process control systems, where each component is upgraded as a separate executable in a separate operating system process, with synchronized runtime data and performance evaluation to ensure compatibility and avoid undesirable impacts on control system behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If redundant hardware is used to support online firmware upgrade, then system reliability is improved, but hardware cost and device complexity increase
Solution Approach 1:
The firmware is segmented into multiple independent components, each representing a functional module that can be upgraded separately. This allows the system to upgrade individual components without requiring complete redundant hardware sets, reducing hardware costs while maintaining reliability through selective component replacement.
Solution Approach 2:
Instead of maintaining complete redundant hardware copies for online firmware upgrade, the system creates virtual copies of firmware components in memory. The new firmware components are loaded and tested alongside running components, allowing upgrade without physical hardware redundancy, thus reducing device complexity and cost.
2Productivity
If online firmware upgrade is performed, then system availability is improved, but risk of unforeseen impacts on control system behavior increases
Solution Approach 1:
The system performs preliminary actions by loading new firmware components into memory before actually replacing the running components. Configuration data and runtime state are prepared and validated in advance. This allows the system to test the new firmware in a controlled manner before full activation, reducing the risk of unforeseen behavioral impacts while maintaining system availability.
Solution Approach 2:
The system implements feedback mechanisms by monitoring control system behavior during and after firmware component replacement. Runtime data is synchronized and compared between old and new components, allowing the system to detect and correct any unforeseen behavioral impacts, thus maintaining reliability while enabling online upgrades.
3Ease of manufacture
If complete firmware replacement is performed, then upgrade simplicity is improved, but risk to control system runtime behavior increases
Solution Approach 1:
The firmware upgrade process is segmented into manageable steps: loading new components into memory, synchronizing configuration data, validating runtime behavior, and then replacing individual components. This segmented approach maintains simplicity by providing clear upgrade procedures while reducing risk through incremental replacement rather than complete firmware swapping.
Solution Approach 2:
The system provides beforehand cushioning by maintaining the ability to rollback to previous firmware versions if issues are detected during upgrade. Configuration data and runtime state are preserved and can be restored if the new firmware proves problematic, thus cushioning against potential runtime behavior disruptions while keeping the upgrade process simple.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
There is provided mechanisms for online firmware upgrade of a node (300a) in a process control system (100, 100'). The node (300a) comprises components. Each component is a separate executable running in a separate operating system process as provided by a real time operating system of the node (300a). A method is performed by a node manager (200a) of the node (300a) to be upgraded. The method comprises creating (S104) a new component for each of the at least one of the components to be upgraded such that each new component is implementing a part of the firmware upgrade corresponding to its component to be upgraded, and where each new component is a separate executable running in a separate operating system process. The method comprises synchronizing (S108) runtime data in each new component with runtime data of its corresponding component to be upgraded. The method comprises replacing (S112) the at least one component to be upgraded with its new component and thereby upgrading the node (300a).