Patent Description:
It some circumstances it may become necessary for an aircraft to perform an emergency landing. For instance, damage to or failure of an aircraft's control system, a conventional aircraft's jet engine, an electric VTOL (eVTOL) aircraft's electric motor or a helicopter's rotor may result in a need to perform an emergency landing.

<CIT> discloses a system for releasing heavy loads from aircraft. A pyrotechnic thruster assembly is placed between a load and one or more attached parachutes, and used on a descent trajectory of the load, so as to brake the load in order to enable landing. The system comprises a sensor sensitive to the extraction of the load out of the aircraft so as to enable means able to initiate the thruster assembly upon exit from the aircraft.

<CIT> discloses an aircraft includes an airframe parachute system. The parachute system includes an activation system, an extraction system, a harness system, and a parachute assembly.

<CIT> discloses a parachute for an aircraft.

<CIT> discloses a low-altitude, retro-rocket, load landing apparatus for decelerating the rate of descent of a load and counteracting sideward wind drift.

<CIT> discloses a device for cushioning the landing of aerial loads.

<CIT> discloses a helicopter emergency rescue system emergency rescue system that includes a main rotor, a container with a releasable cover and an emergency parachute, a device for connecting the parachute and a rescue system control panel.

According to embodiments of the invention there is provided an emergency landing apparatus for an aircraft, the emergency landing apparatus comprising: a housing for ejection from the aircraft; a parachute, arranged for deployment from the housing, comprising a canopy; a rocket motor, positioned in the housing, arranged to provide upwards thrust to control descent of the aircraft during emergency landing of the aircraft; a rocket motor initiator, positioned in the housing, arranged to initiate the rocket motor; and one or more sensors for sensing ejection of the housing from the aircraft and for arming the rocket motor initiator in response to sensing ejection of the housing from the aircraft.

According to embodiments of the invention there is provided a method of performing an emergency landing of an aircraft, the method comprising: sensing ejection of a housing from the aircraft, wherein the housing houses a rocket motor and a parachute comprising a canopy; arming a rocket motor initiator (<NUM>), arranged to initiate the rocket motor, in response to sensing ejection of the housing from the aircraft; and providing upwards thrust, using the rocket motor, to control descent of the aircraft during emergency landing of the aircraft.

In future, it is expected that aircraft, such as VTOL aircraft, will be used increasingly to transport cargo and people. For example, VTOL aircraft may be used to transport individual parcels or to carry a person (or a small number of people) from one destination to another on a regular basis.

There may be circumstances in which the aircraft is damaged or fails, resulting in a need to perform an emergency landing.

Embodiments of the invention relate to an emergency landing apparatus that enables an aircraft to perform an emergency landing. The emergency landing apparatus is particularly suitable for a VTOL aircraft, but may also be suitable for other types of aircraft.

<FIG> illustrates an embodiment of the emergency landing apparatus <NUM>. <FIG> illustrates a functional schematic of some parts of the emergency landing apparatus <NUM>. In the example illustrated in <FIG>, the emergency landing apparatus <NUM> comprises a housing <NUM> and a parachute <NUM> comprising a canopy <NUM> and one or more inflatable airbags <NUM>.

The housing <NUM> is ejected/deployed from an aircraft when emergency landing of the aircraft is required. This is described in further detail below. References are made below to the actively launching/ejecting the housing <NUM> from the aircraft. While in implementations the housing <NUM> can be deployed in this manner, in others it may instead be passively deployed using the effects of gravity (that is, not actively launched/ejected from the aircraft). This applies to all of the forms of the housing <NUM> that are described and illustrated herein.

The parachute <NUM> is arranged for deployment from the housing <NUM>. The airbag(s) <NUM> are arranged to expand the canopy <NUM> following deployment of the parachute <NUM> from the housing <NUM>. As the airbags <NUM> inflate, they cause the canopy <NUM> to expand much more rapidly than would otherwise be the case.

In practice, it is likely that multiple inflatable airbags <NUM> will be provided, but in some implementations, there could merely be a single one.

The emergency landing apparatus <NUM> further comprises a rocket motor <NUM>.

The housing <NUM> may take the form of a canister, which might, for example, be largely cylindrical in shape. The housing <NUM> comprises a first (upper) compartment <NUM>, a second (middle) compartment <NUM> and a third (lower) compartment <NUM>. The first compartment <NUM> is separated from the second compartment <NUM> by at least one wall 16a. The second compartment <NUM> is separated from the third compartment <NUM> by at least one wall 16b. In the illustrated embodiment, the second compartment <NUM> is positioned between the first compartment <NUM> and the third compartment <NUM>.

The parachute <NUM> is stored in the first compartment <NUM>. The first compartment <NUM> has an aperture <NUM> that is covered by a cover <NUM>. The cover <NUM> may be removable and/or frangible. The aperture <NUM> is shaped to enable the parachute <NUM> to be deployed from the housing <NUM>. Deployment of the parachute <NUM> from the housing <NUM> involves the canopy <NUM> and the inflatable airbags <NUM> exiting the housing <NUM> via the aperture <NUM>.

Each of the inflatable airbags <NUM> comprises either a compressed gas such as carbon dioxide or nitrogen, or a gas generation formulation such as sodium azide, that is ignited to cause the airbag to inflate. Inflation of the airbags <NUM> does not occur until after the housing <NUM> has been ejected from an aircraft and the parachute <NUM> has been deployed from the housing <NUM>.

Means, in the form of one or more airbag initiator(s) <NUM>, is provided which initiates airbag inflation by causing release of the compressed gas or the gas generation formulation. The airbag initiator(s) <NUM> may take different forms. In some embodiments, the airbag initiator(s) <NUM> may comprise control circuitry which causes ignition of the gas generation formulation and means, in the form of one or more sensors, for sensing movement of the parachute <NUM>/airbags <NUM> out of the housing <NUM>. Such means/sensors may provide inputs to the control circuitry which causes the control circuitry to inflate of the airbags <NUM> after the parachute <NUM> has exited the housing <NUM>. The one or more sensors may include one or more inertial sensors. A power source is provided, if required, to power the control circuitry and possibly also the sensor(s). This power source is independent of and in addition to the power source(s) powering the aircraft in which the emergency landing apparatus <NUM> may be stored. If a compressed gas is used to inflate the airbag(s) <NUM>, the control circuitry may cause a valve to open or a disc to burst to rapidly release the compressed gas.

In other embodiments, the means for sensing movement of the parachute <NUM> out of the housing <NUM> and the means for initiating airbag inflation may be different from that described above. They might be mechanical in nature rather than electronic. For example, one or more lanyards may be anchored to the housing <NUM> (directly or indirectly via connection to another component in the housing <NUM>) and releasably coupled to the airbags <NUM>. Movement of the parachute <NUM> may unravel the lanyard(s), eventually creating tension in the lanyard(s) when the parachute <NUM> has exited the housing <NUM>. The tension in the lanyard(s) causes the coupling between the airbags <NUM> and the lanyard(s) to be released, which in turn causes control circuitry to ignite the explosive. In some implementations, use of control circuitry might be unnecessary. For example, release of the lanyard(s) might remove an insulative material and removal of that insulative material (e.g. from between two sprung-loaded electrical contacts) may then complete an electrical circuit and cause ignition of the explosive material. Alternatively, pulling each lanyard may trigger a simple percussion cap initiator. An advantage of this type of implementation is that a power source is not necessarily required to ignite the explosive and inflate an airbag <NUM>.

Alternatively, the airbags may be pressurised from small cylinders containing compressed gas such as carbon dioxide, and the lanyard(s) may operate a valve, break a bursting disc or operate another device to rapidly release the compressed gas.

