Hcfyk

Recently we've had the 737-MAX debacle, where it increasingly appears that the MAX on-board MCAS system repeatedly would issue nose-down events, leading to the Lion Air crash, and possibly another

On the Lion Air flight, when the MCAS pushed the jet’s nose down, the captain pulled it back up, using thumb switches on the control column. Still operating under the false angle-of-attack reading, MCAS kicked in each time to swivel the horizontal tail and push the nose down again.

Apparently there is a notification light for MCAS that was an optional package but will now be required.

It reminds me of two other incidents that lead to crashes

1. 
   Air France 447 A330 - A frozen pitot tube caused the computer to switch to Alternate Law 2, which meant that the computer would no longer prevent dangerous flight inputs. While not the same as the MCAS issue, it lead to confusion of the cockpit crew (who had been making maximum nose-up inputs while at TOGA power), and thus the plane crashed due to stall. It was noted that there was nothing direct to alert the pilots that the switch had occurred.


2. 
   Scandanavian Air 751 MD81 - Ice accumulated on the wings. When the plane took off, the ice fell off, striking the engines. The pilots noted the engines were surging and reduced the throttle, but an auto-throttle system not disclosed to the pilots kept increasing power back to full, thus causing engine failure and a crash landing.

Has anyone ever stated why aircraft systems are allowed to make changes without notifying the pilots? Is it something that just hasn't been a large enough problem to address until now?

There is a general design principle, that some, but not all, of the behavior of the flight guidance system or autopilot should be visible to the pilot. Usually automatic engagement or disengagement of a control system is indicated, but sub-modes of these controls or manual changes might be unindicated. That sounds simple and logical, but in reality it's a complex and tricky human factors issue. Displaying too much information to the pilots is just as bad as displaying too little, as too much information can cause them to ignore the most important indicators, like a stick shaker warning about a impending stall.

I know this isn't a very satisfying answer, but it's hard for anyone other than a human factors expert to answer a very general question like this with hard-and-fast rules.

For example, many autopilots will skip the aural warning about disengagement if the disengagement was directly caused by a pilot action. The pilot in this situation only gets a visual indication that AP has changed behavior. This sounds perfect, but on Aeroflot Flight 593 a pilot let his child into the cockpit, who then applied enough pressure on the yoke to disengage the automatic aileron control. There was no warning chime because the disengagement was considered intentional by the autopilot. This was unlike previous planes the pilot had flown, which contributed to the pilot's confusion when the plane began to turn and then go into a sharp bank.

The indicator light you mention for the 737 Max Lion Air crash is for "AoA disagreement", not MCAS engagment as you suggest. While these kinds of AoA indicators are generally considered good ideas, it's still an area of debate how much they'd help confused pilots like in the Lion Air crash or the Air France 447 crash.

Similarly, the quality of indication was not the biggest cause to the accidents you've listed. For example, the Scandinavian Airlines Flight 751 could probably have returned to the airport successfully, but a compressor stall due to ice striking both engines at low altitudes is a bad situation no matter the auto-thrust behavior. Bad sensors and confused pilots can crash a plane with perfectly designed indicators.

Edit: since this answer is getting a lot of attention, I think it's important to note that I don't really cover any special considerations for the edge of the flight envelope, auto-trim vs auto-disengagement vs changing sub-modes, or idiot-proofing of flight systems. I'd love to see this covered in more detail by people with experience.

There are two types of autopilots, one for the behaviour around the CoG and one for control of the CoG, as mentioned in this answer. Also sometimes called Inner Loop and Outer Loop. In short:

1. The F-16 is aerodynamically unstable and has a rapid control system that applies control surface deflections to provide artificial stability. This is done to make the aircraft extremely manoeuvrable. The pilot is deliberately kept unaware of all these rapid control deflections, to them it just appears as if the aircraft is stable. Inner Loop autopilots provide no feedback to the pilots, by design.




2. The automatic pilots that can be set in order to fly to a certain setpoint are Outer Loop control systems. By design, they do provide feedback to the pilot as to what they are doing, so that the pilot can feel and see what sort of inputs are given and can override them if they deem them to be incorrect. The A320 has no means to move the stick, so this feedback cue is unavailable and attention is demanded by alerts.

This article explains the design philosophy of the MCAS system: it was meant as an auto-stabilising feature in a flight state outside the normal envelope - the circumstances Inner Loop control is normally applied in.

So to answer your question: yes, some flight computers do change control surface deflection without notifying the pilots.

In the case of MCAS and the stabilizer control, there is "notification" that the stabilizers are being automatically adjusted in the form of the two wheels on either side of the thrust controls. They spin, have markings, and are very noisy, so the pilots could not have been unaware of them acting. The problem was that the pilots were (apparently) unaware of the possibility of turning off the automatic stabilizer inputs from MCAS and kept trying to manual override the MCAS/stabilizer adjustments. The switches to turn off the stabilizer inputs are right in front of the thrust controls on the co-pilot side.