Introduction:
Whole airframe recovery parachute systems have made impressive advances in safety for general aviation aircraft for nearly four decades: thousands of systems have been put into service, and over 500 lives saved with this technology. The problem is that a conventional ballistically deployed airframe recovery parachute system will not work effectively in a VTOL environment due to lack of forward speed and dependence on altitude-loss to inflate the large parachute canopy required to provide a maximum 9.1 metres per second. Ground Impact Velocity. Only recently have new technologies been developed to address the typical shortcomings of traditional recovery systems (particularly the low-altitude limitation) and several new options now exist which deliver enhanced Emergency Descent Arrest Systems (EDAS) performance, reducing ultimate ground impact velocities (GIV), potentially to the level of a soft landing (1-2 metres per second) and improving overall occupant safety, even in the vulnerable VTOL phase of flight.
Typical flight operations for rotorcraft (such as helicopters and multi-rotor electric VTOL aircraft), especially in an advanced or urban mobility context, can involve significant flight-time in hover (with little or no forward velocity), quite unlike general aviation aircraft which require a traditional runway for take-off and landing. Moreover, electric VTOL platforms (often with high-velocity / low-mass / low-momentum lift fans) can lack the capability to flare, autorotate and arrest an emergency (vertical) descent: for example, a ducted fan is incapable of producing the necessary lift during an attempted autorotation. Without an EDAS, critical loss of thrust or control results in occupant protection within the descending rotorcraft (in common with all aircraft types) being entirely dependent on the Landing Gear/Skids, fuselage Sub-Floor and the Seats, working together as a system to mitigate the landing effects on the occupants. Collectively these elements are designed to dissipate energy from a crash event and reduce some of the significant G loads on the occupants. Whole airframe parachute recovery systems are designed to reduce loads at touchdown to below the aircraft certification limits: this level may be injurious but should allow the occupant to self-extract from the aircraft to safety.
There are several considerations in the design of today’s rotorcraft including the emerging VTOL vehicles designed for advanced/urban air mobility (AAM/UAM). With UAM aircraft designed for predominantly multiple short-hop flights, this means a higher number of take-offs and landings per day than traditional rotorcraft or aircraft, and increased workload for crew, the airframe and the lift/propulsion systems. Typically, low-altitude operation exposes the VTOL aircraft to greater bird density (compared with general aviation) and therefore higher risk of bird strike to the VTOL aircraft. Any of today’s VTOL aircraft may consider the following measures to arrest the emergency descent of an aircraft:
1. Reserve Power
Reserve Power supply and lift/thrust options can be designed into the aircraft to enhance reliability during all phases of operation, and especially to cater for a controlled emergency landing if the main power supply/propulsion system fails.
Whilst this architecture can address a main engine failure and enable a controlled landing, reserve power does not overcome loss-of-lift (for example from a catastrophic bird strike event and/or rotor blade damage), and can add significant additional weight (motor + power source) to the airframe.
2. Emergency Descent Arrest System (EDAS)
EDAS solutions can mitigate a loss of main lift propulsion on the aircraft, reducing Ground Impact Velocity (GIV) in a crash, and enable a survivable emergency landing (in terms of GIV). Single lift/thrust unit failure/malfunction should not affect the continued safe flight and landing of the VTOL aircraft [VTOL.2510], and EDAS activation and deployment would not be anticipated to result from a single lift/thrust unit failure/malfunction. Multiple lift/thrust unit failures/malfunctions could affect the continued safe flight and landing of the VTOL aircraft, and so EDAS activation and deployment could be anticipated to result from multiple lift/thrust unit failures/malfunctions.
From a brief consideration of emergency/crash landing scenarios, deployment of the EDAS should not impede operation and control of the installed lift/thrust system [VTOL.2430]. Descent and landing under EDAS should remain within Limit Loads for the VTOL aircraft structure [VTOL.2230]. EDAS should not impede conduct of a controlled emergency landing (Category Basic) nor continued safe flight and landing (Category Enhanced) following bird impact(s) [VTOL.2250]. Following an emergency landing, the EDAS (whether activated or not activated) should not obstruct means of egress/exits [VTOL.2315] nor present an injury hazard to occupants during their egress from the aircraft [VTOL.2270].
