EP4023892A1

EP4023892A1 - Control device for a hydraulic circuit

Info

Publication number: EP4023892A1
Application number: EP21215828.1A
Authority: EP
Inventors: Daniele BOLLOTTA; Gabriele ZARATTIN; Riccardo LUPONE
Original assignee: Hydroservice SpA
Current assignee: Hydroservice SpA
Priority date: 2020-12-29
Filing date: 2021-12-20
Publication date: 2022-07-06

Abstract

The present invention refers to a control device (1) configured to be connected to a hydraulic circuit and comprising a fluid supply/discharge section (2) and a connection section (3) configured to be connected to an actuator (7, 7L, 7R). Moreover, the control device provides a control section configured both to drive the actuator in one or more operative conditions and to implement, in an anomaly and/or emergency conditions, a safety function operating on the actuator based on this latter the complete retraction of the rod (9) of the actuator inside the box body (8) is determined. The control section has a first operative section (5) and a second operative section (6, 6L, 6R) provided with at least one respective redundancy level and configured, at the occurrence of the anomaly and/or emergency conditions, to ensure said retraction of the rod (9) by the respective redundancy levels.

Description

Technical field of the invention

The present invention refers to a control device for a hydraulic circuit. Moreover, the invention refers to a hydraulic system comprising said control device and an actuator which the control device acts on.
The present invention refers also to a method of controlling at least one hydraulic actuator.

Prior art

Machines provided with hydraulic actuators and control systems configured to control such hydraulic actuators are known. One of the aspects to be considered when designing such machines is in relation to the safety, particularly to the safety of an operator; usually, the machine control system is responsible for managing abnormal conditions which could cause safety risks.
The safety of the machines is the subject, from a regulatory point of view, of standards aimed to establish some requirements necessary to reduce the safety risks, among which there is the EN ISO 13849. EN ISO 13849 is a harmonized type-B European standard which defines the parts of a control system of a machine which are required to implement the safety functions as parts of the control system regarding the safety and is devised to meet the safety base requirements defined by the European community directives. The standard is acknowledged, not only by the European community, but also by the regulatory systems of North America, Canada, Brazil, and Russia.
Substantially, the safety circuits according to the standard EN ISO 13849 are accepted as technical solutions for reducing the safety risks.
Some among the main safety risks can happen when there are anomalies or fails in the machine during its use; in this case, there could occur uncontrolled movements of the actuators which can cause a risk condition in proximity of the machine. For example, a falling actuator could cause an injury to an operator (risk of crushing, collisions, abrasions, etcetera).
The invention must be considered in the background herein described; the objects thereof being indicated in the following.

Objects of the invention

Therefore, a main object of the present invention consists of providing a control device, a system and a method capable of overcoming the inconveniences beforehand described with reference to the prior art.
Consequently, an object of the present invention consists of minimizing or even eliminating the safety risks for an operator working in proximity of a machine or system operatively connected to the control device.
Particularly, an object of the present invention consists of determining and ensuring a safety function which involves the actuator at the occurrence of an anomaly and/or emergency conditions, by reducing or eliminating in this way the safety risk.
An additional object of the invention consists of providing a control device, a system and method according to the standard EN ISO 13849, and particularly to the standard EN ISO 13849-1 category 3 and according to a type "e" maximum reachable Performance Level (PL e); this means that in case of a single failing component, the safety function is anyway performed and ensured.
A further object of the invention consists of ensuring the safety function also in case of an electric supply outage or fail thereof.
An additional object of the present invention consists of disclosing a compact control device, in other words having a limited size, and being modular.
Moreover, the invention advances a technical solution being substantially effective and reliable (PL e).
These and other objects are met by a control device, a system and a method according to the following description, attached claims and following aspects.

Summary of the invention

Some aspects of the invention, which can be considered independent from each other or in any reciprocal combination and/or combination with anyone of the attached claims are described in the following. Specifically, if an aspect refers, by a specific dependence on one or more other aspects and/or by words such as "the" or "said" and similar, to one or more elements or steps introduced by another aspect, such aspects can be considered in combination with each other.
Numbered aspects of the invention are the following.

