Internet Computer upgrades its subnets one at a time instead of all at once

Two Votes, One Upgrade at a Time

Most blockchain networks coordinate protocol upgrades in a single, network-wide event. @dfinity's Internet Computer takes a more deliberate approach, rolling out changes subnet by subnet rather than all at once.

The process starts with two distinct layers of onchain governance. The first vote, handled by the Network Nervous System (NNS), elects a new software version into an approved list. A separate set of proposals then moves each individual subnet onto that version on its own schedule. Whether or not a subnet should be upgraded to a certain version is decided by votes in the governance system rather than by individuals.

A collection of nodes engaging in consensus is called a subnet. These groups of node machines each run a slice of the broader network, and because they upgrade independently, different subnets can run different software versions at the same time without disrupting the whole.

How the Handover Actually Works

The Internet Computer Protocol has built-in support for scheduling upgrades, meaning that each subnetwork's consensus layer autonomously decides when an upgrade should be executed based on agreement between subnetwork participants.

When a subnet's turn comes, its nodes agree on a specific block height where the version switch will happen. The existing software processes all blocks up to that point, and the new version takes over from the next block forward. State is carried across via a catch-up package, a signed snapshot that allows the incoming software to resume exactly where the previous version left off, with no data lost in the transition.

The Internet Computer's nodes have built-in support for downloading and applying upgrades without human intervention, if instructed to do so by the governance system. An upgrade package contains the entire software stack needed to run a node. After verifying the package content corresponds to the version the community voted to run, nodes then reboot into the new version of the protocol autonomously.

The result is a network that can evolve continuously. Several major upgrades have already been applied to the Internet Computer since launch with very little user-perceived downtime per subnet. This design allows the network to evolve continuously without centralized control.

Sources
Upgrading the Internet Computer Protocol - DFINITY
The Network Nervous System: Governing the Internet Computer - DFINITY
Bringing Clarity to ICP Upgrade Proposals - DFINITY Developer Forum