Safety device and safety method for an aircraft, and aircraft comprising the safety device

Abstract

For reducing a risk potential of an aircraft, a safety device for the aircraft is provided, said aircraft having a flight control device for flight control of the aircraft based on global position coordinates and/or flight altitude values of the aircraft detected by a sensor apparatus of the flight control device. The safety device comprises a flight altitude detection apparatus configured to detect a current flight altitude of the aircraft independently of the sensor apparatus, a determination apparatus configured to determine whether the current flight altitude of the aircraft detected by the flight altitude detection apparatus exceeds a predetermined maximum altitude, and a rescue apparatus configured to interrupt the flight control of the aircraft when the current flight altitude of the aircraft detected by the flight altitude detection apparatus exceeds the predetermined maximum altitude.

Description

CROSS REFERENCE TO RELATED APPLICATIONS

This application claims foreign priority to DE 10 2014 217 196.2 filed Aug. 28, 2014, under 35 U.S.C. § 119, the entire contents of which are incorporated herein by reference thereto.

BACKGROUND

It is known to provide aircraft, particularly unmanned aircraft, with an automatic flight control such as an autopilot. It is further known to assign an air corridor to such aircraft, said corridor e.g. corresponding to a reserved airspace. So as to remain in the reserved or assigned airspace, an automatic flight control can be provided with sensors determining a flight altitude and/or a global position (e.g. with a satellite navigation system being used) of the aircraft in order to control the aircraft within the assigned airspace on the basis of the sensor data.

In particular, such a restriction to an assigned airspace may result from requirements of the aviation law to be met. For instance, an aircraft to which a cylindrical airspace has been assigned may on no account leave this airspace upwards as, there, other air traffic may take place and may otherwise be adversely affected by the aircraft.

When errors occur in the automatic flight control, the aircraft may leave the assigned airspace and may e.g. have an adverse effect on air traffic, which could entail serious damage.

Examples of such errors are defective sensors, calculation errors and defective signals of a satellite navigation system used.

Therefore, the invention indicated in claim 1 is based on the object of preventing leaving the assigned airspace when errors occur in the automatic flight control, thereby reducing a risk potential of an aircraft.

SUMMARY OF THE INVENTION

The problem is solved by the features indicated in claim 1, particularly by a safety device for an aircraft having a flight control device for flight control of the aircraft based on global position coordinates and/or flight altitude values of the aircraft detected by a sensor apparatus of the flight control device. The safety device comprises a flight altitude detection apparatus configured to detect a current flight altitude of the aircraft independently of the sensor apparatus, a determination apparatus configured to determine whether the current flight altitude of the aircraft detected by the flight altitude detection apparatus exceeds a predetermined maximum altitude, and a rescue apparatus configured to interrupt the flight control of the aircraft when the current flight altitude of the aircraft detected by the flight altitude detection apparatus exceeds the predetermined maximum altitude.

The advantages achieved by the invention and particularly by the use of independently determined altitude values particularly consist in that it can be avoided that the aircraft leaves its assigned airspace upwards due to errors in the flight control.

According to an advantageous embodiment of the invention, the safety device further comprises a global position detection apparatus configured to detect a current global position of the aircraft independently of the sensor apparatus. The determination apparatus according to the invention is further configured to determine whether a difference between the global position coordinates detected by the sensor apparatus of the flight control device and the current global position of the aircraft detected by the global position detection apparatus exceeds a predetermined difference value. The rescue apparatus according to the invention is further configured to interrupt the flight control of the aircraft when the difference between the global position coordinates detected by the sensor apparatus of the flight control device and the current global position of the aircraft detected by the global position detection apparatus exceeds the predetermined difference value.

This makes it possible to recognize errors in the flight control which may cause, in particular, that the aircraft leaves the assigned airspace in arbitrary directions and to react such that the aircraft cannot leave the assigned airspace.

According to a further advantageous embodiment of the invention, the determination apparatus is further configured to determine whether the current global position detected by the global position detection apparatus is outside a first predetermined space. The safety device according to the invention further comprises an output device configured to output an instruction to the flight control device to control the aircraft into the first predetermined space when the current global position detected by the global position detection apparatus is outside the first predetermined space.

