CONTROL DEVICE FOR A HYDRAULIC CIRCUIT

Description

Technical field of the invention

[0001] The present invention refers to a control device for a hydraulic circuit. Moreover, the invention refers to a hydraulic system comprising said control device and an actuator which the control device acts on.

[0002] The present invention refers also to a method of controlling at least one hydraulic actuator.

Prior art

[0003] Machines provided with hydraulic actuators and control systems configured to control such hydraulic actuators are known. One of the aspects to be considered when designing such machines is in relation to the safety, particularly to the safety of an operator; usually, the machine control system is responsible for managing abnormal conditions which could cause safety risks.

[0004] The safety of the machines is the subject, from a regulatory point of view, of standards aimed to establish some requirements necessary to reduce the safety risks, among which there is the EN ISO 13849. EN ISO 13849 is a harmonized type-B European standard which defines the parts of a control system of a machine which are required to implement the safety functions as parts of the control system regarding the safety and is devised to meet the safety base requirements defined by the European community directives. The standard is acknowledged, not only by the European community, but also by the regulatory systems of North America, Canada, Brazil, and Russia.

[0005] Substantially, the safety circuits according to the standard EN ISO 13849 are accepted as technical solutions for reducing the safety risks.

[0006] Some among the main safety risks can happen when there are anomalies or fails in the machine during its use; in this case, there could occur uncontrolled movements of the actuators which can cause a risk condition in proximity of the machine. For example, a falling actuator could cause an injury to an operator (risk of crushing, collisions, abrasions, etcetera).

[0007] The invention must be considered in the background herein described; the objects thereof being indicated in the following.

[0008] Additional prior art documents are the following.

[0009] US2015152898A1 relates to a device for emergency operation of pneumatic or hydraulic actuators. For normal operation of the actuator, an operation cycle includes at least a proportional valve for switching to different operational conditions of the actuator and related engine components. An emergency cycle is attached to the operation cycle of the actuator.

[0010] EP3447315A1 relates to a system for controlling propeller pitch in the event of electro-hydraulic servo valve (EHSV) failure that can include an actuator and a selection valve in fluid communication with the actuator. The selection valve can be configured to selectively allow fluid communication between one EHSV and the actuator.

[0011] US2008087014A1 relates to a hydraulic circuit for a steer-by-wire steering system which includes a hydraulic pump, a reservoir, a bi-directional steering actuator, a pair of electronic control units (ECU) for generating electrical steering control signals in response to an operator-generated steering command.

Objects of the invention

[0012] Therefore, a main object of the present invention consists of providing a control device, a system and a method capable of overcoming the inconveniences beforehand described with reference to the prior art.

[0013] Consequently, an object of the present invention consists of minimizing or even eliminating the safety risks for an operator working in proximity of a machine or system operatively connected to the control device.

[0014] Particularly, an object of the present invention consists of determining and ensuring a safety function which involves the actuator at the occurrence of an anomaly and/or emergency conditions, by reducing or eliminating in this way the safety risk.

[0015] An additional object of the invention consists of providing a control device, a system and method according to the standard EN ISO 13849, and particularly to the standard EN ISO 13849-1 category 3 and according to a type "e" maximum reachable Performance Level (PL e); this means that in case of a single failing component, the safety function is anyway performed and ensured.

[0016] A further object of the invention consists of ensuring the safety function also in case of an electric supply outage or fail thereof.

[0017] An additional object of the present invention consists of disclosing a compact control device, in other words having a limited size, and being modular.

[0018] Moreover, the invention advances a technical solution being substantially effective and reliable (PL e).

[0019] These and other objects are met by a control device, a system and a method according to the following description, attached claims and following aspects.

Summary of the invention

[0020] The present invention is described by the control device of appended claim 1, the hydraulic system of appended claim 12 and the method of appended claim 15, of controlling at least one hydraulic actuator. Other preferred embodiments of the present description are set forth in the appended dependant claims.

[0021] The technical solution of the present invention, determining the substantially complete retraction of the rod into the box body in case of fail or malfunction or of an electric supply outage, enables to reduce the risks which the operator is subjected to, particularly with reference to the risk for the operator consisting in an uncontrolled movement of the hydraulic actuator which could crush the operator.

[0022] The redundancy levels enable to ensure a substantially complete retraction of the rod into the box body in case of fail or malfunction or of an electric supply outage and therefore contribute to reduce the risk which the operator is subjected to.

Conventions and definitions

[0023] It is observed that in the following detailed description corresponding parts are indicated by the same numeral references. The figures could illustrate the object of the invention by not-to-scale representations; therefore, parts and components illustrated in the attached figures and regarding the object of the invention could only refer to schematic representations. In the context of the present invention the use of terms such as "on", "upper", "at the top", "under", "lower", "at the bottom", "sideways", "lateral", "laterally", "internal", "internally", "external", "externally", "horizontal", "horizontally", "vertical", "vertically", "front", "frontally", "rear", "rearward", "right", "left", similar terms and corresponding variants, save for specific different indications, refers to at least one spatial orientation which the object of the invention can take in condition of use. Save for different specific indications, the terms "condition" or "configuration" can be interchangeably used in the context of the present invention.

[0024] The configurations and connections which are described in the following refer, unless otherwise noted, to an anomaly and/or emergency condition which the control device and method according to the invention are configured to manage.

[0025] In the context of the present invention, one or more of the following definitions and conventions can be applied, when required and unless otherwise noted:

• the term "control device" means any device configured to manage both one or more conditions of normal operation of an actuator and/or a machine which is connectable or connected to, and one or more extraordinary conditions of said actuator and/or said machine, such as one or more anomaly and/or emergency conditions,
• "upstream", "downstream" and similar expressions or derivatives, refer to the arrangement of elements with respect to the fluid advancement direction along a determined line or branch of the circuit in which said elements are located; in different operative or anomaly conditions, the fluid advancement direction can vary along the same line or branch of the circuit,
• the term "level of redundancy" means a redundancy feature of the device or system or method; when required, the expression "redundancy level" can be substituted with "redundancy feature". The term "redundancy level" identifies a portion of the respective operative section which provides two redundant elements, such as redundant valves, each of them is capable of ensuring, in case of fail to the other redundant element, to perform the function, which is responsible for,
• the term "redundant valves" means valves apt to perform the same function, each of them is apt to act as a back-up of the other if one of the valves should not operate. Preferably, redundant valves are placed reciprocally adjacent, serially or parallel (see the respective circuit), and operatively cooperating to ensure the function which are responsible for,
• the term "pair of redundant valves" means two redundant valves which have in common the same function, and which are according to the previous definition of "redundant valves",
• "with redundancy" and "redundant" can be interchangeably used in the present invention unless otherwise noted,
• the term "fluid" means a working fluid or hydraulic fluid, such as oil configured to circulate in a hydraulic circuit and to operate hydraulic machines,
• the term "hydraulic", and variants thereof or derivative terms, is meant implying or regarding the use of a working fluid at the liquid state such as, preferably, oil,
• the term "machine" preferably means a hydraulic machine, in other words a machine configured to be actuated, at least partially hydraulically, such as a calender or a press,
• the terms "upstream" and "downstream" and similar or derivative expressions, refer to the arrangement of elements with respect to the fluid advancement direction along determined line or branch of the circuit in which said elements are located,
• the term "triggering condition" means the condition triggering the safety function,
• the term "anomaly and/or emergency condition" means an anomaly condition (such as a fail, a malfunction, or a unavailable or insufficient electric supply and similar not ordinary conditions) and/or emergency conditions (such as a condition which implies or could imply a risk for an operator) tied to the operation or failed correct operation of the hydraulic circuit which the control device is connected to or of the control device itself or to a unavailable or insufficient electric supply. Such condition can be in relation with a component of the control device or a component of the hydraulic circuit or with the actuator or the electric supply of one or more of said components or of the actuator,
• the term "hydraulic system" means a system provided with at least one hydraulic circuit and with at least one hydraulic device or apparatus, such as a hydraulic actuator or a hydraulic machine,
• the term "safety function" means a function enabling to reduce a risk, for example the risk of crushing an operator, associated to the movable mass which an actuator is connected to,
• the term "safety condition" or "safety position" means a condition or position of the element which said expression refers to (the actuator or its rod, for example) which is associated to a less hazardous condition, for example for an operator, the risk in the safety condition or position being less than the condition or position of such element, or of a movable mass which is connected to, before implementing the safety function,
• the term "fail-safe" condition or position means a safety condition or position (fail-safe condition or position),
• the symbols of the circuits in the figures correspond to the acknowledged conventions established in the technical field of reference, and show, unless otherwise noted, the relative technical meaning; therefore, such symbols are considered as disclosing the respective function/s obtainable from the figures, also when this is not explicitly described; for example, the symbol of the non-return valve discloses that the flow is enabled only in a direction as illustrated in the circuit.

Brief description of the drawings

[0026] In order to have a better comprehension and to appreciate the advantages of the invention, some embodiments thereof will be illustratively described in a non a limiting way with reference to the attached drawings:

Figs 1 and 2 illustrate views of a control device according to a first embodiment of the invention,

Figures 3 and 4 illustrate views of a control device according to a second embodiment of the invention,

Figures 5 and 6 illustrate views of a control device according to a third embodiment of the invention,

Figure 7 illustrates the circuit configuration of the control device of Figures 1 and 2,

Figure 8 illustrates the circuit configuration of the control device of Figures 3 and 4,

Figure 9 illustrates the circuit configuration of the control device of Figures 5 and 6,

Figure 10 illustrates the circuit configuration of a control device according to a fourth embodiment of the invention.

Detailed descriptions of embodiments of the invention

Device

[0027] A control device according to the invention is generally indicated in the figures by the numeral reference 1. The control device 1 is configured to be connected to a hydraulic circuit associated to at least one actuator 7, 7L, 7R. In order to better comprehend the configurations and the functionalities of the control device 1, it is briefly described in the following the actuator 7, 7L, 7R; the numeral references of the actuator 7, 7L, 7R are mainly indicated in Figure 7 and can be clearly applied also to the actuator 7, 7L, 7R in Figures 8, 9, and 10. The actuator 7, 7L, 7R has a box body 8 such as a cylinder and a rod 9 movable with respect to the box body 8. The rod 9 has two ends; a first end located inside the box body 8 which is engaged with a piston 10 and a second end located outside of the box body, which is engaged with a mass M. The mass M (external load which has the tendency of moving the rod 9 out of the box body 8) is movable outside of the box body 8, while the piston 10 is movable inside the box body 8. The box body 8 has an internal volume in which a first chamber 11 and a second chamber 12 are operatively distinguishable; the chambers 11, 12 have a respective volume variable as a function of the instantaneous position of the piston 10. The piston 10 has a thrust surface facing the first chamber 11 and a thrust surface facing the second chamber 12; the thrust surface of the piston facing the first chamber 11 is smaller than the thrust surface of the piston facing the second chamber 12. The box body 8 has a door B1 leading to the first chamber 11 and a door A1 leading to the second chamber 12; the doors B1, A1 enable fluid to flow to/from the respective chamber 11, 12, as a function of the operative configuration of the actuator 7, 7L, 7R. The actuator 7, 7L, 7R, by axially translating the rod 9, is configured to move the movable mass M, of which an uncontrolled movement can possibly cause a risk condition; such condition could, for example, occur in fail or anomaly conditions of the control device or of the actuator or of the machine itself. The actuator 7, 7L, 7R is subjected to a tensile stress state due to the mass M which is connected to; such condition is schematically illustrated in Figures from 7 to 10 by the arrow drawn below the mass M and directed downwardly. Preferably, the actuator 7, 7L, 7R is of a hydraulic type and can be part of a hydraulic machine, such as a calender or a press. Preferably, the actuator 7, 7L, 7R is of the double-acting type; this means the piston 10 can be operated in both the directions (the rod 9 in a direction exiting or in a direction entering the box body 8) along its axis. Indeed, by providing two ports A1, B2, the actuator 7, 7L, 7R, based on which port A1, B1 is supplied with pressurized fluid, can determine the exit or retraction of the rod 9 in the box body 8.

