INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT)

(51) International Patent Classification 4 (11) International Publication Number: WO 87/ 024 F15B 11/22, 13/06 Al (43) International Publication Date: 23 April 1987 (23.04.

(21) International Application Number: PCT/US86/02219 (74) Agent: WILLIAMSON, Harold, A ; 4751 Harris Avenue, P.O. Box 7003, Rockford, IL 61125 (US).

(22) International Filing Date: 20 October 1986 (20.10.86)

(81) Designated States: AT (European patent), BE (Eu

(31) Priority Application Number: 789,456 pean patent), CH (European patent), DE (Europ patent), FR (European patent), GB (European

(32) Priority Date : 21 October 1985 (21.10.85) tent), IT (European patent), JP, LU (European tent), NL (European patent), SE (European paten

(33) Priority Countr : US

Published

(71) Applicant: SUNDSTRAND CORPORATION [US/ With international search report.

US]; 4751 Harrison Avenue, P.O. Box 7003, Rock¬ Before the expiration of the time limit for amending ford, IL 61.125 (US). claims and to be republished in the event of the rec of amendments.

(72) Inventors: DURTSCHI, William, G. ; 2197 Arnold Ave¬ nue, Rockford, IL 61108 (US). DSCHIDA, Linda, M. ; 8572 Valley View Drive, Stillman Valley, IL 61084 (US). LANG, David, J. ; 3426 New England Drive, Rockford, IL 61108 (US).

(54) Title: FAULT DETECTOR FOR A TRIPLEXED MECHANICAL OR HYDROMECHANICAL SYSTEM

(57) Abstract

A fault detector for a triplexed mechanical or hy- dromechanical system has a tripodal summing member (10, 60) which receives three mechanical position signals (18, 20, 22, 61-63) in three different channels with the tripodal summing member retaining a position per¬ pendicular to the force transmitted by the tripodal summing member (60) in re¬ sponse to the position sig¬ nals and tipping when one of the input signals deviates significantly from the other two. A structure (31, 90-96) for detecting a malfunction senses a greater amount of movement of the tripodal summing member at its connection to the mechani¬ cal position signal which is malfunctioning to provide an indication as to which mechanical position signal is faulty. In sponse to detection of the faulty operation, a mechanism (78, 83) disconnects the channel having the faulty operation. alignment structure (160) is operable to restore the tripodal summing member to its normal perpendicular position to able continued operation by means of the mechanical position signals which are still accurate.

FOR THE PURPOSES OF INFORMATION ONLY

Codes used to identify States party to the PCT on the frontpages ofpamphlets publishing international appli- cations under the PCT.

AT Austria FR France ML Mali

AU Australia _ GA Gabon MR Mauritania

BB Barbados GB United Kingdom MW Malawi

BE Belgium HU Hungary NL Netherlands

BG Bulgaria IT Italy NO Norway

BJ Benin JP Japan RO Romania

BR Brazil KP Democratic People's Republic SD Sudan

CF Central African Republic of Korea SE Sweden

CG Congo KR Republic of Korea SN Senegal

CH Switzerland LI Liechtenstein SU Soviet Union

CM Cameroon LK Sri Lanka TD Chad

DE Germany, Federal Republic of LU Luxembourg TG Togo

DK Denmark MC Monaco S United States of America

FI Finland MG Madagascar

FAULT DETECTOR FOR A TRIPLEXED MECHANICAL OR HYDROMECHANICAL SYSTEM

Description

Technical Field

This invention pertains to a fault detector for a triplexed mechanical or hydromechanical system which provides redundant two-channel operation in order to achieve continuing operation after a failure in one channel. There are many requirements for such a system, particularly in the operation of aircraft components in order to assure continued operation even after failure of one channel.

Background Art A typical way of accomplishing continued ^' operation of an aircraft component, after failure of one operating mechanism is by the use of a quadruplexed system in which two sets of two signals are used. ^• Each output signal representing a desired output position constitutes a channel of operation and the output sig¬ nals of the two channels of one set of signals are mechanically compared by a balance beam arrangement. If the balance beam tips representing a disagreement between the two output position signals, a failure is indicated. There is no way to discriminate which of the two channels is not operating properly and, . therefore, both channels must be considered to be in error and must be shut down or bypassed. Redundant operation can still occur, since this leaves the other set of two output signals operating as two channels still operating. The disadvantage of this

quadruplexed system is that it is always necessary to shut down two channels of operation anytime a fault is indicated, which shuts down one-half of the system. Anothef consequence of this approach is that four sets of hardware are required, with resulting impact on cost as well as reliability and weight which are impor¬ tant factors in aircraft use.

