# US 12,001,835 B2 · In-service software upgrade with active service monitoring > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,001,835 B2 - Document ID: US12001835B2 - Status: Granted - Kind: B2 - Application number: 17/551,136 - Filed: 2021-12-14 - Published: 2023-06-15 - Granted: 2024-06-04 - Earliest claimed: 2021-12-14 - Assignees: Hewlett Packard Enterprise Development LP - Applicants: Hewlett Packard Enterprise Development LP - Inventors: Francisco José Rojas Fonseca; Jorge Arturo Sauma Vargas; Eduardo Francisco Ramirez Acosta; Pablo Cesar Barrantes Chaves - Web page: https://patentgrep.com/patent/US12001835B2 ## CPC - G06F 8/656: while running - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system for performing in-service software upgrade on a network device is provided. In response to a software-upgrade command, the system generates an upgrade database based on a state database storing both a data-plane state and a control-plane state associated with the network device. The network device is managed by a management unit comprising a data-plane-management sub-unit and a control-plane sub-unit, and the upgrade database stores at least the data-plane state to allow the data-plane-management sub-unit to operate based on the upgrade database. The system separately upgrades the data-plane-management sub-unit and the control-plane sub-unit, without interrupting services provided by the network device. The system monitors the state database and the upgrade database to detect an event associated with the network device. In response to determining a triggering condition being met, the system performs an action to prevent a network outage or error. ## Claims ### Claim 1 A computer-executed method for performing an in-service software upgrade on a network device, the method comprising: in response to a software-upgrade command, generating an upgrade database based on a state database storing both a data-plane state and a control-plane state associated with the network device, wherein the network device is managed by a management unit comprising a data-plane-management sub-unit for configuring hardware devices according to the data-plane state and a control-plane sub-unit for monitoring the control-plane state, and wherein the upgrade database stores at least a copy of the data-plane state prior to the upgrade; upgrading the management unit by separately upgrading the data-plane-management sub-unit and the control-plane sub-unit, without interrupting services provided by the network device, wherein upgrading the data-plane-management sub-unit comprises: terminating the data-plane-management sub-unit to allow the hardware devices to operate in an autonomous mode; restarting a newer version of the data-plane-management sub-unit; and reattaching the newer version of the data-plane-management sub-unit to the hardware devices based on the copy of the data-plane state prior to the upgrade stored in the upgrade database; monitoring the control-plane state in the state database and the data-plane state in the upgrade database to detect an event associated with the network device during the upgrading of the management unit; and in response to determining, based on the detected event and a set of pre-defined criteria, that a triggering condition is met, performing an action to prevent a network outage or error. ### Claim 2 (depends on 1) The method of claim 1, wherein generating the upgrade database comprises creating a clone of the state database or copying the data-plane state into the upgrade database. ### Claim 3 (depends on 1) The method of claim 1, wherein the management unit executes on a first processor, and wherein restarting the newer version of the data-plane-management sub-unit comprises executing the newer version of the data-plane-management sub-unit on a second standby processor. ### Claim 4 (depends on 3) The method of claim 3, wherein upgrading the control-plane sub-unit comprises: terminating the control-plane sub-unit; and restarting a newer version of the control-plane sub-unit on the second standby processor. ### Claim 5 (depends on 1) The method of claim 1, wherein the set of predefined criteria comprises one or more of: the detected event is associated with a critical service; the detected event is associated with a critical port; the detected event is associated with a critical interface; the detected event is associated with a critical overlay; the detected event is a pre-determined AAA (Authentication, Authorization, and Accounting) event; the detected event is associated with a predetermined network protocol; and the detected event is an internal failure of the management unit. ### Claim 6 (depends on 1) The method of claim 1, wherein the triggering condition comprises one or more of: the detected event may cause the in-service software upgrade to fail; the detected event may cause instability in the network; the detected event may cause an outage or error in the network; and the detected event may interrupt a critical service. ### Claim 7 (depends on 1) The method of claim 1, wherein the action comprises one or more of: pausing the upgrading of the management unit; rolling back the upgrading of the management unit to a previous state; aborting the upgrading of the management unit; and rebooting the network device. ### Claim 8 (depends on 1) The method of claim 1, wherein upgrading the management unit further comprises converging the data-plane state in the upgrade database and the control-plane state in the state database. ### Claim 9 A computer system, comprising: a processor; and a storage device coupled to the processor and storing instructions that when executed by the processor cause the processor to perform a method for facilitating an in-service software upgrade on a network device, the method comprising: in response to a software-upgrade command, generating an upgrade database based on a state database storing both a