In this way, already a trend towards leaving an assigned airspace can be detected, and said trend may already be countered prior to the airspace being actually left.

According to a further advantageous embodiment of the invention, the determination apparatus according to the invention is further configured to determine whether the current global position detected by the global position detection apparatus is outside a second predetermined space incorporating the first predetermined space. The rescue apparatus according to the invention is further configured to interrupt the flight control of the aircraft when the current global position detected by the global position detection apparatus is outside the second predetermined space.

In this way, a further deviation of the aircraft from the assigned airspace after actually leaving the same can be avoided.

According to a further advantageous embodiment of the invention, the first and/or the second predetermined space is a cylindrical airspace defined by an altitude and a diameter.

According to a further advantageous embodiment of the invention, the global position detection apparatus uses a satellite navigation system which differs from a satellite navigation system used by the sensor apparatus. Examples of such satellite navigation systems are GPS, Galileo, GLONASS and BeiDou.

This makes it possible to react appropriately to deviations caused by defective signals of a specific satellite navigation system or by defective calculations based on the specific satellite navigation system (e.g. due to a defective hardware assigned to the specific navigation system).

According to a further advantageous embodiment of the invention, the safety device according to the invention further comprises a power supply which is independent of a power supply of the flight control device.

This makes it possible to react appropriately to deviations caused by a defective power supply (overvoltage, undervoltage, voltage failure) of the automatic flight control.

According to a further advantageous embodiment of the invention, the flight altitude detection apparatus is an air pressure sensor.

According to a further advantageous embodiment of the invention, the rescue apparatus according to the invention is configured to interrupt the flight control of the aircraft by switching off the flight control device and/or by switching off a primary drive of the aircraft.

According to a further advantageous embodiment of the invention, the rescue apparatus according to the invention is further configured to activate, after the flight control of the aircraft has been interrupted, a parachute of the aircraft for a controlled landing of the aircraft.

The above-described problem is also solved by the features indicated in claim 10, particularly by a safety method for an aircraft having a flight control device for flight control of the aircraft based on global position coordinates and/or flight altitude values of the aircraft detected by a sensor apparatus of the flight control device. Said safety method comprises detecting a current flight altitude of the aircraft independently of the sensor apparatus, determining whether the detected current flight altitude of the aircraft exceeds a predetermined maximum altitude, and interrupting the flight control of the aircraft when the detected current flight altitude of the aircraft exceeds the predetermined maximum altitude.

The above-described problem is also solved by the features listed in claim 11, particularly by an aircraft comprising a flight control device for flight control of the aircraft based on global position coordinates and/or flight altitude values of the aircraft detected by a sensor apparatus of the flight control device, and the safety device according to the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

One embodiment of the invention is shown in the drawing and will be described in greater detail below.

There,

FIG. 1 schematically shows an aircraft in which the present invention is used,

FIG. 2 schematically shows an airspace defined for an aircraft in which the present invention is used,

FIG. 3 schematically shows predetermined spaces adapted to serve as limits of decision according to the invention for an aircraft in which the present invention is used, and

FIG. 4 is a schematic diagram of a procedure according to exemplary embodiments of the present invention.

DETAILED DESCRIPTION

FIG. 1 schematically shows an aircraft 1. In particular, FIG. 1 shows a drone in the form of a quadrocopter.

The aircraft 1 comprises a main body or casing 11. The aircraft 1 further comprises a flight control device 12 as well as a safety device 13 according to the invention.

In FIG. 1, the flight control device 12 and the safety device 13 according to the invention are shown as being accommodated in the casing 11. It shall be remarked here that the flight control device 12 as well as the safety device 13 according to the invention, or only one of the two, respectively, may also be arranged outside the main body or casing 11, and does/do not have to be positioned in any casing.

The flight device 1 in FIG. 1 could be a meteodrone, i.e. a drone used for meteorological purposes. The aircraft 1 is, however, not restricted to such a meteodrone.

