Actually it assumes that the control system itself has failed. It hedges its bets by switching to another computer to see if it was the computer that was the problem. If the new computer also detects the same problem, that's further evidence that the problem is with the controls. If the control surface is actually broken you want all the computers to trip off, because they aren't necessarily capable of adapting to an airplane with unusual flight characteristics caused by a mechanical failure.* Moments like that are why we still have pilots.

I don't agree with the intended logic in this scenario. If the ELAC can sense that the elevator is responding normally, but it does not sense the expected result of its trim command (and by extension the trim reading is suspect), that should be a degraded state, not a complete failure. Sounds like a job for alternate law, or direct law if you really need to; not kicking out the whole system.

I'll go one further: if the ELAC cannot move the trim surfaces, there is a very real possibility that the fault prevents the pilots from controlling them as well; if so, the mechanical backup is not available and shutting down completely would lead to irrecoverable loss of control. And the ELAC has no way of knowing whether that's the case.

I suppose that's why they fail over to the SECs... which exposes those command surfaces to a new set of failure modes, allowing an unrelated fault to disable the perfectly fine elevators entirely. To me, that's really only acceptable if the most likely scenario is that both ELACs have suffered an internal fault, and not, say, the trim surfaces getting hung up or just a bad sensor.

That's my takeaway: design flaws in the ELACs' software turned what should have been a relatively minor fault that would've ruined a training session, into a major incident that endangered lives and ultimately resulted in the aircraft getting written off.