data-plane state and a control-plane state associated with the network device, wherein the network device is managed by a management unit comprising a data-plane-management sub-unit for configuring hardware devices according to the data-plane state and a control-plane sub-unit for monitoring the control-plane state, and wherein the upgrade database stores at least a copy of the data-plane state prior to the upgrade; upgrading the management unit by separately upgrading the data-plane-management sub-unit and the control-plane sub-unit, without interrupting services provided by the network device, wherein upgrading the data-plane-management sub-unit comprises: terminating the data-plane-management sub-unit to allow the hardware devices to operate in an autonomous mode; restarting a newer version of the data-plane-management sub-unit; and reattaching the newer version of the data-plane-management sub-unit to the hardware devices based on the copy of the data-plane state prior to the upgrade stored in the upgrade database; monitoring the control-plane state in the state database and the data-plane state in the upgrade database to detect an event associated with the network device during the upgrading of the management unit; and in response to determining, based on the detected event and a set of pre-defined criteria, that a triggering condition is met, performing an action to prevent a network outage or error. ### Claim 10 (depends on 9) The computer system of claim 9, wherein generating the upgrade database comprises creating a clone of the state database or copying the data-plane state into the upgrade database. ### Claim 11 (depends on 9) The computer system of claim 9, wherein the management unit executes on a first processor, and wherein executing restarting the newer version of the data-plane-management sub-unit comprises executing the newer version of the data-plane-management sub-unit on a second standby processor. ### Claim 12 (depends on 11) The computer system of claim 11, wherein upgrading the control-plane sub-unit comprises: terminating the control-plane sub-unit; and restarting a newer version of the control-plane sub-unit on the second standby processor. ### Claim 13 (depends on 9) The computer system of claim 9, wherein the set of predefined criteria comprises one or more of: the detected event is associated with a critical service; the detected event is associated with a critical port; the detected event is associated with a critical interface; the detected event is associated with a critical overlay; the detected event is a pre-determined AAA (Authentication, Authorization, and Accounting) event; the detected event is associated with a predetermined network protocol; and the detected event is an internal failure of the management unit. ### Claim 14 (depends on 9) The computer system of claim 9, wherein the triggering condition comprises one or more of: the detected event may cause the in-service software upgrade to fail; the detected event may cause instability in the network; the detected event may cause an outage or error in the network; and the detected event may interrupt a critical service. ### Claim 15 (depends on 9) The computer system of claim 9, wherein the action comprises one or more of: pausing the upgrading of the management unit; rolling back the upgrading of the management unit to a previous state; aborting the upgrading of the management unit; and rebooting the network device. ### Claim 16 (depends on 9) The computer system of claim 9, wherein upgrading the management unit further comprises converging the data-plane state in the upgrade database and the control-plane state in the state database. ### Claim 17 A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for facilitating an in-service software upgrade on a network device, the method comprising: in response to a software-upgrade command, generating an upgrade database based on a state database storing both a data-plane state and a control-plane state associated with the network device, wherein the network device is managed by a management unit comprising a data-plane-management sub-unit for configuring hardware devices according to the data-plane state and a control-plane sub-unit for monitoring the control-plane state, and wherein the upgrade database stores at least a copy of the data-plane state prior to the upgrade; upgrading the management unit by separately upgrading the data-plane-management sub-unit and the control-plane sub-unit, without interrupting services provided by the network device, wherein upgrading the data-plane-management sub-unit comprises: terminating the data-plane-management sub-unit to allow the hardware devices to operate in an autonomous mode; restarting a newer version of the data-plane-management sub-unit; and reattaching the newer version of the data-plane-management sub-unit to the hardware devices based on the copy of the data-plane state prior to the upgrade stored in the upgrade database; monitoring the control-plane state in the state database and the data-plane state in the upgrade database to detect an event associated with the network device during the upgrading of the management unit; and in response to determining, based on the detected event and a set of pre-defined criteria, that a triggering condition is met, performing an action to prevent a network outage or error. ### Claim 18 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the set of predefined criteria comprises: the detected event is associated with a critical service; the detected event is associated with a critical port; the detected event is associated with a critical interface; the detected event is associated with a critical overlay; the detected event is a pre-determined AAA (Authentication, Authorization, and Accounting) event; the detected event is associated with a predetermined network protocol; and the detected event is an internal failure of the management unit.