Patent Description:
The present invention relates to failsafe operation of actuation systems such as actuation systems for aircraft control surfaces.

In designing flight control actuation systems for positioning flight control surfaces of an aircraft, it is desirable that the control surface (e.g. a flap or a slat movably mounted on a fixed wing) be returned to and maintained in a neutral or centered "null" failsafe position in the event of a failure in the actuation system, for example loss of electrical power to electrically operated valves in the hydraulic circuit and/or loss of hydraulic pressure in the hydraulic circuit. Where the flight control actuation system relies on linear hydraulic actuators to move the control surfaces, centering of the control surface in failure mode has been accomplished in simple fashion. Linear hydraulic actuators have a piston within a cylinder chamber that divides the cylinder chamber into two chambers. To move the piston in a first axial direction, pressurized hydraulic fluid is delivered into the first chamber through a first control line (referred to herein as "P1"), and hydraulic fluid in the second chamber is allowed to flow out of the cylinder chamber through a second control line (referred to herein as "P2"), whereby the piston is displaced. As will be understood, the volume of the first chamber increases, and the volume of the second chamber decreases. Conversely, to move the piston in a second axial direction opposite the first axial direction, pressurized hydraulic fluid is delivered into the second chamber through the second control line P2, and hydraulic fluid in the first chamber is allowed to flow out of the cylinder chamber through the first control line P1. Centering of the control surface in failure mode has been accomplished in simple fashion using a "hole-in-the-wall" (HITW) port. The HITW port is provided through the wall of the hydraulic cylinder of the linear hydraulic actuator at an axial midpoint along the wall. When the linear hydraulic actuator is operating in its intended travel range under normal operating conditions, the HITW port is closed by the piston. However, if a failure event occurs, overtravel of the piston in one direction or the other will cause the HITW port to open on the high-pressure side of the piston so hydraulic fluid escapes to a hydraulic return line. Hydraulic pressure from the return line enables the hydraulic manifold to hydraulically fill the lower pressure side of the piston to force the piston of the linear hydraulic actuator toward a central null position in which the piston again blocks the HITW port and becomes hydraulically locked.

Hydraulic rotary motors, also referred to as rotary hydraulic actuators, operate in a manner analogous to linear hydraulic actuators, but have a rotor which rotates about and axis relative to a stator instead of a piston that moves linearly relative to a cylinder. A pair of hydraulic control lines P1 and P2 communicate by way of corresponding ports in the motor housing with respective variable chambers of the hydraulic rotary motor. To cause rotation of the rotor in a first direction, pressurized fluid is delivered to the motor by way of the first control line P1 and fluid is permitted to leave the motor by way of the second control line P2. To cause reverse rotation of the rotor in a second direction opposite the first direction, pressurized fluid is delivered to the motor by way of the second control line P2 and fluid is permitted to leave the motor by way of the first control line P <NUM>.

<CIT> teaches an alternative version of the HITW concept adapted for a rotary hydraulic actuator as opposed to a linear hydraulic actuator. More specifically, Lebrun et al. disclose a rotary hydraulic actuator including an outer stator and an inner rotor having respective radial vanes for defining arcuate chambers each divided into two variable volume subchambers. The subchambers are connected to first and second control lines analogous to control lines P1 and P2 described above, and hydraulic flow may be selectively controlled in the control lines to cause the rotor to rotate relative to the stator in opposite first and second rotational directions. A HITW port, designated by reference numeral <NUM> in <FIG> of Lebrun et al. , is provided in the stator to provide return pressure causing the rotor to rotate toward its null position in failsafe mode.

The HITW ports described above are provided through the stator or cylinder confining the pressurized working fluid. A drawback of the HITW ports described above is that the location of the port in the actuator, which determines the location of the null position during failsafe mode, is fixed and cannot be changed. Therefore, the null position of the hydraulic linear actuator or hydraulic rotary actuator cannot be readily adjusted after the actuator is manufactured, and the actuator is only suitable for specific applications having the designed null position.

