Innovative Control Technology

SPECIAL PRINT
Control Valve Diagnostics
in Safety-instrumented Systems
A Comparison of Architectures

By:
Dr. Thomas Karte (SAMSON)
Bernd Schäfer (HIMA)

Special print of German article
published in “atp edition”
6/2012

Special print of German article “Diagnosefähige Aktorik in sicherheitsgerichteten Kreisen”
published in “atp edition” 6/2012

2

Control Valves With Diagnostic Functions in Safety-instrumented Systems
A Comparison of Architectures
Dr. Thomas Karte (SAMSON), Bernd Schäfer (HIMA)
Implementing the safety life cycle according to IEC 61511 and IEC 61508 is decisive in preventing systematic failures in field units
installed in safety-instrumented circuits. In both these standards, clear requirements for defined procedures, regular testing, documentation of test results, failure analysis and resulting actions are stipulated. These organizational requirements can be effectively
supported by state-of-the-art instrumentation. In the field of control valves, the required accessories are readily available on themarket. In addition to the higher degree of automation for the validation stages as well as for proof testing and online testing whilea process is running, these control valves may even be simpler in their hook-up. Based on the requirements defined in the standards, suitable architectures and their integration into the associated procedures will be presented in the following article.
Keywords: IEC 61511, partial stroke test, proof test, safety life cycle, automated testing, control valves

Methods of testing control valves online while the process is running, such as partial stroke testing (PST), have been discussed
much in recent years. During such tests, valves are moved througha certain section of their travel range to verify their proper functioning while the limited travel ensures that the running process is
not disrupted. Methods employing mechanical blocking havebeen around for longer. In these tests, the travel motion is triggered by manually removing the connector from the solenoid
valve. Meanwhile, field units have been developed that performpartial stroke tests automatically: in particular, positioners by different manufacturers. This technology is considered mature. The
initial concerns, for example that the valves would overshoot andthus disrupt plant operation, have been refuted.
Despite this technical progress and the great potential benefit,
the opportunity of online testing is still not used very often. It has
become evident that the feasibility and success of online testing
depend on the special field units (positioners) themselves as wellas on the entire integration into the plant structure and work
processes. In the following article, we will present the latest developments in this area.
1. Use in safety-instrumented systems
Publication [1] provides a good overview of the demands
placed on diagnostic and test procedures in safety-instrumented systems. A detailed discussion of the effects of partial stroke
testing on the probability of failure on demand (PFD), amongst

other aspects, can be found in [2]. Publication [3] looks at thecategorization of diagnostic and test procedures. On the whole,
it is evident that all publications deal with the effects of the test
procedure on the rate of random failures. It seems to be more
important, however, to understand the entire set of demands
specified in IEC 61511 and draw the necessary conclusions concerning test procedures from it. The discussions and publications of recent years were centered around the importance ofsystematic failures, particularly for final control elements, i.e.
control valves [4, 9, 1]. The standard differentiates between systematic and random failures (Fig. 1).

Fig. 1: Causes of failure according to [4]3Special print of German article “Diagnosefähige Aktorik in sicherheitsgerichteten Kreisen”
published in “atp edition” 6/2012

If the cause of a failure can be pinpointed – and be it after the
failure occurred – and appropriate action can be taken to
reliably prevent such a failure from occurring again, the failure is systematic. In control valves, areas for systematic failures include proper component selection and sizing to matchthe specific media, pressures and temperatures as well monitoring the ambient conditions [5]. The major tool for masteringsystematic failures is the introduction of a safety life cycle orfunctional safety management (FSM) system. Fig. 2 illustrates
the claim for a structured procedure of systematically following step after step in different stages, such as safety analysis,
definition of requirements, definition of sizing, higher-level
implementation, validation, operation and maintenance. Publication [4] looks at these aspects in more detail. If all steps arefollowed, systematic failures can normally be reduced to aminimum. The remaining risk, i.e. undetected systematic failures, is reduced by three mechanism as shown in Fig. 1:

ning can expose systematic failures that have remained undetected up to this point. This can be explained by a simple example: If the actuator sizing does not take all operating stages
into account, the functional test (validation) of the control valve
performed during cold commissioning may well indicate proper functioning. However, only a partial stroke test performed
online can really show whether the valve is stuck during a critical operating situation, e.g. due to critical media or improperly
estimated pressure conditions at the valve.
According to IEC 61511, sections 15 and 16 as well as
VDI 2180‑3 and VDI 2180-5 [6, 7, 8], some requirements raisedin the safety life cycle and explicitly stated in the standards must
be complied with; they include:
There must be defined, reproducible proceduresProcedures must be documented
Test results must be documented, in the case of failure as wellas when everything works fineDiagnostics and tests

Fail-safe action of the equipment used (if it fails, it must fail toa safe position)

Redundancy, preferably diverse redundancy
Test results must be analyzed and conclusions must be drawn

for future improvementAll operating stages must be taken into account for the testControl valves must be tested under operating conditions,particularly at the full operating pressure
Far from any probability statement, this approach underlines
the importance of diagnostics and tests, particularly while theprocess is running. Safety-instrumented systems are implemented based on the safety analysis. In the vast majority of cases,
the control valves installed in these systems are expected to shut
off or open a pipeline on demand. Checking the proper functioning of these control valves online while the process is run-

The last two requirements in particular are not met when thesafety-instrumented system is subjected to a functional test while
the plant is shut down, which is often done in practice. On thewhole, the list shows that automated testing complies far betterwith the safety life cycle requirements than manual test procedures assessed by human monitoring. VDI 2180-3, section 2.2.3.2 [7] explicitly demands that equipment for automatic function monitoring (e.g. transit time or position monitoring,plausibility check, step or time monitoring) be used. The requirements placed on the safety-instrumented system must be
defined. Based in this, the requirements for the control valve
can be deduced. They are as follows:Response time: How much time does the valve have to reachFig. 2: Safety life cycle according to IEC 61511-1, Fig. 84

the intended fail-safe position upon demand?
Which leakage rate or cross-section of flow must be reached?
This allows requirements for the exact valve position to be
deduced.

Which actuator force or torque must be produced? Howhigh is the required reserve or safety factor that allows all
operating conditions and ageing processes to be masteredsafely?
Additional requirements may arise based on the specific application [5, 8]. Based on these requirements, diagnostic andtest procedures are to be assessed by their degree of diagnostic
coverage (DC, proof test coverage). This can be done by performing a failure modes, effects and diagnostic coverage analysis (FMEDA), for example.
An interesting trend can be observed for sensors: as manufacturers are thriving for the highest possible degree of diagnostic coverage, binary monitoring units (e.g. limit switches forfilling level, temperature or flow rate) are frequently replacedby analog sensors. This is done because the plausibility ofanalog signals can be checked more easily, for example byanalyzing the noise performance and correlation with process
values measured at other measuring locations. In the field ofcontrol valves, this would correspond to using an analog position transmitter with continuous measurement over the entire
travel range instead of the commonly used inductive limit
switches. As far as we know, such a hook-up is very rarely
implemented in practice.
Automated tests present themselves for the following stages inthe valve‘s life cycle:

Fig. 3: Full stroke testValidation during start-up

Proof testingIn-process testingTesting during scheduled or unexpected shutdowns

In addition to systematic failures, random failures need to betaken into account as well. In mechanical systems, the cause of
failure is usually easily detectable. It can be rooted out bychanging the design or process accordingly. As a result, random failures are far less significant in mechanical systems. Reasons for this are discussed in detail in publication [9] for example. The standard [6] demands the use of the tools – diagnostics,
fail-safe bahavior and redundancy – for random failures aswell. In addition, mathematical (probabilistic) proof of theachieved reliability is demanded.
Accoding to [6], the probability of failure on demand is simply
calculated as follows:
Formula 1: PFD = ½ · λdu · TPR
If a test method, such as PST, with a higher test frequency thanthe proof test interval is applied, the PFD becomes
Formula 2: PFD = ½ · λdu · (1–DC) · TPR + ½ · λdu · DC · TPST
TPR: proof test interval
TPST: partial stroke test interval
λdu: rate of dangerous undetected failures