One application scenario of such an aircraft 1 (especially in the case of a meteodrone) could be a scenario where the aircraft basically flies up and down. Such an example of an application scenario is shown in FIG. 2.

FIG. 2 schematically shows an airspace defined for an aircraft 1, with an intended flight route being indicated by an upward/downward arrow in the center of the airspace.

The application scenario and, thus, the airspace shown in FIG. 2 as well as the intended flight route of the aircraft 1 as shown in FIG. 2 are only exemplary and not restricted thereto, but have been selected for the sake of simplicity only.

For example, the flight control device 12 (e.g. an autopilot) comprises an air-pressure sensor for determining the air pressure and, hence, for determining a flight altitude as well as a GPS receiver for the determination of a position. The sensor technology of the flight control device is, however, not restricted thereto.

Due to requirements to be met pursuant to the aviation law, it has to be ensured that the aircraft 1 does not leave a reserved airspace, e.g. one corresponding to the airspace shown in FIG. 2.

Therefore, the invention provides for a safety device 13 comprising an independent power supply (at least independent of the flight control device 12, i.e. the safety device 13 and the flight control device 12 are fed by separate power supplies). The safety device 13 further comprises an air gage/barometer (absolute or relative) adapted to determine an ambient air pressure and, hence, a flight altitude. The safety device 13 further comprises a further geo-positioning system.

On the assumption that the flight control device 12 e.g. uses GPS (Global Positioning System), the safety device 13 could e.g. use Galileo, GLONASS, or BeiDou (also BeiDou Navigation Satellite System).

FIG. 4 illustrates an exemplary method according to the features of claim 10.

If the safety device 13 comprises a relative air gage (step S1), this is adjusted to the starting site altitude (start altitude) upon or prior to a start. As soon as the air gage reaches the upper limit of the assigned airspace (e.g. the upper boundary surface of the cylindrical airspace shown in FIG. 2) (step S1, S2), on the assumption of a standard atmosphere, a rescue measure is implemented/initiated (step S3). This rescue measure (step S3) may e.g. comprise an interruption of the primary drive of the aircraft 1. Also, the rescue measure (step S3) may comprise switching-off the flight control device and/or cutting off a power supply feeding the aircraft (not the power supply of the safety device 13). The rescue measure (step S3) is, however, not restricted to the mentioned examples, but comprises all those measures adapted to prevent leaving the predefined airspace or moving further away from the predefined airspace and/or to allow returning into the predefined airspace.

For a safe return of the aircraft 1 to the ground or for its controlled landing, the rescue measure may comprise an activation of a parachute of the aircraft 1 subsequently to the above interruptions named by way of an example. This measure is, however, not restricted to a parachute, and may comprise any measure, such as gliding surfaces, braking devices, etc., which is adapted to ensure or favor a safe return of the aircraft 1 to the ground when the flight control is interrupted.

So as to prevent the aircraft from horizontally flying out of the predefined airspace (or flying out therefrom with a horizontal component), a navigation system which is independent of a satellite navigation system used by the autopilot (flight control device 12) is operated, as has been noted above, in the safety device 13 also designated as “kill system”. That is, if the autopilot uses GPS, the safety device 13 could use Galileo or GLONASS or BeiDou. If the autopilot uses Galileo, however, the safety device 13 could use GPS, GLONASS, or BeiDou accordingly.

The safety device 13 is, for example, connected to the autopilot (flight control device 12) by means of a bus. In this way, the coordinates or navigation data of the autopilot as primary navigation device can constantly be compared or coordinated with the navigation data of the safety device 13. If unduly large differences occur between the two navigation data (i.e. a predetermined difference value is exceeded), the above-described rescue measure is immediately implemented/initiated.

A further development of the embodiment is described by means of FIG. 3; this Figure schematically shows predetermined spaces for the aircraft 1, these spaces serving as decision limits.

In particular, FIG. 3 shows an intended flight route of the aircraft 1 by an upward/downward arrow in the center of the predetermined spaces and is, hence, illustrated by an application scenario comparable to the application scenario described in FIG. 2. However, also this further development is not restricted to the example of the application scenario.