The foregoing prior art does not disclose a system wherein three mechanical output signals of three separate channels can be compared to enable an improperly operating channel to be identified and shut down or bypassed. This leaves two operative channels with resulting improvement in system reliability, cost and weight over a quadruplexed system. The estbury et al. Patent No. 3,411,410 discloses position control servo systems- using a tri- ■podal force-transmitting member rig ^' idly connected to three actuating pistons for the member. Faulty opera¬ tion of one of the actuating pistons is detected by sensing elements associated, one with each of the actuating pistons which are connected to three legs of a three-armed lever 14 constituting an averaging member and which is pivotally mounted at a central ball carried by a fixed reactor member. Faulty operation of one of the actuating pistons results in tipping movement of the three-armed lever 14, to result in differential movement of members associated therewith to indicate the actuating piston which is not operating properly. The three-armed lever is not connected into the system to be a force-transmitting member for trans¬ mitting the output position signals from the actuating pistons to an element to be positioned by the output signals.

-3-

The Stevko Patent No. 3,762,237 discloses a- digitally-controlled linear actuator having a tripodal _ summing device in the form of a spider assembly having three legs, each of which can receive an output posi- tion signal and transmit these signals to an output member pivotally connected to the spider assembly at a location interiorly of the three locations at which the output signals are applied and which define the apices of a triangle. The prior art does not disclose a fault detector for a triplexed mechanical or hydromechanical system wherein: three output position signals in three separate channels are applied to a tripodal summing member pivotally connected to a force- transmitting member for positioning an operating device; the failure in one output position signal is evi¬ denced by tipping of the tripodal summing member to give an indication as to ^' which output position signal is incorrect; and through the use of appropriate de- tecting structure, the channel providing the deviant output; position signal can either be shut down or by¬ passed and continued redundant operation is carried out by the remaining two channels each having an output position signal which is accurately delivered to the tripodal summing member.

Disclosure of the Invention

A primary feature of the invention is to provide a fault detector for a triplexed mechanical or hydromechanical system wherein three separate output position signals in three separate channels are ap¬ plied to a pi .oted tripodal summing member, with the tripodal summing member transmitting the signals to a

device to be operated and with a failed or inaccurate output position signal resulting in tipping of the tri¬ podal summing member which is sensed by detecting means to initiate appropriate action, such as disconnecting or bypassing the channel which is delivering the in- - accurate output position signal. Means are also provided to permit continued operation using the two output position signals from the remaining two channels after bypass or disconnection of the faulty channel.

In accomplishing the foregoing, the triplexed mechanical or hydromechanical system provides for force-summing three output position signals applied to a tripodal summing member at three locations defining the apices of a triangle and the tripodal summing mem¬ ber is pivotally connected to a force-transmitting mem¬ ber, at a location within the interior, of the triangle defined by the three apices. When the output position signals are all equal, the fo ^' rce-summing member is moved without pivoting to cause movement of the force- transmitting member and the tripodal umming member remains in a perpendicular relation to the force- transmitting member. If there is a failure or in¬ accuracy in one of the output position signals, the tripodal summing member will pivot from its position perpendicular to the force-transmitting member and the connection thereof to the faulty channel having the faulty output position signal will be displaced twice as far as the connections to the two remaining channels which each have one of the correct output position signals. The greater displacement is sensed to operate a device, such as a valve, which may disconnect or by¬ pass the faulty channel. Additionally, means are pro¬ vided for restoring the tripodal summing member to its

position perpendicular to the force-transmitting mem¬ ber and locking the tripodal summing member in such position to enable continued redundant operation by the remaining two channels having, the two accurate output position signals.

An object of the invention is to provide a new and improved triplexed mechanical or hydro¬ mechanical system having a fault detector associated therewith wherein redundant operation is provided by force-summing three output position signals in each of three channels by a summing member which transmits the output position signals to a device to be operated and with the three output position signals being spaced about a ball or swivel-type joint for the summing member, whereby the lack of, or inaccuracy of one of, the three output position signals can be sensed by resultant tipping of the summing member and appropriate action taken to remove the inoperative or inaccurate channel from operation. Still another object of the invention is to provide a system as defined in the preceding paragraph wherein the summing member can be restored to operative position after movement which detects a faulty channel and held in operative position whereby there can be continued operation of the system from the remaining output position signals applied to the summing member in the remaining two channels.

