System and method for in-situ verification of redundant electro-hydraulic servo valve (EHSV) operating state in redundant flow control system

Abstract

A system and method for in-situ verification of an operating state of a control component in a redundant flow control system is provided. The flow control system includes a primary electro-hydraulic servo valve (EHSV) and a secondary EHSV. Only the primary EHSV includes a position sensor. The redundant EHSV is coupled via a change-over valve to control the position of a metering valve that supplies fluid flow to at least one downstream system. The downstream system may be, for example, a combustion chamber, an actuator, an end effector, or a combination thereof.

Description

Technical Field

[0001] The present invention is mainly related to redundant flow control systems for aerospace applications, and more particularly to systems and methods for in-situ verification of their operating states. Background Art

[0002] Reducing the adverse system effects from component failures and the ability to continue operation under such failures are important design considerations in many industries, and particularly so for aerospace applications. Therefore, depending on the criticality of the continued safe operation of a particular system, engineers carefully incorporate redundancy into critical components in such system designs and perform failure mode and effect analyses during such design phases to evaluate the potential impacts of such failures.

[0003] While such considerations during the design process and including redundant critical components and systems effectively reduce the interruption to system operation when component failures occur during operation, it is also important for many systems to ensure that these systems (primary and backup systems) are operational before putting them into use. In fact, for some systems, it is desirable to detect possible or impending failures during the operation of the system so that such interruptions can be completely avoided. For such systems, engineers typically include built-in test (BIT) circuits and / or logic in their designs. Such BIT circuits and / or logic can perform system tests upon power-up to ensure operational integrity and thereafter frequently monitor system operation so that if a failure is detected thereafter, personnel are warned and / or operation is adjusted.

[0004] One problem with including BIT circuits (especially for aerospace applications) is that the additional circuits and sensors add additional weight and require additional space for the system. Since every additional pound of weight on an aircraft increases fuel consumption and reduces cargo capacity, engineers need to keep the weight and size of the entire system as small as possible. To avoid including additional sensors, some industries implement BIT by using actual system components to ensure the operating state.

[0005] Unfortunately, for some aerospace systems, especially those related to fuel control of engines, it is impossible to use actual system components to test their operating states. This is because using such system components would result in actual fuel flowing into the engine combustion chamber before flight. In addition, since such fuel systems are typically used to provide hydraulic pressure to position certain actuators and end effectors on the aircraft (such as flight control surfaces), using such components would also cause the actuation and movement of such actuators and end effectors, which may be undesirable since maintenance or flight personnel may be present.

[0006] In fact, a typical multi-stage gas turbine fuel system (such as the system described in U.S. Patent No. 7,096,658 to Wernberg et al., entitled "Centrifugal Pump Fuel System and Method for a Gas Turbine" and assigned to the assignee of the present application, hereinafter referred to as the "'658 patent", the teachings and disclosures of which are hereby incorporated by reference in their entirety herein) utilizes a single fuel metering unit (FMU) to meter fuel flowing to the combustor of the engine, for example, to power an aircraft. The FMU typically includes a single primary reliable fuel metering valve (FMV). The FMV may include a dual-channel linear variable differential transformer (LVDT) to provide feedback of the fuel metering valve position for both control and BIT monitoring during operation. A full-authority digital electronic controller (FADEC) uses the position of the FMV to regulate the metered fuel flow. The FADEC positions the FMV by supplying an electrical signal to an electro-hydraulic servo valve (EHSV), which provides a hydraulic muscle to adjust the FMV to the desired position.

[0007] To provide redundancy for the fuel control as discussed above, the primary fuel metering system utilizes redundant EHSV to control the FMV of the FMU. To provide such redundancy, a switching system including a switching valve is included to allow the FADEC to select which of the two redundant EHSVs to use to control the FMV. In the event of a failure of the EHSV in control, the FADEC can send a signal to the switching system to switch control to the secondary EHSV via the switching valve, thereby maintaining control of the FMV so that fuel continues to flow to the engine and the actuators / end effectors powered thereby.