Furthermore, FIG. 3 particularly shows a first predetermined space and a second predetermined space whose outer limits or outer envelopes serve as decision limits. The second predetermined space is larger than the first predetermined space and completely incorporates the latter. In the case of cylindrical predetermined spaces, the central axes of the respective cylinders shall preferably coincide. The arrangement of the predetermined spaces is, however, not restricted to this exemplary arrangement.

In accordance with the use thereof, the outer envelope of the first predetermined space may also be designated as “soft fence”, whereas the outer envelope of the second predetermined space may also be designated as “hard fence”.

When the “soft fence” is surpassed, i.e. when the first predetermined space is left, the autopilot is instructed by the safety device 13 to guide the aircraft back to the predefined course (upward/downward arrow).

When the “hard fence” is surpassed, i.e. when the second predetermined space is left, the above-described rescue measure is immediately implemented/initiated.

Claims

1. A safety device for an unmanned aircraft having a flight control device for flight control of the aircraft based on global position coordinates or flight altitude values of the aircraft detected by a sensor apparatus of the flight control device, said safety device comprising computer hardware configured to cause the safety device at least to: detect a current flight altitude of the aircraft independently of the sensor apparatus,determine whether the current flight altitude of the aircraft exceeds a predetermined maximum altitude,interrupt the flight control of the aircraft when the current flight altitude of the aircraft exceeds the predetermined maximum altitude, so that the aircraft returns to flying at an altitude that does not exceed the predetermined maximum altitude,detect a current global position of the aircraft independently of the sensor apparatus,determine whether the current global position is outside a first predetermined space that the aircraft is allowed to fly,output an instruction to the flight control device to control the aircraft to fly back into the first predetermined space when the current global position is outside the first predetermined space,determine whether a difference between the global position coordinates detected by the sensor apparatus of the flight control device and the current global position of the aircraft exceeds a predetermined difference value, andinterrupt the flight control of the aircraft when the difference between the global position coordinates detected by the sensor apparatus of the flight control device and the current global position of the aircraft exceeds the predetermined difference value, by controlling the aircraft to return to flying at a position in which the difference between the global position coordinates and the current global position do not exceed the predetermined difference value,wherein the safety device and the flight control device each comprise a respective independent power supply, andwherein the computer hardware is configured to cause the safety device to interrupt the flight control device of the aircraft by cutting off the power supply of the flight control device while maintaining power of the safety device.

2. The safety device according to claim 1, wherein the computer hardware is further configured to cause the safety device to: determine whether the current global position is outside a second predetermined space incorporating the first predetermined space; andinterrupt the flight control of the aircraft when the current global position is outside the second predetermined space.

3. The safety device according to claim 2, wherein the first or the second predetermined space is a cylindrical airspace defined by an altitude and a diameter.

4. The safety device according to claim 1, wherein the computer hardware is further configured to cause the safety device to use a satellite navigation system which differs from a satellite navigation system used by the sensor apparatus.

5. The safety device according to claim 1, wherein the computer hardware is further configured to cause the safety device to interrupt the flight control of the aircraft by switching off a primary drive of the aircraft.

6. The safety device according to claim 1, wherein the computer hardware is further configured to cause the safety device to activate a parachute of the aircraft for a controlled landing of the aircraft.

7. A safety method executed by a safety device for an unmanned aircraft having a flight control device for flight control of the aircraft based on global position coordinates or flight altitude values of the aircraft detected by a sensor apparatus of the flight control device, said safety method comprising: detecting a current flight altitude of the aircraft independently of the sensor apparatus,determining whether the detected current flight altitude of the aircraft exceeds a predetermined maximum altitude,interrupting the flight control of the aircraft when the detected current flight altitude of the aircraft exceeds the predetermined maximum altitude, so that the aircraft returns to flying at an altitude that does not exceed the predetermined maximum altitude,detecting a current global position of the aircraft independently of the sensor apparatus,determining whether the current global position is outside a first predetermined space that the aircraft is allowed to fly,outputting an instruction to the flight control device to control the aircraft to fly back into the first predetermined space when the current global position detected by the global position detection apparatus is outside the first predetermined space,determining whether a difference between global position coordinates detected by the sensor apparatus and the current global position of the aircraft exceeds a predetermined difference value, andinterrupting flight control of the aircraft when the difference between the global position coordinates detected by the sensor apparatus and the current global position of the aircraft exceeds the predetermined difference value, by controlling the aircraft to return to flying at a position in which the difference between the global position coordinates and the current global position do not exceed the predetermined difference value,wherein the safety device and the flight control device each comprise a respective independent power supply, andwherein interrupting the flight control of the aircraft comprises cutting off the power supply of the flight control device while maintaining power of the safety device.