Another disadvantage specific to the rotary hydraulic actuator disclosed by Lebrun et al. is that the range of rotary motion of the rotor relative to the stator is limited to an angle less than <NUM> degrees. Therefore, continuous revolutions of the rotor are not possible. Some aircraft have a need to use thin wings to reduce drag, thus requiring very thin (i.e. low height) trailing edge control surfaces driven by geared rotary actuators (GRAs) instead of conventional linear hydraulic actuators. The geared rotary actuators are directly attached to the control surface hinge axis, and a hydraulic rotary motor is located on the same axis to drive the GRA continuously through multiple revolutions. The rotary hydraulic actuator taught by Lebrun et al. is not suitable for this type of application due to its limited range of angular motion. While the use of GRAs helps to reduce aerodynamic drag, heretofore there has been no way to provide a HITW feature for fail-safe balancing of the control surface at a null failsafe position.

Patent application publication <CIT> relates to a blow-back circuit comprising an accumulator to build up system pressure during normal system operation, and an accumulator shut-off valve which prevents dissipation of the accumulator pressure during normal operation.

The present invention provides an actuation system and a method of operating an actuation system as set out in the appended independent claims. The present invention has utility in actuation systems in which a movable member is actuated using hydraulic power supplied by a hydraulic rotary motor instead of a hydraulic linear actuator. In one application, the movable member is a flight control surface actuated relative to a fixed wing by a GRA powered by a hydraulic rotary motor. The present disclosure provides the same HITW function of returning the flight control surface to an aerodynamically neutral or null failsafe position in a failure event, without the need for a fixed port in the working hydraulic motor. The failure event may be, for example, the loss of electrical command capability for controlling the hydraulic manifold and/or the loss of hydraulic pressure.

In accordance with an embodiment of the present invention, a failsafe valve is associated with a hydraulic rotary motor powering the GRA, and is also mechanically connected to the control surface. When the failsafe valve receives a normal command pressure from the hydraulic flight control system, the failsafe valve is inactive and the flight control system operates in a normal mode. However, if there is a loss of hydraulic command pressure to the failsafe valve, the failsafe valve is activated and connects one of the motor hydraulic control lines (i.e. P1 or P2) to the case return line R for the hydraulic rotary motor if the control surface is away from its null or neutral failsafe position. As a result, the control surface will be hydraulically powered or aerodynamically ratcheted to its failsafe position in a failure event.

The failsafe valve may include a metering spool directly or indirectly connected to the control surface such that a rotational or axial position of the metering spool is determined by the position of the control surface relative to the fixed member, wherein the metering spool has a null position corresponding to the failsafe position of the movable member. When the metering spool is displaced from its null position in a first direction, the failsafe valve places the first control line P1 in communication with the drain return line R. Conversely, when the metering spool is displaced from its null position in a second and opposite direction, the failsafe valve places the second control line P2 in communication with the drain return line R.

Unlike the solution offered by Lebrun et al. , the hydraulic rotary motor powering the GRA is free to operate through multiple revolutions because there is no angular limit imposed by a physical HITW in the hydraulic rotary motor. Moreover, the failsafe position of the control surface or other movable member may be easily changed for different applications by reconfiguring a transmission mechanism by which the movable member is connected to the metering spool.

The nature and mode of operation of disclosed embodiments will now be more fully described in the following detailed description taken with the accompanying drawing figures, in which:.