[0008] Given the critical control functions provided by these redundant EHSVs, it is very important to monitor their pre-flight functions and continuous operation during flight. While the position sensor for the primary EHSV used by the FADEC monitors the operation of the primary EHSV during flight, this does not ensure the pre-flight operating state (due to the possibility of fuel supply to the combustor and movement of the actuators / end effectors if used). Such an LVDT cannot also be used to determine the operating state of the redundant EHSV. A secondary LVDT can be added to this redundant EHSV for monitoring during flight and for use prior to flight to check its operating state. However, the increased weight and enclosure required for such an additional sensor are disadvantageous, especially since the fuel control system is designed to hopefully never use this redundant EHSV. Nevertheless, given the criticality of such redundant fuel control system components, it is desirable to know the operating state of each EHSV.

[0009] Accordingly, there is a need for a system and method for in situ pre-flight BIT verification of the operating status of redundant FMV EHSVs to ensure the primary reliability of the combustor metering system and / or the actuation system without adding undesirable cost, weight, size, and complexity. Embodiments of the present invention provide such a system and method. These and other advantages of the present invention, as well as additional inventive features, will become apparent from the description of the present invention provided herein. SUMMARY OF THE INVENTION

[0010] In view of the foregoing, embodiments of the present invention provide a new and improved system and method for verifying the operating status of redundant EHSVs in a fuel control system for a gas turbine. More specifically, embodiments of the present invention provide a new and improved system and method for in situ, pre-flight verification of the operating status of redundant EHSVs in a fuel control system for a gas turbine.

[0011] Such embodiments do not add undesirable cost, weight, size, and / or complexity to the system by requiring the operation of position sensors or other sensors that are not needed for control. Embodiments of the present invention provide such a system and method in which there is no possibility of pre-flight fuel supply to the combustor or actuation of the end effector during such operating verification.

[0012] In one embodiment, a method for in situ verification of the operating status of a control component in a redundant flow control system is provided, the redundant flow control system having a primary EHSV and a secondary EHSV, the primary EHSV and the secondary EHSV being coupled via a switching valve to control the position of a metering valve that supplies a fluid flow to at least one downstream system. The method includes the step of commanding the switching valve to couple the secondary EHSV to the metering valve. Thereafter, the method determines whether the downstream system has changed from a stationary state after commanding the switching valve to couple the secondary EHSV to the metering valve. When the step of determining whether the downstream system has changed from the stationary state is negative, the method commands the primary EHSV to move.

[0013] In this embodiment, if the primary EHSV moves after the step of commanding the primary EHSV to move, the method commands the switching valve to couple the primary EHSV to the metering valve and commands the secondary EHSV to move. If, after the step of commanding the secondary EHSV to move, the at least one downstream system has not changed from the stationary state, the method provides an indication of the operating status of the control component in the redundant flow control system.

[0014] In another embodiment, the method further includes the step of indicating a fault when it is determined that the step of whether the downstream system changes from the stationary state is yes. Another method indicates a fault when it is determined that the step of whether the primary EHSV moves is no after the step of commanding the primary EHSV to move. Another method indicates a fault when it is determined that the step of whether at least one downstream system changes from the stationary state is yes after the step of commanding the secondary EHSV to move.

[0015] In another embodiment, the method includes the step of determining whether the downstream system changes from the stationary state after the step of commanding the primary EHSV to move, and indicating a fault when it is determined that the step of whether the downstream system changes from the stationary state is yes after the step of commanding the primary EHSV to move. In another embodiment, when it is determined that the step of whether the downstream system changes from the stationary state is no after the step of commanding the primary EHSV to move, and it is determined that the step of whether the primary EHSV moves is yes after the step of commanding the primary EHSV to move, the method verifies that the switching valve is operable.

[0016] In another embodiment, the method further includes the step of verifying the operation of the closed-loop maintenance of the stationary state of the downstream system when it is determined that the step of whether the downstream system changes from the stationary state is no. One method further includes the step of verifying the operation of the primary EHSV and tracking the position of the primary EHSV when it is determined that the step of whether the primary EHSV moves is yes after the step of commanding the primary EHSV to move. Another method verifies the operation of the switching valve when it is determined that the step of whether the downstream system changes from the stationary state is no after the step of commanding the secondary EHSV to move.

[0017] In another embodiment, a redundant flow control system is provided. The system includes a control component, and the control component includes a primary electro-hydraulic servo valve (EHSV) and a secondary EHSV. It further includes a metering valve for supplying a fluid flow to the downstream system. A switching valve is included in the system, and the switching valve is configured to couple one of the primary EHSV and the secondary EHSV to the metering valve to control its position. Finally, a controller is included, and the controller is configured to provide an in-situ verification of at least the operating state of the control component.

