Really there should just have been a separate cutout for MCAS itself, but that would have triggered retraining requirements, so Boeing wanted to avoid that. But very simply, there should just be an 'off' switch to disable this system if it starts to run away, distinct from the whole runaway trim procedure.
(as well as 2-of-3 redundancy on the sensors, the lack of redundancy is seriously exacerbating the rate of incorrect MCAS system activations)
Well, not quite: if they wanted it to protect against stalls at very low altitude, it would be operational with flaps extended.
The faulty AoA sensor is causing the plane to think it’s about to stall and therefore MCAS works as designed to prevent the pilot from putting the plane into a stall.
Of course the design is wrong because the plane is actually pointing toward the ground and MCAS thinks it’s pointing to the sky...
Maybe a bit like a self driving car planes will eventually have a system where they can use visual markers as a check on what sensors are reporting.
The 737 max was designed to not be any different to fly than previous 737s, so adding a button to disable this system was not allowed as I understand it.
As these two tragic accidents have made clear that specification was pretty wrongheaded...
Besides adding the AoA disagree light AND having MCAS use a triple AoA sensor vote to determine the AoA angle.
MCAS is disabled while flaps are extended. It would have activated the second they retracted the flaps.
[0] Appendix 1, 05:40:30 (You can see the AND command being canceled by the pilots manual electric ANU command)
It seems they tried it but MCAS kicked 5 seconds after they turned on the electrical trim. They didn't have enough time to correct the stabilizer. I don't know how fast returning a stabilizer to neutral position can be done, but they probably thought they had more than 5 seconds. They were probably going to turn off electronic trim control afterwards.