Another object of the invention is to provide a fault detector for a triplexed actuation system having three mechanical inputs comprising, a movable summing member having a pivotal connection to said three inputs at spaced-apart locations, a force- transmitting member pivotally connected to said summing member for transmitting an output responsive to

movement of the summing member, and means for detecting the position of the summing member when the three me¬ chanical inputs are not applied equally to the summing member. Still another object of the invention is to provide a fault detector for a triplexed actuation system having three separate input movements comprising, a movable summing member, means acting on said movable summing member at three spaced locations to apply said input movements individually one at each location to the summing member, a force-transmitting member extending from said summing member at a location within a perimeter defined by said locations and having a pivotal engagement with the summing member, and means for detecting when the summing member is moved by less than three of said input movements or when said input movements are not of equal magnitude.

An additional object of the invention is to provide a fault detector for a triplexed hydromechani- cal system having three mechanical position signals comprising, a pair of hydraulic valves having their valve members in spaced-apart alignment and connected together by a connecting member, a summing plate posi¬ tioned between said hydraulic valves and having a swivel connection interiorly thereof to said connect¬ ing member, three members pivotally connected to said summing plate at spaced-apart locations defining apices of a triangle, three independent actuators con¬ nected one to each of said members to provide said three mechanical position signals to said summing plate, feedback means between said actuators and said hydraulic valves, and means associated with the feed¬ back means for detecting when a hydraulic valve has not operated in accordance with the operation of the

associated actuator for disabling the associated actuator.

Brief Description of the Drawings Fig. 1 is a schematic elevational view of one embodiment of the fault detector for a triplexed mechanical system;

Fig. 2 is a side elevational schematic of the mechanism shown in Fig. 1; Fig. 3 is a graphic illustration of a fault- detecting movement of the mechanism shown in Figs. 1 and 2;

Fig. 4 is a hydraulic schematic of a triplexed hydromechanical system having the fault detector; and

Fig. 5 is a perspective, fragmentary view on an enlarged scale showing the locking mechanism for the tripodal summing member.

Best Modes for Carrying Out the Invention

A first embodiment of the invention is shown in Figs. 1 to 3 which disclose schematically a tri¬ plexed mechanical system having a fault detector. A movable summing member 10, in the form of a tripodal summing plate, is pivotally associated with a force- transmitting member 12 through a force-transmitting connection provided by a ball joint 14 and with the output motion being transmitted through an output member 16 integral with the force-transmitting member 12. . ^*

The tripodal summing plate 10 receives three mechanical signals from three separate channels through input links 18, 20 and 22 which are pivotally

- 8-

connected to the tripodal summing plate by ball ^' joints 23 and 24 as shown. for the input links 18 and 22 in Fig. 2. The input links connect to the tripodal summing plate at three locations which define the apices of a triangle and with the ball joint 14 disposed in¬ teriorly thereof. Forces delivered to the tripodal summing plate 10 from the three input links are summed by the tripodal summing plate 10 and transmitted through the ball joint 14 to the force-transmitting member 12 and the output member 16. During normal operation, the mechanical input signals are equal and, as a result, the tripodal summing plate 10 remains parallel to the force-transmitting member 12 and per¬ pendicular to the direction of the transmitted force. When one of the mechanical input signals deviates from the other two, the tripodal summing plate 10 is caused to tip or pivot about the ball joint 14 from the previously-mentioned perpendicular position. _ This movement results in generation of a fault signal by linkage associated with the tri¬ podal summing plate 10 and the force-transmitting member 12. There are three sets of fault-detecting linkage associated one with each input link.

The fault-detecting linkage associated with the input link 18 includes a pair of normally parallel links 25 and 26 pivotally connected at one of their ends to the tripodal summing plate 10 and the force- transmitting member 12, respectively. The link 26 is pivotally and movably mounted by means of a roller 27 movably mounted in a track 28 fixed to a frame. Interiorly of their ends, the links 25 and 26 are pivotally interconnected by a link 29. The other end of the link 25 is pivotally connected at 30 to a fault signal output link 31.

Each of the input links 20 and 22 has a similar fault-detecting linkage structure and with the structure associated with the input link 22 being seen in Fig. 2 and given the same reference numerals as the fault-detecting linkage associated with the input link 18, with a prime affixed thereto.