[0018] In one embodiment of the system, the controller is configured to command the switching valve to couple the secondary EHSV to the metering valve, and after commanding the switching valve to couple the secondary EHSV to the metering valve, determine whether the downstream system has changed from a stationary state, and when it is determined that the downstream system has not changed from the stationary state, command the primary EHSV to move, determine whether the primary EHSV has moved after commanding the primary EHSV to move, and when it is determined that the primary EHSV has moved, command the switching valve to couple the primary EHSV to the metering valve, command the secondary EHSV to move, determine whether the downstream system has changed from the stationary state after commanding the secondary EHSV to move, and when it is determined that the at least one downstream system has not changed from the stationary state after commanding the secondary EHSV to move, provide an indication of the operating state of the control components in the redundant flow control system.

[0019] In one embodiment, the controller is configured to indicate a fault when it is determined that the at least one downstream system has changed from the stationary state to a non-stationary state. In another embodiment, the controller is configured to indicate a fault when it is determined that the primary EHSV has not moved after commanding the primary EHSV to move. In yet another embodiment, the controller is configured to indicate a fault when it is determined that the downstream system has changed from the stationary state to a non-stationary state after commanding the secondary EHSV to move.

[0020] In another embodiment, the controller is configured to determine whether the downstream system has changed from the stationary state after commanding the primary EHSV to move, and when it is determined that the at least one downstream system has changed from the stationary state to a non-stationary state after commanding the primary EHSV to move, indicate a fault. Further, in one embodiment, the controller is configured to determine whether the at least one downstream system has not changed from the stationary state after commanding the primary EHSV to move, and after determining that the primary EHSV has moved after commanding the primary EHSV to move, verify that the switching valve is operational.

[0021] In another embodiment, the controller is configured to verify the operation of the closed-loop maintenance of the stationary state of the at least one downstream system when it is determined that the at least one downstream system has not changed from the stationary state. In yet another embodiment, the controller is configured to verify the operation of the primary EHSV and track the position of the primary EHSV when it is determined that the primary EHSV has moved after commanding the primary EHSV to move. In yet another embodiment, the controller is configured to verify the operation of the switching valve when it is determined that the at least one downstream system has not changed from the stationary state after commanding the secondary EHSV to move.

[0022] When combined with the accompanying drawings, other aspects, objects, and advantages of the present invention will become more apparent and understandable from the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate several aspects of the present invention and, together with the description, serve to explain the principles of the invention. In the drawings:

[0024] Figure 1 is a simplified system-level block diagram of a redundant fluid flow control system for aerospace applications constructed in accordance with an embodiment of the present invention, and in which an embodiment of the method of the present invention is implemented; and

[0025] Figure 2 is a process flow diagram of an embodiment of a pre-flight in-situ verification method that illustrates the operating states of the primary and standby control components in the redundant fluid flow control system as Figure 1 shown.

[0026] While the present invention will be described in conjunction with certain preferred embodiments, it is not intended to be limited to these embodiments. On the contrary, the present invention is intended to cover all alternatives, modifications, and equivalents included within the spirit and scope of the present invention as defined by the appended claims. DETAILED DESCRIPTION

[0027] Turning now to the drawings, embodiments of systems and methods for in-situ determination of the operating states of key control components of a redundant fluid flow control system (e.g., a fuel flow control system for a combustion chamber of a gas turbine, a hydraulic flow control system for an actuator and / or end effector of a control surface of an aircraft, a hydraulically actuated door, etc.) are illustrated. While such a redundant fluid flow control system may be used for such individual applications, embodiments of the present invention are also applicable to combinations thereof, e.g., where fuel is used both to fuel an engine and to provide hydraulic pressure to control actuation, particularly for aerospace applications. As used herein, "in-situ" refers to using only the sensors necessary for the normal operation of the flow control system, while the control components are in an operating facility capable of influencing and effecting the operation of other components and systems on an aircraft.

[0028] While such systems and methods have particular advantages in such operating environments, especially considering the size, weight, and enclosure limitations common therein, other embodiments of the present invention may be used in other operating environments that require redundant control components, where such redundant control components are not readily or desirably used prior to system operation, and where sensors solely for the purpose of such operating determination are also not desired. Accordingly, the following description should be taken as illustrative rather than limiting.

