Change management is indispensable in most distributed software systems, which are continuously being modified throughout their life cycle. Managing the changes at run-time in highly available distributed systems is especially challenging as upgrade of a running system should not deteriorate its availability characteristics.

We present a distributed algorithm that allows to dynamically upgrade an actively replicated server so that the server is operational, even during the upgrade process. The algorithm makes use of the core functionality of an underlying Group Communication System that has been extended with a recovery mechanism. Its design enables dependable upgrades of replicated software in the presence of replica crashes. The presented mechanisms are part of the Dynamic Upgrade Management Framework aiming at supporting and managing dependable upgrades of distributed systems on the fly.