When one mechanical input signal deviates from the other two, the displacement of the fault signal output link 31 associated with the particular input link giving the faulty signal is twice that of the corresponding fault signal output links asso¬ ciated with the other two input links. This enables a detection of the difference in displacements and provides an indication as to which mechanical input signal is faulty and enables proper disconnection or bypassing of the channel having the faulty input signal. This action is illustrated in Fig. 3 which graphically illustrates a portion of the ^" structure shown in Fig. 2 in normal position in full line and in a fault-sensing position in broken line. Assuming the mechanical input signal delivered by the input link 18 is faulty and deviates from the mechanical inputs of the input links 20 and 22, the tripodal summing plate 10 will tip about a datum A to a position which may typically be illustrated by the broken line showing in Fig. 3. The link 25 pivots through a greater arc than the link 25' and, thus, there is a greater shift of the pivot connection 30 and the fault signal output link 31 than there is of the pivot -connection 30' and the fault signal output link 31' as well as the fault signal output link associated with the input link 20.

In the event the faulty input signal is delivered by one of the other input links 20 and 22, there is a different datum about which the tripodal summing plate 10 pivots. However, there is still the

similar result, in that the fault signal output link associated with a particular input link providing the faulty signal will move twice as far as the other two fault signal output links. The principles embodied in the fault de¬ tector for a triplexed mechanical system can also be embodied in a triplexed hydromechanical system which is shown in the embodiment of Figs. 4 and 5.

The hydromechanical system has a pair of main control valves, indicated generally at 40 and 41, forming parts of two separate hydraulic power systems having their own hydraulic supply and return lines and for controlling the connection of the supply and return lines with a pair of control fluid lines. A first of the hydraulic power systems has a- pair of supply lines 42 and 43 connected to a source of hydraulic fluid under pressure, with the supply line 43 connected to the main control valve 40. A return line 44 connects to a main control valve 40 through a line 45 and the main control valve 40 has a valve mem¬ ber 46 positionable to control communication of a pair of control lines 47 and 48 with supply and return. There is similar structure in the second hydraulic power system, with supply lines 50 and 51 connected to a source of hydraulic fluid under pres¬ sure and the supply line 51 connected to the main control valve 41. A return line 52 connects to the main control valve 41 through lines 53 and 53a and a valve member 54 of the main control valve 41 is posi- tionable to control the communication of the supply and return lines with a pair of control fluid lines 55 and 56.

The valve members 46 and 54 of the main con¬ trol valves 40 and 41 are in spaced-apart, aligned relation and connected by a force-transmitting member 58 in the form of a rod having a ball joint 59- pivotally mounting a tripodal summing plate 60. Three input links 61, 62 and 63 are pivotally connected at one of their ends to the tripodal summing plate 60 in a manner corresponding to the pivotal connection of the input links 18, 20 and 22 in the embodiment of Figs. 1 to 3. These input links provide mechanical input signals to the tripodal summing plate as caused by their con¬ nection to spool actuators 65, 66, and 67 of three separate electro-hydraulic servo valves 70, 71 and 72, respectively. Hydraulic power is provided to the electro- hydraulic servo valves 70 and 71 by the first hydraulic power system and to the electro-hydraulic servo valve 72 by the second hydraulic power system. More particu¬ larly, the electro-hydraulic servo valves 70 and 71 are connected to supply through respective lines 75 and 76 which communicate with a line 77 communicating with the supply line 42 through a shutoff valve, indicated generally at 78. The electro-hydraulic servo valves 70 and 71 are connected to return by means of return lines 79 and 80, respectively.

The electro-hydraulic servo valve 72 is con¬ nected with supply line 50 by means of a line 82 with the communication therebetween being controlled by a shutoff valve, indicated generally at 83. This electro- hydraulic servo valve connects to return by means of a return line 84.

During normal operation, electrical analog command signals are applied to each of the three electro- hydraulic servo valves 70-72 which are of a co mercially- available jet pipe type and which operate in the known

manner to direct hydraulic power to either side of a respective spool 85, 86 and 87 of the spool actuators 65-67. A pressure difference at opposite sides of the spools results in movement of the spool actuators with an internal feedback operating to maintain the new po¬ sition of the spool actuator once the commanded posi¬ tion is reached.

