Since this dangerous high AoA situation is so rare, even a simple rule requiring both AoA sensors to agree that AoA was dangerously high to override the pilot completely solves the problem. Even with just one AoA sensor and a little memory, the simple fact that the system had rolled in so much nose down trim, which should have lowered AoA, with no apparent effect should have clued it into the fact that it’s model of the system was wrong and caused it to stop.
This is not a particularly sophisticated insight. The engineers all knew this when they designined the system. They had a reason for doing it the way they did, though, and that was to slip the new system in a bit under the radar of the FAA. Since the MCAS is required to maintain the stability of the plane at high angle of attack, it should have been certified as a Stability Augmentation System. That would have subjected it to more redundancy requirements and eliminated this failure. The problem was that Boeing wanted the MAX to not require significant training or certification beyond the 737/737NG. A big new Stability Augmentation System would have required extra certification and probably pilot training. Instead, they chose to sort of launder this system through an existing one, the Elevator Feel Shift system. The EFS adds some nose down trim at certain speeds and altitudes to make the 737NG feel like a classic 737.
Since the FAA already determined that the EFS wasn't a stability augmentation system, but it could control the elevator trim, Boeing figured they could piggyback the new MCAS onto it, adding just one new input, the AoA sensor, and no new outputs. Since it only controlled the trim and not the main flight controls, Boeing could keep to its manual control philosophy, and they could slip it through certification. They couldn’t give the computer both AoA inputs, because the air data system is supposed to have two totally independent and manually selectable sets of sensors. If you give a computer both AoA inputs, you lose that redundancy concept.
So why did the EFS system never cause any problems despite having the same lack of redundancy? My guess is that the EFS is essentially an open-loop controller. It applies a fixed amount of forward trim for a given speed/altitude combination. If the pitot/static system goes haywire, the worst that happens is fixed, moderate amount of nose down trim, easily and naturally compensated for by the pilot or autopilot. The MCAS appears to be closed loop in that it will just keep adding more and more nose down trim until the AoA sensor says things are OK again, the pilot pulls its circuit breaker, or the plane smashes into the ocean.
People in the industry blaming the pilots one bit are making a mistake the industry collectively stopped making seventy years ago. We don’t blame the pilot anymore, we blame the system. Given enough time, humans will make any mistake that can be made. If the plane cannot be flown completely safely by significantly below average pilots, it's an unsafe plane. Demanding that the system be safe even with imperfect pilots is why commerical aviation is so amazingly safe today. It’s also ironically why the MCAS is in there in the first place. Boeing could have just put in the manual to never exceed 14 degrees of AoA, and even average pilots would never have a problem. The FAA would never certify such a plane to carry paying passengers with such a limitation though. It would be too dangerous. Eventually someone would screw up and the plane would go out of control, so there had to be a computer to prevent this. As it stands, the plane does not IMO meet certification requirements for the transport category, and the only reason it isn't grounded is because there are literally half a trillion dollars worth of these things in service or on order. I'm racking my brain to think of another single product produced anywhere that is so valuable.