The rocket motor <NUM> is positioned in the second compartment <NUM> of the housing <NUM> and is arranged to provide upwards thrust (i.e. thrust having an upwards component) to control descent of the aircraft during emergency landing of an aircraft. The rocket motor <NUM> comprises propellant <NUM> which might, for example, be cast propellant. The rocket motor <NUM> includes one or more exit nozzles <NUM> through which gas generated by the burning propellant <NUM> is ejected in order to provide the upwards thrust. The exit nozzles <NUM> may each include a protective lining <NUM>. The exit nozzles <NUM> in the illustrated embodiment are angled (in use, relative to the vertical and the horizontal) and may be arranged such that no net horizontal thrust is generated by the rocket motor <NUM> in use.

It might be, for example, that the effect of the horizontal thrust that is generated in one direction by the exit nozzle(s) <NUM> is counteracted by horizontal thrust that is generated in the opposite direction by the exit nozzle(s) <NUM>, resulting in generation of thrust without a net horizontal component.

A rocket motor initiator <NUM> is provided to initiate the rocket motor <NUM> to provide thrust (i.e. to ignite the propellant, causing thrust to be provided). In the illustrated example, the propellant <NUM> and the rocket motor initiator <NUM> are positioned above the exit nozzle(s) <NUM>. The rocket motor initiator <NUM> is controlled by control circuitry <NUM>, which receives and processes inputs from one more sensors/sensor circuitry <NUM> to decide whether or not to ignite the rocket motor(s) <NUM>. The sensor(s) <NUM> might, for example, include an altimeter (such as a laser altimeter or a radio altimeter). The control circuitry <NUM> and/or the sensors <NUM> might be positioned in the housing <NUM>, such as in the third compartment <NUM>.

A power source may be provided to power the control circuitry <NUM> and the sensors <NUM>. This power source might or might not be the same as any power source that is provided to cause inflation of the airbags. The power source that is provided to power the control circuitry <NUM> and the sensors <NUM> may be independent of and in addition to the power source(s) powering the aircraft in which the emergency landing apparatus <NUM> may be stored.

Means, in the form of one or more sensors, is provided for sensing whether the housing <NUM> has been ejected from the aircraft. The sensing of such ejection may cause subsequent arming of the airbag initiators. For example, the means/sensor(s) may include one or more inertial sensor(s) which cause the airbag initiator(s) <NUM> and/or the rocket motor <NUM> to switch from a "safe mode" to an "operative mode" in response to ejection of the housing <NUM> from the aircraft. Alternatively or additionally, the means/sensor(s) may include a microswitch (for instance, at least partially positioned on the outer surface of housing <NUM>) which senses ejection of the housing <NUM>. Alternatively or additionally, the means/sensor(s) may include an inertial sensor in the apparatus <NUM> that is coupled to a lanyard which, in turn, is also coupled to the aircraft. The length of the lanyard might be such that tension in the lanyard activates the inertial switch as the housing <NUM> leaves the aircraft upon ejection.

In embodiments where a power source is used to provide power to the airbag initiator(s) <NUM>, the power source may be enabled to provide power only when ejection of the housing <NUM> from the aircraft has been sensed. The power source for powering the rocket motor initiator <NUM>, rocket motor control circuitry <NUM> and/or sensors <NUM> might only be enabled to provide power to one, some or all of the components only when ejection of the housing <NUM> from the aircraft has been sensed.

A tether <NUM> may couple the housing <NUM> to aircraft following ejection of the housing <NUM> from the aircraft. The tether <NUM> could be <NUM> metres long in some embodiments, but in other embodiments it could be longer or shorter. The tether <NUM> might be the lanyard that activates the inertial switch to transition the airbag initiator(s) <NUM> and/or the rocket motor <NUM> from a "safe mode" to an "operative mode" in the manner described above.

The housing <NUM> remains tethered to the aircraft by the tether <NUM> after the parachute has been deployed. The tether <NUM> might include an electrical connection <NUM> to the aircraft (such as the aircraft control system). This may enable the aircraft control system to provide sensor inputs and/or control signals to the apparatus <NUM>. Such sensor inputs and control signals may cause deployment of the parachute <NUM> and/or initiation of the rocket motor <NUM>. The tether <NUM> may be attached to the housing <NUM> via a reel which unravels when the housing <NUM> is ejected from the aircraft. The reel might be positioned in the aircraft, positioned on the outside of the housing <NUM>, or positioned on the inside of the housing <NUM>, such as within the third compartment <NUM>.

<FIG> illustrates a cross-section of an example of the parachute <NUM> after it has been deployed. One or more tethers <NUM> couple the parachute <NUM> to the housing <NUM> following ejection of the housing <NUM> and deployment of the parachute <NUM>.

The inflatable airbags <NUM> might be positioned on the inside of the canopy <NUM> to cause it to expand/open upon inflation of the airbags. In the illustrated example the inflatable airbags <NUM> are positioned along an inner periphery of the canopy <NUM>, but that need not be in the case in every example. In a different example, the inflatable airbags <NUM> might be positioned on the outside of the canopy <NUM>, such as along an outer periphery of the canopy <NUM>.

<FIG> illustrate a different embodiment of the parachute <NUM> in which the inflatable airbags <NUM> extend downwards from a centre point of the canopy <NUM>. <FIG> illustrates a side elevation of the parachute and <FIG> illustrates a view of the underside of the canopy <NUM>.

In the embodiment illustrated in <FIG>, each set of adjacent inflatable airbags <NUM> is interconnected by a non-inflatable gore <NUM>. The shading in <FIG> illustrates exterior surfaces of the inflatable airbags <NUM>. The shading in <FIG> illustrates a volume <NUM> in each inflatable airbag that has been created by the inflation of the airbags <NUM>.

The parachutes <NUM> shown in <FIG>, <FIG> are round parachutes, but that need not be the case in every example.

<FIG> illustrates an aircraft <NUM> that comprises the emergency landing apparatus <NUM>. In this example, the aircraft <NUM> is an eVTOL aircraft comprising one or more electrical motors for powering multiple rotors <NUM>. In other embodiments, the engine(s) for powering the aircraft <NUM> might be different from electrical motors. The engine(s) could include one or more combustion engines or one or more jet engines, for example.

The aircraft <NUM> comprises a launcher/means <NUM> for storing and ejecting the housing <NUM> from the aircraft <NUM>. A cover <NUM> may be provided which protects the housing <NUM> and its contents during storage. The cover <NUM> may be frangible and/or removable.

The launcher <NUM> may comprise an explosive for ejecting the housing <NUM> from the aircraft. Alternatively, the launcher <NUM> comprise a non-combustible propellant such as a pressurised gas contained in a container with a frangible surface that, when broken, releases the gas to generate thrust. The explosive/pressurised gas is indicated by reference numeral <NUM> in <FIG>.

Forces are exerted on the aircraft <NUM> when the housing <NUM> is ejected and, following ejection, from the drag generated by the parachute <NUM> and the thrust generated by the rocket motor <NUM>. The launcher <NUM> comprises a support structure <NUM> that effectively transfers those forces through the aircraft <NUM> in a manner that does not compromise the integrity of the aircraft <NUM>. A load spreading structure <NUM> may be provided that couples the support structure <NUM> to the base of the aircraft <NUM> to disperse the forces across the base.

<FIG> illustrates an embodiment of the emergency landing apparatus <NUM> in which the housing <NUM> is positioned inside the support structure <NUM> of the launcher <NUM>. A cross section of the second and third compartment <NUM>, <NUM> of the housing <NUM> are shown.

The reference numeral <NUM> indicates one or more sensors, such as an inertial sensor, which may be used to transition the rocket motor <NUM> (and possibly also the airbag initiators <NUM>) from a safe mode to an operative mode. The sensor(s) provide inputs to control circuitry <NUM> which effects the mode transition.