1. Control device configured to be connected to a hydraulic circuit, the hydraulic circuit being provided to or associated with at least one actuator having a box body such as a cylinder and a rod movable with respect to the box body, the actuator being configured to move a movable mass, the control device comprising:
- a supply/discharge section comprising:
  - ∘ a pressurized fluid supply port configured to be connected to a pressurized fluid source and configured, in a condition of connection to the pressurized fluid source, to supply the pressurized fluid to the control device,
  - ∘ a fluid discharge port configured to discharge the fluid from the control device,
- at least one connection section configured to be connected to the actuator and comprising:
  - ∘ a first port configured, at least in a condition of connection to the actuator, to supply the pressurized fluid to the actuator,
  - ∘ a second port configured, at least in a condition of connection to the actuator, to discharge the fluid from the actuator,
- a pressurized fluid supply line connecting the pressurized fluid supply port and the first port and configured, at least in a condition of connection to the actuator, to enable fluid to flow from the pressurized fluid supply port to the actuator,
- a fluid discharge line connecting the second port and the fluid discharge port and configured, at least in a condition of connection to the actuator, to enable discharge fluid to flow from the actuator to the discharge port,
- a control section comprising an actuator drive member configured to drive and/or manage one or more operative conditions of the actuator, the control section being configured both to control the actuator in one or more operative conditions by said actuator drive member, and to implement, in an anomaly and/or emergency conditions, a safety function acting on the actuator which causes the rod of the actuator to retract inside the box body, the anomaly and/or emergency conditions being a condition triggering the safety function.
Such technical solution, determining the substantially complete retraction of the rod into the box body in case of fail or malfunction or of an electric supply outage, enables to reduce the risks which the operator is subjected to, particularly with reference to the risk for the operator consisting in an uncontrolled movement of the hydraulic actuator which could crush the operator.
2. Aspect according to aspect 1, wherein the control section has a first operative section and a second operative section, each of them comprises a portion of the fluid supply line and a portion of the fluid discharge line, the first and second operative sections being configured to implement, upon the occurrence of the triggering condition, said safety function.
- 2-bis. Aspect according to the aspect 2, wherein the first operative section is defined between the supply/discharge section and the connection section.
- 2-tris. Aspect according to the aspect 2 or 2-bis, wherein the second operative section is defined between the supply/discharge section and the connection section.
3. Aspect according to the aspect 2 or 2-bis or 2-tris, wherein:
- the first operative section is defined, preferably in a normal operative condition, at least between the supply/discharge section and the actuator drive member and is configured, upon the occurrence of the triggering condition, to enable fluid to flow from the fluid supply port to the first port and to enable fluid to flow from the second port to the fluid discharge port,
- the second operative section is defined at least between the actuator drive member and the connection section and is configured, upon the occurrence of the triggering condition, at least to prevent fluid from flowing, from the fluid supply port to the second port.
  - 3-bis. Aspect according to anyone of the aspects from 2 to 3, wherein the control device is configured to modify, upon the occurrence of the triggering condition, a fluid path between the supply/discharge section and the connection section with respect to a path of fluid circulating between the supply/discharge section and the connection section and in a normal operative condition before the occurrence of the triggering condition.
  - 3-tris. Aspect according to anyone of the aspects from 2 to 3-bis, wherein the first operative section and/or second operative section are/is parallel to the actuator drive member, preferably upon the occurrence of the triggering condition.
  - 3-quater. Aspect according to the aspect 3-bis or 3-tris, wherein the control device is configured so that the first operative section and/or second operative section switch/switches from the normal operative condition wherein are/is in series with the actuator drive member to the anomaly and/or emergency condition wherein is parallel to the actuator drive member.
4. Aspect according to anyone of the aspects from 2 to 3-quater, wherein the first and second operative sections being provided with at least one respective redundancy level and being configured, upon the occurrence of the triggering condition, to ensure said retraction of the rod by the respective redundancy levels.
The redundancy levels enable to ensure a substantially complete retraction of the rod into the box body in case of fail or malfunction or of an electric supply outage and therefore contribute to reduce the risk which the operator is subjected to.
5. Aspect according to the aspect 4, wherein said at least one redundancy level of the first operative section is defined on the pressurized fluid supply line and is configured to ensure, upon the occurrence of the triggering condition, fluid to flow from the fluid supply port to the first port.
6. Aspect according to the aspect 4 or 5, wherein said at least one redundancy level of the second operative section is located on the pressurized fluid supply line and is configured to ensure, upon the occurrence of the triggering condition, to prevent fluid from flowing, from the fluid supply port to the second port.
7. Aspect according to the aspect 4 or 5 or 6, wherein the first operative section further comprises a further redundancy level defined on the discharge line.
8. Aspect according to anyone of the aspects from 4 to 7, wherein the second operative section comprises a further redundancy level defined on the discharge line.
9. Aspect according to anyone of the aspects from 1 to 8, wherein the fluid pressure in the pressurized fluid supply line is greater than the fluid pressure in the discharge line.
10. Aspect according to anyone of the aspects from 1 to 9, wherein the actuator drive member is configured to operate at least between:
- a condition in which it enables the passage of pressurized fluid from the pressurized fluid supply port to the first port, so that the pressurized fluid enters a first chamber defined inside the box body of the actuator, and the passage of fluid from the second port to the fluid discharge port, so that the fluid to be discharged flows from a second chamber defined inside the box body of the actuator to the fluid discharge port,
- a condition in which it enables both the passage of pressurized fluid from the pressurized fluid supply port to the second port, so that the pressurized fluid enters the second chamber, and the fluid passage from the first port to the fluid discharge port, so that such fluid to be discharged flows from the first chamber to the fluid discharge port.
11. Aspect according to anyone of the aspects from 1 to 10, wherein the actuator drive member is configured to operate in a condition in which it interrupts the flow/s of fluid through it during the execution of the safety function.
12. Aspect according to anyone of the aspects from 1 to 10, wherein the actuator drive command is configured to operate in a condition wherein it enables the flow/s of fluid through it during the execution of the safety function.
13. Aspect according to anyone of the aspects from 1 to 12, wherein the redundancy level and the further redundancy level of the first operative section comprise a respective pair of redundant valves.
14. Aspect according to anyone of the aspects from 1 to 13, wherein each redundancy level comprises a pair of redundant valves, in the safety function each valve of each pair of redundant valves of the first operative section being configured to enable the passage of fluid through it and each valve of each pair of redundant valves of the second operative section being configured to prevent the passage of fluid, preferably in one direction, through it.
15. Aspect according to anyone of the aspects from 1 to 14, wherein the redundant valves are controlled or controllable by a control unit of a system or machine which the control device is connected or connectable to.
16. Aspect according to anyone of the aspects from 1 to 15, wherein the actuator drive member is functionally part of at least one of the first and second operative sections, the actuator drive member contributing to ensure the redundancy of at least one redundancy level of the first and/or second operative sections.
17. Aspect according to anyone of the aspects from 1 to 16, wherein the actuator drive member is configured to operate between:
- a first condition in which it enables both the passage of pressurized fluid from the pressurized fluid supply port to the first port, so that the pressurized fluid enters a first chamber defined inside the box body of the actuator, and the fluid passage from the second port to the fluid discharge port, so that the fluid to be discharged flows from a second chamber defined inside the box body of the actuator to the fluid discharge port,
- a second condition in which it interrupts the flow/s of fluid through it,
- a third condition in which it enables both the passage of pressurized fluid from the pressurized fluid supply port to the second port, so that the pressurized fluid enters the second chamber, and the passage of fluid from the first port to the fluid discharge port, so that the fluid to be discharged flows from the first chamber to the fluid discharge port,
- a fourth condition or fail-safe condition.
18. Aspect according to anyone of the aspects from 1 to 17, wherein the actuator drive member is configured to take a fail-safe condition, the fail-safe condition contributing to the redundancy of said at least one redundancy level.
19. Aspect according to anyone of the aspects from 1 to 18, wherein the actuator drive member is functionally part of the second operative section, each redundancy level of the second operative section comprising the actuator drive member and a valve.
20. Aspect according to anyone of the aspects from 1 to 19, wherein the actuator drive member is functionally part both of the first operative section and the second operative section and contributes to ensure each redundancy level of the first operative section and each redundancy level of the second operative section.
21. Aspect according to anyone of the aspects from 1 to 20, wherein each redundancy level comprises a valve configured to prevent the passage of fluid in an anomaly and/or emergency conditions and the actuator drive command configured to take a fail-safe condition.
22. Aspect according to anyone of the aspects from 1 to 21, each redundancy level provides, in anomaly and/or emergency condition, that the valve prevents the passage of fluid and/or that the actuator drive member takes the fail-safe condition, in which it prevents the passage of fluid.
23. Aspect according to anyone of the aspects from 1 to 22, wherein the actuator drive member is functionally part both of the first operative section and the second operative section, each redundancy level of the first and second operative sections comprising the actuator drive member and a valve.
24. Aspect according to anyone of the aspects from 1 to 23, wherein the actuator drive member is functionally part both of the first operative section and the second operative section, each redundancy level of the first operative section comprising the actuator drive member and a pair of redundant valves, each redundancy level of the second operative section comprising the actuator drive command and a valve.
25. Aspect according to anyone of the aspects from 1 to 24, due to the specific arrangement and functionality of the first and second sections and due to the safety function the device is configured to implement, the control device is configured to make the hydraulic circuit or hydraulic system which is associated to, compliant to the requirements of the standard EN ISO 13849, preferably of the standard EN ISO 13849-1, still more preferably of the standard EN ISO 13849-1 category 3.
26. Aspect according to anyone of the aspects from 1 to 25, the actuator drive member is an actuator pilot valve.
27. Aspect according to the aspect 26, wherein the actuator pilot valve is a servovalve.
28. Aspect according to anyone of the aspects from 1 to 27, wherein the control device is configured to be used in or with a system or a machine in order to perform said safety function and therefore making the system or machine compliant to the standard EN ISO 13849-1.
29. Aspect according to anyone of the aspects from 1 to 28, wherein the control device is configured to enable to retrofit an existing machine or system.
30. Aspect according to anyone of the aspects from 1 to 29, wherein the control device is configured to enable to retrofit an existing machine or system in order to ensure the compliance of the system or machine to the standard EN ISO 13849-1.
31. Aspect according to anyone of the aspects from 1 to 30, wherein the control device is interchangeable with an existing solution of a machine or of a system in order to ensure the compliance of the system or machine to the standard EN ISO 13849-1.
32. Hydraulic system comprising:
- a hydraulic circuit associated to a pressurized fluid source and to a fluid discharge,
- at least one actuator associated to the hydraulic circuit and comprising a box body such as a cylinder and rod movable with respect to the box body, the actuator being configured to move a movable mass,
- a control device according to anyone of the device claims and/or according to the aspects from 1 to 31, the control device being connected to the actuator at the connection section and to the hydraulic circuit at the supply/discharge section.
33. Aspect according to the aspect 32, wherein the system is configured to detect a triggering condition and to implement a safety function by the control device following the detection of said triggering condition, the triggering condition being an anomaly and/or emergency conditions, for example due to or related to the hydraulic circuit or the actuator or the control device itself.
34. Aspect according to the aspect 33, wherein detecting the triggering condition is performed by a control unit outside of the control device.
35. Aspect according to the aspect 32 or 33 or 34, wherein the hydraulic system comprises a control unit configured to detect the triggering condition.
36. Aspect according to the aspect 35, wherein the control unit is configured to:
- detect the triggering condition,
- trigger the safety function by the control device.
37. Aspect according to the aspect 35 or 36, wherein the control unit is configured to communicate the detected triggering condition to the control device so that the control device triggers the safety function.
38. Aspect according to anyone of the aspects from 32 to 37, wherein the hydraulic system comprises a machine configured to be actuated, at least partially hydraulically, such as a calender or a press, the machine comprising at least said actuator.
39. Aspect according to anyone of the aspects from 32 to 38, wherein the machine comprises said control unit.
40. Aspect according to anyone of the aspects from 32 to 39, wherein the machine comprises a first and second actuators.
41. Aspect according to the aspect 40, wherein the first and second actuators cooperate to move a same mass.
42. Aspect according to anyone of the aspects from 32 to 41, wherein the pressurized fluid source is configured to supply pressurized fluid also without an electric supply.
43. Aspect according to anyone of the aspects from 32 to 42, wherein the pressurized fluid source is a group for storing and/or supplying pressurized fluid, such as an oil storage and/or supply group.
44. Use of the control device according to anyone of the device claims and/or the aspects from 1 to 31 for controlling, and implementing said safety function on at least one actuator, for example on at least one hydraulic actuator of a hydraulic machine such as a calender or a press.
45. Aspect according to the aspect 44, wherein the use of the control device ensures, upon the occurrence of an anomaly and/or emergency conditions, to perform the safety function which provides to retract the rod of the actuator inside the box body.
46. Use of the control device according to anyone of the device claims and/or the aspects from 1 to 31, in a hydraulic circuit provided with or associated to at least one actuator having a box body such as a cylinder and a rod movable with respect to the box body, in order to ensure to perform a safety function which provides to retract the rod of the actuator inside the box body.
47. Method of controlling at least one hydraulic actuator, the actuator being arranged in or associated to a hydraulic circuit and having a box body such as a cylinder and rod movable with respect to the box body, the box body being provided with or defining a first chamber and a second chamber, the actuator being configured to move a movable mass, the method comprising the steps of:
- predisposing a control device according to anyone of the device claims and/or the aspects from 1 to 31,
- connecting the control device to the actuator by the connection section or verifying the correct connection of the control device to the actuator,
- detecting a triggering condition, the triggering condition being an anomaly and/or emergency conditions for example due or related to the hydraulic circuit or the actuator or the control device itself,
- following detecting the triggering condition, implementing a safety function by the control device.
48. Aspect according to the aspect 47, the step of implementing a safety function by the control device comprising:
- supplying the first chamber of the actuator with a pressurized fluid, said step comprising making the pressurized fluid to flow along the pressurized fluid supply line through the first operative section and, downstream the first operative section, through said first port,
- discharging pressurized fluid from the second chamber of the actuator, said step comprising making fluid to flow along the discharge line at least through the first operative section and, upstream the first operative section, through said second port,
- retracting the rod inside the box body,
- ensuring the retraction of the rod by said redundancy levels of the first and second operative sections.
48-bis. Aspect according to the aspect 47 or 48, wherein the step of implementing a safety function by the control device comprises modifying, by the control device and upon the occurrence of the triggering condition, a fluid path between the supply/discharge section and the connection section with respect to a path of fluid circulating between the supply/discharge section and the connection section in a normal operative condition before the occurrence of the triggering condition.
48-tris. Aspect according to the aspect 48-bis, wherein said step of modifying a fluid path between the supply/discharge section and the connection section comprises switching the first operative section and/or second operative section from the series arrangement to the parallel arrangement with respect to the actuator drive member.
49. Aspect according to anyone of the aspects from 47 to 48-tris, wherein the step of implementing a safety function by the control device comprises preventing fluid from flowing through the actuator drive member.
50. Aspect according to anyone of the aspects from 47 to 49, wherein the step of ensuring the retraction of the rod by said redundancy levels of the first and second operative sections comprises providing a pair of redundant valves for each redundancy level of the first and second operative sections.
51. Aspect according to anyone of the aspects from 47 to 50, wherein the step of implementing a safety function by the control device comprises enabling fluid to flow through the actuator drive member when the actuator drive member is in the fail-safe condition.
52. Aspect according to anyone of the aspects from 47 to 51, wherein the step of ensuring the retraction of the rod by said redundancy levels of the first and second operative sections comprises using the actuator drive member as element cooperating in the redundancy of at least one redundancy level of at least one of the first and second operative sections.
53. Aspect according to anyone of the aspects from 47 to 52, wherein the step of ensuring the retraction of the rod by said redundancy levels of the first and second operative sections comprises providing a pair of redundant valves for each redundancy level of the first operative section and using the actuator drive member as element cooperating to make redundant each redundancy level of the second operative section.
54. Aspect according to anyone of the aspects from 47 to 53, wherein the step of ensuring the retraction of the rod by said redundancy levels of the first and second operative sections comprises using the actuator drive member as element cooperating in the redundancy of each redundancy level of the first and second operative sections.
55. Aspect according to anyone of the aspects from 47 to 54, wherein the step of implementing a safety function by the control device comprises:
- using the actuator drive member as element cooperating in the redundancy of each redundancy level of the first and second operative sections,
- providing a pair of redundant valves for each redundancy level of the first operative section.
56. Aspect according to anyone of the aspects from 47 to 55, wherein the step of retracting the rod of the actuator inside the box body provides to retract the rod of the actuator in a safety position inside the box body.
57. Aspect according to anyone of the aspects from 47 to 56, wherein the step of operatively connecting the control device to the actuator comprises connecting the control device to the actuator by the connection section.
58. Aspect according to anyone of the aspects from 47 to 57, wherein the method further comprises the step of connecting the control device to a fluid supply port and to a fluid discharge port by the supply/discharge section.
59. Aspect according to anyone of the aspects from 47 to 58, wherein the method comprises the step of signaling the triggering condition and/or the cause of the triggering condition.
60. Aspect according to the aspect 59, wherein the step of signaling the triggering condition and/or the cause of the triggering condition is performed after the step of implementing a safety function or is part of the step of implementing a safety function.
61. Aspect according to anyone of the aspects from 1 to 60, wherein the actuator is a fluid actuator, preferably a hydraulic actuator.
62. Aspect according to anyone of the aspects from 1 to 61, wherein the circuit is a fluid circuit, preferably a hydraulic circuit.
63. Aspect according to anyone of the aspects from 1 to 62, wherein the movable mass is outside of the actuator, in other words is not part of the actuator.
64. Aspect according to anyone of the aspects from 1 to 63, wherein the mass is integral with the rod of the actuator.
65. Aspect according to anyone of the aspects from 1 to 64, wherein the actuator is connected, directly or indirectly, to the movable mass to be moved.
66. Aspect according to anyone of the aspects from 1 to 65, wherein the actuator is configured to move directly or indirectly the movable mass, in other words by interposing one or more motion transmission connections.
67. Aspect according to anyone of the aspects from 1 to 66, wherein the mass is connected to the rod of the actuator.
68. Aspect according to anyone of the aspects from 1 to 67, wherein the mass is connected to the rod of the actuator by one or more intermediate mechanical motion transmission connections, such as one or more joints or similar.
69. Aspect according to anyone of the aspects from 1 to 68, wherein the retraction of the rod of the actuator inside the box body determines a safety condition.
70. Aspect according to anyone of the aspects from 1 to 69, wherein the actuator is an actuator of a machine configured to be actuated, at least partially hydraulically, such as a calender or a press.
71. Aspect according to anyone of the aspects from 1 to 70, wherein the actuator, and particularly the rod, is subjected to a tensile stress state due to the mass to be moved.
72. Aspect according to anyone of the aspects from 1 to 71, wherein the retraction of the rod into the box body provides a substantially complete retraction of the rod in the box body.
73. Aspect according to anyone of the aspects from 1 to 72, wherein the retraction of the rod in the box body enables to secure the mass connected to the actuator.
74. Aspect according to anyone of the aspects from 1 to 73, wherein the retraction of the rod in the box body provides to prevent articles from being damaged and/or persons from being injured in an area adjacent the actuator.
75. Aspect according to anyone of the aspects from 1 to 74, wherein the first operative section includes the actuator drive member.
76. Aspect according to anyone of the aspects from 1 to 75, wherein the second operative section includes the actuator drive member.
77. Aspect according to anyone of the aspects from 1 to 76, wherein the actuator drive member is part both of the first operative section and the second operative section.
78. Aspect according to anyone of the aspects from 1 to 74, wherein the actuator drive member is part both of the first operative section and of the second operative section.
79. Aspect according to anyone of the aspects from 1 to 78, wherein the actuator drive member defines the boundary between the first operative section and the second operative section.
80. Aspect according to anyone of the aspects from 1 to 79, wherein the control device is substantially a safety and control device.
81. Aspect according to anyone of the aspects from 1 to 80, wherein the term "hydraulic" is interchangeable with "fluid" or "fluidic".