[0029] Now referring toFigure 1 , Figure 101 shows a fuel metering system 101 constructed in accordance with an embodiment of the present invention. In the illustrated embodiment, the system 101 supplies pressurized fuel to the combustion chamber 123 and the actuation system 125 of an engine to provide hydraulic power to an actuator / end effector. The system 101 of this embodiment utilizes redundant electro-hydraulic servo valves (EHSVs) 103, 105 to control the fuel metering valve (FMV) 107 of the fuel metering unit (FMU). Due to the redundancy provided, the illustrated system 101 utilizes single-coil EHSVs 103, 105 for redundant control of the main FMV 107. During normal operation of the fuel metering system 101, the FADEC 120 monitors the position of the main EHSV 103 using a position sensor (such as a linear variable differential transformer (LVDT) 113). However, as briefly discussed above, other considerations prohibit including an LVDT for the secondary EHSV 105.

[0030] To provide redundancy in fuel flow control, a switching system including a switching valve 109 is included to allow the FADEC 120 to select which of the two redundant EHSVs 103, 105 to use to control the FMV 107. In the event of a failure of the main EHSV 103 in control, the FADEC 120 can send a signal to the switching system to switch control to the secondary EHSV 105 via the switching valve 107, thereby maintaining control of the FMV 107. This will allow both the fuel flowing to the engine and the fuel flowing to the control surface actuation system that depends thereon to continue operating.

[0031] In Figure 1 , the switching system utilizing the switching valve 109 is positioned such that the control pressure from the main EHSV 103 is supplied (shown via solid lines 117, 119) to position the main FMV 107. The control pressure from the redundant EHSV 105 (as shown by the dashed line 121) is blocked from the main FMV 107 at the switching valve 109. In the event of a failure of the main EHSV 103, the FADEC 120 positions the switching system such that the control pressure from the redundant EHSV 105 is supplied (via lines 121, 119) to position the FMV 107. The control pressure from the main EHSV 103 on line 117 is blocked from the main FMV 107 at the switching valve 109.

[0032] To ensure that the main EHSV 103 and the secondary EHSV 105 are operational prior to deployment (e.g., upon initial system power-up) and that no adverse system effects (such as supplying fuel to the combustion chamber or moving a control surface) occur, the FADEC 120 operates Figure 2The in-situ method will now direct attention to this method. Once this method is completed, the FADEC 120 has verified without supplying fuel to the combustion chamber or significantly moving the end effector that: 1) the switching valve 109 is operable (in one embodiment, the switching timing is indicated by observing a small position movement on the output of the actuation system); 2) the main control channel EHSV 103 is isolated from the output of the control manifold of the switching valve 109; 3) the LVDT 113 and the main EHSV 103 are operating properly; and 4) the standby channel EHSV 105 is functioning properly and is controlling the output position hold of the actuation system.

[0033] As Figure 2 shown, in one embodiment of the BIT check method of the present invention, starting at 200, in step 202, the FADEC 120 commands the switching valve 109 to switch control to the standby EHSV 105. Then, in step 204, the position of the actuator / end effector of the actuation system is monitored to determine whether it has undergone any movement. If no movement is observed, then in step 206, the closed-loop hold of the end effector is verified as operable. Otherwise, a fault in the EHSV 105 is identified, and the method terminates at step 208.

[0034] After step 206, in step 210, the FADEC 120 commands the main EHSV 103 to move. Then, in step 212, the FADEC 120 monitors the output of the LVDT 113 to ensure that it is tracking the commanded position. If the LVDT 113 is correctly tracking the position commanded by the EHSV 103, then in step 214, the EHSV 103 and its LVDT 113 are verified as operable. Otherwise, a fault in the EHSV 103 and / or its LVDT 113 is identified, and the method terminates at step 208.

[0035] During step 210, in step 216, the position of the actuator / end effector of the actuation system is monitored again to determine whether it has undergone any movement. If no movement is observed, then when step 214 indicates that the EHSV 103 is operable, the function of the switching valve 109 is verified in step 218. Otherwise, a fault in the switching valve 109 is identified, and the method terminates at step 208.

[0036] If the main EHSV 103 and its LVDT 113, the secondary EHSV 105, and the switching valve 109 are all confirmed as operable according to the above steps, then in step 220, the FADEC 120 commands the EHSV 103 to return to its initial position and switches the switching valve 109 to allow the main EHSV 103 to control the FMV 107.