<FIG> also illustrates the sensor(s) <NUM>, such as an altimeter, which provide inputs to the control circuitry <NUM> (following ejection of the housing <NUM>) to enable it to decide whether to activate the rocket motor <NUM> to provide upwards thrust.

The explosive/non-combustible propellant <NUM> that is used to eject the housing <NUM> is illustrated in <FIG> further illustrates the reel <NUM> mentioned above (which, in this embodiment forms part of the launcher <NUM> rather than the housing <NUM>) and the tether <NUM> which couples the housing <NUM> to the aircraft <NUM>. An electrical connection <NUM> is illustrated which electrically connects the apparatus <NUM> (e.g. the control circuitry <NUM> of the apparatus <NUM>) to the electrical power supply and possibly the control circuitry <NUM> of the aircraft <NUM> (see <FIG>).

<FIG> illustrates some aspects of the aircraft control system. The aircraft <NUM> comprises sensor circuitry <NUM> comprising one or more sensors and control circuitry <NUM>. The sensor circuitry <NUM> is configured to sense failure of the aircraft <NUM> and/or damage to the aircraft <NUM> that might be indicative of an emergency. The sensor circuitry <NUM> might, for example, include one or more sensors for sensing engine failure and/or an altimeter for sensing descent of the aircraft <NUM>. Alternatively or additionally, the sensor circuitry <NUM> might include user input circuitry that enables a user to provide one or more inputs to indicate that an emergency has occurred which requires an emergency landing to be performed.

The control circuitry <NUM> monitors and processes inputs from the sensor circuitry <NUM>. In the event that the control circuitry <NUM> determines that the sensor inputs are indicative of an emergency situation that is causing or will cause an uncontrolled descent of the aircraft (e.g. to ground or sea), the control circuitry <NUM> controls the launcher <NUM> to eject the housing <NUM> of the emergency landing apparatus <NUM>. This is described in more detail in relation to <FIG> below.

Sensor inputs that may be indicative of an emergency situation might include sensing of a descent rate of the aircraft that exceeds a predetermined threshold (e.g. using the altimeter) and/or sensing failure of (at least an aspect of) one or more engines of the aircraft <NUM> that is preventing the aircraft <NUM> from generating sufficient upward thrust to remain airborne (or will do so in the near future). Alternatively, sensing of an excessively rapid change in aircraft attitude such as roll, pitch or yaw (e.g. sensing a rate of change that exceeds a threshold value) may cause the control circuitry <NUM> control the launcher <NUM> to eject the housing <NUM>.

The launcher <NUM> might be powered by a power source that is independent of and in addition to the power source(s) powering the aircraft <NUM>. That power source may be controlled by the control circuitry <NUM>. For instance, as a safety measure, the control circuitry <NUM> might (only) switch on the power source when the aircraft <NUM> is powered up for flight. The power source continues to provide power for a period of time after the aircraft is powered down, so that it can provide the necessary power to eject the housing <NUM> after failure of the aircraft (e.g. failure of the aircraft control system and/or the main aircraft power supply).

<FIG> illustrates a flow chart of a method of using the emergency landing apparatus <NUM>. <FIG> and <FIG> illustrate the implementation of that method in which the aircraft <NUM> performs an emergency landing using the emergency landing apparatus <NUM>.

In block <NUM> in <FIG>, the control circuitry <NUM> of the aircraft <NUM> receives and processes one or more inputs from the sensor circuitry <NUM> that are indicative of a need to perform an emergency landing. The control circuitry <NUM> responds by switching the launcher <NUM> from a safe mode to an armed/operative mode within <NUM> millisecond. The control circuitry <NUM> also responds by causing the launcher <NUM> to launch the housing <NUM> from the aircraft <NUM> within <NUM>-<NUM> milliseconds of determining a need to perform an emergency landing. This is illustrated in section <NUM> on the left-hand side of <FIG>. The housing <NUM> might, for example, be launched at a velocity of <NUM>-<NUM> metres per second.

In block <NUM> in <FIG>, the parachute <NUM> is deployed from the housing <NUM> following ejection of the housing <NUM>. This is illustrated in section <NUM> in the centre of <FIG>. In this example, the parachute <NUM> is passively deployed. That is, the parachute <NUM> exits the housing <NUM> without a further force being generated to actively eject it from the housing <NUM>. Ejection of the housing <NUM> from the aircraft <NUM> will cause upwards movement of the housing <NUM> and the parachute <NUM> positioned in the first compartment <NUM> of the housing <NUM>. The parachute <NUM> (including the uninflated airbags <NUM>) is arranged to be free to move relative to the housing <NUM> and its momentum ensures that it exits the first compartment <NUM> when housing <NUM> reaches the end of the tether <NUM> and is rapidly brought to a halt from its previous velocity of <NUM>-<NUM> metres per second. This results in passive deployment of the parachute <NUM>. The first compartment <NUM> might be tapered to facilitate passive deployment of the parachute <NUM> including the airbags <NUM>.

In some embodiments, the parachute <NUM> might instead be actively deployed. For example, it might be a ballistic parachute in which a (combustible or non-combustible) propellant is provided for ejecting it from the housing <NUM>. The control circuitry <NUM> may be configured to cause deployment of the parachute <NUM>.

In block <NUM> of <FIG>, the inflatable airbags <NUM> are inflated following deployment of the parachute <NUM>, causing the canopy <NUM> of the parachute <NUM> to expand rapidly (much more quickly than would otherwise be the case without the airbags <NUM>). This is illustrated in section <NUM> on the right-hand side of <FIG>. Expansion of the canopy <NUM> of the parachute <NUM> creates increased drag, slowing the descent of the aircraft <NUM>. <FIG> is not intended to illustrate the extent to which the distance between the canopy <NUM> and the housing <NUM> when the airbags <NUM> are inflated; it could occur at a shorter or longer distance than that illustrated in <FIG>.

Descent of the aircraft <NUM> is continually monitored by the control circuitry <NUM> of the emergency landing apparatus <NUM>, by the control circuitry <NUM> of the aircraft <NUM>, or both using the sensor circuitry <NUM> of the apparatus <NUM>, the sensor circuitry <NUM> of the aircraft, or both. This is illustrated in section <NUM> on the left-hand side of <FIG>. This continual monitoring may have begun before the housing <NUM> was ejected to initiate the emergency landing apparatus <NUM> and, as explained above, may have been at least one factor in deciding to initiate the emergency landing procedure.

In block <NUM> in <FIG>, the control circuitry <NUM> of the apparatus <NUM> or the control circuitry <NUM> of the aircraft <NUM> decides that an appropriate threshold altitude has been reached to activate the rocket motor <NUM> of the apparatus <NUM> and initiates it using the rocket motor initiator <NUM>. Following initiation, the rocket motor <NUM> begins to generate upwards thrust. This is illustrated in section <NUM> in the centre of <FIG>. The upwards thrust is sufficient to further reduce the rate of descent of the aircraft <NUM>, possibly to <NUM> metre per second or less on contact with the ground, for example. In some embodiments, the rocket motor <NUM> might be initiated about <NUM> to <NUM> metres from ground, but in other embodiments it might be different. The height at which the rocket motor <NUM> is activated may be adjustable, for example, via the control circuitry <NUM> of the aircraft <NUM>. Different descent velocities and aircraft weights will change the optimum height at which the rocket motor <NUM> is initiated in order to reduce the ground impact velocity as far as possible.