Considering aircraft design performance, single-mode failures in the EDAS should not result in catastrophic failure of the VTOL aircraft
[VTOL.2510], and in-service monitoring (built-in-test) in the EDAS sub-system can contribute to functional reliability of the aircraft [VTOL.2510(c)]. Reliability and the expected Functional Performance of the EDAS should be included in determining the Function Development Assurance Levels (FDAL) for a VTOL aircraft with flight crew on board [VTOL.2510].
EDAS maintenance should support the ensured Continued Airworthiness of the VTOL aircraft [VTOL.2625] Limit and Ultimate Loads on the VTOL airframe induced by the deployment of an EDAS system shall be determined [VTOL.2225, VTOL.2230]. Operation (intended or fault) of the EDAS should not generate high-energy fragments [VTOL.2240]. The EDAS should not present a risk of fire to the VTOL aircraft, with the EDAS sub-system designed to withstand crash load factors per MOC SC-VTOL, and its crash resistance demonstrated by drop testing [MOC VTOL.2325(a)(4)].
What Emergency Descent Arrest Systems Exist?
There are multiple EDAS solution pathways. Each of these EDAS concepts add weight to the airframe, and can recover the entire aircraft to the ground with a survivable touch-down condition. Some of these EDAS solution
pathways are outlined below:
Whole-Aircraft Emergency Recovery Parachute systems can deliver a survivable landing, usually at 7 to 10metres per second GIV, following critical loss of thrust and/or loss of control; these parachute systems are designed to recover the entire aircraft, including airframe and occupants, to the ground in an emergency. Attached by harness straps to hard-points on the aircraft fuselage, the parachute is usually deployed by the action of a manual emergency handle in the cockpit, which triggers the parachute extraction sequence.
Ejection of the parachute can be accelerated with the release of stored-energy, for example using compressed gas or a (chemical propellant) tractor rocket: these Ballistic Parachute Recovery Systems are in manufacture and in service on light aircraft worldwide (for example the one from Ballistic Recovery Systems Inc and another from Galaxy GRS).
Ballistic Parachute system weights (for light aircraft) are typically 75-100lbs (35-45kg), some achieving a descent velocity of c.7.0 to 7.5 metres per second. Given the time required for the ballistically-ejected parachute canopy to inflate (often constrained by a Slider to limit the shock loading on the airframe structure), parachute-based recovery systems can have a low-altitude limitation ranging from at least 100-feet (33-meters) through 450-feet (150 meters) to 600-feet (200 meters) in the case of aircraft engine failure.
Recovery Parachute deployment can be further accelerated through the use of multiple small parachutes, reducing the inflation time (and reducing low-altitude limitation). Developing multi-parachute systems include the Galaxy GRS Robur system, with distributed small parachutes achieving unmanned platform descent rate of c.7.5 metres per second.
Aviation Safety Resources (ASR) combine multiple ballistically-extrcted recovery parachutes with a retro-rocket effector to slow the descent in its Xtreme Rapid Deployment (XRD) vehicle recovery system. Having been deployed on a tether from the airframe with the parachutes, the XRD retro-rocket continues to produce thrust and deliver lift to the aircraft to prevent it acquiring a high descent rate whilst the parachutes inflate: this reduces the minimum deployment altitude c.100ft/33m.
The EDAS concept from Active VTOL Crash Prevention (AVCP) Ltd. further extends the role of a Retro-Rocket system, with an actively-ejected small drogue parachute (which can be launched over a broad aircraft speed range) stabilising the aircraft attitude and limiting the maximum descent rate to 25 metres per second, with a twinned, rotating, self-extinguishing solid rocket motor system delivering emergency lift during the final 15m to 5m of the descent to the ground. The altitude at which the motors are fired is dependent on the weight and the current descent rate of the aircraft.