<FIG> and <FIG> schematically illustrate a hydraulically-powered flight control actuation system <NUM> for actuating a control surface of an aircraft, for example a flap or slat <NUM> connected to a fixed wing <NUM> of the aircraft by a geared rotary actuator (GRA) <NUM>. GRA <NUM> may be a single input GRA driven by a single hydraulic rotary motor, or a dual input GRA driven by a pair of hydraulic rotary motors <NUM> and 12R as shown in <FIG> and <FIG>. Hydraulic rotary motors <NUM>, 12R may be controlled by a hydraulic system including a main control valve <NUM>, bypass valves <NUM>, and shut-off valves <NUM>. For example, the hydraulic system may be a dual redundant system including a first hydraulic subsystem designated Hyd <NUM> for controlling hydraulic rotary motor <NUM> at the left end of GRA <NUM>, and a second hydraulic subsystem Hyd <NUM> controlling the other hydraulic rotary motor 12R at the right end of GRA <NUM>. More specifically, second hydraulic subsystem Hyd <NUM> includes a first hydraulic control line P1 in hydraulic communication with a first control port C1 of hydraulic rotary motor 12R, a second hydraulic control line P2 in hydraulic communication with a second control port C2 of hydraulic rotary motor 12R, and a case drain return line R in hydraulic communication with a return port RP of hydraulic rotary motor 12R.

At least one of the hydraulic motors <NUM>, 12R and control surface <NUM> are connected to a failsafe valve <NUM>. In <FIG> and <FIG>, only one failsafe valve <NUM> is shown in association with hydraulic motor 12R on the right end of GRA <NUM>, however it will be understood that another failsafe valve may be provided in association hydraulic motor <NUM> on the left end of GRA <NUM>.

In <FIG>, failsafe valve <NUM> is shown in its non-activated state. When failsafe valve <NUM> is in its non-activated state, the hydraulic flight control actuation system <NUM> is operating normally and failsafe valve <NUM> plays no role. In <FIG>, failsafe valve <NUM> is shown in its activated state, meaning that the hydraulic flight control actuation system has experienced a failure causing loss of hydraulic pressure to hydraulic rotary motor 12R. In its activated state, failsafe valve <NUM> connects an appropriate one of the hydraulic control lines P1 or P2 for hydraulic motor 12R to case drain return line R for the hydraulic motor if the control surface <NUM> is not at its aerodynamically null or neutral failsafe position, thereby allowing the control surface <NUM> to move to its failsafe position.

<FIG> show one possible arrangement of failsafe valve <NUM> and hydraulic rotary motor 12R. As may be seen, the hydraulic control lines P1 and P2 of second hydraulic subsystem Hyd <NUM> connect respectively to a first control port <NUM> and a second control port <NUM> in a housing <NUM> of failsafe valve <NUM>, a hydraulic supply line S of second hydraulic subsystem Hyd <NUM> connects to a command port <NUM> in valve housing <NUM>, and case drain return line R of second hydraulic subsystem Hyd <NUM> connects to a return port <NUM> in the valve housing. In the depicted embodiment, failsafe valve <NUM> may include a first control conduit <NUM> communicating with first control port <NUM> and with first control port C1 of hydraulic motor 12R, a second control conduit <NUM> communicating with second control port <NUM> and with second control port C2 of hydraulic motor 12R, and a return conduit <NUM> communicating with return port <NUM> and with return port RP of hydraulic motor 12R. Thus, command port <NUM> is in hydraulic communication with hydraulic supply line S, first control conduit <NUM> is in hydraulic communication with first hydraulic control line P1 and first control port C1 of hydraulic rotary motor 12R, second control conduit <NUM> is in hydraulic communication with second hydraulic control line P2 and second control port C2 of hydraulic rotary motor 12R, and return conduit <NUM> is in hydraulic communication with the hydraulic return line R and the return port RP of hydraulic rotary motor 12R.

Failsafe valve <NUM> may include a valve arm <NUM> protruding from one end of valve housing <NUM>. Valve arm <NUM> may include a clevis <NUM> on its protruding portion for connection to a transmission mechanism (not shown) connected to control surface <NUM>. Movement of control surface <NUM> about a hinge axis <NUM> of GRA <NUM> may be transmitted to valve arm <NUM> by way of the transmission mechanism, thereby causing valve arm <NUM> to rotate about its longitudinal axis relative to the housing of failsafe valve <NUM>. An example of a transmission mechanism is shown and described below in connection with <FIG>. Instead of using an intervening transmission mechanism, valve arm <NUM> may be directly connected to control surface <NUM>.