Section <NUM> on the right-hand side of <FIG> illustrates the aircraft <NUM> after an emergency landing has been safely performed. The control circuitry <NUM> of the apparatus <NUM> might or might not cause detachment of the parachute <NUM>, such as upon initiation of the rocket motors <NUM>, when the aircraft <NUM> makes contact with ground or at an instance in time between those two events. In the example illustrated in <FIG>, the parachute <NUM> has not been detached.

<FIG> illustrates another embodiment of the emergency landing apparatus <NUM> in which a safety device <NUM> is provided which prevents inadvertent inflation of the airbags <NUM> when the aircraft <NUM> is grounded. The safety device <NUM> may be safety pin that is pulled out by a person prior to take-off. In the embodiment described above in relation to <FIG> in which releasable lanyards are used to inflate the airbags <NUM>, the safety device <NUM> may prevent the lanyards from being unravelled, thereby preventing inflation of the airbags <NUM> while the aircraft <NUM> is grounded.

<FIG> illustrates a schematic of an emergency landing apparatus <NUM> according to further embodiments that do not form part of the claimed invention but are useful for understanding the invention. These further embodiments are similar to the embodiments of the invention described above in that, in an emergency landing scenario, a parachute <NUM> is deployed and then one or more rocket motors <NUM> are initiated in order to control descent of an aircraft <NUM>. These further embodiments differ from those described above, however, in that a housing <NUM> is not ejected/deployed from the aircraft <NUM> prior to or in conjunction with the deployment of the parachute <NUM>.

The emergency landing apparatus <NUM> that is used in these further embodiments is in accordance with the schematic illustrated in <FIG>. However, the control circuitry functionality is carried out by control circuitry <NUM> in the aircraft <NUM> and the sensing functionality is carried out by sensor circuitry <NUM> of the aircraft <NUM>, for example, as mentioned above in the context of <FIG>. However, unlike <FIG>, there is no launcher <NUM> for launching a housing <NUM>. Instead, the control circuitry <NUM> uses inputs from the sensor circuitry <NUM> to determine if and when to deploy the parachute <NUM>, and if and when to initiate the rocket motor(s) <NUM>.

<FIG> illustrate a plan view, upper isometric view, lower isometric view and a front view of an example of the aircraft <NUM> in an embodiment not forming part of the invention. The aircraft <NUM> may, for example, be a VTOL aircraft. In this example, the aircraft <NUM> comprises a compartment <NUM> for housing the parachute <NUM> which, in this instance, is a ballistic parachute. The aircraft <NUM> also comprises one or more rocket motors <NUM>. In the illustrated example, the aircraft <NUM> includes at least one rocket motor <NUM> positioned at each wing. Alternatively or additionally, one or more rocket motor(s) <NUM> could be positioned elsewhere, such as on the underside of the fuselage.

Each of the rocket motors <NUM> is arranged to provide upwards thrust in order to control descent of the aircraft <NUM> in an emergency landing scenario. Each of the rocket motors <NUM> may, for example, be arranged to eject efflux in a groundwards direction in order to provide upwards thrust.

As explained above, the sensing circuitry <NUM> is configured to sense failure of the aircraft <NUM> and/or damage to the aircraft <NUM> that might be indicative of an emergency. The control circuitry <NUM> is configured to monitor and process inputs from the sensor circuitry <NUM>.

<FIG> illustrates a flow chart illustrating an example of a method according to the further embodiments not forming part of the claimed invention but that are useful for understanding the invention. In block <NUM> of <FIG>, the control circuitry <NUM> receives one or more inputs from the sensor circuitry <NUM> which are indicative of an emergency situation that is causing or will cause an uncontrolled descent of the aircraft <NUM> (e.g. to ground or water). The control circuitry <NUM> responds to that in block <NUM> of <FIG> by causing deployment of the parachute <NUM> from the compartment <NUM> in order to control descent of the aircraft <NUM> during emergency landing of the aircraft <NUM>.

The parachute <NUM> may, for example, be a ballistic parachute that is ballistically/actively deployed from the compartment <NUM>. In some examples, the compartment <NUM> comprises a door that may be opened under control of the control circuitry <NUM>. In other examples, the compartment <NUM> comprises a cover that is removable and/or frangible. The cover is removed and/or broken when the parachute <NUM> is ballistically deployed. <FIG> illustrates the parachute <NUM> while it is in the process of being deployed from the aircraft <NUM>.

In block <NUM> of <FIG>, one or more airbags <NUM> of the parachute <NUM> cause the canopy <NUM> of the parachute <NUM> to expand/open rapidly. <FIG> illustrates the aircraft <NUM> after the canopy <NUM> has fully opened. The parachute <NUM> may be the same as that described above in relation to the other embodiments not forming part of the claimed invention. However, in these embodiments there is no housing <NUM> intermediate the parachute <NUM> and the aircraft <NUM>. Following deployment of the parachute <NUM>, the one or more tethers <NUM> couple the parachute <NUM> to the aircraft <NUM>. In this example, the one or more tethers <NUM> are directly connected to the aircraft <NUM> rather than an intermediate housing <NUM> which is connected to the aircraft <NUM>.

In block <NUM> of <FIG>, the control circuitry <NUM> causes initiation of the rocket motors <NUM> via the rocket motor initiator <NUM>. When the rocket motors <NUM> are initiated, they provide an upwards thrust to control descent of the aircraft <NUM> during emergency landing of the aircraft <NUM>.

The control circuitry <NUM> decides when to initiate the rocket motors <NUM> based on inputs from the sensor circuitry <NUM>. For example, the control circuitry <NUM> may decide to initiate the rocket motors <NUM> when the altitude of the aircraft <NUM> reduces to a threshold level.

In some examples, the control circuitry <NUM> may decide when to initiate the rocket motors <NUM> based on a descent rate of the aircraft <NUM>, the altitude of the aircraft <NUM> and the current weight of the aircraft <NUM>. The control circuitry <NUM> might include memory storing at least one look-up table indicating the altitude at which the rocket motors <NUM> are to be initiated, based at least in part on the current altitude of the aircraft <NUM>, the descent rate of the aircraft <NUM> and/or the current weight of the aircraft <NUM>.

The current weight of the aircraft <NUM> will have a fixed part that relates to the aircraft <NUM> and a variable aspect that depends on the weight of any crew members, passengers and/or cargo that are onboard the aircraft <NUM>. The sensor circuitry <NUM> may include one or more weight sensors configured to determine the weight of any crew members, passengers and/or cargo that are onboard the aircraft <NUM>, such that the necessary inputs may be provided to the control circuitry <NUM>. Alternatively, weight measurements might be made elsewhere, or the control circuitry <NUM> might make weight estimates. In all of these examples, the control circuitry <NUM> is making a decision as to when to initiate the rocket motors <NUM> based on an indication of the current weight of the aircraft <NUM>.

The rocket motors <NUM> eject efflux when they are operational (i.e. after initiation). The direction of the efflux depends on the orientation of the exit nozzle(s) <NUM> of the rocket motors <NUM>. The efflux is directed groundwards. The ejection of the efflux causes an upwards thrust to be generated in a direction that is opposite to the direction of ejection.

<FIG> illustrates the rocket motors <NUM> of the aircraft <NUM> ejecting efflux in a groundwards direction, as per the arrows <NUM>, <NUM>. The control circuitry <NUM> may for example, cause the parachute <NUM> to be detached upon initiation of the rocket motors <NUM> or after initiation of the rocket motors <NUM>, such as when the aircraft <NUM> makes contact with ground. <FIG> illustrates an example in which the parachute <NUM> has been detached prior to the aircraft <NUM> making contact with ground.

In some implementations, the efflux might be directed in a vertical direction (as per <FIG>). In other examples, the efflux might be angled away from the fuselage of the aircraft <NUM>.