[0028] The control device 1 comprises a supply/discharge section 2 which enables the connection to a pressurized fluid source P and to a discharge T, such as a discharge tank. The supply/discharge section is provided with a pressurized fluid supply port P' and a fluid discharge port T'. The pressurized fluid supply port P' is configured to be connected to the pressurized fluid source P' and, in a condition of connection to the pressurized fluid source P, to supply the control device 1 with pressurized fluid. The fluid discharge port T' is configured to discharge fluid from the control device 1 and, in condition of connection to the discharge T, to discharge fluid from the control device 1 to the discharge T. Preferably, the fluid is hydraulic oil.

[0029] Moreover, the control device 1 comprises at least one connection section 3 which enables the connection to the actuator 7, 7L, 7R. The connection section 3 comprises a first port B1', B1L', B1R' configured, at least in a condition of connection to the actuator (such as at least in an anomaly and/or in an emergency condition) to supply the actuator with pressurized fluid and a second port A1', A1 L', A1R' configured, at least in a condition of connection to the actuator (such at least one anomaly and/or emergency condition), to discharge fluid from the actuator. The first port B1', B1L', B1R' is connected to the port B1 leading to the first chamber 11 of the actuator and the second port A1', A1L', A1R' is connected to the port A1 leading to the second chamber 12 of the actuator; the first and second chambers 11, 12 of the actuator are opposite with respect to a piston 10 connected to the rod 9.

[0030] As illustrated in the figures from 1 to 6 with reference to the ports A1', B1', P', T' of the control device 1 according to three possible embodiments, the ports A1', A1L', A1R', B1', B1L', B1R', P', T' can be defined on the box body 4 of the control device 1. The box body 4 can comprise and contain at least partially circuit configurations of the control device 1. The control device 1 can comprise two connection sections 3, and consequently two first ports B1', B1L', B1R' and two second ports A1', A1L', A1R', and two supply/discharge sections 2, and therefore two pressurized fluid supply ports P' and two discharge ports T'; in further embodiments, the control device 1 could provide a number of connection sections 3 greater than two and, in addition or as an alternative, a number of supply/discharge sections 2 greater than two. As it is visible in Figures from 1 to 6 by illustrating the ports P', T', A1', B1', a connection section 3 and a supply/discharge section 2 can be defined on a face of a box body 4 of the control device 1, while the other connection section 3 and the other supply/discharge section 2 can be defined on a face of the box body 4 opposite to said face. Providing two or more connection sections and a corresponding number of ports enables to connect the control device 1 to the actuator at different portions of the box body 4 of the control device 1. Analogously, providing two or more supply/discharge sections 2 and a corresponding number of ports enables to connect the control device 1 to the pressurized fluid source P and to the discharge T at different portions of the box body 4 of the control device 1.

[0031] Moreover, the control device 1 comprises fluid lines developing between the supply/discharge section 2 and each connection section 3. The fluid lines can be at least partially or completely defined inside the box body 4. More particularly, the control device 1 comprises a pressurized fluid supply line and a fluid discharge line. The pressurized fluid supply lines develop between, and connects, the pressurized fluid supply port P' and the first port B1', B1L', B1R' and is configured, at least in a condition of connection to the actuator 7, 7L, 7R, to enable supply fluid to flow from the pressurized fluid supply port P' to the actuator 7, 7L, 7R. The fluid discharge line develops between, and connects the second port, A1', A1L', A1R' and the fluid discharge port T' and is configured, at least in a condition of connection to the actuator 7, 7L, 7R, to enable discharge fluid to flow from the actuator 7, 7L, 7R to the discharge port T'.

[0032] Moreover, the control device 1 comprises a control section configured both to control the actuator 7, 7L, 7R in one or more normal operative conditions ("steady" operative conditions) and to implement, in an extraordinary condition such as an anomaly and/or emergency conditions, a safety function operating on the actuator 7, 7L, 7R. More particularly, the safety function starts operating at the occurrence of a triggering condition, which indeed consists of the anomaly and/or emergency conditions and determines the complete retraction of the rod 9 of the actuator 7, 7L, 7R inside the box body 8.

[0033] The control section comprises an actuator drive member VA09, VA09L, VA09R configured to drive and/or manage one or more operative conditions of the actuator, and particularly in at least the normal operative conditions. As illustrated in the attached figures, the actuator drive member VA09, VA09L, VA09R is configured to operate according to a plurality of operative configurations. In the normal operative conditions, the fluid flows into the actuator drive member VA09, VA09L, VA09R, which drives the normal operation of the actuator 7, 7L, 7R. In the normal operative conditions, the actuator drive member VA09, VA09L, VA09R can therefore drive the retraction of the rod 9 into, or the exit of the rod 9 from the box body 8 because it is configured to operate at least between a condition in which it determines the retraction of the rod 9 into the box body 8 (retraction condition of the rod) and a condition in which it determines the exit of the rod 9 from the box body 8 (exit condition of the rod). In the retraction condition of the rod 9, the actuator drive member VA09, VA09L, VA09R enables both the passage of pressurized fluid from the pressurized fluid supply port P' to the first port B1', B1L', B1R' and the passage of fluid from the second port A1', A1L', A1R' to the fluid discharge port T', so that the pressurized fluid flows into the first chamber 11 and the fluid to be discharges flows out the second chamber 12 and flows from the second port A1', A1L', A1R' to the fluid discharge port T' in order to precisely determine the retraction of the rod 9 into the box body 8. In the condition of egress of the rod 9, the actuator drive member VA09, VA09L, VA09R enables both the passage of pressurized fluid from the pressurized fluid supply port P' to the second port A1', A1L', A1R' and the passage of fluid from the first port B1', B1L', B1R' to the fluid discharge port T', so that the pressurized fluid flows into the second chamber 12 and the fluid to be discharged flows from the first chamber 11 to the fluid discharge port T' in order to precisely determine the retraction of the rod 9 into the box body 8. The actuator drive member VA09, VA09L, VA09R is preferably a valve, particularly a servovalve.

[0034] Moreover, the control section comprises a first operative section 5 and second operative section 6, which enable to implement the safety function at the occurrence of the triggering condition. Both the first and second operative sections comprise a portion of the pressurized fluid supply line and a portion of the fluid discharge line.

[0035] The first operative section 5 is defined between the connection section 3 and the supply/discharge section 2. The first operative section 5 is fluidically connected to the supply/discharge section 2. More particularly, the first operative section 5 is defined at least between the supply/discharge section 2 and the actuator drive member VA09, VA09L, VA09R; such arrangement is defined with reference to the normal operative conditions in which the first operative section 5 and the actuator drive member VA09, VA09L, VA09R are in series to each other. With reference to the four embodiments which will be described in the following, the series arrangement of the first operative section 5 with the actuator drive member VA09 occurs in the normal operative condition, while the first operative section 5 is parallel to the actuator drive member VA09, VA09L, VA09R during the anomaly and/or emergency conditions. Substantially, at the occurrence of the triggering condition, the fluid flow in the circuit changes at least partially its path between the connection section 3 and the supply/discharge section 2 in order to switch the first operative section 5 from the series arrangement to the parallel arrangement with respect to the actuator drive member VA09, VA09L, VA09R. The first operative section 5 is configured, at the occurrence of the triggering condition, to enable fluid to flow from the fluid supply port P to the first port B1', B1L', B1R' and to enable fluid to flow from the second port A1', A1L', A1R' to the fluid discharge port T'. Optionally, the first operative section 5 can comprise the actuator drive member VA09, VA09L, VA09R (for example, in the second, third and fourth embodiments, in which the actuator drive member is functionally part of at least one between the first and second operative sections 5, 6 due to its safety position), which can therefore be functionally part of the first operative section 5.

[0036] The second operative section 6 is defined between the supply/discharge section 2 and the connection section 3. The second operative section 6 is defined at least between the actuator drive member VA09, VA09L, VA09R and the connection section 3; such arrangement is defined with reference to the normal operative condition in which the actuator drive member VA09, VA09L, VA09R and the second operative section 6 are in series to each other. With reference to the four embodiments which are described in the following, the series arrangement between the actuator drive member VA09, VA09L, VA09R and the second operative section 6 occurs in the normal operative condition, while the second operative section 6 is parallel to the actuator drive member VA09, VA09L, VA09R during the anomaly and/or emergency condition. Substantially, at the occurrence of the triggering condition, the fluid flow in the circuit changes at least partially its path between the connection section 3 and the supply/discharge section 2 in order to switch the second operative section 6 from the series arrangement to the parallel arrangement with respect to the actuator drive member VA09, VA09L, VA09R. The second operative section 6 is configured, at the occurrence of the triggering condition, at least to prevent fluid from flowing from the pressurized fluid supply port P', to the second port A1', A1L', A1R'. Optionally, the second operative section 6 can comprise the actuator drive member VA09, VA09L, VA09R (for example in the second, third and fourth embodiments, in which the actuator drive member is functionally part of at least one between the first and second operative sections 5, 6 due to its safety position) which thus can be functionally part of the second operative section 6.

[0037] According to the invention, the first and second operative sections 5, 6 are provided with at least one respective redundancy level and are configured, at the occurrence of the triggering condition, to ensure said retraction of the rod 9 by the respective redundancy levels. As it will be more particularly described in the following, each redundancy level provides at least two redundant elements which cooperate so that the function for which they are devised is performed also in case of a fail of one of said elements. The assurance of the retraction of the rod 9 is just given by the presence, at each provided redundancy level, of at least two redundant elements; consequently, if one of the redundant elements does not act the other redundant element or one of the other redundant elements of the same redundancy level acts.

[0038] The redundancy level of the first operative section 5 is defined on the pressurized fluid supply line and ensures, at the occurrence of the triggering condition, the flow of fluid from the fluid supply port P to the first port B1', B1L', B1R'. The redundancy level of the second operative section 6 is provided on the pressurized fluid supply line and ensures, at the occurrence of the triggering condition, to prevent fluid from flowing, from the pressurized fluid supply port P', to the second port A1', A1L', A1 R'. By making the pressurized fluid to flow to the first port B1', B1L', B1R' and not to the second port A1', A1 L', A1R', the control section enables and ensures the complete retraction of the rod 9 into the box body 8.

[0039] The control device 1 is interchangeable with the existent solutions which are not capable of performing a safety function according to the standard EN ISO 13849-1, in order to make them adapted to perform the safety function and consequently to make them compliant to said standard. Therefore, the control device 1 can be configured to enable to retrofit an existing machine or system 100 in order to ensure the compliance of the system or of the machine to the standard EN ISO 13849-1.

[0040] As it will be more specifically described in the following with reference to different embodiments of the control device 1, at least one between the first and second operative sections 5, 6 can comprise a further redundancy level. Preferably, both the first and second operative sections 5, 6 comprise respective further redundancy levels. Particularly, the further redundancy level of the first operative section 5 is defined on the discharge line and the further redundancy level of the second operative section 6 is also defined on the discharge line.