Fig. 4: Logging of valve movements
5

Special print of German article “Diagnosefähige Aktorik in sicherheitsgerichteten Kreisen”
published in “atp edition” 6/2012

tion [10] for example mentions that different databases listing
the specifications of electronic components often differ by morethan one decimal power.

Fig. 5: Automated valves (left: solenoid valve and limit switch mounted
separately, right: state-of-the-art limit switch with integrated solenoid
valve)

The formula shows that diagnostic and testing procedures are
directly incorporated into the calculation result. As a result, diagnostic procedures can be used to target a longer test interval.
This seems to be a realistic approach for many applications, but
it must be analyzed for each individual case. The approximate
result is that a 50 % test coverage doubles the service life between two complete proof tests during a plant shutdown. Publications [2], [11] and [12] go into more detail on this.
This calculated value is only valid when the failure rate is constant. However, if the failure rate increases over the examined
period, for example due to wear or ageing, this is the decisive
mechanism. For example, to achieve an uninterrupted service
life of five years, it is easy to furnish mathematical proof forachieving this service life if the failure rate is low. It must be
observed that effects relating to the process, ageing, wear orother mechanisms can impair the constancy of the failure ratethat was assumed.
Nevertheless, the statistical data are to be handled cautiously inthis context: none of the publications dealing with probability of
failure calculation that the authors are aware of includes a calculation of error, which means that the reliability of the calculated values is not assessed in any way. This can lead to be
calculated values being trusted without justification. Publica6

2. Workflow requirements
Field units offer a wide range of diagnostic functions. Their benefit to the users not only depends on the performance they
promise, but on how they can be integrated into everyday operation.
We will briefly outline the opportunities for control valves basedon the use of positioners or smart limit switches. Fig. 3 shows anautomated full stroke test, Fig. 4 an assessment listing parameters. Positioners or smart limit switches can perform such measurements on site as well as record and assess them [11, 12].
Fig. 5 shows two hook-ups: a butterfly valve with solenoid valve
and inductive limit switches (left) and a state-of-the-art ballvalve with electronic limit switch (right). The parameters for thedead time, the transit time until the valve reaches the end position, the exact measurement of the achieved end position as
well as the required actuator force are detected by the integrated travel and pressure measuring system. The results areplotted in the travel vs time diagram and saved in the positioner
as characteristic times and values. Moreover, friction forces canbe deduced from the stick-slip effect. The stick-slip effect typicalof an actuator with high friction would become visible in thetravel vs time diagram.
A comparison of these measurements with the demands stipulated in the standard shows that the proper functioning of thecontrol valve within the safety-instrumented system can be assessed thoroughly. The exact degree of diagnostic and test coverage is to be determined individually in each case; one way to
do this is to compare the potential sources of failure determined
during the risk assessment and the diagnostic features of the
field unit used. The moveability of the valve and the exact reaching of the end or intermediate position can be assessed without
any problems. Additional measurements may only be necessary
when stringent tightness requirements need to be met.
A single test, however, does not mean that this method is integrated into the operating process. Table 1 gives an overview ofthe sequence of all necessary steps. Apart from the automationof a test, it is of particular importance that the results can berecorded and saved. A database to save the results of all testsperformed must be available. Saving and archiving as well as
the assessment are particularly important, for an individual test
as well as for trending based on several tests or in correlation
with other process data. The rows on the left in Table 1 list thenecessary steps while the columns to the right contain proposals
on how the tasks are to be distributed among the available resources (positioner and asset management system). Of course,
the exact distribution of tasks can be discussed; what becomes
evident, however, is the necessity of having a higher-level system with greater resources than the field unit.
3. Architectures of the safety-instrumented system
Assuming the availability of a PST-capable positioner, the resulting hook-up of field units is as indicated in Fig. 6a and assessedin Table 2. Following the classic design, the safety-instrumented
circuit is equipped with a solenoid valve for emergency shutdown and limit switches to indicate the valve position. The desired PST function is supplied by a positioner that is pneumatically connected ahead of the solenoid valve. The test is started
locally at the positioner; the measured data and assessed test
results are transmitted to the higher-level asset management sys-