In block <NUM> of <FIG>, the control circuitry <NUM> causes thrust that is provided by each rocket motor <NUM> to be redirected. That is, control circuitry <NUM> causes the position of the exit nozzle(s) <NUM> of each of the rocket motors <NUM> to alter, relative to the (fuselage of the) aircraft <NUM>, causing the efflux that is ejected by each rocket motor <NUM> to be redirected. This may be done in a manner that reduces the upwards thrust being provided by the rocket motors <NUM>. This enables the aircraft <NUM> to descend slowly towards ground (or water) in a controlled manner. The control circuitry <NUM> might cause the thrust that is provided by each rocket motor <NUM> to be redirected based, at least in part, on inputs from the sensor circuitry <NUM>, such as if at least one input that indicates that the aircraft <NUM> has descended to a threshold altitude (e.g. which is on or close to ground/water).

<FIG> illustrates redirection of the efflux, as per the arrows <NUM>, <NUM>. In this example, the efflux is directed away from the fuselage of the aircraft <NUM> following redirection (or is directed away from the fuselage at a greater angle to the vertical than was previously the case prior to redirection). The horizontal component of the thrust generated by each rocket motor <NUM> is substantially counteracted out by the other rocket motor <NUM> (at the other wing), leaving only the reduced vertical component of the thrust.

Prior to redirection of the efflux of the rocket motors <NUM>, the rocket motors <NUM> provide upwards thrust of a first magnitude and, following redirection of the efflux, the rocket motors provide upwards thrust of a second magnitude, where the first magnitude is greater than the second magnitude. In some instances, the second magnitude might be substantially zero. That is, the efflux may be redirected such that there is substantially no upwards thrust. In the example illustrated in <FIG>, the horizontal thrust from the rocket motors <NUM> is cancelled out following redirection, allowing the rocket motors <NUM> to burn out without providing a hazard once the emergency has been dealt with (e.g. the altitude of the aircraft <NUM> has been sufficiently reduced in a controlled manner, such that the aircraft <NUM> is on ground/water or close to ground/water).

The control circuitry <NUM> may be configured to cause movement (e.g. rotation) of at least a part of a rocket motor <NUM>, such as the (outer) casing of the rocket motor <NUM> in order to redirect the efflux ejected by that rocket motor <NUM>.

The control circuitry <NUM> may be configured to redirect the efflux into one or more predefined directions. For example, the efflux may be redirected from a first, original, direction, into a second direction. The direction of the efflux is continuously changing as it moves from the first direction to the second direction. At a later point in time, the efflux may then be redirected from the second direction into a third direction. The direction of the efflux is continuously changing as it moves from the second direction to the third direction. In some instances, the efflux may be redirected from the first direction into the third direction (e.g. in one continuous movement). The direction of the efflux in each of the first, second and third directions may be such that the upwards thrust that is provided is greater in the first direction than in the second and third directions, and greater in the second direction than in the third direction.

In some emergency landing scenarios, the control circuitry <NUM> might not cause the parachute <NUM> to be deployed. Instead, the control circuitry <NUM> might begin the method of <FIG> at block <NUM> and initiate the rocket motors <NUM>, redirecting the efflux ejected by the rocket motors <NUM> (as per block <NUM> in <FIG>) if necessary/desired. The decision as to whether to deploy the parachute <NUM> might depend on the inputs received by the control circuitry <NUM> from the sensor circuitry <NUM>. For example, if the sensor circuitry <NUM> provides at least one input that is indicative of an emergency when the altitude of the aircraft <NUM> is below a threshold level, the control circuitry <NUM> may initiate the rocket motor(s) <NUM> without deploying the parachute <NUM>.

Each rocket motor <NUM> might be a "linear rocket motor" of the same or a similar configuration to those described in prior <CIT>. A "linear rocket motor" is considered to be a rocket motor comprising a casing having a length dimension, a width dimension and a height/depth dimension, where the length dimension is greater than the width dimension and the height/depth dimension, and the rocket motor <NUM> is configured to generate thrust in a direction that is perpendicular to the length dimension of the casing.

Advantageously, the further embodiments useful for understanding the invention enable an aircraft <NUM> to safely perform an emergency landing. Emergency landing might, for example, be made possible for aircraft <NUM> that do not have any rotors and/or aircraft <NUM> that have rotors which are unable to autorotate.

<FIG> illustrates a first cross section of a linear rocket motor <NUM> that might be used in the further embodiments not forming part of the claimed invention but that are useful for understanding the invention. <FIG> illustrates a cross-section of the linear rocket motor <NUM> through the line A-A in <FIG>.

The linear rocket motor <NUM> illustrated in <FIG> comprises a casing <NUM> which comprises at least one wall. In the illustrated example, the at least one wall is a single wall having a substantially circular cross-section, but that need not be the case in every example. The length dimension L and the height/depth dimension H are indicated in <FIG>. The width dimension W and the height/depth dimension H are indicated in <FIG>.

The casing <NUM> defines an internal enclosure/chamber <NUM> in which propellent, such as solid, combustible propellant might be stored. Solid propellant is considered to be safer to use than liquid propellant. Liquid propellant is more likely to present a fire hazard when an emergency landing is performed. In at least some prior rocket motors, use of solid propellant in the rocket motor has resulted in an inability to vary the level of thrust of the rocket motor while thrust is being generated. Advantageously, in the further embodiments that are useful for understanding the invention, a variable upwards thrust is achieved by re-directing the efflux from the rocket motor <NUM> as described above, and the safety benefit provided by the use of solid propellant is also achieved.

In this example, a plurality of diverging (cone-shaped) exit nozzles <NUM> protrude outwardly from the outer surface of the at least one wall of the casing <NUM> of the rocket motor <NUM>. In other examples, they might extend inwardly into the casing <NUM>. In some implementations, such as the one illustrated, an exit nozzle <NUM> is positioned at substantially each end of the casing <NUM> of the rocket motor <NUM>. There are no exit nozzles positioned between those that are located at substantially each end of the casing <NUM>.

In the illustrated example, each of the exit nozzles <NUM> includes a thread that is configured to connect it to a thread of the casing <NUM>. A thermal insulator provides a protective lining <NUM> to thermally insulate each of the threaded connections between the casing <NUM> and an exit nozzle <NUM>.

The arrows labelled with an E in <FIG> indicate the direction in which efflux is ejected from the exit nozzles <NUM> in use, when the propellant in the chamber <NUM> is burned. The arrows labelled with a T in <FIG> indicate the direction in which an equal and opposite thrust is generated due to the ejection of the efflux E.

<FIG> illustrate the rocket motor <NUM> of <FIG> positioned at a wing <NUM> of an aircraft <NUM>. In this example, the rocket motor <NUM> is positioned within the wing <NUM>, but in other examples in might be positioned underneath the wing <NUM>, for instance.

The control circuitry <NUM> is configured to provide control signals to cause the rocket motor <NUM> to move/rotate. In this regard, an actuator <NUM>, such as a Metron/explosively driven ram actuator or an electrical actuator, may be used to provide the force to the rocket motor <NUM> that causes it to move/rotate, under the control of the control circuitry <NUM>. The electrical actuator may be or comprise a stepper motor, for example, which is configured to move/rotate the rocket motor <NUM> in discrete steps.

The actuator <NUM> is coupled to a rack and cog system which enables the casing of the rocket motor <NUM> to rotate outwardly into a plurality of different positions, causing the direction in which efflux is ejected to be adjusted. The rocket motor <NUM> might be rotated through more than <NUM> degrees when moving from a first position to a second position. In some examples, the rocket motor <NUM> might be rotated through <NUM>-<NUM> degrees when moving from the first position to the second position. In the illustrated example two exit nozzles <NUM> are provided for ejecting efflux, but in other examples more or fewer exit nozzles <NUM> might be provided.

