They need to implement triple redundant AOA indicators. It's obscene that these failure modes are even possible much less approved. Knowing there is a disagreement just lets you know you are close to being fucked.
Once the pilot knows there's one bad AOA, they can lock out the bad one as an input to the autopilot/MCAS, or hand fly without automation. Of course this is all a bunch of new software and training though.
The Flight Computer as architected was found to be a single point-of-failure with a catastrophic failure mode with the software as delivered. That's a big fat no-no. Even if it was only under the most unlikely circumstances possible, you don't design a system that can fail that way, even in theory. Murphy is considered to always find a way, so you must be able to survive that casualty.
Therefore, they had to rearchitect the software with greater redundancy, which in aerospace, comes with such a load of verification burden as to be a majority of the work on it's own, especially given as it will almost guaranteed change the operating interface procedurewise in some way for pilots. Throw in the issues getting all international regulators independent buy-in, and fix wish lists, negotiating through those, documenting and publishing training and maintenance material updates...
https://www.seattletimes.com/business/boeing-aerospace/newly...
There were also deeper problems from at least a reading of regulations from my point of view with how interpretations of statutory regulation have evolved, but unfortunately, those are beyond any ability of me to confirm or comment on ongoing developments as a non-industry insider. (Read: practically just me being pissy because no one in the industry except maybe WalterBright has given me a sufficiently convincing reckoning of.) From my recollection of my digging at the time, there were various statutory test criteria that an MCAS-less MAX could not meet, and thus should not have been certified as a civil transport aircraft if evaluated strictly to the statute as written. Obviously, reading of statute doesn't directly translate to 100% accurate assessments of how it is enforced, as they are written to be understood and convey meaning within an intended audience of specialists (which is it's own problem in my opinion), but nevertheless, back in the bad old days, there were quite the number of test pilots who felt that as time went on, the loosening of airworthyness standards from "strictly as written" was resulting in a slippery slope which was resulting in aircraft that were increasingly less capable of being fully understood by pilots, and potentially more dangerous in the event of substantial problems developing with their automation systems.
Obviously, we can see how history resolved that debate, but our forebearer's on the losing side of that argument sadly do win their "I told you so"s.
See the D.P. Davies Interviews with the Royal Aeronautical Society for more on that and some good listening.
https://www.aerosociety.com/news/audio-the-d-p-davies-interv...
https://www.aerosociety.com/news/audio-the-d-p-davies-interv...
The 737 MAX didn't support that as delivered.
Even with the warning (which some US airlines paid for), you couldn't "lock out the bad one" even assuming you knew which one that was (you don't). All you could do is disable the electronic horizontal stabilizer completely, so that MCAS couldn't command it into a dangerous and unrecoverable state.
MCAS has been fixed, in the sense that it won't command continuously bad trim inputs until the aircraft is unrecoverable when bad AOA data is provided, but ultimately the aircraft either needs to be designed around trustworthy AOA data (i.e. triple) or you untrustworthy (i.e. double, even with the warning). Half measures are exactly how we got to this point, with two crashes.
Both answers are actually acceptable. A lot of completely safe aircraft have untrustworthy AOA inputs, the key there though is that automated systems are designed around that assumption. MCAS had too much flight authority to be linked to untrustworthy inputs.
Are you saying that a bad input warning was an optional(paid) extra?
While technically true, that sounds a bit misleading considering that the AOA DISAGREE warning "light" is just a text indicator on the primary flight display: https://www.boeing.com/resources/boeingdotcom/commercial/737...
also they increased the maximum stabilizer angles mcas could command, the review/certification was done with a 0.6 cap (effective but not overwhelming) and on production it was increased on a whopping 2.5 degrees.
it was also meant to be using vertical acceleration to understand whether the plane was actually stalling, but that trigger was removed
it was also supposed to operate slowly enough to let people catch up with its operation and be able to disconnect it in case of a runaway trim, but the increased angle required to move the stabilizer faster
I don't know the exact English term for this kind of iterative failure of people communicating changes to each other assuming they are both fixing a problem, instead making it worse, but it's not just like they were doing half measures, they were each tuning their systems in silos, without considering cross system functionality from each system behavioral changes
https://orangeflighttraining.com.au/images/aviation-AoA-pitc...
Edit: It had 2 AOA sensors but the indicators showing each reading and the disagree light if they differed were optional (https://www.nytimes.com/2019/03/21/business/boeing-safety-fe...)