A fault-accommodating flow scheduling valve has a first inlet, outlet, and orifice therebetween. The valve has a shuttle valve member on the orifice inlet side, a primary valve member on the orifice outlet side, a compression-loaded primary spring, and first and second compression-loaded balance springs. Below a threshold differential pressure, the primary valve member engages with the outlet-side sealing face to close the valve while the shuttle valve member is spaced from the inlet-side sealing face, and on failure of the primary spring, the primary valve member moves from the outlet-side sealing face but the shuttle valve member closes the valve. Above the threshold differential pressure, the primary valve member opens the valve while the shuttle valve member remains spaced, and on failure of the primary spring, the primary valve member moves further from the outlet-side sealing face but the shuttle valve member closes the valve.