In some examples, the rocket motors <NUM> on each side/wing of the aircraft <NUM> might be moved/rotated by the same extent (e.g. at the same time). Alternatively, the rocket motors <NUM> on each side/wing of the aircraft <NUM> may be moved/rotated to different extents to provide some lateral thrust to assist in steering the aircraft to a preferred landing location.

<FIG> and <FIG> illustrate a schematic showing how rocket motors <NUM> might be moved/rotated substantially simultaneously. Each of the rocket motors <NUM> illustrated in <FIG> and <FIG> is positioned on a different wing <NUM> of the aircraft <NUM>. <FIG> illustrates the rocket motors <NUM> prior to reorientation; <FIG> illustrates the rocket motors <NUM> following reorientation. The direction of the ejected efflux E and the corresponding thrust T are shown in <FIG> and <FIG>.

In the illustrated example, the rocket motors <NUM> are connected together by a tractor <NUM>, which might be a cable or belt, for instance. The tractor <NUM> extends across a plurality of pulleys <NUM>.

The control circuitry <NUM> is configured to cause an actuator <NUM> to apply a force to the tractor <NUM>, which causes the tractor <NUM> to apply a pulling force to each of the rocket motors <NUM>, rotating them outwardly. This is achieved in the illustrated example by the actuator <NUM> applying a force to the tractor <NUM> at a location between the two pulleys <NUM>. The outward rotation of the rocket motors <NUM> changes the orientation of the (exit nozzles <NUM> of the) rocket motors <NUM>, redirecting the efflux that is being ejected and reducing the magnitude of the upwards thrust that is being provided.

<FIG> illustrate an end view, a side view, an underside perspective view and an elevated perspective view of another of the further embodiments of the emergency landing apparatus <NUM> that are useful for understanding the invention. The emergency landing apparatus <NUM> comprises a housing <NUM>, one or more rocket motors <NUM> and a compartment <NUM> for storing a parachute <NUM> (not shown in <FIG> for clarity). The compartment <NUM> may be covered by a cover (not shown), which might be removable and/or frangible.

The emergency landing apparatus <NUM> illustrated in <FIG> is similar to those illustrated in <FIG>, <FIG>, <FIG>, <FIG> and <FIG> in that the apparatus <NUM> is deployable/ejectable/launchable from an aircraft <NUM> and is coupled to the aircraft <NUM> by at least one tether <NUM> following deployment/ejection/launch. An electrical connection to the aircraft <NUM> may be maintained following deployment, as explained above.

In the illustrated example, a plurality of rocket motors <NUM> is provided. The rocket motors <NUM> have the same form as those described above in relation to <FIG> and operate in a similar manner. The efflux of the rocket motors <NUM> is controlled in a similar manner in to that described above in relation to <FIG> and, as such, aspects of the description of that control are applicable here.

In this example, the emergency landing apparatus <NUM> and the housing <NUM> have the general shape of a triangular prism, but other shapes are possible. The housing <NUM> of the apparatus <NUM> includes end caps <NUM>.

<FIG> show the same views as <FIG>, but the end caps <NUM> have been removed. <FIG> includes a larger version of <FIG>, with an end cap <NUM> also shown.

The parachute <NUM> stored in the compartment <NUM> is steerable. It might, for example, be a ram-air parachute or a Rogallo wing parachute. The apparatus <NUM> comprises a steering mechanism <NUM> for steering the parachute <NUM> after it has been deployed from the housing <NUM>. The steering mechanism <NUM> is coupled to the parachute <NUM> by one or more steering lines. Each steering line may provide a direct connection between the steering mechanism <NUM> and the canopy <NUM> of the parachute <NUM>. For example, a first steering line may extend from the steering mechanism <NUM> to a position at or close to a first end/edge of the canopy <NUM>, and a second steering line may extend from the steering mechanism <NUM> to a position at or close to a second end/edge of the canopy <NUM>.

The steering mechanism <NUM> may be configured to steer the steerable parachute by increasing and/or decreasing a length of at least one of the steering lines between the steering mechanism <NUM> and the canopy <NUM>. In the illustrated example, the steering mechanism <NUM> comprises a first steering winch and a second steering winch that are provided at opposite ends of the housing <NUM>. Each steering winch is configured to reel in and reel out its steering line(s) as necessary to steer the parachute <NUM> (and thereby steer the coupled aircraft <NUM>).

The steering mechanism <NUM> may be controlled by the pilot of the aircraft <NUM> or may be controlled autonomously by control circuitry <NUM> of the aircraft <NUM> or may be controlled autonomously by control circuitry <NUM> of the apparatus <NUM>.

<FIG> illustrate an end view, a side view, an underside perspective view and an elevated perspective view of the emergency landing apparatus <NUM> shown in <FIG>, where portions of the housing <NUM> are transparent to show the interior of the apparatus <NUM>.

Operation of the rocket motors <NUM> of the apparatus <NUM> is best understood from <FIG>. As explained above in relation to other embodiments, the rocket motors <NUM> are arranged to provide upwards thrust to control descent of an aircraft <NUM> during emergency landing of the aircraft <NUM>. Initiation of the rocket motors <NUM> may be controlled by control circuitry <NUM> of the aircraft <NUM> or control circuitry <NUM> of the apparatus <NUM>. After the apparatus <NUM> has been deployed/ejected from the aircraft <NUM>, the exit nozzles <NUM> of the rocket motors <NUM> are initially arranged to eject efflux groundwards (vertically or in a direction which is angled, to some extent, to the vertical). This initial positioning of the exit nozzles <NUM> is illustrated in <FIG>. When the exit nozzles <NUM> are positioned in this manner, the ejection of the efflux causes an upwards thrust to be generated in a direction that is opposite to the direction of ejection.

In order to change the direction of the efflux and the thrust that is generated, the exit nozzles <NUM> may be moved/rotated, for example, by moving at least part of the casing of each rocket motor <NUM> in the manner described above in relation to <FIG> and <FIG>. Control circuitry <NUM>/<NUM> of the apparatus <NUM> or the aircraft <NUM> may provide a control signal to initiate movement of the exit nozzles <NUM>. The apparatus <NUM> comprises means for moving the exit nozzles <NUM> that is responsive to such a control signal. The means may comprise one or more Metron actuators/explosively driven rams <NUM> and/or one or more stepper motors, for example. In the illustrated example, the means comprises a plurality of explosively driven rams <NUM>. In practice, only one explosively driven ram <NUM> might be required, but inclusion of a plurality provides some redundancy in case of a failure to fire, for example.

In response to receiving a control signal, the explosively driven ram <NUM> applies a (downwards) force to a tractor/chain <NUM> which is coupled to the rocket motors <NUM>. In this example, the tractor <NUM> extends around and is connected to a periphery of the casing of each rocket motor <NUM>. When the explosively driven ram <NUM> applies a force to the tractor <NUM>, the tractor <NUM> pulls the rocket motors <NUM>, rotating each of their casings and rotating the exit nozzles <NUM> outwardly (simultaneously). Movement of the exit nozzles <NUM> in this manner reduces the vertical component of the thrust generated by the rocket motors <NUM>.

At least one stop <NUM> may be provided to limit the movement of the exit nozzles <NUM> of the rocket motors <NUM>. In the illustrated example, an elongate stop <NUM> is positioned on the exterior of each elongate side of the housing <NUM> to limit such movement, but it will be appreciated by those skilled in the art that other forms of stop could be used.

The apparatus <NUM> further comprises at least one receptacle <NUM> defining an internal chamber for storing a coolant, such as carbon dioxide. The coolant is a fluid and might be in a liquid state or a gaseous state, for example. In this example a receptacle <NUM> storing coolant is provided for each rocket motor <NUM>, but in other instances a single receptacle <NUM> could be provided for storing coolant for multiple rocket motors <NUM>.