In the arrangement seen in Fig. 4, the command signals applied to the electro-hydraulic servo valves would cause movement of the spool actuators 85 and 86 in the same direction, for example, to__the right as viewed in Fig. 4 and cause movement of the spool actuator 67 also to the right. With proper analog command signals applied to the electro-hydraulic servo valves from a controller and with these valves operating properly, there will be uniform movement of all three spool actuators and, therefore ^" , movement of the tripodal sum¬ ming plate 60 toward the right, in the example given. In this operation, both of the valve members 46 and 54 of the main control valves 40 and 41 will be shifted equally toward the right, with the movement being that of the tripodal summing plate 60 which is the same as the movement of any one of the spool actuators. The summing plate is positioned perpendicular to the main control valves and to the path of travel of the con¬ necting' member 58 and remains so oriented.

There is a mechanical feedback linkage between each of the spool actuators and the valve member of the associated main control valve. This mechanical feedback linkage between the electro-hydraulic servo valve 70 and the" valve member 46 includes a link having arms 90 and 91 with the arm 90 pivotally connected to the valve member 46 at a pivot connection 92 therebetween and with the parts shown separated by a broken line for illustra- tive purposes. A link 93 is pivotally connected to the

spool actuator 65 at one end and at its other end is pivotally connected at 94 to the link having the arms 90 and 91. The arm 91 has a pin 95 movable within a slot 96 in a failure detection piston 112 to a position either side of that shown in Fig. 4 for a purpose to be described. Feedback linkage between the spool actuator 66 and the valve member 46 is of the same construction as just described and with an arm 97 having a pin 98 movable in a slot 99 in a failure detection piston 121. The spool actutor 67 has a feedback linkage associated with the valve member 54 of the same con¬ struction as described, including an arm 100 having a pin 101 movable in a slot in a failure detection piston 106. In Fig. 4, the arms 91, 97 and 100 and asso¬ ciated pins are shown at two locations as indicated by broken lines to enable a clear showing of failure detection pistons 106, 112 and 121. When one of the spool actuators 65, 66, 67 does not move to the same extent that the other spool ^' actuators move, there will be tipping of the tripodal._summing plate 60 as described in connection with the embodiment of Figs. 1 to 3 and, as a result, there will not be movement of the valve members 46 and 54 equalling the movement of the spool actuators. As described in connection with Fig. 3, the summing plate 60 will have greater movement at the location of the faulty input and this will re¬ sult in a greater movement of one of the pins 95, 98, 101 to thus provide detection means for signalling a malfunction of an actuator.

Assuming the spool actuator 67 has failed to operate properly, the extent of movement of the pin 101 in the slot 100 will operate the failure detection piston 106 which will connect the supply line 50 to the return line 52 by opening a line 108 extending between

the supply line 50 and the failure detection piston 106 to the return line through either of a pair of lines 109 or 110.

If the failure is associated with the spool actuator 65, the greater movement is of the pin 95 to operate the failure detection piston 112 to connect the supply line 42 to the return line 44 through a line 114 extended between the line 42 and the failure detection piston 112, with the latter controlling the connection to return line 44 through either passage 115 or 116.

The pin 98 connects to the failure detection piston 121 which similarly to the failure detection piston 112 functions, to connect the return line 114 to the return line 44 when the pin 98 has moved a distance indicating malfunctioning of the spool actuator 66. The shutoff valves 78 and 83 have both an open position and a lock position, with the open posi¬ tion thereof shown for shutoff valve 83 and the shutoff valve 78 being shown in the lock position. In the open position, as shown for shutoff valve 83, supply pressure from supply line 50 is in lines 125 and 126 extending to the shutoff valve and there can be flow from line 126 through the shutoff valve to line 82 to provide supply fluid to the electro-hydraulic servo valve 72. With respect to shutoff valve 78, there are supply lines 127 and 128 extending from supply line 42 to the shutoff valve and, when in the open position, supply pressure passes through the shutoff valve 78 to the line 77 which communicates with lines 75 and 76 to deliver supply pressure to the electro-hydraulic servo valves 70 and 71 and also to a control piston 130 of a tripodal alignment valve, indicated at 131.

The tripodal alignment valve has an outlet line 132 extending to a port 133 of the main control valve 41 and also has a pair of line connections 135 and 136 to the line 82 extending from the shutoff valve 83 to electro-hydraulic servo valve 72 as well as a return line 137 connecting to the return line 52.

In normal operation, both of the shutoff valves 78 and 83 are in open position whereby all the electro-hydraulic servo valves are provided with supply pressure and the tripodal alignment valve 131 has its valve member 140 in the position shown because of supply pressure acting on the area of piston 130 which is larger than the end of the valve member 140 exposed to supply pressure through the line 136. As a result, supply pressure in line 82 is directed to the port 133 of the main control valve 41 through lines .132 and 135 'to hold inoperative certain mechanism which can be brought into operation to restore the tipped summer plate 60 to- the perpendicular position shown in Fig. 4.

