Updates

Overview

CONNECT can replace its own program file with a newer published build. Nothing happens automatically: there is no background download and no silent update. You confirm one specific build in the CONNECT options of the viewer, and only then is anything fetched.

The gateway downloads the build itself rather than letting the browser do it. That keeps the request on the same origin as the HMI and uses the machine’s proxy settings instead of the browser’s.

Installing an update

The CONNECT settings in the viewer: the running version and build, and the available stable build with its Update button

Open the CONNECT settings in the viewer. The connection section shows the running version and build and, if one exists, the available build per channel — the panel itself announces it with an Update available badge.
Confirm the build you want with Update.
The gateway downloads it, verifies it, restarts into the new version and confirms its health.

The whole operation takes seconds; the browser reconnects on its own.

Channels

Channel	Meaning
Stable	The normal channel
Beta	Shown only when a beta build actually exists

Beta is offered, never proposed: it is not emphasised and never becomes the default. Downgrading within a channel is refused; switching channels is always allowed — including back from a beta to stable — and is labelled as installing an older version.

What is verified

The artifact is checked against the confirmed hash and then against its Authenticode signature. The signature is the trust boundary — not the download URL and not HTTPS. The certificate must name realvirtual GmbH, carry the code-signing usage and chain to a trusted root.

An expired certificate is accepted with a valid timestamp and refused without one. If the revocation status cannot be established at all — typical behind a corporate proxy — the artifact is refused, never accepted by default.

Requirements

Requirement	Why
The access rule	An operator at the machine updates it without any configuration; a caller from another machine needs the API key, as everywhere
A writable program directory	The program file is replaced in place. An installation under a protected directory reports this and offers no update. CONNECT never asks for elevation
No second instance from the same program file	Checked before the download and again immediately before the swap

When updating is not offered

Situation	Reason
The executable carries an embedded customer project	Replacing the file would replace that project with the generic one. Such installations are updated by installing a new build
Linux	Not implemented

If it goes wrong

The gateway never replaces its own running file. It stages the verified artifact, starts a helper copy of itself and stops. The helper performs one atomic replacement with a backup, so there is no moment where the program path holds nothing startable. It then starts the new version and waits until it reports healthy twice, several seconds apart.

If the new version cannot start, or starts but never reports the expected release, the helper puts the previous file back and starts it again. Both cases are reported distinctly rather than as one generic failure.

An interrupted update is resolved on the next start — whichever version happens to run. A staged file with no replacement done is discarded; a completed replacement that was never confirmed is confirmed by the fact that the new version is running.

Switching it off

Set Update.Enabled to false in the configuration to disable updates for an installation. The endpoints then refuse as well — the update surface is not merely hidden in the UI.

{ "Update": { "Enabled": true, "Channel": "" } }

An empty channel means the channel of the running build.