The apparatus <NUM> includes at least one conduit <NUM> which defines a channel along with coolant may pass from the receptacle(s) <NUM> and the internal chambers of the rocket motors <NUM>. At least one valve <NUM> is provided for controlling the passage of coolant along the at least one conduit <NUM>, from the receptacle(s) <NUM> to the internal chamber(s) <NUM> of the rocket motors <NUM>.

The valve <NUM> is configured to transition from a closed state to an open state in response to initiation of a rocket motor <NUM> (that is, when the propellant in the internal chamber <NUM> of the rocket motor <NUM> is ignited). For example, pressure generated from combustion of the propellant may cause the valve <NUM> to transition automatically from the closed state to the open state. When the valve <NUM> is in its closed state, it is configured to prevent the coolant from passing from the receptacle(s) <NUM> to the internal chamber(s) of the rocket motor(s) <NUM>. When the valve <NUM> is in its open state, it is configured to enable the coolant to pass from the receptacle(s) <NUM> to the internal chamber(s) <NUM> of the rocket motor(s) <NUM>.

When the valve <NUM> transitions to its open state, the pressure generated from combustion of the propellant prevents the coolant from entering the internal chamber(s) <NUM> of the rocket motor(s) <NUM> for a period of time, while the pressure generated from combustion of the propellant is greater than the (static) pressure generated by the coolant. However, during the combustion process a point in time is reached where the pressure generated by the coolant exceeds the pressure in the internal chamber(s) <NUM> of the rocket motor(s) <NUM>. When this occurs, the coolant enters the internal chamber(s) <NUM>, cooling the internal chamber(s) <NUM>. Advantageously, this prevents residual burning in the internal chambers <NUM> which might otherwise create a safety hazard.

In this example, the at least one conduit provides an open channel between the internal chambers <NUM> of the rocket motors <NUM>. When the valve <NUM> is in its closed state, the channel between the rocket motors <NUM> remains open, but the channel(s) from the receptacle(s) <NUM> storing the coolant and the internal chamber(s) <NUM> of the rocket motors is/are closed by the valve <NUM> (such that no coolant can pass from the receptacle(s) <NUM> to the internal chamber(s) <NUM>). Thus, if one rocket motor <NUM> is successfully initiated, the open channel between the internal chamber <NUM> of that rocket motor <NUM> and the internal chamber <NUM> of the other rocket motor <NUM> should ensure that the other rocket motor <NUM> is successfully (fully) initiated. This means that the rocket motors <NUM> each generate substantially the same thrust, which is particularly important following rotation of the exit nozzles <NUM>. If the thrust generated by rocket motors <NUM> were not substantially the same following the rotation of the exit nozzles <NUM>, a net horizontal thrust would be produced in addition to a net upwards thrust, which may be undesired.

<FIG> illustrate emergency landing apparatus of <FIG> and its parachute being deployed.

In this example, the parachute <NUM> stored in the compartment <NUM> is ballistically/actively deployed and is steerable. The additional detail shown in <FIG> (omitted from other figures for clarity reasons) illustrates first and second rockets <NUM>, each of which is coupled to the parachute <NUM> by one or more tractors/lines. The rockets <NUM> are arranged to follow divergent trajectories, following their initiation, in order to ballistically deploy the parachute in a rapid manner.

<FIG> illustrates a point in time in which the first and second rockets <NUM> have been initiated and are following divergent trajectories from one another. The rockets <NUM> are tethered to the canopy <NUM> of the parachute <NUM> and cause it to open rapidly. <FIG> illustrates a point in time in which the canopy <NUM> is partially open. The canopy <NUM> is coupled to the housing <NUM> of the apparatus <NUM> by, for example, one or more steering lines <NUM> and/or one or more (other) tethers. As the canopy <NUM> opens, it applies an upwards force to the housing <NUM>, causing it to deploy/eject from the aircraft <NUM>. This is illustrated in <FIG>. It can also be seen in <FIG> that the housing <NUM> is coupled to (the fuselage of) the aircraft <NUM> by one or more tethers <NUM>. Those tethers <NUM> eventually become taut in conjunction with the opening of the canopy <NUM>, as shown in <FIG>. The parachute <NUM> reduces the rate of descent of the aircraft <NUM> and potentially enables a safe landing to be performed. The aircraft <NUM> can be steered using the steering lines <NUM> which connect the housing <NUM> to the canopy <NUM>, enabling a safe landing location to be reached.

As explained above, the apparatus <NUM> and/or the aircraft <NUM> may include one or more sensors/sensor circuitry <NUM>/<NUM> which may be used to determine when to initiate the rocket motors <NUM>. For instance, when the aircraft <NUM> is close to ground or water (e.g. <NUM> to <NUM> metres from ground or water), the rocket motors <NUM> may be initiated to reduce the rate of descent of the aircraft <NUM>. Subsequently the exit nozzles <NUM> of the rocket motors <NUM> may be moved/rotated in the manner described above, redirecting the efflux that is being ejected and reducing the magnitude of the upwards thrust that is being provided, thereby enabling the aircraft <NUM> to land safely.

It was explained above that emergency landing apparatus <NUM> may include sensors/sensor circuitry <NUM> for sensing a descent rate of an aircraft <NUM>. <FIG> includes an example of such sensors <NUM>. The sensors <NUM> are configured to sense the altitude of the aircraft <NUM>. The sensors <NUM> may be retrofitted to an aircraft <NUM>, or fitted when the aircraft <NUM> is manufactured. The sensors <NUM> are positioned on a curved surface <NUM>, which may be formed by a portion of a sphere. For example, the surface <NUM> may comprise at least a hemispherical portion of a sphere. It might be substantially hemispherical.

The sensors <NUM> are coupled to an underside of an aircraft <NUM>, such as the fuselage of the aircraft <NUM>. For example, an upper surface/portion <NUM> may be coupled to an underside of the fuselage of the aircraft <NUM>. The upper surface/portion <NUM> is substantially flat in the illustration, but need not be in other examples.

<FIG> illustrates a first axis <NUM>, a second axis <NUM> and a third axis <NUM>. The third axis <NUM> extends into and out of the page in <FIG>. The sensors <NUM> are distributed about the first, second and third axes <NUM>, <NUM>, <NUM>. When the sensors <NUM> are coupled to an underside of an aircraft <NUM>, the first axis <NUM> may be substantially parallel to (and possibly coincident with) the normal/yaw axis of the aircraft <NUM>. The second axis <NUM> may be substantially parallel with the transverse/lateral/pitch axis of the aircraft <NUM>. The third axis <NUM> may be substantially parallel with the longitudinal/roll axis of the aircraft <NUM>.

The sensors <NUM> may be distributed about a solid angle of at least (substantially) π steradians or at least (substantially) 2π steradians. In the illustrated example, the sensors <NUM> are distributed about a solid angle that is substantially 2π steradians.

The sensors <NUM> may be configured to transmit and receive wireless signals, such as radio signals or light signals (e.g. laser signals), in order to sense the altitude of the aircraft <NUM>. Wireless signals transmitted by the sensors <NUM> may be reflected from ground or water such that the reflections are received at the sensors <NUM>.

The sensors <NUM> might be arranged/directed such that they collectively to transmit (and receive) wireless signals across a solid angle of at least (substantially) π steradians or at least (substantially) 2rr steradians, although in some embodiments it could be less. One or more gaps may exist within the solid angle in which there is no signal coverage.

