A380 Development of the Flight Controls

Source: Airbus Safety First URL: https://safetyfirst.airbus.com/a380-development-of-the-flight-controls/ Published: 2012-01-14 Magazine Issue: 2012-01 Category: Archive PDF: Original PDF

Safety

claude LELAIE

Experimental Test Pilot

A380: Development of the Flight Controls

Part 1

This article is the first of a series intended to explain what has been done for the development of the flight controls laws of the A380.

The General Principles of the design

Very early in the development process, the design office has to take many important decisions related to flight controls such as how many computers, flight controls surfaces, and hydraulic circuits are needed. All that is dictated by the analysis of failures, associated with a first estimation of the likely flight characteristics. In case of multiple failures, the aircraft must remain flyable.

One of the failures that could have the most adverse consequences and that leads to a lot of decisions is the non-contained explosion of an engine rotor disc. It is assumed that a part of this disc will penetrate the fuselage or the wing with “high” energy. The engine is designed and built in such a way that this should not happen, but this is a supplementary precaution. The potential trajectories of this part are computed according to very precise rules. It must be checked that all the energy sources (mainly electricity and hydraulic) will not be affected at the same time, which could have catastrophic consequences. Obviously, this study is far more complex

on a quad than on a twin due to the number of rotors involved. It is to be noted that this scenario, while extremely rare, happened recently, on an A380 from Qantas taking off from Singapore. Even though the aircraft was in a severely damaged and degraded situation, the crew had all the means to land safely, and the analysis of the event confirmed that the design, in terms of reconfiguration choices, was appropriate.

thanks to wind tunnel tests. This allows a first version of the computers to be prepared. The next step is the installation of these computers on a simulator where the latest aerodynamic models have been integrated. Evaluations can start, first with “development simulator” pilots specialized in this job, and then with the test pilots nominated to follow the program. At the beginning, numerous small problems are found and there is a progressive evolution of the computers. The real proof comes with the test flight itself as, even if the models are generally reliable, they are rarely fully representative of the aircraft at low speed, high speed and in the ground effect. Also, at the beginning of the flight tests, for the first time, pilots are exposed to the accelerations of the aircraft in response to their commands. Flexibility of the structure can have consequences

Numerous other factors are taken into account when choosing the general architecture. The most important is the need to minimise weight, obviously whilst keeping the same level of safety.

The development of the flight controls laws for a Fly-By-Wire aircraft is a complex process. It starts by computations based on estimated aerodynamic models of the aircraft, which are then checked and adjusted

Figure 1 A380 Iron Bird

on comfort, but can also induce effects on the flying characteristics.Often, the models used for computations or in the simulator are correct so that after tuning on ground and validation in flight, there is nothing else to do. But it occasionally happens that the aircraft behaviour is not in line with the expectations and an aerodynamic identification in flight is needed to allow further tuning of the models in order to enable the design office to define the next standard of the computers. Sometimes it is difficult because the modelling of the ground effect is not satisfactory or the flexibility of the aircraft does not permit a correct simulation. In this case, the development has to be performed in two phases, first with models and then directly in flight. When in flight, engineers and pilots decide in real time what adjustments are necessary. They are using their knowledge, judgement, common sense and feelings (seat of the pants flying). Some non-specialists consider that the flight test task is only to validate results obtained in a simulator. This is not correct, as, for a significant number of tests, methodologies have not evolved since the last century, except for the help given by the computers. Most of the time, qualitative feelings and impressions are still showing the way.

Fly-By-Wire and Associated Improvements

Fly-By-Wire has brought a lot to aviation. Obviously the ease of flying and the protections to avoid loss of control are well known, but that is not all.

In the past, flight controls were designed to meet two sets of criteria: they had to be “well harmonised” and had to meet the criteria for certification. With Fly-By-Wire, three possibilities have been added: improve safety by restricting manoeuvres which could lead to a loss of control, reduce the weight of the structure with the prohibition of some actions, which may increase the loads and finally improve comfort for the passengers. Adding all these functions leads to more and more complexity for the flight controls computers.

The Main A380 characteristics

A general description of the main characteristics of the A380 flight controls will allow us to gain a better understanding of the tests performed.