Therefore, the control device, the method and system can be apt to operate with general fluid circuits and with general fluid actuators (therefore not only with hydraulic circuits and actuators).

Conventions and definitions

It is observed that in the following detailed description corresponding parts are indicated by the same numeral references. The figures could illustrate the object of the invention by not-to-scale representations; therefore, parts and components illustrated in the attached figures and regarding the object of the invention could only refer to schematic representations. In the context of the present disclosure, the use of terms such as "on", "upper", "at the top", "under", "lower", "at the bottom", "sideways", "lateral", "laterally", "internal", "internally", "external", "externally", "horizontal", "horizontally", "vertical", "vertically", "front", "frontally", "rear", "rearward", "right", "left", similar terms and corresponding variants, save for specific different indications, refers to at least one spatial orientation which the object of the invention can take in condition of use. Save for different specific indications, the terms "condition" or "configuration" can be interchangeably used in the context of the present disclosure. The configurations and connections which are described in the following refer, unless otherwise noted, to an anomaly and/or emergency condition which the control device and method according to the invention are configured to manage.
In the context of the present disclosure, one or more of the following definitions and conventions can be applied, when required and unless otherwise noted:

the term "control device" means any device configured to manage both one or more conditions of normal operation of an actuator and/or a machine which is connectable or connected to, and one or more extraordinary conditions of said actuator and/or said machine, such as one or more anomaly and/or emergency conditions,
"upstream", "downstream" and similar expressions or derivatives, refer to the arrangement of elements with respect to the fluid advancement direction along a determined line or branch of the circuit in which said elements are located; in different operative or anomaly conditions, the fluid advancement direction can vary along the same line or branch of the circuit,
the term "level of redundancy" means a redundancy feature of the device or system or method; when required, the expression "redundancy level" can be substituted with "redundancy feature". The term "redundancy level" identifies a portion of the respective operative section which provides two redundant elements, such as redundant valves, each of them is capable of ensuring, in case of fail to the other redundant element, to perform the function, which is responsible for,
the term "redundant valves" means valves apt to perform the same function, each of them is apt to act as a back-up of the other if one of the valves should not operate. Preferably, redundant valves are placed reciprocally adjacent, serially or parallel (see the respective circuit), and operatively cooperating to ensure the function which are responsible for,
the term "pair of redundant valves" means two redundant valves which have in common the same function, and which are according to the previous definition of "redundant valves",
"with redundancy" and "redundant" can be interchangeably used in the present disclosure unless otherwise noted,
the term "fluid" means a working fluid or hydraulic fluid, such as oil configured to circulate in a hydraulic circuit and to operate hydraulic machines,
the term "hydraulic", and variants thereof or derivative terms, is meant implying or regarding the use of a working fluid at the liquid state such as, preferably, oil,
the term "machine" preferably means a hydraulic machine, in other words a machine configured to be actuated, at least partially hydraulically, such as a calender or a press,
the terms "upstream" and "downstream" and similar or derivative expressions, refer to the arrangement of elements with respect to the fluid advancement direction along determined line or branch of the circuit in which said elements are located,
the term "triggering condition" means the condition triggering the safety function,
the term "anomaly and/or emergency condition" means an anomaly condition (such as a fail, a malfunction, or a unavailable or insufficient electric supply and similar not ordinary conditions) and/or emergency conditions (such as a condition which implies or could imply a risk for an operator) tied to the operation or failed correct operation of the hydraulic circuit which the control device is connected to or of the control device itself or to a unavailable or insufficient electric supply. Such condition can be in relation with a component of the control device or a component of the hydraulic circuit or with the actuator or the electric supply of one or more of said components or of the actuator,
the term "hydraulic system" means a system provided with at least one hydraulic circuit and with at least one hydraulic device or apparatus, such as a hydraulic actuator or a hydraulic machine,
the term "safety function" means a function enabling to reduce a risk, for example the risk of crushing an operator, associated to the movable mass which an actuator is connected to,
the term "safety condition" or "safety position" means a condition or position of the element which said expression refers to (the actuator or its rod, for example) which is associated to a less hazardous condition, for example for an operator, the risk in the safety condition or position being less than the condition or position of such element, or of a movable mass which is connected to, before implementing the safety function,
the term "fail-safe" condition or position means a safety condition or position (fail-safe condition or position),
the symbols of the circuits in the figures correspond to the acknowledged conventions established in the technical field of reference, and show, unless otherwise noted, the relative technical meaning; therefore, such symbols are considered as disclosing the respective function/s obtainable from the figures, also when this is not explicitly described; for example, the symbol of the non-return valve discloses that the flow is enabled only in a direction as illustrated in the circuit.

Brief description of the drawings

In order to have a better comprehension and to appreciate the advantages of the invention, some embodiments thereof will be illustratively described in a non a limiting way with reference to the attached drawings:

Figs 1 and 2 illustrate views of a control device according to a first embodiment of the invention,
Figures 3 and 4 illustrate views of a control device according to a second embodiment of the invention,
Figures 5 and 6 illustrate views of a control device according to a third embodiment of the invention,
Figure 7 illustrates the circuit configuration of the control device of Figures 1 and 2,
Figure 8 illustrates the circuit configuration of the control device of Figures 3 and 4,
Figure 9 illustrates the circuit configuration of the control device of Figures 5 and 6,
Figure 10 illustrates the circuit configuration of a control device according to a fourth embodiment of the invention.

