The exceptional situation is defined by a combination of modes belonging to two mode sets :
In the particular accident, the protection was by disabling the throttle, and therefore the pilot was not able to complete the flyover. .
The failure in this case study is attributed to
scenario ambiguity, due to implicit setting of the safety mode.
To enable identification of
scenario mismatch, the
modes should be defined explicitly, and the
Scenario analyzer should verify that they match.
Updated on 17 May 2016.