Updating the MUXEN Brain — overview

This manual is about one thing: how to put a new version of the software on a Brain, safely.

There are two ways to do it, and the rest of this manual is one chapter for each:

Route	When it is used	Chapter
From the HMI	the boat has a working internet link and the Brain is registered with the MUXEN update server	Updating from the HMI
From a USB key	no link, or a yard visit — the update is carried on a stick	Updating from a USB key

Both routes end the same way: the new version is written to the spare copy of the system software, and the Brain switches to it at the next reboot.

How an update works

The Brain keeps two complete copies of its system software on the internal storage, and runs from one of them at a time. An update is written into the copy that is not running. Nothing on the boat changes while that happens: the screens, the daemons, the CAN bus and the navigation instruments keep running from the copy they booted from. Only a reboot switches to the new copy, and only when the install has finished cleanly.

If the new copy does not come up properly, the bootloader gives up on it and starts the old one again. The Brain returns to the software it was running before, on its own, with nobody on board doing anything.

There is no state in which a failed update leaves the Brain without a working system to boot. The previous copy is never overwritten by the update that is being installed.

Is it safe to update at sea?

The honest answer is that the update itself is safe and the reboot is the part that costs you something.

Stage	What is at risk
Downloading and writing the new version	Nothing. The running system is untouched; a failure here leaves the boat exactly as it was
The reboot	The Brain is down for as long as it takes to boot — screens, HMI and every MUXEN service with it
The first boot of the new copy	If it does not come up, the bootloader falls back to the previous copy and reboots again, so the Brain is down for a second boot cycle

Pick a moment when losing the screens for a couple of minutes is acceptable, and the rest takes care of itself. At anchor or alongside is better than in a channel.

Two things worth knowing

• Nothing happens on its own. The Brain never contacts the update server by itself and never installs anything by itself. It checks when somebody asks it to, from the update page, and it installs only after an explicit confirmation. A Brain nobody touches never updates — which also means a Brain whose update page is never opened never learns that a new version exists. Checking is part of a maintenance routine.
• Your settings are not touched. Configuration, logs and recorded data live on a separate partition that updates never replace. Only the system software is.

What this manual does not cover

Preparing a board is a yard operation, not an on-board one: installing the software, wiring the update page into the web server, and registering the Brain with the update server so that it is allowed to ask for updates at all. That, and everything about how the update client is built and behaves internally, lives in internal/ and is written for MUXEN engineers.

If the update page says the Brain is not provisioned, it has never been registered, or lost its credential when its data partition was rebuilt. It runs perfectly well; it just cannot be updated over the air until somebody with server credentials registers it. A USB-key update works regardless.

Document map

Document	Content
Updating from the HMI	check → apply → reboot, from the update page
Updating from a USB key	carrying an update on a stick, with no network
When an update does not go through	what to do when an update does not go through, and the questions people ask