Detailed descriptions of embodiments of the invention

Device

A control device according to the invention is generally indicated in the figures by the numeral reference 1. The control device 1 is configured to be connected to a hydraulic circuit associated to at least one actuator 7, 7L, 7R. In order to better comprehend the configurations and the functionalities of the control device 1, it is briefly described in the following the actuator 7, 7L, 7R; the numeral references of the actuator 7, 7L, 7R are mainly indicated in Figure 7 and can be clearly applied also to the actuator 7, 7L, 7R in Figures 8, 9, and 10. The actuator 7, 7L, 7R has a box body 8 such as a cylinder and a rod 9 movable with respect to the box body 8. The rod 9 has two ends; a first end located inside the box body 8 which is engaged with a piston 10 and a second end located outside of the box body, which is engaged with a mass M. The mass M (external load which has the tendency of moving the rod 9 out of the box body 8) is movable outside of the box body 8, while the piston 10 is movable inside the box body 8. The box body 8 has an internal volume in which a first chamber 11 and a second chamber 12 are operatively distinguishable; the chambers 11, 12 have a respective volume variable as a function of the instantaneous position of the piston 10. The piston 10 has a thrust surface facing the first chamber 11 and a thrust surface facing the second chamber 12; the thrust surface of the piston facing the first chamber 11 is smaller than the thrust surface of the piston facing the second chamber 12. The box body 8 has a door B1 leading to the first chamber 11 and a door A1 leading to the second chamber 12; the doors B1, A1 enable fluid to flow to/from the respective chamber 11, 12, as a function of the operative configuration of the actuator 7, 7L, 7R. The actuator 7, 7L, 7R, by axially translating the rod 9, is configured to move the movable mass M, of which an uncontrolled movement can possibly cause a risk condition; such condition could, for example, occur in fail or anomaly conditions of the control device or of the actuator or of the machine itself. The actuator 7, 7L, 7R is subjected to a tensile stress state due to the mass M which is connected to; such condition is schematically illustrated in Figures from 7 to 10 by the arrow drawn below the mass M and directed downwardly. Preferably, the actuator 7, 7L, 7R is of a hydraulic type and can be part of a hydraulic machine, such as a calender or a press. Preferably, the actuator 7, 7L, 7R is of the double-acting type; this means the piston 10 can be operated in both the directions (the rod 9 in a direction exiting or in a direction entering the box body 8) along its axis. Indeed, by providing two ports A1, B2, the actuator 7, 7L, 7R, based on which port A1, B1 is supplied with pressurized fluid, can determine the exit or retraction of the rod 9 in the box body 8.
The control device 1 comprises a supply/discharge section 2 which enables the connection to a pressurized fluid source P and to a discharge T, such as a discharge tank. The supply/discharge section is provided with a pressurized fluid supply port P' and a fluid discharge port T'. The pressurized fluid supply port P' is configured to be connected to the pressurized fluid source P' and, in a condition of connection to the pressurized fluid source P, to supply the control device 1 with pressurized fluid. The fluid discharge port T' is configured to discharge fluid from the control device 1 and, in condition of connection to the discharge T, to discharge fluid from the control device 1 to the discharge T. Preferably, the fluid is hydraulic oil.
Moreover, the control device 1 comprises at least one connection section 3 which enables the connection to the actuator 7, 7L, 7R. The connection section 3 comprises a first port B1', B1L', B1R' configured, at least in a condition of connection to the actuator (such as at least in an anomaly and/or in an emergency condition) to supply the actuator with pressurized fluid and a second port A1', A1L', A1R' configured, at least in a condition of connection to the actuator (such at least one anomaly and/or emergency condition), to discharge fluid from the actuator. The first port B1', B1L', B1R' is connected to the port B1 leading to the first chamber 11 of the actuator and the second port A1', A1L', A1R' is connected to the port A1 leading to the second chamber 12 of the actuator; the first and second chambers 11, 12 of the actuator are opposite with respect to a piston 10 connected to the rod 9.
As illustrated in the figures from 1 to 6 with reference to the ports A1', B1', P', T' of the control device 1 according to three possible embodiments, the ports A1', A1L', A1R', B1', B1L', B1R', P', T' can be defined on the box body 4 of the control device 1. The box body 4 can comprise and contain at least partially circuit configurations of the control device 1. The control device 1 can comprise two connection sections 3, and consequently two first ports B1', B1L', B1R' and two second ports A1', A1L', A1R', and two supply/discharge sections 2, and therefore two pressurized fluid supply ports P' and two discharge ports T'; in further embodiments, the control device 1 could provide a number of connection sections 3 greater than two and, in addition or as an alternative, a number of supply/discharge sections 2 greater than two. As it is visible in Figures from 1 to 6 by illustrating the ports P', T', A1', B1', a connection section 3 and a supply/discharge section 2 can be defined on a face of a box body 4 of the control device 1, while the other connection section 3 and the other supply/discharge section 2 can be defined on a face of the box body 4 opposite to said face. Providing two or more connection sections and a corresponding number of ports enables to connect the control device 1 to the actuator at different portions of the box body 4 of the control device 1. Analogously, providing two or more supply/discharge sections 2 and a corresponding number of ports enables to connect the control device 1 to the pressurized fluid source P and to the discharge T at different portions of the box body 4 of the control device 1.
Moreover, the control device 1 comprises fluid lines developing between the supply/discharge section 2 and each connection section 3. The fluid lines can be at least partially or completely defined inside the box body 4. More particularly, the control device 1 comprises a pressurized fluid supply line and a fluid discharge line. The pressurized fluid supply lines develop between, and connects, the pressurized fluid supply port P' and the first port B1', B1L', B1R' and is configured, at least in a condition of connection to the actuator 7, 7L, 7R, to enable supply fluid to flow from the pressurized fluid supply port P' to the actuator 7, 7L, 7R. The fluid discharge line develops between, and connects the second port, A1', A1L', A1R' and the fluid discharge port T' and is configured, at least in a condition of connection to the actuator 7, 7L, 7R, to enable discharge fluid to flow from the actuator 7, 7L, 7R to the discharge port T'.
Moreover, the control device 1 comprises a control section configured both to control the actuator 7, 7L, 7R in one or more normal operative conditions ("steady" operative conditions) and to implement, in an extraordinary condition such as an anomaly and/or emergency conditions, a safety function operating on the actuator 7, 7L, 7R. More particularly, the safety function starts operating at the occurrence of a triggering condition, which indeed consists of the anomaly and/or emergency conditions and determines the complete retraction of the rod 9 of the actuator 7, 7L, 7R inside the box body 8.
The control section comprises an actuator drive member VA09, VA09L, VA09R configured to drive and/or manage one or more operative conditions of the actuator, and particularly in at least the normal operative conditions. As illustrated in the attached figures, the actuator drive member VA09, VA09L, VA09R is configured to operate according to a plurality of operative configurations. In the normal operative conditions, the fluid flows into the actuator drive member VA09, VA09L, VA09R, which drives the normal operation of the actuator 7, 7L, 7R. In the normal operative conditions, the actuator drive member VA09, VA09L, VA09R can therefore drive the retraction of the rod 9 into, or the exit of the rod 9 from the box body 8 because it is configured to operate at least between a condition in which it determines the retraction of the rod 9 into the box body 8 (retraction condition of the rod) and a condition in which it determines the exit of the rod 9 from the box body 8 (exit condition of the rod). In the retraction condition of the rod 9, the actuator drive member VA09, VA09L, VA09R enables both the passage of pressurized fluid from the pressurized fluid supply port P' to the first port B1', B1L', B1R' and the passage of fluid from the second port A1', A1L', A1R' to the fluid discharge port T', so that the pressurized fluid flows into the first chamber 11 and the fluid to be discharges flows out the second chamber 12 and flows from the second port A1', A1L', A1R' to the fluid discharge port T' in order to precisely determine the retraction of the rod 9 into the box body 8. In the condition of egress of the rod 9, the actuator drive member VA09, VA09L, VA09R enables both the passage of pressurized fluid from the pressurized fluid supply port P' to the second port A1', A1L', A1R' and the passage of fluid from the first port B1', B1L', B1R' to the fluid discharge port T', so that the pressurized fluid flows into the second chamber 12 and the fluid to be discharged flows from the first chamber 11 to the fluid discharge port T' in order to precisely determine the retraction of the rod 9 into the box body 8. The actuator drive member VA09, VA09L, VA09R is preferably a valve, particularly a servovalve.
Moreover, the control section comprises a first operative section 5 and second operative section 6, which enable to implement the safety function at the occurrence of the triggering condition. Both the first and second operative sections comprise a portion of the pressurized fluid supply line and a portion of the fluid discharge line.
The first operative section 5 is defined between the connection section 3 and the supply/discharge section 2. The first operative section 5 is fluidically connected to the supply/discharge section 2. More particularly, the first operative section 5 is defined at least between the supply/discharge section 2 and the actuator drive member VA09, VA09L, VA09R; such arrangement is defined with reference to the normal operative conditions in which the first operative section 5 and the actuator drive member VA09, VA09L, VA09R are in series to each other. With reference to the four embodiments which will be described in the following, the series arrangement of the first operative section 5 with the actuator drive member VA09 occurs in the normal operative condition, while the first operative section 5 is parallel to the actuator drive member VA09, VA09L, VA09R during the anomaly and/or emergency conditions. Substantially, at the occurrence of the triggering condition, the fluid flow in the circuit changes at least partially its path between the connection section 3 and the supply/discharge section 2 in order to switch the first operative section 5 from the series arrangement to the parallel arrangement with respect to the actuator drive member VA09, VA09L, VA09R. The first operative section 5 is configured, at the occurrence of the triggering condition, to enable fluid to flow from the fluid supply port P to the first port B1', B1L', B1R' and to enable fluid to flow from the second port A1', A1L', A1R' to the fluid discharge port T'. Optionally, the first operative section 5 can comprise the actuator drive member VA09, VA09L, VA09R (for example, in the second, third and fourth embodiments, in which the actuator drive member is functionally part of at least one between the first and second operative sections 5, 6 due to its safety position), which can therefore be functionally part of the first operative section 5.
The second operative section 6 is defined between the supply/discharge section 2 and the connection section 3. The second operative section 6 is defined at least between the actuator drive member VA09, VA09L, VA09R and the connection section 3; such arrangement is defined with reference to the normal operative condition in which the actuator drive member VA09, VA09L, VA09R and the second operative section 6 are in series to each other. With reference to the four embodiments which are described in the following, the series arrangement between the actuator drive member VA09, VA09L, VA09R and the second operative section 6 occurs in the normal operative condition, while the second operative section 6 is parallel to the actuator drive member VA09, VA09L, VA09R during the anomaly and/or emergency condition. Substantially, at the occurrence of the triggering condition, the fluid flow in the circuit changes at least partially its path between the connection section 3 and the supply/discharge section 2 in order to switch the second operative section 6 from the series arrangement to the parallel arrangement with respect to the actuator drive member VA09, VA09L, VA09R. The second operative section 6 is configured, at the occurrence of the triggering condition, at least to prevent fluid from flowing from the pressurized fluid supply port P', to the second port A1', A1L', A1R'. Optionally, the second operative section 6 can comprise the actuator drive member VA09, VA09L, VA09R (for example in the second, third and fourth embodiments, in which the actuator drive member is functionally part of at least one between the first and second operative sections 5, 6 due to its safety position) which thus can be functionally part of the second operative section 6.
According to the invention, the first and second operative sections 5, 6 are provided with at least one respective redundancy level and are configured, at the occurrence of the triggering condition, to ensure said retraction of the rod 9 by the respective redundancy levels. As it will be more particularly described in the following, each redundancy level provides at least two redundant elements which cooperate so that the function for which they are devised is performed also in case of a fail of one of said elements. The assurance of the retraction of the rod 9 is just given by the presence, at each provided redundancy level, of at least two redundant elements; consequently, if one of the redundant elements does not act the other redundant element or one of the other redundant elements of the same redundancy level acts.
The redundancy level of the first operative section 5 is defined on the pressurized fluid supply line and ensures, at the occurrence of the triggering condition, the flow of fluid from the fluid supply port P to the first port B1', B1L', B1R'. The redundancy level of the second operative section 6 is provided on the pressurized fluid supply line and ensures, at the occurrence of the triggering condition, to prevent fluid from flowing, from the pressurized fluid supply port P', to the second port A1', A1L', A1R'. By making the pressurized fluid to flow to the first port B1', B1L', B1R' and not to the second port A1', A1L', A1R', the control section enables and ensures the complete retraction of the rod 9 into the box body 8.
The control device 1 is interchangeable with the existent solutions which are not capable of performing a safety function according to the standard EN ISO 13849-1, in order to make them adapted to perform the safety function and consequently to make them compliant to said standard. Therefore, the control device 1 can be configured to enable to retrofit an existing machine or system 100 in order to ensure the compliance of the system or of the machine to the standard EN ISO 13849-1.
As it will be more specifically described in the following with reference to different embodiments of the control device 1, at least one between the first and second operative sections 5, 6 can comprise a further redundancy level. Preferably, both the first and second operative sections 5, 6 comprise respective further redundancy levels. Particularly, the further redundancy level of the first operative section 5 is defined on the discharge line and the further redundancy level of the second operative section 6 is also defined on the discharge line.
Moreover, the control section comprises a plurality of valves VA01-VA08, VA05L, VA05R, VA06L, VA06R, which contribute to one or more redundancy levels as hereinbelow described. The valves VA01-VA08, VA05L, VA05R, VA06L, VA06R can operate between an energized configuration (supplied condition) and a deenergized configuration; preferably, they are solenoid valves. The valves VA01-VA08, VA05L, VA05R, VA06L, VA06R preferably have an elastic element, such as a spring, which support the valve in the rest configuration in case of a current leak or cut of a supply wire. The valves VA01-VA08, VA05L, VA05R, VA06L, VA06R can be monitorable by a control unit, such as a programmable logic controller (PLC), of the hydraulic machine comprising at least one actuator which the control device 1 operates on. Among the types of valves VA01-VA08, VA05L, VA05R, VA06L, VA06R which can be used, it is mentioned in an exemplifying and non-limiting way the seat valves and the slide valves. The seat valves are substantially perfect tight valves; this type of valves does not have any fluid leakage and enables an optimal control of the hydraulic actuator.
Preferably, the control device 1 comprises two redundancy levels for each operative section. The following will more particularly describe a first, a second, a third, and a fourth embodiments of the invention, respectively illustrated in the Figures 7, 8, 9, and 10. Such circuit configurations illustrate the control device 1 during the implementation of the safety function.
The pressurized fluid source P, the discharge T and the ports A1, A1L, A1R, B1, B1L, B1R of the actuator 7 are illustrated in the attached figures from 7 to 10 outside of the abovementioned broken line which encircle the corresponding circuit configuration of the control device 1; possible references P, T, A, B present inside of before mentioned broken line (in proximity of the actuator drive member VA09, VA09L, VA09R, for example) refer to the corresponding fluid line and illustrate a possible continuity or interruption of fluid (for example according to the arrows and symbols of the actuator drive member VA09, VA09L, VA09R which illustrate possible operative configuration) between the pressurized fluid source P or discharge T and/or a port A1, B1.