tem using digital HART® communication. The HART® protocol
can be integrated, for example using suitable isolation amplifiers available on the market (for examples see publications [13,14]). This hook-up has been and still is used in practice; it issuitable for performing the test on site, particularly for the operating staff. In larger plants with many valves and less operating
staff, the time and efforts involved in performing the test are asignificant drawback. A number of alternative hook-ups is possible; the most favorable is shown in Fig. 6b:
There is no solenoid valve and the positioner is used for emergency shutdown and to perform the test. To implement thishook-up, the positioner must comply with IEC 61508
or IEC 61511 requirements. Such positioners are readily available. With this hook-up, there is less wiring and a greater test
depth can be achieved as it includes only one pneumatic unitthat also performs the test.
The positioner is connected directly to the safety PLC (Programmable Logic Controller) using a 4 to 20 mA signal. Certified
output boards are available on the market.
The HART® protocol is tunneled to the level of the isolation
amplifier by the safety PLC without additional patching. In

Steps

Positioner

Asset management system

Triggering

Manual or automatic

Manual or automatic

MethodRamp or step response

Real-time recording ofresults

Travel vs time diagram,coefficients

Reading results from thefield unit

Travel vs time diagram,coefficients

Travel vs time diagram,coefficients

Saving results

Travel vs time diagram,coefficients

Travel vs time diagram,coefficients

Test assessment

On-site diagnostics

Diagnostics, link to process
data

Alarm generation

On-site alarm generation

Alarm generation and inclusion of process data

Assumption

Real-time data transmission
not possible

Archiving

Long-term archiving in the
database

Trending over several tests

Comparison of individual
results over several tests, diagnostics, alarm generation

Table 1: Partial stroke testing routine
7

Special print of German article “Diagnosefähige Aktorik in sicherheitsgerichteten Kreisen”
published in “atp edition” 6/2012

Solution A

Solution B

Solution C

Solution D

Safety-instrumented
control

Solenoid valve

Positioner

Solenoid valve

Solenoid valve

Partial stroke test

Positioner

Positioner

Solenoid valve

Solenoid valve

Travel feedback

Limit switch

Limit switch, alternatively: transmitter

Limit switch, alternatively: transmitter

Limit switch

Actuator pressure
measurement

Positioner

Positioner

Optional:transmitter

Pneumatic test

No

Yes

Yes

Yes

Table 2: Architectures of the safety-instrumented system

practice, data are mostly transmitted to the asset management
system using the existing Ethernet connection between the PLC
and the basic process control system (BPCS). Fig. 7 shows theassociated circuit diagram. What is special about this architecture is the parallel, simultaneous functioning of the HART® communication. This is much quicker than the serial operation of amultiplexer. The communication functions can be restricted as
required. This guarantees that the recorded test results can beread from the field units without accidentally changing the parameter settings.
The most favorable solution shown in Fig. 6b allows diagnostic
data to be read and prevents the field unit settings from beingchanged by mistake. Assessment is based on the following criteria:The positioner is powered by standardized signals:+20 mA indicate normal operation in end position+12 mA indicate the start of a PST+4 mA indicate emergency shutdown.
Certified positioners for reliable emergency shutdown at
4 mA (instead of 0 mA) are readily available on the market.
Emergency shutdown is also possible while the test is runningas the positioner will give it priority.