[0041] Moreover, the control section comprises a plurality of valves VA01-VA08, VA05L, VA05R, VA06L, VA06R, which contribute to one or more redundancy levels as hereinbelow described. The valves VA01-VA08, VA05L, VA05R, VA06L, VA06R can operate between an energized configuration (supplied condition) and a deenergized configuration; preferably, they are solenoid valves. The valves VA01-VA08, VA05L, VA05R, VA06L, VA06R preferably have an elastic element, such as a spring, which support the valve in the rest configuration in case of a current leak or cut of a supply wire. The valves VA01-VA08, VA05L, VA05R, VA06L, VA06R can be monitorable by a control unit, such as a programmable logic controller (PLC), of the hydraulic machine comprising at least one actuator which the control device 1 operates on. Among the types of valves VA01-VA08, VA05L, VA05R, VA06L, VA06R which can be used, it is mentioned in an exemplifying and non-limiting way the seat valves and the slide valves. The seat valves are substantially perfect tight valves; this type of valves does not have any fluid leakage and enables an optimal control of the hydraulic actuator.

[0042] Preferably, the control device 1 comprises two redundancy levels for each operative section. The following will more particularly describe a first, a second, a third, and a fourth embodiments of the invention, respectively illustrated in the Figures 7, 8, 9, and 10. Such circuit configurations illustrate the control device 1 during the implementation of the safety function.

[0043] The pressurized fluid source P, the discharge T and the ports A1, A1L, A1R, B1, B1L, B1R of the actuator 7 are illustrated in the attached figures from 7 to 10 outside of the abovementioned broken line which encircle the corresponding circuit configuration of the control device 1; possible references P, T, A, B present inside of before mentioned broken line (in proximity of the actuator drive member VA09, VA09L, VA09R, for example) refer to the corresponding fluid line and illustrate a possible continuity or interruption of fluid (for example according to the arrows and symbols of the actuator drive member VA09, VA09L, VA09R which illustrate possible operative configuration) between the pressurized fluid source P or discharge T and/or a port A1, B1.

First embodiment

[0044] In the first embodiment of the control device 1, the configuration thereof is schematically illustrated in Figure 7, the first operative section 5 comprises a redundancy level and a further redundancy level; analogously, the second operative section 6 comprises a redundancy level and a further redundancy level.

[0045] Each redundancy level comprises a pair of valves VA01-VA08. With reference to the first operative section 5, the redundancy level located on the pressurized fluid supply line comprises the pair or redundant valves VA02, VA04, the further redundancy level located on the discharge line comprises the pair of redundant valves VA01, VA03. Referring now to the second operative section 6, the redundancy level thereof is defined on the pressurized fluid supply line and comprises the valves VA05, VA07 and its further redundancy level is defined in the fluid discharge line and comprises the valves VA06, VA08. For each pair of redundant valves, if there is a fail of or no supply to a valve, the function is ensured by the other redundant valve of the same pair of redundant valves.

[0046] The circuit configuration of the first embodiment, illustrating an anomaly and/or emergency conditions, can be summarized in this way: the control device 1 is supplied with pressurized hydraulic oil by the pressurized fluid source P through the port P'. The oil flow rate is adjusted by the one-way flow valve RG01. Independently from the position of the valve VA09 (Figure 7 shows the position in which it prevents the oil from flowing), the pressurized oil enters the first chamber 11 of the hydraulic actuator 7 through the port B1 determining the retraction of the rod 9. The retraction of the rod 9 into the box body 8 is ensured because the oil flowing out of the port A1 can be discharged from the fluid discharge line through the redundant valves VA01, VA03. The valves VA05, VA06, VA07, VA08 isolate the actuator drive member VA09; this is advantageous because this latter can fail and locks in any non-safe position. In performing the safety function, the retraction of the rod 9 into the box body 8 is therefore ensured by:

• the redundancy of the valves VA02 and VA04,
• the redundancy of the valves VA01 and VA03,
• the redundancy of the valves VA05 and VA07,
• the redundancy of the valves VA08 and VA07.

[0047] The first embodiment enables to implement the safety function by using eight solenoid valves VA01-VA08 (monitored by the control unit of the hydraulic machine comprising the actuator 7 which the control device 1 operates on) and a proportional solenoid valve VA09, particularly and as more specifically described in the following, a non-safety proportional solenoid valve VA09.

[0048] The valves VA01-VA08 can be monostable solenoid valves configured to operate between a rest position (deenergized condition) and an operative position (energized condition). The rest position, and consequently the operative position, are different among the valves VA01-VA04 and the valves VA05-VA08; the valves VA01-VA04 at rest enable the passage of fluid (on the contrary, they do not enable it in their operative position), while the valves VA05-VA08 at rest do not enable the passage of fluid in a direction, as indicated in the following (instead they enable it in their operative position). The solenoid valves VA01-VA08 are monitored by the control unit of the hydraulic machine so that, at the occurrence of an anomaly and/or emergency conditions, the control unit operates on them (therefore on the redundancy levels of the first and operative sections) for determining the implementation of the safety function.

[0049] Figure 7 illustrates the circuit of the first embodiment in the deenergized state of the valves, wherein the monostable solenoid valves VA01-VA08 are not supplied and therefore are in a rest position. In such configuration, the valves VA01-VA04 enable the passage of fluid while the valves VA05-VA08 do not enable the passage of fluid in a direction (the passage of fluid is prevented from 2 to 1, see the symbols of each valve VA05-VA08). Consequently, the "non-safe" actuator drive member VA09 (in other words not configured to operate in a safety position) is excluded or bypassed; this is advantageous in order to prevent risk conditions if the actuator drive member VA09 fails and blocks in any non-safe position. Moreover, according to such configuration, pressurized fluid is supplied to the first chamber B1 of the actuator through the first port B1' and fluid is discharged from the second chamber A1 of the actuator through the second port A1'; in so far, therefore, the rod 9 of the actuator 7 is retracted inside the box body 8, so that the safety function is implemented. Performing the safety function is ensured by the redundant valves of each redundancy level.

[0050] In the first embodiment, the actuator drive member VA09 is a proportional solenoid valve and particularly a non-safety proportional solenoid valve, in other words a solenoid valve not apt to take a fail-safe position (safety position). It is understood the actuator drive member VA09 can be provided with any valve alternative to what was hereinbefore described or with an element apt to ensure the hereinbefore described functions.

[0051] As illustrated in Figure 7, the control device 1 according to the first embodiment can further comprise a sectionalizing valve VA10 configured to sectionalize the control device 1 in case of maintenance and, optionally, an oil filtration device F01 provided to protect the actuator drive member VA09. The control device 1 can comprise at least one non-return valve RT01, RT02, RT03; Figure 7 illustrates three non-return valves RT01, RT02, RT03. Each non-return valve can be a cartridge valve RT01, RT02, RT03. The control device 1 of Figure 7 further comprises two one-direction flow valves RG01, RG02 which enable to adjust the oil flow rate only in one flow direction (see the symbols in Figure 7). The valves VA10, RG01, RG02 are preferably of the manual type; in the circuit configuration illustrated for the first embodiment, the valves VA10, RG01, RG02 are completely open and therefore enable the passage of fluid.

[0052] The state of the valves shown in the circuit configuration of Figure 7 exemplifyingly shows the following operative conditions of the hydraulic machine: loss of the electric supply, actuation of one of the emergency stop functions by the control unit (PLC) of the machine.

Second embodiment

[0053] In the second embodiment of the control device 1, of which the circuit configuration is schematically illustrated in Figure 8, the first operative section 5 comprises a redundancy level and a further redundancy level; analogously, the second operative section 6 comprises a redundancy level and a further redundancy level. As it is hereinbelow described, the actuator drive member VA09 cooperates with the redundancy levels of the second operative section 6 and therefore, from the functional point of view, is part of the second operative section 6. The actuator drive member VA09 contributes to the redundancy because is configured to operate, in addition to the beforehand described retraction condition of the rod 9 and the outward condition of the rod, also in a fail-safe condition, in which it takes a fail-safe position, which prevents fluid from flowing; see Figure 8 in this regard. The fail-safe position is a safety position and can be defined, in such embodiment, as "closed-center" position, because it prevents fluid from flowing through the actuator drive member VA09.

[0054] The circuit configuration of the second embodiment, illustrating an anomaly and/or emergency conditions, can be summarized in this way: the control circuit 1 is supplied with pressurized hydraulic oil by the pressurized fluid source P through the port P'. The oil flow rate is adjusted by the one-direction flow valve RG01, the function and type thereof can be analogous to what was hereinbefore described with reference to the first embodiment. Independently from the position of the valve VA09 (Figure 8 illustrates the position in which it prevents the passage of oil), the pressurized oil flows into the first chamber 11 of the hydraulic actuator 7 through the port B1 determining the retraction of the rod 9. The retraction of the rod 9 into the box body 8 is ensured by the fact the oil flowing out of the port A1 can be discharged from the fluid discharge line through the redundant valves VA02, VA04. The valves VA05, VA06 and the actuator drive member VA09 in the safety position prevent pressure from entering the second chamber 12 of the hydraulic actuator 7. In performing the safety function, the retraction of the rod 9 into the box body 8 is consequently ensured by:

• the redundancy of the valves VA02 and VA04,
• the redundancy of the valves VA01 and VA03,
• the redundancy of the valve VA05 and the safety position of the actuator drive member VA09,
• the redundancy of the valve VA06 and the safety position of the actuator drive member VA09.

[0055] The second embodiment enables to implement the safety function by using six solenoid valves VA01-VA06 (monitored by the control unit of the hydraulic machine comprising the actuator 7 which the control device 1 operates on) and a proportional solenoid valve VA09 configured to take said safety position. The safety position corresponds to the case in which the ports P', T', A1', B1' are closed (see Figure 8). Each solenoid valve VA01-VA06 is preferably a solenoid valve of the beforehand type described with reference to the first embodiment.

[0056] The control device according to the second embodiment, can comprise one or more among the further components RG02, RP01, F01, RT01, RT02, RT03 of the beforehand type described with reference to the first embodiment.

Third embodiment

[0057] In the third embodiment of the control device 1, of which the circuit configuration is schematically illustrated in Figure 9, the first operative section 5 comprises a redundancy level and a further redundancy level; analogously, the second operative section 6 comprises a redundancy level and a further redundancy level. As it is described in the following, the actuator drive member VA09 cooperates with the redundancy levels both of the first operative section 5 and of the second operative section 6 and therefore, from the functional point of view, is part both of the first operative section 5 and of the second operative section 6. The actuator drive member VA09 contributes to the redundancy because it is provided with a fail-safe condition, in which it takes a fail-safe position, which ensures the flow of fluid such to enable the retraction of the rod 10; in this regard, see Figure 9. The fail-safe position is a safety position and can be also defined, in such embodiment, as the "crossed-center" position, because it enables "crossed" fluid flows (from P to B1 and from A1 to T, see the symbols of the actuator drive member VA09 in Figure 9) through the actuator drive member VA09. The fail-safe position of the actuator drive member VA09 illustrated in Figure 9, enables therefore the passage of "crossed" fluid through it in anomaly and/or emergency conditions; consequently, the oil can flow through the actuator drive member VA09 both in normal operative conditions and in extraordinary operative conditions. The fail-safe position of the actuator drive member VA09 of the third embodiment is therefore different from the fail-safe position of the actuator drive member VA09 of the second embodiment.

