Paweł Kalinowski

2025-01

Software integration with flight simulator for handling qualities assessment — integrated the new autopilot software build into a full-flight-dynamics simulator and ran pilot-in-the-loop evaluation sessions for CAT III autoland.

Challenge: Simulator interface latency introduced a 20ms additional delay not present in the actual aircraft hardware. This made the autopilot oscillatory at certain gain settings in the simulator but acceptable in hardware. Required separate gain sets for simulation and flight — managing the configuration carefully.

Learned: Flight simulator integration testing must account for simulator-specific latencies that do not exist on the real aircraft. Either characterize and compensate for the latency in the simulator model, or maintain explicit separate parameter sets for simulation vs. flight.

2024-05

Autoland mode implementation — designed 3-segment ILS approach control law (localizer, glideslope, flare) with automatic go-around logic. Validated against FAA AC 120-28 CAT III autoland requirements.

Challenge: Flare law gain scheduling with radio altimeter altitude must handle radio altimeter dropouts gracefully. The nominal gain schedule was valid only with a valid RA signal — added a monitor with reversion to a time-based flare law for RA failure cases.

Learned: Safety-critical mode logic must account for sensor failure reversion at every sensor input. Designing for nominal operation first and adding failure modes later always misses cases. Failure mode design must be co-developed with the nominal logic.

2023-09

TargetLink auto-code generation and verification for the autopilot software component — generated C code from Simulink model, performed back-to-back testing, and achieved 100% structural coverage under DO-178C Level B objectives.

Challenge: MC/DC coverage for 3 boolean conditions required test cases that were physically unreachable in simulation — the condition combinations were logically exclusive given aircraft operating constraints. Had to formally justify the infeasibility and document the justification as a deviation in the compliance matrix.

Learned: MC/DC infeasibility justifications must be grounded in formal logic proof, not engineering judgement alone. DER reviewers expect a rigorous argument that the condition combination cannot occur — informal 'it's not physically possible' statements are rejected.

2023-03

Altitude-hold autopilot mode — designed and implemented the altitude capture and hold control law in Simulink, including mode engagement logic, rate limiting, and altitude error gain scheduling with airspeed.

Challenge: The altitude capture overshoot exceeded the 50ft requirement at high-speed, high-altitude conditions due to integrator windup during the capture phase. Implemented an anti-windup scheme with conditional integration — eliminated the overshoot without degrading steady-state altitude hold accuracy.

Learned: Integrator anti-windup is essential for autopilot mode transitions. The windup problem only appears at certain operating condition corners — comprehensive model-in-the-loop testing across the full flight envelope is necessary, not just design-point verification.