  SDN controllers must be periodically modified to add features, improve
performance, and fix bugs, but current techniques for implementing dynamic
updates are inadequate. Simply halting old controllers and bringing up new ones
can cause state to be lost, which often leads to incorrect behavior-e.g., if
the state represents hosts blacklisted by a firewall, then traffic that should
be blocked may be allowed to pass through. Techniques based on record and
replay can reconstruct state automatically, but they are expensive to deploy
and can lead to incorrect behavior. Problematic scenarios are especially likely
to arise in distributed controllers and with semantics-altering updates.
  This paper presents a new approach to implementing dynamic controller updates
based on explicit state transfer. Instead of attempting to infer state changes
automatically-an approach that is expensive and fundamentally incomplete-our
framework gives programmers effective tools for implementing correct updates
that avoid major disruptions. We develop primitives that enable programmers to
directly (and easily, in most cases) initialize the new controller's state as a
function of old state and we design protocols that ensure consistent behavior
during the transition. We also present a prototype implementation called
Morpheus, and evaluate its effectiveness on representative case studies.