[0058] The circuit configuration of the third embodiment, illustrating an anomaly and/or emergency conditions, can be summarized in this way: the control device 1 is supplied with pressurized hydraulic oil from the pressurized fluid source P through the port P'. The pressurized oil flows into the first chamber 11 of the hydraulic actuator 7 through the port B1 determining the retraction of the rod 9. The retraction of the rod 9 is ensured because the oil flowing out of the port A1 can be discharged from the fluid discharge line through the valves VA02, VA06. The safety position of the actuator drive member VA09 also ensure the retraction of the rod 9. The valve VA05 and the actuator drive member VA09 in the safety position prevent pressure from entering into the second chamber 12 of the hydraulic actuator 7. In performing the safety function, the retraction of the rod 9 into the box body 8 is therefore ensured by:

• the redundancy of the valves VA02 and the safety position of the actuator drive member VA09,
• the redundancy of the valves VA01 and the safety position of the actuator drive member VA09,
• the redundancy of the valves VA05 and the safety position of the actuator drive member VA09,
• the redundancy of the valves VA06 and the safety position of the actuator drive member VA09.

[0059] The third embodiment enables to implement the safety function by using four solenoid valves VA01-VA04 (monitored by the control unit of the hydraulic machine comprising the actuator 7 which the control device 1 operates on) and a proportional solenoid valve VA09 configured to take said safety position. The safety position corresponds to the condition in which the port P' is fluidically communicating with the port B1' and the port T' is fluidically communicating with the port A1' (see Figure 9). Each solenoid valve VA01-VA04 is preferably a solenoid valve of the beforehand type described with reference to the first embodiment.

[0060] The control device according to the third embodiment can comprise one or more further components RG01, RG02, RP01, F01, RT01, RT02, RT03 of the beforehand type described with reference to the first embodiment.

Fourth embodiment

[0061] The control device 1, according to the fourth embodiment, illustrated in Figure 10, is configured to assist two actuators 7L, 7R. Figure 10 illustrates the actuators 7L, 7R as left actuator 7L and right actuator 7R and they are configured to move a same mass M arranged between them. The letters "L" and "R" indicate that some references of ports, components and/or sections analogous to the beforehand described ones and which end with such letter assist the left actuator (letter "L") and the right actuator (letter "R") respectively. It is understood that, even though in Figure 10 the actuators 7L, 7R are illustrated on the left and on the right, such position is only illustrative; indeed, the actuators 7L, 7R and the mass M (or the respective mass M) can be placed according to other arrangements provided that the actuators are apt to assist the function of moving the mass M which they are responsible for. Moreover, even though the fourth embodiment has two actuators 7L, 7R, in further possible embodiments, the control device 1 can be configured to operate on a plurality of actuators in number equal to N, wherein N is greater than two. In such embodiments provided with N actuators, it is possible to provide a corresponding number or the same number N of ports, components and/or sections required to ensure the fluid connections of the control device 1 to the N actuators and the operability of the control device 1 on the N actuators.

[0062] The fourth embodiment provides two actuator drive members VA09L and VA09R respectively configured to assist the left actuator 7L and the right actuator 7R. Each actuator drive member VA09L, VA09R is of the beforehand type described with reference to the third embodiment. In possible embodiments in which the control device 1 is configured to operate N actuators, it can comprise the same number N of actuator drive members so that each actuator drive member is configured to assist a respective actuator.

[0063] The first operative section 5 of the control device 1 assists both the actuators 7L, 7R and consequently is in common for the two actuators 7, while the control device 1 comprises a second section 6L dedicated to assist the left actuator 7L and a second section 6R dedicated to assist the right actuator 7R. In further embodiments which provide that the control device 1 is configured to operate on N actuators, the same number N of second sections can be provided, wherein each second section is apt to assist a respective actuator. In such embodiments, the first operative section 5 or a plurality of first operative sections 5 are provided to assist all the N actuators, each of them can assist one or more actuators as a function of the selected circuit configuration.

[0064] The circuit configuration of the fourth embodiment, illustrating an anomaly and/or emergency conditions, can be summarized in this way: the control device 1 is supplied with pressurized hydraulic oil from the pressurized fluid source P through the port P'. The pressurized oil flows into the respective first chambers 11 of the hydraulic actuators 7L, 7R through the respective ports B1L, B1R determining the retraction of the rod 9 of each actuator 7L, 7R. The retraction of the rod 9 is ensured because the oil flowing out of the ports A1L, A1R can be discharged from the fluid discharge line through the valves VA02, VA04, VA05, VA05R and the safety position of the actuator drive members VA09L, VA09R. The valves VA05L, VA05R and the actuator drive members VA09L, VA09R in the safety position prevent pressure from entering the second chamber 12 of the respective hydraulic actuator 7L, 7R which they assist. In performing the safety function, the retraction of the rod 9 into the box body 8 of the actuators 7L, 7R is consequently ensured by:

• the redundancy of the valves VA02 and VA04 and the safety position of the actuator drive members VA09L, VA09R,
• the redundancy of the valves VA01 and VA03 and the safety position of the actuator drive members VA09L, VA09R,

• the redundancy of the valves VA05L and the safety position of the actuator drive member VA09L,
• the redundancy of the valves VA06L and the safety position of the actuator drive member VA09L,
• the redundancy of the valves VA05R and the safety position of the actuator drive member VA09R,
• the redundancy of the valves VA06R and the safety position of the actuator drive member VA09R.

[0065] More particularly, in performing the safety function, the retraction of the rod 9 into the box body 8 of the left actuator 7L is ensured by:

• the redundancy of the valves VA02 and VA04 and the safety position of the actuator drive member VA09L,
• the redundancy of the valves VA01 and VA03 and the safety position of the actuator drive member VA09L,
• the redundancy of the valves VA05L and the safety position of the actuator drive member VA09L,
• the redundancy of the valves VA06L and the safety position of the actuator drive member VA09L,

and the retraction of the rod 9 into the box body 8 of the right actuator 7R is ensured by:

• the redundancy of the valves VA02 and VA04 and the safety position of the actuator drive member VA09R,
• the redundancy of the valves VA01 and VA03 and the safety position of the actuator drive member VA09R,
• the redundancy of the valves VA05R and the safety position of the actuator drive member VA09R,
• the redundancy of the valves VA06R and the safety position of the actuator drive member VA09R.

[0066] The fourth embodiment enables to implement the safety function on two hydraulic actuators 7L,7R by eight solenoid valves VA01-VA04, VA05L, VA05R, VA06L, VA06R (monitored by the control unit of the hydraulic machine comprising the actuator 7 which the control device 1 operates on) and two proportional solenoid valves VA09L, VA09R configured to take said safety position. The safety position of the proportional solenoid valves VA09L, VA09R corresponds to the case in which the port P' is fluidically communicating with the ports B1 L', B1R' and the port T' is fluidically communicating with the ports A1L', A1R' (see Figure 10). Each solenoid valve VA01-VA04, VA05L, VA05R, VA06L, VA06R is preferably a solenoid valve of the beforehand type described with reference to the first embodiment. It must be specified that each actuator 7L, 7R, in order to implement the safety unction, is assisted by six solenoid valves (VA01-VA04, VA05L and VA06L for the left actuator 7L and VA01-VA04, VA05R and VA06R for the right actuator 7R) and by a respective proportional solenoid valve VA09 configured to tale said safety position (VA09L for the left actuator 7L And VA09R for the right actuator 7R).

[0067] The control device 1, according to the fourth embodiment, can comprise one or more among the further components RG01, RG02, RP01 (particularly RP01L which assist the left actuator and RP01R which assists the right actuator), F01, RT01 (particularly RT01 L which assists the left actuator and RT01R which assists the right actuator), RT02 (particularly RT02L which assists the left actuator and RT02R which assists the right actuator) of the beforehand type described with reference to the first embodiment.

[0068] Four embodiments of the control device 1 have been described in an illustrative way; it is understood that possible further embodiments and/or combinations of the described embodiments are possible.

[0069] Now it must be specified as, due to the specific arrangement and functionality of the first section 5, second section 6 and due to the safety function the control device 1 is configured to implement, the control device 1 is configured to make the hydraulic circuit or a hydraulic system 100 which is associated to, compliant to the requirements of the standard EN ISO 13849, preferably according to the standard EN ISO 13849-1, still more preferably according to the standard EN ISO 13849-1 category 3.

[0070] The technical features herein disclosed with reference to functions of the control device 1 can be applied in the field of corresponding uses of the device or steps of the method which will be described in the following and can consequently be used for specifying such uses and method in the attached claims.

Use

[0071] Moreover, the invention refers to a use of the beforehand described control device 1 for controlling and implementing a safety function on at least one actuator 7, 7L, 7R, for example on at least one hydraulic actuator 7, 7L, 7R of a hydraulic machine such as a calender or a press. The safety function is of the beforehand described type and provides to retract the rod of the actuator inside the box body. Using the control device 1 ensures, at the occurrence of an anomaly and/or emergency condition, to perform the safety function by the redundancy levels of the control device 1.

System

[0072] Further, the invention refers to a system 100 comprising a control device 1 of the beforehand described type.

[0073] Preferably, the system 100 is of a hydraulic type and comprises a hydraulic circuit associated to a pressurized fluid source P and to a fluid discharge T. The pressurized fluid source P is configured to supply pressurized fluid also without an electric supply; this enables to implement the safety function by the control device 1 also without an electric supply. For example, the pressurized fluid source P can be a pressurized fluid storage and/or supply group, such as an oil storage and/or supply group.

[0074] The system 100 comprises at least one actuator 7, 7L, 7R associated to the hydraulic circuit. The actuator 7, 7L, 7R can be of the type beforehand described. Specifically, the actuator 7, 7L, 7R comprises a box body 8 such as a cylinder and a rod 9 movable with respect to the box body and is configured to move a movable mass M. The control device 1 is connected to the actuator 7, 7L, 7R at the connection section 3 and to the hydraulic circuit at the supply/discharge section 2. More particularly, the system 100 can comprise the hydraulic machine provided with at least one actuator 7 or a pair of actuators 7L, 7R and/or possible additional actuators which the control device 1 is configured to assist.

[0075] The system 100 has a control unit, which is preferably part of the hydraulic machine and can be a programmable logic controller (PLC). The control unit is configured to monitor the valves VA01-VA08 and to drive the rest or operative positions. More specifically, the control unit is configured to control the correct operation of each valve VA01-VA08 and the correct implementation of operative logics.

[0076] The control unit is configured to detect a triggering condition and, following the detection of the triggering condition, to implement the beforehand described safety function by the control device 1. The triggering condition is of the beforehand described type. Possible triggering conditions are: no electric supply or fail or anomaly in one of the electric components of the hydraulic circuit (for example electric anomaly of one or more valves VA01-VA08, cut cables, etcetera), combination of "non-safe" positions of the valves (for example, failing in taking the correct rest position of a valve VA01-VA08) or discrepancy between the driven position and effective position of one or more valves VA01-VA08, presence of a person in a risk area defined in proximity of the actuator 7, 7L, 7R and/or of the machine, etcetera.

[0077] At the end of the safety function, the cause of the triggering condition, such as an anomaly or malfunction, can be detected or signaled by the control unit of the machine.

[0078] The technical features herein disclosed with reference to functions of the system 100 can be applied in the field of corresponding uses of the system 100, or of the control device 1 or steps of the control method of at least one hydraulic actuator which is described in the following.

