HIMax High‑End Safety Instrumented Controller (SIS) Product Selection Guide
Document Version: V1.0
Target Audience: Automatic control design engineers, SIS system integrators and process safety managers for large‑scale petrochemical, oil & gas and power sectors
Core Objective: Deliver SIL4‑rated high‑availability control solutions with no single‑point‑of‑failure and online hot‑reload
capability for critical process safety applications based on the XMR triple‑modular redundant architecture.
Chapter 1 Product Positioning and Scope of Application
Official Definition
HIMax is the flagship Uninterruptible Safety Instrumented System (U‑SIS) developed by HIMA Group, Germany. Adopting the X‑Modular Redundancy (XMR) triple‑redundant architecture, it is designed for core units in large‑scale process industries with extreme availability and safety requirements. The system supports full‑process online hot change‑over, enabling logic modifications during continuous plant operation without shutdown.
Mandatory Application Scenarios (Selection Access Criteria)
HIMax shall be prioritized for the scenarios below; conventional redundant SIS is not recommended:
- New large‑scale refining‑chemical integration: ESD for ethylene plants ≥1 million tons/year and ten‑million‑ton‑grade atmospheric‑vacuum distillation units;
- National pipeline network hub stations / LNG receiving terminals: SIS for large‑size storage tanks and BOG compressor control;
- Offshore platforms: Platform ESD and Fire & Gas (F&G) systems;
- High‑speed rotating equipment: Main protection (HIPPS) for gas / steam turbines;
- High‑pressure pipeline protection: HIPPS systems for pipelines with pressure above 10 MPa;
- Plant‑wide F&G: Site‑wide fire and gas detection & alarm systems.
Chapter 2 Complete Product Model List and Naming Rules
Quick‑Reference Model Summary Table
| Category | Model Examples | Suffix Differentiator | Key Remarks |
|---|---|---|---|
| CPU | X‑CPU 01, X‑CPU 31 | 01 = High‑performance; 31 = Compact | 01 supports larger I/O count and more complex computations |
| Rack | X‑BASE PLATE 10 01, 15 01 | 10‑slot / 15‑slot | Select slot quantity according to I/O density |
| Bus / Function Module | X‑SB 01, X‑COM 01, X‑HART 32 01, X‑MIO 7/6 01 | — | System backplane bus, communication expansion and multi‑function I/O |
| Fan Assembly | X‑FAN 01 | No suffix | Mandatory configuration. System certification invalid without fan |
| DI Module | X‑DI32 01/02/03/04/05 X‑DI32 51/52/53/54/55 X‑DI64 01/51 | 01‑05 = Standard 51‑55 = Conformal‑coated 01 = Standard; 51 = Conformal‑coated | 02/04 with SOE (sequence‑of‑events) function Conformal‑coated for offshore / salt‑fog / high‑humidity environments High‑density 64‑channel digital input |
| DO Module | X‑DO12 01/02/51/52 X‑DO24 01/02/51/52 X‑DO32 01/51 | 01/02 = Standard; 51/52 = Conformal‑coated | 12‑/24‑/32‑channel options; 02/52 with diagnostics |
| AI/AO Module | X‑AI32 01/02/51/52 X‑AO16 01/51 | 01/02 = Standard; 51/52 = Conformal‑coated | 32‑channel analog input with HART support 16‑channel analog output |
| Terminal / Backplane | X‑CB series, X‑FTA series | Differentiated by wiring specification | Field terminal assemblies; must match corresponding modules |
Suffix Selection Rules
- SOE‑function suffix (02/04/52/54): If millisecond‑level sequence‑of‑events recording is required for incident post‑mortem analysis, modules with suffix “2” or “4” (e.g. X‑DI32 02) must be selected. Note: SOE suffixes for conformal‑coated versions are 52/54.
- Environmental protection suffix (51/52/53/54/55): For offshore platforms, coastal open‑air units and high‑humidity sites, standard 01/02 variants are strictly prohibited; conformal‑coated versions with “5”‑prefixed suffixes shall be used.