Failsafe valve <NUM> may include a shaft <NUM> defining a central axis <NUM> about which valve arm <NUM> rotates. A metering spool <NUM> may be housed within a valve sleeve <NUM> and coupled to valve arm <NUM> to rotate with valve arm <NUM> about axis <NUM> of shaft <NUM>. The rotation of metering spool <NUM> about valve axis <NUM> is relative to valve sleeve <NUM>, which remains in a fixed position within valve housing <NUM>. Metering spool <NUM> may be keyed to a slotted command spool <NUM> slidably mounted on an end of metering spool <NUM>. A spring <NUM> engages a plugged end of housing <NUM> and biases command spool <NUM> in an axial direction to the left in <FIG> and <FIG>. In <FIG>, valve arm <NUM> and metering spool <NUM> are shown at a null rotational position A0 corresponding to a failsafe position of control surface <NUM>. In the depicted embodiment, the null rotational position A0 of metering spool <NUM> is characterized by clevis <NUM> extending in a vertical direction, as best seen in <FIG>.

Failsafe valve <NUM> is configured such that hydraulic communication is possible between first control conduit <NUM> and return conduit <NUM>, or between second control conduit <NUM> and return conduit <NUM>, but only when the failsafe valve is in its activated state. For example, metering spool <NUM> and valve sleeve <NUM> may define respective passageways <NUM> and <NUM>, such that as metering spool <NUM> is rotated in a first rotational direction about valve axis <NUM> away from the null rotational position A0, passageways <NUM> in metering spool <NUM> will move into overlapped communication with passageways <NUM> in valve sleeve <NUM>, thereby allowing hydraulic fluid to flow from first control conduit <NUM> to return conduit <NUM> as described in greater detail below with reference to <FIG>. Similarly, when metering spool <NUM> is rotated in a second rotational direction about valve axis <NUM> opposite the first rotational direction and away from the null rotational position A0, passageways <NUM> in metering spool <NUM> will move into overlapped communication with passageways <NUM> in valve sleeve <NUM>, thereby allowing hydraulic fluid to flow from second control conduit <NUM> to return conduit <NUM> as described in greater detail below with reference to <FIG>. Hydraulic flow may reach return conduit <NUM> by way of a plurality of radial openings <NUM> through valve sleeve <NUM>.

In <FIG>, failsafe valve <NUM> is in its non-activated state, whereas in <FIG>, failsafe vale <NUM> is in its activated state. The state of failsafe valve <NUM> may be determined by the axial position of command spool <NUM>. When hydraulic pressure in hydraulic supply line S is greater than or equal to a predetermined normal pressure, the hydraulic pressure delivered through command port <NUM> is sufficient to force command spool <NUM> to the right in <FIG> against the bias of spring <NUM> such that command spool <NUM> blocks radial openings <NUM> leading to return conduit <NUM>, thereby preventing hydraulic communication between first and second control conduits <NUM>, <NUM> on the one hand, and return conduit <NUM> on the other. As will be understood, when hydraulic pressure in hydraulic supply line S is lost due to a malfunction or failure of second hydraulic subsystem Hyd <NUM> of the flight control actuation system, hydraulic pressure at command port <NUM> will decrease to less than the predetermined normal pressure, and spring <NUM> will displace command spool <NUM> axially to the left, as viewed in <FIG>, to unblock radial openings <NUM> leading to return conduit <NUM> and place failsafe valve <NUM> in its activated state.

