--- title: "Software updates for machines in the field | logiccloud" description: "Bring PLC software and security updates to delivered machines without travelling: inventory, staged rollout, rollback and audit log — across vendors." url: https://logiccloud.com/en/solutions/field-software-updates/ language: en-GB --- Software updates in the field Keep delivered machines current.\ Without travelling. =================== If you look after hundreds of machines at many customers, every update needs a process — not a service technician with a USB stick. With logiccloud ORCHESTRATE you see which software runs on which machine, roll out new versions in stages and document every change. Across vendors — including software that was not built with logiccloud. [Request a demo](https://logiccloud.com/en/demo/) [Go to ORCHESTRATE](https://logiccloud.com/en/products/orchestrate/) logiccloud ORCHESTRATE live Installed base · X200 / Europe Machine Customer · site Version State X200-0142 Customer A · Lyon 4.8.0 current X200-0156 Customer B · Graz 4.7.2 outdated X200-0161 Customer B · Graz 4.7.2 outdated X200-0177 Customer C · Brno 4.8.0 current X200-0183 Customer D · Linz 4.6.9 outdated 3 machines not on the released version Rollout 4.8.0 · canary Machine Hardware Version Rollout X200-0156 WAGO CC100 4.7.2 4.8.0 canary updated X200-0161 Kontron KBox 4.7.2 4.8.0 waiting updated X200-0183 ctrlX CORE 4.6.9 4.8.0 waiting updated Auto-rollback once the failure rate passes the threshold Evidence - Version 4.8.0 from the registry sha256 checked - Batches approved by an admin canary → rest - All machines in the group on 4.8.0 5 / 5 - Every change in the audit log immutable · CSV Illustrative example — names and values are made up. Today and tomorrow ## From one-off jobs to an update process ### Updates today - Nobody knows for sure which version runs on which machine - Every update is a site visit or a remote session - Customers stay on old versions — known vulnerabilities included - Evidence is pieced together afterwards, when someone asks ### With logiccloud ORCHESTRATE - Inventory: version per machine, customer and site at a glance - Roll out new versions in stages: one machine first, then the group - The rollout stops automatically once the failure rate passes a threshold - Every change in the immutable audit log Know what runs out there. Without travelling. Roll out in stages ## Three strategies, one platform Which strategy fits depends on how critical the machines are and how sure you are of the new version. - ### Immediate All targets at once — for non-critical changes. - ### Canary A few systems first, then the rest once all is well. - ### Rolling Batch by batch; optionally with an admin approving each batch. The markers show the principle, not customer figures. What it takes ## The building blocks of updates in the field - ### Connect securely Devices onboard with a one-time token and receive a certificate from the tenant’s own CA. - ### Form groups Labels by customer, site, machine type and version — new machines sort themselves in. - ### Roll out in a controlled way Immediate, canary or rolling; applications as Helm charts or Compose files from Git and OCI registries. - ### Provide evidence Audit log with CSV export: who rolled out or approved what, and when. - ### Monitor Telemetry via OpenTelemetry, device logs, alerts by email or webhook. - ### Many customers, one team Tenants strictly separated, each with its own branding. logiccloud ORCHESTRATE · machine X200 CRA Provable in the field - Which software runs on which machine inventory - Vulnerability scan (premium module) 2 findings - Fixed version built and released 4.8.1 - Update rolled out in stages canary → all - Every change recorded audit log, CSV export CRA conformity of the overall product remains the manufacturer’s responsibility. Illustrative example — names and values are made up. Cyber Resilience Act ## Updates in the field become mandatory in 2027 The Cyber Resilience Act requires manufacturers to handle vulnerabilities and provide security updates for the whole support period. Reporting duties have applied since 11 Sep 2026, the full requirements from 11 Dec 2027. ORCHESTRATE provides the technical capabilities for this: inventory, controlled updates, evidence. CRA conformity of the overall product remains the manufacturer’s responsibility. [CRA for machine builders](https://logiccloud.com/en/cra/) ## Frequently asked questions about software updates in the field Does this only work with logiccloud CONTROL? No. ORCHESTRATE distributes any container application as a Helm chart or Compose file — including software that was not built with logiccloud. Which hardware does it run on? On edge devices from many vendors with Linux and a container runtime. The hardware page lists the devices. What happens if an update goes wrong? In canary and rolling rollouts ORCHESTRATE stops automatically once the failure rate passes the threshold you set. Rollouts can also be paused, resumed or cancelled at any time. How does this relate to the open Margo standard? ORCHESTRATE implements the Margo Workload Management API, an open specification under the Linux Foundation. The specification is not final yet; we keep ORCHESTRATE current with every release. ## Show us your installed base Together we look at how updates reach your delivered machines — and what a pilot with one machine group needs. [Request a demo](https://logiccloud.com/en/demo/) [Get the CRA checklist](https://logiccloud.com/en/cra/checklist/)