In the case of a disagreement between the AoA sensors, the obviously correct thing to do is for the computer to disable MCAS and put up a warning light. The conditions MCAS addresses only happen when the AoA gets very high, such as in a slow speed over banked turn. The plane is stable in normal operation.
Think of how a human would react: One sensor says everything is normal. The other says a very rare emergency situation is occurring. Since the sensors disagree, you know one of them is defective and wrong. Applying a very rarely needed emergency correction when you know that you have a sensor fault is not reasonable.
Even applying the stick shaker is confusing to the pilots and dangerous. Much more appropriate is a warning light of a sensor malfunction/MCAS disabled. Then the pilots must simply be extra careful to not make overly banked turns for the remainder of the flight, and replace the sensor on landing.
> the obviously correct thing to do is for the computer to disable MCAS and put up a warning light.
The only problem with that is that problems rarely happen isolation, and you have to consider whether the pilots are going to notice the warning in the midst of several others and if they are going to give it the appropriate priority and consideration while flying.
> Think of how a human would react
That's exactly it, though.. look at Air France 447. The system automatically disabled itself and put the plane into an "alternative law." All automatically. The pilots did _not_ notice this, and still flew the plane into the ocean even though they had several minutes to work the problem.
It's not that simple.
> Even applying the stick shaker is confusing to the pilots and dangerous.
All evidence to the contrary. The stick shaker is an amazing safety device because it demands priority of consideration. It's not going to get lost in the noise of a degrading cockpit. Seriously, go listen to some cockpit voice recorders of a disaster.. it's never what you would expect.
Problems usually happen in isolation. Your dataset is skewed because you've read a bunch of accident reports. When there are multiple failures together, this is much more likely to lead to an accident. When there's just a single problem and it's handled with no loss of life, they don't write a report about it.
I agree, the stick shaker gets a pilot's attention. What the stick shaker tells the pilot is that he's about to stall, but that's not what was happening. Shaking the stick is loudly yelling false information at the pilot!
Let's look at the epistemology here. If we're only looking at the two AoA indicators, and one reads 5 degrees and the other reads 25 degrees, we know that there has been a sensor failure. All you can say that the airplane does not know what its angle of attack is. That's fine though, we've been flying planes for a hundred years without AoA indicators, even ones that had way worse pitch instabilities than the 737MAX. If the airplane doesn't know the angle of attack, there is no reason for it to activate the stick shaker, put in nose down trim, or do anything else except to calmly notify the pilots that AoA is unavailable and therefore MCAS is disabled. All the pilots need to do then is fly the plane normally and not do any crazy banked turns or extremely abrupt pullups at low speed. It's definitely wrong for the plane to start dialing in nose down trim "just in case", because the "just in case" can kill you if it's not necessary!
On AF447, there were as usual, a lot of mistakes made. One problem clearly though was that the plane was giving the pilots a lot of conflicting information that confused them. If the plane was seeing three different airspeeds, the best thing for it to do would have been to put a big red X over the airspeed tape and let them fly by pitch and power. This is exactly why a lot of instrument pilots in older smaller planes carry a little instrument cover. If say your AI fails in IMC, you don't want to see the wrong indication at all, so you cover it up and use your other instruments. Seeing a wrong indication, even if you know it's wrong is very confusing and can lead people to make errors in reasoning, especially in a stressful situation.
Think of how a human would react: One sensor says everything is normal. The other says a very rare emergency situation is occurring. Since the sensors disagree, you know one of them is defective and wrong. Applying a very rarely needed emergency correction when you know that you have a sensor fault is not reasonable.
Even applying the stick shaker is confusing to the pilots and dangerous. Much more appropriate is a warning light of a sensor malfunction/MCAS disabled. Then the pilots must simply be extra careful to not make overly banked turns for the remainder of the flight, and replace the sensor on landing.