Reference is now made to <FIG>, <FIG>, <FIG>, and <FIG> to further describe operation of failsafe valve <NUM> in its activated state. When failsafe valve <NUM> is in its activated state, the rotational position of metering spool <NUM> may determine which hydraulic control line, P1 or P2, is connected by the failsafe valve <NUM> to communicate with drain return line R. The rotational position of metering spool <NUM> may be determined by the angular position of control surface <NUM> to which metering spool <NUM> is connected by way of valve arm <NUM> and an intervening transmission mechanism, if any, between valve arm <NUM> and the control surface. As mentioned above, if control surface <NUM> is away from its failsafe position, failsafe valve <NUM> connects one of the hydraulic control lines P1 or P2 to drain return line R.

In <FIG> and <FIG>, metering spool <NUM> is rotated about valve axis <NUM> in the first rotational direction away from its null rotational position A0 such that hydraulic communication is opened between first hydraulic control line P1 and drain return line R. First control conduit <NUM>, which communicates with first hydraulic control line P1 through first control port <NUM>, hydraulically communicates through passageways <NUM> and <NUM> with an annular passageway <NUM> defined between shaft <NUM> and an internal diameter of metering spool <NUM>. Annular passageway <NUM> may extend axially along the interior of failsafe valve <NUM> to an opening <NUM> of metering spool <NUM>, allowing hydraulic fluid to travel out of passageway <NUM>, into an annular space in which spring <NUM> is located, and through radial openings <NUM> in valve sleeve <NUM> to return conduit <NUM>. From return conduit <NUM>, hydraulic fluid travels through return port <NUM> to drain return line R.

In <FIG> and <FIG>, metering spool <NUM> is rotated about valve axis <NUM> in the second rotational direction away from its null rotational position such that hydraulic communication is opened between second hydraulic control line P2 and drain return line R. Second control conduit <NUM>, which communicates with second hydraulic control line P1 through second control port <NUM>, hydraulically communicates with annular passageway <NUM> by way of passageways <NUM> and <NUM>. As described above, annular passageway <NUM> leads to opening <NUM>, allowing hydraulic fluid to travel out of passageway <NUM> and through radial openings <NUM> to return conduit <NUM>. From return conduit <NUM>, hydraulic fluid travels through return port <NUM> to drain return line R.

For example, if the second hydraulic subsystem Hyd <NUM> loses electrical supply when control surface <NUM> is tilted upward away from its failsafe position, then failsafe valve <NUM> will receive decreased pressure at command port <NUM> as the shut-off valve <NUM> of Hyd <NUM> goes from opened to closed without electrical power, and failsafe valve <NUM> will transition from its non-activated state to its activated state. Due to the position of valve arm <NUM> and metering spool <NUM>, and the spaced arrangement of passageways <NUM> and <NUM>, a flow passageway is opened whereby motor control pressure from second hydraulic control line P2 is directed to drain return line R and hydraulic motor 12R sees full system pressure from first hydraulic control line P1 at first control port C1, thus driving the hydraulic rotary motor to actuate control surface <NUM> toward its failsafe position. If control surface <NUM> is tilted downward away from its failsafe position, the reverse will happen, i.e. failsafe valve <NUM> may direct the motor control pressure from first hydraulic control line P1 to the drain return line R and hydraulic rotary motor 12R sees full system pressure from second hydraulic control line P2 at second control port C2, thus driving the motor to actuate the control surface <NUM> toward its failsafe position. Once control surface reaches its failsafe position from either direction, motor control pressures are equalized and porting to return line R is closed, whereby control surface <NUM> becomes hydraulically locked in its failsafe position.

As mentioned above, GRA <NUM> may be driven by a pair of hydraulic motors <NUM> and 12R. The following table represents various modes of the example system depicted in <FIG> and <FIG>:.

When both the first and second hydraulic subsystems (Hyd <NUM> and Hyd <NUM>) have hydraulic power, and there is electrical power to operate main control valve <NUM> and shut-off valves <NUM>, then the flight control actuation system <NUM> will operate in its normal active mode to control the position of control surface <NUM>.