The A380 has seven flight controls computers: three Primary Computers (PRIMs), three Secondary Computers (SECs), and one Back

Up Control Module (BCM). Any of the three PRIMs can ensure the full control of the plane without restriction. The SECs do not provide stabilized control laws as do the PRIMs but they are more robust to the loss of some information. They also have different software than the PRIMs so that a bug in one category of computer does not “contaminate” the others. All computers have a command and a monitoring lane. Finally, there is a BCM, available in case of failure of all PRIMs and SECs.

The A380 has only two hydraulic circuits instead of three on the Airbus of the previous generations. The third circuit has been replaced by local hydraulic generation: for some servo-controls, a small electrical motor creates the hydraulic energy to power it. These systems are called EHA (Electro Hydraulic Actuator) or EBHA (Electro Backed up Hydraulic Actuator: fig. 2 ). This new type of architecture with only two circuits allows the saving of several hundred kilograms on the A380, mainly thanks to the reduction of the number of pipes. It also creates a new level of system segregation safety.

Some control surfaces have been split into several parts controlled by different electrical and hydraulic sources. There are two rudders instead of one on all other Airbus and four elevators instead of two. On each side, there are three ailerons

In order to save time, the flight test engineers have a tool called AFDX Digital Injection System (ADIS), which allows them to modify in real time some characteristics of the computers. For safety reasons, all the new possible adjustments are checked in a simulator before using them in flight.

The development of the flight controls laws is a fascinating adventure: every day there are new surprises, some good and some bad. The A380 has not been the most difficult aircraft in this respect, thanks to the excellent aerodynamic characteristics.

Figure 2 A380 EBHA Rudder

Safety

instead of one on the A320 family and two on the A340 and A330. Each of the surfaces (except the spoilers) is activated by two servos using different hydraulic circuits or EHA or EBHA. Two or three different computers (PRIM and SEC plus BCM) control each of the servos. Therefore, a lot of failures are needed to lose the control of one surface.

When the four engines (or their generators) and the APU are no longer available, electricity is coming from a Ram Air Turbine (RAT).

The Identification of the Aircraft

To ensure that the adjustments to the control laws are well adapted to the characteristics of the plane, the design office needs a good aerodynamic model. This is initially achieved through simulation. However some tuning can only be finalized and validated in flight. So, the identification of the aircraft stability and control characteristics in flight is among the first priorities of the program. On the A380, about one month after the beginning of the flight tests, in April 2005, flight 16 was devoted to identification of these characteristics in pitch. Then, during the months of July and August, about 15 flights were dedicated to similar tests in roll, pitch, effect of the engines… More were performed during the following months.

These identification flights are completely different from those which must be done at the end of the development in order to prepare the aircraft models for installation in the training simulators. For these last flights a very specific process has to be followed. The training simulators do not need to represent the flight characteristics in extreme situations. On the other hand, in order to develop the flight control computers, the design office needs to have a good identification of the aerodynamic characteristics at the limits of the flight envelope.

The Take-Off rotation Law

On the A340-600, the development of the take-off control law proved to be rather difficult. It is worth explaining the issue here to show the kind of obstacles that can be found.

All the pilots agreed that, on the A340-300, the reaction in pitch during the rotation at take-off, whilst being acceptable, was a bit sluggish. As the A340-600 was planned to be about 100 tons heavier than the A340-300 and longer by about 12 meters, a study was launched to improve the reaction of the -600 during the rotation. Numerous tests were performed in the simulator and then the new control law was installed on the A340-300 used for development. The team was happy with the results. Subsequently, the take-offs of the first two flights of the A340-600 were performed in direct law in order to improve progressively our knowledge of the aircraft. Following the landing from the second flight, it was planned to perform another take-off with the brand new rotation law. It just happened that the Captain of the A340-600 had been in charge of the development of this law. At the beginning of the manoeuvre, the aircraft exhibited a strong Pilot Induced Oscillation (PIO). The pilot reacted naturally to an unexpectedly strong response of the aircraft. The oscillations stopped after six cycles.

Why this surprise, as everything was well prepared? The forward part of the A340-600 is longer than on the -300 and, with this lever, the crew had the feeling of being projected too quickly into the air and therefore reacted immediately, creating this PIO. All the work done prior to the flight could not be used as such. So, after a minimum of development in the simulator, to have a good starting point for the control law, the tuning was performed during a flight with around 15 take-offs.

