That when mcas goes nuts, in addition to trying to crash the plane with trim, it's also taking over the throttle, which I believe is a change that was never documented.
MCAS provides a nose-down trim input for just under 9 seconds. On the pre-modification aircraft, there would be a 5 second pause and then, if the triggering condition continued to exist, the process would repeat. That was all it did. Today, it will only activate once and will be disabled if there is a significant disagreement between the left and right AoA data.
On the accident Ethiopian flight, the crew did a LVLCH (level change) departure with the MCP (mode control panel) altitude preselect set to something in the low 20,000's. (I think it was FL230 but don't remember exactly). In this mode, when LVLCH was selected, the auto-throttles go into "N1" mode with Climb N1 selected. In that mode, the auto-throttles set and maintain climb power and the autopilot and flight director command pitch to hold the airspeed that is set in the MCP speed window.
The important thing about this mode is that the auto-throttles will maintain the Climb power setting regardless of how fast the airplane is going.
The Ethiopian pilots never disconnected the auto-throttles (which is on several of the non-normal checklists that would have applied to their situation) and never pulled the thrust levers back. Airspeed reached a peak of nearly 400 KIAS. For reference, Vmo is 340 KIAS. The excessive speed made it more difficult to control the mis-trimmed airplane.
What the NTSB is pointing out is that the simple application of the main electric trim inputs (thumb switches on each yoke) would have stopped MCAS and allowed the pilot to trim-out all of the nose-down trim input that MCAS had made.
On the Lion Air accident flight, the Captain had 21 MCAS activations. When each one occurred, he used his yoke thumb switches to trim back up which stopped the MCAS activation and removed MCAS' invalid trim inputs. After the programed waiting period, MCAS would activate again and each time he responding by trimming up. He could have continued to fly the airplane indefinitely in that condition.
His (relatively inexperienced) F/O couldn't find the checklist in the QRH (quick reference handbook) so the Captain transferred control of the airplane to the F/O so that the Captain could find the checklist. When he made that transfer, the Captain failed to tell the F/O that he was repeatedly having to trim the nose up and that the airplane was repeatedly trimming it back down again. The F/O had 5 additional MCAS activations while he was flying. He stopped the first 4 but didn't trim out the nose-down inputs that MCAS had made so the aircraft's trim moved progressively toward nose-down with each activation. The 5th activation reached the full nose-down position and aircraft control was lost shortly thereafter.
On the Ethiopian Air accident flight the Captain, who was also the flying pilot, seemed focused on engaging the autopilot. He started trying to engage it at 400' on takeoff and continued to retry repeatedly throughout the flight. The 737 A/P will not engage when the airplane is out of trim. That's something that every 737 pilot must know so that we know to trim the airplane before engaging the autopilot during flight. The various checklists that they may have followed all also included the instruction to disconnect the autopilot and auto-throttles as this is one of the first steps in any situation where you have bad data. You don't want the A/P or A/T to follow the bad data and the "A" side, which is the autopilot that the Captain kept trying to engage, was the side with the bad data.
The Ethiopian Air crew stopped MCAS twice. Once when they re-extended the flaps (MCAS is inhibited with flaps extended) and later when they flipped the stab trim cutout switches. In both cases they reversed those actions which allowed MCAS to reactivate. Eventually, they reached full nose-down stabilizer trim at an airspeed over 390 KIAS which made it impossible to maintain control.
What should they have done?
1. Disconnect the autopilot and auto-throttles. This prevents the automation from following the bad data.
2. Fly the airplane. Set a known pitch/power and keep the airplane in-trim with the thumb switches on the yoke. All of that was working.
3. Identify the problem. They had 1 (but not both) stick shakers, an "IAS DISAGREE" message (and different airspeed readings on each primary display), repeated uncommand stabilizer trim movement, and, eventually, an overspeed warning.
Since the airplane was now stable, with one pilot hand-flying, they could have picked any of those checklists to start but the RUNAWAY STABILIZER checklist would have been the best choice since it directly affects control of the flight. It would have quickly led them to disabling the electric trim, and MCAS with it, with the stab trim cutout switches. Even if they started elsewhere, they would have eventually gotten there. As long as the pilot-flying was actually flying the airplane, there wasn't any need to rush, and that flying-pilot should soon realize that the trim keeps running nose-down which would lead them back to the RUNAWAY STABILIZER checklist.
Since there is a standby instrument display, it isn't difficult to figure out which pilot has the good instrument data, and which one doesn't, so that control can be switched to the pilot with good data.
These were not the first accidents that could have been prevented if the pilots prioritized flying the airplane first. My airline has the following printed, in big bold lettering, at the top of our QRC (quick reference checklist) which is the first place we go for an emergency checklist. It is there to remind us what is most important in an emergency.
FLY THE AIRPLANE -- SILENCE THE WARNING -- CONFIRM THE EMERGENCY