On landing, the AVCP system rotates the rocket motors so that the initial vertical thrust switches to a horizontallyopposed orientation: this prevents excess thrust lifting the aircraft off the ground again, especially in the case of lower descent-rate incidents where only a proportion of the total motor impulse is required. An automatic carbondioxide quench system ensures the rocket motors are fully extinguished on landing, and cools the motor casings to prevent fire and avoid a hazard to egress from the aircraft.
Basic airframe crashworthiness standards (FAA and EASA) of either 9.1 metres per second or 10 metres per second are expected, effectively including a free unpowered fall from 5m altitude (resulting in a 9.9 metres per second GIV): with a qualified (stroking) energyabsorbing seat system in the airframe, a worst-case free-fall emergency from up to 5m altitude could be addressed if a 10 metres per second criterion is adopted for basic airframe crashworthiness.
The AVCP system is designed for activation at any operational altitude above 5m for launching the drogue parachute and extracting the rocket motor system, with the rocket motors only fired within a 5m-15m altitude initiation zone if the descent rate (possibly still influenced by the aircraft rotors providing partial lift) is greater than 9.1 metres per second. Once the rocket motors are initiated and full thrust confirmed, power to the aircraft rotors is cut to avoid the combined upward thrust lifting the aircraft again.
In a worst-case design scenario of a 25 metres per second descent rate, when the motors are fired the baseline-weight version AVCP system (which is designed to reduce the descent rate by 15 metres per second) will reduce the GIV to less than 10 metres per second.
If residual aircraft rotor lift is available (so that the stable descent rate is less than 25 metres per second) the baseline motor system will reduce the GIV to a level below 10 metres per second by reducing the descent rate by 15 metres per second.
With a descent rate of 15 metres per second (or lower) the baseline AVCP system will enable a soft landing (1-2 metres per second) by selecting the correct height for firing the rocket motors, dependent on the aircraft weight and current descent rate.
The AVCP system is designed to eliminate the altitude limitation Safety Gap, and ensure (as far as possible) that there is no ‘un-survivable’ descent rate for a (essentially) vertical emergency descent situation, where additional lift is not provided by fixed wings or other means.
A further development could use retrorockets capable of providing a soft landing (1-2 metres per second) from an assumed worst-case aircraft descent rate of c.25 metres per second and zero lift from the aircraft rotor(s), albeit with additional rocket motor size & weight.
Consideration of survivable landing loads / GIV data
EDAS arrest of the VTOL emergency descent should contribute additional margin to the currently-defined acceptable aircraft loads during Emergency Landing conditions [MOC VTOL.2270(a) and (c)], through the reduction in ground impact velocity (GIV) on landing.
Likewise, EDAS arrest of the VTOL emergency descent should contribute additional margin to the loads experienced by aircraft occupants during Emergency Landing conditions [MOC VTOL.2270(b)(1)]. From a rotorcraft basis, CS 27.562(b)(1) Amdt. 6 also notes downward velocity of not less than 9.1 metres per second (30 feet per second) and deceleration of 30g within 31 metres per second at seat attachment level, based upon the typical underfloor structure of a conventional rotorcraft.
CS 27.561(b)(3) Amdt. 6 notes ultimate inertial load factors on the occupant relative to the surrounding structure: Upward 4g / Forward 16g / Sideward 8g / Rearward 1.5g / Downward 20g (after intended displacement of an energy-absorbing seat device). From a normal aircraft basis, CS 23.2270 Amdt. 5 simply requires the aircraft, even when damaged in an emergency landing, must protect each occupant against injury that would preclude egress. Emergency landing conditions must include dynamic conditions that are likely to occur in an emergency landing; and must not generate loads experienced by the occupants, which exceed established human-injury criteria for human tolerance.