The principle is rather simple: with the help of the ADIS, at each take-

off, it is possible to improve what the pilots are feeling and the flight engineers have on their traces. As an example, the law can be made more or less efficient at the initial pilot command. It is also possible to reduce the pitch rate when approaching the take-off attitude, but not too early and not too late. If there is a risk of tail strike, the pitch rate must also be controllable to almost zero very quickly. The flight test engineers have to play with a lot of variables such as precommand, damping, filtering and so on, so as to reduce the take-off distances and ensure safety in all the critical cases such as engine failure, early rotation… To perform this tuning well they must have a perfect understanding of the effect of all parameters.

This example shows the limits of what is possible to perform with models or with the simulation for some flight phases, particularly close to the ground. However, the conclusion must not be that models have to be disregarded. Very good preparation is fundamental in order to have a solid starting point and to give to the flight test engineers well-adapted tools with the ADIS.

After the lessons of the A340-600, we decided to keep the same methodology to develop the rotation law of the A380: a basic and simple preparation using models and simulators followed by the development with flight tests.

For all these tests: development of a rotation law and, later on, measurements of take-off distances, there is always a risk of tail strike because we are frequently on the limit of manoeuvrability of the aircraft. Therefore, the aircraft is equipped with a tail bumper, the same that is used for the VMU tests.

The first flight for development of the A380 take-off rotation law was performed on December 29th 2005 with a very experienced crew: two test pilots, one test flight engineer (in the cockpit) and two flight test engineers both specialists of flight controls. After 15 take-offs, the

Figure 3 lowed us to be efficient after each A380 take-off from Toulouse- take-off by executing overweight

Blagnac Airport landings without overheating the brakes. These landings added to the difficulty of the tests.

results were satisfactory. Later on, in February 2006, another flight allowed the team to fine-tune the protection, which was designed to avoid getting a tail strike. It is to be noted that during these tests, we did experience a slight tail strike on the tail bumper, proof that we were looking for the minimum margin while keeping the safety level. The computations performed later on, demonstrated that the tail strike would not have happened on the fuselage without the installation of the bumper. Finally, a last flight was performed at the beginning of March 2006 to validate the law at very heavy weights, as the behaviour has to be checked for all the weight and CG combinations. The first take-off was performed at 596,5 tons, more than 30 tons above the MTOW. Our experience has shown that it is always better to be heavier for this type of flight as, very often, our customers are asking for an increase of the MTOW very quickly after entry into service. This way of working avoids launching, later on, new tests which could even lead to a further modification of the law. Additionally, sufficient fuel was necessary to fly to Istres Air Force Base (South of France) to perform all the tests. The choice of Istres airport to perform this flight was due to the runway length of 5000 meters, which al-

Immediately at the end of the development of this law, the flights for measurements of take-off distances started with EASA crews.

The Landing Pitch Law

The development of the pitch law at landing was quite quick. From the beginning, we were aware that landing the A380 was very easy. However some adjustments were necessary for the various flight conditions: weights and CG positions. For the flight part, an initial tuning was performed as the controls were judged to be a bit too sensitive.

But the main modification was the suppression of what is called the “de-rotation” law on A340 and A330. On these aircraft, as soon as the main wheels touch the ground, this law is engaged and helps the pilot to control the pitch attitude until the front wheels are on ground. This law does not exist on the A320 family but was installed during the development of the A340 because, during a demonstration flight, an airline

pilot encountered Pilot Induced Oscillations (PIO) in this flight phase. The reason is that the A340 touches down with a rather high pitch attitude, and on the rear wheels of the bogies having a “nose up” position. Added to which, the touchdown of the nose wheels is performed with a slight nose down attitude. The nose wheels, and obviously the pilots, must “descend” from a relatively large height at landing. This “de-rotation” law reduces the authority of the stick in pitch during this phase in order to be able to smoothly control the nose gear to the ground, without risk of PIO.

A similar law was installed on the A380 by precaution, despite the fact that the A380 has none of the characteristics of the A340. In all cases, it appeared that this law was only engaged for two or three seconds and therefore was probably useless. In May 2006, during flight 221 of aircraft 1, we used the opportunity provided by the tuning of the pitch law for approach and landing to make the decision to remove it, keeping the flare law engaged during this phase. After several landings, it appeared that this was the right solution and from then on, all landings were performed with this modified law in order to be sure that there was no adverse consequence.

Later on, some minor final adjustments were made on the approach and flare law. The target was to satisfy the majority of pilots! The most important modification during this period was the increase of pitch authority when at high weight to reduce the risk of hard landing in case of emergency turn back.