First embodiment

In the first embodiment of the control device 1, the configuration thereof is schematically illustrated in Figure 7, the first operative section 5 comprises a redundancy level and a further redundancy level; analogously, the second operative section 6 comprises a redundancy level and a further redundancy level.
Each redundancy level comprises a pair of valves VA01-VA08. With reference to the first operative section 5, the redundancy level located on the pressurized fluid supply line comprises the pair or redundant valves VA02, VA04, the further redundancy level located on the discharge line comprises the pair of redundant valves VA01, VA03. Referring now to the second operative section 6, the redundancy level thereof is defined on the pressurized fluid supply line and comprises the valves VA05, VA07 and its further redundancy level is defined in the fluid discharge line and comprises the valves VA06, VA08. For each pair of redundant valves, if there is a fail of or no supply to a valve, the function is ensured by the other redundant valve of the same pair of redundant valves.
The circuit configuration of the first embodiment, illustrating an anomaly and/or emergency conditions, can be summarized in this way: the control device 1 is supplied with pressurized hydraulic oil by the pressurized fluid source P through the port P'. The oil flow rate is adjusted by the one-way flow valve RG01. Independently from the position of the valve VA09 (Figure 7 shows the position in which it prevents the oil from flowing), the pressurized oil enters the first chamber 11 of the hydraulic actuator 7 through the port B1 determining the retraction of the rod 9. The retraction of the rod 9 into the box body 8 is ensured because the oil flowing out of the port A1 can be discharged from the fluid discharge line through the redundant valves VA01, VA03. The valves VA05, VA06, VA07, VA08 isolate the actuator drive member VA09; this is advantageous because this latter can fail and locks in any non-safe position. In performing the safety function, the retraction of the rod 9 into the box body 8 is therefore ensured by:

the redundancy of the valves VA02 and VA04,
the redundancy of the valves VA01 and VA03,
the redundancy of the valves VA05 and VA07,
the redundancy of the valves VA08 and VA07.

The first embodiment enables to implement the safety function by using eight solenoid valves VA01-VA08 (monitored by the control unit of the hydraulic machine comprising the actuator 7 which the control device 1 operates on) and a proportional solenoid valve VA09, particularly and as more specifically described in the following, a non-safety proportional solenoid valve VA09.
The valves VA01-VA08 can be monostable solenoid valves configured to operate between a rest position (deenergized condition) and an operative position (energized condition). The rest position, and consequently the operative position, are different among the valves VA01-VA04 and the valves VA05-VA08; the valves VA01-VA04 at rest enable the passage of fluid (on the contrary, they do not enable it in their operative position), while the valves VA05-VA08 at rest do not enable the passage of fluid in a direction, as indicated in the following (instead they enable it in their operative position). The solenoid valves VA01-VA08 are monitored by the control unit of the hydraulic machine so that, at the occurrence of an anomaly and/or emergency conditions, the control unit operates on them (therefore on the redundancy levels of the first and operative sections) for determining the implementation of the safety function.
Figure 7 illustrates the circuit of the first embodiment in the deenergized state of the valves, wherein the monostable solenoid valves VA01-VA08 are not supplied and therefore are in a rest position. In such configuration, the valves VA01-VA04 enable the passage of fluid while the valves VA05-VA08 do not enable the passage of fluid in a direction (the passage of fluid is prevented from 2 to 1, see the symbols of each valve VA05-VA08). Consequently, the "non-safe" actuator drive member VA09 (in other words not configured to operate in a safety position) is excluded or bypassed; this is advantageous in order to prevent risk conditions if the actuator drive member VA09 fails and blocks in any non-safe position. Moreover, according to such configuration, pressurized fluid is supplied to the first chamber B1 of the actuator through the first port B1' and fluid is discharged from the second chamber A1 of the actuator through the second port A1'; in so far, therefore, the rod 9 of the actuator 7 is retracted inside the box body 8, so that the safety function is implemented. Performing the safety function is ensured by the redundant valves of each redundancy level.
In the first embodiment, the actuator drive member VA09 is a proportional solenoid valve and particularly a non-safety proportional solenoid valve, in other words a solenoid valve not apt to take a fail-safe position (safety position). It is understood the actuator drive member VA09 can be provided with any valve alternative to what was hereinbefore described or with an element apt to ensure the hereinbefore described functions.
As illustrated in Figure 7, the control device 1 according to the first embodiment can further comprise a sectionalizing valve VA10 configured to sectionalize the control device 1 in case of maintenance and, optionally, an oil filtration device F01 provided to protect the actuator drive member VA09. The control device 1 can comprise at least one non-return valve RT01, RT02, RT03; Figure 7 illustrates three non-return valves RT01, RT02, RT03. Each non-return valve can be a cartridge valve RT01, RT02, RT03. The control device 1 of Figure 7 further comprises two one-direction flow valves RG01, RG02 which enable to adjust the oil flow rate only in one flow direction (see the symbols in Figure 7). The valves VA10, RG01, RG02 are preferably of the manual type; in the circuit configuration illustrated for the first embodiment, the valves VA10, RG01, RG02 are completely open and therefore enable the passage of fluid.
The state of the valves shown in the circuit configuration of Figure 7 exemplifyingly shows the following operative conditions of the hydraulic machine: loss of the electric supply, actuation of one of the emergency stop functions by the control unit (PLC) of the machine.

