Correct, there was probably a significant amount of simulator testing. Keep in mind that these kinds of simulators use real hardware and the avionics are being given inputs just like in the aircraft (i.e. the GPS antenna is simulated, but GPS inputs and uncertainty propagate through the system just like in the actual aircraft)

Most likely there is a test mode that raises the altitude floor/projected flight path at which it takes over. You could then perform the level-off at a safer altitude.

Yes. From what I heard when working at Saab (which makes sytems like this), it is a very... memorable... experience sitting in the second seat of a fighter aircraft when the pilot demonstrates this capability.

Altitude above sea level is absolute, whereas your altitude above ground depends on the terrain.

So maybe one way to test this on a real plane would be to trick the software into thinking the terrain is 5000 feet higher than it is. Then it can execute the maneuver against a safe fake "ground", still giving the test pilot time to intervene if it doesn't work properly.

Test pilots have done much more dangerous things. The pilot still has time to recover from a faux "uncontrolled" descent if the system appears to not work.

NASA Armstrong led the effort and have a decent little microsite describing the history with some videos of the testing:

https://www.nasa.gov/offices/ipp/centers/dfrc/technology/DRC...

Essentially what you'd expect, in software then models then UAVs then full-scale planes with test pilots and finally roll-out to service aircraft.

A couple different options come to mind. a) The recovery level here is enough that a test pilot would have time to still recover after the software should have recovered. b) The terrain height is pulled from a database based on the position so you could fake the software to adding more space to recover by adding a test area in the database where terrain is at 15000 feet.