Part 2 will include the development of the lateral law (the “ailerons waltz”) and the tuning of the low speeds and high speeds protections.

Safety

中文译文

来源: Airbus Safety First 链接: https://safetyfirst.airbus.com/a380-development-of-the-flight-controls/ 发布日期: 2012-01-14 杂志期号: 2012-01 分类: Archive PDF: 原始 PDF

安全

克劳德·勒莱（Claude LELAIE）

试飞员

A380：飞控系统的研发

第一部分

本文是一系列文章中的第一篇，旨在阐述A380飞控律的研发工作。

设计的一般原则

在研发初期，设计部门需要就飞控系统做出许多重要决策，例如需要多少台计算机、多少个飞控面和多少套液压管路。所有这些都取决于对故障的分析，并结合对飞行特性的初步估计。即使发生多重故障，飞机必须仍可飞行。

最可能导致严重后果并引发大量设计决策的故障之一，是发动机转子盘的未包容爆炸。假定该盘的部分将以“高”能量穿透机身或机翼。发动机的设计和制造确保这种情况不应发生，但这是一层额外的防护措施。该碎片的潜在轨迹按照非常精确的规则计算。必须验证所有能源（主要是电力和液压）不会同时受到影响，否则可能导致灾难性后果。显然，由于涉及的转子数量较多，四发飞机比双发飞机的这项研究要复杂得多。值得注意的是，尽管这种情况极其罕见，但最近确实发生过——一架从新加坡起飞的澳航（Qantas）A380。尽管飞机处于严重损坏和性能下降的状态，机组仍有所有手段安全着陆，对该事件的分析证实了在重构选择方面的设计是恰当的。

选择总体架构时还需考虑众多其他因素。最重要的是在保持相同安全水平的同时尽可能减轻重量。

电传操纵（Fly-By-Wire）飞机飞控律的研发是一个复杂的过程。首先基于飞机估算气动模型进行计算，然后通过风洞试验进行验证和调整。这使得可以准备计算机的初版程序。下一步是将这些计算机安装在综合了最新气动模型的模拟机上。评估工作可以开始，首先由专门从事此工作的“研发模拟机”飞行员进行，然后由指定跟踪该项目的试飞员接续。初期会发现许多小问题，计算机程序逐步演进。真正的验证来自试飞本身，因为尽管模型通常可靠，但在低速、高速和地效情况下很少能完全代表飞机。此外，在飞行试验初期，飞行员首次体验到飞机对他们指令的响应加速度。结构柔度会对舒适性产生影响，但也可能对飞行特性产生副作用。

通常，计算或模拟机中使用的模型是正确的，因此在地面调校和飞行验证之后无需其他操作。但偶尔会出现飞机行为与预期不符的情况，需要进行飞行气动识别，以便进一步调校模型，使设计部门能够确定计算机的下一版标准。有时这很困难，因为地效的建模不够理想，或者飞机的柔度不允许正确的模拟。在这种情况下，研发必须分两个阶段进行，首先使用模型，然后直接在飞行中进行。在飞行中，工程师和飞行员实时决定需要进行哪些调整。他们运用自己的知识、判断力、常识和感觉（凭手感飞行）。一些非专业人士认为飞行测试任务只是验证模拟机中获得的结果。这是不正确的，因为对于大量测试来说，除了计算机提供的辅助外，方法论自上世纪以来并无太大发展。大多数时候，定性的感觉和印象仍然指引着方向。

图1 A380 铁鸟台

电传操纵及其相关改进

电传操纵（Fly-By-Wire）给航空业带来了诸多裨益。显然，飞行变得更加简便、能够避免失控的保护措施是众所周知的，但这并非全部。

过去，飞控系统的设计需要满足两组标准：必须“良好协调”并且必须满足取证标准。电传操纵增加了三种可能性：通过限制可能导致失控的机动动作来提高安全性，通过禁止某些可能增加载荷的动作来减轻结构重量，最后提高乘客的舒适度。将所有这些功能整合在一起导致飞控计算机越来越复杂。

A380 主要特征

对A380飞控系统主要特征的总体描述将有助于我们更好地理解所进行的测试。

A380有七台飞控计算机：三台主计算机（PRIMs）、三台次计算机（SECs）和一个备用控制模块（BCM）。任何一台PRIM都能完全控制飞机而没有任何限制。SEC不像PRIM那样提供稳定的控制律，但对某些信息丢失更具鲁棒性。它们的软件也与PRIM不同，这样一类计算机中的缺陷就不会“污染”其他计算机。所有计算机都有指令通道和监控通道。最后，还有一个BCM，可在所有PRIM和SEC发生故障时使用。