The test is triggered by an external signal and performed locally by the positioner. This allows for a high control accuracy
while stroking the valve as defined for the test.

The data as shown in Fig. 3 are recorded and saved in thepositioner. As a result, millisecond sampling rates (e.g. for thevalve position and actuator pressure) can be achieved, which
has a positive effect on the accuracy of the measured values
as well and thus ensures a high diagnostic coverage.
8The operator or human-machine interface (HMI) is represent-

ed in the safety-instrumented system. This makes it possible tosimply save a set of standardized rules for locking and unlocking the safety-instrumented circuit.
The travel is fed back by an analog signal. This has somebenefits over indication by two limit switches: less wiring, ahigher measuring accuracy and better diagnostic options.

In the case of large valves that require a high air capacity fromthe controlling components, an analog booster (e.g. Type 3755
by SAMSON [15]) can be mounted into the connecting line
between the positioner and actuator (dotted line in Fig 6b).
Certified boosters are readily available on the market.
Other viable hook-ups need to be explained further:
Fig. 6c shows a hook-up where the performance of the test iscompletely implemented in the safety PLC: the pneumatic actuator is controlled by the solenoid valve, the control loop controlling the test is closed by an analog position transmitter. To
achieve a diagnostic depth similar to solution B, a pressuretransmitter to measure the actuator pressure is included. This
hook-up offers the benefit that all the rules for performing thetest and assessment can be saved in the PLC, which makes theconfiguration certifiable. A drawback, however, is the lower
sampling rate, which may be pushed to under 100 ms whenstate-of-the-art equipment is used. The sampling rate is important for the achievable control accuracy of the test (overshooting)and the quality of diagnostics. As a result, solution C is preferably used for large valves with transit times greater than 5 s.
Fig. 6b can also be used in the special case where a control
valve is integrated into the emergency shutdown routine. This

Fig. 7: Tunneling of HART® signals

a

c

b

d

Fig. 6: Possible architectures

integration is frequently encountered in German and European plants. Publication [15] deals with an analysis of thesafety-related aspects of this hook-up. As usual, this classic
hook-up includes a positioner controlled by the control system
and a solenoid valve actuated by the PLC. Two wires need to
be installed in the field in this case. According to the figure, avery simple and elegant solution would be possible as well: apositioner could be used for actuation, emergency shutdown
and the test. It would be controlled by the PLC only. The necessary control algorithm would have to be saved in the PLC in
this case. Examples of such applications are found in excesspressure valves used in turbo machine control or in the burnermanagement in fuel control systems. The PLC is connected tothe control system via Ethernet and receives commands fromit during normal operation (e.g. a demand). Such applications
are also frequently found on the market as the necessary systems are readily available (e.g. HIMax® system with FlexSILon® libraries).
Fig. 6d shows a solution based entirely on the classic signals(NAMUR signal for limit switches according to IEC 60947-5-6,
24 V to energize the solenoid valve). In this case, a device isused that combines the functions of a limit switch and solenoid
valve but also possesses diagnostic functions thanks to using
analog travel measurement and a microprocessor. The benefit
of being able to use the existing wiring is outweighed by having
to do without communication as there is no standardized protocol for this kind of signal transmission. Nevertheless, it is possible to transmit the internal diagnostic results (e.g. a canceledPST) by a status contact (NAMUR signal) to the higher-level
control system (also see [16]).
Table 2 provides a short summary of the different architectures.
All solutions have in common that they employ components thatare readily available on the market and can also be used outside the safety-instrumented system. As a result, the use of components that are proven in use – as demanded by plant operators – is possible [17]. In this article, we do not deal with tailored, manufacturer-specific instrument hook-ups that use
proprietary architectures and wiring. A fieldbus protocol, suchas PROFIBUS or FOUNDATION™ fieldbus, can be used instead
9

