>When designing a critical system such as an aircraft, you must include human authority into it

This is where Boeing messed up big time. According to the article they only had 2 AoA sensor, completely missing the fact that what happens if one sensor fails and which is correct. Airbus has 3, but IMO a critical component like an AoA sensor there should be 5 + additional inputs from the artificial horizon should be considered.

>You cannot design an unoverrideable automatic mechanism.

Yes, it makes sense. Even a complete automatic mechanism would need functionality to override in case things go completely haywire.