Originally Posted by
SteinarN
And at the same time Boeing obviously did NOT expect the pilots do diagnose a correct MCAS activation in a real high AOA event as trim runaway. How did Boeing figure this out, that the pilots would ONLY diagnose an erroneous MCAS activation as trim runaway and not diagnose a correct MCAS activation as trim runaway?
This point has been raised before, but your comment highlights the reality that the original MCAS design was not thought through from beginning to end result, in terms of a flow-chart or decision-tree. You could write a whole essay about erroneous assumptions, but hopefully the bugs have been sorted out by now. Even when 'fixed' MCAS remains a band-aid, and violates many of the tenets of manual versus automated systems. The mere fact that there is no indication when the system is active, compounds the bad ergonomics. Pilots can't be expected to fly manually, and at the same time monitor what the computer may be doing wrong in the background.
To give a legalistic answer to your question: The intent was that MCAS would very rarely activate in normal passenger flight, and IMO it was a 'regulatory' solution, not a realistic requirement. The erroneous activation of MCAS due to a faulty AOA sensor was simply not on the radar, and I don't think there was a conscious tradeoff such as you suggest.
Something that I raised previously, is that both crashes happened during daytime VFR conditions. The worst-case scenario of faulty AOA sensor and MCAS activation during night IFR conditions, along with somatogravic illusion, would have made the crew workload immeasurably harder. I wonder if any of those cases were tested in a simulator?