Method

[0079] The present invention refers also to a method of controlling at least one hydraulic actuator 7, 7L, 7R. Preferably, the method is performed by the beforehand described control device 1, on at least one actuator 7 or a pair of actuators 7L, 7R and/or possible additional actuators also of the beforehand described type.

[0080] The method provides to connect the control device 1 to at least one actuator 7, 7L, 7R by the connection section or, if it is already connected, to verify its correct connection. Further, the method provides to detect a triggering condition which can be one among the beforehand described ones or a further anomaly and/or emergency conditions.

[0081] Following the detection of the triggering condition, the method provides to implement a safety function by the control device; the safety function is according to what was hereinbefore described. The implementation of the safety function by the control device 1 provides to supply the first chamber B1, B1L, B1R of the actuator 7, 7L, 7R with pressurized fluid and discharge pressurized fluid from the second chamber A1, A1L, A1R of the actuator 7, 7L, 7R, in order to determine the retraction of the rod 9 inside the box body 8. Supplying the first chamber B1, B1L, B1R preferably provides to flow the pressurized fluid in the pressurized fluid supply line through the first operative section 5 and, downstream the first operative section 5, through the first port B1', B1L', B1R'. Discharging the pressurized fluid from the second chamber A1, A1L, A1R of the actuator 7, 7L, 7R preferably provides to flow fluid in the discharge line at least through the first operative section 5 and, upstream the first operative section 5, through the second port A1', A1L', A1R'.

[0082] Retracting the rod 9 inside the box body 8 enables it to take a safety position inside the box body; such safety position is a position determining the implementation of safety measures for the movable mass M, pulled in a controlled way (consequently substantially without risks) by the rod 9 during its retraction stroke. The retraction of the rod is ensured by the redundancy levels of the first and second operative sections beforehand described with reference to the control device 1 and to possible embodiments thereof, which correspond to possible embodiments of the method.

[0083] In the first and second embodiments of the method, the step of implementing a safety function by the control device can provide to prevent fluid from flowing through the actuator drive member.

[0084] With reference to the third and fourth embodiments of the method, the step of implementing a safety function by the control device can provide to enable the passage of fluid flow, particularly the passage of "crossed" fluid as hereinbefore described through the actuator drive member when the actuator drive member is in the fail-safe condition.

[0085] The method can provide, at the end of the performance of the safety function, to detect and signal the cause of the triggering condition, such as an anomaly or malfunction.

[0086] The technical features herein disclosed with reference to the steps of the method, can be applied in the field of corresponding beforehand described functions or uses of the control device 1 and therefore can be used for specifying such functions or uses of the device in the attached claims.

[0087] The following describes some of the many advantages the invention provides. First of all, the invention provides a control device 1, which is modular and compact, in other words having limited dimensions. The modularity of the control device 1 is due to the fact that it comprises a plurality of subgroups (modules) which can be reconfigured and assembled in different ways in order to obtain a more efficient size for the integration with the machine; each mode of assembly determines an embodiment such as the ones beforehand illustrated. The subgroups which can be assembled in different ways can consist of the valves VA01-VA08, VA05L, VA05R, VA06L, VA06R and respective connectors (see the blocks connected to said valves and illustrated in Figures from 1 to 6) and of the actuator drive member VA09, VA09L, VA09R and relevant respective (see the blocks connected to the actuator drive member VA09 and illustrated in the Figures from 1 to 6).

[0088] The invention enables to use different types of servovalves VA09, VA09L, VA09R to drive the hydraulic actuator during the normal operation of the machine without jeopardizing the safety function; the type of servovalve VA09, VA09L, VA09R can therefore be selected only as a function of the type of control to be performed. Moreover, the invention further enables to use oil having a high filtration grade (less filtered oil), densities comprised between 10 and 800 cst (kinematic viscosity) and temperatures comprised between -20°C and +70°C without jeopardizing the safety function. Moreover, the invention enables to reduce the operative cost of the machine and to operate with pressures to 350 bar.

[0089] The configurations of the described hydraulic circuits show a reduced probability of having simultaneous fails (common cause fail, CCF) because the control device 1 is not sensible to the environmental conditions, because the quality of the hydraulic oil for implementing the safety function is irrelevant and because the electric connections of the electrovalves VA01-VA08, VA05L, VA05R, VA06L, VA06R are insensible to the electromagnetic noises.

[0090] Lastly, the invention provides a technical solution of remarkable efficiency and reliability. Indeed, the control device 1 has the following probabilities of failing:

• dangerous fails for each operative hour (Probability of dangerous Fail per Hour, PFHd) from 10^-8 to 10^-7,
• prediction of a dangerous fail in a time range from 1000 to 10000 years.

Claims

1. Control device (1) configured to be connected to a hydraulic circuit, the hydraulic circuit being provided with or associated to at least one actuator (7, 7L, 7R) having a box body (8) such as a cylinder and a rod (9) movable with respect to the box body (8), the actuator (7, 7L, 7R) being configured to move a movable mass (M), the control device (1) comprising:

- a supply/discharge section (2) comprising:

∘ a pressurized fluid supply port (P') configured to be connected to a pressurized fluid source (P) and configured, in a condition of connection to the pressurized fluid source, to supply the pressurized fluid to the control device (1),

∘ a fluid discharge port (T') configured to discharge the fluid from the control device (1),

- at least one connection section (3) configured to be connected to the actuator (7, 7L, 7R) and comprising:

∘ a first port (B1', B1L', B1R') configured, at least in one condition of connection to the actuator (7, 7L, 7R), to supply the pressurized fluid to the actuator (7, 7L, 7R),

∘ a second port (A1', A1L', A1 R') configured, at least in one condition of connection to the actuator (7, 7L, 7R), to discharge the fluid from the actuator (7, 7L, 7R),

- a pressurized fluid supply line connecting the pressurized fluid supply port (P') and the first port (B1', B1L', B1R') and configured, at least in one condition of connection to the actuator (7, 7L, 7R), to enable supply fluid to flow from the pressurized fluid supply port (P') to the actuator (7, 7L, 7R),

- a fluid discharge line connecting the second port (A1', A1L', A1 R') and the fluid discharge port (T') and configured, at least in one condition of connection to the actuator (7, 7L, 7R), to enable discharge fluid to flow from the actuator (7, 7L, 7R) to the discharge port (T'),

- a control section comprising an actuator drive member (VA09, VA09L, VA09R) configured to drive and/or manage one or more operative conditions of the actuator (7, 7L, 7R), the control section being configured both to control the actuator (7, 7L, 7R) in one or more operative conditions by said actuator drive member (VA09, VA09L, VA09R) and to implement, in an anomaly and/or emergency condition, a safety function acting on the actuator (7, 7L, 7R), which causes the rod (9) of the actuator (7, 7L, 7R) to retract inside the box body (8), the anomaly and/or emergency condition being a condition triggering the safety function,

wherein the control section features a first operative section (5) and a second operative section (6, 6L, 6R) each of which comprises a portion of the fluid supply line and a portion of the fluid discharge line, the first and second operative sections (5, 6) being configured to implement, upon occurring the triggering condition, said safety function,

characterized in that

the first and second operative sections (5, 6) are provided with at least one respective redundancy level and are configured, upon occurring the triggering condition, to ensure the retraction of the rod (9) by the respective redundancy levels.

2. Control device according to claim 1, wherein:

- the first operative section (5) is defined, in a normal operative condition, at least between the supply/discharge section (2) and the actuator drive member (VA09, VA09L, VA09R) and is configured, upon occurring the triggering condition, to enable fluid to flow from the fluid supply port (P') to the first port (B1', B1L', B1R') and to enable fluid to flow from the second port (A1', A1L', A1 R') to the fluid discharge port (T'),

- the second operative section is defined at least between the actuator drive member (VA09, VA09L, VA09R) and the connection section (3) and is configured, upon occurring the triggering condition, at least to prevent fluid to flow from the fluid supply port (P') to the second port (A1', A1L', A1R').

3. Control device according to claim 1 or 2, wherein:

- said at least one redundancy level of the first operative section (5) is defined on the pressurized fluid supply line and is configured to ensure, upon occurring the triggering condition, fluid to flow from the fluid supply port (P') to the first port (B1', B1L', B1R'),

- said at least one redundancy level of the second operative section (6, 6L, 6R) is arranged on the pressurized fluid supply line and is configured to ensure, upon occurring the triggering condition, to prevent fluid to flow from the fluid supply port (P') to the second port (A1', A1L', A1R').

4. Control device according to claim 1 or 2 or 3, wherein:

- the first operative section (5) further comprises a further redundancy level defined on the discharge line,

- the second operative section (6, 6L, 6R) comprises a further redundancy level defined on the discharge line.

5. Control device according to any of claims from 1 to 4, wherein the actuator drive member (VA09, VA09L, VA09R) is configured to operate at least between:

- a condition in which it enables the passage of pressurized fluid from the pressurized fluid supply port (P') to the first port, (B1', B1L', B1R') so that the pressurized fluid enters a first chamber (11) defined inside the box body (8) of the actuator, (7, 7L, 7R) and the passage of fluid from the second port (A1', A1L', A1 R') to the fluid discharge port (T'), so that the fluid to be discharged flows from a second chamber (12) defined inside the box body (8) of the actuator (7, 7L, 7R) to the fluid discharge port (T'),

- a condition in which it enables both the passage of pressurized fluid from the pressurized fluid supply port (P') to the second port (A1', A1L', A1 R'), so that the pressurized fluid enters the second chamber (12), and the fluid passage from the first port (B1', B1L', B1R') to the fluid discharge port (T'), so that such fluid to be discharged flows from the first chamber (11) to the fluid discharge port (T').

6. Control device according to claim 4 or claim 5 when depending on claim 4, wherein the redundancy level and the further redundancy level of the first operative section (5) comprise a respective pair of redundant valves (VA01-VA04).

7. Control device according to anyone of the preceding claims, wherein each redundancy level comprises a pair of redundant valves (VA01-VA08), in the safety function each valve (VA01-VA04) of each pair of redundant valves of the first operative section (5) being configured to enable fluid to flow through it and each valve (VA05-VA08) of each pair of redundant valves of the second operative section (6) being configured to prevent fluid from flowing through it in one direction,
optionally wherein the redundant valves are controllable by a control unit of a system or machine which the control device (1) is connected or connectable to.

8. Control device according to anyone of claims from 1 to 6, wherein the actuator drive member (VA09, VA09L, VA09R) is functionally part of at least one of the first and second operative sections, the actuator drive member (VA09, VA09L, VA09R) contributing to ensure the redundancy of at least one redundancy level of the first and/or second operative sections (5, 6).

9. Control device according to anyone of claims from 1 to 5 or according to claim 7, wherein the actuator drive member (VA09, VA09L, VA09R) is configured to switch to a fail-safe condition, the fail-safe condition contributing to the redundancy of said at least one redundancy level.

10. Control device according to anyone of claims from 1 to 5 or according to claim 8 or 9, wherein the actuator drive member (VA09, VA09L, VA09R) is functionally part both of the first operative section (5) and of the second operative section (6, 6L, 6R) and contributes to ensure each redundancy level of the first operative section (5) and each redundancy level of the second operative section (6, 6L, 6R).

