fgrieu, #1, medod, #4,
The basic aircraft was certificated on the basis of MCAS. The theory and inservice experience confirmed that this option is satisfactory, excepting for AoA malfunction.
Thus the approval to fly again depends on the robustness of the changes to protect the system from AoA malfunction; evaluated as required against existing requirements and recommendations from accident investigations.
Technically the second iteration of modification appears to be satisfactory. However, there appears to be issues with pilot interaction, using checklists, presumably after the system has failed safe, #3 considers these.
The aircraft is not inherently unstable; there is a reduction in stability margin in small areas of the flight envelope, which MCAS alleviates.
There should not be any significant concerns about abnormal flight without MCAS - after an inhibit - an assumption. The aircraft has ‘normal’ stability characteristic in most areas of the flight envelope - as demonstrated with lengthy time in service - but how often did MCAS work. Crews can be alerted to the need for care in the less stable ‘corner points’ when flying without MCAS.
The remaining oddity is trim. Historically the 737 trim has been ‘different’, which has changed (for the worse) with series development - extensive tech log discussion.
In the NG, a trim runaway appears to be acceptable, but depends on quick pilot reaction - trim inhibit, and as a last resort a yo-yo recovery manoeuvre (not in all situations - certification probability argument for acceptability).
The Max might have crossed the boundary of acceptability for timely pilot intervention and/or an increased need for, or impractical yo-yo.
How far does the trim run before MCAS shuts down, is this offset acceptable in every possible part of the flight envelope; with consideration of the variability and physical range of human ability to operate the trim wheel, (5sec ?)
How does a non MCAS Max differ from the NG; do aerodynamic differences effect the ability to trim with the wheel ?
The certification requirements involve judgement of how much piloting contribution can be assumed towards mitigating failures - with all alerted conditions coincident with, and consequential to an AoA failure. Whatever ‘piloting’ arguments have been used for NG have been negated by the two accidents in the Max; thus assessments are now clean sheet reappraisals by an authority under national and international pressure to demonstrate the highest quality processes.