If the first hydraulic subsystem Hyd <NUM> has hydraulic power but the second hydraulic subsystem Hyd <NUM> loses hydraulic power, and there is electrical power to operate main control valve <NUM> and shut-off valves <NUM>, then flight control actuation system <NUM> will operate in a bypass mode in which first and second hydraulic control chambers of hydraulic rotary motor 12R are placed into hydraulic communication with one another such that hydraulic fluid can flow freely between the two chambers, allowing the fully functional first hydraulic subsystem Hyd <NUM> to actively drive GRA <NUM> by operation of hydraulic rotary motor <NUM> alone, with minimal resistance from hydraulic rotary motor 12R.

Conversely, if the second hydraulic subsystem Hyd <NUM> has hydraulic power but the first hydraulic subsystem Hyd <NUM> loses hydraulic power, and there is electrical power to operate main control valve <NUM> and shut-off valves <NUM>, then flight control actuation system <NUM> will operate in a bypass mode in which first and second hydraulic control chambers of hydraulic rotary motor <NUM> are placed into hydraulic communication with one another such that hydraulic fluid can flow freely between the two chambers, allowing the fully functional second hydraulic subsystem Hyd <NUM> to actively drive GRA <NUM> by operation of hydraulic rotary motor 12R alone, with minimal resistance from hydraulic rotary motor <NUM>.

When both hydraulic subsystems lose hydraulic power, first hydraulic subsystem Hyd <NUM> will operate in bypass mode as described above. However, failsafe valve <NUM> will transition to its activated state such that second hydraulic subsystem <NUM> will allow control surface <NUM> to "ratchet" to its aerodynamically neutral failsafe position under aerodynamic loading. Hydraulic subsystems Hyd <NUM> and Hyd <NUM> will respectively operate in bypass and ratchet modes regardless of whether there is electrical power or not.

When second hydraulic subsystem Hyd <NUM> has hydraulic power but electrical power is lost, first hydraulic subsystem Hyd <NUM> will operate in bypass mode as described above. Failsafe valve <NUM> will transition to its activated state such that second hydraulic subsystem Hyd <NUM> will hydraulically power control surface <NUM> to its failsafe position. Hydraulic subsystems Hyd <NUM> and Hyd <NUM> will respectively operate in bypass and power-to-fail safe modes regardless of whether first hydraulic subsystem Hyd <NUM> has hydraulic power or not.

The connection of metering spool <NUM> and valve arm <NUM> to control surface <NUM> may be designed kinematically such that the failsafe position of control surface <NUM> corresponds to the null position of metering spool <NUM>. For example, as shown in <FIG>, a transmission mechanism <NUM> mechanically couples control surface <NUM> to valve arm <NUM> (and thus to metering spool <NUM>) such that when control surface <NUM> is at its aerodynamically neutral position shown in <FIG>, metering spool <NUM> is caused to be in its null position. As illustrated by the depicted embodiment, the failsafe position of control surface <NUM> may be an intermediate, for example centered, angular position of control surface <NUM> in its range of pivotal motion about axis <NUM> of GRA <NUM>. Transmission mechanism <NUM> may be configured to displace valve arm <NUM> and metering spool <NUM> in first and second opposite directions away from its null position depending on the direction of displacement of control surface <NUM> away from its failsafe position. Consequently, in the illustrated embodiment, transmission mechanism <NUM> displaces valve arm <NUM> and metering spool <NUM> in a first direction when control surface <NUM> is displaced in a first direction away from its failsafe position as shown in <FIG>, and transmission mechanism <NUM> displaces valve arm <NUM> and metering spool <NUM> in a second and opposite direction when control surface <NUM> is displaced in a second and opposite direction away from its failsafe position as shown in <FIG>. Transmission mechanism <NUM> may have any configuration providing desired kinematic response to displacement of control surface <NUM> away from its failsafe position such that valve arm <NUM> and metering spool <NUM> experience a corresponding intended displacement away from the null position. As may be understood, transmission mechanism <NUM> may include various types of gears, gear trains, links, linkage systems, and other transmission components to achieve a desired correspondence between the position of control surface <NUM> and metering spool <NUM>. The transmission mechanism <NUM> shown in <FIG> includes a control surface link <NUM> having a first end pivotally coupled to control surface <NUM> at pivot 82A spaced from hinge axis <NUM>, and a second end 82B pivotally coupled to clevis <NUM>. The configuration of transmission mechanism <NUM> shown in <FIG> is merely for sake of illustration, and is not intended to limit the transmission mechanism to the configuration shown.