11. Control device according to any of the preceding claims, wherein:

- each redundancy level comprises a valve (VA01, VA02, VA05, VA06, VA05L, VA05R, VA06L, VA06R) configured to prevent the passage of fluid in an anomaly and/or emergency conditions and the actuator drive command (VA09, VA09L, VA09R) configured to take a fail-safe condition, and/or

- each redundancy level provides, in anomaly and/or emergency condition, that the valve (VA01, VA02, VA05, VA06, VA05L, VA05R, VA06L, VA06R) prevents the passage of fluid and/or that the actuator drive member (VA09, VA09L, VA09R) takes the fail-safe conditions, in which it prevents the passage of fluid.

12. Hydraulic system (100) comprising:

- a hydraulic circuit associated to a pressurized fluid source (P) and to a fluid discharge (T),

- at least one actuator (7, 7L, 7R) associated to the hydraulic circuit and comprising a box body (8) such as a cylinder and a rod (9) movable with respect to the box body (8), the actuator (7, 7L, 7R) being configured to move a movable mass (M),

- a control device (1) according to anyone of the preceding claims, the control device being connected to the actuator (7, 7L, 7R) at the connection section (3) and to the hydraulic circuit at the supply/discharge section (2),

the system (100) being configured to detect a triggering condition and to implement a safety function by the control device (1) following detecting said triggering condition, the triggering condition being an anomaly and/or emergency condition for example due to or related to the hydraulic circuit or actuator (7, 7L, 7R) or control device (1) itself.

13. Hydraulic system according to claim 12, further comprising a control unit configured to detect the triggering condition,

the control unit being configured to:

- detect the triggering condition,

- trigger the safety function by the control device (1),

optionally wherein the control unit is configured to communicate the detected triggering condition to the control device (1) so that the control device (1) triggers the safety function.

14. Hydraulic system according to claim 12 or 13, comprising a machine configured to be actuated, at least partially hydraulically, such as a calender or press, the machine comprising at least said actuator (7, 7L, 7R).

15. Method of controlling at least one hydraulic actuator (7, 7L, 7R), the actuator being arranged in or associated to a hydraulic circuit and having a box body (8) such as a cylinder and a rod (9) movable with respect to the box body (8), the box body (8) being provided with a first chamber (11) and a second chamber (12), the actuator (7, 7L, 7R) being configured to move a movable mass (M), the method comprising the steps of:

- providing a control device (1) according to anyone of claims from 1 to 11,

- connecting the control device (1) to the actuator by the connection section (3),

- detecting a triggering condition, the triggering condition being an anomaly and/or emergency condition for example due to or related to the hydraulic circuit or actuator (7, 7L, 7R) or control device (1) itself,

- following detecting the triggering condition, implementing a safety function by the control device (1),

the step of implementing a safety function by the control device (1) comprising:

- supplying pressurized fluid to the first chamber (11) of the actuator (7, 7L, 7R), said step comprising causing the pressurized fluid to flow in the pressurized fluid supply line through the first operative section (5) and, downstream the first operative section (5), through said first port (B1', B1L', B1R'),

- discharging pressurized fluid from the second actuator chamber (7, 7L, 7R), said step comprising making fluid to flow in the discharge line at least through the first operative section (5) and, upstream the first operative section (5), through said second port (A1', A1L', A1R'),

- retracting the rod (9) inside the box body (8),

- ensuring the rod retraction (9) by said redundancy levels of the first and second operative sections (5, 6),

optionally wherein the step of implementing a safety function by the control device (1) comprises preventing fluid from flowing through the actuator drive member (VA09).

Ansprüche

1. Steuervorrichtung (1), die konfiguriert ist, um mit einem Hydraulikkreis verbunden zu werden, wobei der Hydraulikkreis mit mindestens einem Aktuator (7, 7L, 7R) versehen oder diesem zugeordnet ist, der einen Kastenkörper (8) wie einen Zylinder und eine Stange (9) aufweist, die relativ zu dem Kastenkörper (8) beweglich ist, wobei der Aktuator (7, 7L, 7R) zum Bewegen einer beweglichen Masse (M) konfiguriert ist, wobei die Steuervorrichtung (1) umfasst:

- einen Versorgungs-/Ablassabschnitt (2), umfassend:

∘ einen Druckfluidversorgungsanschluss (P'), der konfiguriert ist, um mit einer Druckfluidquelle (P) verbunden zu werden, und konfiguriert ist, um bei Verbindung mit der Druckfluidquelle die Steuervorrichtung (1) mit dem Druckfluid zu versorgen,

∘ einen Fluidablassanschluss (T'), der konfiguriert ist, um das Fluid aus der Steuervorrichtung (1) abzulassen,

- mindestens einen Verbindungsabschnitt (3), der konfiguriert ist, um mit dem Aktuator (7, 7L, 7R) verbunden zu werden, und umfassend:

∘ einen ersten Anschluss (B1', B1L', B1R'), der konfiguriert ist, um mindestens in einem Verbindungszustand mit dem Aktuator (7, 7L, 7R) den Aktuator (7, 7L, 7R) mit dem Druckfluid zu versorgen,

∘ einen zweiten Anschluss (A1', A1L', A1R'), der konfiguriert ist, um mindestens in einem Verbindungszustand mit dem Aktuator (7, 7L, 7R) das Fluid aus dem Aktuator (7, 7L, 7R) abzulassen,

- eine Druckfluidversorgungsleitung, die den Druckfluidversorgungsanschluss (P') und den ersten Anschluss (B1', B1L', B1 R') verbindet und konfiguriert ist, um mindestens in einem Verbindungszustand mit dem Aktuator (7, 7L, 7R) zu ermöglichen, dass Versorgungsfluid vom Druckfluidversorgungsanschluss (P') zum Aktuator (7, 7L, 7R) strömt,

- eine Fluidablassleitung, die den zweiten Anschluss (A1', A1L', A1R') und den Fluidablassanschluss (T') verbindet und konfiguriert ist, um mindestens in einem Verbindungszustand mit dem Aktuator (7, 7L, 7R) zu ermöglichen, dass Ablassfluid vom Aktuator (7, 7L, 7R) zum Ablassanschluss (T') strömt,

- einen Steuerabschnitt, umfassend ein Aktuator-Antriebselement (VA09, VA09L, VA09R), das konfiguriert ist, um einen oder mehrere Betriebszustände des Aktuators (7, 7L, 7R) anzutreiben und/oder zu verwalten, wobei der Steuerabschnitt konfiguriert ist, um sowohl den Aktuator (7, 7L, 7R) in einem oder mehreren Betriebszuständen durch das Aktuator-Antriebselement (VA09, VA09L, VA09R) zu steuern als auch in einem Anomalie- und/oder Notfallzustand eine auf den Aktuator (7, 7L, 7R) wirkende Sicherheitsfunktion zu implementieren, die ein Einziehen der Stange (9) des Aktuators (7, 7L, 7R) in das Innere des Kastenkörpers (8) bewirkt, wobei der Anomalie- und/oder Notfallzustand ein Zustand ist, der die Sicherheitsfunktion auslöst,

wobei der Steuerabschnitt einen ersten Betriebsabschnitt (5) und einen zweiten Betriebsabschnitt (6, 6L, 6R) aufweist, die jeweils einen Abschnitt der Fluidversorgungsleitung und einen Abschnitt der Fluidablassleitung umfassen, wobei der erste und der zweite Betriebsabschnitt (5, 6) konfiguriert sind, um bei Auftreten der Auslösebedingung die Sicherheitsfunktion zu implementieren,

dadurch gekennzeichnet, dass

der erste und der zweite Betriebsabschnitt (5, 6) mit mindestens einer jeweiligen Redundanzstufe versehen und konfiguriert sind, um bei Auftreten des Auslösezustands das Einziehen der Stange (9) durch die jeweiligen Redundanzstufen zu gewährleisten.

2. Steuervorrichtung nach Anspruch 1, wobei:

- der erste Betriebsabschnitt (5) in einem normalen Betriebszustand mindestens zwischen dem Versorgungs-/Ablassabschnitt (2) und dem Aktuator-Antriebselement (VA09, VA09L, VA09R) definiert ist und konfiguriert ist, um bei Auftreten des Auslösezustands zu ermöglichen, dass Fluid vom Fluidversorgungsanschluss (P') zum ersten Anschluss (B1', B1L', B1 R') strömt, sowie zu ermöglichen, dass Fluid vom zweiten Anschluss (A1', A1L', A1R') zum Fluidablassanschluss (T') strömt,

- der zweite Betriebsabschnitt mindestens zwischen dem Aktuator-Antriebselement (VA09, VA09L, VA09R) und dem Verbindungsabschnitt (3) definiert ist und konfiguriert ist, um bei Auftreten des Auslösezustands mindestens zu verhindern, dass Fluid vom Fluidversorgungsanschluss (P') zum zweiten Anschluss (A1', A1L', A1 R') strömt.

3. Steuervorrichtung nach Anspruch 1 oder 2, wobei:

- die mindestens eine Redundanzstufe des ersten Betriebsabschnitts (5) an der Druckfluidversorgungsleitung definiert ist und konfiguriert ist, um zu gewährleisten, dass bei Auftreten des Auslösezustands Fluid vom Fluidversorgungsanschluss (P') zum ersten Anschluss (B1', B1L', B1R') strömt,

- die mindestens eine Redundanzstufe des zweiten Betriebsabschnitts (6, 6L, 6R) an der Druckfluidversorgungsleitung angeordnet ist und konfiguriert ist, um zu gewährleisten, dass bei Auftreten des Auslösezustands verhindert wird, dass Fluid vom Fluidversorgungsanschluss (P') zum zweiten Anschluss (A1', A1L', A1 R') strömt.

4. Steuervorrichtung nach Anspruch 1 oder 2 oder 3, wobei:

- der erste Betriebsabschnitt (5) ferner eine weitere Redundanzstufe umfasst, die an der Abflussleitung definiert ist,

- der zweite Betriebsabschnitt (6, 6L, 6R) eine weitere Redundanzstufe umfasst, die an der Ablassleitung definiert ist.

5. Steuervorrichtung nach einem der Ansprüche 1 bis 4, wobei das Aktuator-Antriebselement (VA09, VA09L, VA09R) konfiguriert ist, um mindestens zwischen folgenden Zuständen zu arbeiten:

- einem Zustand, in dem es den Durchgang von Druckfluid vom Druckfluidversorgungsanschluss (P') zum ersten Anschluss (B1', B1L', B1 R') ermöglicht, so dass das Druckfluid in eine erste Kammer (11) eintritt, die innerhalb des Kastenkörpers (8) des Aktuators (7, 7L, 7R) definiert ist, sowie den Durchgang von Fluid vom zweiten Anschluss (A1', A1L', A1R') zum Fluidablassanschluss (T') ermöglicht, so dass das abzulassende Fluid von einer zweiten Kammer (12), die innerhalb des Kastenkörpers (8) des Aktuators (7, 7L, 7R) definiert ist, zum Fluidablassanschluss (T') strömt,

- einem Zustand, in dem es sowohl den Durchgang von Druckfluid vom Druckfluidversorgungsanschluss (P') zum zweiten Anschluss (A1', A1L', A1 R') ermöglicht, so dass das Druckfluid in die zweite Kammer (12) eintritt, als auch den Durchgang von Fluid vom ersten Anschluss (B1', B1L', B1R') zum Fluidablassanschluss (T') ermöglicht, so dass das auszulassende Fluid von der ersten Kammer (11) zum Fluidauslassanschluss (T') strömt.