Second embodiment

In the second embodiment of the control device 1, of which the circuit configuration is schematically illustrated in Figure 8, the first operative section 5 comprises a redundancy level and a further redundancy level; analogously, the second operative section 6 comprises a redundancy level and a further redundancy level. As it is hereinbelow described, the actuator drive member VA09 cooperates with the redundancy levels of the second operative section 6 and therefore, from the functional point of view, is part of the second operative section 6. The actuator drive member VA09 contributes to the redundancy because is configured to operate, in addition to the beforehand described retraction condition of the rod 9 and the outward condition of the rod, also in a fail-safe condition, in which it takes a fail-safe position, which prevents fluid from flowing; see Figure 8 in this regard. The fail-safe position is a safety position and can be defined, in such embodiment, as "closed-center" position, because it prevents fluid from flowing through the actuator drive member VA09.
The circuit configuration of the second embodiment, illustrating an anomaly and/or emergency conditions, can be summarized in this way: the control circuit 1 is supplied with pressurized hydraulic oil by the pressurized fluid source P through the port P'. The oil flow rate is adjusted by the one-direction flow valve RG01, the function and type thereof can be analogous to what was hereinbefore described with reference to the first embodiment. Independently from the position of the valve VA09 (Figure 8 illustrates the position in which it prevents the passage of oil), the pressurized oil flows into the first chamber 11 of the hydraulic actuator 7 through the port B1 determining the retraction of the rod 9. The retraction of the rod 9 into the box body 8 is ensured by the fact the oil flowing out of the port A1 can be discharged from the fluid discharge line through the redundant valves VA02, VA04. The valves VA05, VA06 and the actuator drive member VA09 in the safety position prevent pressure from entering the second chamber 12 of the hydraulic actuator 7. In performing the safety function, the retraction of the rod 9 into the box body 8 is consequently ensured by:

the redundancy of the valves VA02 and VA04,
the redundancy of the valves VA01 and VA03,
the redundancy of the valve VA05 and the safety position of the actuator drive member VA09,
the redundancy of the valve VA06 and the safety position of the actuator drive member VA09.

The second embodiment enables to implement the safety function by using six solenoid valves VA01-VA06 (monitored by the control unit of the hydraulic machine comprising the actuator 7 which the control device 1 operates on) and a proportional solenoid valve VA09 configured to take said safety position. The safety position corresponds to the case in which the ports P', T', A1', B1' are closed (see Figure 8). Each solenoid valve VA01-VA06 is preferably a solenoid valve of the beforehand type described with reference to the first embodiment.
The control device according to the second embodiment, can comprise one or more among the further components RG02, RP01, F01, RT01, RT02, RT03 of the beforehand type described with reference to the first embodiment.

Third embodiment

In the third embodiment of the control device 1, of which the circuit configuration is schematically illustrated in Figure 9, the first operative section 5 comprises a redundancy level and a further redundancy level; analogously, the second operative section 6 comprises a redundancy level and a further redundancy level. As it is described in the following, the actuator drive member VA09 cooperates with the redundancy levels both of the first operative section 5 and of the second operative section 6 and therefore, from the functional point of view, is part both of the first operative section 5 and of the second operative section 6. The actuator drive member VA09 contributes to the redundancy because it is provided with a fail-safe condition, in which it takes a fail-safe position, which ensures the flow of fluid such to enable the retraction of the rod 10; in this regard, see Figure 9. The fail-safe position is a safety position and can be also defined, in such embodiment, as the "crossed-center" position, because it enables "crossed" fluid flows (from P to B1 and from A1 to T, see the symbols of the actuator drive member VA09 in Figure 9) through the actuator drive member VA09. The fail-safe position of the actuator drive member VA09 illustrated in Figure 9, enables therefore the passage of "crossed" fluid through it in anomaly and/or emergency conditions; consequently, the oil can flow through the actuator drive member VA09 both in normal operative conditions and in extraordinary operative conditions. The fail-safe position of the actuator drive member VA09 of the third embodiment is therefore different from the fail-safe position of the actuator drive member VA09 of the second embodiment.
The circuit configuration of the third embodiment, illustrating an anomaly and/or emergency conditions, can be summarized in this way: the control device 1 is supplied with pressurized hydraulic oil from the pressurized fluid source P through the port P'. The pressurized oil flows into the first chamber 11 of the hydraulic actuator 7 through the port B1 determining the retraction of the rod 9. The retraction of the rod 9 is ensured because the oil flowing out of the port A1 can be discharged from the fluid discharge line through the valves VA02, VA06. The safety position of the actuator drive member VA09 also ensure the retraction of the rod 9. The valve VA05 and the actuator drive member VA09 in the safety position prevent pressure from entering into the second chamber 12 of the hydraulic actuator 7. In performing the safety function, the retraction of the rod 9 into the box body 8 is therefore ensured by:

the redundancy of the valves VA02 and the safety position of the actuator drive member VA09,
the redundancy of the valves VA01 and the safety position of the actuator drive member VA09,
the redundancy of the valves VA05 and the safety position of the actuator drive member VA09,
the redundancy of the valves VA06 and the safety position of the actuator drive member VA09.

The third embodiment enables to implement the safety function by using four solenoid valves VA01-VA04 (monitored by the control unit of the hydraulic machine comprising the actuator 7 which the control device 1 operates on) and a proportional solenoid valve VA09 configured to take said safety position. The safety position corresponds to the condition in which the port P' is fluidically communicating with the port B1' and the port T' is fluidically communicating with the port A1' (see Figure 9). Each solenoid valve VA01-VA04 is preferably a solenoid valve of the beforehand type described with reference to the first embodiment.
The control device according to the third embodiment can comprise one or more further components RG01, RG02, RP01, F01, RT01, RT02, RT03 of the beforehand type described with reference to the first embodiment.

Fourth embodiment

The control device 1, according to the fourth embodiment, illustrated in Figure 10, is configured to assist two actuators 7L, 7R. Figure 10 illustrates the actuators 7L, 7R as left actuator 7L and right actuator 7R and they are configured to move a same mass M arranged between them. The letters "L" and "R" indicate that some references of ports, components and/or sections analogous to the beforehand described ones and which end with such letter assist the left actuator (letter "L") and the right actuator (letter "R") respectively. It is understood that, even though in Figure 10 the actuators 7L, 7R are illustrated on the left and on the right, such position is only illustrative; indeed, the actuators 7L, 7R and the mass M (or the respective mass M) can be placed according to other arrangements provided that the actuators are apt to assist the function of moving the mass M which they are responsible for. Moreover, even though the fourth embodiment has two actuators 7L, 7R, in further possible embodiments, the control device 1 can be configured to operate on a plurality of actuators in number equal to N, wherein N is greater than two. In such embodiments provided with N actuators, it is possible to provide a corresponding number or the same number N of ports, components and/or sections required to ensure the fluid connections of the control device 1 to the N actuators and the operability of the control device 1 on the N actuators.
The fourth embodiment provides two actuator drive members VA09L and VA09R respectively configured to assist the left actuator 7L and the right actuator 7R. Each actuator drive member VA09L, VA09R is of the beforehand type described with reference to the third embodiment. In possible embodiments in which the control device 1 is configured to operate N actuators, it can comprise the same number N of actuator drive members so that each actuator drive member is configured to assist a respective actuator.
The first operative section 5 of the control device 1 assists both the actuators 7L, 7R and consequently is in common for the two actuators 7, while the control device 1 comprises a second section 6L dedicated to assist the left actuator 7L and a second section 6R dedicated to assist the right actuator 7R. In further embodiments which provide that the control device 1 is configured to operate on N actuators, the same number N of second sections can be provided, wherein each second section is apt to assist a respective actuator. In such embodiments, the first operative section 5 or a plurality of first operative sections 5 are provided to assist all the N actuators, each of them can assist one or more actuators as a function of the selected circuit configuration.
The circuit configuration of the fourth embodiment, illustrating an anomaly and/or emergency conditions, can be summarized in this way: the control device 1 is supplied with pressurized hydraulic oil from the pressurized fluid source P through the port P'. The pressurized oil flows into the respective first chambers 11 of the hydraulic actuators 7L, 7R through the respective ports B1L, B1R determining the retraction of the rod 9 of each actuator 7L, 7R. The retraction of the rod 9 is ensured because the oil flowing out of the ports A1L, A1R can be discharged from the fluid discharge line through the valves VA02, VA04, VA05, VA05R and the safety position of the actuator drive members VA09L, VA09R. The valves VA05L, VA05R and the actuator drive members VA09L, VA09R in the safety position prevent pressure from entering the second chamber 12 of the respective hydraulic actuator 7L, 7R which they assist. In performing the safety function, the retraction of the rod 9 into the box body 8 of the actuators 7L, 7R is consequently ensured by:

the redundancy of the valves VA02 and VA04 and the safety position of the actuator drive members VA09L, VA09R,
the redundancy of the valves VA01 and VA03 and the safety position of the actuator drive members VA09L, VA09R,
the redundancy of the valves VA05L and the safety position of the actuator drive member VA09L,
the redundancy of the valves VA06L and the safety position of the actuator drive member VA09L,
the redundancy of the valves VA05R and the safety position of the actuator drive member VA09R,
the redundancy of the valves VA06R and the safety position of the actuator drive member VA09R.

More particularly, in performing the safety function, the retraction of the rod 9 into the box body 8 of the left actuator 7L is ensured by:

the redundancy of the valves VA02 and VA04 and the safety position of the actuator drive member VA09L,
the redundancy of the valves VA01 and VA03 and the safety position of the actuator drive member VA09L,
the redundancy of the valves VA05L and the safety position of the actuator drive member VA09L,
the redundancy of the valves VA06L and the safety position of the actuator drive member VA09L,
and the retraction of the rod 9 into the box body 8 of the right actuator 7R is ensured by:
the redundancy of the valves VA02 and VA04 and the safety position of the actuator drive member VA09R,
the redundancy of the valves VA01 and VA03 and the safety position of the actuator drive member VA09R,
the redundancy of the valves VA05R and the safety position of the actuator drive member VA09R,
the redundancy of the valves VA06R and the safety position of the actuator drive member VA09R.