[0037] After returning the main control function to the main EHSV 103 channel, a momentary step change in the current from the FADEC 120 to the standby EHSV 105 is provided in step 222. The position of the end effector is monitored in step 224 to detect any position change that would indicate that the switching valve 109 has not returned properly to the main mode. Any such movement in step 224 would indicate a failure of the switching valve 109, and the method would terminate at step 208. If there is no such movement, the method would end successfully at step 226, indicating that all system components have been checked and are operational.

[0038] Having thus described the foregoing exemplary embodiments employed in an engine fuel control system that also utilizes fuel to supply hydraulic pressure to a downstream actuation system 125, those skilled in the art will now appreciate the construction and operation of other embodiments of the present invention. For example, in another embodiment, the redundant flow control system is used only for actuators and / or end effectors of control surfaces of an aircraft, hydraulically actuated doors, and the like.

[0039] In such an embodiment, the fuel metering valve 107 is replaced by a hydraulic metering valve or actuator (hereinafter both referred to as "metering valve") that drives a downstream system such as a hydraulically actuated door, a control surface, and the like. In this embodiment, the metering valve opens and / or closes the door or moves the control surface under the control of the hydraulic pressure supplied by the EHSV, either directly or via additional downstream actuators or actuator groups. In such a system, there is no Figure 1 fuel pressurizing valve or combustion chamber 123 as shown, and the FADEC 120 shown may be only a controller for the redundant hydraulic flow control system.

[0040] All references cited herein, including published publications, patent applications, and patents, are incorporated herein by reference to the extent that each reference is specifically and individually indicated to be incorporated by reference in its entirety and set forth herein.

[0041] In the context of describing the present invention (especially in the context of the appended claims), the use of the terms "a" (the indefinite article "a" or "an") and "the" and similar indicative words are construed to cover both the singular and the plural, unless otherwise specified herein or clearly contradicted by the context. The terms "comprising" (comprising or including), "having" and "containing" are construed as open-ended terms (i.e., meaning "including, but not limited to"), unless otherwise noted. The recitation of numerical ranges herein is merely intended to serve as a shorthand reference to each individual numerical value falling within the range, unless otherwise indicated herein, and each individual numerical value is incorporated into the specification as if it were recited herein individually. All methods described herein can be performed in any suitable order, unless otherwise indicated herein or clearly contradicted by the context. The use of any and all examples provided herein, or of exemplary language (e.g., "such as") is merely intended to better illustrate the invention and is not intended to limit the scope of the invention, unless otherwise claimed. No language in the specification should be construed as indicating any non-claimed element as essential to the practice of the invention.

[0042] Preferred embodiments of the invention are described herein, including the best mode known to the inventors for practicing the invention. Variations of these preferred embodiments will become apparent to those skilled in the art upon reading the foregoing description. The inventors expect skilled artisans to employ such variations appropriately, and the inventors intend for the invention to be practiced otherwise than as specifically described herein. Accordingly, as permitted by applicable law, the invention includes all variations and equivalent substitutions of the subject matter recited in the appended claims. Moreover, the invention encompasses any combination of the above elements in all possible variations, unless otherwise specified herein or clearly contradicted by the context.

Claims

1. A method for in-situ verification of the operating state of a control component in a redundant flow control system, the redundant flow control system having a primary electro-hydraulic servo valve (EHSV) and a secondary EHSV, the primary EHSV and the secondary EHSV being coupled via a switching valve to control the position of a metering valve that supplies a fluid flow to at least one downstream system, the method comprising the steps of: Commanding the switching valve to couple the secondary EHSV to the metering valve; After the step of commanding the switching valve to couple the secondary EHSV to the metering valve, determining whether the at least one downstream system changes from a stationary state; When the determination in the step of determining whether the at least one downstream system changes from the stationary state is negative, commanding the primary EHSV to move; After the step of commanding the primary EHSV to move, determining whether the primary EHSV moves; When the determination in the step of determining whether the primary EHSV moves is positive, commanding the switching valve to couple the primary EHSV to the metering valve; Commanding the secondary EHSV to move; After the step of commanding the secondary EHSV to move, determining whether the at least one downstream system changes from the stationary state; And When the determination in the step of determining whether the at least one downstream system changes from the stationary state after the step of commanding the secondary EHSV to move is negative, providing an indication of the operating state of the control component in the redundant flow control system.