Analysis of civil and military rotorcraft incidents shows vertical impact velocities up to 70 feet per second (21.2 metres per second) with mortality rates showing a marked increase from GIV levels of 9.1 metres per second (30 feet per second) for conventional rotorcraft, and from GIV of 12.1 metres per second (40 feet per second) for crashworthy military rotorcraft18, 19. Modern military rotorcraft have demonstrated hard landing impacts up to 6.1 metres per second (20 feet per second) with no injury to occupants, and little or no damage to the aircraft; similar impacts for civilian helicopters routinely resulting in serious occupant injuries and significant airframe damage.
Addressing the EDAS Safety Gap
These three EDAS concepts (reserve power, whole-aircraft recovery ballistic parachute systems, and parachute ballistic recovery with retro-rocket systems) clearly have differing design approaches and performance capabilities, which complicates the definition of a single objective EDAS standard for the VTOL Urban Air Mobility / Advanced Air Mobility (and light aircraft/helicopter/gyrocopter) industries to work towards.
The first differentiation factor is the altitude at which the EDAS system becomes effective, the ‘Safety Gap’ inherent in a descent-arrest system concept. This Safety Gap is a clear concern, and can discount the use of conventional ‘Ballistic Parachute Recovery Systems’ where they are not fully effective during the VTOL aircraft flight envelope when they are most vulnerable to any loss of power or control, i.e. the VTOL phase.
The Safety Gap aspect is a primary discriminator between the three EDAS system concepts currently identified.
Actual ground impact velocity (GIV) that any system delivers could be used as a secondary discriminator. Clearly there is some advantage if all emergency descents could result in a soft landing, minimising injury to occupants and damage to the aircraft. Currently, any integrated engineering design must only meet current ASTM requirements in order to produce a survivable touchdown condition.
Categorization of Emergency Descent Arrest System (EDAS) solutions
In conclusion, there are four EDAS categories that could be considered:
- current conventional Ballistic Parachute Recovery System types, with a c.300+ feet Safety Gap and GIV controlled to a maximum of 10 metres per second
- rapid Deployment Vehicle Recovery System such as the ASR system, with a c.100 feet Safety Gap and GIV controlled to a maximum of 9.14 metres per second (30 feet per second)
- such as the AVCP and ASR systems with no Safety Gap due to operation from >5m altitude (integrated with the airframe/seat system, for aircraft crashworthiness addressing a 9.14 metres per second GIV)
- such as the ASR and AVCP systems with no Safety Gap due to operation from >5m altitude, and sufficient retro-rocket total-impulse to provide a soft landing from a maximum descent rate of 25 metres per second, with additional weight penalty from the increased total-impulse from the retro-rocket(s) required to achieve this.
As an airframe system to arrest an emergency descent, and the range of different EDAS approaches and design safety performance levels, it is appropriate that the VTOL aircraft designer/manufacturer/operator/insurer able to specify their EDAS system type / category choice, supported by an objective standard to which the EDAS can be certified. The capabilities and categories of EDAS system could follow a taxonomy as below:
Alongside the aircraft Altitude and ultimate GIV performances of a given EDAS solution, the Safety & Initiation Architecture of the EDAS is also considered. This EDAS Architecture category will inform the aircraft designer on the avionic & crew interface(s), functional reliability, and functional failure mode(s) of an EDAS system.
Finally, consideration is given to any energetic material content within the EDAS (for example, the tractor rocket used to eject a ballistic parachute), and its sensitivity to environmental stimuli. Energetic / pyrotechnic components are routinely fitted in military aircraft systems, and are already used in several Whole-Aircraft Emergency Recovery Parachute systems as shown above.
It remains important to consider measures to minimise or eliminate all the potential risks that an energetic system can present. Safety Design principles can mitigate un-commanded initiation of the EDAS interface, whilst insensitive munition (IM) design principles can mitigate hazards such as fragment impact and un-commanded ignition (cook-off) of an energetic/pyrotechnic component such as tractor rocket propellant.
Each category of EDAS system can then be assessed objectively within a VTOL aircraft design, both in terms of (i) operational function, safety and reliability, and (ii) in assessing the emergency landing capability (and resulting occupant loads) of the EDAS-equipped VTOL aircraft.