DonH
If I may be permitted to wander slightly, the "possibility-potential", (
possibilistic thinking, according to
Lee Clarke), is what facilitates this thinking. To me anyway, the difficulty for the designers and the engineers becomes making an assessment between two polar opposites - What's probable?, vice What's possible? The question goes beyond "excusing or blaming" - it's just trying to find out what the causal pathway (to which you referred) was; in the case of AF447 I think we have it.
It seems to me as a retired pilot, that in terms of the designer/engineer's work (speaking specifically of Airbus), we can only say that the approach was(is) sufficiently cognizant to consider and expect that an airline pilot would be trained against, and would avoid-like-the-plague, stalling his/her aircraft and would understand those circumstances which would lead to stall entry.
As a retired designer, I have to agree with your assessment here. In order to design an aircraft one has to make certain assumptions. One of those is that the pilots will fly like - errr well like pilots actually
One assumes that flying to respect the techniques and limits prescribed for the airplane will be the norm, but one must also recognise that techniques will not be followed exactly and limits not strictly respected. The problem is to know, or guess, the magnitude of these deviations that must be safely available.
Would you, for example, have predicted the AF447 actions? Or would you have imagined, when designing the autobrake logic that an aircraft might be landed on a flooded runway, with worn tyres, 29 kts above Vref in a 15 kt tailwind and put down with a long flare?
It is always easier to make these flights of imagination with hindsight