Special print of German article “Diagnosefähige Aktorik in sicherheitsgerichteten Kreisen”
published in “atp edition” 6/2012

Fig. 8: SAMSON Type 3755
Volume Boosterof the HART® protocol. According to the latest developments inthis field, however, the safety-related signals still need to betransmitted over discrete wiring.
4. Integration into the processes on site
Table 1 lists the necessary steps to be performed. Experience
with some initial installations have shown that individual tests
on field unit level can be performed without any problems andproduce reliable results. If, however, a large number of units ina large plant is to be tested at regular intervals, the main problems arising are the following:The rate for transmission of the test results saved locally in thefield units does not meet the requirements. With the current
state of the art, it does not seem to be possible to read complete data records from a large number of units once weekly,
let alone daily. This limitation is less due to the communication
protocol used (HART®); rather, it is caused by the entire architecture of the control system. Of course, the data transmitted
to uphold operation need to have priority over diagnostic
data.
Assessment options: asset management systems are available
from different manufacturers. They allow field unit records
containing diagnostic data to be read and saved. However,there is no satisfactory solution available yet that allows isolated measured values to be viewed and linked to other measured values using a definable algorithm. For example, it may
be necessary to indicate the measurement history of a value(e.g. the valve‘s zero position) recorded over several tests
10(Fig. 8). In practice, it does not seem to be possible yet to linka value with process data collected by other field units (e.g. tocheck the plausibility of the valve position versus the flowrate). Table 1 gives an overall overview of the necessary steps
and how they can be distributed among the field unit and thehigher-level asset management system. The field unit is incharge of quick data recording and on-site control. It is betterto have the higher-level system perform the long-term archiving, trend assessment and complex alarm management
as the processing speed and memory capacity are limited by
the energy consumption. The system can also process datafrom different units and assess them based on device-unspecific criteria.
5. Summary
In field units installed in safety-instrumented systems – particularly
if they are in direct contact with the process medium –, the probability of failure on demand is determined by how systematic failures are handled. The necessary implementation of the safety life
cycle can be supported by using state-of-the-art instrumentation.
Thanks to modern field units and safety-related control mechanisms, effective yet simple architectures can be implemented using
components that are readily available on the market. Further developments need to be made in asset management systems concerning the data transmission rates and functionality to allow thediagnostic tools integrated into the field units to fully display what
they are capable of doing. It seems that this cannot be achieved
unless manufacturers and operators cooperate closely in selectedpilot projects.

Fig. 9: Zero point trendBibliography
1. Rogiers, I.: Using a “Smart“ Partial Stroke Test Device on SIS Loop
On/Off Valves: Adding Value or Adding Cost? P4039, Valve
World 2004. KCI Publishing BV
2. Börcsök, J., Schrörs, B., Holub, P.: Reduzierung der Ausfallwahrscheinlichkeit und Verlängerung des Proof-Test-Intervalls durch Einsatz
von Partial-Stroke-Tests am Beispiel von Stellgeräten (German only:
reducing the probability of failure and extending the proof test interval using partial stroke testing exemplified on control valves).
atp – Automatisierungstechnische Praxis 11/2008
3. McCrea-Steele, R.: Partial Stroke Testing: The Good, the Bad and the
Ugly. Seventh International TÜV Symposium on Safety 2006
4. Götz, A., Hildebrandt, A., Karte, T., Schäfer, B., Ströbl, J.: Implementation of Safety-instrumented Systems in the Process Industry – SIL in
Practice, special print by SAMSON AG of article “Realisierung vonSchutzeinrichtungen in der Prozessindustrie – SIL in der Praxis”,
atp – Automatisierungstechnische Praxis 8/2008
5. SAMSON AG: Competence in Functional Safety – Functional safetyof globe valves, rotary plug valves, ball valves and butterfly valves,
WA 236
6. IEC 61511-1 and IEC 61511-2: Functional safety – Safety instrumented
systems for the process industry sector, parts 1 and 2. May 2005
7. VDI 2180-3: Safeguarding of industrial process plants by means ofprocess control engineering - Plant engineering, realisation andoperation. April 2007
8. VDI 2180-5: Safeguarding of industrial process plants by means ofprocess control engineering (PCE) - Recommendations for practicaluse. May 2010
9. Hildebrandt, A.: SIL-Bewertung von Mechanik – Versagenswahrscheinlichkeit mechanischer Komponenten (German only: SIL assessment of mechanics – failure probability of mechanical components).
atp – Automatisierungstechnische Praxis 1-2/2011