The fourth embodiment enables to implement the safety function on two hydraulic actuators 7L,7R by eight solenoid valves VA01-VA04, VA05L, VA05R, VA06L, VA06R (monitored by the control unit of the hydraulic machine comprising the actuator 7 which the control device 1 operates on) and two proportional solenoid valves VA09L, VA09R configured to take said safety position. The safety position of the proportional solenoid valves VA09L, VA09R corresponds to the case in which the port P' is fluidically communicating with the ports B1L', B1R' and the port T' is fluidically communicating with the ports A1L', A1R' (see Figure 10). Each solenoid valve VA01-VA04, VA05L, VA05R, VA06L, VA06R is preferably a solenoid valve of the beforehand type described with reference to the first embodiment. It must be specified that each actuator 7L, 7R, in order to implement the safety unction, is assisted by six solenoid valves (VA01-VA04, VA05L and VA06L for the left actuator 7L and VA01-VA04, VA05R and VA06R for the right actuator 7R) and by a respective proportional solenoid valve VA09 configured to tale said safety position (VA09L for the left actuator 7L And VA09R for the right actuator 7R).
The control device 1, according to the fourth embodiment, can comprise one or more among the further components RG01, RG02, RP01 (particularly RP01L which assist the left actuator and RP01R which assists the right actuator), F01, RT01 (particularly RT01L which assists the left actuator and RT01R which assists the right actuator), RT02 (particularly RT02L which assists the left actuator and RT02R which assists the right actuator) of the beforehand type described with reference to the first embodiment.
Four embodiments of the control device 1 have been described in an illustrative way; it is understood that possible further embodiments and/or combinations of the described embodiments are possible.
Now it must be specified as, due to the specific arrangement and functionality of the first section 5, second section 6 and due to the safety function the control device 1 is configured to implement, the control device 1 is configured to make the hydraulic circuit or a hydraulic system 100 which is associated to, compliant to the requirements of the standard EN ISO 13849, preferably according to the standard EN ISO 13849-1, still more preferably according to the standard EN ISO 13849-1 category 3.
The technical features herein disclosed with reference to functions of the control device 1 can be applied in the field of corresponding uses of the device or steps of the method which will be described in the following and can consequently be used for specifying such uses and method in the attached claims.

Use

Moreover, the invention refers to a use of the beforehand described control device 1 for controlling and implementing a safety function on at least one actuator 7, 7L, 7R, for example on at least one hydraulic actuator 7, 7L, 7R of a hydraulic machine such as a calender or a press. The safety function is of the beforehand described type and provides to retract the rod of the actuator inside the box body. Using the control device 1 ensures, at the occurrence of an anomaly and/or emergency condition, to perform the safety function by the redundancy levels of the control device 1.

System

Further, the invention refers to a system 100 comprising a control device 1 of the beforehand described type.
Preferably, the system 100 is of a hydraulic type and comprises a hydraulic circuit associated to a pressurized fluid source P and to a fluid discharge T. The pressurized fluid source P is configured to supply pressurized fluid also without an electric supply; this enables to implement the safety function by the control device 1 also without an electric supply. For example, the pressurized fluid source P can be a pressurized fluid storage and/or supply group, such as an oil storage and/or supply group.
The system 100 comprises at least one actuator 7, 7L, 7R associated to the hydraulic circuit. The actuator 7, 7L, 7R can be of the type beforehand described. Specifically, the actuator 7, 7L, 7R comprises a box body 8 such as a cylinder and a rod 9 movable with respect to the box body and is configured to move a movable mass M. The control device 1 is connected to the actuator 7, 7L, 7R at the connection section 3 and to the hydraulic circuit at the supply/discharge section 2. More particularly, the system 100 can comprise the hydraulic machine provided with at least one actuator 7 or a pair of actuators 7L, 7R and/or possible additional actuators which the control device 1 is configured to assist.
The system 100 has a control unit, which is preferably part of the hydraulic machine and can be a programmable logic controller (PLC). The control unit is configured to monitor the valves VA01-VA08 and to drive the rest or operative positions. More specifically, the control unit is configured to control the correct operation of each valve VA01-VA08 and the correct implementation of operative logics.
The control unit is configured to detect a triggering condition and, following the detection of the triggering condition, to implement the beforehand described safety function by the control device 1. The triggering condition is of the beforehand described type. Possible triggering conditions are: no electric supply or fail or anomaly in one of the electric components of the hydraulic circuit (for example electric anomaly of one or more valves VA01-VA08, cut cables, etcetera), combination of "non-safe" positions of the valves (for example, failing in taking the correct rest position of a valve VA01-VA08) or discrepancy between the driven position and effective position of one or more valves VA01-VA08, presence of a person in a risk area defined in proximity of the actuator 7, 7L, 7R and/or of the machine, etcetera.
At the end of the safety function, the cause of the triggering condition, such as an anomaly or malfunction, can be detected or signaled by the control unit of the machine.
The technical features herein disclosed with reference to functions of the system 100 can be applied in the field of corresponding uses of the system 100, or of the control device 1 or steps of the control method of at least one hydraulic actuator which is described in the following.

Method

The present invention refers also to a method of controlling at least one hydraulic actuator 7, 7L, 7R. Preferably, the method is performed by the beforehand described control device 1, on at least one actuator 7 or a pair of actuators 7L, 7R and/or possible additional actuators also of the beforehand described type.
The method provides to connect the control device 1 to at least one actuator 7, 7L, 7R by the connection section or, if it is already connected, to verify its correct connection. Further, the method provides to detect a triggering condition which can be one among the beforehand described ones or a further anomaly and/or emergency conditions.
Following the detection of the triggering condition, the method provides to implement a safety function by the control device; the safety function is according to what was hereinbefore described. The implementation of the safety function by the control device 1 provides to supply the first chamber B1, B1L, B1R of the actuator 7, 7L, 7R with pressurized fluid and discharge pressurized fluid from the second chamber A1, A1L, A1R of the actuator 7, 7L, 7R, in order to determine the retraction of the rod 9 inside the box body 8. Supplying the first chamber B1, B1L, B1R preferably provides to flow the pressurized fluid in the pressurized fluid supply line through the first operative section 5 and, downstream the first operative section 5, through the first port B1', B1L', B1R'. Discharging the pressurized fluid from the second chamber A1, A1L, A1R of the actuator 7, 7L, 7R preferably provides to flow fluid in the discharge line at least through the first operative section 5 and, upstream the first operative section 5, through the second port A1', A1L', A1R'.
Retracting the rod 9 inside the box body 8 enables it to take a safety position inside the box body; such safety position is a position determining the implementation of safety measures for the movable mass M, pulled in a controlled way (consequently substantially without risks) by the rod 9 during its retraction stroke. The retraction of the rod is ensured by the redundancy levels of the first and second operative sections beforehand described with reference to the control device 1 and to possible embodiments thereof, which correspond to possible embodiments of the method.
In the first and second embodiments of the method, the step of implementing a safety function by the control device can provide to prevent fluid from flowing through the actuator drive member.
With reference to the third and fourth embodiments of the method, the step of implementing a safety function by the control device can provide to enable the passage of fluid flow, particularly the passage of "crossed" fluid as hereinbefore described through the actuator drive member when the actuator drive member is in the fail-safe condition.
The method can provide, at the end of the performance of the safety function, to detect and signal the cause of the triggering condition, such as an anomaly or malfunction.
The technical features herein disclosed with reference to the steps of the method, can be applied in the field of corresponding beforehand described functions or uses of the control device 1 and therefore can be used for specifying such functions or uses of the device in the attached claims.
The following describes some of the many advantages the invention provides. First of all, the invention provides a control device 1, which is modular and compact, in other words having limited dimensions. The modularity of the control device 1 is due to the fact that it comprises a plurality of subgroups (modules) which can be reconfigured and assembled in different ways in order to obtain a more efficient size for the integration with the machine; each mode of assembly determines an embodiment such as the ones beforehand illustrated. The subgroups which can be assembled in different ways can consist of the valves VA01-VA08, VA05L, VA05R, VA06L, VA06R and respective connectors (see the blocks connected to said valves and illustrated in Figures from 1 to 6) and of the actuator drive member VA09, VA09L, VA09R and relevant respective (see the blocks connected to the actuator drive member VA09 and illustrated in the Figures from 1 to 6).
The invention enables to use different types of servovalves VA09, VA09L, VA09R to drive the hydraulic actuator during the normal operation of the machine without jeopardizing the safety function; the type of servovalve VA09, VA09L, VA09R can therefore be selected only as a function of the type of control to be performed. Moreover, the invention further enables to use oil having a high filtration grade (less filtered oil), densities comprised between 10 and 800 cst (kinematic viscosity) and temperatures comprised between -20°C and +70°C without jeopardizing the safety function. Moreover, the invention enables to reduce the operative cost of the machine and to operate with pressures to 350 bar.
The configurations of the described hydraulic circuits show a reduced probability of having simultaneous fails (common cause fail, CCF) because the control device 1 is not sensible to the environmental conditions, because the quality of the hydraulic oil for implementing the safety function is irrelevant and because the electric connections of the electrovalves VA01-VA08, VA05L, VA05R, VA06L, VA06R are insensible to the electromagnetic noises.
Lastly, the invention provides a technical solution of remarkable efficiency and reliability. Indeed, the control device 1 has the following probabilities of failing:

dangerous fails for each operative hour (Probability of dangerous Fail per Hour, PFHd) from 10^-8 to 10^-7,
prediction of a dangerous fail in a time range from 1000 to 10000 years.

