Rafał Laskowski
Flight Control Software Engineer — Safety Critical · Avionics & Embedded Systems
Warsaw, Poland
Flight Control Software Engineer specializing in DO-178C Level A (DAL A) safety-critical flight control laws written in Ada 2012. Primary responsibility is the stall protection and flight envelope protection system — functions that directly prevent in-flight incidents. Uses Ada/SPARK for formal proof of absence of runtime errors and GNATcoverage for 100% MC/DC structural coverage.
Expertise
- DO-178C Level A safety-critical software
- Ada 2012 programming for avionic systems
- stall protection and envelope protection laws
- formal methods and static analysis
- MCDC and structural coverage for DAL A
Technologies
Work History
2025-02
Regression test campaign after compiler upgrade (GNAT Pro 21 to GNAT Pro 24) — verified that all DAL A functions retained identical behavior after compiler optimization changes. Ran 12,000+ test cases.
Challenge: Two functions produced slightly different floating-point results after the compiler upgrade due to changed instruction ordering in the optimizer. Results were within floating-point epsilon but violated the bit-exact regression requirement. Required compiler flags to lock the floating-point contraction behavior.
Learned: Compiler upgrades for DAL A software require bit-exact regression testing, not just functional testing. Floating-point non-determinism from optimizer changes can violate strict regression requirements even when the numerical difference is negligible.
2024-06
Bank angle protection law — limiting bank angle at low speed and high altitude to prevent loss of lift. Implemented soft-stop progressive force augmentation with hard-stop override prevention. Level A.
Challenge: The soft-stop gain schedule was a 2D table (speed x altitude) with 840 entries. Populating the table with correct values required integration with flight dynamics simulations — any table entry error could cause unsafe bank angle protection behavior.
Learned: Safety-critical gain table generation should be automated from simulation data, not hand-populated. An automated tool that generates the Ada array literal from the flight dynamics simulation output eliminates transcription errors and makes the table regeneratable when requirements change.
2023-10
SPARK 2014 formal verification for the flight envelope protection boundary computation — proved absence of integer overflow, division by zero, and out-of-bounds array access for the alpha and speed limit computation functions.
Challenge: SPARK Prover (GNATprove) failed to discharge 3 proof obligations automatically — required manual addition of loop invariant annotations and range type constraints. Understanding the prover's requirement for explicit invariants was a steep learning curve.
Learned: SPARK proof of absence of runtime errors requires careful type design from the start — constrained integer types with explicit range bounds significantly reduce the burden on the prover. Trying to apply SPARK to unconstrained code after the fact is very painful.
2023-02
Stall protection law implementation in Ada 2012 — high-AOA alpha protection with progressive stick force augmentation and automatic nose-down command at stall warning threshold. DO-178C Level A.
Challenge: Achieving 100% MC/DC on the stall protection engagement condition required 18 test cases for a 5-condition boolean expression. Several infeasible condition combinations required formal justification. DER initially rejected one justification — required a formal proof using predicate logic to demonstrate infeasibility.
Learned: For DAL A MC/DC infeasibility justifications, predicate logic proofs are the only DER-acceptable form of argument. Engineering narratives like 'this condition cannot physically occur' are insufficient — write the formal proof or restructure the code to eliminate the infeasible condition.