Wiedehopf, #1466, gbnf, et al. Your discussion focuses on a single aspect; consider the overall situation.
An AoA probe malfunction may give indications, individually or collectively, of stickshaker (on one side), erroneous low speed display, nose down trim, IAS disagree, ALT disagree (AOA disagree if display option fitted), FEEL DIF PRESS alert.
A crews’ perception of these aspects is likely to differ; only PF feels trim change (note FEEL alert), but more likely the stick shaker will be prioritised, particularly as the direction of change is nose down, which is the required corrective action.
Both crew should be alerted by central warnings; the display order might suggest priority; IAS disagree as the first line of thought, consider a drill for UAS (has IAS failed and the aircraft stalled). Other alerts add confusion, distract / limit understanding the overall situation.
The critical issue is when the crew appreciate that control is the dominant problem, and thereafter that trim is contributing.
A significant aspect is the airspeed at which the malfunction occurs. If at high speed (climb), then the amount of trim movement, more likely optimised for low speed situations (9sec), could result in considerable nose down stick force requiring great effort for recovery (not forgetting that this might contradict thoughts about stickshake - cognitive dissidence). Manual trim would cut out MCAS, but would a crew keep on trimming nose up - debatable - as we shouldn’t fly with trim, non SOP (more dissonance, breaking rules)
It could be concluded that the crew would be totally focussed on the control issue - #1 ‘fly the aircraft’, and only later deduce a trim problem from the intermittent MCAS command, - this takes time. No doubt there are as many different interpretations as there are posts, but we don’t know which one the crew had.
Other posts have questioned the use of single source AoA. In some aircraft (737 config no known), a single AoA malfunction could result in a stickshake in isolation. The certification safety case probably concluded that this was not a hazardous misleading indication, particularly as there was no change in flight path, nor speed display.
The discussion re MCAS is if that safety case was made on the same assumption (not hazardous), if so this accident (and other events) indicate otherwise, or if not (AoA malfunction could result in a hazardous situation), then the system’s integrity appears insufficient for the AoA failure.
For those who like to consider design judgement, there is an example in
OODA Learning Activity
With respect to the Double Loop Learning diagram, the critical ‘grey box’ is overcoming Defensive Reasoning; perhaps something now a problem at corporate level.