Assuming either of the failure detection pistons 112 or 121 are operated, supply pressure in the first hydraulic power system is ported to the return line 44 and a valve member 141 of the shutoff valve 78 is caused to move to the lock position shown in Fig. 4. The valve member 141 moves as a result of the action of a spring 141a acting on the valve member 14.1 as well as a force resulting from fluid pressure in a chamber 142 acting on the end of the valve member and supplied from the supply line 127 through an internal passage in the valve member. The shift is a snap action because of the combination of pressure and spring force and the connection of line 114 to the return line 44 which immediately releases pressure from a chamber 143 which acts on the opposite end of the valve member. Pressure

is substantially maintained in the supply line 127 because of the orifice 144. With supply pressure cut off to the line 77 extending from the shutoff valve 78, there is a gradual bleeding of pressure acting on the control piston 130 of the tripodal alignment valve 131 by bleeding through electro-hydraulic servo valves 70 and 71 whereby the valve member 140 of the tripodal alignment valve can shift to the left under the urging of pressure in line 136 as well as a spring 146. As

10 a result, the line 132 is blocked from supply pressure in line 135 and is connected to line 137 extending to the return line 52 to bleed pressure at the port 133 of the main control valve.

A shutoff valve interlock rod 150 is asso-

15 ciated with a piston 151'and is- normally held inactive by pressure extended to the underside of the piston 151 from the line 77 and with the upper side thereof being supplied with pressure from line 127 through the shut¬ off valve and a passage 152. When the shutoff valve 78

-® shifts to lock position, the underside of the piston 151 is connected to return by bleeding through the electro - hydraulic servo valves with pressure remaining on the upper side of the piston whereby the interlock rod 150 can move into a groove on the stem of the

- ~~ valve member and lock the shutoff valve in lock posi¬ tion. This movement of the valve member 141 of the shutoff valve activates a failure monitor switch 155.

The foregoing operation has disabled the electro-hydraulic servo valves 70 and 71 in the first 0 hydraulic power system, while the main control valves 40 and 54 still remain operable under the control of the spool actuator 67. This must occur with the tri¬ podal summing member 60 held against tilting movement and this is achieved by structure shown in Fig. 4 and,

more particularly, in Fig. 5. This mechanism includes an alignment disc 160 urged against the summing plate 60 b Belleville springs 161 acting against a member 164 fixed to the connecting member 58. In normal opera- tion, the alignment disc 160 is held away from the summing plate 60 by fluid pressure acting in an annular chamber 162 and which is delivered thereto from the port 133 of the main control valve 41 by flow into an internal passage of the valve member 54. The annular chamber 162 is defined by a flange 165 formed on a tubu¬ lar extension 166 of the alignment disc 160 and a ring 167 keyed into an annular groove in the connecting mem¬ ber 58. When the tripodal alignment valve 131 shifts to connect line 132 to the return line 52, pressure is bled from this chamber and the Belleville springs 161 are effective to urge the alignment disc 160 against the summing plate 60 and bring it to the perpendicular posi¬ tion. This action is assisted by spring means 165, shown in Fig. 4. Referring .back to the shutoff valves 78 and

83, the shut off action of the shutoff valve 78 has been described and, when the latter valve is in the lock position, shown in Fig. 4, there is abutment with the valve member of the shutoff valve 83 to assure that it stays in open position.

Assuming the detecting means associated with the spool actuator 67 operates the failure detection piston 106 when both shutoff valves are in open posi¬ tion, there is a connection of the line 108 to the return line 52, with resulting shift of the shutoff valve 83 to lock position with a valve member 170 thereof moving to the left with a snap action, as previously described in connection with the shutoff valve 78. A shutoff valve interlock 171 is operative

and also a failure monitor switch 172. When this occurs, there is a bleed-off of line 132 through the electro-hydraulic servo valve 72, whereby pressure is removed from the chamber 162 of the alignment-mechan- ism for the summing plate 60 whereby the summing plate can be brought to the perpendicular position for con¬ tinued operation under positioning control of the spool actuators 65 and 66 associated with electro-hydraulic servo valves 70 and 71. The valve members 141 and 170 of the shutoff valves 78 and 83 are related mechanically so that one valve is open when the other is in lock position.