10. Smith, D.: Reliability, Maintainability and Risk. Elsevier ButterworthHeinemann, Burlington, MA 01803, Sixth Edition 2001
11. Karte, T., Kiesbauer, J.: Smart Valve Positioners and Their Use in
Safety-instrumented Systems, Industrial Valves 200912. SAMSON AG: Competence in Functional Safety – Application notes
for safety-instrumented systems, WA 239
13. Pepperl + Fuchs specification sheet: Solenoid Driver KFD2-RI-Ex1.
Edition 2010-04-13. Document 216568_GER.xml
14. Pepperl + Fuchs specification sheet: HART Loop Converter KFD2-HLCEx1.D. Edition 2011-01-26. Document 198804_GER.xml
15. SAMSON AG: Type 3755 Volume Booster, Data Sheet T 8393,
September 2009
16. Gabriel, T., Litz, L., Schrörs, B.: Nutzung von SIS-Armaturen für Leitsystemfunktionen – Rahmenbedingungen für die Ausführung vonBPCS-Funktionen (German only: use of SIS valves for BPCS functions – conditions for executing BPCS functions). atp – Automatisierungstechnische Praxis 3/2010
17. Karte, T., Kiesbauer, J.: Smart Limit Switch for On/off Valves in Process Engineering. Special print by SAMSON AG of the German
article published in atp – Automatisierungstechnische Praxis 5/2009
18. Hablawetz, D., Matalla, N., Adam, G.: IEC 61511 in der Praxis – Erfahrungen eines Anlagenbetreibers (German only: application of
IEC 61511 – experiences of an operational company). atp – Automatisierungstechnische Praxis 10/2007
19. SAMSON AG: Type 3730-3 Electropneumatic Positioner, Data Sheet
T 8384-2, February 2012

Appendix
Dr. rer. nat. Thomas Karte (born in 1955) is responsible for application engineering of electropneumatic equipment at SAMSON AKTIENGE­
SELLSCHAFT in Frankfurt am Main, Germany. He
is a member of the VDI/VDE-GMA expert committee 6.13 dealing with the engineering of safetyinstrumented systems and of DKE committee
GK 914 for functional safety.
SAMSON AKTIENGESELLSCHAFT
MESS- UND REGELTECHNIK
Weismüllerstraße 360314 Frankfurt am Main, Germany
Phone: +49 69 4009 2086
E-mail: tkarte@samson.de

Dipl.-Ing. (FH) Bernd Schäfer (44) has been working for HIMA since 1996;. He started in project
management. Since 2004, he has been a productmanager for OPC and SCADA products. In addition, he is responsible for special applications
including asset management and OTS solutions.
He is a member of the PLCopen working groupthat deals with the OPC UA information model.
HIMA Paul Hildebrandt GmbH & Co KG
Albert-Bassermann-Straße 28
68782 Brühl bei Mannheim, Germany
Phone: +49 6202 709 453
E-mail: b.schaefer@hima.com

11

SAMSON AG · MESS- UND REGELTECHNIK · Weismüllerstraße 3 · 60314 Frankfurt am Main · Germany
Phone: +49 69 4009-0 · Fax: +49 69 4009-1507 · E-mail: samson@samson.de · Internet: www.samson.de
SAMSON GROUP · www.samsongroup.net

2012-10 HD · WA 284 EN

Where innovation is tradition