2. The method according to claim 1, further comprising the step of indicating a fault when the determination in the step of determining whether the at least one downstream system changes from the stationary state is positive.

3. The method according to claim 1, further comprising the step of indicating a fault when the determination in the step of determining whether the primary EHSV moves after the step of commanding the primary EHSV to move is negative.

4. The method according to claim 1, further comprising the step of indicating a fault when the determination in the step of determining whether the at least one downstream system changes from the stationary state after the step of commanding the secondary EHSV to move is positive.

5. The method according to claim 1, further comprising the step of determining whether the at least one downstream system changes from the stationary state after the step of commanding the primary EHSV to move, and the step of indicating a fault when the determination in the step of determining whether the at least one downstream system changes from the stationary state after the step of commanding the primary EHSV to move is positive.

6. The method according to claim 5, wherein, When the determination in the step of determining whether the at least one downstream system changes from the stationary state after the step of commanding the primary EHSV to move is negative, and the determination in the step of determining whether the primary EHSV moves after the step of commanding the primary EHSV to move is positive, verifying that the switching valve is operable.

7. The method according to claim 1, further comprising the step of verifying the operation of the closed-loop maintenance of the stationary state of the at least one downstream system when the determination in the step of determining whether the at least one downstream system changes from the stationary state is negative.

8. The method according to claim 1, further comprising, when it is determined that the main EHSV has moved after the step of commanding the main EHSV to move, verifying the operation of the main EHSV and tracking the position of the main EHSV.

9. The method according to claim 1, further comprising, when it is determined that the at least one downstream system has not changed from the stationary state after the step of commanding the secondary EHSV to move, verifying the operation of the switching valve.

10. A redundant flow control system, comprising: a plurality of control components, including a main electro-hydraulic servo valve (EHSV) and a secondary EHSV; a metering valve that supplies a fluid flow to at least one downstream system; a switching valve configured to couple one of the main EHSV and the secondary EHSV to the metering valve to control its position; and a controller configured to provide an in-situ verification of the operating state of at least the plurality of control components.

11. The system according to claim 10, wherein the controller is configured to: command the switching valve to couple the secondary EHSV to the metering valve; after commanding the switching valve to couple the secondary EHSV to the metering valve, determine whether the at least one downstream system has changed from a stationary state; when it is determined that the at least one downstream system has not changed from the stationary state, command the main EHSV to move; after commanding the main EHSV to move, determine whether the main EHSV has moved; when it is determined that the main EHSV has moved, command the switching valve to couple the main EHSV to the metering valve; command the secondary EHSV to move; after commanding the secondary EHSV to move, determine whether the at least one downstream system has changed from the stationary state; and when it is determined that the at least one downstream system has not changed from the stationary state after commanding the secondary EHSV to move, provide an indication of the operating state of the plurality of control components in the redundant flow control system.

12. The system according to claim 10, wherein, The controller is configured to indicate a fault when it is determined that the at least one downstream system has changed from the stationary state.

13. The system according to claim 10, wherein The controller is configured to indicate a fault when it is determined that the main EHSV has not moved after commanding the main EHSV to move.

14. The system according to claim 10, wherein, The controller is configured to indicate a fault when it is determined that the at least one downstream system has changed from the stationary state after commanding the secondary EHSV to move.

15. The system according to claim 10, wherein, The controller is configured to determine whether the at least one downstream system has changed from the stationary state after commanding the main EHSV to move, and to indicate a fault when it is determined that the at least one downstream system has changed from the stationary state after commanding the main EHSV to move.

16. The system according to claim 15, wherein The controller is configured to determine whether the at least one downstream system has changed from the stationary state after commanding the main EHSV to move, and to verify that the switching valve is operable after it is determined that the at least one downstream system has not changed from the stationary state after commanding the main EHSV to move and it is determined that the main EHSV has moved after commanding the main EHSV to move.

17. The system according to claim 10, wherein The controller is configured to verify the operation of the closed-loop maintenance of the stationary state of the at least one downstream system when it is determined whether the at least one downstream system changes from the stationary state to no.

18. The system according to claim 10, wherein, The controller is configured to verify the operation of the main EHSV and track the position of the main EHSV when it is determined that the main EHSV moves yes after commanding the main EHSV to move.

19. The system according to claim 10, wherein, The controller is configured to verify the operation of the switching valve when it is determined whether the at least one downstream system changes from the stationary state to no after commanding the secondary EHSV to move.

Images