A380只有两套液压系统，而不是前代空客机型的三套。第三套已被本地液压生成取代：对于某些伺服控制系统，小型电动机产生液压能量来驱动它。这些系统被称为EHA（电液作动器）或EBHA（电备份液压作动器：图 2）。这种仅有两套系统的新架构使A380节省了数百公斤重量，主要得益于减少了管道数量。它还创建了一个新的系统隔离安全级别。

部分操纵面被分成多个部分，由不同的电气和液压源控制。A380有两个方向舵，而其他空客机型只有一个；有四个升降舵而不是两个。每侧有三个副翼，而不是A320系列的一个，也不同于A340和A330的两个。每个操纵面（除扰流板外）都由两个使用不同液压回路或EHA或EBHA的伺服系统驱动。两个或三个不同的计算机（PRIM和SEC加上BCM）控制每个伺服系统。因此，需要大量故障才能导致某个操纵面失去控制。

当四台发动机（或其发电机）和APU都不可用时，电力来自冲压空气涡轮（RAT）。

为了节省时间，飞行测试工程师使用一种称为AFDX数字注入系统（ADIS）的工具，该工具允许他们实时修改计算机的某些特性。出于安全原因，所有新的可能调整在用于飞行之前都必须在模拟器中进行检查。

飞控律的开发是一段令人着迷的历程：每天都有新的惊喜，有些是好的，有些则不然。A380在这方面并非最具挑战性的飞机，这要归功于其卓越的气动特性。

图 2 A380 EBHA 方向舵

安全

飞机识别

为确保控制律的调整能够很好地适应飞机的特性，设计部门需要一个良好的气动模型。这最初是通过模拟实现的。然而，某些调校只能在飞行中最终确定和验证。因此，在飞行中识别飞机的稳定性和控制特性是项目的首要任务之一。在A380上，大约在飞行测试开始后一个月，即2005年4月，飞行16专注于俯仰特性的识别。随后在7月和8月期间，大约15次飞行专门用于滚转、俯仰、发动机影响等方面的类似测试。在接下来的几个月中还进行了更多测试。

这些识别飞行与开发结束时为准备训练模拟器的飞机模型而进行的飞行完全不同。对于这些最后的飞行，必须遵循非常特定的过程。训练模拟器不需要表现极端情况下的飞行特性。另一方面，为了开发飞控计算机，设计部门需要在飞行包线极限状态下对气动特性进行良好的识别。

起飞抬轮法则

在A340-600上，起飞控制法则的开发被证明相当困难。在此有必要解释这个问题，以展示可能遇到的障碍类型。

所有飞行员都同意，在A340-300上，起飞时俯仰旋转的响应虽然可以接受，但有些迟缓。由于A340-600计划比A340-300重约100吨，长约12米，因此启动了一项研究来改善-600在旋转时的响应特性。在模拟器中进行了大量测试，随后将新的控制法则安装在用于研发的A340-300上。团队对结果感到满意。随后，A340-600的首次两次飞行采用直接法则进行起飞，以逐步提升对飞机的了解。第二次飞行着陆后，计划采用全新的抬轮法则进行另一次起飞。恰好A340-600的机长负责该法则的研发。在机动开始时，飞机表现出强烈的驾驶员诱发振荡(PIO)。驾驶员对飞机出乎意料的强烈响应做出了自然的反应。振荡在六个周期后停止。

为什么会出现这种意外，既然一切准备就绪？A340-600的前部比-300更长，有了这种拉杆感觉，机组人员会产生飞机过快进入空中的错觉，因此立即做出反应，从而引发了PIO。飞行前所做的所有工作无法照搬使用。因此，在模拟器中进行了最少程度的开发后，为了给控制法则一个良好的起点，调校工作是在一次约15次起飞的飞行中完成的。