Claims

Control device (1) configured to be connected to a hydraulic circuit, the hydraulic circuit being provided with or associated to at least one actuator (7, 7L, 7R) having a box body (8) such as a cylinder and a rod (9) movable with respect to the box body (8), the actuator (7, 7L, 7R) being configured to move a movable mass (M), the control device (1) comprising:
- a supply/discharge section (2) comprising:
∘ a pressurized fluid supply port (P') configured to be connected to a pressurized fluid source (P) and configured, in a condition of connection to the pressurized fluid source, to supply the pressurized fluid to the control device (1),

∘ a fluid discharge port (T') configured to discharge the fluid from the control device (1),

- at least one connection section (3) configured to be connected to the actuator (7, 7L, 7R) and comprising:
∘ a first port (B1', B1L', B1R') configured, at least in one condition of connection to the actuator (7, 7L, 7R), to supply the pressurized fluid to the actuator (7, 7L, 7R),

∘ a second port (A1', A1L', A1R') configured, at least in one condition of connection to the actuator (7, 7L, 7R), to discharge the fluid from the actuator (7, 7L, 7R),

- a pressurized fluid supply line connecting the pressurized fluid supply port (P') and the first port (B1', B1L', B1R') and configured, at least in one condition of connection to the actuator (7, 7L, 7R), to enable supply fluid to flow from the pressurized fluid supply port (P') to the actuator (7, 7L, 7R),

- a fluid discharge line connecting the second port (A1', A1L', A1R') and the fluid discharge port (T') and configured, at least in one condition of connection to the actuator (7, 7L, 7R), to enable discharge fluid to flow from the actuator (7, 7L, 7R) to the discharge port (T'),

- a control section comprising an actuator drive member (VA09, VA09L, VA09R) configured to drive and/or manage one or more operative conditions of the actuator (7, 7L, 7R), the control section being configured both to control the actuator (7, 7L, 7R) in one or more operative conditions by said actuator drive member (VA09, VA09L, VA09R) and to implement, in an anomaly and/or emergency condition, a safety function acting on the actuator (7, 7L, 7R), which causes the rod (9) of the actuator (7, 7L, 7R) to retract inside the box body (8), the anomaly and/or emergency condition being a condition triggering the safety function,

wherein the control section features a first operative section (5) and a second operative section (6, 6L, 6R) each of which comprises a portion of the fluid supply line and a portion of the fluid discharge line, the first and second operative sections (5, 6) being configured to implement, upon occurring the triggering condition, said safety function,

the first and second operative sections (5, 6) being provided with at least one respective redundancy level and being configured, upon occurring the triggering condition, to ensure the retraction of the rod (9) by the respective redundancy levels.
Control device according to claim 1, wherein:
- the first operative section (5) is defined at least between the supply/discharge section (2) and the actuator drive member (VA09, VA09L, VA09R) and is configured, upon occurring the triggering condition, to enable fluid to flow from the fluid supply port (P') to the first port (B1', B1L', B1R') and to enable fluid to flow from the fluid supply port (P') to the first port (B1', B1L', B1R') and to enable fluid to flow from the second port (A1', A1L', A1R') to the fluid discharge port (T'),

- the second operative section is defined at least between the actuator drive member (VA09, VA09L, VA09R) and the connection section (3) and is configured, upon occurring the triggering condition, at least to prevent fluid to flow from the fluid supply port (P') to the second port (A1', A1L', A1R').
Control device according to claim 1 or 2, wherein:
- said at least one redundancy level of the first operative section (5) is defined on the pressurized fluid supply line and is configured to ensure, upon occurring the triggering condition, fluid to flow from the fluid supply port (P') to the first port (B1', B1L', B1R'),

- said at least one redundancy level of the second operative section (6, 6L, 6R) is arranged on the pressurized fluid supply line and is configured to ensure, upon occurring the triggering condition, to prevent fluid to flow from the fluid supply port (P') to the second port (A1', A1L', A1R').
Control device according to claim 1 or 2 or 3, wherein:
- the first operative section (5) further comprises a further redundancy level defined on the discharge line,

- the second operative section (6, 6L, 6R) comprises a further redundancy level defined on the discharge line.
Control device according to any of claims from 1 to 4, wherein the actuator drive member (VA09, VA09L, VA09R) is configured to operate at least between:
- a condition in which it enables the passage of pressurized fluid from the pressurized fluid supply port (P') to the first port, (B1', B1L', B1R') so that the pressurized fluid enters a first chamber (11) defined inside the box body (8) of the actuator, (7, 7L, 7R) and the passage of fluid from the second port (A1', A1L', A1R') to the fluid discharge port (T'), so that the fluid to be discharged flows from a second chamber (12) defined inside the box body (8) of the actuator (7, 7L, 7R) to the fluid discharge port (T'),

- a condition in which it enables both the passage of pressurized fluid from the pressurized fluid supply port (P') to the second port (A1', A1L', A1R'), so that the pressurized fluid enters the second chamber (12), and the fluid passage from the first port (B1', B1L', B1R') to the fluid discharge port (T'), so that such fluid to be discharged flows from the first chamber (11) to the fluid discharge port (T').
Control device according to claim 4 or claim 5 when depending on claim 4, wherein the redundancy level and the further redundancy level of the first operative section (5) comprise a respective pair of redundant valves (VA01-VA04).
Control device according to anyone of the preceding claims, wherein each redundancy level comprises a pair of redundant valves (VA01-VA04), in the safety function each valve (VA01-VA08) of each pair of redundant valves of the first operative section (5) being configured to enable fluid to flow through it and each valve (VA05-VA08) of each pair of redundant valves of the second operative section (6) being configured to prevent fluid from flowing through it in one direction,
optionally wherein the redundant valves are controllable by a control unit of a system or machine which the control device (1) is connected or connectable to.
Control device according to anyone of claims from 1 to 6, wherein the actuator drive member (VA09, VA09L, VA09R) is functionally part of at least one of the first and second operative sections, the actuator drive member (VA09, VA09L, VA09R) contributing to ensure the redundancy of at least one redundancy level of the first and/or second operative sections (5, 6).
Control device according to anyone of claims from 1 to 5 or according to claim 7, wherein the actuator drive member (VA09, VA09L, VA09R) is configured to switch to a fail-safe condition, the fail-safe condition contributing to the redundancy of said at least one redundancy level.
Control device according to anyone of claims from 1 to 5 or according to claim 8 or 9, wherein the actuator drive member (VA09, VA09L, VA09R) is functionally part both of the first operative section (5) and of the second operative section (6, 6L, 6R) and contributes to ensure each redundancy level of the first operative section (5) and each redundancy level of the second operative section (6, 6L, 6R).
Control device according to any of the preceding claims, wherein:
- each redundancy level comprises a valve (VA01, VA02, VA05, VA06, VA05L, VA05R, VA06L, VA06R) configured to prevent the passage of fluid in an anomaly and/or emergency conditions and the actuator drive command (VA09, VA09L, VA09R) configured to take a fail-safe condition, and/or

- each redundancy level provides, in anomaly and/or emergency condition, that the valve (VA01, VA02, VA05, VA06, VA05L, VA05R, VA06L, VA06R) prevents the passage of fluid and/or that the actuator drive member (VA09, VA09L, VA09R) takes the fail-safe conditions, in which it prevents the passage of fluid.
Hydraulic system (100) comprising:
- a hydraulic circuit associated to a pressurized fluid source (P) and to a fluid discharge (T),

- at least one actuator (7, 7L, 7R) associated to the hydraulic circuit and comprising a box body (8) such as a cylinder and a rod (9) movable with respect to the box body (8), the actuator (7, 7L, 7R) being configured to move a movable mass (M),

- a control device (1) according to anyone of the preceding claims, the control device being connected to the actuator (7, 7L, 7R) at the connection section (3) and to the hydraulic circuit at the supply/discharge section (2),
the system (100) being configured to detect a triggering condition and to implement a safety function by the control device (1) following detecting said triggering condition, the triggering condition being an anomaly and/or emergency condition for example due to or related to the hydraulic circuit or actuator (7, 7L, 7R) or control device (1) itself.
Hydraulic system according to claim 12, further comprising a control unit configured to detect the triggering condition,
the control unit being configured to:
- detect the triggering condition,

- trigger the safety function by the control device (1),

optionally wherein the control unit is configured to communicate the detected triggering condition to the control device (1) so that the control device (1) triggers the safety function.
Hydraulic system according to claim 12 or 13, comprising a machine configured to be actuated, at least partially hydraulically, such as a calender or press, the machine comprising at least said actuator (7, 7L, 7R).
Method of controlling at least one hydraulic actuator (7, 7L, 7R), the actuator being arranged in or associated to a hydraulic circuit and having a box body (8) such as a cylinder and a rod (9) movable with respect to the box body (8), the box body (8) being provided with a first chamber (11) and a second chamber (12), the actuator (7, 7L, 7R) being configured to move a movable mass (M), the method comprising the steps of:
- providing a control device (1) according to anyone of claims from 1 to 11,

- connecting the control device (1) to the actuator by the connection section (3),

- detecting a triggering condition, the triggering condition being an anomaly and/or emergency condition for example due to or related to the hydraulic circuit or actuator (7, 7L, 7R) or control device (1) itself,

- following detecting the triggering condition, implementing a safety function by the control device (1),
the step of implementing a safety function by the control device (1) comprising:

- supplying pressurized fluid to the first chamber (11) of the actuator (7, 7L, 7R), said step comprising causing the pressurized fluid to flow in the pressurized fluid supply line through the first operative section (5) and, downstream the first operative section (5), through said first port (B1', B1L', B1R'),

- discharging pressurized fluid from the second actuator chamber (7, 7L, 7R), said step comprising making fluid to flow in the discharge line at least through the first operative section (5) and, upstream the first operative section (5), through said second port (A1', A1L', A1R'),

- retracting the rod (9) inside the box body (8),

- ensuring the rod retraction (9) by said redundancy levels of the first and second operative sections (5, 6),
optionally wherein the step of implementing a safety function by the control device (1) comprises preventing fluid from flowing through the actuator drive member (VA09).