In an emergency landing situation, the control circuitry <NUM> is configured to determine when to initiate the rocket motor(s) <NUM> to provide upwards thrust, based at least in part on inputs from the sensors <NUM>. The control circuitry <NUM> may be able to determine the descent rate of the aircraft <NUM> from inputs provided by the sensors <NUM> over a period of time, and the altitude of the aircraft <NUM> from one or more inputs provided by the sensors <NUM> at an instance in time.

An advantage of the sensor distribution illustrated in <FIG> is that the sensors <NUM> are able to determine the altitude of the aircraft <NUM> across a large range of pitch, roll and yaw angles. In some embodiments, the control circuitry <NUM> might determine the altitude of the aircraft <NUM> to be the lowest measurement determined by the sensors <NUM>, or it might make an interpolation from multiple measurements.

<FIG> illustrates a flow chart of a method which may incorporate any of the aspects of the further embodiments useful for understanding the invention that are described above.

In block <NUM> of <FIG>, sensors/sensor circuitry <NUM>/<NUM> of the apparatus <NUM> and/or the aircraft <NUM> sense failure of the aircraft <NUM> and/or damage to the aircraft <NUM> that may be indicative of an emergency, as described above.

In block <NUM> of <FIG>, optionally, if the emergency landing apparatus <NUM> comprises a deployable housing <NUM>, in response to sensing failure of the aircraft <NUM> and/or damage to the aircraft <NUM> that may be indicative of an emergency in block <NUM>, that housing <NUM> is deployed in the manner described above.

In block <NUM> of <FIG>, optionally, if the emergency landing apparatus <NUM> comprises a parachute <NUM>, such as any of the parachutes described above, the parachute <NUM> is deployed in the manner described above. It might be an actively deployed ballistic parachute <NUM> and/or it might include one or more inflatable airbags <NUM> for rapid deployment.

In block <NUM> of <FIG>, the control circuitry <NUM> of the apparatus <NUM> and/or the control circuitry <NUM> of the aircraft <NUM> monitors inputs from the sensors/sensor circuitry <NUM>/<NUM> in order to monitor the altitude, descent rate and/or current weight of the aircraft <NUM>. This monitoring may commence before, after or upon sensing an emergency in block <NUM>.

In block <NUM> of <FIG>, the control circuitry <NUM> of the apparatus <NUM> or the control circuitry <NUM> of the aircraft <NUM> initiates the one or more rocket motors <NUM>. After the rocket motors <NUM> have been initiated, they provide an upwards thrust to control descent of the aircraft <NUM> to enable an emergency landing to be performed. The control circuitry <NUM>/<NUM> determines when to initiate the rocket motor(s) <NUM> based, at least in part, on the sensed altitude, descent rate and/or current weight of the aircraft <NUM>. The control circuitry <NUM>/<NUM> may include memory storing a look-up table indicating when the rocket motors <NUM> are to be initiated based on the sensed altitude, descent rate and current weight of the aircraft <NUM>.

At block <NUM> of <FIG>, optionally, if multiple rocket motors <NUM> are provided and one or more conduits <NUM> are provided coupling the internal chambers of those rocket motors <NUM> to one another, failure to initiate a particular rocket motor <NUM> may be prevented by the passage of hot gas from an internal chamber of a successfully initiated rocket motor <NUM> to an internal chamber of a rocket motor <NUM> that was not successfully initiated. Also, at block <NUM> of <FIG>, if a valve <NUM> is provided which controls the passage of coolant to an internal chamber of a rocket motor <NUM>, that valve <NUM> is opened by the high pressure generated in the internal chamber of the rocket motor <NUM>.

At block <NUM> of <FIG>, optionally, following the initiation of the rocket motors <NUM>, the efflux of the rocket motors <NUM> may be re-directed to reduce the upwards thrust being provided in the manner described above. The efflux may be re-directed by rotating the rocket motors <NUM>. The re-direction may be a continuous process which is achieved by gradual rotation of the rocket motors <NUM>. The gradual reduction in the upwards thrust provides a controlled landing for the aircraft <NUM>.

The rocket motors <NUM> continue to burn until substantially the whole of the (solid) propellant has been consumed. When this has occurred, optionally, at block <NUM> of <FIG>, if coolant is provided, the coolant is able to enter the internal chambers of the rocket motors <NUM> to cool them.

At block <NUM> of <FIG>, optionally, if a parachute <NUM> was deployed, that parachute <NUM> is detached. It may be detached, for example, as the aircraft <NUM> lands. Freed from the weight of the aircraft <NUM>, the parachute <NUM> drifts away from the aircraft <NUM>, potentially taking the housing <NUM> with it (if a housing <NUM> has been deployed).

For example, the emergency landing apparatus <NUM> may include alert circuitry (such as a red warning light) which is activated upon the powering up/arming of the airbag initiator(s) <NUM>, the rocket motor initiator <NUM>, control circuitry <NUM> and/or the sensor(s) <NUM>. This might occur, for example, if the apparatus <NUM> is dropped, causing activation of an inertial switch.

In all of the embodiments described above, the parachute <NUM> might be a steerable parachute. The steerable parachute <NUM> may be controlled by the control circuitry <NUM>/<NUM> (e.g. controlling the tethers <NUM> via electric motors) to control the path of the aircraft <NUM> as it descends. The parachute <NUM> could be a Rogallo wing-type parachute or a ram-air parachute.

An audible and/or visual warning signal might be provided from the aircraft <NUM> in the event of an emergency, under the control of the control circuitry <NUM> and in response to one or more inputs from the sensor circuitry <NUM>/<NUM>.

Rather than rotating or moving the whole of a rocket motor <NUM> in order to redirect the efflux as described above, a moveable flap (positioned on or close to the exit nozzle(s) <NUM>) might instead be provided to redirect the efflux.

In some embodiments, the control circuity <NUM>, <NUM>, may be an application specific integrated circuit (ASIC) rather than a general purpose, programmable processor. The control circuity <NUM>, <NUM> may comprise processing circuitry and memory. The memory stores control data (such as one or more look-up tables) defining how the rocket motor(s) <NUM> is/are to be controlled in response to inputs from the sensor circuitry <NUM>, <NUM>. The processing circuitry processes the inputs from the sensor circuitry <NUM>, <NUM>, accesses the memory and responds in accordance with the stored control data.

In some implementations, the rocket motors <NUM> are designed such that if they are activated, all of the propellant is burned. This can be achieved by redirecting the efflux of the rocket motors <NUM> in the manner described above. This reduces the risk to first responders that attend an aircraft landing site.

The aircraft <NUM> need not include the sensor arrangement illustrated in <FIG>. In other embodiments, the sensors/sensor circuitry <NUM> might be a gyroscope-controlled gimbal system or a mass-controlled system that causes at least one sensor to remain pointing groundwards and substantially aligned with the vertical, irrespective of the attitude of the aircraft <NUM>.

Block <NUM> in <FIG> and block <NUM> in <FIG> relating to inflation of one or more airbags are optional. For example, a parachute comprising one or more airbags could be replaced by a ballistically deployed parachute and vice versa. The ballistically deployed parachute may comprise the airbags. Also, a standard parachute might be used.

Claim 1:
An emergency landing apparatus (<NUM>) for an aircraft (<NUM>), the emergency landing apparatus comprising:
a housing (<NUM>) for ejection from the aircraft;
a parachute (<NUM>), arranged for deployment from the housing, comprising a canopy (<NUM>);
a rocket motor (<NUM>), positioned in the housing, arranged to provide upwards thrust to control descent of the aircraft during emergency landing of the aircraft;
a rocket motor initiator (<NUM>), positioned in the housing, arranged to initiate the rocket motor; and
one or more sensors (<NUM>) for sensing ejection of the housing from the aircraft and for arming the rocket motor initiator in response to sensing ejection of the housing from the aircraft.