In the embodiment described above and depicted in the figures, metering spool <NUM> is rotatable about valve axis <NUM> in opposite rotational directions away from its null rotational position. However, those skilled in the art will understand that failsafe valve <NUM> may be designed such that metering spool <NUM> is movable axially along valve axis in opposite axially directions away from a null axial position to achieve similar functionality. For this type of modification, transmission mechanism <NUM> and valve arm <NUM> may be reconfigured such that angular motion of control surface <NUM> about hinge axis <NUM> is converted to linear motion which is transmitted to metering spool <NUM> to shift the axial position of the metering spool. For example, transmission mechanism may include a bell-crank linkage for converting angular motion to linear motion.

The failsafe position of the actuated movable member (e.g. control surface <NUM>) may be adjusted to suit different applications merely by reconfiguring transmission mechanism <NUM>, without the need to make any structural modifications to failsafe valve <NUM> or to hydraulic rotary motor 12R. The failsafe position of the movable member need not be a centered position, and may be at or near a travel limit of its range of movement. This feature offers an important advantage over existing HITW designs of the prior art.

As will be appreciated, the present invention provides "HITW" failsafe functionality in an actuation system employing a hydraulic rotary actuator, such as hydraulically-powered flight control actuation system which employs GRAs powered by hydraulic rotary actuators instead of hydraulic linear actuators. The solution of the invention is easily adaptable to various different travel ranges and failsafe positions of the actuated member.

Claim 1:
An actuation system (<NUM>) for displacing a movable member (<NUM>) relative to a fixed member (<NUM>), the movable member having a failsafe position and being displaceable away from the failsafe position, the actuation system comprising:
an actuator (<NUM>) configured to connect the movable member to the fixed member;
a hydraulic system (Hyd <NUM>, Hyd <NUM>) having a hydraulic supply line (Supply <NUM>, Supply <NUM>), a first hydraulic control line (P1), a second hydraulic control line (P2), and a hydraulic return line (R);
a hydraulic rotary motor (<NUM>, 12R) powered by the hydraulic system and arranged to drive the actuator to displace the movable member relative to the fixed member, the hydraulic rotary motor including a first control port (C1) in hydraulic communication with the first hydraulic control line, a second control port (C2) in hydraulic communication with the second hydraulic control line, and a return port (RP) in hydraulic communication with the hydraulic return line; and
a failsafe valve (<NUM>) in hydraulic communication with the hydraulic system and the hydraulic rotary motor, the failsafe valve configured to be operably connected to the movable member;
wherein the failsafe valve has a non-activated state when hydraulic pressure in the hydraulic supply line is greater than or equal to a predetermined normal pressure and an activated state when hydraulic pressure in the hydraulic supply line is less than the predetermined normal pressure;
wherein, when the failsafe valve is in the non-activated state, the first hydraulic control line is in hydraulic communication with the first control port of the hydraulic rotary motor, the second hydraulic control line is in hydraulic communication with the second control port of the hydraulic rotary motor, and the return port of the hydraulic rotary motor is in hydraulic communication with the hydraulic return line, such that the hydraulic rotary motor operates normally;
wherein, when the failsafe valve is in the activated state and the movable member is away from the failsafe position, the first hydraulic control line and the first control port of the hydraulic rotary motor, or the second hydraulic control line and the second control port of the hydraulic rotary motor, are in hydraulic communication with the hydraulic return line.