6. Steuervorrichtung nach Anspruch 4 oder Anspruch 5 in Abhängigkeit von Anspruch 4, wobei die Redundanzstufe und die weitere Redundanzstufe des ersten Betriebsabschnitts (5) jeweils ein Paar redundanter Ventile (VA01-VA04) umfassen.

7. Steuervorrichtung nach einem der vorstehenden Ansprüche, wobei jede Redundanzstufe ein Paar redundanter Ventile (VA01-VA08) umfasst, wobei in der Sicherheitsfunktion jedes Ventil (VA01-VA04) jedes Paares redundanter Ventile des ersten Betriebsabschnitts (5) konfiguriert ist, um einen Durchfluss von Fluid zu ermöglichen, und wobei jedes Ventil (VA05-VA08) jedes Paares redundanter Ventile des zweiten Betriebsabschnitts (6) konfiguriert ist, um einen Durchfluss von Fluid in eine Richtung zu verhindern,
wobei optional die redundanten Ventile durch eine Steuereinheit eines Systems oder einer Maschine, mit der die Steuervorrichtung (1) verbunden ist oder verbunden werden kann, gesteuert werden können.

8. Steuervorrichtung nach einem der Ansprüche 1 bis 6, wobei das Aktuator-Antriebselement (VA09, VA09L, VA09R) funktionell Teil von mindestens einem von dem ersten und zweiten Betriebsabschnitt ist, wobei das Aktuator-Antriebselement (VA09, VA09L, VA09R) dazu beiträgt, die Redundanz von mindestens einer Redundanzstufe des ersten und/oder zweiten Betriebsabschnitts (5, 6) zu gewährleisten.

9. Steuervorrichtung nach einem der Ansprüche 1 bis 5 oder nach Anspruch 7, wobei das Aktuator-Antriebselement (VA09, VA09L, VA09R) konfiguriert ist, um in einen ausfallsicheren Zustand zu wechseln, wobei der ausfallsichere Zustand zur Redundanz der mindestens einen Redundanzstufe beiträgt.

10. Steuervorrichtung nach einem der Ansprüche 1 bis 5 oder nach Anspruch 8 oder 9, wobei das Aktuator-Antriebselement (VA09, VA09L, VA09R) funktionell sowohl Teil des ersten Betriebsabschnitts (5) als auch des zweiten Betriebsabschnitts (6, 6L, 6R) ist und dazu beiträgt, jede Redundanzstufe des ersten Betriebsabschnitts (5) und jede Redundanzstufe des zweiten Betriebsabschnitts (6, 6L, 6R) zu gewährleisten.

11. Steuervorrichtung nach einem der vorstehenden Ansprüche, wobei:

- jede Redundanzstufe ein Ventil (VA01, VA02, VA05, VA06, VA05L, VA05R, VA06L, VA06R) umfasst, das konfiguriert ist, um den Durchgang von Fluid in einem Anomalie- und/oder Notfallzustand zu verhindern, und den Aktuator-Antriebsbefehl (VA09, VA09L, VA09R) umfasst, der konfiguriert ist, um einen ausfallsicheren Zustand einzunehmen, und/oder

- jede Redundanzstufe im Anomalie- und/oder Notfallzustand dafür sorgt, dass das Ventil (VA01, VA02, VA05, VA06, VA05L, VA05R, VA06L, VA06R) den Durchgang von Fluid verhindert und/oder dass das Aktuator-Antriebselement (VA09, VA09L, VA09R) den ausfallsicheren Zustand einnimmt, in dem es den Durchgang von Fluid verhindert.

12. Hydrauliksystem (100), umfassend:

- einen Hydraulikkreis, der einer Druckfluidquelle (P) und einem Fluidablass (T) zugeordnet ist,

- mindestens einen Aktuator (7, 7L, 7R), der dem Hydraulikkreis zugeordnet ist und einen Kastenkörper (8) wie einen Zylinder und eine Stange (9) umfasst, die relativ zu dem Kastenkörper (8) beweglich ist, wobei der Aktuator (7, 7L, 7R) konfiguriert ist, um eine bewegliche Masse (M) zu bewegen,

- eine Steuervorrichtung (1) nach einem der vorstehenden Ansprüche, wobei die Steuervorrichtung mit dem Aktuator (7, 7L, 7R) am Verbindungsabschnitt (3) und mit dem Hydraulikkreislauf am Versorgungs-/Ablassabschnitt (2) verbunden ist,

wobei das System (100) konfiguriert ist, um einen Auslösezustand zu erkennen und nach Erkennen des Auslösezustands eine Sicherheitsfunktion durch die Steuervorrichtung (1) zu implementieren, wobei der Auslösezustand ein Anomalie- und/oder Notfallzustand ist, der zum Beispiel auf den Hydraulikkreis oder Aktuator (7, 7L, 7R) oder die Steuervorrichtung (1) selbst zurückzuführen ist oder damit zusammenhängt.

13. Hydrauliksystem nach Anspruch 12, ferner umfassend eine Steuereinheit, die konfiguriert ist, um den Auslösezustand zu erkennen,

wobei die Steuereinheit konfiguriert ist, um:

- den Auslösezustand zu erkennen,

- die Sicherheitsfunktion durch die Steuervorrichtung (1) auszulösen,

wobei optional die Steuereinheit konfiguriert ist, um den erkannten Auslösezustand an die Steuervorrichtung (1) zu übermitteln, so dass die Steuervorrichtung (1) die Sicherheitsfunktion auslöst.

14. Hydrauliksystem nach Anspruch 12 oder 13, umfassend eine Maschine, die konfiguriert ist, um mindestens teilweise hydraulisch betätigt zu werden, wie ein Kalander oder eine Presse, wobei die Maschine mindestens den Aktuator (7, 7L, 7R) umfasst.

15. Verfahren zum Steuern mindestens eines hydraulischen Aktuators (7, 7L, 7R), wobei der Aktuator in einem Hydraulikkreis angeordnet oder einem solchen zugeordnet ist und einen Kastenkörper (8) wie einen Zylinder und eine Stange (9) aufweist, die relativ zu dem Kastenkörper (8) beweglich ist, wobei der Kastenkörper (8) mit einer ersten Kammer (11) und einer zweiten Kammer (12) versehen ist, wobei der Aktuator (7, 7L, 7R) konfiguriert ist, um eine bewegliche Masse (M) zu bewegen, wobei das Verfahren folgende Schritte umfasst:

- Bereitstellen einer Steuervorrichtung (1) nach einem der Ansprüche 1 bis 11,

- Verbinden der Steuervorrichtung (1) mit dem Aktuator durch den Verbindungsabschnitt (3),

- Erkennen eines Auslösezustands, wobei der Auslösezustand ein Anomalie- und/oder ein Notfallzustand ist, der zum Beispiel auf den Hydraulikkreis oder Aktuator (7, 7L, 7R) oder die Steuervorrichtung (1) selbst zurückzuführen ist oder damit zusammenhängt,

- nach Erkennen des Auslösezustands Implementieren einer Sicherheitsfunktion durch die Steuervorrichtung (1),

wobei der Schritt des Implementierens einer Sicherheitsfunktion durch die Steuervorrichtung (1) umfasst:

- Versorgen der ersten Kammer (11) des Aktuators (7, 7L, 7R) mit Druckfluid, wobei dieser Schritt umfasst, zu bewirken, dass das Druckfluid in der Druckfluidversorgungsleitung durch den ersten Betriebsabschnitt (5) und stromabwärts des ersten Betriebsabschnitts (5) durch den ersten Anschluss (B1', B1L', B1 R') strömt,

- Ablassen von Druckfluid aus der zweiten Aktuator-Kammer (7, 7L, 7R), wobei dieser Schritt umfasst, zu bewirken, dass Fluid in der Ablassleitung mindestens durch den ersten Betriebsabschnitt (5) und stromaufwärts des ersten Betriebsabschnitts (5) durch den zweiten Anschluss (A1', A1L', A1R') strömt,

- Einziehen der Stange (9) in das Innere des Kastenkörpers (8),

- Gewährleisten des Einziehens der Stange (9) durch die Redundanzstufen des ersten und des zweiten Betriebsabschnitts (5, 6),

wobei optional der Schritt des Implementierens einer Sicherheitsfunktion durch die Steuervorrichtung (1) umfasst, zu verhindern, dass Fluid durch das Aktuator-Antriebselement (VA09) strömt.

Revendications

1. Dispositif de commande (1) conçu pour être relié à un circuit hydraulique, le circuit hydraulique étant pourvu de ou associé à au moins un actionneur (7, 7L, 7R) ayant un corps de boîte (8) tel qu'un cylindre et une tige (9) pouvant se déplacer par rapport au corps de boîte (8), l'actionneur (7, 7L, 7R) étant conçu pour déplacer une masse (M) déplaçable, le dispositif de commande (1) comprenant :

- une section d'alimentation/évacuation (2) comprenant :

∘ un orifice d'alimentation en fluide (P') sous pression conçu pour être relié à une source de fluide sous pression (P) et conçu, dans une condition de liaison à la source de fluide sous pression, pour fournir le fluide sous pression au dispositif de commande (1),

∘ un orifice d'évacuation (T') de fluide conçu pour évacuer le fluide du dispositif de commande (1),

- au moins une section de liaison (3) conçue pour être reliée à l'actionneur (7, 7L, 7R) et comprenant :

∘ un premier orifice (B1', B1 L', B1 R') conçu, au moins dans une condition de liaison à l'actionneur (7, 7L, 7R), pour fournir le fluide sous pression à l'actionneur (7, 7L, 7R),

∘ un second orifice (A1', A1 L', A1 R') conçu, au moins dans une condition de liaison à l'actionneur (7, 7L, 7R), pour évacuer le fluide de l'actionneur (7, 7L, 7R),

- une conduite d'alimentation en fluide sous pression reliant l'orifice d'alimentation en fluide (P') sous pression et le premier orifice (B1', B1 L', B1 R') et conçue, au moins dans une condition de liaison à l'actionneur (7, 7L, 7R), pour permettre à un fluide d'alimentation de s'écouler à partir de l'orifice d'alimentation en fluide (P') sous pression vers l'actionneur (7, 7L, 7R),

- une conduite d'évacuation de fluide reliant le second orifice (A1', A1L', A1 R') et l'orifice d'évacuation (T') de fluide et conçue, au moins dans une condition de liaison à l'actionneur (7, 7L, 7R), pour permettre à un fluide d'évacuation de s'écouler à partir de l'actionneur (7, 7L, 7R) vers l'orifice d'évacuation (T'),

- une section de commande comprenant un élément d'entraînement d'actionneur (VA09, VA09L, VA09R) conçu pour entraîner et/ou gérer une ou plusieurs conditions de fonctionnement de l'actionneur (7, 7L, 7R), la section de commande étant conçue à la fois pour commander l'actionneur (7, 7L, 7R) dans une ou plusieurs conditions de fonctionnement par ledit élément d'entraînement d'actionneur (VA09, VA09L, VA09R) et pour mettre en oeuvre, dans une condition d'anomalie et/ou d'urgence, une fonction de sécurité agissant sur l'actionneur (7, 7L, 7R), qui amène la tige (9) de l'actionneur (7, 7L, 7R) à se rétracter à l'intérieur du corps de boîte (8), la condition d'anomalie et/ou d'urgence étant une condition déclenchant la fonction de sécurité,

dans lequel la section de commande présente une première section de fonctionnement (5) et une seconde section de fonctionnement (6, 6L, 6R) dont chacun comprend une partie de la conduite d'alimentation en fluide et une partie de la conduite d'évacuation de fluide, les première et seconde sections de fonctionnement (5, 6) étant conçues pour mettre en oeuvre, lors de l'occurrence de la condition de déclenchement, ladite fonction de sécurité,

caractérisé en ce que

les première et seconde sections de fonctionnement (5, 6) sont pourvues d'au moins un niveau de redondance respectif et sont conçues, lors de l'occurrence de la condition de déclenchement, pour assurer la rétraction de la tige (9) par les niveaux de redondance respectifs.

