Refinery units do not tolerate a weekend rip-and-replace. A crude-atmospheric column has hundreds of FOUNDATION Fieldbus blocks. Many still carry tuning constants from the 1998 commissioning. A big-bang cutover discards those constants. Operators then fight an unstable unit for weeks. However, the plant cannot wait forever. Foxboro I/A Series spares are already scarce. Honeywell Experion offers a stable future and better cybersecurity. The compromise is a segmented, phased migration. Follow that rule. Nothing else keeps the plant running.
Inventory the HSE Backbone Before Writing a Single Tag
Start with a full device audit. Enumerate every H1 segment, every HSE host, and every link-scheduler master. Audit existing fieldbus interfaces such as the Foxboro FBM228 FOUNDATION Fieldbus module and communication couplers like the Foxboro FBM230. Export Foxboro block parameters using I/A Series PACTware or FieldCare. Then export Honeywell Experion target block definitions from the Global Explorer workbook. Compare the two lists and flag blocks that need manual retuning.
Moreover, capture the existing IEC 61850-3 environmental ratings on switch cabinets. Network gear like the Foxboro 900701-10-02 Fast Ethernet Switch Module or industrial switches must handle ambient operating limits; a field switch rated only to 40°C will collapse an HSE backbone on a summer afternoon. Replace marginal hardware during the migration, not afterward.
C300 Controller Sizing and IELXST Execution Timing
Honeywell Experion's C300 platform—anchored by hardware such as the Honeywell CC-PCNT02 Experion PKS C300 Controller and matched I/O like the Honeywell CC-PAIX02 Analog Input Module—executes logic via Control Expert Execution (IELXST). The default cycle is 50 milliseconds, which covers most refinery process loops. However, fast-response loops on compressor anti-surge or heater fuel gas may require 20-millisecond execution. Set cycles deliberately and verify worst-case execution remains under 80% of the allocated period.
Next, evaluate controller memory. The C300 provides 2 GB of working memory, accommodating a 1,000-loop unit with room to spare. A 5,000-loop unit with historian buffering requires a C300E or paired redundant controllers. Size hardware for peak migration load, not initial day-one tagging.
- Step 1 — Import: Import the Foxboro block export into Experion Engineering Studio.
- Step 2 — Re-hosting Sequence: Re-host analog input blocks first, followed by PID blocks, then analog output blocks.
- Step 3 — Address Preservation: Retain original FF H1 device addresses during Phase 1 to prevent field rewiring.
- Step 4 — Simulation: Simulate block topology using the Experion Offline Test tool.
- Step 5 — Benchmark: Compare simulated dynamics against the live Foxboro trend baseline. Any deviation exceeding 5% requires manual re-tuning.
Coexistence: OPC UA Bridge, Historian, and Alarm Journal
During Phase 2, Foxboro and Experion share the plant. Both need to publish to the same historian. Deploy an OPC UA server on each system and bind them with a unified Asset ID convention based on ISA-95. This allows PI Server, Aspen IP.21, or Wonderware InStep to ingest both feeds seamlessly.
Second, align alarm severity schemes: Foxboro defaults to four priority levels while Honeywell uses six. Rationalize all alarms under ISA 18.2 prior to cutover; otherwise, operators will see the identical process condition labeled differently across adjacent screens. Keep alarm journals segregated by platform until Phase 3 closes to maintain an untainted regulatory audit trail.
Safety Loops and the SIS Boundary
Do not migrate safety instrumented functions onto Experion unless the complete safety loop path has been recertified. While Honeywell safety controllers are SIL3 capable and legacy systems like Foxboro Trident are also SIL3 rated, mixing components across the boundary invalidates the certified PFDavg calculation. Retain safety loops on their native platforms during Phase 2 and migrate them as an independent Phase 3 scope. Verify proof-test records during decommissioning and commissioning, and archive the full bypass history from the legacy system.
Cut-In Rehearsal: Freeze, Verify, Restart
Never perform an online cutover without a rigorous rehearsal. Schedule a two-day dry-run on a staging test bench replicating the actual H1 and HSE network topology. Load the target Experion configuration and simulate the cutover with a stopwatch. Verify that operator consoles refresh within 5 seconds, historian data gaps remain under 30 seconds, and alarm propagation reaches emergency workstations. If a rehearsal exceeds its time envelope, extend the testing window—a lengthy bench rehearsal is cheap insurance against an unplanned refinery trip.
Conclusion & Action Advice
Refinery DCS migration is fundamentally an inventory and topology discipline rather than a coding sprint. Export every Foxboro block parameter early, tune C300 execution periods to your fastest loop, and keep safety instrumented functions quarantined on their original controllers until Phase 3. Maintain operational clarity with a standardized OPC UA bridge and ISA 18.2 alarm rationalization. Finally, rehearse the cut-in twice—once on paper and once on a staging test bench. A disciplined, phased cutover protects plant production, safety compliance, and operator trust.