My early background was in aircraft instrumentation and later on, after earning a degree in Computer Science, I worked in aerospace for a good number of years, so I feel pretty qualified to comment on this.
The crash of both planes seems to have been caused by faulty Angle of Attack (AOA) information being fed into a computer system which then drove the flight controls to force the nose down in order to avoid a perceived stall.
In my experience, sometimes the pilots would complain that their altimeters were erratic and after investigation we found that the problem was often caused by a dirty AOA probe. How’d we know? We had test equipment that we could hook up and fake out the aircraft by changing the static pressure in the tubing. We would power up the test equipment and simulate an altitude of, say, 10,000 ft., and then engage the computer which made changes to the altimeters. Then we would slowly turn the AOA probe and watch the altimeter. If it’s OK, it will change the altimeter in a controlled steady change. If the AOA probe was dirty, this would suddenly drive the altimeters thousands of feet in one direction and then thousands of feet in the other direction unpredictably. Of course, that’s not good. The point is that a dirty and/or corroded AOA probe can produce WILDLY inaccurate AOA information.
On the 737-Max aircraft they apparently also sent the AOA information to a computer system, which is tied into the autopilot system, which drives the control surfaces and when they got wild AOA information they also got wild control surface changes. The pilots at first turned off the system but then, for some reason, turned it back on and couldn’t recover the 2nd time. I’m not a pilot, but after watching many, many episodes of “Air Disaster” I’ve concluded that a lot pilots today just aren’t very good at flying the plane manually anymore.
Many people have suggested that they should have a backup AOA probe. But with two probes how do you know which one is right and which one is wrong? I suppose you could have a third probe and then “vote” to see which data to use. I think this might lead to more problems than it fixes.
Knowing that the AOA data can be wild at times, I think I would use my computer systems to sample it at, say, 5 times per second. Within 1/5 of a second I think the readings should be pretty close together, within some reasonable limit. If consecutive readings were wildly different I’d try to figure out the real AOA reading, discard the other(s), and raise some sort of fault code in the maintenance records. If it gets too bad, at some point the computer system may have to warn the pilots and shut itself down. My offhand thinking is in terms of perhaps 3-5 seconds.
I’d probably look back farther than just two readings. A mathematician would be good here. There are mathematical techniques that can take a set of input data points and generate a smoothed output. This might be a good place for one of those. Use the smoothed out data in the autopilot system in order to avoid the wild behavior. Perhaps they already did this; I don’t know.
Another thing would be to change out the AOA probes fairly quickly and refurbish them, hopefully before problems occurs. I don’t think we did this in the Air Force but then our pilots had ejection seats.
But every single MAX aircraft already does have two AOA probes. One drives the Captain's instrumentation and one drives the First Officer's side.
Boeing wrote the MCAS software to use just one AOA probe, either the Captain's or the FO's, alternating every other flight. The problem came when Boeing wrote the flight display software, there was supposed to be an error flag "AOA DISAGREE" on the flight display unit if the two AOA sensors disagreed by more than 10 degrees.
However, the way the software was ultimately written, the AOA DISAGREE error flag was only active on those aircraft where the optional AOA display was purchased. If you didn't buy the optional AOA display, you didn't get the AOA DISAGREE warning.
Boeing knew of this problem, and had planned on quietly correcting it in a future software update, but the two crashes occurred, the MAX was grounded, and the whole software error fiasco was exposed.
Boeing's proposed fix to the MAX aircraft is to activate the AOA DISAGREE warning on all aircraft, and to disable MCAS completely if the two AOA probes are in disagreement.
And an erratic altimeter reading would be caused by an obstructed static pressure port, not an AOA probe.