2. Dispositif de commande selon la revendication 1, dans lequel :

- la première section de fonctionnement (5) est définie, dans une condition de fonctionnement normale, au moins entre la section d'alimentation/évacuation (2) et l'élément d'entraînement d'actionneur (VA09, VA09L, VA09R) et est conçue, lors de l'occurrence de la condition de déclenchement, pour permettre à un fluide de s'écouler de l'orifice d'alimentation en fluide (P') vers le premier orifice (B1', B1 L', B1 R') et pour permettre à un fluide de s'écouler à partir du second orifice (A1', A1 L', A1 R') vers l'orifice d'évacuation (T') de fluide,

- la seconde section de fonctionnement est définie au moins entre l'élément d'entraînement d'actionneur (VA09, VA09L, VA09R) et la section de liaison (3) et est conçue, lors de l'occurrence de la condition de déclenchement, au moins pour empêcher un fluide de s'écouler à partir de l'orifice d'alimentation en fluide (P') vers le second orifice (A1', A1 L', A1 R').

3. Dispositif de commande selon la revendication 1 ou 2, dans lequel :

- ledit au moins un niveau de redondance de la première section de fonctionnement (5) est défini sur la conduite d'alimentation en fluide sous pression et est conçu pour assurer, lors de l'occurrence de la condition de déclenchement, l'écoulement d'un fluide à partir de l'orifice d'alimentation en fluide (P') vers le premier orifice (B1', B1L', B1 R'),

- ledit au moins un niveau de redondance de la seconde section de fonctionnement (6, 6L, 6R) est disposé sur la conduite d'alimentation en fluide sous pression et est conçu pour assurer, lors de l'occurrence de la condition de déclenchement, la prévention de l'écoulement d'un fluide à partir de l'orifice d'alimentation en fluide (P') vers le second orifice (A1', A1 L', A1 R').

4. Dispositif de commande selon la revendication 1 ou 2 ou 3, dans lequel :

- la première section de fonctionnement (5) comprend en outre un autre niveau de redondance défini sur la conduite d'évacuation,

- la seconde section de fonctionnement (6, 6L, 6R) comprend un autre niveau de redondance défini sur la conduite d'évacuation.

5. Dispositif de commande selon l'une quelconque des revendications 1 à 4, dans lequel l'élément d'entraînement d'actionneur (VA09, VA09L, VA09R) est conçu pour fonctionner au moins entre :

- une condition dans laquelle il permet le passage d'un fluide sous pression à partir de l'orifice d'alimentation en fluide (P') sous pression vers le premier orifice, (B1', B1L', B1 R') de sorte que le fluide sous pression entre dans une première chambre (11) définie à l'intérieur du corps de boîte (8) de l'actionneur, (7, 7L, 7R) et le passage d'un fluide à partir du second orifice (A1', A1L', A1R') vers l'orifice d'évacuation (T') de fluide, de sorte que le fluide à évacuer s'écoule à partir d'une seconde chambre (12) définie à l'intérieur du corps de boîte (8) de l'actionneur (7, 7L, 7R) vers l'orifice d'évacuation (T') de fluide,

- une condition dans laquelle il permet à la fois le passage d'un fluide sous pression à partir de l'orifice d'alimentation en fluide (P') sous pression vers le second orifice (A1', A1L', A1 R'), de sorte que le fluide sous pression entre dans la seconde chambre (12), et le passage de fluide à partir du premier orifice (B1', B1L', B1R') vers l'orifice d'évacuation (T') de fluide, de sorte que le fluide à évacuer s'écoule à partir de la première chambre (11) vers l'orifice d'évacuation (T') de fluide.

6. Dispositif de commande selon la revendication 4 ou la revendication 5 lorsqu'elle dépend de la revendication 4, dans lequel le niveau de redondance et l'autre niveau de redondance de la première section de fonctionnement (5) comprennent une paire respective de soupapes (VA01-VA04) redondantes.

7. Dispositif de commande selon l'une quelconque des revendications précédentes, dans lequel chaque niveau de redondance comprend une paire de soupapes (VA01-VA08) redondantes, dans la fonction de sécurité, chaque soupape (VA01-VA04) de chaque paire de soupapes redondantes de la première section de fonctionnement (5) étant conçue pour permettre à un fluide de s'écouler à travers elle et chaque soupape (VA05-VA08) de chaque paire de soupapes redondantes de la seconde section de fonctionnement (6) étant conçue pour empêcher un fluide de s'écouler à travers elle dans une direction,
optionnellement, dans lequel les soupapes redondantes peuvent être commandées par une unité de commande d'un système ou d'une machine à laquelle le dispositif de commande (1) est relié ou peut être relié.

8. Dispositif de commande selon l'une quelconque des revendications 1 à 6, dans lequel l'élément d'entraînement d'actionneur (VA09, VA09L, VA09R) fait fonctionnellement partie d'au moins l'une des première et seconde sections de fonctionnement, l'élément d'entraînement d'actionneur (VA09, VA09L, VA09R) contribuant à assurer la redondance d'au moins un niveau de redondance des première et/ou seconde sections de fonctionnement (5, 6).

9. Dispositif de commande selon l'une quelconque des revendications 1 à 5 ou selon la revendication 7, dans lequel l'élément d'entraînement d'actionneur (VA09, VA09L, VA09R) est conçu pour passer à une condition de sécurité intégrée, la condition de sécurité intégrée contribuant à la redondance dudit au moins un niveau de redondance.

10. Dispositif de commande selon l'une quelconque des revendications 1 à 5 ou selon la revendication 8 ou 9, dans lequel l'élément d'entraînement d'actionneur (VA09, VA09L, VA09R) fait fonctionnellement partie à la fois de la première section de fonctionnement (5) et de la seconde section de fonctionnement (6, 6L, 6R) et contribue à assurer chaque niveau de redondance de la première section de fonctionnement (5) et chaque niveau de redondance de la seconde section de fonctionnement (6, 6L, 6R).

11. Dispositif de commande selon l'une quelconque des revendications précédentes, dans lequel :

- chaque niveau de redondance comprend une soupape (VA01, VA02, VA05, VA06, VA05L, VA05R, VA06L, VA06R) conçue pour empêcher le passage d'un fluide dans des conditions d'anomalie et/ou d'urgence et la commande d'entraînement d'actionneur (VA09, VA09L, VA09R) conçue pour prendre une condition de sécurité intégrée et/ou

- chaque niveau de redondance prévoit, dans une condition d'anomalie et/ou d'urgence, que la soupape (VA01, VA02, VA05, VA06, VA05L, VA05R, VA06L, VA06R) empêche le passage d'un fluide et/ou que l'élément d'entraînement d'actionneur (VA09, VA09L, VA09R) prenne les conditions de sécurité intégrée, dans lesquelles il empêche le passage d'un fluide.

12. Système hydraulique (100), comprenant :

- un circuit hydraulique associé à une source de fluide sous pression (P) et à une évacuation de fluide (T),

- au moins un actionneur (7, 7L, 7R) associé au circuit hydraulique et comprenant un corps de boîte (8) tel qu'un cylindre et une tige (9) pouvant se déplacer par rapport au corps de boîte (8), l'actionneur (7, 7L, 7R) étant conçu pour déplacer une masse (M) déplaçable,

- un dispositif de commande (1) selon l'une quelconque des revendications précédentes, le dispositif de commande étant relié à l'actionneur (7, 7L, 7R) au niveau de la section de liaison (3) et au circuit hydraulique au niveau de la section d'alimentation/évacuation (2),

le système (100) étant conçu pour détecter une condition de déclenchement et pour mettre en oeuvre une fonction de sécurité par le dispositif de commande (1) suite à la détection de ladite condition de déclenchement, la condition de déclenchement étant une condition d'anomalie et/ou d'urgence par exemple due ou liée au circuit hydraulique ou à l'actionneur (7, 7L, 7R) ou au dispositif de commande (1) lui-même.

13. Système hydraulique selon la revendication 12, comprenant en outre une unité de commande conçue pour détecter la condition de déclenchement,

l'unité de commande étant conçue pour :

- détecter la condition de déclenchement,

- déclencher la fonction de sécurité par le dispositif de commande (1),

optionnellement, dans lequel l'unité de commande est conçue pour communiquer la condition de déclenchement détectée au dispositif de commande (1) de sorte que le dispositif de commande (1) déclenche la fonction de sécurité.

14. Système hydraulique selon la revendication 12 ou 13, comprenant une machine conçue pour être actionnée, au moins partiellement hydrauliquement, telle qu'une calandre ou une presse, la machine comprenant au moins ledit actionneur (7, 7L, 7R).

15. Procédé de commande d'au moins un actionneur hydraulique (7, 7L, 7R), l'actionneur étant disposé dans ou associé à un circuit hydraulique et ayant un corps de boîte (8) tel qu'un cylindre et une tige (9) pouvant se déplacer par rapport au corps de boîte (8), le corps de boîte (8) étant pourvu d'une première chambre (11) et d'une seconde chambre (12), l'actionneur (7, 7L, 7R) étant conçu pour déplacer une masse (M) déplaçable, le procédé comprenant les étapes consistant à :

- fournir un dispositif de commande (1) selon l'une quelconque des revendications 1 à 11,

- relier le dispositif de commande (1) à l'actionneur par la section de liaison (3),

- détecter une condition de déclenchement, la condition de déclenchement étant une condition d'anomalie et/ou d'urgence par exemple due ou liée au circuit hydraulique ou à l'actionneur (7, 7L, 7R) ou au dispositif de commande (1) lui-même,

- suite à la détection de la condition de déclenchement, mettre en oeuvre une fonction de sécurité par le dispositif de commande (1),

l'étape consistant à mettre en oeuvre une fonction de sécurité par le dispositif de commande (1) comprenant :

- la fourniture d'un fluide sous pression à la première chambre (11) de l'actionneur (7, 7L, 7R), ladite étape comprenant le fait d'amener le fluide sous pression à s'écouler dans la conduite d'alimentation en fluide sous pression à travers la première section de fonctionnement (5) et, en aval de la première section de fonctionnement (5), à travers ledit premier orifice (B1', B1L', B1 R'),

- l'évacuation d'un fluide sous pression de la seconde chambre d'actionneur (7, 7L, 7R), ladite étape comprenant le fait de faire s'écouler le fluide dans la conduite d'évacuation au moins à travers la première section de fonctionnement (5) et, en amont de la première section de fonctionnement (5), à travers ledit second orifice (A1', A1 L', A1 R'),

- la rétraction de la tige (9) à l'intérieur du corps de boîte (8),

- le fait d'assurer la rétraction de la tige (9) par lesdits niveaux de redondance des première et seconde sections de fonctionnement (5, 6),

optionnellement, dans lequel l'étape consistant à mettre en oeuvre une fonction de sécurité par le dispositif de commande (1) comprend la prévention de l'écoulement d'un fluide à travers l'élément d'entraînement d'actionneur (VA09).

Drawing