8. An unmanned aircraft comprising: a safety device having a flight control device for flight control of the aircraft based on global position coordinates or flight altitude values of the aircraft detected by a sensor apparatus of the flight control device,said safety device comprising computer hardware configured to cause the safety device at least to detect a current flight altitude of the aircraft independently of the sensor apparatus,determine whether the current flight altitude of the aircraft exceeds a predetermined maximum altitude,interrupt the flight control of the aircraft when the current flight altitude of the aircraft exceeds the predetermined maximum altitude, so that the aircraft returns to flying at an altitude that does not exceed the predetermined maximum altitude,detect a current global position of the aircraft independently of the sensor apparatus,determine whether the current global position is outside a first predetermined space that the aircraft is allowed to fly, andoutput an instruction to the flight control device to control the aircraft to fly back into the first predetermined space when the current global position is outside the first predetermined space,determine whether a difference between the global position coordinates detected by the sensor apparatus of the flight control device and the current global position of the aircraft exceeds a predetermined difference value, andinterrupt the flight control of the aircraft when the difference between the global position coordinates detected by the sensor apparatus of the flight control device and the current global position of the aircraft exceeds the predetermined difference value, by controlling the aircraft to return to flying at a position in which the difference between the global position coordinates and the current global position do not exceed the predetermined difference value,wherein the safety device and the flight control device each comprise a respective independent power supply, andwherein the computer hardware is configured to cause the safety device to interrupt the flight control device of the aircraft by cutting off the power supply of the flight control device while maintaining power of the safety device.

9. A safety device for an unmanned aircraft having a flight control device, said safety device comprising: computer hardware, the computer hardware being configured to cause the apparatus at least to:detect a current flight altitude of an aircraft independently of an output of a sensor apparatus, wherein the sensor apparatus senses flight altitude information;determine whether a detected current flight altitude of the aircraft exceeds a predetermined maximum altitude;interrupt flight control of the aircraft when the detected current flight altitude of the aircraft exceeds the predetermined maximum altitude, so that the aircraft returns to flying at an altitude that does not exceed the predetermined maximum altitude;detect a current global position of the aircraft independently of the sensor apparatus;determine whether the current global position is outside of a first predetermined space that the aircraft is allowed to fly;control the aircraft to fly back into the first predetermined space when the current global position detected by the global position detection apparatus is outside the first predetermined space;determine whether a difference between global position coordinates detected by the sensor apparatus and the current global position of the aircraft exceeds a predetermined difference value; andinterrupt flight control of the aircraft when the difference between the global position coordinates detected by the sensor apparatus and the current global position of the aircraft exceeds the predetermined difference value, by controlling the aircraft to return to flying at a position in which the difference between the global position coordinates and the current global position do not exceed the predetermined difference value,wherein the safety device and the flight control device each comprise a respective independent power supply, andwherein interrupting the flight control of the aircraft comprises cutting off the power supply of the flight control device while maintaining power of the safety device.

10. The safety device according to claim 9, wherein the computer hardware is further configured to cause the apparatus to: determine whether the current global position is outside a second predetermined space incorporating the first predetermined space; andinterrupt flight control of the aircraft when the current global position is determined to be outside of the second predetermined space.

11. The safety device according to claim 10, wherein the first or second predetermined space comprises a cylindrical air space defined by an altitude and a diameter.

12. The safety device according to claim 9, wherein the computer hardware uses a satellite navigation system which differs from a satellite navigation system used by the sensor apparatus.