原理相当简单：借助ADIS，每次起飞后，都有可能改善飞行员的感受和飞行工程师在轨迹上看到的结果。例如，该法则可以在初始驾驶员指令时变得更加高效或效率稍低。也可以在接近起飞姿态时降低俯仰率，但不能过早或过晚。如果存在擦尾风险，俯仰率也必须能够非常迅速地控制在接近零的状态。飞行测试工程师需要调整许多变量，如预指令、阻尼、滤波等，以缩短起飞距离并确保所有关键情况下的安全，如发动机失效、提前抬轮……为了很好地完成此调校，他们必须对所有参数的影响有完美的理解。

这个例子展示了在某些飞行阶段，特别是接近地面时，使用模型或模拟所能做到的局限性。然而，结论不应该是模型可以被忽视。非常好的准备工作是基础，这样才能有一个坚实的起点，并通过ADIS为飞行测试工程师提供合适的工具。

从A340-600的经验教训中，我们决定采用相同的方法论来开发A380的抬轮法则：使用模型和模拟器进行基本而简单的准备工作，然后通过飞行测试进行开发。

对于所有这些测试：抬轮法则的开发以及随后进行的起飞距离测量，始终存在擦尾风险，因为我们经常处于飞机机动性的极限。因此，飞机配备了防撞尾锥，与VMU测试中使用的一样。

2005年12月29日进行了A380起飞抬轮法则开发的首飞，机组人员非常有经验：两名试飞员、一名飞行试验工程师（在驾驶舱内）和两名飞行控制专业飞行试验工程师。经过15次起飞后，结果令人满意。2006年2月进行的另一次飞行使团队能够微调防护设计，以避免擦尾。值得注意的是，在这些测试期间，防撞尾锥确实经历了轻微的擦尾，这证明我们在保持安全水平的同时正在寻找最小余量。随后进行的计算表明，如果没有安装防撞尾锥，擦尾不会发生在机身上。最后，2006年3月初进行了最后一次飞行，以在非常重的重量下验证该法则，因为必须检查所有重量和重心组合下的行为。首次起飞在596.5吨进行，超过MTOW 30多吨。我们的经验表明，对于这类飞行，总是偏重一些更好，因为通常我们的客户在投入服务后很快就会要求增加MTOW。这种方法可以避免后续启动新的测试，甚至可能导致进一步修改法则。此外，需要足够的燃油才能飞往法国南部的伊斯特雷斯空军基地执行所有测试。选择伊斯特雷斯机场进行这次飞行是因为其5000米的跑道长度，这使得我们能够在每次起飞后高效地进行超重着陆，而不会使刹车过热。这些着陆增加了测试的难度。

该法则开发一结束，立即开始了与EASA机组人员合作的起飞距离测量飞行。

着陆俯仰法则

俯仰法则在着陆阶段的开发进展相当迅速。从一开始，我们就意识到A380的着陆非常容易。然而，针对不同的飞行条件——重量和重心位置——需要进行一些调整。在飞行部分，由于操纵被认为稍微过于灵敏，因此进行了初步的调校。

但最主要的修改是取消了A340和A330上所采用的“防后仰”法则。在这些机型上，当主轮触地时，该法则立即启动，帮助飞行员控制俯仰姿态，直到前轮接地。该法则在A320系列上并不存在，而是在A340研发过程中安装的，因为在一次演示飞行中，一位航空公司飞行员在这一飞行阶段遇到了驾驶员诱发振荡（PIO）。原因是A340以相当大的俯仰姿态接地，且落在转向架后轮上处于“抬头”位置。再加上前轮的接地是以轻微的低头姿态完成的。前轮以及显然包括飞行员在内，必须在着陆时从相对较高的高度“下降”。这个“防后仰”法则在该阶段降低了操纵杆在俯仰方向的权限，以便能够平稳地将前起落架控制接地，且无PIO风险。

出于预防措施，A380上也安装了类似的法则，尽管A380实际上并不具备A340的任何特征。在所有情况下，该法则的启动时间仅为两三秒，因此可能毫无用处。2006年5月，在1号机的第221次飞行中，我们利用调校进近和着陆阶段俯仰法则的机会，做出了取消该法则的决定，并在此阶段保持拉平法则启动。经过多次着陆后，证明这是正确的解决方案，此后所有着陆均采用这一修改后的法则，以确保没有不利影响。

随后，对进近和拉平法则进行了一些细微的最终调整。目标是让大多数飞行员满意！这一时期最重要的修改是增加高重量时的俯仰权限，以降低紧急返航时硬着陆的风险。

第二部分将包括侧向法则的开发（“副翼协调”），以及低速和高速保护的调校。

Safety