Chapter 3 Core System Value and Architecture Logic
Why HIMax? (Selection Decision Basis)
- Mitigate continuous‑production shutdown risks: One of the few SIS platforms supporting online hot download (logic modification) without plant shutdown. This capability is a rigid requirement for large‑scale facilities where a single shutdown may incur losses of tens of millions.
- XMR triple redundancy vs. traditional 1oo2: Conventional 1oo2 (dual redundancy) degrades to 1oo1 upon single‑channel fault, introducing risk of fail‑to‑act. Upon single‑module fault, XMR triple‑modular redundancy automatically isolates the faulty unit while maintaining 2oo3 high‑availability mode with no single‑point‑of‑failure.
- SIL4 certification barrier: General‑purpose SIS often meets only SIL3. For high‑risk scenarios under European CENELEC standards (e.g. offshore oil & gas platforms), SIL4 is mandatory. HIMax holds dual relevant certifications.
Operating Logic and Signal Flow
Hardware voting: Field AI/DI signals are acquired → three CPUs execute parallel computation → hardware‑level median / 2‑out‑of‑3 voting → interlock commands output via DO/AO. Isolation mechanism: In case of module faults (e.g. channel breakdown), the faulty unit is automatically isolated within 200 µs without altering output results, and an alarm is triggered. Engineering & maintenance: Configuration is performed on the SILworX platform with online incremental download. Built‑in millisecond‑precision SOE cache supports incident reconstruction after accidents.
Chapter 4 Step‑by‑Step Selection Procedure (Design Practice)
Step 1: Determine CPU performance grade
| Plant Scale | Recommended CPU | Rationale |
|---|---|---|
| Large integrated complex (>5000 I/O points, complex logic) | X‑CPU 01 | High clock frequency and large memory for complex mathematical algorithms and large‑scale F&G matrix |
| Medium‑size single unit (<2000 I/O points, well‑defined logic) | X‑CPU 31 | Cost‑effective for standard ESD / HIPPS applications |
Step 2: Count I/O points and select racksCalculate physical slot quantity based on actual redundancy configuration (typically 1oo1 for AI/AO, 2oo2 for DI/DO). Where cabinet space is constrained, high‑density modules such as X‑DI64 / X‑DO32 are preferred to reduce rack quantity. Rack selection: 10‑slot baseplate for total I/O slots ≤ 8; 15‑slot baseplate for total I/O slots ≤ 13.
Step 3 Verify mandatory functional modules
- X‑FAN 01: Mandatory. Per HIMA specifications, system certification becomes invalid without fans; commissioning is forbidden. Double‑check this item to avoid critical design omissions.
- Communication interface: For DCS interconnection, select X‑COM 01 (for monitoring only; safety logic shall never be triggered via DCS).
Step 4 Final confirmation of environment and diagnostic suffixes
- Indoor air‑conditioned cabinet environment: Adopt 01/02 standard variants.
- Outdoor / offshore / salt‑fog exposure: Adopt 51/52/53/54/55 conformal‑coated variants.
- Incident reconstruction required: DI modules must use 02 (standard) or 52 (conformal‑coated).
Chapter 5 Common Selection Pitfalls and Risk Mitigation
| Pitfall | Fact |
|---|---|
| Pitfall 1: Existing H41q / H51q programs can be reused | Zero compatibility. Legacy systems run on ELOP‑II; HIMax exclusively uses the SILworX platform. Retrofit projects require full re‑configuration and re‑testing with no shortcuts. |
| Pitfall 2: Fan‑less operation is acceptable | Strictly prohibited. X‑FAN 01 is essential for thermal management and safety certification. Deployment without this component constitutes non‑compliance. |
| Pitfall 3: SIL3 suffices; SIL4 redundancy is unnecessary | SIL4 is dictated by application safety requirements. CENELEC SIL4 certification demonstrates superior hardware fault tolerance and common‑cause‑failure resistance, and is a mandatory access requirement for offshore oil‑gas platforms. |
